Change from basic auth to header authentication

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.dockerignore

@@ -7,3 +7,4 @@
 !entrypoint.sh
 !healthcheck.sh
 !.healthcheck.env
+!dist/public_html/

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -29,9 +29,9 @@ body:
     id: 'version'
     attributes:
       label: |
-      	Version
+        Version
       description: |
-      	What version(s) of Authelia can you reproduce this bug on?
+        What version(s) of Authelia can you reproduce this bug on?
       multiple: true
       options:
         - 'v4.37.5'
@@ -76,9 +76,9 @@ body:
     id: 'deployment'
     attributes:
       label: |
-      	Deployment Method
+        Deployment Method
       description: |
-      	How are you deploying Authelia?
+        How are you deploying Authelia?
       options:
         - 'Docker'
         - 'Kubernetes'
@@ -90,9 +90,9 @@ body:
     id: 'proxy'
     attributes:
       label: |
-      	Reverse Proxy
+        Reverse Proxy
       description: |
-      	What reverse proxy are you using?
+        What reverse proxy are you using?
       options:
         - 'Caddy'
         - 'Traefik'
@@ -108,9 +108,9 @@ body:
     id: 'proxy-version'
     attributes:
       label: |
-      	Reverse Proxy Version
+        Reverse Proxy Version
       description: |
-      	What is the version of your reverse proxy?
+        What is the version of your reverse proxy?
       placeholder: 'x.x.x'
     validations:
       required: false
@@ -118,36 +118,36 @@ body:
     id: 'description'
     attributes:
       label: |
-      	Description
+        Description
       description: |
-      	Describe the bug.
+        Describe the bug.
     validations:
       required: true
   - type: 'textarea'
     id: 'reproduction'
     attributes:
       label: |
-      	Reproduction
+        Reproduction
       description: |
-      	Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved.
+        Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved.
     validations:
       required: true
   - type: 'textarea'
     id: 'expectations'
     attributes:
       label: |
-      	Expectations
+        Expectations
       description: |
-      	Describe the desired or expected results.
+        Describe the desired or expected results.
     validations:
       required: false
   - type: 'textarea'
     id: 'configuration'
     attributes:
       label: |
-      	Configuration (Authelia)
+        Configuration (Authelia)
       description: |
-      	Provide a complete configuration file (the template will automatically put this content in a code block).
+        Provide a complete configuration file (the template will automatically put this content in a code block).
       render: 'yaml'
     validations:
       required: false
@@ -155,7 +155,7 @@ body:
     id: 'logs'
     attributes:
       label: |
-      	Logs (Authelia)
+        Logs (Authelia)
       description: |
         Provide complete logs with the log level set to debug or trace. Complete means from application start until the issue occurring. This is clearly explained in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section of the troubleshooting guide.
 
@@ -167,9 +167,9 @@ body:
     id: 'logs-other'
     attributes:
       label: |
-      	Logs (Proxy / Application)
+        Logs (Proxy / Application)
       description: |
-      	Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block).
+        Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block).
       render: 'shell'
     validations:
       required: false
@@ -177,38 +177,38 @@ body:
     id: 'documentation'
     attributes:
       label: |
-      	Documentation
+        Documentation
       description: |
-      	Provide any relevant specification or other documentation if applicable.
+        Provide any relevant specification or other documentation if applicable.
     validations:
       required: false
   - type: 'checkboxes'
     id: 'checklist'
     attributes:
       label: |
-      	Pre-Submission Checklist
+        Pre-Submission Checklist
       description: |
-      	By submitting this issue confirm all of the following.
+        By submitting this issue confirm all of the following.
       options:
         - label: |
-        	I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
+            I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
           required: true
         - label: |
-        	This is a bug report and not a support request
+            This is a bug report and not a support request
           required: true
         - label: |
-        	I have read the security policy and this bug report is not a security issue or security related issue
+            I have read the security policy and this bug report is not a security issue or security related issue
           required: true
         - label: |
-        	I have either included the complete configuration file or I am sure it's unrelated to the configuration
+            I have either included the complete configuration file or I am sure it's unrelated to the configuration
           required: true
         - label: |
-        	I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide
+            I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide
           required: true
         - label: |
-        	I have checked for related proxy or application logs and included them if available
+            I have checked for related proxy or application logs and included them if available
           required: true
         - label: |
-        	I have checked for related issues and checked the documentation
+            I have checked for related issues and checked the documentation
           required: true
 ...

.github/ISSUE_TEMPLATE/feature-request.yml

@@ -20,50 +20,50 @@ body:
     id: 'description'
     attributes:
       label: |
-      	Description
+        Description
       description: |
-      	Describe the feature
+        Describe the feature
     validations:
       required: true
   - type: 'textarea'
     id: 'use-case'
     attributes:
       label: |
-      	Use Case
+        Use Case
       description: |
-      	Provide a use case
+        Provide a use case
     validations:
       required: true
   - type: 'textarea'
     id: 'details'
     attributes:
       label: |
-      	Details
+        Details
       description: |
-      	Describe the feature in detail
+        Describe the feature in detail
     validations:
       required: false
   - type: 'textarea'
     id: 'documentation'
     attributes:
       label: |
-      	Documentation
+        Documentation
       description: |
-      	Provide any relevant specification or other documentation if applicable
+        Provide any relevant specification or other documentation if applicable
     validations:
       required: false
   - type: 'checkboxes'
     id: 'checklist'
     attributes:
       label: |
-      	Pre-Submission Checklist
+        Pre-Submission Checklist
       description: |
-      	By submitting this issue confirm all of the following
+        By submitting this issue confirm all of the following
       options:
         - label: |
-        	I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
+            I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
           required: true
         - label: |
-        	I have checked for related issues and checked the documentation
+            I have checked for related issues and checked the documentation
           required: true
 ...

Dockerfile

@@ -1,7 +1,7 @@
 # ===================================
 # ===== Authelia official image =====
 # ===================================
-FROM alpine:3.18.0
+FROM alpine:3.18.2
 
 ARG TARGETOS
 ARG TARGETARCH

Dockerfile.coverage

@@ -15,7 +15,7 @@ RUN yarn global add pnpm && \
 # =======================================
 # ===== Build image for the backend =====
 # =======================================
-FROM golang:1.20.4-alpine AS builder-backend
+FROM golang:1.20.5-alpine AS builder-backend
 
 WORKDIR /go/src/app
 
@@ -46,7 +46,7 @@ RUN \
 # ===================================
 # ===== Authelia official image =====
 # ===================================
-FROM alpine:3.18.0
+FROM alpine:3.18.2
 
 RUN apk --no-cache add ca-certificates tzdata
 

Dockerfile.dev

@@ -13,7 +13,7 @@ RUN yarn install --frozen-lockfile && yarn build
 # =======================================
 # ===== Build image for the backend =====
 # =======================================
-FROM golang:1.20.4-alpine AS builder-backend
+FROM golang:1.20.5-alpine AS builder-backend
 
 WORKDIR /go/src/app
 
@@ -43,7 +43,7 @@ RUN \
 # ===================================
 # ===== Authelia official image =====
 # ===================================
-FROM alpine:3.18.0
+FROM alpine:3.18.2
 
 WORKDIR /app
 

MyNotes.md

@@ -0,0 +1,95 @@
+# Ausführen
+
+Um die Anwendung lokal auszuführen, können die folgenden Befehle verwendet werden.
+
+```
+export GOPATH=/tmp
+source bootstrap.sh
+authelia-scripts suites setup Standalone
+```
+
+Nun sollte der "Haupt-Enpunkt" unter `https://home.example.com:8080` und die API unter `https://authelia.example.com:9091` erreichbar sein. Achtung: es wird ein selbstsigniertes Zertifikat verwendet!
+Mithilfe der Hot-Reload kann jetzt gecoded werden.
+
+---
+
+Nach der Entwicklung kann die Testumgebung durch den folgenden Befehl wieder zurückgesetzt werden. 
+
+```
+go run ./cmd/authelia-scripts/ suites teardown Standalone
+```
+
+## Benutzerdefinierte Zertifikate
+
+Um ein benutzerdefiniertes Zertifikat für die Ausführung zu verwenden, muss die Datai `public.backend.crt` und `private.bakend.pem` unter [diesem](/internal/suites/common/pki/) Verzeichnis abgeändert werden. 
+Um die Gültigkeit zu testen, kann der folgendende Befehl ausgeführt werden.
+
+```
+curl https://auth.rpjosh.de:9091 --connect-to 'auth.rpjosh.de:9091:authelia.example.com:9091'
+```
+
+## Externe erreichbarkeit
+
+Im aktuellen Zustand sind die Endpunkte nur unter den Docker internen IP-Adressen erreichbar. Daher muss noch ein NAT Regel angelegt werden.
+
+```
+ip=$(ping -c 1 authelia.example.com | gawk -F'[()]' '/PING/{print $2}')
+sudo iptables -t nat -A PREROUTING -p tcp --dport 9091 -d 192.168.0.15 -j DNAT --to-destination 192.168.240.50:9091 -m comment --comment "Authelia-Test"
+sudo iptables -t nat -A PREROUTING -p tcp --dport 9092 -d 192.168.0.15 -j DNAT --to-destination 192.168.240.50:9092 -m comment --comment "Authelia-Test"
+sudo iptables -t nat -I OUTPUT -p tcp -o lo --dport 9091 -j DNAT --to-destination 192.168.240.50:9091
+```
+
+# Customizations
+
+Für das Starten des *gRPC* Servers müssen die folgenden Abhängigkeiten installiert werden.
+
+```
+go get github.com/envoyproxy/go-control-plane
+go get github.com/envoyproxy/go-control-plane/envoy/config/core/v3
+go get github.com/gogo/googleapis/google/rpc
+go get google.golang.org/grpc
+```
+
+## Konfiguration ändern
+
+Wenn die Konfiguration geändert wurde, müssen die Keys zur Validierung wieder erneut gebaut werden.
+
+```
+go run ./cmd/authelia-gen code keys
+```
+
+## Mocks abgeändert
+
+Wenn interfaces von den Mocks geändert werden, muss folgendes wieder ausgeführt werden:
+
+```
+export PATH=$PATH:$(go env GOPATH)/bin
+go generate ./...
+```
+
+## Bauen
+
+Um ein Docker Image für authelia zu bauen, müssen die folgenden Befehle ausgeführt werden.
+
+```sh
+# Dieser Befehle funktionieren aktuell nicht 
+authelia-scripts docker build
+authelia-scripts build
+
+# => Manuell bauen
+export CC=musl-gcc
+
+authelia-scripts build
+cp -r dist/public_html internal/server/
+go build -buildmode=pie -ldflags "-linkmode=external -s -w" -trimpath -buildmode=pie -o authelia ./cmd/authelia
+mv authelia authelia-linux-amd64-musl
+# Build docker image
+docker build --tag git.rpjosh.de/rpjosh/authelia/authelia:4.38.0-dev .
+docker push git.rpjosh.de/rpjosh/authelia/authelia:4.38.0-dev
+# Cleanup
+rm -rf internal/server/public_html/ ./authelia-linux-amd64-musl
+```
+
+# gRCP
+
+Um einen gRCP Endpunkt nutzen zu können, brauch mein eine *.proto* Datei. Für Envoy sieht diese wie in [dieser Datei](/ext-auth.proto) folgendermaßen aus.

cmd/authelia-gen/cmd_root.go

@@ -61,6 +61,24 @@ func rootSubCommandsRunE(cmd *cobra.Command, args []string) (err error) {
 		return err
 	}
 
+	subCmds := sortCmds(cmd)
+
+	for _, subCmd := range subCmds {
+		if subCmd.Use == cmdUseCompletion || strings.HasPrefix(subCmd.Use, "help ") || utils.IsStringSliceContainsAny([]string{resolveCmdName(subCmd), subCmd.Use}, exclude) {
+			continue
+		}
+
+		rootCmd.SetArgs(rootCmdGetArgs(subCmd, args))
+
+		if err = rootCmd.Execute(); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func sortCmds(cmd *cobra.Command) []*cobra.Command {
 	subCmds := cmd.Commands()
 
 	switch cmd.Use {
@@ -90,19 +108,7 @@ func rootSubCommandsRunE(cmd *cobra.Command, args []string) (err error) {
 		})
 	}
 
-	for _, subCmd := range subCmds {
-		if subCmd.Use == cmdUseCompletion || strings.HasPrefix(subCmd.Use, "help ") || utils.IsStringSliceContainsAny([]string{resolveCmdName(subCmd), subCmd.Use}, exclude) {
-			continue
-		}
-
-		rootCmd.SetArgs(rootCmdGetArgs(subCmd, args))
-
-		if err = rootCmd.Execute(); err != nil {
-			return err
-		}
-	}
-
-	return nil
+	return subCmds
 }
 
 func resolveCmdName(cmd *cobra.Command) string {
@@ -117,7 +123,7 @@ func resolveCmdName(cmd *cobra.Command) string {
 
 func rootCmdGetArgs(cmd *cobra.Command, args []string) []string {
 	for {
-		if cmd == rootCmd {
+		if cmd == nil || cmd == rootCmd {
 			break
 		}
 

cmd/authelia-gen/cmd_root_test.go

@@ -0,0 +1,125 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestResolveCmdName(t *testing.T) {
+	testCases := []struct {
+		name     string
+		have     *cobra.Command
+		expected string
+	}{
+		{
+			"ShouldResolveRootCmd",
+			newRootCmd(),
+			"authelia-gen",
+		},
+		{
+			"ShouldResolveDocsCmd",
+			newDocsCmd(),
+			"docs",
+		},
+		{
+			"ShouldResolveDocsSubCmd",
+			newRootCmd().Commands()[0].Commands()[0],
+			"code.keys",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.expected, resolveCmdName(tc.have))
+		})
+	}
+}
+
+func TestRootCmdGetArgs(t *testing.T) {
+	testCases := []struct {
+		name     string
+		have     func() *cobra.Command
+		args     []string
+		expected []string
+	}{
+		{
+			"ShouldReturnRootCmdArgs",
+			func() *cobra.Command {
+				cmd := newRootCmd()
+
+				cmd.SetArgs([]string{"a", "b"})
+
+				return cmd.Commands()[0]
+			},
+			[]string{"c", "d"},
+			[]string{"authelia-gen", "code", "c", "d"},
+		},
+		{
+			"ShouldReturnRootCmdWithoutArgs",
+			func() *cobra.Command {
+				cmd := newRootCmd()
+
+				return cmd.Commands()[0]
+			},
+			nil,
+			[]string{"authelia-gen", "code"},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.expected, rootCmdGetArgs(tc.have(), tc.args))
+		})
+	}
+}
+
+func TestSortCmds(t *testing.T) {
+	testCases := []struct {
+		name     string
+		have     *cobra.Command
+		expected []string
+	}{
+		{
+			"ShouldSortRootCmd",
+			newRootCmd(),
+			[]string{"code", "commit-lint", "github", "locales", "docs"},
+		},
+		{
+			"ShouldSortDocsCmd",
+			newDocsCmd(),
+			[]string{"cli", "data", "date"},
+		},
+		{
+			"ShouldSortGitHubCmd",
+			newGitHubCmd(),
+			[]string{"issue-templates"},
+		},
+		{
+			"ShouldSortLocalesCmd",
+			newLocalesCmd(),
+			nil,
+		},
+		{
+			"ShouldSortDocsDataCmd",
+			newDocsDataCmd(),
+			[]string{"keys", "misc"},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			actual := sortCmds(tc.have)
+
+			n := len(tc.expected)
+
+			require.Len(t, actual, n)
+
+			for i := 0; i < n; i++ {
+				assert.Equal(t, tc.expected[i], actual[i].Use)
+			}
+		})
+	}
+}

cmd/authelia-gen/helpers_test.go

@@ -0,0 +1,145 @@
+package main
+
+import (
+	"net/mail"
+	"reflect"
+	"testing"
+
+	"github.com/spf13/pflag"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/authelia/authelia/v4/internal/configuration/schema"
+)
+
+func TestGetPFlagPath(t *testing.T) {
+	testCases := []struct {
+		name     string
+		have     func(t *testing.T) *pflag.FlagSet
+		names    []string
+		expected string
+		err      string
+	}{
+		{
+			"ShouldFailEmptyFlagSet",
+			func(t *testing.T) *pflag.FlagSet {
+				return pflag.NewFlagSet("example", pflag.ContinueOnError)
+			},
+			[]string{"abc", "123"},
+			"",
+			"failed to lookup flag 'abc': flag accessed but not defined: abc",
+		},
+		{
+			"ShouldFailEmptyFlagNames",
+			func(t *testing.T) *pflag.FlagSet {
+				return pflag.NewFlagSet("example", pflag.ContinueOnError)
+			},
+			nil,
+			"",
+			"no flag names",
+		},
+		{
+			"ShouldLookupFlagNames",
+			func(t *testing.T) *pflag.FlagSet {
+				flagset := pflag.NewFlagSet("example", pflag.ContinueOnError)
+
+				flagset.String("dir.one", "", "")
+				flagset.String("dir.two", "", "")
+				flagset.String("file.name", "", "")
+
+				require.NoError(t, flagset.Parse([]string{"--dir.one=abc", "--dir.two=123", "--file.name=path.txt"}))
+
+				return flagset
+			},
+			[]string{"dir.one", "dir.two", "file.name"},
+			"abc/123/path.txt",
+			"",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			actual, theError := getPFlagPath(tc.have(t), tc.names...)
+
+			if tc.err == "" {
+				assert.NoError(t, theError)
+				assert.Equal(t, tc.expected, actual)
+			} else {
+				assert.EqualError(t, theError, tc.err)
+				assert.Equal(t, "", actual)
+			}
+		})
+	}
+}
+
+func TestBuildCSP(t *testing.T) {
+	testCases := []struct {
+		name     string
+		have     string
+		ruleSets [][]CSPValue
+		expected string
+	}{
+		{
+			"ShouldParseDefault",
+			codeCSPProductionDefaultSrc,
+			[][]CSPValue{
+				codeCSPValuesCommon,
+				codeCSPValuesProduction,
+			},
+			"default-src 'self'; frame-src 'none'; object-src 'none'; style-src 'self' 'nonce-%s'; frame-ancestors 'none'; base-uri 'self'",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.expected, buildCSP(tc.have, tc.ruleSets...))
+		})
+	}
+}
+
+func TestContainsType(t *testing.T) {
+	astring := ""
+
+	testCases := []struct {
+		name     string
+		have     any
+		expected bool
+	}{
+		{
+			"ShouldContainMailAddress",
+			mail.Address{},
+			true,
+		},
+		{
+			"ShouldContainSchemaAddressPtr",
+			&schema.Address{},
+			true,
+		},
+		{
+			"ShouldNotContainString",
+			astring,
+			false,
+		},
+		{
+			"ShouldNotContainStringPtr",
+			&astring,
+			false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.expected, containsType(reflect.TypeOf(tc.have), decodedTypes))
+		})
+	}
+}
+
+func TestReadTags(t *testing.T) {
+	assert.NotPanics(t, func() {
+		readTags("", reflect.TypeOf(schema.Configuration{}), false)
+	})
+
+	assert.NotPanics(t, func() {
+		readTags("", reflect.TypeOf(schema.Configuration{}), true)
+	})
+}

cmd/authelia-gen/templates/github_issue_template_bug_report.yml.tmpl

@@ -29,23 +29,23 @@ body:
     id: 'version'
     attributes:
       label: |
-      	Version
+        Version
       description: |
-      	What version(s) of Authelia can you reproduce this bug on?
+        What version(s) of Authelia can you reproduce this bug on?
       multiple: true
       options:
       {{- range .Versions }}
         - '{{ . }}'
-	  {{- end }}
+      {{- end }}
     validations:
       required: true
   - type: 'dropdown'
     id: 'deployment'
     attributes:
       label: |
-      	Deployment Method
+        Deployment Method
       description: |
-      	How are you deploying Authelia?
+        How are you deploying Authelia?
       options:
         - 'Docker'
         - 'Kubernetes'
@@ -57,9 +57,9 @@ body:
     id: 'proxy'
     attributes:
       label: |
-      	Reverse Proxy
+        Reverse Proxy
       description: |
-      	What reverse proxy are you using?
+        What reverse proxy are you using?
       options:
       {{- range .Proxies }}
         - '{{ . }}'
@@ -70,9 +70,9 @@ body:
     id: 'proxy-version'
     attributes:
       label: |
-      	Reverse Proxy Version
+        Reverse Proxy Version
       description: |
-      	What is the version of your reverse proxy?
+        What is the version of your reverse proxy?
       placeholder: 'x.x.x'
     validations:
       required: false
@@ -80,36 +80,36 @@ body:
     id: 'description'
     attributes:
       label: |
-      	Description
+        Description
       description: |
-      	Describe the bug.
+        Describe the bug.
     validations:
       required: true
   - type: 'textarea'
     id: 'reproduction'
     attributes:
       label: |
-      	Reproduction
+        Reproduction
       description: |
-      	Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved.
+        Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved.
     validations:
       required: true
   - type: 'textarea'
     id: 'expectations'
     attributes:
       label: |
-      	Expectations
+        Expectations
       description: |
-      	Describe the desired or expected results.
+        Describe the desired or expected results.
     validations:
       required: false
   - type: 'textarea'
     id: 'configuration'
     attributes:
       label: |
-      	Configuration (Authelia)
+        Configuration (Authelia)
       description: |
-      	Provide a complete configuration file (the template will automatically put this content in a code block).
+        Provide a complete configuration file (the template will automatically put this content in a code block).
       render: 'yaml'
     validations:
       required: false
@@ -117,7 +117,7 @@ body:
     id: 'logs'
     attributes:
       label: |
-      	Logs (Authelia)
+        Logs (Authelia)
       description: |
         Provide complete logs with the log level set to debug or trace. Complete means from application start until the issue occurring. This is clearly explained in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section of the troubleshooting guide.
 
@@ -129,9 +129,9 @@ body:
     id: 'logs-other'
     attributes:
       label: |
-      	Logs (Proxy / Application)
+        Logs (Proxy / Application)
       description: |
-      	Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block).
+        Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block).
       render: 'shell'
     validations:
       required: false
@@ -139,38 +139,38 @@ body:
     id: 'documentation'
     attributes:
       label: |
-      	Documentation
+        Documentation
       description: |
-      	Provide any relevant specification or other documentation if applicable.
+        Provide any relevant specification or other documentation if applicable.
     validations:
       required: false
   - type: 'checkboxes'
     id: 'checklist'
     attributes:
       label: |
-      	Pre-Submission Checklist
+        Pre-Submission Checklist
       description: |
-      	By submitting this issue confirm all of the following.
+        By submitting this issue confirm all of the following.
       options:
         - label: |
-        	I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
+            I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
           required: true
         - label: |
-        	This is a bug report and not a support request
+            This is a bug report and not a support request
           required: true
         - label: |
-        	I have read the security policy and this bug report is not a security issue or security related issue
+            I have read the security policy and this bug report is not a security issue or security related issue
           required: true
         - label: |
-        	I have either included the complete configuration file or I am sure it's unrelated to the configuration
+            I have either included the complete configuration file or I am sure it's unrelated to the configuration
           required: true
         - label: |
-        	I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide
+            I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide
           required: true
         - label: |
-        	I have checked for related proxy or application logs and included them if available
+            I have checked for related proxy or application logs and included them if available
           required: true
         - label: |
-        	I have checked for related issues and checked the documentation
+            I have checked for related issues and checked the documentation
           required: true
 ...

cmd/authelia-gen/templates/github_issue_template_feature.yml.tmpl

@@ -20,50 +20,50 @@ body:
     id: 'description'
     attributes:
       label: |
-      	Description
+        Description
       description: |
-      	Describe the feature
+        Describe the feature
     validations:
       required: true
   - type: 'textarea'
     id: 'use-case'
     attributes:
       label: |
-      	Use Case
+        Use Case
       description: |
-      	Provide a use case
+        Provide a use case
     validations:
       required: true
   - type: 'textarea'
     id: 'details'
     attributes:
       label: |
-      	Details
+        Details
       description: |
-      	Describe the feature in detail
+        Describe the feature in detail
     validations:
       required: false
   - type: 'textarea'
     id: 'documentation'
     attributes:
       label: |
-      	Documentation
+        Documentation
       description: |
-      	Provide any relevant specification or other documentation if applicable
+        Provide any relevant specification or other documentation if applicable
     validations:
       required: false
   - type: 'checkboxes'
     id: 'checklist'
     attributes:
       label: |
-      	Pre-Submission Checklist
+        Pre-Submission Checklist
       description: |
-      	By submitting this issue confirm all of the following
+        By submitting this issue confirm all of the following
       options:
         - label: |
-        	I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
+            I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
           required: true
         - label: |
-        	I have checked for related issues and checked the documentation
+            I have checked for related issues and checked the documentation
           required: true
 ...

cmd/authelia-gen/templates_test.go

@@ -0,0 +1,13 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestShouldFailToLoadBadTemplate(t *testing.T) {
+	assert.Panics(t, func() {
+		mustLoadTmplFS("bad tmpl")
+	})
+}

cmd/authelia-gen/types.go

@@ -120,6 +120,11 @@ const (
 	labelAreaPrefixStatus   = "status"
 )
 
+type label interface {
+	String() string
+	LabelDescription() string
+}
+
 type labelPriority int
 
 //nolint:deadcode,varcheck // Kept for future use.
@@ -129,6 +134,7 @@ const (
 	labelPriorityMedium
 	labelPriorityNormal
 	labelPriorityLow
+	labelPriorityVeryLow
 )
 
 var labelPriorityDescriptions = [...]string{
@@ -137,14 +143,15 @@ var labelPriorityDescriptions = [...]string{
 	"Medium",
 	"Normal",
 	"Low",
+	"Very Low",
 }
 
-func (p labelPriority) String() string {
-	return fmt.Sprintf("%s/%d/%s", labelAreaPrefixPriority, p+1, strings.ToLower(labelPriorityDescriptions[p]))
+func (l labelPriority) String() string {
+	return fmt.Sprintf("%s/%d/%s", labelAreaPrefixPriority, l+1, labelFormatString(labelPriorityDescriptions[l]))
 }
 
-func (p labelPriority) Description() string {
-	return labelPriorityDescriptions[p]
+func (l labelPriority) LabelDescription() string {
+	return labelPriorityDescriptions[l]
 }
 
 type labelStatus int
@@ -155,12 +162,16 @@ const (
 )
 
 var labelStatusDescriptions = [...]string{
-	"needs-design",
-	"needs-triage",
+	"Needs Design",
+	"Needs Triage",
 }
 
-func (s labelStatus) String() string {
-	return fmt.Sprintf("%s/%s", labelAreaPrefixStatus, labelStatusDescriptions[s])
+func (l labelStatus) String() string {
+	return fmt.Sprintf("%s/%s", labelAreaPrefixStatus, labelFormatString(labelStatusDescriptions[l]))
+}
+
+func (l labelStatus) LabelDescription() string {
+	return labelStatusDescriptions[l]
 }
 
 type labelType int
@@ -173,13 +184,24 @@ const (
 )
 
 var labelTypeDescriptions = [...]string{
-	"feature",
-	"bug/unconfirmed",
-	"bug",
+	"Feature",
+	"Bug: Unconfirmed",
+	"Bug",
 }
 
-func (t labelType) String() string {
-	return fmt.Sprintf("%s/%s", labelAreaPrefixType, labelTypeDescriptions[t])
+func (l labelType) String() string {
+	return fmt.Sprintf("%s/%s", labelAreaPrefixType, labelFormatString(labelTypeDescriptions[l]))
+}
+
+func (l labelType) LabelDescription() string {
+	return labelTypeDescriptions[l]
+}
+
+func labelFormatString(in string) string {
+	in = strings.ReplaceAll(in, ": ", "/")
+	in = strings.ReplaceAll(in, " ", "-")
+
+	return strings.ToLower(in)
 }
 
 // CSPValue represents individual CSP values.

cmd/authelia-gen/types_test.go

@@ -0,0 +1,90 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestLabels(t *testing.T) {
+	testCases := []struct {
+		name                string
+		have                label
+		expectedDescription string
+		expectedString      string
+	}{
+		{
+			"ShouldShowCorrectPriorityCriticalValues",
+			labelPriorityCritical,
+			"Critical",
+			"priority/1/critical",
+		},
+		{
+			"ShouldShowCorrectPriorityHighValues",
+			labelPriorityHigh,
+			"High",
+			"priority/2/high",
+		},
+		{
+			"ShouldShowCorrectPriorityMediumValues",
+			labelPriorityMedium,
+			"Medium",
+			"priority/3/medium",
+		},
+		{
+			"ShouldShowCorrectPriorityNormalValues",
+			labelPriorityNormal,
+			"Normal",
+			"priority/4/normal",
+		},
+		{
+			"ShouldShowCorrectPriorityLowValues",
+			labelPriorityLow,
+			"Low",
+			"priority/5/low",
+		},
+		{
+			"ShouldShowCorrectPriorityVeryLowValues",
+			labelPriorityVeryLow,
+			"Very Low",
+			"priority/6/very-low",
+		},
+		{
+			"ShouldShowCorrectStatusNeedsDesignValues",
+			labelStatusNeedsDesign,
+			"Needs Design",
+			"status/needs-design",
+		},
+		{
+			"ShouldShowCorrectStatusNeedsTriageValues",
+			labelStatusNeedsTriage,
+			"Needs Triage",
+			"status/needs-triage",
+		},
+		{
+			"ShouldShowCorrectTypeFeatureValues",
+			labelTypeFeature,
+			"Feature",
+			"type/feature",
+		},
+		{
+			"ShouldShowCorrectTypeBugUnconfirmedValues",
+			labelTypeBugUnconfirmed,
+			"Bug: Unconfirmed",
+			"type/bug/unconfirmed",
+		},
+		{
+			"ShouldShowCorrectTypeBugValues",
+			labelTypeBug,
+			"Bug",
+			"type/bug",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.expectedString, tc.have.String())
+			assert.Equal(t, tc.expectedDescription, tc.have.LabelDescription())
+		})
+	}
+}

cmd/authelia-scripts/cmd/gen.go

@@ -7,5 +7,5 @@
 package cmd
 
 const (
-	versionSwaggerUI = "4.18.3"
+	versionSwaggerUI = "5.0.0"
 )

config.template.yml

@@ -39,7 +39,7 @@ default_redirection_url: 'https://home.example.com/'
 ## Set the default 2FA method for new users and for when a user has a preferred method configured that has been
 ## disabled. This setting must be a method that is enabled.
 ## Options are totp, webauthn, mobile_push.
-default_2fa_method: ''
+# default_2fa_method: ''
 
 ##
 ## Server Configuration
@@ -47,15 +47,12 @@ default_2fa_method: ''
 server:
   ## The address for the Main server to listen on in the address common syntax.
   ## Formats:
-  ##  - [<scheme>://]<hostname>[:<port>]
-  ##  - [<scheme>://][hostname]:<port>
+  ##  - [<scheme>://]<hostname>[:<port>][/<path>]
+  ##  - [<scheme>://][hostname]:<port>[/<path>]
   ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'.
   ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9091'.
-  address: 'tcp://:9091'
-
-  ## Set the single level path Authelia listens on.
-  ## Must be alphanumeric chars and should not contain any slashes.
-  path: ''
+  ## If the path is specified this configures the router to handle both the `/` path and the configured path.
+  address: 'tcp://:9091/'
 
   ## Set the path on disk to Authelia assets.
   ## Useful to allow overriding of specific static assets.
@@ -65,6 +62,10 @@ server:
   ## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist.
   disable_healthcheck: false
 
+  ## If a request over the insecure http protocol is received from authelias gRPC endpoint (only for envoy),
+  ## the request is by default redirected to the matching https URL (301)
+  disable_autho_https_redirect: false
+
   ## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour.
   tls:
     ## The path to the DER base64/PEM format private key.
@@ -76,6 +77,17 @@ server:
     ## The list of certificates for client authentication.
     client_certificates: []
 
+  ## Enable the support for gRPC ext authentication for envoy. If TLS is enabled in the above section,
+  ## the defined certificates will also be used for the gRPC endpoint
+  grpc:
+    address: 'tcp://:9092'
+
+    # Even if TLS is configured in the server setting (under server.tls), the grcp server won't use TLS
+    disableTLS: false
+
+  # By default the ban is issued for the user. With this options the IP instead of the user will be banned
+  use_ip_for_ban: true
+
   ## Server headers configuration/customization.
   headers:
 
@@ -162,11 +174,12 @@ telemetry:
 
     ## The address for the Metrics server to listen on in the address common syntax.
     ## Formats:
-    ##  - [<scheme>://]<hostname>[:<port>]
-    ##  - [<scheme>://][hostname]:<port>
+    ##  - [<scheme>://]<hostname>[:<port>][/<path>]
+    ##  - [<scheme>://][hostname]:<port>[/<path>]
     ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'.
     ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9959'.
-    address: 'tcp://:9959'
+    ## If the path is not specified it defaults to `/metrics`.
+    address: 'tcp://:9959/metrics'
 
     ## Metrics Server Buffers configuration.
     # buffers:
@@ -203,7 +216,7 @@ totp:
   ## The TOTP algorithm to use.
   ## It is CRITICAL you read the documentation before changing this option:
   ## https://www.authelia.com/c/totp#algorithm
-  algorithm: 'sha1'
+  algorithm: 'SHA1'
 
   ## The number of digits a user has to input. Must either be 6 or 8.
   ## Changing this option only affects newly generated TOTP configurations.
@@ -300,7 +313,7 @@ authentication_backend:
 
     ## External reset password url that redirects the user to an external reset portal. This disables the internal reset
     ## functionality.
-    custom_url: ''
+    # custom_url: ''
 
   ## The amount of time to wait before we refresh data from the authentication backend in the duration common syntax.
   ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
@@ -396,7 +409,7 @@ authentication_backend:
         # SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH
         # ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg
         # 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg
-        # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE=
+        # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRs_DO_NOT_USE=
         # -----END RSA PRIVATE KEY-----
 
     ## The distinguished name of the container searched for objects in the directory information tree.
@@ -421,11 +434,6 @@ authentication_backend:
     ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
     # users_filter: '(&({username_attribute}={input})(objectClass=person))'
 
-    ## Defaults to the users_filter. This filter is used exclusively for password resets. So you can leverage it to
-    ## prevent users who must change their password from logging in, but if you set a separate filter here they could
-    ## theoretically still reset their password.
-    # users_reset_filter: '(&({username_attribute}={input})(objectClass=person))'
-
     ## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups.
     ## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups.
     # additional_groups_dn: 'ou=groups'
@@ -840,7 +848,7 @@ session:
         # SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH
         # ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg
         # 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg
-        # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE=
+        # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRs_DO_NOT_USE=
         # -----END RSA PRIVATE KEY-----
 
     ## The Redis HA configuration options.
@@ -985,7 +993,7 @@ regulation:
         # SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH
         # ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg
         # 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg
-        # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE=
+        # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRs_DO_NOT_USE=
         # -----END RSA PRIVATE KEY-----
 
   ##
@@ -1068,8 +1076,8 @@ regulation:
         # SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH
         # ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg
         # 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg
-        # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE=
-      # -----END RSA PRIVATE KEY-----
+        # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRs_DO_NOT_USE=
+        # -----END RSA PRIVATE KEY-----
 
 ##
 ## Notification Provider
@@ -1186,7 +1194,7 @@ notifier:
         # SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH
         # ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg
         # 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg
-        # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE=
+        # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRs_DO_NOT_USE=
         # -----END RSA PRIVATE KEY-----
 
 ##
@@ -1228,7 +1236,7 @@ notifier:
         # SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH
         # ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg
         # 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg
-        # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE=
+        # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRs_DO_NOT_USE=
         # -----END RSA PRIVATE KEY-----
 
 
@@ -1258,7 +1266,7 @@ notifier:
       # SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH
       # ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg
       # 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg
-      # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE=
+      # HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRs_DO_NOT_USE=
       # -----END RSA PRIVATE KEY-----
 
     ## Optional matching certificate chain in PEM DER form that matches the issuer_private_key. All certificates within
@@ -1307,6 +1315,7 @@ notifier:
       ## List of endpoints in addition to the metadata endpoints to permit cross-origin requests on.
       # endpoints:
         #  - 'authorization'
+        #  - 'pushed-authorization-request'
         #  - 'token'
         #  - 'revocation'
         #  - 'introspection'
@@ -1345,7 +1354,7 @@ notifier:
 
         ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
         # redirect_uris:
-        # - 'https://oidc.example.com:8080/oauth2/callback'
+          # - 'https://oidc.example.com:8080/oauth2/callback'
 
         ## Audience this client is allowed to request.
         # audience: []
@@ -1360,7 +1369,7 @@ notifier:
         ## Grant Types configures which grants this client can obtain.
         ## It's not recommended to define this unless you know what you're doing.
         # grant_types:
-        # - 'authorization_code'
+          # - 'authorization_code'
 
         ## Response Types configures which responses this client can be sent.
         ## It's not recommended to define this unless you know what you're doing.
@@ -1432,7 +1441,7 @@ notifier:
               # key: |
                 # -----BEGIN RSA PUBLIC KEY-----
                 # MEgCQQDAwV26ZA1lodtOQxNrJ491gWT+VzFum9IeZ+WTmMypYWyW1CzXKwsvTHDz
-                # 9ec+jserR3EMQ0Rr24lj13FL1ib5AgMBAAE=
+                # 9ec+jserR3EMQ0Rr24lj13FL1ib5AgMBAAE_DO_NOT_USE=
                 # -----END RSA PUBLIC KEY----
 
               ## The matching certificate chain in PEM DER form that matches the key if available.

docs/content/en/blog/pre-release-notes-4.37/index.md

@@ -31,14 +31,14 @@ with all major proxies supported excluding Microsoft IIS.
 [Envoy]: https://www.envoyproxy.io/
 [Istio]: https://istio.io/
 
-## OpenID Connect Improvements
+## OpenID Connect 1.0 Improvements
 
-Several items from the [OpenID Connect Roadmap](../../roadmap/active/openid-connect.md) are being checked off in this
+Several items from the [OpenID Connect 1.0 Roadmap](../../roadmap/active/openid-connect.md) are being checked off in this
 release.
 
 ### Hashed Client Secrets
 
-We'll be supporting hashed OpenID Connect client secrets in this release. People will still be able to use plaintext
+We'll be supporting hashed OpenID Connect 1.0 client secrets in this release. People will still be able to use plaintext
 secrets if they wish however we'll be recommending people utilize PBKDF2, BCrypt or SHA512 SHA2CRYPT (see
 [Password Algorithms](#password-algorithms) for a full compatibility list). This doesn't change anything for OpenID
 Connect Relying Parties, it only requires a change in the Authelia configuration.

docs/content/en/configuration/first-factor/ldap.md

@@ -209,17 +209,9 @@ exactly which OU to get users from for either security or performance reasons. F
 default negating this requirement. Refer to the [filter defaults](../../reference/guides/ldap.md#filter-defaults) for
 more information.*
 
-The LDAP filter to determine users are valid. This is important to set correctly as to exclude disabled users. The
-default value is dependent on the [implementation](#implementation), refer to the
-[attribute defaults](../../reference/guides/ldap.md#attribute-defaults) for more information.
-
-### users_reset_filter
-
-{{< confkey type="string" required="no" >}}
-
 The LDAP filter to narrow down which users are valid. This is important to set correctly as to exclude disabled users.
-The default value is the same as [users_filter](#usersfilter). This can be leveraged to allow users who cannot login
-due to restrictions in the [users_filter](#usersfilter) to still be able to reset their password.
+The default value is dependent on the [implementation](#implementation), refer to the
+[attribute defaults](../../reference/guides/ldap.md#attribute-defaults) for more information.
 
 ### additional_groups_dn
 

docs/content/en/configuration/identity-providers/introduction.md

@@ -14,6 +14,6 @@ aliases:
   - /docs/configuration/identity-providers/
 ---
 
-## OpenID Connect
+## OpenID Connect 1.0
 
 The only identity provider implementation supported at this time is [OpenID Connect 1.0](openid-connect/provider.md).

docs/content/en/configuration/identity-providers/openid-connect/_index.md

@@ -2,7 +2,7 @@
 title: "OpenID Connect 1.0"
 description: ""
 lead: ""
-date: 2023-05-08T13:38:08+10:00
+date: 2023-05-15T10:32:10+10:00
 lastmod: 2022-01-18T20:07:56+01:00
 draft: false
 images: []

docs/content/en/configuration/identity-providers/openid-connect/clients.md

@@ -2,7 +2,7 @@
 title: "OpenID Connect 1.0 Clients"
 description: "OpenID Connect 1.0 Registered Clients Configuration"
 lead: "Authelia can operate as an OpenID Connect 1.0 Provider. This section describes how to configure the registered clients."
-date: 2023-05-08T13:38:08+10:00
+date: 2023-05-15T10:32:10+10:00
 draft: false
 images: []
 menu:
@@ -16,8 +16,8 @@ This section covers specifics regarding configuring the providers registered cli
 provider specific configuration and information not related to clients see the [OpenID Connect 1.0 Provider](provider.md)
 documentation.
 
-More information about OpenID Connect can be found in the [roadmap](../../../roadmap/active/openid-connect.md) and in the
-[integration](../../../integration/openid-connect/introduction.md) documentation.
+More information about OpenID Connect 1.0 can be found in the [roadmap](../../../roadmap/active/openid-connect.md) and
+in the [integration](../../../integration/openid-connect/introduction.md) documentation.
 
 ## Configuration
 
@@ -28,39 +28,41 @@ intended for production use it's used to provide context and an indentation exam
 identity_providers:
   oidc:
     clients:
-      - id: myapp
-        description: My Application
+      - id: 'myapp'
+        description: 'My Application'
         secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
         sector_identifier: ''
         public: false
         redirect_uris:
-          - https://oidc.example.com:8080/oauth2/callback
+          - 'https://oidc.example.com:8080/oauth2/callback'
         audience: []
         scopes:
-          - openid
-          - groups
-          - email
-          - profile
+          - 'openid'
+          - 'groups'
+          - 'email'
+          - 'profile'
         grant_types:
-          - refresh_token
-          - authorization_code
+          - 'refresh_token'
+          - 'authorization_code'
         response_types:
-          - code
+          - 'code'
         response_modes:
-          - form_post
-          - query
-          - fragment
-        authorization_policy: two_factor
-        consent_mode: explicit
-        pre_configured_consent_duration: 1w
+          - 'form_post'
+          - 'query'
+          - 'fragment'
+        authorization_policy: 'two_factor'
+        consent_mode: 'explicit'
+        pre_configured_consent_duration: '1 week'
         enforce_par: false
         enforce_pkce: false
-        pkce_challenge_method: S256
+        pkce_challenge_method: 'S256'
+        id_token_signing_alg: 'RS256'
+        id_token_signing_key_id: ''
+        userinfo_signing_alg: 'none'
+        userinfo_signing_key_id: ''
+        request_object_signing_alg: 'RS256'
+        token_endpoint_auth_signing_alg: 'RS256'
         token_endpoint_auth_method: ''
-        token_endpoint_auth_signing_alg: RS256
-        id_token_signing_alg: RS256
-        request_object_signing_alg: RS256
-        userinfo_signing_alg: none
 ```
 
 ## Options
@@ -270,6 +272,65 @@ effectively enables the [enforce_pkce](#enforcepkce) option for this client.
 Valid values are an empty string, `plain`, or `S256`. It should be noted that `S256` is strongly recommended if the
 relying party supports it.
 
+### id_token_signing_alg
+
+{{< confkey type="string" default="RS256" required="no" >}}
+
+The algorithm used to sign the ID Tokens in the token responses.
+
+See the response object section of the
+[integration guide](../../../integration/openid-connect/introduction.md#response-object) for more information including
+the algorithm column for supported values. In addition to the values listed we also support `none` as a value for this
+endpoint.
+
+The algorithm chosen must have a key configured in the [issuer_private_keys](provider.md#issuerprivatekeys) section to
+be considered valid.
+
+This option has no effect if the [id_token_signing_key_id](#idtokensigningkid) is specified as the algorithm is
+automatically assumed by the configured key.
+
+### id_token_signing_key_id
+
+{{< confkey type="string" required="no" >}}
+
+The key id of the JWK used to sign the ID Tokens in the token responses. This option takes precedence over
+[id_token_signing_alg](#idtokensigningalg). The value of this must one of those provided or calculated in the
+[issuer_private_keys](provider.md#issuerprivatekeys).
+
+### userinfo_signing_alg
+
+{{< confkey type="string" default="none" required="no" >}}
+
+The algorithm used to sign the userinfo endpoint responses.
+
+See the response object section of the [integration guide](../../../integration/openid-connect/introduction.md#response-object)
+for more information including the algorithm column for supported values. In addition to the values listed we also
+support `none` as a value for this endpoint.
+
+The algorithm chosen must have a key configured in the [issuer_private_keys](provider.md#issuerprivatekeys) section to
+be considered valid.
+
+This option has no effect if the [userinfo_signing_key_id](#userinfosigningkeyid) is specified as the algorithm is
+automatically assumed by the configured key.
+
+### userinfo_signing_key_id
+
+{{< confkey type="string" required="no" >}}
+
+The key id of the JWK used to sign the userinfo endpoint responses in the token responses. This option takes precedence
+over  [userinfo_signing_alg](#userinfosigningalg). The value of this must one of those provided or calculated in the
+[issuer_private_keys](provider.md#issuerprivatekeys).
+
+### request_object_signing_alg
+
+{{< confkey type="string" default="RSA256" required="no" >}}
+
+The JWT signing algorithm accepted for request objects.
+
+See the request object section of the
+[integration guide](../../../integration/openid-connect/introduction.md#request-object) for more information including
+the algorithm column for supported values.
+
 ### token_endpoint_auth_method
 
 {{< confkey type="string" default="" required="no" >}}
@@ -300,35 +361,6 @@ otherwise we assume the default value:
 | [token_endpoint_auth_method](#tokenendpointauthsigningalg) |  `private_key_jwt`  | `RS256` |
 | [token_endpoint_auth_method](#tokenendpointauthsigningalg) | `client_secret_jwt` | `HS256` |
 
-### request_object_signing_alg
-
-{{< confkey type="string" default="RSA256" required="no" >}}
-
-The JWT signing algorithm accepted for request objects.
-
-See the request object section of the [integration guide](../../../integration/openid-connect/introduction.md#request-object)
-for more information including the algorithm column for supported values.
-
-### id_token_signing_alg
-
-{{< confkey type="string" default="RS256" required="no" >}}
-
-The algorithm used to sign the ID Tokens in the token responses.
-
-See the response object section of the [integration guide](../../../integration/openid-connect/introduction.md#response-object)
-for more information including the algorithm column for supported values. In addition to the values listed we also
-support `none` as a value for this endpoint.
-
-### userinfo_signing_alg
-
-{{< confkey type="string" default="none" required="no" >}}
-
-The algorithm used to sign the userinfo endpoint responses.
-
-See the response object section of the [integration guide](../../../integration/openid-connect/introduction.md#response-object)
-for more information including the algorithm column for supported values. In addition to the values listed we also
-support `none` as a value for this endpoint.
-
 ### public_keys
 
 This section configures the trusted JSON Web Keys or JWKS for this registered client. This can either be static values
@@ -368,11 +400,29 @@ A list of static keys.
 
 The Key ID used to match the request object's JWT header `kid` value against.
 
+##### use
+
+{{< confkey type="string" default="sig" required="no" >}}
+
+The key usage. Defaults to `sig` which is the only available option at this time.
+
+##### algorithm
+
+{{< confkey type="string" default="RS256" required="situational" >}}
+
+The algorithm for this key. This value typically optional as it can be automatically detected based on the type of key
+in some situations. It is however strongly recommended this is set.
+
+See the request object table in the [integration guide](../../../integration/openid-connect/introduction.md#request-object)
+for more information. The `Algorithm` column lists supported values, the `Key` column references the required
+[key](#key) type constraints that exist for the algorithm, and the `JWK Default Conditions` column briefly explains the
+conditions under which it's the default algorithm.
+
 ##### key
 
 {{< confkey type="string" required="yes" >}}
 
-The public key portion of the JSON Web Key
+The public key portion of the JSON Web Key.
 
 The public key the clients use to sign/encrypt the [OpenID Connect 1.0] asserted [JWT]'s. The key is generated by the
 client application or the administrator of the client application.
@@ -388,9 +438,15 @@ The key *__MUST__*:
     * A P-384 elliptical curve.
     * A P-512 elliptical curve.
 
-If the [issuer_certificate_chain](#issuercertificatechain) is provided the private key must include matching public
+If the [certificate_chain](#certificatechain) is provided the private key must include matching public
 key data for the first certificate in the chain.
 
+##### certificate_chain
+
+{{< confkey type="string" required="no" >}}
+
+The certificate chain/bundle to be used with the [key](#key) DER base64 ([RFC4648])
+encoded PEM format used to sign/encrypt the [OpenID Connect 1.0] [JWT]'s.
 
 ## Integration
 

docs/content/en/configuration/identity-providers/openid-connect/provider.md

@@ -2,7 +2,7 @@
 title: "OpenID Connect 1.0 Provider"
 description: "OpenID Connect 1.0 Provider Configuration"
 lead: "Authelia can operate as an OpenID Connect 1.0 Provider. This section describes how to configure this."
-date: 2023-05-08T13:38:08+10:00
+date: 2023-05-15T10:32:10+10:00
 draft: false
 images: []
 menu:
@@ -135,41 +135,31 @@ with 64 or more characters.
 
 ### issuer_private_keys
 
-The key *__MUST__*:
-
-* Be a PEM block encoded in the DER base64 format ([RFC4648]).
-* Be either:
-  * An RSA public key:
-    * With a key size of at least 2048 bits.
-  * An ECDSA public key with one of:
-    * A P-256 elliptical curve.
-    * A P-384 elliptical curve.
-    * A P-512 elliptical curve.
-
-### issuer_private_keys
-
 {{< confkey type="list(object" required="no" >}}
 
 The list of JWKS instead of or in addition to the [issuer_private_key](#issuerprivatekey) and
 [issuer_certificate_chain](#issuercertificatechain). Can also accept ECDSA Private Key's and Certificates.
 
+The default key for each algorithm is is decided based on the order of this list. The first key for each algorithm is
+considered the default if a client is not configured to use a specific key id. For example if a client has
+[id_token_signing_alg](clients.md#idtokensigningalg) `ES256` and [id_token_signing_key_id](clients.md#idtokensigningkid) is
+not specified then the first `ES256` key in this list is used.
+
 #### key_id
 
 {{< confkey type="string" default="<thumbprint of public key>" required="no" >}}
 
 Completely optional, and generally discouraged unless there is a collision between the automatically generated key id's.
-If provided must be a unique string with 7 or less alphanumeric characters.
+If provided must be a unique string with 100 or less characters, with a recommendation to use a length less
+than 10. In addition it must meet the following rules:
 
-This value is the first 7 characters of the public key thumbprint (SHA1) encoded into hexadecimal.
+- Match the regular expression `^[a-zA-Z0-9](([a-zA-Z0-9._~-]*)([a-zA-Z0-9]))?$` which should enforce the following rules:
+  - Start with an alphanumeric character.
+  - End with an alphanumeric character.
+  - Only contain the [RFC3986 Unreserved Characters](https://datatracker.ietf.org/doc/html/rfc3986#section-2.3).
 
-#### algorithm
-
-{{< confkey type="string" default="RS256" required="no" >}}
-
-The algorithm for this key. This value must be unique. It's automatically detected based on the type of key.
-
-See the response object table in the [integration guide](../../../integration/openid-connect/introduction.md#response-object)
-including the algorithm column for the supported values and the key type column for the default algorithm value.
+The default if this value is omitted is the first 7 characters of the public key SHA256 thumbprint encoded into
+hexadecimal.
 
 #### use
 
@@ -177,14 +167,28 @@ including the algorithm column for the supported values and the key type column
 
 The key usage. Defaults to `sig` which is the only available option at this time.
 
+#### algorithm
+
+{{< confkey type="string" default="RS256" required="situational" >}}
+
+The algorithm for this key. This value typically optional as it can be automatically detected based on the type of key
+in some situations.
+
+See the response object table in the [integration guide](../../../integration/openid-connect/introduction.md#response-object)
+for more information. The `Algorithm` column lists supported values, the `Key` column references the required
+[key](#key) type constraints that exist for the algorithm, and the `JWK Default Conditions` column briefly explains the
+conditions under which it's the default algorithm.
+
+At least one `RSA256` key must be provided.
+
 #### key
 
 {{< confkey type="string" required="yes" >}}
 
 The private key associated with this key entry.
 
-The private key used to sign/encrypt the [OpenID Connect 1.0] issued [JWT]'s. The key must be generated by the administrator
-and can be done by following the
+The private key used to sign/encrypt the [OpenID Connect 1.0] issued [JWT]'s. The key must be generated by the
+administrator and can be done by following the
 [Generating an RSA Keypair](../../../reference/guides/generating-secure-values.md#generating-an-rsa-keypair) guide.
 
 The private key *__MUST__*:
@@ -217,15 +221,13 @@ it if present.
 
 {{< confkey type="string" required="yes" >}}
 
-*__Important Note:__ This can also be defined using a [secret](../../methods/secrets.md) which is __strongly recommended__
-especially for containerized deployments.*
-
-The private key used to sign/encrypt the [OpenID Connect 1.0] issued [JWT]'s. The key must be generated by the administrator
-and can be done by following the
+The private key used to sign/encrypt the [OpenID Connect 1.0] issued [JWT]'s. The key must be generated by the
+administrator and can be done by following the
 [Generating an RSA Keypair](../../../reference/guides/generating-secure-values.md#generating-an-rsa-keypair) guide.
 
 This private key is automatically appended to the [issuer_private_keys](#issuerprivatekeys) and assumed to be for the
-RS256 algorithm. As such no other key in this list should be RS256 if this is configured.
+`RS256` algorithm. If provided it is always the first key in this list. As such this key is assumed to be the default
+for `RS256` if provided.
 
 The issuer private key *__MUST__*:
 
@@ -240,7 +242,7 @@ key data for the first certificate in the chain.
 
 {{< confkey type="string" required="no" >}}
 
-The certificate chain/bundle to be used with the [issuer_private_key](#issuer_private_key) DER base64 ([RFC4648])
+The certificate chain/bundle to be used with the [issuer_private_key](#issuerprivatekey) DER base64 ([RFC4648])
 encoded PEM format used to sign/encrypt the [OpenID Connect 1.0] [JWT]'s. When configured it enables the [x5c] and [x5t]
 JSON key's in the JWKs [Discoverable Endpoint](../../../integration/openid-connect/introduction.md#discoverable-endpoints)
 as per [RFC7517].
@@ -299,9 +301,11 @@ Allows additional debug messages to be sent to the clients.
 This controls the minimum length of the `nonce` and `state` parameters.
 
 *__Security Notice:__* Changing this value is generally discouraged, reducing it from the default can theoretically
-make certain scenarios less secure. It is highly encouraged that if your OpenID Connect RP does not send these
-parameters or sends parameters with a lower length than the default that they implement a change rather than changing
-this value.
+make certain scenarios less secure. It is highly encouraged that if your OpenID Connect 1.0 Relying Party does not send
+these parameters or sends parameters with a lower length than the default that they implement a change rather than
+changing this value.
+
+This restriction can also be disabled entirely when set to `-1`.
 
 ### enforce_pkce
 
@@ -411,7 +415,7 @@ See the [OpenID Connect 1.0 Registered Clients](clients.md) documentation for co
 ## Integration
 
 To integrate Authelia's [OpenID Connect 1.0] implementation with a relying party please see the
-[integration docs](../../integration/openid-connect/introduction.md).
+[integration docs](../../../integration/openid-connect/introduction.md).
 
 [token lifespan]: https://docs.apigee.com/api-platform/antipatterns/oauth-long-expiration
 [OpenID Connect 1.0]: https://openid.net/connect/

docs/content/en/configuration/methods/environment.md

@@ -16,7 +16,7 @@ Environment variables are applied after the configuration file meaning anything
 overrides the configuration files.
 
 *__Please Note:__ It is not possible to configure several sections at this time, these include but may not be
-limited to the rules section in access control, the clients section in the OpenID Connect identity provider, the cookies
+limited to the rules section in access control, the clients section in the OpenID Connect 1.0 Provider, the cookies
 section of in session, and the authz section in the server endpoints.*
 
 ## Prefix

docs/content/en/configuration/methods/files.md

@@ -63,9 +63,9 @@ authelia --config configuration.yml,config-acl.yml,config-other.yml
 Authelia's configuration files use the YAML format. A template with all possible options can be found at the root of the
 repository {{< github-link name="here" path="config.template.yml" >}}.
 
-*__Important Note:__ You should not have configuration sections such as Access Control Rules or OpenID Connect clients
-configured in multiple files. If you wish to split these into their own files that is fine, but if you have two files that
-specify these sections and expect them to merge properly you are asking for trouble.*
+*__Important Note:__ You should not have configuration sections such as Access Control Rules or OpenID Connect 1.0
+clients configured in multiple files. If you wish to split these into their own files that is fine, but if you have two
+files that specify these sections and expect them to merge properly you are asking for trouble.*
 
 ### Container
 

docs/content/en/configuration/miscellaneous/server.md

@@ -21,8 +21,7 @@ aliases:
 
 ```yaml
 server:
-  address: 'tcp://:9091'
-  path: ''
+  address: 'tcp://:9091/'
   disable_healthcheck: false
   tls:
     key: ''
@@ -59,19 +58,25 @@ server:
 
 ### address
 
-{{< confkey type="address" default="tcp://:9091" required="no" >}}
+{{< confkey type="address" default="tcp://:9091/" required="no" >}}
 
 *__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please
 see the [documentation](../prologue/common.md#address) on this format for more information.*
 
 Configures the listener address for the Main HTTP Server. The address itself is a listener and the scheme must either be
-the `unix` scheme or one of the `tcp` schemes.
+the `unix` scheme or one of the `tcp` schemes. It can configure the host, port, and path the listener responds to. If
+the path is configured to anything other than `/` Authelia will handle requests for both `/` and the configured path.
 
 __Examples:__
 
 ```yaml
 server:
-  address: tcp://127.0.0.1:9091
+  address: tcp://127.0.0.1:9091/
+```
+
+```yaml
+server:
+  address: tcp://127.0.0.1:9091/subpath
 ```
 
 ```yaml
@@ -79,34 +84,6 @@ server:
   address: unix:///var/run/authelia.sock
 ```
 
-### path
-
-{{< confkey type="string " required="no" >}}
-
-Authelia by default is served from the root `/` location, either via its own domain or subdomain.
-
-Modifying this setting will allow you to serve Authelia out from a specified base path. Please note
-that currently only a single level path is supported meaning slashes are not allowed, and only
-alphanumeric characters are supported.
-
-__Example:__
-
-```yaml
-server:
-  path: ""
-```
-
-*Works for https://auth.example.com/, https://example.com/, etc*.
-
-__Example:__
-
-```yaml
-server:
-  path: authelia
-```
-
-*Works for https://auth.example.com/authelia/,  https://example.com/authelia/, etc*.
-
 ### asset_path
 
 {{< confkey type="string " required="no" >}}

docs/content/en/configuration/prologue/common.md

@@ -88,7 +88,7 @@ Refer to the individual documentation for an option for clarity. In this format
 are optional. The default for these when not provided varies.
 
 ```text
-[<scheme>://]<hostname>[:<port>]
+[<scheme>://]<hostname>[:<port>][/<path>]
 ```
 
 ##### Port
@@ -99,7 +99,7 @@ hostname are optional. The default for the scheme when not provided varies, and
 available addresses when not provided.
 
 ```text
-[<scheme>://][hostname]:<port>
+[<scheme>://][hostname]:<port>[/<path>]
 ```
 
 ##### Unix Domain Socket
@@ -131,8 +131,11 @@ Various examples for these formats.
 ```text
 0.0.0.0
 tcp://0.0.0.0
+tcp://0.0.0.0/subpath
 tcp://0.0.0.0:9091
+tcp://0.0.0.0:9091/subpath
 tcp://:9091
+tcp://:9091/subpath
 0.0.0.0:9091
 
 udp://0.0.0.0:123

docs/content/en/configuration/second-factor/webauthn.md

@@ -89,6 +89,6 @@ Please see the [documentation](../prologue/common.md#duration) on this format fo
 
 This adjusts the requested timeout for a WebAuthn interaction.
 
-## FAQ
+## Frequently Asked Questions
 
-See the [Security Key FAQ](../../overview/authentication/security-key/index.md#faq) for the FAQ.
+See the [Security Key FAQ](../../overview/authentication/security-key/index.md#frequently-asked-questions) for the FAQ.

docs/content/en/configuration/security/access-control.md

@@ -15,6 +15,11 @@ aliases:
   - /docs/configuration/access-control.html
 ---
 
+*__Important Note:__ This section does not apply to OpenID Connect 1.0. See the [Frequently Asked Questions] for more
+information.*
+
+[Frequently Asked Questions]: ../../integration/openid-connect/frequently-asked-questions.md#why-doesnt-the-access-control-configuration-work-with-openid-connect-10
+
 ## Configuration
 
 {{< config-alert-example >}}

docs/content/en/configuration/storage/migrations.md

@@ -32,9 +32,9 @@ this instance if you wanted to downgrade to pre1 you would need to use an Authel
 |       1        |      4.33.0      |                                 Initial migration managed version                                  |
 |       2        |      4.34.0      | WebAuthn - added webauthn_devices table, altered totp_config to include device created/used dates  |
 |       3        |      4.34.2      |     WebAuthn - fix V2 migration kid column length and provide migration path for anyone on V2      |
-|       4        |      4.35.0      |               Added OpenID Connect storage tables and opaque user identifier tables                |
+|       4        |      4.35.0      |             Added OpenID Connect 1.0 storage tables and opaque user identifier tables              |
 |       5        |      4.35.1      | Fixed the oauth2_consent_session table to accept NULL subjects for users who are not yet signed in |
-|       6        |      4.37.0      |          Adjusted the OpenID Connect tables to allow pre-configured consent improvements           |
+|       6        |      4.37.0      |        Adjusted the OpenID Connect 1.0 tables to allow pre-configured consent improvements         |
 |       7        |      4.37.3      |       Fixed some schema inconsistencies most notably the MySQL/MariaDB Engine and Collation        |
 |       8        |      4.38.0      |                          OpenID Connect 1.0 Pushed Authorization Requests                          |
 |       9        |      4.38.0      | Fix a PostgreSQL NOT NULL constraint issue on the `aaguid` column of the `webauthn_devices` table  |

docs/content/en/configuration/storage/postgres.md

@@ -32,6 +32,7 @@ storage:
     schema: 'public'
     username: 'authelia'
     password: 'mypassword'
+    timeout: '5s'
     tls:
       server_name: 'postgres.example.com'
       skip_verify: false

docs/content/en/configuration/telemetry/metrics.md

@@ -22,7 +22,7 @@ toc: true
 telemetry:
   metrics:
     enabled: false
-    address: 'tcp://:9959'
+    address: 'tcp://:9959/'
     buffers:
       read: 4096
       write: 4096
@@ -44,7 +44,7 @@ Determines if the [Prometheus] HTTP Metrics Exporter is enabled.
 
 ### address
 
-{{< confkey type="address" default="tcp://:9959" required="no" >}}
+{{< confkey type="address" default="tcp://:9959/" required="no" >}}
 
 *__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please
 see the [documentation](../prologue/common.md#address) on this format for more information.*

docs/content/en/contributing/development/environment.md

@@ -62,7 +62,7 @@ There is a scripting context provided with __Authelia__ which can easily be conf
 [suites] and various other tasks. Read more about it in the [authelia-scripts](reference-authelia-scripts.md) reference
 guide.
 
-## FAQ
+## Frequently Asked Questions
 
 ### Do you support development under Windows or OSX?
 

docs/content/en/integration/deployment/docker.md

@@ -210,7 +210,7 @@ running the following command:
 grep -Eo '"https://.*" ' ./authelia/notification.txt.
 ```
 
-## FAQ
+## Frequently Asked Questions
 
 #### Running the Proxy on the Host Instead of in a Container
 

docs/content/en/integration/kubernetes/introduction.md

@@ -63,7 +63,7 @@ spec:
 ...
 ```
 
-## FAQ
+## Frequently Asked Questions
 
 ### RAM usage
 

docs/content/en/integration/openid-connect/_index.md

@@ -1,6 +1,6 @@
 ---
-title: "OpenID Connect"
-description: "OpenID Connect Integration"
+title: "OpenID Connect 1.0"
+description: "OpenID Connect 1.0 Integration"
 lead: ""
 date: 2022-06-15T17:51:47+10:00
 draft: false

docs/content/en/integration/openid-connect/apache-guacamole/index.md

@@ -1,6 +1,6 @@
 ---
 title: "Apache Guacamole"
-description: "Integrating Apache Guacamole with the Authelia OpenID Connect Provider."
+description: "Integrating Apache Guacamole with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2022-07-31T13:09:05+10:00
 draft: false

docs/content/en/integration/openid-connect/argocd/index.md

@@ -1,6 +1,6 @@
 ---
 title: "Argo CD"
-description: "Integrating Argo CD with the Authelia OpenID Connect Provider."
+description: "Integrating Argo CD with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2022-07-13T04:27:30+10:00
 draft: false

docs/content/en/integration/openid-connect/bookstack/index.md

@@ -1,6 +1,6 @@
 ---
 title: "BookStack"
-description: "Integrating BookStack with the Authelia OpenID Connect Provider."
+description: "Integrating BookStack with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2022-06-15T17:51:47+10:00
 draft: false

docs/content/en/integration/openid-connect/cloudflare-zerotrust/index.md

@@ -1,6 +1,6 @@
 ---
 title: "Cloudflare Zero Trust"
-description: "Integrating Cloudflare Zero Trust with the Authelia OpenID Connect Provider."
+description: "Integrating Cloudflare Zero Trust with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2022-06-15T17:51:47+10:00
 draft: false

docs/content/en/integration/openid-connect/firezone/index.md

@@ -1,6 +1,6 @@
 ---
 title: "Firezone"
-description: "Integrating Firezone with the Authelia OpenID Connect Provider."
+description: "Integrating Firezone with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2023-03-28T20:29:13+11:00
 draft: false

docs/content/en/integration/openid-connect/frequently-asked-questions.md

@@ -1,7 +1,7 @@
 ---
 title: "Frequently Asked Questions"
-description: "Frequently Asked Questions regarding integrating the Authelia OpenID Connect Provider with an OpenID Connect relying party"
-lead: "Frequently Asked Questions regarding integrating the Authelia OpenID Connect Provider with an OpenID Connect relying party."
+description: "Frequently Asked Questions regarding integrating the Authelia OpenID Connect 1.0 Provider with an OpenID Connect 1.0 Relying Party"
+lead: "Frequently Asked Questions regarding integrating the Authelia OpenID Connect 1.0 Provider with an OpenID Connect 1.0 Relying Party."
 date: 2022-10-20T15:27:09+11:00
 draft: false
 images: []
@@ -88,6 +88,26 @@ If you've configured Authelia alongside a proxy and are making a request directl
 request via the proxy. If you're avoiding the proxy due to a DNS limitation see
 [Solution: Configure DNS Appropriately](#configure-dns-appropriately) section.
 
+### Why doesn't the access control configuration work with OpenID Connect 1.0?
+
+The [access control](../../configuration/security/access-control.md) configuration contains several elements which are
+not very compatible with OpenID Connect 1.0. They were designed with per-request authorizations in mind. In particular
+the [resources](../../configuration/security/access-control.md#resources),
+[query](../../configuration/security/access-control.md#query),
+[methods](../../configuration/security/access-control.md#methods), and
+[networks](../../configuration/security/access-control.md#networks) criteria are very specific to each request and to
+some degree so are the [domain](../../configuration/security/access-control.md#domain) and
+[domain regex](../../configuration/security/access-control.md#domainregex) criteria as the token is issued to the client
+not a specific domain.
+
+For these reasons we implemented the
+[authorization policy](../../configuration/identity-providers/openid-connect/clients.md#authorizationpolicy) as a direct
+option in the client. It's likely in the future that we'll expand this option to encompass the features that work well
+with OpenID Connect 1.0 such as the [subject](../../configuration/security/access-control.md#subject) criteria which
+reasonably be matched to an individual authorization policy. Because the other criteria are mostly geared towards
+per-request authorization these criteria types are fairly unlikely to become part of OpenID Connect 1.0 as there are no
+ways to apply these criteria except during the initial authorization request.
+
 ## Solutions
 
 The following section details solutions for multiple of the questions above.

docs/content/en/integration/openid-connect/gitea/index.md

@@ -1,6 +1,6 @@
 ---
 title: "Gitea"
-description: "Integrating Gitea with the Authelia OpenID Connect Provider."
+description: "Integrating Gitea with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2022-07-01T13:07:02+10:00
 draft: false

docs/content/en/integration/openid-connect/gitlab/index.md

@@ -1,6 +1,6 @@
 ---
 title: "GitLab"
-description: "Integrating GitLab with the Authelia OpenID Connect Provider."
+description: "Integrating GitLab with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2022-06-15T17:51:47+10:00
 draft: false

docs/content/en/integration/openid-connect/grafana/index.md

@@ -1,6 +1,6 @@
 ---
 title: "Grafana"
-description: "Integrating Grafana with the Authelia OpenID Connect Provider."
+description: "Integrating Grafana with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2022-06-15T17:51:47+10:00
 draft: false

docs/content/en/integration/openid-connect/harbor/index.md

@@ -1,6 +1,6 @@
 ---
 title: "Harbor"
-description: "Integrating Harbor with the Authelia OpenID Connect Provider."
+description: "Integrating Harbor with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2022-06-15T17:51:47+10:00
 draft: false

docs/content/en/integration/openid-connect/hashicorp-vault/index.md

@@ -1,6 +1,6 @@
 ---
 title: "HashiCorp Vault"
-description: "Integrating HashiCorp Vault with the Authelia OpenID Connect Provider."
+description: "Integrating HashiCorp Vault with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2022-06-15T17:51:47+10:00
 draft: false

docs/content/en/integration/openid-connect/introduction.md

@@ -1,7 +1,7 @@
 ---
 title: "OpenID Connect"
-description: "An introduction into integrating the Authelia OpenID Connect Provider with an OpenID Connect relying party"
-lead: "An introduction into integrating the Authelia OpenID Connect Provider with an OpenID Connect relying party."
+description: "An introduction into integrating the Authelia OpenID Connect 1.0 Provider with an OpenID Connect 1.0 Relying Party"
+lead: "An introduction into integrating the Authelia OpenID Connect 1.0 Provider with an OpenID Connect 1.0 Relying Party."
 date: 2022-06-15T17:51:47+10:00
 draft: false
 images: []
@@ -265,7 +265,7 @@ The following table describes the response from the [UserInfo] endpoint dependin
 ## Endpoint Implementations
 
 The following section documents the endpoints we implement and their respective paths. This information can
-traditionally be discovered by relying parties that utilize [OpenID Connect Discovery], however this information may be
+traditionally be discovered by relying parties that utilize [OpenID Connect Discovery 1.0], however this information may be
 useful for clients which do not implement this.
 
 The endpoints can be discovered easily by visiting the Discovery and Metadata endpoints. It is recommended regardless
@@ -275,7 +275,7 @@ below.
 
 These tables document the endpoints we currently support and their paths in the most recent version of Authelia. The
 paths are appended to the end of the primary URL used to access Authelia. The tables use the url
-https://auth.example.com as an example of the Authelia root URL which is also the OpenID Connect issuer.
+https://auth.example.com as an example of the Authelia root URL which is also the OpenID Connect 1.0 Issuer.
 
 ### Well Known Discovery Endpoints
 
@@ -283,12 +283,12 @@ These endpoints can be utilized to discover other endpoints and metadata about t
 
 |                 Endpoint                  |                              Path                               |
 |:-----------------------------------------:|:---------------------------------------------------------------:|
-|        [OpenID Connect Discovery]         |    https://auth.example.com/.well-known/openid-configuration    |
+|        [OpenID Connect Discovery 1.0]         |    https://auth.example.com/.well-known/openid-configuration    |
 | [OAuth 2.0 Authorization Server Metadata] | https://auth.example.com/.well-known/oauth-authorization-server |
 
 ### Discoverable Endpoints
 
-These endpoints implement OpenID Connect elements.
+These endpoints implement OpenID Connect 1.0 Provider specifications.
 
 |            Endpoint             |                              Path                              |          Discovery Attribute          |
 |:-------------------------------:|:--------------------------------------------------------------:|:-------------------------------------:|
@@ -365,7 +365,7 @@ The advantages of this approach are as follows:
 
 [OpenID Connect 1.0]: https://openid.net/connect/
 
-[OpenID Connect Discovery]: https://openid.net/specs/openid-connect-discovery-1_0.html
+[OpenID Connect Discovery 1.0]: https://openid.net/specs/openid-connect-discovery-1_0.html
 [OAuth 2.0 Authorization Server Metadata]: https://datatracker.ietf.org/doc/html/rfc8414
 
 [JSON Web Key Set]: https://datatracker.ietf.org/doc/html/rfc7517#section-5

docs/content/en/integration/openid-connect/kasm-workspaces/index.md

@@ -1,6 +1,6 @@
 ---
 title: "Kasm Workspaces"
-description: "Integrating Kasm Workspaces with the Authelia OpenID Connect Provider."
+description: "Integrating Kasm Workspaces with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2023-04-27T18:40:06+10:00
 draft: false

docs/content/en/integration/openid-connect/komga/index.md

@@ -1,6 +1,6 @@
 ---
 title: "Komga"
-description: "Integrating Komga with the Authelia OpenID Connect Provider."
+description: "Integrating Komga with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2022-08-26T11:39:00+10:00
 draft: false

docs/content/en/integration/openid-connect/minio/index.md

@@ -1,6 +1,6 @@
 ---
 title: "MinIO"
-description: "Integrating MinIO with the Authelia OpenID Connect Provider."
+description: "Integrating MinIO with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2023-03-21T11:21:23+11:00
 draft: false

docs/content/en/integration/openid-connect/misago/index.md

@@ -1,6 +1,6 @@
 ---
 title: "Misago"
-description: "Integrating Misago with the Authelia OpenID Connect Provider."
+description: "Integrating Misago with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2023-03-14T08:51:13+11:00
 draft: false

docs/content/en/integration/openid-connect/nextcloud/index.md

@@ -1,6 +1,6 @@
 ---
 title: "Nextcloud"
-description: "Integrating Nextcloud with the Authelia OpenID Connect Provider."
+description: "Integrating Nextcloud with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2022-06-15T17:51:47+10:00
 draft: false

docs/content/en/integration/openid-connect/outline/index.md

@@ -1,6 +1,6 @@
 ---
 title: "Outline"
-description: "Integrating Outline with the Authelia OpenID Connect Provider."
+description: "Integrating Outline with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2022-08-12T09:11:42+10:00
 draft: false

docs/content/en/integration/openid-connect/portainer/index.md

@@ -1,6 +1,6 @@
 ---
 title: "Portainer"
-description: "Integrating Portainer with the Authelia OpenID Connect Provider."
+description: "Integrating Portainer with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2022-06-15T17:51:47+10:00
 draft: false

docs/content/en/integration/openid-connect/proxmox/index.md

@@ -1,6 +1,6 @@
 ---
 title: "Proxmox"
-description: "Integrating Proxmox with the Authelia OpenID Connect Provider."
+description: "Integrating Proxmox with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2022-06-15T17:51:47+10:00
 draft: false

docs/content/en/integration/openid-connect/seafile/index.md

@@ -1,6 +1,6 @@
 ---
 title: "Seafile"
-description: "Integrating Seafile with the Authelia OpenID Connect Provider."
+description: "Integrating Seafile with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2022-06-15T17:51:47+10:00
 draft: false

docs/content/en/integration/openid-connect/synapse/index.md

@@ -1,6 +1,6 @@
 ---
 title: "Synapse"
-description: "Integrating Synapse with the Authelia OpenID Connect Provider."
+description: "Integrating Synapse with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2022-06-15T17:51:47+10:00
 draft: false

docs/content/en/integration/openid-connect/synology-dsm/index.md

@@ -1,6 +1,6 @@
 ---
 title: "Synology DSM"
-description: "Integrating Synology DSM with the Authelia OpenID Connect Provider."
+description: "Integrating Synology DSM with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2022-10-18T21:22:13+11:00
 draft: false

docs/content/en/integration/openid-connect/tailscale/index.md

@@ -1,6 +1,6 @@
 ---
 title: "Tailscale"
-description: "Using Authelia as the Tailscale OpenID Connect Provider."
+description: "Integrating Tailscale with the Authelia OpenID Connect 1.0 Provider."
 lead: ""
 date: 2023-04-23T10:06:28+10:00
 draft: false

docs/content/en/integration/prologue/get-started.md

@@ -36,7 +36,7 @@ In addition to the `https` scheme requirement for Authelia itself:
 1. Due to the fact a cookie is used, it's an intentional design decision that *__ALL__* applications/domains protected via
 this method *__MUST__* use secure schemes (`https` and `wss`) for all of their communication.
 
-### OpenID Connect
+### OpenID Connect 1.0
 
 No additional requirements other than the use of the `https` scheme for Authelia itself exist excluding those mandated
 by the relevant specifications.
@@ -93,6 +93,11 @@ recommended that you read the relevant [Proxy Integration Documentation](../prox
 recommend viewing the dedicated [Kubernetes Documentation](../kubernetes/introduction.md) prior to viewing the
 [Proxy Integration Documentation](../proxies/introduction.md).*
 
+## Additional Useful Links
+
+See the [Frequently Asked Questions](../../reference/guides/frequently-asked-questions.md) for helpful sections of the
+documentation which may answer specific questions.
+
 ## Moving to Production
 
 We consider it important to do several things in moving to a production environment.

docs/content/en/integration/proxies/nginx.md

@@ -466,14 +466,6 @@ and is paired with [authelia-location.conf](#authelia-locationconf).*
 ## Send a subrequest to Authelia to verify if the user is authenticated and has permission to access the resource.
 auth_request /internal/authelia/authz;
 
-## Save the upstream authorization response headers from Authelia to variables.
-auth_request_set $authorization $upstream_http_authorization;
-auth_request_set $proxy_authorization $upstream_http_proxy_authorization;
-
-## Inject the authorization response headers from the variables into the request made to the backend.
-proxy_set_header Authorization $authorization;
-proxy_set_header Proxy-Authorization $proxy_authorization;
-
 ## Save the upstream metadata response headers from Authelia to variables.
 auth_request_set $user $upstream_http_remote_user;
 auth_request_set $groups $upstream_http_remote_groups;
@@ -486,10 +478,6 @@ proxy_set_header Remote-Groups $groups;
 proxy_set_header Remote-Email $email;
 proxy_set_header Remote-Name $name;
 
-## Include the Set-Cookie header if present.
-auth_request_set $cookie $upstream_http_set_cookie;
-add_header Set-Cookie $cookie;
-
 ## Configure the redirection when the authz failure occurs. Lines starting with 'Modern Method' and 'Legacy Method'
 ## should be commented / uncommented as pairs. The modern method uses the session cookies configuration's authelia_url
 ## value to determine the redirection URL here. It's much simpler and compatible with the mutli-cookie domain easily.

docs/content/en/integration/proxies/traefik.md

@@ -517,7 +517,7 @@ http:
 ```
 {{< /details >}}
 
-## FAQ
+## Frequently Asked Questions
 
 ### Basic Authentication
 

docs/content/en/overview/authentication/push-notification/index.md

@@ -39,7 +39,7 @@ Now that Authelia is configured, pass the first factor and select the Push notif
 You should now receive a notification on your mobile phone with all the details about the authentication request. In
 case you have multiple devices available, you will be asked to select your preferred device.
 
-## FAQ
+## Frequently Asked Questions
 
 ### Why don't I have access to the *Push Notification* option?
 

docs/content/en/overview/authentication/security-key/index.md

@@ -43,7 +43,7 @@ requested:
 
 Easy, right?!
 
-## FAQ
+## Frequently Asked Questions
 
 ### Can I register multiple FIDO2 WebAuthn devices?
 

docs/content/en/overview/security/threat-model.md

@@ -86,5 +86,5 @@ It's important to note that Authelia is considered running in a trusted environm
    transmitted unsigned to the backends, meaning a malicious user within the network could pretend to be
    Authelia and send those headers to bypass authentication and gain access to the service. This could be mitigated by
    transmitting those headers with a digital signature which could be verified by the backend however, many backends
-   just won't support it. It has therefore been decided to invest in OpenID Connect instead to solve that authentication
-   delegation problem.
+   just won't support it. It has therefore been decided to invest in OpenID Connect 1.0 instead to solve that
+   authentication delegation problem.

docs/content/en/reference/guides/frequently-asked-questions.md

@@ -12,6 +12,24 @@ weight: 220
 toc: true
 ---
 
+## Miscellaneous
+
+- [Docker](../../integration/deployment/docker.md#frequently-asked-questions)
+- [Development](../../contributing/development/environment.md#frequently-asked-questions)
+
+## Authentication
+
+- [WebAuthn](../../overview/authentication/security-key/index.md#frequently-asked-questions)
+- [Duo](../../overview/authentication/push-notification/index.md#frequently-asked-questions)
+
+## Proxies
+
+- [Traefik](../../integration/proxies/traefik.md#frequently-asked-questions)
+
+## Kubernetes
+
+- [General](../../integration/kubernetes/introduction.md#frequently-asked-questions)
+
 ## Identity Providers
 
 - [OpenID Connect 1.0 Integration](../../integration/openid-connect/frequently-asked-questions.md)

docs/content/en/reference/guides/ldap.md

@@ -194,8 +194,8 @@ Username column.
 | activedirectory | sAMAccountName | displayName  | mail |     cn     | distinguishedName  | memberOf  |
 |   rfc2307bis    |      uid       | displayName  | mail |     cn     |        N/A         | memberOf  |
 |     freeipa     |      uid       | displayName  | mail |     cn     |        N/A         | memberOf  |
-|      lldap      |      uid       |      cn      | mail |     cn     |        N/A         |    N/A    |
-|     glauth      |       cn       | description  | mail |     cn     |        N/A         |    N/A    |
+|      lldap      |      uid       |      cn      | mail |     cn     |        N/A         | memberOf  |
+|     glauth      |       cn       | description  | mail |     cn     |        N/A         | memberOf  |
 
 #### Filter defaults
 
@@ -212,8 +212,8 @@ the following conditions:
 - Their password is expired:
   - The [Active Directory] implementation achieves this via the `(!(pwdLastSet=0))` filter.
   - The [FreeIPA] implementation achieves this via the `(krbPasswordExpiration>={date-time:generalized})` filter.
+  - The [RFC2307bis] implementation achieves this via the `(!(pwdReset=TRUE))` filter.
   - The following implementations have no suitable attribute for this as far as we're aware:
-    - [RFC2307bis]
     - [GLAuth]
     - [lldap]
 - Their account is expired:
@@ -228,7 +228,7 @@ the following conditions:
 |:---------------:|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|:-----------------------------------------------------------------------------------------------------------------------------------------:|
 |     custom      |                                                                                                                           N/A                                                                                                                            |                                                                    N/A                                                                    |
 | activedirectory | (&(|({username_attribute}={input})({mail_attribute}={input}))(sAMAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(!(pwdLastSet=0))(|(!(accountExpires=*))(accountExpires=0)(accountExpires>={date-time:microsoft-nt}))) |                               (&(member={dn})(|(sAMAccountType=268435456)(sAMAccountType=536870912)))                                |
-|   rfc2307bis    |                                                         (&(|({username_attribute}={input})({mail_attribute}={input}))(|(objectClass=inetOrgPerson)(objectClass=organizationalPerson)))                                                         | (&(|(member={dn})(uniqueMember={dn}))(|(objectClass=groupOfNames)(objectClass=groupOfUniqueNames)(objectClass=groupOfMembers))) |
+|   rfc2307bis    |                                                (&(|({username_attribute}={input})({mail_attribute}={input}))(|(objectClass=inetOrgPerson)(objectClass=organizationalPerson))(!(pwdReset=TRUE)))                                                | (&(|(member={dn})(uniqueMember={dn}))(|(objectClass=groupOfNames)(objectClass=groupOfUniqueNames)(objectClass=groupOfMembers))) |
 |     freeipa     |   (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person)(!(nsAccountLock=TRUE))(krbPasswordExpiration>={date-time:generalized})(|(!(krbPrincipalExpiration=*))(krbPrincipalExpiration>={date-time:generalized})))   |                                                (&(member={dn})(objectClass=groupOfNames))                                                 |
 |      lldap      |                                                                                 (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))                                                                                  |                                                (&(member={dn})(objectClass=groupOfNames))                                                 |
 |     glauth      |                                                                 (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=posixAccount)(!(accountStatus=inactive)))                                                                 |                                              (&(uniqueMember={dn})(objectClass=posixGroup))                                               |

docs/content/en/roadmap/active/dashboard-control-panel.md

@@ -14,8 +14,8 @@ aliases:
   - /r/dashboard
 ---
 
-This feature has several major impacts on other roadmap items. For example several OpenID Connect features would greatly
-benefit from a dashboard. It would also be important when we implement WebAuthn features like passwordless
+This feature has several major impacts on other roadmap items. For example several OpenID Connect 1.0 features would
+greatly benefit from a dashboard. It would also be important when we implement WebAuthn features like passwordless
 authentication allowing users to intentionally register a passwordless credential.
 
 ## Stages

docs/content/en/roadmap/active/openid-connect.md

@@ -1,7 +1,7 @@
 ---
-title: "OpenID Connect"
-description: "Authelia OpenID Connect Implementation"
-lead: "The OpenID Connect Provider role is a very useful but complex feature to enhance interoperability of Authelia with other products. "
+title: "OpenID Connect 1.0"
+description: "Authelia OpenID Connect 1.0 Provider Implementation"
+lead: "The OpenID Connect 1.0 Provider role is a very useful but complex feature to enhance interoperability of Authelia with other products. "
 date: 2022-06-15T17:51:47+10:00
 draft: false
 images: []
@@ -15,14 +15,15 @@ aliases:
   - /docs/roadmap/oidc.html
 ---
 
-We have decided to implement [OpenID Connect] as a beta feature, it's suggested you only utilize it for testing and
-providing feedback, and should take caution in relying on it in production as of now. [OpenID Connect] and it's related
-endpoints are not enabled by default unless you specifically configure the [OpenID Connect] section.
+We have decided to implement [OpenID Connect 1.0] as a beta feature, it's suggested you only utilize it for testing and
+providing feedback, and should take caution in relying on it in production as of now. [OpenID Connect 1.0] and it's
+related endpoints are not enabled by default unless you specifically configure the [OpenID Connect 1.0] section.
 
-As [OpenID Connect] is fairly complex (the [OpenID Connect] Provider role especially so) it's intentional that it is
-both a beta and that the implemented features are part of a thoughtful roadmap. Items that are not immediately obvious
-as required (i.e. bug fixes or spec features), will likely be discussed in team meetings or on GitHub issues before
-being added to the list. We want to implement this feature in a very thoughtful way in order to avoid security issues.
+As [OpenID Connect 1.0] is fairly complex (the [OpenID Connect 1.0] Provider role especially so) it's intentional that
+it is both a beta and that the implemented features are part of a thoughtful roadmap. Items that are not immediately
+obvious as required (i.e. bug fixes or spec features), will likely be discussed in team meetings or on GitHub issues
+before being added to the list. We want to implement this feature in a very thoughtful way in order to avoid security
+issues.
 
 ## Stages
 
@@ -38,7 +39,7 @@ Feature List:
 
 * [User Consent](https://openid.net/specs/openid-connect-core-1_0.html#Consent)
 * [Authorization Code Flow](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowSteps)
-* [OpenID Connect Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html)
+* [OpenID Connect Discovery 1.0](https://openid.net/specs/openid-connect-discovery-1_0.html)
 * [RS256 Signature Strategy](https://datatracker.ietf.org/doc/html/rfc7518#section-3.1)
 * Per Client Scope/Grant Type/Response Type Restriction
 * Per Client Authorization Policy (1FA/2FA)
@@ -64,7 +65,7 @@ Feature List:
 
 Feature List:
 
-* [Proof Key Code Exchange (PKCE)] for Authorization Code Flow
+* [RFC7636: Proof Key for Code Exchange (PKCE)] for Authorization Code Flow
 * Claims:
   * `preferred_username` - sending the username in this claim instead of the `sub` claim.
 
@@ -79,12 +80,12 @@ Feature List:
   * Auditable Information
   * Subject to User Mapping
 * Opaque [RFC4122] UUID v4's for subject identifiers
-* Support for Pairwise and Plain subject identifier types as per [OpenID Connect Core (Subject Identifier Types)]
-  * Utilize the pairwise example method 3 as per [OpenID Connect Core (Pairwise Identifier Algorithm)]
+* Support for Pairwise and Plain subject identifier types as per [OpenID Connect Core 1.0 (Subject Identifier Types)]
+  * Utilize the pairwise example method 3 as per [OpenID Connect Core 1.0 (Pairwise Identifier Algorithm)]
 * Claims:
   * `sub` - replace username with opaque random [RFC4122] UUID v4
   * `amr` - authentication method references as per [RFC8176]
-  * `azp` - authorized party as per [OpenID Connect Core (ID Token)]
+  * `azp` - authorized party as per [OpenID Connect Core 1.0 (ID Token)]
   * `client_id` - the Client ID as per [RFC8693 Section 4.3]
 * [Cross Origin Resource Sharing] (CORS):
   * Automatically allow all cross-origin requests to the discovery endpoints
@@ -106,7 +107,7 @@ Feature List:
   * Implicit:
     * Not expressly standards compliant
     * Never asks for end-user consent
-    * Not compatible with the consent prompt type
+    * Not compatible with the `consent` prompt type
   * Pre-Configured:
     * Allows users to save consent sessions for a duration configured by the administrator
     * Operates nearly identically to the explicit consent mode
@@ -115,15 +116,15 @@ Feature List:
 
 {{< roadmap-status stage="in-progress" version="v4.38.0" >}}
 
-* [RFC9126: OAuth 2.0 Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126)
-* [RFC7523: JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants](https://datatracker.ietf.org/doc/html/rfc7523):
+* [RFC9126: OAuth 2.0 Pushed Authorization Requests]
+* [RFC7523: JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants]:
   * Client Auth Method `client_secret_jwt`
   * Client Auth Method `private_key_jwt`
-* Per-Client [Proof Key Code Exchange (PKCE)] Policy
+* Per-Client [RFC7636: Proof Key for Code Exchange (PKCE)] Policy
 * Multiple Issuer JWKs:
-  * RS256, RS384, RS512
-  * PS256, PS384, PS512
-  * ES256, ES384, ES512
+  * `RS256`, `RS384`, `RS512`
+  * `PS256`, `PS384`, `PS512`
+  * `ES256`, `ES384`, `ES512`
 
 ### Beta 7
 
@@ -134,7 +135,7 @@ Feature List:
 * Prompt Handling
 * Display Handling
 
-See [OpenID Connect Core (Mandatory to Implement Features for All OpenID Providers)].
+See [OpenID Connect Core 1.0 (Mandatory to Implement Features for All OpenID Providers)].
 
 ### Beta 8
 
@@ -144,6 +145,15 @@ Feature List:
 
 * Revoke Tokens on User Logout or Expiration
 * [JSON Web Key Rotation](https://openid.net/specs/openid-connect-messages-1_0-20.html#rotate.sig.keys)
+* In-Storage Configuration:
+  * Multi-Issuer Configuration (require one per Issuer URL)
+  * Dynamically Configured via CLI
+  * Import from YAML:
+    * Manual method
+    * Bootstrap method:
+      * Defaults to one time only
+      * Can optionally override the database configuration
+  * Salt (random) and/or Peppered (storage encryption) Client Credentials
 
 ### General Availability
 
@@ -151,7 +161,7 @@ Feature List:
 
 Feature List:
 
-* Enable by Default
+* ~~Enable by Default~~
 * Only after all previous stages are checked for bugs
 
 ### Miscellaneous
@@ -162,13 +172,13 @@ This stage lists features which individually do not fit into a specific stage an
 
 {{< roadmap-status >}}
 
-See the [OpenID Connect] website for the [OpenID Connect Dynamic Client Registration] specification.
+See the [OpenID Connect 1.0] website for the [OpenID Connect Dynamic Client Registration 1.0] specification.
 
 #### OpenID Connect Back-Channel Logout
 
 {{< roadmap-status >}}
 
-See the [OpenID Connect] website for the [OpenID Connect Back-Channel Logout] specification.
+See the [OpenID Connect 1.0] website for the [OpenID Connect Back-Channel Logout 1.0] specification.
 
 Should be implemented alongside [Dynamic Client Registration](#openid-connect-dynamic-client-registration).
 
@@ -176,7 +186,7 @@ Should be implemented alongside [Dynamic Client Registration](#openid-connect-dy
 
 {{< roadmap-status >}}
 
-See the [OpenID Connect] website for the [OpenID Connect Front-Channel Logout] specification.
+See the [OpenID Connect 1.0] website for the [OpenID Connect Front-Channel Logout 1.0] specification.
 
 Should be implemented alongside [Dynamic Client Registration](#openid-connect-dynamic-client-registration).
 
@@ -190,7 +200,7 @@ See the [IETF Specification RFC8414](https://datatracker.ietf.org/doc/html/rfc84
 
 {{< roadmap-status >}}
 
-See the [OpenID Connect] website for the [OpenID Connect Session Management] specification.
+See the [OpenID Connect 1.0] website for the [OpenID Connect Session Management 1.0] specification.
 
 #### End-User Scope Grants
 
@@ -216,14 +226,17 @@ The `preferred_username` claim was missing and was fixed.
 [RFC8693 Section 4.3]: https://datatracker.ietf.org/doc/html/rfc8693/#section-4.3
 [RFC4122]: https://datatracker.ietf.org/doc/html/rfc4122
 
-[OpenID Connect]: https://openid.net/connect/
-[OpenID Connect Front-Channel Logout]: https://openid.net/specs/openid-connect-frontchannel-1_0.html
-[OpenID Connect Back-Channel Logout]: https://openid.net/specs/openid-connect-backchannel-1_0.html
-[OpenID Connect Session Management]: https://openid.net/specs/openid-connect-session-1_0.html
-[OpenID Connect Dynamic Client Registration]: https://openid.net/specs/openid-connect-registration-1_0.html
+[OpenID Connect 1.0]: https://openid.net/connect/
+[OpenID Connect Front-Channel Logout 1.0]: https://openid.net/specs/openid-connect-frontchannel-1_0.html
+[OpenID Connect Back-Channel Logout 1.0]: https://openid.net/specs/openid-connect-backchannel-1_0.html
+[OpenID Connect Session Management 1.0]: https://openid.net/specs/openid-connect-session-1_0.html
+[OpenID Connect Dynamic Client Registration 1.0]: https://openid.net/specs/openid-connect-registration-1_0.html
 
-[OpenID Connect Core (ID Token)]: https://openid.net/specs/openid-connect-core-1_0.html#IDToken
-[OpenID Connect Core (Subject Identifier Types)]: https://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes
-[OpenID Connect Core (Pairwise Identifier Algorithm)]: https://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg
-[OpenID Connect Core (Mandatory to Implement Features for All OpenID Providers)]: https://openid.net/specs/openid-connect-core-1_0.html#ServerMTI
-[Proof Key Code Exchange (PKCE)]: https://datatracker.ietf.org/doc/html/rfc7636
+[OpenID Connect Core 1.0 (ID Token)]: https://openid.net/specs/openid-connect-core-1_0.html#IDToken
+[OpenID Connect Core 1.0 (Subject Identifier Types)]: https://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes
+[OpenID Connect Core 1.0 (Pairwise Identifier Algorithm)]: https://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg
+[OpenID Connect Core 1.0 (Mandatory to Implement Features for All OpenID Providers)]: https://openid.net/specs/openid-connect-core-1_0.html#ServerMTI
+
+[RFC7636: Proof Key for Code Exchange (PKCE)]: https://datatracker.ietf.org/doc/html/rfc7636
+[RFC7523: JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants]: https://datatracker.ietf.org/doc/html/rfc7523
+[RFC9126: OAuth 2.0 Pushed Authorization Requests]: https://datatracker.ietf.org/doc/html/rfc9126

docs/content/en/roadmap/prologue/introduction.md

@@ -25,7 +25,7 @@ be glad to share ideas and plans with you.
 This is a summary of the features which are currently on the roadmap with links to further details:
 
 1. [WebAuthn](../active/webauthn.md)
-2. [OpenID Connect Provider](../active/openid-connect.md)
+2. [OpenID Connect 1.0 Provider](../active/openid-connect.md)
 3. [Internationalization or Multilingual Support](../active/internationalization.md)
 4. [Multiple Domain Protection](../active/multi-domain-protection.md)
 5. [Control Panel / Dashboard for User / Administration Settings](../active/dashboard-control-panel.md)

envoy-proto/ext-auth.proto

@@ -0,0 +1,144 @@
+syntax = "proto3";
+
+package envoy.service.auth.v3;
+
+import "envoy/config/core/v3/base.proto";
+import "envoy/service/auth/v3/attribute_context.proto";
+import "envoy/type/v3/http_status.proto";
+
+import "google/protobuf/struct.proto";
+import "google/rpc/status.proto";
+
+import "envoy/annotations/deprecation.proto";
+import "udpa/annotations/status.proto";
+import "udpa/annotations/versioning.proto";
+
+option java_package = "io.envoyproxy.envoy.service.auth.v3";
+option java_outer_classname = "ExternalAuthProto";
+option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/service/auth/v3;authv3";
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Authorization service]
+
+// The authorization service request messages used by external authorization :ref:`network filter
+// <config_network_filters_ext_authz>` and :ref:`HTTP filter <config_http_filters_ext_authz>`.
+
+// A generic interface for performing authorization check on incoming
+// requests to a networked service.
+service Authorization {
+  // Performs authorization check based on the attributes associated with the
+  // incoming request, and returns status `OK` or not `OK`.
+  rpc Check(CheckRequest) returns (CheckResponse) {
+  }
+}
+
+message CheckRequest {
+  option (udpa.annotations.versioning).previous_message_type = "envoy.service.auth.v2.CheckRequest";
+
+  // The request attributes.
+  AttributeContext attributes = 1;
+}
+
+// HTTP attributes for a denied response.
+message DeniedHttpResponse {
+  option (udpa.annotations.versioning).previous_message_type =
+      "envoy.service.auth.v2.DeniedHttpResponse";
+
+  // This field allows the authorization service to send an HTTP response status code to the
+  // downstream client. If not set, Envoy sends ``403 Forbidden`` HTTP status code by default.
+  type.v3.HttpStatus status = 1;
+
+  // This field allows the authorization service to send HTTP response headers
+  // to the downstream client. Note that the :ref:`append field in HeaderValueOption <envoy_v3_api_field_config.core.v3.HeaderValueOption.append>` defaults to
+  // false when used in this message.
+  repeated config.core.v3.HeaderValueOption headers = 2;
+
+  // This field allows the authorization service to send a response body data
+  // to the downstream client.
+  string body = 3;
+}
+
+// HTTP attributes for an OK response.
+// [#next-free-field: 9]
+message OkHttpResponse {
+  option (udpa.annotations.versioning).previous_message_type =
+      "envoy.service.auth.v2.OkHttpResponse";
+
+  // HTTP entity headers in addition to the original request headers. This allows the authorization
+  // service to append, to add or to override headers from the original request before
+  // dispatching it to the upstream. Note that the :ref:`append field in HeaderValueOption <envoy_v3_api_field_config.core.v3.HeaderValueOption.append>` defaults to
+  // false when used in this message. By setting the ``append`` field to ``true``,
+  // the filter will append the correspondent header value to the matched request header.
+  // By leaving ``append`` as false, the filter will either add a new header, or override an existing
+  // one if there is a match.
+  repeated config.core.v3.HeaderValueOption headers = 2;
+
+  // HTTP entity headers to remove from the original request before dispatching
+  // it to the upstream. This allows the authorization service to act on auth
+  // related headers (like ``Authorization``), process them, and consume them.
+  // Under this model, the upstream will either receive the request (if it's
+  // authorized) or not receive it (if it's not), but will not see headers
+  // containing authorization credentials.
+  //
+  // Pseudo headers (such as ``:authority``, ``:method``, ``:path`` etc), as well as
+  // the header ``Host``, may not be removed as that would make the request
+  // malformed. If mentioned in ``headers_to_remove`` these special headers will
+  // be ignored.
+  //
+  // When using the HTTP service this must instead be set by the HTTP
+  // authorization service as a comma separated list like so:
+  // ``x-envoy-auth-headers-to-remove: one-auth-header, another-auth-header``.
+  repeated string headers_to_remove = 5;
+
+  // This field has been deprecated in favor of :ref:`CheckResponse.dynamic_metadata
+  // <envoy_v3_api_field_service.auth.v3.CheckResponse.dynamic_metadata>`. Until it is removed,
+  // setting this field overrides :ref:`CheckResponse.dynamic_metadata
+  // <envoy_v3_api_field_service.auth.v3.CheckResponse.dynamic_metadata>`.
+  google.protobuf.Struct dynamic_metadata = 3
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
+
+  // This field allows the authorization service to send HTTP response headers
+  // to the downstream client on success. Note that the :ref:`append field in HeaderValueOption <envoy_v3_api_field_config.core.v3.HeaderValueOption.append>`
+  // defaults to false when used in this message.
+  repeated config.core.v3.HeaderValueOption response_headers_to_add = 6;
+
+  // This field allows the authorization service to set (and overwrite) query
+  // string parameters on the original request before it is sent upstream.
+  repeated config.core.v3.QueryParameter query_parameters_to_set = 7;
+
+  // This field allows the authorization service to specify which query parameters
+  // should be removed from the original request before it is sent upstream. Each
+  // element in this list is a case-sensitive query parameter name to be removed.
+  repeated string query_parameters_to_remove = 8;
+}
+
+// Intended for gRPC and Network Authorization servers ``only``.
+message CheckResponse {
+  option (udpa.annotations.versioning).previous_message_type =
+      "envoy.service.auth.v2.CheckResponse";
+
+  // Status ``OK`` allows the request. Any other status indicates the request should be denied, and
+  // for HTTP filter, if not overridden by :ref:`denied HTTP response status <envoy_v3_api_field_service.auth.v3.DeniedHttpResponse.status>`
+  // Envoy sends ``403 Forbidden`` HTTP status code by default.
+  google.rpc.Status status = 1;
+
+  // An message that contains HTTP response attributes. This message is
+  // used when the authorization service needs to send custom responses to the
+  // downstream client or, to modify/add request headers being dispatched to the upstream.
+  oneof http_response {
+    // Supplies http attributes for a denied response.
+    DeniedHttpResponse denied_response = 2;
+
+    // Supplies http attributes for an ok response.
+    OkHttpResponse ok_response = 3;
+  }
+
+  // Optional response metadata that will be emitted as dynamic metadata to be consumed by the next
+  // filter. This metadata lives in a namespace specified by the canonical name of extension filter
+  // that requires it:
+  //
+  // - :ref:`envoy.filters.http.ext_authz <config_http_filters_ext_authz_dynamic_metadata>` for HTTP filter.
+  // - :ref:`envoy.filters.network.ext_authz <config_network_filters_ext_authz_dynamic_metadata>` for network filter.
+  google.protobuf.Struct dynamic_metadata = 4;
+}

examples/compose/lite/docker-compose.yml

@@ -45,7 +45,7 @@ services:
       - TZ=Australia/Melbourne
 
   traefik:
-    image: traefik:v2.10.1
+    image: traefik:v2.10.3
     container_name: traefik
     volumes:
       - ./traefik:/etc/traefik

examples/compose/local/docker-compose.yml

@@ -32,7 +32,7 @@ services:
       - TZ=Australia/Melbourne
 
   traefik:
-    image: traefik:v2.10.1
+    image: traefik:v2.10.3
     container_name: traefik
     volumes:
       - ./traefik:/etc/traefik

go.mod

@@ -11,16 +11,16 @@ require (
 	github.com/fasthttp/session/v2 v2.5.0
 	github.com/fsnotify/fsnotify v1.6.0
 	github.com/go-asn1-ber/asn1-ber v1.5.4
-	github.com/go-crypt/crypt v0.2.7
-	github.com/go-ldap/ldap/v3 v3.4.5-0.20230506142018-039466e6b835
-	github.com/go-rod/rod v0.112.9
+	github.com/go-crypt/crypt v0.2.9
+	github.com/go-ldap/ldap/v3 v3.4.5
+	github.com/go-rod/rod v0.113.3
 	github.com/go-sql-driver/mysql v1.7.1
 	github.com/go-webauthn/webauthn v0.5.0
 	github.com/golang-jwt/jwt/v4 v4.5.0
 	github.com/golang/mock v1.6.0
 	github.com/google/uuid v1.3.0
-	github.com/hashicorp/go-retryablehttp v0.7.2
-	github.com/jackc/pgx/v5 v5.3.1
+	github.com/hashicorp/go-retryablehttp v0.7.4
+	github.com/jackc/pgx/v5 v5.4.1
 	github.com/jmoiron/sqlx v1.3.5
 	github.com/knadh/koanf/parsers/yaml v0.1.0
 	github.com/knadh/koanf/providers/confmap v0.1.0
@@ -28,27 +28,27 @@ require (
 	github.com/knadh/koanf/providers/posflag v0.1.0
 	github.com/knadh/koanf/providers/rawbytes v0.1.0
 	github.com/knadh/koanf/v2 v2.0.1
-	github.com/mattn/go-sqlite3 v1.14.16
+	github.com/mattn/go-sqlite3 v1.14.17
 	github.com/mitchellh/mapstructure v1.5.0
 	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826
 	github.com/ory/fosite v0.44.0
 	github.com/ory/herodot v0.10.2
-	github.com/ory/x v0.0.555
-	github.com/otiai10/copy v1.11.0
+	github.com/ory/x v0.0.563
+	github.com/otiai10/copy v1.12.0
 	github.com/pkg/errors v0.9.1
 	github.com/pquerna/otp v1.4.0
-	github.com/prometheus/client_golang v1.15.1
-	github.com/sirupsen/logrus v1.9.0
+	github.com/prometheus/client_golang v1.16.0
+	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/cobra v1.7.0
 	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.8.2
+	github.com/stretchr/testify v1.8.4
 	github.com/trustelem/zxcvbn v1.0.1
-	github.com/valyala/fasthttp v1.47.0
+	github.com/valyala/fasthttp v1.48.0
 	github.com/wneessen/go-mail v0.3.9
-	golang.org/x/net v0.10.0
-	golang.org/x/sync v0.2.0
-	golang.org/x/term v0.8.0
-	golang.org/x/text v0.9.0
+	golang.org/x/net v0.11.0
+	golang.org/x/sync v0.3.0
+	golang.org/x/term v0.9.0
+	golang.org/x/text v0.10.0
 	gopkg.in/square/go-jose.v2 v2.6.0
 	gopkg.in/yaml.v3 v3.0.1
 )
@@ -59,6 +59,7 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
 	github.com/cristalhq/jwt/v4 v4.0.2 // indirect
 	github.com/dave/jennifer v1.6.0 // indirect
@@ -68,12 +69,16 @@ require (
 	github.com/dlclark/regexp2 v1.4.0 // indirect
 	github.com/dustin/go-humanize v1.0.0 // indirect
 	github.com/ecordell/optgen v0.0.6 // indirect
+	github.com/envoyproxy/go-control-plane v0.11.1 // indirect
+	github.com/envoyproxy/protoc-gen-validate v1.0.1 // indirect
 	github.com/facebookgo/stack v0.0.0-20160209184415-751773369052 // indirect
 	github.com/fxamacker/cbor/v2 v2.4.0 // indirect
-	github.com/go-crypt/x v0.2.0 // indirect
+	github.com/go-crypt/x v0.2.1 // indirect
 	github.com/go-redis/redis/v8 v8.11.5 // indirect
 	github.com/go-webauthn/revoke v0.1.9 // indirect
-	github.com/golang/glog v1.0.0 // indirect
+	github.com/gogo/googleapis v1.4.1 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/glog v1.1.0 // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/go-tpm v0.3.3 // indirect
 	github.com/gorilla/websocket v1.5.0 // indirect
@@ -97,9 +102,9 @@ require (
 	github.com/pelletier/go-toml/v2 v2.0.6 // indirect
 	github.com/philhofer/fwd v1.1.2 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/client_model v0.3.0 // indirect
+	github.com/prometheus/client_model v0.4.0 // indirect
 	github.com/prometheus/common v0.42.0 // indirect
-	github.com/prometheus/procfs v0.9.0 // indirect
+	github.com/prometheus/procfs v0.10.1 // indirect
 	github.com/redis/go-redis/v9 v9.0.4 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/savsgio/gotils v0.0.0-20230208104028-c358bd845dee // indirect
@@ -112,18 +117,20 @@ require (
 	github.com/tinylib/msgp v1.1.8 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	github.com/ysmood/fetchup v0.2.2 // indirect
+	github.com/ysmood/fetchup v0.2.3 // indirect
 	github.com/ysmood/goob v0.4.0 // indirect
+	github.com/ysmood/got v0.34.1 // indirect
 	github.com/ysmood/gson v0.7.3 // indirect
 	github.com/ysmood/leakless v0.8.0 // indirect
-	golang.org/x/crypto v0.7.0 // indirect
+	golang.org/x/crypto v0.10.0 // indirect
 	golang.org/x/mod v0.10.0 // indirect
-	golang.org/x/oauth2 v0.5.0 // indirect
-	golang.org/x/sys v0.8.0 // indirect
-	golang.org/x/tools v0.7.0 // indirect
+	golang.org/x/oauth2 v0.7.0 // indirect
+	golang.org/x/sys v0.9.0 // indirect
+	golang.org/x/tools v0.8.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20230403163135-c38d8f061ccd // indirect
-	google.golang.org/grpc v1.54.0 // indirect
+	google.golang.org/genproto v0.0.0-20230526203410-71b5a4ffd15e // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230526203410-71b5a4ffd15e // indirect
+	google.golang.org/grpc v1.56.0 // indirect
 	google.golang.org/protobuf v1.30.0 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect

go.sum

@@ -72,6 +72,8 @@ github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDk
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
+github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4 h1:/inchEIKaYC1Akx+H+gqO04wryn5h75LSazbRlnya1k=
+github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
@@ -113,7 +115,11 @@ github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.m
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
+github.com/envoyproxy/go-control-plane v0.11.1 h1:wSUXTlLfiAQRWs2F+p+EKOY9rUyis1MyGqJ2DIk5HpM=
+github.com/envoyproxy/go-control-plane v0.11.1/go.mod h1:uhMcXKCQMEJHiAb0w+YGefQLaTEw+YhGluxZkrTmD0g=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/envoyproxy/protoc-gen-validate v1.0.1 h1:kt9FtLiooDc0vbwTLhdg3dyNX1K9Qwa1EK9LcD4jVUQ=
+github.com/envoyproxy/protoc-gen-validate v1.0.1/go.mod h1:0vj8bNkYbSTNS2PIyH87KZaeN4x9zpL9Qt8fQC7d+vs=
 github.com/facebookgo/stack v0.0.0-20160209184415-751773369052 h1:JWuenKqqX8nojtoVVWjGfOF9635RETekkoH6Cc9SX0A=
 github.com/facebookgo/stack v0.0.0-20160209184415-751773369052/go.mod h1:UbMTZqLaRiH3MsBH8va0n7s1pQYcu3uTb8G4tygF4Zg=
 github.com/fasthttp/router v1.4.19 h1:RLE539IU/S4kfb4MP56zgP0TIBU9kEg0ID9GpWO0vqk=
@@ -130,22 +136,22 @@ github.com/fxamacker/cbor/v2 v2.4.0/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrt
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-asn1-ber/asn1-ber v1.5.4 h1:vXT6d/FNDiELJnLb6hGNa309LMsrCoYFvpwHDF0+Y1A=
 github.com/go-asn1-ber/asn1-ber v1.5.4/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
-github.com/go-crypt/crypt v0.2.7 h1:Ir6E59c1wrskJhpJXMqaynHA2xAxpGN7nQXlLkbpzR0=
-github.com/go-crypt/crypt v0.2.7/go.mod h1:ulieouNs4qwFCq4wF61oyTQYXAXSoOv995EU4hcHwMU=
-github.com/go-crypt/x v0.2.0 h1:rHMiKRAu6kFc+xAnQywDb3iHGpvrFbIGXnP3IfCZ+2U=
-github.com/go-crypt/x v0.2.0/go.mod h1:uLo5o+Cc8nvahDASQpntR1g3ZMUoq2LM/859PkhykC4=
+github.com/go-crypt/crypt v0.2.9 h1:5gWWTId2Qyqs9ROIsegt5pnqo9wUSRLbhpkR6JSftjg=
+github.com/go-crypt/crypt v0.2.9/go.mod h1:JjzdTYE2mArb6nBoIvvpF7o46/rK/1pfmlArCRMTFUk=
+github.com/go-crypt/x v0.2.1 h1:OGw78Bswme9lffCOX6tyuC280ouU5391glsvThMtM5U=
+github.com/go-crypt/x v0.2.1/go.mod h1:Q/y9rms7yw4/1CavBlNGn0Itg4HqwNpe1N9FX0TxXrc=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
-github.com/go-ldap/ldap/v3 v3.4.5-0.20230506142018-039466e6b835 h1:XgBmN9yZXIh9vJGzs2qYPb5ee8/VnOWLHHYcKXGXKME=
-github.com/go-ldap/ldap/v3 v3.4.5-0.20230506142018-039466e6b835/go.mod h1:bMGIq3AGbytbaMwf8wdv5Phdxz0FWHTIYMSzyrYgnQs=
+github.com/go-ldap/ldap/v3 v3.4.5 h1:ekEKmaDrpvR2yf5Nc/DClsGG9lAmdDixe44mLzlW5r8=
+github.com/go-ldap/ldap/v3 v3.4.5/go.mod h1:bMGIq3AGbytbaMwf8wdv5Phdxz0FWHTIYMSzyrYgnQs=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI=
 github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo=
-github.com/go-rod/rod v0.112.9 h1:uA/yLbB+t0UlqJcLJtK2pZrCNPzd15dOKRUEOnmnt9k=
-github.com/go-rod/rod v0.112.9/go.mod h1:l0or0gEnZ7E5C0L/W7iD+yXBnm/OM3avP1ji74k8N9s=
+github.com/go-rod/rod v0.113.3 h1:oLiKZW721CCMwA5g7977cWfcAKQ+FuosP47Zf1QiDrA=
+github.com/go-rod/rod v0.113.3/go.mod h1:aiedSEFg5DwG/fnNbUOTPMTTWX3MRj6vIs/a684Mthw=
 github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI=
 github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
@@ -154,13 +160,19 @@ github.com/go-webauthn/revoke v0.1.9 h1:gSJ1ckA9VaKA2GN4Ukp+kiGTk1/EXtaDb1YE8Rkn
 github.com/go-webauthn/revoke v0.1.9/go.mod h1:j6WKPnv0HovtEs++paan9g3ar46gm1NarktkXBaPR+w=
 github.com/go-webauthn/webauthn v0.5.0 h1:Tbmp37AGIhYbQmcy2hEffo3U3cgPClqvxJ7cLUnF7Rc=
 github.com/go-webauthn/webauthn v0.5.0/go.mod h1:0CBq/jNfPS9l033j4AxMk8K8MluiMsde9uGNSPFLEVE=
+github.com/gogo/googleapis v1.4.1 h1:1Yx4Myt7BxzvUr5ldGSbwYiZG6t9wGBZ+8/fX3Wvtq0=
+github.com/gogo/googleapis v1.4.1/go.mod h1:2lpHqI5OcWCtVElxXnPt+s8oJvMpySlOyM6xDCrzib4=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
 github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/glog v1.0.0 h1:nfP3RFugxnNRyKgeWd4oI1nYvXpxrx8ck8ZrcizshdQ=
 github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=
+github.com/golang/glog v1.1.0 h1:/d3pCKDPWNnvIWe0vVUpNP32qc8U3PDVxySP/y360qE=
+github.com/golang/glog v1.1.0/go.mod h1:pfYeQZ3JWZoXTV5sFc986z3HTpwQs9At6P4ImfuP3NQ=
 github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -241,8 +253,8 @@ github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9n
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
 github.com/hashicorp/go-hclog v1.2.0 h1:La19f8d7WIlm4ogzNHB0JGqs5AUDAZ2UfCY4sJXcJdM=
-github.com/hashicorp/go-retryablehttp v0.7.2 h1:AcYqCvkpalPnPF2pn0KamgwamS42TqUDDYFRKq/RAd0=
-github.com/hashicorp/go-retryablehttp v0.7.2/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8=
+github.com/hashicorp/go-retryablehttp v0.7.4 h1:ZQgVdpTdAL7WpMIwLzCfbalOcSUdkDZnpUv3/+BxzFA=
+github.com/hashicorp/go-retryablehttp v0.7.4/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
@@ -256,8 +268,8 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk=
 github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.3.1 h1:Fcr8QJ1ZeLi5zsPZqQeUZhNhxfkkKBOgJuYkJHoBOtU=
-github.com/jackc/pgx/v5 v5.3.1/go.mod h1:t3JDKnCBlYIc0ewLF0Q7B8MXmoIaBOZj/ic7iHozM/8=
+github.com/jackc/pgx/v5 v5.4.1 h1:oKfB/FhuVtit1bBM3zNRRsZ925ZkMN3HXL+LgLUM9lE=
+github.com/jackc/pgx/v5 v5.4.1/go.mod h1:q6iHT8uDNXWiFNOlRqJzBTaSH3+2xCXkokxHZC5qWFY=
 github.com/jandelgado/gcov2lcov v1.0.5 h1:rkBt40h0CVK4oCb8Dps950gvfd1rYvQ8+cWa346lVU0=
 github.com/jandelgado/gcov2lcov v1.0.5/go.mod h1:NnSxK6TMlg1oGDBfGelGbjgorT5/L3cchlbtgFYZSss=
 github.com/jmoiron/sqlx v1.3.5 h1:vFFPA71p1o5gAeqtEAwLU4dnX2napprKtHr7PYIcN3g=
@@ -267,6 +279,7 @@ github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.16.5 h1:IFV2oUNUzZaz+XyusxpLzpzS8Pt5rh0Z16For/djlyI=
 github.com/klauspost/compress v1.16.5/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
@@ -300,8 +313,8 @@ github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3v
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-isatty v0.0.16 h1:bq3VjFmv/sOjHtdEhmkEV4x1AJtvUvOJ2PFAZ5+peKQ=
 github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
-github.com/mattn/go-sqlite3 v1.14.16 h1:yOQRA0RpS5PFz/oikGwBEqvAWhWg5ufRz4ETLjwpU1Y=
-github.com/mattn/go-sqlite3 v1.14.16/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
+github.com/mattn/go-sqlite3 v1.14.17 h1:mCRHCLDUBXgpKAqIKsaAaAsrAlbkeomtRFKXh2L6YIM=
+github.com/mattn/go-sqlite3 v1.14.17/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
 github.com/mattn/goveralls v0.0.11 h1:eJXea6R6IFlL1QMKNMzDvvHv/hwGrnvyig4N+0+XiMM=
 github.com/mattn/goveralls v0.0.11/go.mod h1:gU8SyhNswsJKchEV93xRQxX6X3Ei4PJdQk/6ZHvrvRk=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
@@ -331,10 +344,10 @@ github.com/ory/go-convenience v0.1.0 h1:zouLKfF2GoSGnJwGq+PE/nJAE6dj2Zj5QlTgmMTs
 github.com/ory/go-convenience v0.1.0/go.mod h1:uEY/a60PL5c12nYz4V5cHY03IBmwIAEm8TWB0yn9KNs=
 github.com/ory/herodot v0.10.2 h1:gGvNMHgAwWzdP/eo+roSiT5CGssygHSjDU7MSQNlJ4E=
 github.com/ory/herodot v0.10.2/go.mod h1:MMNmY6MG1uB6fnXYFaHoqdV23DTWctlPsmRCeq/2+wc=
-github.com/ory/x v0.0.555 h1:Etg6yUnrXP5YVTlpgipRh+hDLMavldbTURj+Mb0kdIY=
-github.com/ory/x v0.0.555/go.mod h1:oRVemI3SQQOLvOCJWIRinHQKlgmay/NbwSyRUIsS/Yk=
-github.com/otiai10/copy v1.11.0 h1:OKBD80J/mLBrwnzXqGtFCzprFSGioo30JcmR4APsNwc=
-github.com/otiai10/copy v1.11.0/go.mod h1:rSaLseMUsZFFbsFGc7wCJnnkTAvdc5L6VWxPE4308Ww=
+github.com/ory/x v0.0.563 h1:T77Bjt6ALMZmUJIsQ5UEkzDBCD+8vxfQlBCU1Y39uDk=
+github.com/ory/x v0.0.563/go.mod h1:kup4ebSC4SzwU6KPZJ4G60UR3EEsHxJ0apQVflVw5yQ=
+github.com/otiai10/copy v1.12.0 h1:cLMgSQnXBs1eehF0Wy/FAGsgDTDmAqFR7rQylBb1nDY=
+github.com/otiai10/copy v1.12.0/go.mod h1:rSaLseMUsZFFbsFGc7wCJnnkTAvdc5L6VWxPE4308Ww=
 github.com/otiai10/mint v1.5.1 h1:XaPLeE+9vGbuyEHem1JNk3bYc7KKqyI/na0/mLd/Kks=
 github.com/pborman/uuid v1.2.1 h1:+ZZIw58t/ozdjRaXh/3awHfmWRbzYxJoAdNJxe/3pvw=
 github.com/pborman/uuid v1.2.1/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
@@ -356,21 +369,23 @@ github.com/pquerna/otp v1.4.0 h1:wZvl1TIVxKRThZIBiwOOHOGP/1+nZyWBil9Y2XNEDzg=
 github.com/pquerna/otp v1.4.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
-github.com/prometheus/client_golang v1.15.1 h1:8tXpTmJbyH5lydzFPoxSIJ0J46jdh3tylbvM1xCv0LI=
-github.com/prometheus/client_golang v1.15.1/go.mod h1:e9yaBhRPU2pPNsZwE+JdQl0KEt1N9XgF6zxWmaC0xOk=
+github.com/prometheus/client_golang v1.16.0 h1:yk/hx9hDbrGHovbci4BY+pRMfSuuat626eFsHb7tmT8=
+github.com/prometheus/client_golang v1.16.0/go.mod h1:Zsulrv/L9oM40tJ7T815tM89lFEugiJ9HzIqaAx4LKc=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.3.0 h1:UBgGFHqYdG/TPFD1B1ogZywDqEkwp3fBMvqdiQ7Xew4=
 github.com/prometheus/client_model v0.3.0/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w=
+github.com/prometheus/client_model v0.4.0 h1:5lQXD3cAg1OXBf4Wq03gTrXHeaV0TQvGfUooCfx1yqY=
+github.com/prometheus/client_model v0.4.0/go.mod h1:oMQmHW1/JoDwqLtg57MGgP/Fb1CJEYF2imWWhWtMkYU=
 github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.42.0 h1:EKsfXEYo4JpWMHH5cg+KOUWeuJSov1Id8zGR8eeI1YM=
 github.com/prometheus/common v0.42.0/go.mod h1:xBwqVerjNdUDjgODMpudtOMwlOwf2SaTr1yjz4b7Zbc=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
-github.com/prometheus/procfs v0.9.0 h1:wzCHvIvM5SxWqYvwgVL7yJY8Lz3PKn49KQtpgMYJfhI=
-github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY=
+github.com/prometheus/procfs v0.10.1 h1:kYK1Va/YMlutzCGazswoHKo//tZVlFpKYh+PymziUAg=
+github.com/prometheus/procfs v0.10.1/go.mod h1:nwNm2aOCAYw8uTR/9bWRREkZFxAUcWzPHWJq+XBB/FM=
 github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
 github.com/redis/go-redis/v9 v9.0.4 h1:FC82T+CHJ/Q/PdyLW++GeCO+Ol59Y4T7R4jbgjvktgc=
 github.com/redis/go-redis/v9 v9.0.4/go.mod h1:WqMKv5vnQbRuZstUwxQI195wHy+t4PuXDOjzMvcuQHk=
@@ -385,8 +400,8 @@ github.com/savsgio/gotils v0.0.0-20230208104028-c358bd845dee h1:8Iv5m6xEo1NR1Avp
 github.com/savsgio/gotils v0.0.0-20230208104028-c358bd845dee/go.mod h1:qwtSXrKuJh/zsFQ12yEE89xfCrGKK63Rr7ctU/uCo4g=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
-github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
-github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
@@ -421,8 +436,8 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
-github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/subosito/gotenv v1.4.2 h1:X1TuBLAMDFbaTAChgCBLu3DU3UPyELpnF2jjJ2cz/S8=
 github.com/subosito/gotenv v1.4.2/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
 github.com/test-go/testify v1.1.4 h1:Tf9lntrKUMHiXQ07qBScBTSA0dhYQlu83hswqelv1iE=
@@ -436,16 +451,16 @@ github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGr
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
-github.com/valyala/fasthttp v1.47.0 h1:y7moDoxYzMooFpT5aHgNgVOQDrS3qlkfiP9mDtGGK9c=
-github.com/valyala/fasthttp v1.47.0/go.mod h1:k2zXd82h/7UZc3VOdJ2WaUqt1uZ/XpXAfE9i+HBC3lA=
+github.com/valyala/fasthttp v1.48.0 h1:oJWvHb9BIZToTQS3MuQ2R3bJZiNSa2KiNdeI8A+79Tc=
+github.com/valyala/fasthttp v1.48.0/go.mod h1:k2zXd82h/7UZc3VOdJ2WaUqt1uZ/XpXAfE9i+HBC3lA=
 github.com/wneessen/go-mail v0.3.9 h1:Q4DbCk3htT5DtDWKeMgNXCiHc4bBY/vv/XQPT6XDXzc=
 github.com/wneessen/go-mail v0.3.9/go.mod h1:zxOlafWCP/r6FEhAaRgH4IC1vg2YXxO0Nar9u0IScZ8=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
-github.com/ysmood/fetchup v0.2.2 h1:Qn8/q5uDW7szclt4sVXCFJ1TXup3hogz94OaLf6kloo=
-github.com/ysmood/fetchup v0.2.2/go.mod h1:xhibcRKziSvol0H1/pj33dnKrYyI2ebIvz5cOOkYGns=
+github.com/ysmood/fetchup v0.2.3 h1:ulX+SonA0Vma5zUFXtv52Kzip/xe7aj4vqT5AJwQ+ZQ=
+github.com/ysmood/fetchup v0.2.3/go.mod h1:xhibcRKziSvol0H1/pj33dnKrYyI2ebIvz5cOOkYGns=
 github.com/ysmood/goob v0.4.0 h1:HsxXhyLBeGzWXnqVKtmT9qM7EuVs/XOgkX7T6r1o1AQ=
 github.com/ysmood/goob v0.4.0/go.mod h1:u6yx7ZhS4Exf2MwciFr6nIM8knHQIE22lFpWHnfql18=
 github.com/ysmood/gop v0.0.2 h1:VuWweTmXK+zedLqYufJdh3PlxDNBOfFHjIZlPT2T5nw=
@@ -484,8 +499,9 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.7.0 h1:AvwMYaRytfdeVt3u6mLaxYtErKYjxA2OXjJ1HHq6t3A=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
+golang.org/x/crypto v0.10.0 h1:LKqV2xt9+kDzSTfOhx4FrkEBcMrAgHSYgzywV9zcGmM=
+golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -565,8 +581,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.11.0 h1:Gi2tvZIJyBtO9SDr1q9h5hEQCp/4L2RQ+ar0qjx2oNU=
+golang.org/x/net v0.11.0/go.mod h1:2L/ixqYpgIVXmeoSA/4Lu7BzTG4KIyPIryS4IsOd1oQ=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -578,6 +594,10 @@ golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.5.0 h1:HuArIo48skDwlrvM3sEdHXElYslAMsf3KwRkkW4MC4s=
 golang.org/x/oauth2 v0.5.0/go.mod h1:9/XBHVqLaWO3/BRHs5jbpYCnOZVjj5V0ndyaAM7KB4I=
+golang.org/x/oauth2 v0.6.0 h1:Lh8GPgSKBfWSwFvtuWOfeI3aAAnbXTSutYxJiOJFgIw=
+golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw=
+golang.org/x/oauth2 v0.7.0 h1:qe6s0zUXlPX80/dITx3440hWZ7GwMwgDDyrSGTPJG/g=
+golang.org/x/oauth2 v0.7.0/go.mod h1:hPLQkd9LyjfXTiRohC/41GhcFqxisoUQ99sCUOHO9x4=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -591,8 +611,8 @@ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.2.0 h1:PUR+T4wwASmuSTYdKjYHI5TD22Wy5ogLU5qZCOLxBrI=
-golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -643,15 +663,15 @@ golang.org/x/sys v0.0.0-20221010170243-090e33056c14/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.9.0 h1:KS/R3tvhPqvJvwcKfnBHJwwthS11LRhmM5D59eEXa0s=
+golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.9.0 h1:GRRCnKYhdQrD8kfRAdQ6Zcw1P0OcELxGLKJvtjVMZ28=
+golang.org/x/term v0.9.0/go.mod h1:M6DEAAIenWoTxdKrOltXcmDY3rSplQUkrvaDU5FcQyo=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -663,8 +683,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.10.0 h1:UpjohKhiEgNc0CSauXmwYftY1+LlaC75SJwh0SgCX58=
+golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -706,6 +726,7 @@ golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roY
 golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200717024301-6ddee64345a6/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
@@ -715,6 +736,7 @@ golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
@@ -723,6 +745,7 @@ golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.7.0 h1:W4OVu8VVOaIO0yzWMNdepAulS7YfoS3Zabrm8DOXXU4=
 golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
+golang.org/x/tools v0.8.0/go.mod h1:JxBZ99ISMI5ViVkT1tr6tdNmXeTrcpVSD3vZ1RsRdN4=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -792,6 +815,10 @@ google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod h1:FWY/as6D
 google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20230403163135-c38d8f061ccd h1:sLpv7bNL1AsX3fdnWh9WVh7ejIzXdOc1RRHGeAmeStU=
 google.golang.org/genproto v0.0.0-20230403163135-c38d8f061ccd/go.mod h1:UUQDJDOlWu4KYeJZffbWgBkS1YFobzKbLVfK69pe0Ak=
+google.golang.org/genproto v0.0.0-20230526203410-71b5a4ffd15e h1:Ao9GzfUMPH3zjVfzXG5rlWlk+Q8MXWKwWpwVQE1MXfw=
+google.golang.org/genproto v0.0.0-20230526203410-71b5a4ffd15e/go.mod h1:zqTuNwFlFRsw5zIts5VnzLQxSRqh+CGOTVMlYbY0Eyk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230526203410-71b5a4ffd15e h1:NumxXLPfHSndr3wBBdeKiVHjGVFzi9RX2HwwQke94iY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230526203410-71b5a4ffd15e/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -811,6 +838,10 @@ google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA5
 google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
 google.golang.org/grpc v1.54.0 h1:EhTqbhiYeixwWQtAEZAxmV9MGqcjEU2mFx52xCzNyag=
 google.golang.org/grpc v1.54.0/go.mod h1:PUSEXI6iWghWaB6lXM4knEgpJNu2qUcKfDtNci3EC2g=
+google.golang.org/grpc v1.55.0 h1:3Oj82/tFSCeUrRTg/5E/7d/W5A1tj6Ky1ABAuZuv5ag=
+google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGONTY8=
+google.golang.org/grpc v1.56.0 h1:+y7Bs8rtMd07LeXmL3NxcTLn7mUkbKZqEpPhMNkwJEE=
+google.golang.org/grpc v1.56.0/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
 google.golang.org/grpc/examples v0.0.0-20210304020650-930c79186c99 h1:qA8rMbz1wQ4DOFfM2ouD29DG9aHWBm6ZOy9BGxiUMmY=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=

internal/authentication/const.go

@@ -2,20 +2,8 @@ package authentication
 
 import (
 	"errors"
-)
 
-// Level is the type representing a level of authentication.
-type Level int
-
-const (
-	// NotAuthenticated if the user is not authenticated yet.
-	NotAuthenticated Level = iota
-
-	// OneFactor if the user has passed first factor only.
-	OneFactor
-
-	// TwoFactor if the user has passed two factors.
-	TwoFactor
+	"golang.org/x/text/encoding/unicode"
 )
 
 const (
@@ -116,3 +104,7 @@ const fileAuthenticationMode = 0600
 // OWASP recommends to escape some special characters.
 // https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.md
 const specialLDAPRunes = ",#+<>;\"="
+
+var (
+	encodingUTF16LittleEndian = unicode.UTF16(unicode.LittleEndian, unicode.IgnoreBOM)
+)

internal/authentication/file_user_provider.go

@@ -23,7 +23,7 @@ import (
 type FileUserProvider struct {
 	config        *schema.FileAuthenticationBackend
 	hash          algorithm.Hash
-	database      *FileUserDatabase
+	database      FileUserDatabase
 	mutex         *sync.Mutex
 	timeoutReload time.Time
 }
@@ -34,6 +34,7 @@ func NewFileUserProvider(config *schema.FileAuthenticationBackend) (provider *Fi
 		config:        config,
 		mutex:         &sync.Mutex{},
 		timeoutReload: time.Now().Add(-1 * time.Second),
+		database:      NewYAMLUserDatabase(config.Path, config.Search.Email, config.Search.CaseInsensitive),
 	}
 }
 
@@ -136,7 +137,9 @@ func (p *FileUserProvider) StartupCheck() (err error) {
 		return err
 	}
 
-	p.database = NewFileUserDatabase(p.config.Path, p.config.Search.Email, p.config.Search.CaseInsensitive)
+	if p.database == nil {
+		p.database = NewYAMLUserDatabase(p.config.Path, p.config.Search.Email, p.config.Search.CaseInsensitive)
+	}
 
 	if err = p.database.Load(); err != nil {
 		return err
@@ -194,10 +197,6 @@ func NewFileCryptoHashFromConfig(config schema.Password) (hash algorithm.Hash, e
 		return nil, fmt.Errorf("failed to initialize hash settings: %w", err)
 	}
 
-	if err = hash.Validate(); err != nil {
-		return nil, fmt.Errorf("failed to validate hash settings: %w", err)
-	}
-
 	return hash, nil
 }
 

internal/authentication/file_user_provider_database.go

@@ -12,9 +12,16 @@ import (
 	"gopkg.in/yaml.v3"
 )
 
-// NewFileUserDatabase creates a new FileUserDatabase.
-func NewFileUserDatabase(filePath string, searchEmail, searchCI bool) (database *FileUserDatabase) {
-	return &FileUserDatabase{
+type FileUserDatabase interface {
+	Save() (err error)
+	Load() (err error)
+	GetUserDetails(username string) (user DatabaseUserDetails, err error)
+	SetUserDetails(username string, details *DatabaseUserDetails)
+}
+
+// NewYAMLUserDatabase creates a new YAMLUserDatabase.
+func NewYAMLUserDatabase(filePath string, searchEmail, searchCI bool) (database *YAMLUserDatabase) {
+	return &YAMLUserDatabase{
 		RWMutex:     &sync.RWMutex{},
 		Path:        filePath,
 		Users:       map[string]DatabaseUserDetails{},
@@ -25,8 +32,8 @@ func NewFileUserDatabase(filePath string, searchEmail, searchCI bool) (database
 	}
 }
 
-// FileUserDatabase is a user details database that is concurrency safe database and can be reloaded.
-type FileUserDatabase struct {
+// YAMLUserDatabase is a user details database that is concurrency safe database and can be reloaded.
+type YAMLUserDatabase struct {
 	*sync.RWMutex
 
 	Path    string
@@ -39,7 +46,7 @@ type FileUserDatabase struct {
 }
 
 // Save the database to disk.
-func (m *FileUserDatabase) Save() (err error) {
+func (m *YAMLUserDatabase) Save() (err error) {
 	m.RLock()
 
 	defer m.RUnlock()
@@ -52,7 +59,7 @@ func (m *FileUserDatabase) Save() (err error) {
 }
 
 // Load the database from disk.
-func (m *FileUserDatabase) Load() (err error) {
+func (m *YAMLUserDatabase) Load() (err error) {
 	yml := &DatabaseModel{Users: map[string]UserDetailsModel{}}
 
 	if err = yml.Read(m.Path); err != nil {
@@ -71,7 +78,7 @@ func (m *FileUserDatabase) Load() (err error) {
 }
 
 // LoadAliases performs the loading of alias information from the database.
-func (m *FileUserDatabase) LoadAliases() (err error) {
+func (m *YAMLUserDatabase) LoadAliases() (err error) {
 	if m.SearchEmail || m.SearchCI {
 		for k, user := range m.Users {
 			if m.SearchEmail && user.Email != "" {
@@ -91,7 +98,7 @@ func (m *FileUserDatabase) LoadAliases() (err error) {
 	return nil
 }
 
-func (m *FileUserDatabase) loadAlias(k string) (err error) {
+func (m *YAMLUserDatabase) loadAlias(k string) (err error) {
 	u := strings.ToLower(k)
 
 	if u != k {
@@ -113,7 +120,7 @@ func (m *FileUserDatabase) loadAlias(k string) (err error) {
 	return nil
 }
 
-func (m *FileUserDatabase) loadAliasEmail(k string, user DatabaseUserDetails) (err error) {
+func (m *YAMLUserDatabase) loadAliasEmail(k string, user DatabaseUserDetails) (err error) {
 	e := strings.ToLower(user.Email)
 
 	var duplicates []string
@@ -145,7 +152,7 @@ func (m *FileUserDatabase) loadAliasEmail(k string, user DatabaseUserDetails) (e
 
 // GetUserDetails get a DatabaseUserDetails given a username as a value type where the username must be the users actual
 // username.
-func (m *FileUserDatabase) GetUserDetails(username string) (user DatabaseUserDetails, err error) {
+func (m *YAMLUserDatabase) GetUserDetails(username string) (user DatabaseUserDetails, err error) {
 	m.RLock()
 
 	defer m.RUnlock()
@@ -172,7 +179,7 @@ func (m *FileUserDatabase) GetUserDetails(username string) (user DatabaseUserDet
 }
 
 // SetUserDetails sets the DatabaseUserDetails for a given user.
-func (m *FileUserDatabase) SetUserDetails(username string, details *DatabaseUserDetails) {
+func (m *YAMLUserDatabase) SetUserDetails(username string, details *DatabaseUserDetails) {
 	if details == nil {
 		return
 	}
@@ -184,8 +191,8 @@ func (m *FileUserDatabase) SetUserDetails(username string, details *DatabaseUser
 	m.Unlock()
 }
 
-// ToDatabaseModel converts the FileUserDatabase into the DatabaseModel for saving.
-func (m *FileUserDatabase) ToDatabaseModel() (model *DatabaseModel) {
+// ToDatabaseModel converts the YAMLUserDatabase into the DatabaseModel for saving.
+func (m *YAMLUserDatabase) ToDatabaseModel() (model *DatabaseModel) {
 	model = &DatabaseModel{
 		Users: map[string]UserDetailsModel{},
 	}
@@ -236,8 +243,8 @@ type DatabaseModel struct {
 	Users map[string]UserDetailsModel `yaml:"users" valid:"required"`
 }
 
-// ReadToFileUserDatabase reads the DatabaseModel into a FileUserDatabase.
-func (m *DatabaseModel) ReadToFileUserDatabase(db *FileUserDatabase) (err error) {
+// ReadToFileUserDatabase reads the DatabaseModel into a YAMLUserDatabase.
+func (m *DatabaseModel) ReadToFileUserDatabase(db *YAMLUserDatabase) (err error) {
 	users := map[string]DatabaseUserDetails{}
 
 	var udm *DatabaseUserDetails

internal/authentication/file_user_provider_database_mock_test.go

@@ -0,0 +1,89 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/authelia/authelia/v4/internal/authentication (interfaces: FileUserDatabase)
+
+// Package authentication is a generated GoMock package.
+package authentication
+
+import (
+	reflect "reflect"
+
+	gomock "github.com/golang/mock/gomock"
+)
+
+// MockFileUserDatabase is a mock of FileUserDatabase interface.
+type MockFileUserDatabase struct {
+	ctrl     *gomock.Controller
+	recorder *MockFileUserDatabaseMockRecorder
+}
+
+// MockFileUserDatabaseMockRecorder is the mock recorder for MockFileUserDatabase.
+type MockFileUserDatabaseMockRecorder struct {
+	mock *MockFileUserDatabase
+}
+
+// NewMockFileUserDatabase creates a new mock instance.
+func NewMockFileUserDatabase(ctrl *gomock.Controller) *MockFileUserDatabase {
+	mock := &MockFileUserDatabase{ctrl: ctrl}
+	mock.recorder = &MockFileUserDatabaseMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockFileUserDatabase) EXPECT() *MockFileUserDatabaseMockRecorder {
+	return m.recorder
+}
+
+// GetUserDetails mocks base method.
+func (m *MockFileUserDatabase) GetUserDetails(arg0 string) (DatabaseUserDetails, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetUserDetails", arg0)
+	ret0, _ := ret[0].(DatabaseUserDetails)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetUserDetails indicates an expected call of GetUserDetails.
+func (mr *MockFileUserDatabaseMockRecorder) GetUserDetails(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUserDetails", reflect.TypeOf((*MockFileUserDatabase)(nil).GetUserDetails), arg0)
+}
+
+// Load mocks base method.
+func (m *MockFileUserDatabase) Load() error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Load")
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Load indicates an expected call of Load.
+func (mr *MockFileUserDatabaseMockRecorder) Load() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Load", reflect.TypeOf((*MockFileUserDatabase)(nil).Load))
+}
+
+// Save mocks base method.
+func (m *MockFileUserDatabase) Save() error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Save")
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Save indicates an expected call of Save.
+func (mr *MockFileUserDatabaseMockRecorder) Save() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Save", reflect.TypeOf((*MockFileUserDatabase)(nil).Save))
+}
+
+// SetUserDetails mocks base method.
+func (m *MockFileUserDatabase) SetUserDetails(arg0 string, arg1 *DatabaseUserDetails) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "SetUserDetails", arg0, arg1)
+}
+
+// SetUserDetails indicates an expected call of SetUserDetails.
+func (mr *MockFileUserDatabaseMockRecorder) SetUserDetails(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetUserDetails", reflect.TypeOf((*MockFileUserDatabase)(nil).SetUserDetails), arg0, arg1)
+}

internal/authentication/file_user_provider_database_test.go

@@ -0,0 +1,39 @@
+package authentication
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestDatabaseModel_Read(t *testing.T) {
+	model := &DatabaseModel{}
+
+	dir := t.TempDir()
+
+	_, err := os.Create(filepath.Join(dir, "users_database.yml"))
+
+	assert.NoError(t, err)
+
+	assert.EqualError(t, model.Read(filepath.Join(dir, "users_database.yml")), "no file content")
+
+	assert.NoError(t, os.Mkdir(filepath.Join(dir, "x"), 0000))
+
+	f := filepath.Join(dir, "x", "users_database.yml")
+
+	assert.EqualError(t, model.Read(f), fmt.Sprintf("failed to read the '%s' file: open %s: permission denied", f, f))
+
+	f = filepath.Join(dir, "schema.yml")
+
+	file, err := os.Create(f)
+	assert.NoError(t, err)
+
+	_, err = file.WriteString("users:\n\tjohn: {}")
+
+	assert.NoError(t, err)
+
+	assert.EqualError(t, model.Read(f), "could not parse the YAML database: yaml: line 2: found character that cannot start any token")
+}

internal/authentication/file_user_provider_hash_mock_test.go

@@ -0,0 +1,93 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/go-crypt/crypt/algorithm (interfaces: Hash)
+
+// Package authentication is a generated GoMock package.
+package authentication
+
+import (
+	reflect "reflect"
+
+	algorithm "github.com/go-crypt/crypt/algorithm"
+	gomock "github.com/golang/mock/gomock"
+)
+
+// MockHash is a mock of Hash interface.
+type MockHash struct {
+	ctrl     *gomock.Controller
+	recorder *MockHashMockRecorder
+}
+
+// MockHashMockRecorder is the mock recorder for MockHash.
+type MockHashMockRecorder struct {
+	mock *MockHash
+}
+
+// NewMockHash creates a new mock instance.
+func NewMockHash(ctrl *gomock.Controller) *MockHash {
+	mock := &MockHash{ctrl: ctrl}
+	mock.recorder = &MockHashMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockHash) EXPECT() *MockHashMockRecorder {
+	return m.recorder
+}
+
+// Hash mocks base method.
+func (m *MockHash) Hash(arg0 string) (algorithm.Digest, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Hash", arg0)
+	ret0, _ := ret[0].(algorithm.Digest)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Hash indicates an expected call of Hash.
+func (mr *MockHashMockRecorder) Hash(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Hash", reflect.TypeOf((*MockHash)(nil).Hash), arg0)
+}
+
+// HashWithSalt mocks base method.
+func (m *MockHash) HashWithSalt(arg0 string, arg1 []byte) (algorithm.Digest, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "HashWithSalt", arg0, arg1)
+	ret0, _ := ret[0].(algorithm.Digest)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// HashWithSalt indicates an expected call of HashWithSalt.
+func (mr *MockHashMockRecorder) HashWithSalt(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HashWithSalt", reflect.TypeOf((*MockHash)(nil).HashWithSalt), arg0, arg1)
+}
+
+// MustHash mocks base method.
+func (m *MockHash) MustHash(arg0 string) algorithm.Digest {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "MustHash", arg0)
+	ret0, _ := ret[0].(algorithm.Digest)
+	return ret0
+}
+
+// MustHash indicates an expected call of MustHash.
+func (mr *MockHashMockRecorder) MustHash(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "MustHash", reflect.TypeOf((*MockHash)(nil).MustHash), arg0)
+}
+
+// Validate mocks base method.
+func (m *MockHash) Validate() error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Validate")
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Validate indicates an expected call of Validate.
+func (mr *MockHashMockRecorder) Validate() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Validate", reflect.TypeOf((*MockHash)(nil).Validate))
+}

internal/authentication/file_user_provider_test.go

@@ -1,59 +1,167 @@
 package authentication
 
 import (
-	"log"
+	"fmt"
 	"os"
+	"path/filepath"
 	"regexp"
 	"runtime"
 	"strings"
+	"sync"
 	"testing"
+	"time"
 
+	"github.com/go-crypt/crypt/algorithm/bcrypt"
+	"github.com/go-crypt/crypt/algorithm/pbkdf2"
+	"github.com/go-crypt/crypt/algorithm/scrypt"
+	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/authelia/authelia/v4/internal/configuration/schema"
 )
 
-func WithDatabase(content []byte, f func(path string)) {
-	tmpfile, err := os.CreateTemp("", "users_database.*.yaml")
-	if err != nil {
-		log.Fatal(err)
-	}
-
-	defer os.Remove(tmpfile.Name()) // Clean up.
-
-	if _, err := tmpfile.Write(content); err != nil {
-		tmpfile.Close()
-		log.Panic(err)
-	}
-
-	f(tmpfile.Name())
-
-	if err := tmpfile.Close(); err != nil {
-		log.Panic(err)
-	}
-}
-
 func TestShouldErrorPermissionsOnLocalFS(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		t.Skip("skipping test due to being on windows")
 	}
 
-	_ = os.Mkdir("/tmp/noperms/", 0000)
-	err := checkDatabase("/tmp/noperms/users_database.yml")
+	dir := t.TempDir()
 
-	require.EqualError(t, err, "error checking user authentication database file: stat /tmp/noperms/users_database.yml: permission denied")
+	_ = os.Mkdir(filepath.Join(dir, "noperms"), 0000)
+
+	f := filepath.Join(dir, "noperms", "users_database.yml")
+	require.EqualError(t, checkDatabase(f), fmt.Sprintf("error checking user authentication database file: stat %s: permission denied", f))
 }
 
 func TestShouldErrorAndGenerateUserDB(t *testing.T) {
-	err := checkDatabase("./nonexistent.yml")
-	_ = os.Remove("./nonexistent.yml")
+	dir := t.TempDir()
 
-	require.EqualError(t, err, "user authentication database file doesn't exist at path './nonexistent.yml' and has been generated")
+	f := filepath.Join(dir, "users_database.yml")
+
+	require.EqualError(t, checkDatabase(f), fmt.Sprintf("user authentication database file doesn't exist at path '%s' and has been generated", f))
+}
+
+func TestShouldErrorFailCreateDB(t *testing.T) {
+	dir := t.TempDir()
+
+	assert.NoError(t, os.Mkdir(filepath.Join(dir, "x"), 0000))
+
+	f := filepath.Join(dir, "x", "users.yml")
+
+	provider := NewFileUserProvider(&schema.FileAuthenticationBackend{Path: f, Password: schema.DefaultPasswordConfig})
+
+	require.NotNil(t, provider)
+
+	assert.EqualError(t, provider.StartupCheck(), "one or more errors occurred checking the authentication database")
+
+	assert.NotNil(t, provider.database)
+
+	reloaded, err := provider.Reload()
+
+	assert.False(t, reloaded)
+	assert.EqualError(t, err, fmt.Sprintf("failed to reload: error reading the authentication database: failed to read the '%s' file: open %s: permission denied", f, f))
+}
+
+func TestShouldErrorBadPasswordConfig(t *testing.T) {
+	dir := t.TempDir()
+
+	f := filepath.Join(dir, "users.yml")
+
+	require.NoError(t, os.WriteFile(f, UserDatabaseContent, 0600))
+
+	provider := NewFileUserProvider(&schema.FileAuthenticationBackend{Path: f})
+
+	require.NotNil(t, provider)
+
+	assert.EqualError(t, provider.StartupCheck(), "failed to initialize hash settings: argon2 validation error: parameter is invalid: parameter 't' must be between 1 and 2147483647 but is set to '0'")
+}
+
+func TestShouldNotPanicOnNilDB(t *testing.T) {
+	dir := t.TempDir()
+
+	f := filepath.Join(dir, "users.yml")
+
+	assert.NoError(t, os.WriteFile(f, UserDatabaseContent, 0600))
+
+	provider := &FileUserProvider{
+		config:        &schema.FileAuthenticationBackend{Path: f, Password: schema.DefaultPasswordConfig},
+		mutex:         &sync.Mutex{},
+		timeoutReload: time.Now().Add(-1 * time.Second),
+	}
+
+	assert.NoError(t, provider.StartupCheck())
+}
+
+func TestShouldReloadDatabase(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "users.yml")
+
+	testCases := []struct {
+		name     string
+		setup    func(t *testing.T, provider *FileUserProvider)
+		expected bool
+		err      string
+	}{
+		{
+			"ShouldSkipReloadRecentlyReloaded",
+			func(t *testing.T, provider *FileUserProvider) {
+				provider.timeoutReload = time.Now().Add(time.Minute)
+			},
+			false,
+			"",
+		},
+		{
+			"ShouldReloadWithoutError",
+			func(t *testing.T, provider *FileUserProvider) {
+				provider.timeoutReload = time.Now().Add(time.Minute * -1)
+			},
+			true,
+			"",
+		},
+		{
+			"ShouldNotReloadWithNoContent",
+			func(t *testing.T, provider *FileUserProvider) {
+				p := filepath.Join(dir, "empty.yml")
+
+				_, _ = os.Create(p)
+
+				provider.timeoutReload = time.Now().Add(time.Minute * -1)
+
+				provider.config.Path = p
+
+				provider.database = NewYAMLUserDatabase(p, provider.config.Search.Email, provider.config.Search.CaseInsensitive)
+			},
+			false,
+			"",
+		},
+	}
+
+	require.NoError(t, os.WriteFile(path, UserDatabaseContent, 0600))
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			provider := NewFileUserProvider(&schema.FileAuthenticationBackend{
+				Path:     path,
+				Password: schema.DefaultPasswordConfig,
+			})
+
+			tc.setup(t, provider)
+
+			actual, theError := provider.Reload()
+
+			assert.Equal(t, tc.expected, actual)
+			if tc.err == "" {
+				assert.NoError(t, theError)
+			} else {
+				assert.EqualError(t, theError, tc.err)
+			}
+		})
+	}
 }
 
 func TestShouldCheckUserArgon2idPasswordIsCorrect(t *testing.T) {
-	WithDatabase(UserDatabaseContent, func(path string) {
+	WithDatabase(t, UserDatabaseContent, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 		provider := NewFileUserProvider(&config)
@@ -68,7 +176,7 @@ func TestShouldCheckUserArgon2idPasswordIsCorrect(t *testing.T) {
 }
 
 func TestShouldCheckUserSHA512PasswordIsCorrect(t *testing.T) {
-	WithDatabase(UserDatabaseContent, func(path string) {
+	WithDatabase(t, UserDatabaseContent, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 
@@ -84,7 +192,7 @@ func TestShouldCheckUserSHA512PasswordIsCorrect(t *testing.T) {
 }
 
 func TestShouldCheckUserPasswordIsWrong(t *testing.T) {
-	WithDatabase(UserDatabaseContent, func(path string) {
+	WithDatabase(t, UserDatabaseContent, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 
@@ -100,7 +208,7 @@ func TestShouldCheckUserPasswordIsWrong(t *testing.T) {
 }
 
 func TestShouldCheckUserPasswordIsWrongForEnumerationCompare(t *testing.T) {
-	WithDatabase(UserDatabaseContent, func(path string) {
+	WithDatabase(t, UserDatabaseContent, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 
@@ -115,7 +223,7 @@ func TestShouldCheckUserPasswordIsWrongForEnumerationCompare(t *testing.T) {
 }
 
 func TestShouldCheckUserPasswordOfUserThatDoesNotExist(t *testing.T) {
-	WithDatabase(UserDatabaseContent, func(path string) {
+	WithDatabase(t, UserDatabaseContent, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 
@@ -131,7 +239,7 @@ func TestShouldCheckUserPasswordOfUserThatDoesNotExist(t *testing.T) {
 }
 
 func TestShouldRetrieveUserDetails(t *testing.T) {
-	WithDatabase(UserDatabaseContent, func(path string) {
+	WithDatabase(t, UserDatabaseContent, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 
@@ -147,8 +255,27 @@ func TestShouldRetrieveUserDetails(t *testing.T) {
 	})
 }
 
+func TestShouldErrOnUserDetailsNoUser(t *testing.T) {
+	WithDatabase(t, UserDatabaseContent, func(path string) {
+		config := DefaultFileAuthenticationBackendConfiguration
+		config.Path = path
+
+		provider := NewFileUserProvider(&config)
+
+		assert.NoError(t, provider.StartupCheck())
+
+		details, err := provider.GetDetails("nouser")
+		assert.Nil(t, details)
+		assert.Equal(t, err, ErrUserNotFound)
+
+		details, err = provider.GetDetails("dis")
+		assert.Nil(t, details)
+		assert.Equal(t, err, ErrUserNotFound)
+	})
+}
+
 func TestShouldUpdatePassword(t *testing.T) {
-	WithDatabase(UserDatabaseContent, func(path string) {
+	WithDatabase(t, UserDatabaseContent, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 
@@ -172,7 +299,7 @@ func TestShouldUpdatePassword(t *testing.T) {
 
 // Checks both that the hashing algo changes and that it removes {CRYPT} from the start.
 func TestShouldUpdatePasswordHashingAlgorithmToArgon2id(t *testing.T) {
-	WithDatabase(UserDatabaseContent, func(path string) {
+	WithDatabase(t, UserDatabaseContent, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 
@@ -180,7 +307,10 @@ func TestShouldUpdatePasswordHashingAlgorithmToArgon2id(t *testing.T) {
 
 		assert.NoError(t, provider.StartupCheck())
 
-		assert.True(t, strings.HasPrefix(provider.database.Users["harry"].Digest.Encode(), "$6$"))
+		db, ok := provider.database.(*YAMLUserDatabase)
+		require.True(t, ok)
+
+		assert.True(t, strings.HasPrefix(db.Users["harry"].Digest.Encode(), "$6$"))
 		err := provider.UpdatePassword("harry", "newpassword")
 		assert.NoError(t, err)
 
@@ -189,15 +319,15 @@ func TestShouldUpdatePasswordHashingAlgorithmToArgon2id(t *testing.T) {
 
 		assert.NoError(t, provider.StartupCheck())
 
-		ok, err := provider.CheckUserPassword("harry", "newpassword")
+		ok, err = provider.CheckUserPassword("harry", "newpassword")
 		assert.NoError(t, err)
 		assert.True(t, ok)
-		assert.True(t, strings.HasPrefix(provider.database.Users["harry"].Digest.Encode(), "$argon2id$"))
+		assert.True(t, strings.HasPrefix(db.Users["harry"].Digest.Encode(), "$argon2id$"))
 	})
 }
 
 func TestShouldUpdatePasswordHashingAlgorithmToSHA512(t *testing.T) {
-	WithDatabase(UserDatabaseContent, func(path string) {
+	WithDatabase(t, UserDatabaseContent, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 		config.Password.Algorithm = "sha2crypt"
@@ -207,7 +337,10 @@ func TestShouldUpdatePasswordHashingAlgorithmToSHA512(t *testing.T) {
 
 		assert.NoError(t, provider.StartupCheck())
 
-		assert.True(t, strings.HasPrefix(provider.database.Users["john"].Digest.Encode(), "$argon2id$"))
+		db, ok := provider.database.(*YAMLUserDatabase)
+		require.True(t, ok)
+
+		assert.True(t, strings.HasPrefix(db.Users["john"].Digest.Encode(), "$argon2id$"))
 		err := provider.UpdatePassword("john", "newpassword")
 		assert.NoError(t, err)
 
@@ -216,15 +349,29 @@ func TestShouldUpdatePasswordHashingAlgorithmToSHA512(t *testing.T) {
 
 		assert.NoError(t, provider.StartupCheck())
 
-		ok, err := provider.CheckUserPassword("john", "newpassword")
+		ok, err = provider.CheckUserPassword("john", "newpassword")
 		assert.NoError(t, err)
 		assert.True(t, ok)
-		assert.True(t, strings.HasPrefix(provider.database.Users["john"].Digest.Encode(), "$6$"))
+		assert.True(t, strings.HasPrefix(db.Users["john"].Digest.Encode(), "$6$"))
+	})
+}
+
+func TestShouldErrOnUpdatePasswordNoUser(t *testing.T) {
+	WithDatabase(t, UserDatabaseContent, func(path string) {
+		config := DefaultFileAuthenticationBackendConfiguration
+		config.Path = path
+
+		provider := NewFileUserProvider(&config)
+
+		assert.NoError(t, provider.StartupCheck())
+
+		assert.Equal(t, provider.UpdatePassword("nousers", "newpassword"), ErrUserNotFound)
+		assert.Equal(t, provider.UpdatePassword("dis", "example"), ErrUserNotFound)
 	})
 }
 
 func TestShouldRaiseWhenLoadingMalformedDatabaseForFirstTime(t *testing.T) {
-	WithDatabase(MalformedUserDatabaseContent, func(path string) {
+	WithDatabase(t, MalformedUserDatabaseContent, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 
@@ -235,7 +382,7 @@ func TestShouldRaiseWhenLoadingMalformedDatabaseForFirstTime(t *testing.T) {
 }
 
 func TestShouldRaiseWhenLoadingDatabaseWithBadSchemaForFirstTime(t *testing.T) {
-	WithDatabase(BadSchemaUserDatabaseContent, func(path string) {
+	WithDatabase(t, BadSchemaUserDatabaseContent, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 
@@ -246,7 +393,7 @@ func TestShouldRaiseWhenLoadingDatabaseWithBadSchemaForFirstTime(t *testing.T) {
 }
 
 func TestShouldRaiseWhenLoadingDatabaseWithBadSHA512HashesForTheFirstTime(t *testing.T) {
-	WithDatabase(BadSHA512HashContent, func(path string) {
+	WithDatabase(t, BadSHA512HashContent, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 
@@ -257,7 +404,7 @@ func TestShouldRaiseWhenLoadingDatabaseWithBadSHA512HashesForTheFirstTime(t *tes
 }
 
 func TestShouldRaiseWhenLoadingDatabaseWithBadArgon2idHashSettingsForTheFirstTime(t *testing.T) {
-	WithDatabase(BadArgon2idHashSettingsContent, func(path string) {
+	WithDatabase(t, BadArgon2idHashSettingsContent, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 
@@ -268,7 +415,7 @@ func TestShouldRaiseWhenLoadingDatabaseWithBadArgon2idHashSettingsForTheFirstTim
 }
 
 func TestShouldRaiseWhenLoadingDatabaseWithBadArgon2idHashKeyForTheFirstTime(t *testing.T) {
-	WithDatabase(BadArgon2idHashKeyContent, func(path string) {
+	WithDatabase(t, BadArgon2idHashKeyContent, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 
@@ -279,7 +426,7 @@ func TestShouldRaiseWhenLoadingDatabaseWithBadArgon2idHashKeyForTheFirstTime(t *
 }
 
 func TestShouldRaiseWhenLoadingDatabaseWithBadArgon2idHashSaltForTheFirstTime(t *testing.T) {
-	WithDatabase(BadArgon2idHashSaltContent, func(path string) {
+	WithDatabase(t, BadArgon2idHashSaltContent, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 
@@ -290,7 +437,7 @@ func TestShouldRaiseWhenLoadingDatabaseWithBadArgon2idHashSaltForTheFirstTime(t
 }
 
 func TestShouldSupportHashPasswordWithoutCRYPT(t *testing.T) {
-	WithDatabase(UserDatabaseWithoutCryptContent, func(path string) {
+	WithDatabase(t, UserDatabaseWithoutCryptContent, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 
@@ -306,7 +453,7 @@ func TestShouldSupportHashPasswordWithoutCRYPT(t *testing.T) {
 }
 
 func TestShouldNotAllowLoginOfDisabledUsers(t *testing.T) {
-	WithDatabase(UserDatabaseContent, func(path string) {
+	WithDatabase(t, UserDatabaseContent, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 
@@ -322,7 +469,7 @@ func TestShouldNotAllowLoginOfDisabledUsers(t *testing.T) {
 }
 
 func TestShouldErrorOnInvalidCaseSensitiveFile(t *testing.T) {
-	WithDatabase(UserDatabaseContentInvalidSearchCaseInsenstive, func(path string) {
+	WithDatabase(t, UserDatabaseContentInvalidSearchCaseInsenstive, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 		config.Search.Email = false
@@ -335,7 +482,7 @@ func TestShouldErrorOnInvalidCaseSensitiveFile(t *testing.T) {
 }
 
 func TestShouldErrorOnDuplicateEmail(t *testing.T) {
-	WithDatabase(UserDatabaseContentInvalidSearchEmail, func(path string) {
+	WithDatabase(t, UserDatabaseContentInvalidSearchEmail, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 		config.Search.Email = true
@@ -349,7 +496,7 @@ func TestShouldErrorOnDuplicateEmail(t *testing.T) {
 }
 
 func TestShouldNotErrorOnEmailAsUsername(t *testing.T) {
-	WithDatabase(UserDatabaseContentSearchEmailAsUsername, func(path string) {
+	WithDatabase(t, UserDatabaseContentSearchEmailAsUsername, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 		config.Search.Email = true
@@ -362,7 +509,7 @@ func TestShouldNotErrorOnEmailAsUsername(t *testing.T) {
 }
 
 func TestShouldErrorOnEmailAsUsernameWithDuplicateEmail(t *testing.T) {
-	WithDatabase(UserDatabaseContentInvalidSearchEmailAsUsername, func(path string) {
+	WithDatabase(t, UserDatabaseContentInvalidSearchEmailAsUsername, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 		config.Search.Email = true
@@ -375,7 +522,7 @@ func TestShouldErrorOnEmailAsUsernameWithDuplicateEmail(t *testing.T) {
 }
 
 func TestShouldErrorOnEmailAsUsernameWithDuplicateEmailCase(t *testing.T) {
-	WithDatabase(UserDatabaseContentInvalidSearchEmailAsUsernameCase, func(path string) {
+	WithDatabase(t, UserDatabaseContentInvalidSearchEmailAsUsernameCase, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 		config.Search.Email = false
@@ -388,7 +535,7 @@ func TestShouldErrorOnEmailAsUsernameWithDuplicateEmailCase(t *testing.T) {
 }
 
 func TestShouldAllowLookupByEmail(t *testing.T) {
-	WithDatabase(UserDatabaseContent, func(path string) {
+	WithDatabase(t, UserDatabaseContent, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 		config.Search.Email = true
@@ -415,7 +562,7 @@ func TestShouldAllowLookupByEmail(t *testing.T) {
 }
 
 func TestShouldAllowLookupCI(t *testing.T) {
-	WithDatabase(UserDatabaseContent, func(path string) {
+	WithDatabase(t, UserDatabaseContent, func(path string) {
 		config := DefaultFileAuthenticationBackendConfiguration
 		config.Path = path
 		config.Search.CaseInsensitive = true
@@ -436,6 +583,139 @@ func TestShouldAllowLookupCI(t *testing.T) {
 	})
 }
 
+func TestNewFileCryptoHashFromConfig(t *testing.T) {
+	testCases := []struct {
+		name     string
+		have     schema.Password
+		expected any
+		err      string
+	}{
+		{
+			"ShouldCreatePBKDF2",
+			schema.Password{
+				Algorithm: "pbkdf2",
+				PBKDF2: schema.PBKDF2Password{
+					Variant:    "sha256",
+					Iterations: 100000,
+					SaltLength: 16,
+				},
+			},
+			&pbkdf2.Hasher{},
+			"",
+		},
+		{
+			"ShouldCreateSCrypt",
+			schema.Password{
+				Algorithm: "scrypt",
+				SCrypt: schema.SCryptPassword{
+					Iterations:  12,
+					SaltLength:  16,
+					Parallelism: 1,
+					BlockSize:   1,
+					KeyLength:   32,
+				},
+			},
+			&scrypt.Hasher{},
+			"",
+		},
+		{
+			"ShouldCreateBCrypt",
+			schema.Password{
+				Algorithm: "bcrypt",
+				BCrypt: schema.BCryptPassword{
+					Variant: "standard",
+					Cost:    12,
+				},
+			},
+			&bcrypt.Hasher{},
+			"",
+		},
+		{
+			"ShouldFailToCreateSCryptInvalidParameter",
+			schema.Password{
+				Algorithm: "scrypt",
+			},
+			nil,
+			"failed to initialize hash settings: scrypt validation error: parameter is invalid: parameter 'iterations' must be between 1 and 58 but is set to '0'",
+		},
+		{
+			"ShouldFailUnknown",
+			schema.Password{
+				Algorithm: "unknown",
+			},
+			nil,
+			"algorithm 'unknown' is unknown",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			actual, theError := NewFileCryptoHashFromConfig(tc.have)
+
+			if tc.err == "" {
+				assert.NoError(t, theError)
+				require.NotNil(t, actual)
+				assert.IsType(t, tc.expected, actual)
+			} else {
+				assert.EqualError(t, theError, tc.err)
+				assert.Nil(t, actual)
+			}
+		})
+	}
+}
+
+func TestHashError(t *testing.T) {
+	WithDatabase(t, UserDatabaseContent, func(path string) {
+		config := DefaultFileAuthenticationBackendConfiguration
+		config.Search.CaseInsensitive = true
+		config.Path = path
+
+		provider := NewFileUserProvider(&config)
+
+		assert.NoError(t, provider.StartupCheck())
+
+		ctrl := gomock.NewController(t)
+		defer ctrl.Finish()
+
+		mock := NewMockHash(ctrl)
+		provider.hash = mock
+
+		mock.EXPECT().Hash("apple123").Return(nil, fmt.Errorf("failed to mock hash"))
+
+		assert.EqualError(t, provider.UpdatePassword("john", "apple123"), "failed to mock hash")
+	})
+}
+
+func TestDatabaseError(t *testing.T) {
+	WithDatabase(t, UserDatabaseContent, func(path string) {
+		db := NewYAMLUserDatabase(path, false, false)
+		assert.NoError(t, db.Load())
+
+		config := DefaultFileAuthenticationBackendConfiguration
+		config.Search.CaseInsensitive = true
+		config.Path = path
+
+		provider := NewFileUserProvider(&config)
+
+		assert.NoError(t, provider.StartupCheck())
+
+		ctrl := gomock.NewController(t)
+		defer ctrl.Finish()
+
+		mock := NewMockFileUserDatabase(ctrl)
+
+		provider.database = mock
+
+		gomock.InOrder(
+			mock.EXPECT().GetUserDetails("john").Return(db.GetUserDetails("john")),
+			mock.EXPECT().SetUserDetails("john", gomock.Any()),
+			mock.EXPECT().Save().Return(fmt.Errorf("failed to mock save")),
+		)
+
+		assert.EqualError(t, provider.UpdatePassword("john", "apple123"), "failed to mock save")
+	})
+}
+
 var (
 	DefaultFileAuthenticationBackendConfiguration = schema.FileAuthenticationBackend{
 		Path:     "",
@@ -657,3 +937,17 @@ users:
       - admins
       - dev
 `)
+
+func WithDatabase(t *testing.T, content []byte, f func(path string)) {
+	dir := t.TempDir()
+
+	db, err := os.CreateTemp(dir, "users_database.*.yaml")
+	require.NoError(t, err)
+
+	_, err = db.Write(content)
+	require.NoError(t, err)
+
+	f(db.Name())
+
+	require.NoError(t, db.Close())
+}

internal/authentication/gen.go

@@ -3,5 +3,7 @@ package authentication
 // This file is used to generate mocks. You can generate all mocks using the
 // command `go generate github.com/authelia/authelia/v4/internal/authentication`.
 
-//go:generate mockgen -package authentication -destination ldap_client_mock.go -mock_names LDAPClient=MockLDAPClient github.com/authelia/authelia/v4/internal/authentication LDAPClient
-//go:generate mockgen -package authentication -destination ldap_client_factory_mock.go -mock_names LDAPClientFactory=MockLDAPClientFactory github.com/authelia/authelia/v4/internal/authentication LDAPClientFactory
+//go:generate mockgen -package authentication -destination ldap_client_mock_test.go -mock_names LDAPClient=MockLDAPClient github.com/authelia/authelia/v4/internal/authentication LDAPClient
+//go:generate mockgen -package authentication -destination ldap_client_factory_mock_test.go -mock_names LDAPClientFactory=MockLDAPClientFactory github.com/authelia/authelia/v4/internal/authentication LDAPClientFactory
+//go:generate mockgen -package authentication -destination file_user_provider_database_mock_test.go -mock_names FileUserDatabase=MockFileUserDatabase github.com/authelia/authelia/v4/internal/authentication FileUserDatabase
+//go:generate mockgen -package authentication -destination file_user_provider_hash_mock_test.go -mock_names Hash=MockHash github.com/go-crypt/crypt/algorithm Hash

internal/authentication/ldap_control_types_test.go

@@ -0,0 +1,17 @@
+package authentication
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestControlMsftServerPolicyHints(t *testing.T) {
+	ct := &controlMsftServerPolicyHints{
+		oid: ldapOIDControlMsftServerPolicyHints,
+	}
+
+	assert.Equal(t, ldapOIDControlMsftServerPolicyHints, ct.GetControlType())
+	assert.Equal(t, "Enforce the password history length constraint (MS-SAMR section 3.1.1.7.1) during password set: 1.2.840.113556.1.4.2239", ct.String())
+	assert.NotNil(t, ct.Encode())
+}

internal/authentication/ldap_user_provider.go

@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/go-ldap/ldap/v3"
+	ldap "github.com/go-ldap/ldap/v3"
 	"github.com/sirupsen/logrus"
 
 	"github.com/authelia/authelia/v4/internal/configuration/schema"
@@ -106,7 +106,7 @@ func (p *LDAPUserProvider) CheckUserPassword(username string, password string) (
 
 	defer client.Close()
 
-	if profile, err = p.getUserProfile(client, username, false); err != nil {
+	if profile, err = p.getUserProfile(client, username); err != nil {
 		return false, err
 	}
 
@@ -132,7 +132,7 @@ func (p *LDAPUserProvider) GetDetails(username string) (details *UserDetails, er
 
 	defer client.Close()
 
-	if profile, err = p.getUserProfile(client, username, false); err != nil {
+	if profile, err = p.getUserProfile(client, username); err != nil {
 		return nil, err
 	}
 
@@ -165,7 +165,7 @@ func (p *LDAPUserProvider) UpdatePassword(username, password string) (err error)
 
 	defer client.Close()
 
-	if profile, err = p.getUserProfile(client, username, true); err != nil {
+	if profile, err = p.getUserProfile(client, username); err != nil {
 		return fmt.Errorf("unable to update password. Cause: %w", err)
 	}
 
@@ -191,7 +191,7 @@ func (p *LDAPUserProvider) UpdatePassword(username, password string) (err error)
 		modifyRequest := ldap.NewModifyRequest(profile.DN, controls)
 		// The password needs to be enclosed in quotes
 		// https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/6e803168-f140-4d23-b2d3-c3a8ab5917d2
-		pwdEncoded, _ := utf16LittleEndian.NewEncoder().String(fmt.Sprintf("\"%s\"", password))
+		pwdEncoded, _ := encodingUTF16LittleEndian.NewEncoder().String(fmt.Sprintf("\"%s\"", password))
 		modifyRequest.Replace(ldapAttributeUnicodePwd, []string{pwdEncoded})
 
 		err = p.modify(client, modifyRequest)
@@ -257,10 +257,6 @@ func (p *LDAPUserProvider) search(client LDAPClient, request *ldap.SearchRequest
 	}
 
 	if !p.config.PermitReferrals || len(result.Referrals) == 0 {
-		if err != nil {
-			return nil, err
-		}
-
 		return result, nil
 	}
 
@@ -306,11 +302,11 @@ func (p *LDAPUserProvider) searchReferrals(request *ldap.SearchRequest, result *
 	return nil
 }
 
-func (p *LDAPUserProvider) getUserProfile(client LDAPClient, username string, reset bool) (profile *ldapUserProfile, err error) {
+func (p *LDAPUserProvider) getUserProfile(client LDAPClient, username string) (profile *ldapUserProfile, err error) {
 	// Search for the given username.
 	request := ldap.NewSearchRequest(
 		p.usersBaseDN, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases,
-		1, 0, false, p.resolveUsersFilter(username, reset), p.usersAttributes, nil,
+		1, 0, false, p.resolveUsersFilter(username), p.usersAttributes, nil,
 	)
 
 	p.log.
@@ -433,22 +429,8 @@ func (p *LDAPUserProvider) getUserGroupsRequestFilter(client LDAPClient, usernam
 	}
 
 	for _, entry := range result.Entries {
-	attributes:
-		for _, attr := range entry.Attributes {
-			switch attr.Name {
-			case p.config.Attributes.GroupName:
-				switch n := len(attr.Values); n {
-				case 0:
-					continue
-				case 1:
-					groups = append(groups, attr.Values[0])
-				default:
-					fmt.Println(attr.Name, n, attr.Values)
-					return nil, fmt.Errorf("unable to retrieve groups of user '%s': Cause: the group '%s' attribute '%s' (group name attribute) has more than one value", username, entry.DN, p.config.Attributes.GroupName)
-				}
-
-				break attributes
-			}
+		if group := p.getUserGroupFromEntry(entry); len(group) != 0 {
+			groups = append(groups, group)
 		}
 	}
 
@@ -482,49 +464,53 @@ func (p *LDAPUserProvider) getUserGroupsRequestMemberOf(client LDAPClient, usern
 			continue
 		}
 
-	attributes:
-		for _, attr := range entry.Attributes {
-			switch attr.Name {
-			case p.config.Attributes.GroupName:
-				switch len(attr.Values) {
-				case 0:
-					p.log.
-						WithField("dn", entry.DN).
-						WithField("attribute", attr.Name).
-						Trace("Group skipped as the server returned a null attribute")
-				case 1:
-					switch len(attr.Values[0]) {
-					case 0:
-						p.log.
-							WithField("dn", entry.DN).
-							WithField("attribute", attr.Name).
-							Trace("Skipping group as the configured group name attribute had no value")
-
-					default:
-						groups = append(groups, attr.Values[0])
-					}
-				default:
-					p.log.
-						WithField("dn", entry.DN).
-						WithField("attribute", attr.Name).
-						Trace("Group skipped as the server returned a multi-valued attribute but it should be a single-valued attribute")
-				}
-
-				break attributes
-			}
+		if group := p.getUserGroupFromEntry(entry); len(group) != 0 {
+			groups = append(groups, group)
 		}
 	}
 
 	return groups, nil
 }
 
-func (p *LDAPUserProvider) resolveUsersFilter(input string, reset bool) (filter string) {
-	if reset {
-		filter = p.config.UsersResetFilter
-	} else {
-		filter = p.config.UsersFilter
+func (p *LDAPUserProvider) getUserGroupFromEntry(entry *ldap.Entry) string {
+attributes:
+	for _, attr := range entry.Attributes {
+		switch attr.Name {
+		case p.config.Attributes.GroupName:
+			switch len(attr.Values) {
+			case 0:
+				p.log.
+					WithField("dn", entry.DN).
+					WithField("attribute", attr.Name).
+					Trace("Group skipped as the server returned a null attribute")
+			case 1:
+				switch len(attr.Values[0]) {
+				case 0:
+					p.log.
+						WithField("dn", entry.DN).
+						WithField("attribute", attr.Name).
+						Trace("Skipping group as the configured group name attribute had no value")
+
+				default:
+					return attr.Values[0]
+				}
+			default:
+				p.log.
+					WithField("dn", entry.DN).
+					WithField("attribute", attr.Name).
+					Trace("Group skipped as the server returned a multi-valued attribute but it should be a single-valued attribute")
+			}
+
+			break attributes
+		}
 	}
 
+	return ""
+}
+
+func (p *LDAPUserProvider) resolveUsersFilter(input string) (filter string) {
+	filter = p.config.UsersFilter
+
 	if p.usersFilterReplacementInput {
 		// The {input} placeholder is replaced by the username input.
 		filter = strings.ReplaceAll(filter, ldapPlaceholderInput, ldapEscape(input))

internal/authentication/ldap_user_provider_startup.go

@@ -91,16 +91,6 @@ func (p *LDAPUserProvider) parseDynamicUsersConfiguration() {
 	p.config.UsersFilter = strings.ReplaceAll(p.config.UsersFilter, ldapPlaceholderMailAttribute, p.config.Attributes.Mail)
 	p.config.UsersFilter = strings.ReplaceAll(p.config.UsersFilter, ldapPlaceholderMemberOfAttribute, p.config.Attributes.MemberOf)
 
-	if p.config.UsersResetFilter == "" {
-		p.config.UsersResetFilter = p.config.UsersFilter
-	} else {
-		p.config.UsersResetFilter = strings.ReplaceAll(p.config.UsersResetFilter, ldapPlaceholderDistinguishedNameAttribute, p.config.Attributes.DistinguishedName)
-		p.config.UsersResetFilter = strings.ReplaceAll(p.config.UsersResetFilter, ldapPlaceholderUsernameAttribute, p.config.Attributes.Username)
-		p.config.UsersResetFilter = strings.ReplaceAll(p.config.UsersResetFilter, ldapPlaceholderDisplayNameAttribute, p.config.Attributes.DisplayName)
-		p.config.UsersResetFilter = strings.ReplaceAll(p.config.UsersResetFilter, ldapPlaceholderMailAttribute, p.config.Attributes.Mail)
-		p.config.UsersResetFilter = strings.ReplaceAll(p.config.UsersResetFilter, ldapPlaceholderMemberOfAttribute, p.config.Attributes.MemberOf)
-	}
-
 	p.log.Tracef("Dynamically generated users filter is %s", p.config.UsersFilter)
 
 	if len(p.config.Attributes.Username) != 0 && !utils.IsStringInSlice(p.config.Attributes.Username, p.usersAttributes) {

internal/authentication/ldap_user_provider_test.go

@@ -6,7 +6,7 @@ import (
 	"testing"
 	"time"
 
-	ldap "github.com/go-ldap/ldap/v3"
+	"github.com/go-ldap/ldap/v3"
 	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -16,6 +16,20 @@ import (
 	"github.com/authelia/authelia/v4/internal/utils"
 )
 
+func TestNewLDAPUserProvider(t *testing.T) {
+	provider := NewLDAPUserProvider(schema.AuthenticationBackend{LDAP: &schema.LDAPAuthenticationBackend{}}, nil)
+
+	assert.NotNil(t, provider)
+}
+
+func TestNewLDAPUserProviderWithFactoryWithoutFactory(t *testing.T) {
+	provider := NewLDAPUserProviderWithFactory(schema.LDAPAuthenticationBackend{}, false, nil, nil)
+
+	assert.NotNil(t, provider)
+
+	assert.IsType(t, &ProductionLDAPClientFactory{}, provider.factory)
+}
+
 func TestShouldCreateRawConnectionWhenSchemeIsLDAP(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()
@@ -757,7 +771,7 @@ func TestShouldEscapeUserInput(t *testing.T) {
 		Search(NewSearchRequestMatcher("(|(uid=john\\=abc)(mail=john\\=abc))")).
 		Return(&ldap.SearchResult{}, nil)
 
-	_, err := provider.getUserProfile(mockClient, "john=abc", false)
+	_, err := provider.getUserProfile(mockClient, "john=abc")
 	require.Error(t, err)
 	assert.EqualError(t, err, "user not found")
 }
@@ -823,7 +837,7 @@ func TestShouldReturnEmailWhenAttributeSameAsUsername(t *testing.T) {
 	client, err := provider.connect()
 	assert.NoError(t, err)
 
-	profile, err := provider.getUserProfile(client, "john@example.com", false)
+	profile, err := provider.getUserProfile(client, "john@example.com")
 
 	assert.NoError(t, err)
 	require.NotNil(t, profile)
@@ -897,7 +911,7 @@ func TestShouldReturnUsernameAndBlankDisplayNameWhenAttributesTheSame(t *testing
 	client, err := provider.connect()
 	assert.NoError(t, err)
 
-	profile, err := provider.getUserProfile(client, "john@example.com", false)
+	profile, err := provider.getUserProfile(client, "john@example.com")
 
 	assert.NoError(t, err)
 	require.NotNil(t, profile)
@@ -965,6 +979,10 @@ func TestShouldReturnBlankEmailAndDisplayNameWhenAttrsLenZero(t *testing.T) {
 							Name:   "displayName",
 							Values: []string{},
 						},
+						{
+							Name:   "memberOf",
+							Values: []string{},
+						},
 					},
 				},
 			},
@@ -975,7 +993,7 @@ func TestShouldReturnBlankEmailAndDisplayNameWhenAttrsLenZero(t *testing.T) {
 	client, err := provider.connect()
 	assert.NoError(t, err)
 
-	profile, err := provider.getUserProfile(client, "john@example.com", false)
+	profile, err := provider.getUserProfile(client, "john@example.com")
 
 	assert.NoError(t, err)
 	require.NotNil(t, profile)
@@ -1022,7 +1040,7 @@ func TestShouldCombineUsernameFilterAndUsersFilter(t *testing.T) {
 		Search(NewSearchRequestMatcher("(&(uid=john)(&(objectCategory=person)(objectClass=user)))")).
 		Return(&ldap.SearchResult{}, nil)
 
-	_, err := provider.getUserProfile(mockClient, "john", false)
+	_, err := provider.getUserProfile(mockClient, "john")
 	require.Error(t, err)
 	assert.EqualError(t, err, "user not found")
 }
@@ -1650,13 +1668,400 @@ func TestShouldReturnUsernameFromLDAPSearchModeMemberOfDN(t *testing.T) {
 	assert.Equal(t, details.Username, "John")
 }
 
-func TestShouldReturnUsernameFromLDAPWithReferrals(t *testing.T) {
+func TestShouldReturnErrSearchMemberOf(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mockFactory := NewMockLDAPClientFactory(ctrl)
+	mockClient := NewMockLDAPClient(ctrl)
+
+	provider := NewLDAPUserProviderWithFactory(
+		schema.LDAPAuthenticationBackend{
+			Address:  testLDAPAddress,
+			User:     "CN=Administrator,CN=Users,DC=example,DC=com",
+			Password: "password",
+			Attributes: schema.LDAPAuthenticationAttributes{
+				DistinguishedName: "distinguishedName",
+				Username:          "sAMAccountName",
+				Mail:              "mail",
+				DisplayName:       "displayName",
+				MemberOf:          "memberOf",
+				GroupName:         "cn",
+			},
+			GroupSearchMode:   "memberof",
+			UsersFilter:       "sAMAccountName={input}",
+			GroupsFilter:      "(|{memberof:dn})",
+			AdditionalUsersDN: "CN=users",
+			BaseDN:            "DC=example,DC=com",
+		},
+		false,
+		nil,
+		mockFactory)
+
+	dialURL := mockFactory.EXPECT().
+		DialURL(gomock.Eq("ldap://127.0.0.1:389"), gomock.Any()).
+		Return(mockClient, nil)
+
+	connBind := mockClient.EXPECT().
+		Bind(gomock.Eq("CN=Administrator,CN=Users,DC=example,DC=com"), gomock.Eq("password")).
+		Return(nil)
+
+	connClose := mockClient.EXPECT().Close()
+
+	requestGroups := ldap.NewSearchRequest(
+		provider.groupsBaseDN, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases,
+		0, 0, false, "(|(distinguishedName=CN=admins,OU=groups,DC=example,DC=com)(distinguishedName=CN=users,OU=groups,DC=example,DC=com))", provider.groupsAttributes, nil,
+	)
+
+	searchGroups := mockClient.EXPECT().
+		Search(requestGroups).
+		Return(nil, fmt.Errorf("failed to get groups"))
+
+	searchProfile := mockClient.EXPECT().
+		Search(gomock.Any()).
+		Return(&ldap.SearchResult{
+			Entries: []*ldap.Entry{
+				{
+					DN: "uid=test,dc=example,dc=com",
+					Attributes: []*ldap.EntryAttribute{
+						{
+							Name:   "displayName",
+							Values: []string{"John Doe"},
+						},
+						{
+							Name:   "mail",
+							Values: []string{"test@example.com"},
+						},
+						{
+							Name:   "sAMAccountName",
+							Values: []string{"John"},
+						},
+						{
+							Name:   "memberOf",
+							Values: []string{"CN=admins,OU=groups,DC=example,DC=com", "CN=users,OU=groups,DC=example,DC=com"},
+						},
+					},
+				},
+			},
+		}, nil)
+
+	gomock.InOrder(dialURL, connBind, searchProfile, searchGroups, connClose)
+
+	details, err := provider.GetDetails("john")
+	assert.Nil(t, details)
+	assert.EqualError(t, err, "unable to retrieve groups of user 'john'. Cause: failed to get groups")
+}
+
+func TestShouldReturnErrUnknownSearchMode(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mockFactory := NewMockLDAPClientFactory(ctrl)
+	mockClient := NewMockLDAPClient(ctrl)
+
+	provider := NewLDAPUserProviderWithFactory(
+		schema.LDAPAuthenticationBackend{
+			Address:  testLDAPAddress,
+			User:     "CN=Administrator,CN=Users,DC=example,DC=com",
+			Password: "password",
+			Attributes: schema.LDAPAuthenticationAttributes{
+				DistinguishedName: "distinguishedName",
+				Username:          "sAMAccountName",
+				Mail:              "mail",
+				DisplayName:       "displayName",
+				MemberOf:          "memberOf",
+				GroupName:         "cn",
+			},
+			GroupSearchMode:   "bad",
+			UsersFilter:       "sAMAccountName={input}",
+			GroupsFilter:      "(|{memberof:dn})",
+			AdditionalUsersDN: "CN=users",
+			BaseDN:            "DC=example,DC=com",
+		},
+		false,
+		nil,
+		mockFactory)
+
+	dialURL := mockFactory.EXPECT().
+		DialURL(gomock.Eq("ldap://127.0.0.1:389"), gomock.Any()).
+		Return(mockClient, nil)
+
+	connBind := mockClient.EXPECT().
+		Bind(gomock.Eq("CN=Administrator,CN=Users,DC=example,DC=com"), gomock.Eq("password")).
+		Return(nil)
+
+	connClose := mockClient.EXPECT().Close()
+
+	searchProfile := mockClient.EXPECT().
+		Search(gomock.Any()).
+		Return(&ldap.SearchResult{
+			Entries: []*ldap.Entry{
+				{
+					DN: "uid=test,dc=example,dc=com",
+					Attributes: []*ldap.EntryAttribute{
+						{
+							Name:   "displayName",
+							Values: []string{"John Doe"},
+						},
+						{
+							Name:   "mail",
+							Values: []string{"test@example.com"},
+						},
+						{
+							Name:   "sAMAccountName",
+							Values: []string{"John"},
+						},
+						{
+							Name:   "memberOf",
+							Values: []string{"CN=admins,OU=groups,DC=example,DC=com", "CN=users,OU=groups,DC=example,DC=com"},
+						},
+					},
+				},
+			},
+		}, nil)
+
+	gomock.InOrder(dialURL, connBind, searchProfile, connClose)
+
+	details, err := provider.GetDetails("john")
+	assert.Nil(t, details)
+
+	assert.EqualError(t, err, "could not perform group search with mode 'bad' as it's unknown")
+}
+
+func TestShouldSkipEmptyAttributesSearchModeMemberOf(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mockFactory := NewMockLDAPClientFactory(ctrl)
+	mockClient := NewMockLDAPClient(ctrl)
+
+	provider := NewLDAPUserProviderWithFactory(
+		schema.LDAPAuthenticationBackend{
+			Address:  testLDAPAddress,
+			User:     "CN=Administrator,CN=Users,DC=example,DC=com",
+			Password: "password",
+			Attributes: schema.LDAPAuthenticationAttributes{
+				DistinguishedName: "distinguishedName",
+				Username:          "sAMAccountName",
+				Mail:              "mail",
+				DisplayName:       "displayName",
+				MemberOf:          "memberOf",
+				GroupName:         "cn",
+			},
+			GroupSearchMode:   "memberof",
+			UsersFilter:       "sAMAccountName={input}",
+			GroupsFilter:      "(|{memberof:dn})",
+			AdditionalUsersDN: "CN=users",
+			BaseDN:            "DC=example,DC=com",
+		},
+		false,
+		nil,
+		mockFactory)
+
+	dialURL := mockFactory.EXPECT().
+		DialURL(gomock.Eq("ldap://127.0.0.1:389"), gomock.Any()).
+		Return(mockClient, nil)
+
+	connBind := mockClient.EXPECT().
+		Bind(gomock.Eq("CN=Administrator,CN=Users,DC=example,DC=com"), gomock.Eq("password")).
+		Return(nil)
+
+	connClose := mockClient.EXPECT().Close()
+
+	searchProfile := mockClient.EXPECT().
+		Search(gomock.Any()).
+		Return(&ldap.SearchResult{
+			Entries: []*ldap.Entry{
+				{
+					DN: "uid=test,dc=example,dc=com",
+					Attributes: []*ldap.EntryAttribute{
+						{
+							Name:   "displayName",
+							Values: []string{"John Doe"},
+						},
+						{
+							Name:   "mail",
+							Values: []string{"test@example.com"},
+						},
+						{
+							Name:   "sAMAccountName",
+							Values: []string{"John"},
+						},
+						{
+							Name:   "memberOf",
+							Values: []string{"CN=admins,OU=groups,DC=example,DC=com", "CN=users,OU=groups,DC=example,DC=com", "CN=multi,OU=groups,DC=example,DC=com"},
+						},
+					},
+				},
+			},
+		}, nil)
+
+	searchGroups := mockClient.EXPECT().
+		Search(gomock.Any()).
+		Return(&ldap.SearchResult{
+			Entries: []*ldap.Entry{
+				{
+					DN:         "uid=grp,dc=example,dc=com",
+					Attributes: []*ldap.EntryAttribute{},
+				},
+				{
+					DN: "CN=users,OU=groups,DC=example,DC=com",
+					Attributes: []*ldap.EntryAttribute{
+						{
+							Name:   "cn",
+							Values: []string{},
+						},
+					},
+				},
+				{
+					DN: "CN=admins,OU=groups,DC=example,DC=com",
+					Attributes: []*ldap.EntryAttribute{
+						{
+							Name:   "cn",
+							Values: []string{""},
+						},
+					},
+				},
+				{
+					DN: "CN=multi,OU=groups,DC=example,DC=com",
+					Attributes: []*ldap.EntryAttribute{
+						{
+							Name:   "cn",
+							Values: []string{"a", "b"},
+						},
+					},
+				},
+			},
+		}, nil)
+
+	gomock.InOrder(dialURL, connBind, searchProfile, searchGroups, connClose)
+
+	details, err := provider.GetDetails("john")
+
+	assert.NoError(t, err)
+	assert.NotNil(t, details)
+}
+
+func TestShouldSkipEmptyAttributesSearchModeFilter(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mockFactory := NewMockLDAPClientFactory(ctrl)
+	mockClient := NewMockLDAPClient(ctrl)
+
+	provider := NewLDAPUserProviderWithFactory(
+		schema.LDAPAuthenticationBackend{
+			Address:  testLDAPAddress,
+			User:     "CN=Administrator,CN=Users,DC=example,DC=com",
+			Password: "password",
+			Attributes: schema.LDAPAuthenticationAttributes{
+				DistinguishedName: "distinguishedName",
+				Username:          "sAMAccountName",
+				Mail:              "mail",
+				DisplayName:       "displayName",
+				MemberOf:          "memberOf",
+				GroupName:         "cn",
+			},
+			GroupSearchMode:   "filter",
+			UsersFilter:       "sAMAccountName={input}",
+			GroupsFilter:      "(|{memberof:dn})",
+			AdditionalUsersDN: "CN=users",
+			BaseDN:            "DC=example,DC=com",
+		},
+		false,
+		nil,
+		mockFactory)
+
+	dialURL := mockFactory.EXPECT().
+		DialURL(gomock.Eq("ldap://127.0.0.1:389"), gomock.Any()).
+		Return(mockClient, nil)
+
+	connBind := mockClient.EXPECT().
+		Bind(gomock.Eq("CN=Administrator,CN=Users,DC=example,DC=com"), gomock.Eq("password")).
+		Return(nil)
+
+	connClose := mockClient.EXPECT().Close()
+
+	searchProfile := mockClient.EXPECT().
+		Search(gomock.Any()).
+		Return(&ldap.SearchResult{
+			Entries: []*ldap.Entry{
+				{
+					DN: "uid=test,dc=example,dc=com",
+					Attributes: []*ldap.EntryAttribute{
+						{
+							Name:   "displayName",
+							Values: []string{"John Doe"},
+						},
+						{
+							Name:   "mail",
+							Values: []string{"test@example.com"},
+						},
+						{
+							Name:   "sAMAccountName",
+							Values: []string{"John"},
+						},
+						{
+							Name:   "memberOf",
+							Values: []string{"CN=admins,OU=groups,DC=example,DC=com", "CN=users,OU=groups,DC=example,DC=com", "CN=multi,OU=groups,DC=example,DC=com"},
+						},
+					},
+				},
+			},
+		}, nil)
+
+	searchGroups := mockClient.EXPECT().
+		Search(gomock.Any()).
+		Return(&ldap.SearchResult{
+			Entries: []*ldap.Entry{
+				{
+					DN:         "uid=grp,dc=example,dc=com",
+					Attributes: []*ldap.EntryAttribute{},
+				},
+				{
+					DN: "CN=users,OU=groups,DC=example,DC=com",
+					Attributes: []*ldap.EntryAttribute{
+						{
+							Name:   "cn",
+							Values: []string{},
+						},
+					},
+				},
+				{
+					DN: "CN=admins,OU=groups,DC=example,DC=com",
+					Attributes: []*ldap.EntryAttribute{
+						{
+							Name:   "cn",
+							Values: []string{""},
+						},
+					},
+				},
+				{
+					DN: "CN=multi,OU=groups,DC=example,DC=com",
+					Attributes: []*ldap.EntryAttribute{
+						{
+							Name:   "cn",
+							Values: []string{"a", "b"},
+						},
+					},
+				},
+			},
+		}, nil)
+
+	gomock.InOrder(dialURL, connBind, searchProfile, searchGroups, connClose)
+
+	details, err := provider.GetDetails("john")
+
+	assert.NoError(t, err)
+	assert.NotNil(t, details)
+}
+
+func TestShouldSkipEmptyGroupsResultMemberOf(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()
 
 	mockFactory := NewMockLDAPClientFactory(ctrl)
 	mockClient := NewMockLDAPClient(ctrl)
-	mockClientReferral := NewMockLDAPClient(ctrl)
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
@@ -1690,27 +2095,14 @@ func TestShouldReturnUsernameFromLDAPWithReferrals(t *testing.T) {
 	connClose := mockClient.EXPECT().Close()
 
 	searchGroups := mockClient.EXPECT().
-		Search(gomock.Any()).
-		Return(createGroupSearchResultModeFilter(provider.config.Attributes.GroupName, "group1", "group2"), nil)
-
-	searchProfile := mockClient.EXPECT().
 		Search(gomock.Any()).
 		Return(&ldap.SearchResult{
-			Entries:   []*ldap.Entry{},
-			Referrals: []string{"ldap://192.168.2.1"},
+			Entries: []*ldap.Entry{
+				{},
+			},
 		}, nil)
 
-	dialURLReferral := mockFactory.EXPECT().
-		DialURL(gomock.Eq("ldap://192.168.2.1"), gomock.Any()).
-		Return(mockClientReferral, nil)
-
-	connBindReferral := mockClientReferral.EXPECT().
-		Bind(gomock.Eq("cn=admin,dc=example,dc=com"), gomock.Eq("password")).
-		Return(nil)
-
-	connCloseReferral := mockClientReferral.EXPECT().Close()
-
-	searchProfileReferral := mockClientReferral.EXPECT().
+	searchProfile := mockClient.EXPECT().
 		Search(gomock.Any()).
 		Return(&ldap.SearchResult{
 			Entries: []*ldap.Entry{
@@ -1734,12 +2126,11 @@ func TestShouldReturnUsernameFromLDAPWithReferrals(t *testing.T) {
 			},
 		}, nil)
 
-	gomock.InOrder(dialURL, connBind, searchProfile, dialURLReferral, connBindReferral, searchProfileReferral, connCloseReferral, searchGroups, connClose)
+	gomock.InOrder(dialURL, connBind, searchProfile, searchGroups, connClose)
 
 	details, err := provider.GetDetails("john")
 	require.NoError(t, err)
 
-	assert.ElementsMatch(t, details.Groups, []string{"group1", "group2"})
 	assert.ElementsMatch(t, details.Emails, []string{"test@example.com"})
 	assert.Equal(t, details.DisplayName, "John Doe")
 	assert.Equal(t, details.Username, "John")
@@ -1793,11 +2184,11 @@ func TestShouldReturnUsernameFromLDAPWithReferralsInErrorAndResult(t *testing.T)
 		Search(gomock.Any()).
 		Return(&ldap.SearchResult{
 			Entries:   []*ldap.Entry{},
-			Referrals: []string{"ldap://192.168.2.1"},
+			Referrals: []string{"ldap://192.168.0.1"},
 		}, &ldap.Error{ResultCode: ldap.LDAPResultReferral, Err: errors.New("referral"), Packet: &testBERPacketReferral})
 
 	dialURLReferral := mockFactory.EXPECT().
-		DialURL(gomock.Eq("ldap://192.168.2.1"), gomock.Any()).
+		DialURL(gomock.Eq("ldap://192.168.0.1"), gomock.Any()).
 		Return(mockClientReferral, nil)
 
 	connBindReferral := mockClientReferral.EXPECT().
@@ -1875,6 +2266,266 @@ func TestShouldReturnUsernameFromLDAPWithReferralsInErrorAndResult(t *testing.T)
 	assert.Equal(t, details.Username, "John")
 }
 
+func TestShouldReturnUsernameFromLDAPWithReferralsInErrorAndNoResult(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mockFactory := NewMockLDAPClientFactory(ctrl)
+	mockClient := NewMockLDAPClient(ctrl)
+	mockClientReferral := NewMockLDAPClient(ctrl)
+
+	provider := NewLDAPUserProviderWithFactory(
+		schema.LDAPAuthenticationBackend{
+			Address:  testLDAPAddress,
+			User:     "cn=admin,dc=example,dc=com",
+			Password: "password",
+			Attributes: schema.LDAPAuthenticationAttributes{
+				Username:    "uid",
+				Mail:        "mail",
+				DisplayName: "displayName",
+				MemberOf:    "memberOf",
+				GroupName:   "cn",
+			},
+			UsersFilter:       "uid={input}",
+			AdditionalUsersDN: "ou=users",
+			BaseDN:            "dc=example,dc=com",
+			PermitReferrals:   true,
+		},
+		false,
+		nil,
+		mockFactory)
+
+	dialURL := mockFactory.EXPECT().
+		DialURL(gomock.Eq("ldap://127.0.0.1:389"), gomock.Any()).
+		Return(mockClient, nil)
+
+	connBind := mockClient.EXPECT().
+		Bind(gomock.Eq("cn=admin,dc=example,dc=com"), gomock.Eq("password")).
+		Return(nil)
+
+	connClose := mockClient.EXPECT().Close()
+
+	searchGroups := mockClient.EXPECT().
+		Search(gomock.Any()).
+		Return(createGroupSearchResultModeFilter(provider.config.Attributes.GroupName, "group1", "group2"), nil)
+
+	searchProfile := mockClient.EXPECT().
+		Search(gomock.Any()).
+		Return(nil, &ldap.Error{ResultCode: ldap.LDAPResultReferral, Err: errors.New("referral"), Packet: &testBERPacketReferral})
+
+	dialURLReferral := mockFactory.EXPECT().
+		DialURL(gomock.Eq("ldap://192.168.0.1"), gomock.Any()).
+		Return(mockClientReferral, nil)
+
+	connBindReferral := mockClientReferral.EXPECT().
+		Bind(gomock.Eq("cn=admin,dc=example,dc=com"), gomock.Eq("password")).
+		Return(nil)
+
+	connCloseReferral := mockClientReferral.EXPECT().Close()
+
+	searchProfileReferral := mockClientReferral.EXPECT().
+		Search(gomock.Any()).
+		Return(&ldap.SearchResult{
+			Entries: []*ldap.Entry{
+				{
+					DN: "uid=test,dc=example,dc=com",
+					Attributes: []*ldap.EntryAttribute{
+						{
+							Name:   "displayName",
+							Values: []string{"John Doe"},
+						},
+						{
+							Name:   "mail",
+							Values: []string{"test@example.com"},
+						},
+						{
+							Name:   "uid",
+							Values: []string{"John"},
+						},
+					},
+				},
+			},
+		}, nil)
+
+	gomock.InOrder(dialURL, connBind, searchProfile, dialURLReferral, connBindReferral, searchProfileReferral, connCloseReferral, searchGroups, connClose)
+
+	details, err := provider.GetDetails("john")
+	require.NoError(t, err)
+
+	assert.ElementsMatch(t, details.Groups, []string{"group1", "group2"})
+	assert.ElementsMatch(t, details.Emails, []string{"test@example.com"})
+	assert.Equal(t, details.DisplayName, "John Doe")
+	assert.Equal(t, details.Username, "John")
+}
+
+func TestShouldReturnDialErrDuringReferralSearchUsernameFromLDAPWithReferralsInErrorAndNoResult(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mockFactory := NewMockLDAPClientFactory(ctrl)
+	mockClient := NewMockLDAPClient(ctrl)
+
+	provider := NewLDAPUserProviderWithFactory(
+		schema.LDAPAuthenticationBackend{
+			Address:  testLDAPAddress,
+			User:     "cn=admin,dc=example,dc=com",
+			Password: "password",
+			Attributes: schema.LDAPAuthenticationAttributes{
+				Username:    "uid",
+				Mail:        "mail",
+				DisplayName: "displayName",
+				MemberOf:    "memberOf",
+				GroupName:   "cn",
+			},
+			UsersFilter:       "uid={input}",
+			AdditionalUsersDN: "ou=users",
+			BaseDN:            "dc=example,dc=com",
+			PermitReferrals:   true,
+		},
+		false,
+		nil,
+		mockFactory)
+
+	dialURL := mockFactory.EXPECT().
+		DialURL(gomock.Eq("ldap://127.0.0.1:389"), gomock.Any()).
+		Return(mockClient, nil)
+
+	connBind := mockClient.EXPECT().
+		Bind(gomock.Eq("cn=admin,dc=example,dc=com"), gomock.Eq("password")).
+		Return(nil)
+
+	connClose := mockClient.EXPECT().Close()
+
+	searchProfile := mockClient.EXPECT().
+		Search(gomock.Any()).
+		Return(nil, &ldap.Error{ResultCode: ldap.LDAPResultReferral, Err: errors.New("referral"), Packet: &testBERPacketReferral})
+
+	dialURLReferral := mockFactory.EXPECT().
+		DialURL(gomock.Eq("ldap://192.168.0.1"), gomock.Any()).
+		Return(nil, fmt.Errorf("failed to connect"))
+
+	gomock.InOrder(dialURL, connBind, searchProfile, dialURLReferral, connClose)
+
+	details, err := provider.GetDetails("john")
+
+	assert.Nil(t, details)
+	assert.EqualError(t, err, "cannot find user DN of user 'john'. Cause: error occurred connecting to referred LDAP server 'ldap://192.168.0.1': dial failed with error: failed to connect")
+}
+
+func TestShouldReturnSearchErrDuringReferralSearchUsernameFromLDAPWithReferralsInErrorAndNoResult(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mockFactory := NewMockLDAPClientFactory(ctrl)
+	mockClient := NewMockLDAPClient(ctrl)
+	mockClientReferral := NewMockLDAPClient(ctrl)
+
+	provider := NewLDAPUserProviderWithFactory(
+		schema.LDAPAuthenticationBackend{
+			Address:  testLDAPAddress,
+			User:     "cn=admin,dc=example,dc=com",
+			Password: "password",
+			Attributes: schema.LDAPAuthenticationAttributes{
+				Username:    "uid",
+				Mail:        "mail",
+				DisplayName: "displayName",
+				MemberOf:    "memberOf",
+				GroupName:   "cn",
+			},
+			UsersFilter:       "uid={input}",
+			AdditionalUsersDN: "ou=users",
+			BaseDN:            "dc=example,dc=com",
+			PermitReferrals:   true,
+		},
+		false,
+		nil,
+		mockFactory)
+
+	dialURL := mockFactory.EXPECT().
+		DialURL(gomock.Eq("ldap://127.0.0.1:389"), gomock.Any()).
+		Return(mockClient, nil)
+
+	connBind := mockClient.EXPECT().
+		Bind(gomock.Eq("cn=admin,dc=example,dc=com"), gomock.Eq("password")).
+		Return(nil)
+
+	connClose := mockClient.EXPECT().Close()
+
+	searchProfile := mockClient.EXPECT().
+		Search(gomock.Any()).
+		Return(nil, &ldap.Error{ResultCode: ldap.LDAPResultReferral, Err: errors.New("referral"), Packet: &testBERPacketReferral})
+
+	dialURLReferral := mockFactory.EXPECT().
+		DialURL(gomock.Eq("ldap://192.168.0.1"), gomock.Any()).
+		Return(mockClientReferral, nil)
+
+	connBindReferral := mockClientReferral.EXPECT().
+		Bind(gomock.Eq("cn=admin,dc=example,dc=com"), gomock.Eq("password")).
+		Return(nil)
+
+	connCloseReferral := mockClientReferral.EXPECT().Close()
+
+	searchProfileReferral := mockClientReferral.EXPECT().
+		Search(gomock.Any()).
+		Return(nil, fmt.Errorf("not found"))
+
+	gomock.InOrder(dialURL, connBind, searchProfile, dialURLReferral, connBindReferral, searchProfileReferral, connCloseReferral, connClose)
+
+	details, err := provider.GetDetails("john")
+
+	assert.Nil(t, details)
+	assert.EqualError(t, err, "cannot find user DN of user 'john'. Cause: error occurred performing search on referred LDAP server 'ldap://192.168.0.1': not found")
+}
+
+func TestShouldNotReturnUsernameFromLDAPWithReferralsInErrorAndReferralsNotPermitted(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mockFactory := NewMockLDAPClientFactory(ctrl)
+	mockClient := NewMockLDAPClient(ctrl)
+
+	provider := NewLDAPUserProviderWithFactory(
+		schema.LDAPAuthenticationBackend{
+			Address:  testLDAPAddress,
+			User:     "cn=admin,dc=example,dc=com",
+			Password: "password",
+			Attributes: schema.LDAPAuthenticationAttributes{
+				Username:    "uid",
+				Mail:        "mail",
+				DisplayName: "displayName",
+				MemberOf:    "memberOf",
+				GroupName:   "cn",
+			},
+			UsersFilter:       "uid={input}",
+			AdditionalUsersDN: "ou=users",
+			BaseDN:            "dc=example,dc=com",
+			PermitReferrals:   false,
+		},
+		false,
+		nil,
+		mockFactory)
+
+	dialURL := mockFactory.EXPECT().
+		DialURL(gomock.Eq("ldap://127.0.0.1:389"), gomock.Any()).
+		Return(mockClient, nil)
+
+	connBind := mockClient.EXPECT().
+		Bind(gomock.Eq("cn=admin,dc=example,dc=com"), gomock.Eq("password")).
+		Return(nil)
+
+	connClose := mockClient.EXPECT().Close()
+
+	searchProfile := mockClient.EXPECT().
+		Search(gomock.Any()).
+		Return(nil, &ldap.Error{ResultCode: ldap.LDAPResultReferral, Err: errors.New("referral"), Packet: &testBERPacketReferral})
+
+	gomock.InOrder(dialURL, connBind, searchProfile, connClose)
+
+	details, err := provider.GetDetails("john")
+	assert.EqualError(t, err, "cannot find user DN of user 'john'. Cause: LDAP Result Code 10 \"Referral\": referral")
+	assert.Nil(t, details)
+}
+
 func TestShouldReturnUsernameFromLDAPWithReferralsErr(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()
@@ -2259,7 +2910,7 @@ func TestShouldUpdateUserPasswordMSAD(t *testing.T) {
 		[]ldap.Control{&controlMsftServerPolicyHints{ldapOIDControlMsftServerPolicyHints}},
 	)
 
-	pwdEncoded, _ := utf16LittleEndian.NewEncoder().String(fmt.Sprintf("\"%s\"", "password"))
+	pwdEncoded, _ := encodingUTF16LittleEndian.NewEncoder().String(fmt.Sprintf("\"%s\"", "password"))
 	modifyRequest.Replace(ldapAttributeUnicodePwd, []string{pwdEncoded})
 
 	dialURLOIDs := mockFactory.EXPECT().
@@ -2373,7 +3024,7 @@ func TestShouldUpdateUserPasswordMSADWithReferrals(t *testing.T) {
 		[]ldap.Control{&controlMsftServerPolicyHints{ldapOIDControlMsftServerPolicyHints}},
 	)
 
-	pwdEncoded, _ := utf16LittleEndian.NewEncoder().String(fmt.Sprintf("\"%s\"", "password"))
+	pwdEncoded, _ := encodingUTF16LittleEndian.NewEncoder().String(fmt.Sprintf("\"%s\"", "password"))
 	modifyRequest.Replace(ldapAttributeUnicodePwd, []string{pwdEncoded})
 
 	dialURLOIDs := mockFactory.EXPECT().
@@ -2504,7 +3155,7 @@ func TestShouldUpdateUserPasswordMSADWithReferralsWithReferralConnectErr(t *test
 		[]ldap.Control{&controlMsftServerPolicyHints{ldapOIDControlMsftServerPolicyHints}},
 	)
 
-	pwdEncoded, _ := utf16LittleEndian.NewEncoder().String(fmt.Sprintf("\"%s\"", "password"))
+	pwdEncoded, _ := encodingUTF16LittleEndian.NewEncoder().String(fmt.Sprintf("\"%s\"", "password"))
 	modifyRequest.Replace(ldapAttributeUnicodePwd, []string{pwdEncoded})
 
 	dialURLOIDs := mockFactory.EXPECT().
@@ -2626,7 +3277,7 @@ func TestShouldUpdateUserPasswordMSADWithReferralsWithReferralModifyErr(t *testi
 		[]ldap.Control{&controlMsftServerPolicyHints{ldapOIDControlMsftServerPolicyHints}},
 	)
 
-	pwdEncoded, _ := utf16LittleEndian.NewEncoder().String(fmt.Sprintf("\"%s\"", "password"))
+	pwdEncoded, _ := encodingUTF16LittleEndian.NewEncoder().String(fmt.Sprintf("\"%s\"", "password"))
 	modifyRequest.Replace(ldapAttributeUnicodePwd, []string{pwdEncoded})
 
 	dialURLOIDs := mockFactory.EXPECT().
@@ -2761,7 +3412,7 @@ func TestShouldUpdateUserPasswordMSADWithoutReferrals(t *testing.T) {
 		[]ldap.Control{&controlMsftServerPolicyHints{ldapOIDControlMsftServerPolicyHints}},
 	)
 
-	pwdEncoded, _ := utf16LittleEndian.NewEncoder().String(fmt.Sprintf("\"%s\"", "password"))
+	pwdEncoded, _ := encodingUTF16LittleEndian.NewEncoder().String(fmt.Sprintf("\"%s\"", "password"))
 	modifyRequest.Replace(ldapAttributeUnicodePwd, []string{pwdEncoded})
 
 	dialURLOIDs := mockFactory.EXPECT().
@@ -3975,7 +4626,7 @@ func TestShouldReturnErrorWhenMultipleUsernameAttributes(t *testing.T) {
 	client, err := provider.connect()
 	assert.NoError(t, err)
 
-	profile, err := provider.getUserProfile(client, "john", false)
+	profile, err := provider.getUserProfile(client, "john")
 
 	assert.Nil(t, profile)
 	assert.EqualError(t, err, "user 'john' has 2 values for for attribute 'uid' but the attribute must be a single value attribute")
@@ -4044,7 +4695,7 @@ func TestShouldReturnErrorWhenZeroUsernameAttributes(t *testing.T) {
 	client, err := provider.connect()
 	assert.NoError(t, err)
 
-	profile, err := provider.getUserProfile(client, "john", false)
+	profile, err := provider.getUserProfile(client, "john")
 
 	assert.Nil(t, profile)
 	assert.EqualError(t, err, "user 'john' must have value for attribute 'uid'")
@@ -4109,7 +4760,7 @@ func TestShouldReturnErrorWhenUsernameAttributeNotReturned(t *testing.T) {
 	client, err := provider.connect()
 	assert.NoError(t, err)
 
-	profile, err := provider.getUserProfile(client, "john", false)
+	profile, err := provider.getUserProfile(client, "john")
 
 	assert.Nil(t, profile)
 	assert.EqualError(t, err, "user 'john' must have value for attribute 'uid'")
@@ -4195,7 +4846,7 @@ func TestShouldReturnErrorWhenMultipleUsersFound(t *testing.T) {
 	client, err := provider.connect()
 	assert.NoError(t, err)
 
-	profile, err := provider.getUserProfile(client, "john", false)
+	profile, err := provider.getUserProfile(client, "john")
 
 	assert.Nil(t, profile)
 	assert.EqualError(t, err, "there were 2 users found when searching for 'john' but there should only be 1")
@@ -4264,7 +4915,7 @@ func TestShouldReturnErrorWhenNoDN(t *testing.T) {
 	client, err := provider.connect()
 	assert.NoError(t, err)
 
-	profile, err := provider.getUserProfile(client, "john", false)
+	profile, err := provider.getUserProfile(client, "john")
 
 	assert.Nil(t, profile)
 	assert.EqualError(t, err, "user 'john' must have a distinguished name but the result returned an empty distinguished name")
@@ -4383,6 +5034,51 @@ func TestShouldNotCheckValidUserPasswordWithConnectError(t *testing.T) {
 	assert.EqualError(t, err, "bind failed with error: LDAP Result Code 49 \"Invalid Credentials\": invalid username or password")
 }
 
+func TestShouldNotCheckValidUserPasswordWithGetProfileError(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mockFactory := NewMockLDAPClientFactory(ctrl)
+	mockClient := NewMockLDAPClient(ctrl)
+
+	provider := NewLDAPUserProviderWithFactory(
+		schema.LDAPAuthenticationBackend{
+			Address:  testLDAPAddress,
+			User:     "cn=admin,dc=example,dc=com",
+			Password: "password",
+			Attributes: schema.LDAPAuthenticationAttributes{
+				Username:    "uid",
+				Mail:        "mail",
+				DisplayName: "displayName",
+				MemberOf:    "memberOf",
+			},
+			UsersFilter:       "uid={input}",
+			AdditionalUsersDN: "ou=users",
+			BaseDN:            "dc=example,dc=com",
+		},
+		false,
+		nil,
+		mockFactory)
+
+	gomock.InOrder(
+		mockFactory.EXPECT().
+			DialURL(gomock.Eq("ldap://127.0.0.1:389"), gomock.Any()).
+			Return(mockClient, nil),
+		mockClient.EXPECT().
+			Bind(gomock.Eq("cn=admin,dc=example,dc=com"), gomock.Eq("password")).
+			Return(nil),
+		mockClient.EXPECT().
+			Search(gomock.Any()).
+			Return(nil, &ldap.Error{ResultCode: ldap.LDAPResultBusy, Err: errors.New("directory server busy")}),
+		mockClient.EXPECT().Close(),
+	)
+
+	valid, err := provider.CheckUserPassword("john", "password")
+
+	assert.False(t, valid)
+	assert.EqualError(t, err, "cannot find user DN of user 'john'. Cause: LDAP Result Code 51 \"Busy\": directory server busy")
+}
+
 func TestShouldCheckInvalidUserPassword(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()
@@ -4551,7 +5247,7 @@ func TestShouldParseDynamicConfiguration(t *testing.T) {
 				DisplayName: "displayName",
 				MemberOf:    "memberOf",
 			},
-			UsersFilter:        "(&(|({username_attribute}={input})({mail_attribute}={input}))(sAMAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(!(pwdLastSet=0))(|(!(accountExpires=*))(accountExpires=0)(accountExpires>={date-time:microsoft-nt})(accountExpires>={date-time:generalized})))",
+			UsersFilter:        "(&(|({username_attribute}={input})({mail_attribute}={input}))(sAMAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(!(pwdLastSet=0))(|(!(accountExpires=*))(accountExpires=0)(accountExpiresM>={date-time:microsoft-nt})(accountExpiresU>={date-time:unix})(accountExpiresG>={date-time:generalized})))",
 			GroupsFilter:       "(&(|(member={dn})(member={input})(member={username}))(objectClass=group))",
 			AdditionalUsersDN:  "ou=users",
 			AdditionalGroupsDN: "ou=groups",
@@ -4576,12 +5272,12 @@ func TestShouldParseDynamicConfiguration(t *testing.T) {
 	assert.True(t, provider.usersFilterReplacementDateTimeGeneralized)
 	assert.True(t, provider.usersFilterReplacementDateTimeMicrosoftNTTimeEpoch)
 
-	assert.Equal(t, "(&(|(uid={input})(mail={input}))(sAMAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(!(pwdLastSet=0))(|(!(accountExpires=*))(accountExpires=0)(accountExpires>={date-time:microsoft-nt})(accountExpires>={date-time:generalized})))", provider.config.UsersFilter)
+	assert.Equal(t, "(&(|(uid={input})(mail={input}))(sAMAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(!(pwdLastSet=0))(|(!(accountExpires=*))(accountExpires=0)(accountExpiresM>={date-time:microsoft-nt})(accountExpiresU>={date-time:unix})(accountExpiresG>={date-time:generalized})))", provider.config.UsersFilter)
 	assert.Equal(t, "(&(|(member={dn})(member={input})(member={username}))(objectClass=group))", provider.config.GroupsFilter)
 	assert.Equal(t, "ou=users,dc=example,dc=com", provider.usersBaseDN)
 	assert.Equal(t, "ou=groups,dc=example,dc=com", provider.groupsBaseDN)
 
-	assert.Equal(t, "(&(|(uid=test@example.com)(mail=test@example.com))(sAMAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(!(pwdLastSet=0))(|(!(accountExpires=*))(accountExpires=0)(accountExpires>=133147241190000000)(accountExpires>=20221205142839.0Z)))", provider.resolveUsersFilter("test@example.com", false))
+	assert.Equal(t, "(&(|(uid=test@example.com)(mail=test@example.com))(sAMAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(!(pwdLastSet=0))(|(!(accountExpires=*))(accountExpires=0)(accountExpiresM>=133147241190000000)(accountExpiresU>=1670250519)(accountExpiresG>=20221205142839.0Z)))", provider.resolveUsersFilter("test@example.com"))
 	assert.Equal(t, "(&(|(member=cn=admin,dc=example,dc=com)(member=test@example.com)(member=test))(objectClass=group))", provider.resolveGroupsFilter("test@example.com", &ldapUserProfile{Username: "test", DN: "cn=admin,dc=example,dc=com"}))
 }
 

internal/authentication/ldap_util.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 
 	ber "github.com/go-asn1-ber/asn1-ber"
-	"github.com/go-ldap/ldap/v3"
+	ldap "github.com/go-ldap/ldap/v3"
 )
 
 func ldapEntriesContainsEntry(needle *ldap.Entry, haystack []*ldap.Entry) bool {
@@ -67,12 +67,12 @@ func ldapEscape(inputUsername string) string {
 }
 
 func ldapGetReferral(err error) (referral string, ok bool) {
-	if !ldap.IsErrorWithCode(err, ldap.LDAPResultReferral) {
-		return "", false
-	}
-
 	switch e := err.(type) {
 	case *ldap.Error:
+		if e.ResultCode != ldap.LDAPResultReferral {
+			return "", false
+		}
+
 		if e.Packet == nil {
 			return "", false
 		}

internal/authentication/ldap_util_test.go

@@ -193,6 +193,12 @@ func TestLDAPGetReferral(t *testing.T) {
 			expectedReferral: "",
 			expectedOK:       false,
 		},
+		{
+			description:      "ShouldNotGetInvalidErrType",
+			have:             errors.New("not an err"),
+			expectedReferral: "",
+			expectedOK:       false,
+		},
 	}
 
 	for _, tc := range testCases {

internal/authentication/types.go

@@ -6,7 +6,6 @@ import (
 	"time"
 
 	"github.com/go-ldap/ldap/v3"
-	"golang.org/x/text/encoding/unicode"
 )
 
 // LDAPClientFactory an interface of factory of LDAP clients.
@@ -104,4 +103,30 @@ type LDAPSupportedControlTypes struct {
 	MsftPwdPolHintsDeprecated bool
 }
 
-var utf16LittleEndian = unicode.UTF16(unicode.LittleEndian, unicode.IgnoreBOM)
+// Level is the type representing a level of authentication.
+type Level int
+
+const (
+	// NotAuthenticated if the user is not authenticated yet.
+	NotAuthenticated Level = iota
+
+	// OneFactor if the user has passed first factor only.
+	OneFactor
+
+	// TwoFactor if the user has passed two factors.
+	TwoFactor
+)
+
+// String returns a string representation of an authentication.Level.
+func (l Level) String() string {
+	switch l {
+	case NotAuthenticated:
+		return "not_authenticated"
+	case OneFactor:
+		return "one_factor"
+	case TwoFactor:
+		return "two_factor"
+	default:
+		return "invalid"
+	}
+}

internal/authentication/types_test.go

@@ -0,0 +1,42 @@
+package authentication
+
+import (
+	"net/mail"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestUserDetails_Addresses(t *testing.T) {
+	details := &UserDetails{}
+
+	assert.Equal(t, []mail.Address(nil), details.Addresses())
+
+	details = &UserDetails{
+		DisplayName: "Example",
+		Emails:      []string{"abc@123.com"},
+	}
+
+	assert.Equal(t, []mail.Address{{Name: "Example", Address: "abc@123.com"}}, details.Addresses())
+
+	details = &UserDetails{
+		DisplayName: "Example",
+		Emails:      []string{"abc@123.com", "two@apple.com"},
+	}
+
+	assert.Equal(t, []mail.Address{{Name: "Example", Address: "abc@123.com"}, {Name: "Example", Address: "two@apple.com"}}, details.Addresses())
+
+	details = &UserDetails{
+		DisplayName: "",
+		Emails:      []string{"abc@123.com"},
+	}
+
+	assert.Equal(t, []mail.Address{{Address: "abc@123.com"}}, details.Addresses())
+}
+
+func TestLevel_String(t *testing.T) {
+	assert.Equal(t, "one_factor", OneFactor.String())
+	assert.Equal(t, "two_factor", TwoFactor.String())
+	assert.Equal(t, "not_authenticated", NotAuthenticated.String())
+	assert.Equal(t, "invalid", Level(-1).String())
+}

internal/authentication/util.go

@@ -1,15 +0,0 @@
-package authentication
-
-// String returns a string representation of an authentication.Level.
-func (l Level) String() string {
-	switch l {
-	case NotAuthenticated:
-		return "not_authenticated"
-	case OneFactor:
-		return "one_factor"
-	case TwoFactor:
-		return "two_factor"
-	default:
-		return "invalid"
-	}
-}

internal/authorization/access_control_domain.go

@@ -66,13 +66,13 @@ func (m AccessControlDomainMatcher) IsMatch(domain string, subject Subject) (mat
 		return strings.HasSuffix(domain, m.Name)
 	case m.UserWildcard:
 		if subject.IsAnonymous() && strings.HasSuffix(domain, m.Name) {
-			return true
+			return len(domain) > len(m.Name)
 		}
 
 		return domain == fmt.Sprintf("%s%s", subject.Username, m.Name)
 	case m.GroupWildcard:
 		if subject.IsAnonymous() && strings.HasSuffix(domain, m.Name) {
-			return true
+			return len(domain) > len(m.Name)
 		}
 
 		i := strings.Index(domain, ".")

internal/authorization/access_control_domain_test.go

@@ -0,0 +1,64 @@
+package authorization
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestAccessControlDomain_IsMatch(t *testing.T) {
+	testCases := []struct {
+		name     string
+		have     *AccessControlDomainMatcher
+		domain   string
+		subject  Subject
+		expected bool
+	}{
+		{
+			"ShouldMatchDomainSuffixUserWildcard",
+			&AccessControlDomainMatcher{
+				Name:         "-user.domain.com",
+				UserWildcard: true,
+			},
+			"a-user.domain.com",
+			Subject{},
+			true,
+		},
+		{
+			"ShouldMatchDomainSuffixGroupWildcard",
+			&AccessControlDomainMatcher{
+				Name:          "-group.domain.com",
+				GroupWildcard: true,
+			},
+			"a-group.domain.com",
+			Subject{},
+			true,
+		},
+		{
+			"ShouldNotMatchExactDomainWithUserWildcard",
+			&AccessControlDomainMatcher{
+				Name:         "-user.domain.com",
+				UserWildcard: true,
+			},
+			"-user.domain.com",
+			Subject{},
+			false,
+		},
+		{
+			"ShouldMatchWildcard",
+			&AccessControlDomainMatcher{
+				Name:     "user.domain.com",
+				Wildcard: true,
+			},
+			"abc.user.domain.com",
+			Subject{},
+			true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.expected, tc.have.IsMatch(tc.domain, tc.subject))
+		})
+	}
+}

internal/authorization/access_control_query_test.go

@@ -0,0 +1,62 @@
+package authorization
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/authelia/authelia/v4/internal/configuration/schema"
+)
+
+func TestNewAccessControlQuery(t *testing.T) {
+	testCases := []struct {
+		name     string
+		have     [][]schema.ACLQueryRule
+		expected []AccessControlQuery
+		matches  [][]Object
+	}{
+		{
+			"ShouldSkipInvalidTypeEqual",
+			[][]schema.ACLQueryRule{
+				{
+					{Operator: operatorEqual, Key: "example", Value: 1},
+				},
+			},
+			[]AccessControlQuery{{Rules: []ObjectMatcher(nil)}},
+			[][]Object{{{}}},
+		},
+		{
+			"ShouldSkipInvalidTypePattern",
+			[][]schema.ACLQueryRule{
+				{
+					{Operator: operatorPattern, Key: "example", Value: 1},
+				},
+			},
+			[]AccessControlQuery{{Rules: []ObjectMatcher(nil)}},
+			[][]Object{{{}}},
+		},
+		{
+			"ShouldSkipInvalidOperator",
+			[][]schema.ACLQueryRule{
+				{
+					{Operator: "nop", Key: "example", Value: 1},
+				},
+			},
+			[]AccessControlQuery{{Rules: []ObjectMatcher(nil)}},
+			[][]Object{{{}}},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			actual := NewAccessControlQuery(tc.have)
+			assert.Equal(t, tc.expected, actual)
+
+			for i, rule := range actual {
+				for _, object := range tc.matches[i] {
+					assert.True(t, rule.IsMatch(object))
+				}
+			}
+		})
+	}
+}

internal/authorization/access_control_rule_test.go

@@ -0,0 +1,33 @@
+package authorization
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestAccessControlRule_MatchesSubjectExact(t *testing.T) {
+	testCases := []struct {
+		name     string
+		have     *AccessControlRule
+		subject  Subject
+		expected bool
+	}{
+		{
+			"ShouldNotMatchAnonymous",
+			&AccessControlRule{
+				Subjects: []AccessControlSubjects{
+					{[]SubjectMatcher{schemaSubjectToACLSubject("user:john")}},
+				},
+			},
+			Subject{},
+			false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.expected, tc.have.MatchesSubjectExact(tc.subject))
+		})
+	}
+}