1441 lines
63 KiB
YAML
1441 lines
63 KiB
YAML
# yamllint disable rule:comments-indentation
|
|
---
|
|
###############################################################################
|
|
# Authelia Configuration #
|
|
###############################################################################
|
|
|
|
##
|
|
## Notes:
|
|
##
|
|
## - the default location of this file is assumed to be configuration.yml unless otherwise noted
|
|
## - when using docker the container expects this by default to be at /config/configuration.yml
|
|
## - the default location where this file is loaded from can be overridden with the X_AUTHELIA_CONFIG environment var
|
|
## - the comments in this configuration file are helpful but users should consult the official documentation on the
|
|
## website at https://www.authelia.com/ or https://www.authelia.com/configuration/prologue/introduction/
|
|
## - this configuration file template is not automatically updated
|
|
##
|
|
|
|
## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to
|
|
## the system certificates store.
|
|
## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem.
|
|
# certificates_directory: '/config/certificates/'
|
|
|
|
## The theme to display: light, dark, grey, auto.
|
|
theme: 'light'
|
|
|
|
## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be
|
|
## set using a secret: https://www.authelia.com/c/secrets
|
|
jwt_secret: 'a_very_important_secret'
|
|
|
|
## Default redirection URL
|
|
##
|
|
## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end
|
|
## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use
|
|
## in such a case.
|
|
##
|
|
## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
|
|
default_redirection_url: 'https://home.example.com/'
|
|
|
|
## Set the default 2FA method for new users and for when a user has a preferred method configured that has been
|
|
## disabled. This setting must be a method that is enabled.
|
|
## Options are totp, webauthn, mobile_push.
|
|
default_2fa_method: ''
|
|
|
|
##
|
|
## Server Configuration
|
|
##
|
|
server:
|
|
## The address for the Main server to listen on in the address common syntax.
|
|
## Formats:
|
|
## - [<scheme>://]<hostname>[:<port>]
|
|
## - [<scheme>://][hostname]:<port>
|
|
## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'.
|
|
## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9091'.
|
|
address: 'tcp://:9091'
|
|
|
|
## Set the single level path Authelia listens on.
|
|
## Must be alphanumeric chars and should not contain any slashes.
|
|
path: ''
|
|
|
|
## Set the path on disk to Authelia assets.
|
|
## Useful to allow overriding of specific static assets.
|
|
# asset_path: '/config/assets/'
|
|
|
|
## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0.
|
|
## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist.
|
|
disable_healthcheck: false
|
|
|
|
## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour.
|
|
tls:
|
|
## The path to the DER base64/PEM format private key.
|
|
key: ''
|
|
|
|
## The path to the DER base64/PEM format public certificate.
|
|
certificate: ''
|
|
|
|
## The list of certificates for client authentication.
|
|
client_certificates: []
|
|
|
|
## Server headers configuration/customization.
|
|
headers:
|
|
|
|
## The CSP Template. Read the docs.
|
|
csp_template: ''
|
|
|
|
## Server Buffers configuration.
|
|
# buffers:
|
|
|
|
## Buffers usually should be configured to be the same value.
|
|
## Explanation at https://www.authelia.com/c/server#buffer-sizes
|
|
## Read buffer size adjusts the server's max incoming request size in bytes.
|
|
## Write buffer size does the same for outgoing responses.
|
|
|
|
## Read buffer.
|
|
# read: 4096
|
|
|
|
## Write buffer.
|
|
# write: 4096
|
|
|
|
## Server Timeouts configuration.
|
|
# timeouts:
|
|
|
|
## Read timeout in the duration common syntax.
|
|
# read: '6s'
|
|
|
|
## Write timeout in the duration common syntax.
|
|
# write: '6s'
|
|
|
|
## Idle timeout in the duration common syntax.
|
|
# idle: '30s'
|
|
|
|
## Server Endpoints configuration.
|
|
## This section is considered advanced and it SHOULD NOT be configured unless you've read the relevant documentation.
|
|
# endpoints:
|
|
## Enables the pprof endpoint.
|
|
# enable_pprof: false
|
|
|
|
## Enables the expvars endpoint.
|
|
# enable_expvars: false
|
|
|
|
## Configure the authz endpoints.
|
|
# authz:
|
|
# forward-auth:
|
|
# implementation: 'ForwardAuth'
|
|
# authn_strategies: []
|
|
# ext-authz:
|
|
# implementation: 'ExtAuthz'
|
|
# authn_strategies: []
|
|
# auth-request:
|
|
# implementation: 'AuthRequest'
|
|
# authn_strategies: []
|
|
# legacy:
|
|
# implementation: 'Legacy'
|
|
# authn_strategies: []
|
|
|
|
##
|
|
## Log Configuration
|
|
##
|
|
log:
|
|
## Level of verbosity for logs: info, debug, trace.
|
|
level: 'debug'
|
|
|
|
## Format the logs are written as: json, text.
|
|
# format: 'json'
|
|
|
|
## File path where the logs will be written. If not set logs are written to stdout.
|
|
# file_path: '/config/authelia.log'
|
|
|
|
## Whether to also log to stdout when a log_file_path is defined.
|
|
# keep_stdout: false
|
|
|
|
##
|
|
## Telemetry Configuration
|
|
##
|
|
telemetry:
|
|
|
|
##
|
|
## Metrics Configuration
|
|
##
|
|
metrics:
|
|
## Enable Metrics.
|
|
enabled: false
|
|
|
|
## The address for the Metrics server to listen on in the address common syntax.
|
|
## Formats:
|
|
## - [<scheme>://]<hostname>[:<port>]
|
|
## - [<scheme>://][hostname]:<port>
|
|
## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'.
|
|
## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9959'.
|
|
address: 'tcp://:9959'
|
|
|
|
## Metrics Server Buffers configuration.
|
|
# buffers:
|
|
|
|
## Read buffer.
|
|
# read: 4096
|
|
|
|
## Write buffer.
|
|
# write: 4096
|
|
|
|
## Metrics Server Timeouts configuration.
|
|
# timeouts:
|
|
|
|
## Read timeout in the duration common syntax.
|
|
# read: '6s'
|
|
|
|
## Write timeout in the duration common syntax.
|
|
# write: '6s'
|
|
|
|
## Idle timeout in the duration common syntax.
|
|
# idle: '30s'
|
|
|
|
##
|
|
## TOTP Configuration
|
|
##
|
|
## Parameters used for TOTP generation.
|
|
totp:
|
|
## Disable TOTP.
|
|
disable: false
|
|
|
|
## The issuer name displayed in the Authenticator application of your choice.
|
|
issuer: 'authelia.com'
|
|
|
|
## The TOTP algorithm to use.
|
|
## It is CRITICAL you read the documentation before changing this option:
|
|
## https://www.authelia.com/c/totp#algorithm
|
|
algorithm: 'sha1'
|
|
|
|
## The number of digits a user has to input. Must either be 6 or 8.
|
|
## Changing this option only affects newly generated TOTP configurations.
|
|
## It is CRITICAL you read the documentation before changing this option:
|
|
## https://www.authelia.com/c/totp#digits
|
|
digits: 6
|
|
|
|
## The period in seconds a one-time password is valid for.
|
|
## Changing this option only affects newly generated TOTP configurations.
|
|
period: 30
|
|
|
|
## The skew controls number of one-time passwords either side of the current one that are valid.
|
|
## Warning: before changing skew read the docs link below.
|
|
skew: 1
|
|
## See: https://www.authelia.com/c/totp#input-validation to read
|
|
## the documentation.
|
|
|
|
## The size of the generated shared secrets. Default is 32 and is sufficient in most use cases, minimum is 20.
|
|
secret_size: 32
|
|
|
|
##
|
|
## WebAuthn Configuration
|
|
##
|
|
## Parameters used for WebAuthn.
|
|
webauthn:
|
|
## Disable WebAuthn.
|
|
disable: false
|
|
|
|
## The interaction timeout for WebAuthn dialogues in the duration common syntax.
|
|
timeout: '60s'
|
|
|
|
## The display name the browser should show the user for when using WebAuthn to login/register.
|
|
display_name: 'Authelia'
|
|
|
|
## Conveyance preference controls if we collect the attestation statement including the AAGUID from the device.
|
|
## Options are none, indirect, direct.
|
|
attestation_conveyance_preference: 'indirect'
|
|
|
|
## User verification controls if the user must make a gesture or action to confirm they are present.
|
|
## Options are required, preferred, discouraged.
|
|
user_verification: 'preferred'
|
|
|
|
##
|
|
## Duo Push API Configuration
|
|
##
|
|
## Parameters used to contact the Duo API. Those are generated when you protect an application of type
|
|
## "Partner Auth API" in the management panel.
|
|
# duo_api:
|
|
# disable: false
|
|
# hostname: 'api-123456789.example.com'
|
|
# integration_key: 'ABCDEF'
|
|
## Secret can also be set using a secret: https://www.authelia.com/c/secrets
|
|
# secret_key: '1234567890abcdefghifjkl'
|
|
# enable_self_enrollment: false
|
|
|
|
##
|
|
## NTP Configuration
|
|
##
|
|
## This is used to validate the servers time is accurate enough to validate TOTP.
|
|
ntp:
|
|
## The address of the NTP server to connect to in the address common syntax.
|
|
## Format: [<scheme>://]<hostname>[:<port>].
|
|
## Square brackets indicate optional portions of the format. Scheme must be 'udp', 'udp4', or 'udp6'.
|
|
## The default scheme is 'udp'. The default port is '123'.
|
|
address: 'udp://time.cloudflare.com:123'
|
|
|
|
## NTP version.
|
|
version: 4
|
|
|
|
## Maximum allowed time offset between the host and the NTP server in the duration common syntax.
|
|
max_desync: '3s'
|
|
|
|
## Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you
|
|
## set this to true, and can operate in a truly offline mode.
|
|
disable_startup_check: false
|
|
|
|
## The default of false will prevent startup only if we can contact the NTP server and the time is out of sync with
|
|
## the NTP server more than the configured max_desync. If you set this to true, an error will be logged but startup
|
|
## will continue regardless of results.
|
|
disable_failure: false
|
|
|
|
##
|
|
## Authentication Backend Provider Configuration
|
|
##
|
|
## Used for verifying user passwords and retrieve information such as email address and groups users belong to.
|
|
##
|
|
## The available providers are: `file`, `ldap`. You must use only one of these providers.
|
|
authentication_backend:
|
|
|
|
## Password Reset Options.
|
|
password_reset:
|
|
## Disable both the HTML element and the API for reset password functionality.
|
|
disable: false
|
|
|
|
## External reset password url that redirects the user to an external reset portal. This disables the internal reset
|
|
## functionality.
|
|
custom_url: ''
|
|
|
|
## The amount of time to wait before we refresh data from the authentication backend in the duration common syntax.
|
|
## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
|
|
## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
|
|
## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
|
|
## See the below documentation for more information.
|
|
## Refresh Interval docs: https://www.authelia.com/c/1fa#refresh-interval
|
|
refresh_interval: '5m'
|
|
|
|
##
|
|
## LDAP (Authentication Provider)
|
|
##
|
|
## This is the recommended Authentication Provider in production
|
|
## because it allows Authelia to offload the stateful operations
|
|
## onto the LDAP service.
|
|
# ldap:
|
|
## The address of the LDAP server to connect to in the address common syntax.
|
|
## Format: [<scheme>://]<hostname>[:<port>].
|
|
## Square brackets indicate optional portions of the format. Scheme must be 'ldap', 'ldaps', or 'ldapi`.
|
|
## The default scheme is 'ldapi' if the address is an absolute path otherwise it's 'ldaps'.
|
|
## The default port is '636', unless the scheme is 'ldap' in which case it's '389'.
|
|
# address: 'ldaps://127.0.0.1:636'
|
|
|
|
## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
|
|
## Acceptable options are as follows:
|
|
## - 'activedirectory' - for Microsoft Active Directory.
|
|
## - 'freeipa' - for FreeIPA.
|
|
## - 'lldap' - for lldap.
|
|
## - 'custom' - for custom specifications of attributes and filters.
|
|
## This currently defaults to 'custom' to maintain existing behaviour.
|
|
##
|
|
## Depending on the option here certain other values in this section have a default value, notably all of the
|
|
## attribute mappings have a default value that this config overrides, you can read more about these default values
|
|
## at https://www.authelia.com/c/ldap#defaults
|
|
# implementation: 'custom'
|
|
|
|
## The dial timeout for LDAP in the duration common syntax.
|
|
# timeout: '5s'
|
|
|
|
## Use StartTLS with the LDAP connection.
|
|
# start_tls: false
|
|
|
|
# tls:
|
|
## The server subject name to check the servers certificate against during the validation process.
|
|
## This option is not required if the certificate has a SAN which matches the address options hostname.
|
|
# server_name: 'ldap.example.com'
|
|
|
|
## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
|
|
## certificate or the certificate of the authority signing the certificate to the certificates directory which is
|
|
## defined by the `certificates_directory` option at the top of the configuration.
|
|
## It's important to note the public key should be added to the directory, not the private key.
|
|
## This option is strongly discouraged but may be useful in some self-signed situations where validation is not
|
|
## important to the administrator.
|
|
# skip_verify: false
|
|
|
|
## Minimum TLS version for the connection.
|
|
# minimum_version: 'TLS1.2'
|
|
|
|
## Maximum TLS version for the connection.
|
|
# maximum_version: 'TLS1.3'
|
|
|
|
## The certificate chain used with the private_key if the server requests TLS Client Authentication
|
|
## i.e. Mutual TLS.
|
|
# certificate_chain: |
|
|
# -----BEGIN CERTIFICATE-----
|
|
# MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT
|
|
# MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3
|
|
# NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
|
|
# AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00
|
|
# z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud
|
|
# JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8
|
|
# Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx
|
|
# 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE=
|
|
# -----END CERTIFICATE-----
|
|
# -----BEGIN CERTIFICATE-----
|
|
# MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT
|
|
# MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3
|
|
# NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
|
|
# AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00
|
|
# z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud
|
|
# JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8
|
|
# Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx
|
|
# 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE=
|
|
# -----END CERTIFICATE-----
|
|
|
|
## The private key used with the certificate_chain if the server requests TLS Client Authentication
|
|
## i.e. Mutual TLS.
|
|
# private_key: |
|
|
# -----BEGIN RSA PRIVATE KEY-----
|
|
# MIIBPAIBAAJBAK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZF
|
|
# p7aTcToHMf00z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAQJBAJdpB0+RQ9ZFwy9Uk38P
|
|
# 5zZpUB8cL8ZFeEFluQeVbt0vyNa+cPLvDLouY87onduXtMz5AKIatLaTOjuG2thh
|
|
# SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH
|
|
# ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg
|
|
# 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg
|
|
# HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE=
|
|
# -----END RSA PRIVATE KEY-----
|
|
|
|
## The distinguished name of the container searched for objects in the directory information tree.
|
|
## See also: additional_users_dn, additional_groups_dn.
|
|
# base_dn: 'dc=example,dc=com'
|
|
|
|
## The attribute holding the username of the user. This attribute is used to populate the username in the session
|
|
## information. For your information, Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually
|
|
## uses 'uid'. Beware that this attribute holds the unique identifiers for the users binding the user and the
|
|
## configuration stored in database. Therefore only single value attributes are allowed and the value must never be
|
|
## changed once attributed to a user otherwise it would break the configuration for that user. Technically,
|
|
## non-unique attributes like 'mail' can also be used but we don't recommend using them, we instead advise to use
|
|
## a filter to perform alternative lookups and the attributes mentioned above (sAMAccountName and uid) to
|
|
## follow https://datatracker.ietf.org/doc/html/rfc2307.
|
|
# username_attribute: 'uid'
|
|
|
|
## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users.
|
|
## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users.
|
|
# additional_users_dn: 'ou=users'
|
|
|
|
## The users filter used in search queries to find the user profile based on input filled in login form.
|
|
## Various placeholders are available in the user filter which you can read about in the documentation which can
|
|
## be found at: https://www.authelia.com/c/ldap#users-filter-replacements
|
|
##
|
|
## Recommended settings are as follows:
|
|
## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
|
|
## - OpenLDAP:
|
|
## - (&({username_attribute}={input})(objectClass=person))
|
|
## - (&({username_attribute}={input})(objectClass=inetOrgPerson))
|
|
##
|
|
## To allow sign in both with username and email, one can use a filter like
|
|
## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
|
|
# users_filter: '(&({username_attribute}={input})(objectClass=person))'
|
|
|
|
## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups.
|
|
## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups.
|
|
# additional_groups_dn: 'ou=groups'
|
|
|
|
## The groups filter used in search queries to find the groups based on relevant authenticated user.
|
|
## Various placeholders are available in the groups filter which you can read about in the documentation which can
|
|
## be found at: https://www.authelia.com/c/ldap#groups-filter-replacements
|
|
##
|
|
## If your groups use the `groupOfUniqueNames` structure use this instead:
|
|
## (&(uniqueMember={dn})(objectClass=groupOfUniqueNames))
|
|
# groups_filter: '(&(member={dn})(objectClass=groupOfNames))'
|
|
|
|
## The attribute holding the name of the group.
|
|
# group_name_attribute: 'cn'
|
|
|
|
## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
|
|
## first one returned by the LDAP server is used.
|
|
# mail_attribute: 'mail'
|
|
|
|
## The attribute holding the display name of the user. This will be used to greet an authenticated user.
|
|
# display_name_attribute: 'displayName'
|
|
|
|
## Follow referrals returned by the server.
|
|
## This is especially useful for environments where read-only servers exist. Only implemented for write operations.
|
|
# permit_referrals: false
|
|
|
|
## The username and password of the admin user.
|
|
# user: 'cn=admin,dc=example,dc=com'
|
|
## Password can also be set using a secret: https://www.authelia.com/c/secrets
|
|
# password: 'password'
|
|
|
|
##
|
|
## File (Authentication Provider)
|
|
##
|
|
## With this backend, the users database is stored in a file which is updated when users reset their passwords.
|
|
## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia
|
|
## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security
|
|
## implications it is highly recommended you leave the default values. Before considering changing these settings
|
|
## please read the docs page below:
|
|
## https://www.authelia.com/r/passwords#tuning
|
|
##
|
|
## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
|
|
##
|
|
# file:
|
|
# path: '/config/users_database.yml'
|
|
# watch: false
|
|
# search:
|
|
# email: false
|
|
# case_insensitive: false
|
|
# password:
|
|
# algorithm: 'argon2'
|
|
# argon2:
|
|
# variant: 'argon2id'
|
|
# iterations: 3
|
|
# memory: 65536
|
|
# parallelism: 4
|
|
# key_length: 32
|
|
# salt_length: 16
|
|
# scrypt:
|
|
# iterations: 16
|
|
# block_size: 8
|
|
# parallelism: 1
|
|
# key_length: 32
|
|
# salt_length: 16
|
|
# pbkdf2:
|
|
# variant: 'sha512'
|
|
# iterations: 310000
|
|
# salt_length: 16
|
|
# sha2crypt:
|
|
# variant: 'sha512'
|
|
# iterations: 50000
|
|
# salt_length: 16
|
|
# bcrypt:
|
|
# variant: 'standard'
|
|
# cost: 12
|
|
|
|
##
|
|
## Password Policy Configuration.
|
|
##
|
|
password_policy:
|
|
|
|
## The standard policy allows you to tune individual settings manually.
|
|
standard:
|
|
enabled: false
|
|
|
|
## Require a minimum length for passwords.
|
|
min_length: 8
|
|
|
|
## Require a maximum length for passwords.
|
|
max_length: 0
|
|
|
|
## Require uppercase characters.
|
|
require_uppercase: true
|
|
|
|
## Require lowercase characters.
|
|
require_lowercase: true
|
|
|
|
## Require numeric characters.
|
|
require_number: true
|
|
|
|
## Require special characters.
|
|
require_special: true
|
|
|
|
## zxcvbn is a well known and used password strength algorithm. It does not have tunable settings.
|
|
zxcvbn:
|
|
enabled: false
|
|
|
|
## Configures the minimum score allowed.
|
|
min_score: 3
|
|
|
|
##
|
|
## Privacy Policy Configuration
|
|
##
|
|
## Parameters used for displaying the privacy policy link and drawer.
|
|
privacy_policy:
|
|
|
|
## Enables the display of the privacy policy using the policy_url.
|
|
enabled: false
|
|
|
|
## Enables the display of the privacy policy drawer which requires users accept the privacy policy
|
|
## on a per-browser basis.
|
|
require_user_acceptance: false
|
|
|
|
## The URL of the privacy policy document. Must be an absolute URL and must have the 'https://' scheme.
|
|
## If the privacy policy enabled option is true, this MUST be provided.
|
|
policy_url: ''
|
|
|
|
##
|
|
## Access Control Configuration
|
|
##
|
|
## Access control is a list of rules defining the authorizations applied for one resource to users or group of users.
|
|
##
|
|
## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed
|
|
## to anyone. Otherwise restrictions follow the rules defined.
|
|
##
|
|
## Note: One can use the wildcard * to match any subdomain.
|
|
## It must stand at the beginning of the pattern. (example: *.example.com)
|
|
##
|
|
## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct.
|
|
##
|
|
## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'.
|
|
##
|
|
## - 'domain' defines which domain or set of domains the rule applies to.
|
|
##
|
|
## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not
|
|
## provided. If provided, the parameter represents either a user or a group. It should be of the form
|
|
## 'user:<username>' or 'group:<groupname>'.
|
|
##
|
|
## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'.
|
|
##
|
|
## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter
|
|
## is optional and matches any resource if not provided.
|
|
##
|
|
## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.
|
|
access_control:
|
|
## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
|
|
## resource if there is no policy to be applied to the user.
|
|
default_policy: 'deny'
|
|
|
|
# networks:
|
|
# - name: 'internal'
|
|
# networks:
|
|
# - '10.10.0.0/16'
|
|
# - '192.168.2.0/24'
|
|
# - name: 'VPN'
|
|
# networks: '10.9.0.0/16'
|
|
|
|
# rules:
|
|
## Rules applied to everyone
|
|
# - domain: 'public.example.com'
|
|
# policy: 'bypass'
|
|
|
|
## Domain Regex examples. Generally we recommend just using a standard domain.
|
|
# - domain_regex: '^(?P<User>\w+)\.example\.com$'
|
|
# policy: 'one_factor'
|
|
# - domain_regex: '^(?P<Group>\w+)\.example\.com$'
|
|
# policy: 'one_factor'
|
|
# - domain_regex:
|
|
# - '^appgroup-.*\.example\.com$'
|
|
# - '^appgroup2-.*\.example\.com$'
|
|
# policy: 'one_factor'
|
|
# - domain_regex: '^.*\.example\.com$'
|
|
# policy: 'two_factor'
|
|
|
|
# - domain: 'secure.example.com'
|
|
# policy: 'one_factor'
|
|
## Network based rule, if not provided any network matches.
|
|
# networks:
|
|
# - 'internal'
|
|
# - 'VPN'
|
|
# - '192.168.1.0/24'
|
|
# - '10.0.0.1'
|
|
|
|
# - domain:
|
|
# - 'secure.example.com'
|
|
# - 'private.example.com'
|
|
# policy: 'two_factor'
|
|
|
|
# - domain: 'singlefactor.example.com'
|
|
# policy: 'one_factor'
|
|
|
|
## Rules applied to 'admins' group
|
|
# - domain: 'mx2.mail.example.com'
|
|
# subject: 'group:admins'
|
|
# policy: 'deny'
|
|
|
|
# - domain: '*.example.com'
|
|
# subject:
|
|
# - 'group:admins'
|
|
# - 'group:moderators'
|
|
# policy: 'two_factor'
|
|
|
|
## Rules applied to 'dev' group
|
|
# - domain: 'dev.example.com'
|
|
# resources:
|
|
# - '^/groups/dev/.*$'
|
|
# subject: 'group:dev'
|
|
# policy: 'two_factor'
|
|
|
|
## Rules applied to user 'john'
|
|
# - domain: 'dev.example.com'
|
|
# resources:
|
|
# - '^/users/john/.*$'
|
|
# subject: 'user:john'
|
|
# policy: 'two_factor'
|
|
|
|
## Rules applied to user 'harry'
|
|
# - domain: 'dev.example.com'
|
|
# resources:
|
|
# - '^/users/harry/.*$'
|
|
# subject: 'user:harry'
|
|
# policy: 'two_factor'
|
|
|
|
## Rules applied to user 'bob'
|
|
# - domain: '*.mail.example.com'
|
|
# subject: 'user:bob'
|
|
# policy: 'two_factor'
|
|
# - domain: 'dev.example.com'
|
|
# resources:
|
|
# - '^/users/bob/.*$'
|
|
# subject: 'user:bob'
|
|
# policy: 'two_factor'
|
|
|
|
##
|
|
## Session Provider Configuration
|
|
##
|
|
## The session cookies identify the user once logged in.
|
|
## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined.
|
|
session:
|
|
## The secret to encrypt the session data. This is only used with Redis / Redis Sentinel.
|
|
## Secret can also be set using a secret: https://www.authelia.com/c/secrets
|
|
secret: 'insecure_session_secret'
|
|
|
|
## Cookies configures the list of allowed cookie domains for sessions to be created on.
|
|
## Undefined values will default to the values below.
|
|
# cookies:
|
|
# -
|
|
## The name of the session cookie.
|
|
# name: 'authelia_session'
|
|
|
|
## The domain to protect.
|
|
## Note: the Authelia portal must also be in that domain.
|
|
# domain: 'example.com'
|
|
|
|
## Optional. The fully qualified URI of the portal to redirect users to on proxies that support redirections.
|
|
## Rules:
|
|
## - MUST use the secure scheme 'https://'
|
|
## - The above domain MUST either:
|
|
## - Match the host portion of this URI.
|
|
## - Match the suffix of the host portion when prefixed with '.'.
|
|
# authelia_url: 'https://auth.example.com'
|
|
|
|
## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
|
|
## Please read https://www.authelia.com/c/session#same_site
|
|
# same_site: 'lax'
|
|
|
|
## The value for inactivity, expiration, and remember_me are in seconds or the duration common syntax.
|
|
## All three of these values affect the cookie/session validity period. Longer periods are considered less secure
|
|
## because a stolen cookie will last longer giving attackers more time to spy or attack.
|
|
|
|
## The inactivity time before the session is reset. If expiration is set to 1h, and this is set to 5m, if the user
|
|
## does not select the remember me option their session will get destroyed after 1h, or after 5m since the last
|
|
## time Authelia detected user activity.
|
|
# inactivity: '5m'
|
|
|
|
## The time before the session cookie expires and the session is destroyed if remember me IS NOT selected by the
|
|
## user.
|
|
# expiration: '1h'
|
|
|
|
## The time before the cookie expires and the session is destroyed if remember me IS selected by the user. Setting
|
|
## this value to -1 disables remember me for this session cookie domain. If allowed and the user uses the remember
|
|
## me checkbox this overrides the expiration option and disables the inactivity option.
|
|
# remember_me: '1M'
|
|
|
|
## Cookie Session Domain default 'name' value.
|
|
name: 'authelia_session'
|
|
|
|
## Cookie Session Domain default 'same_site' value.
|
|
same_site: 'lax'
|
|
|
|
## Cookie Session Domain default 'inactivity' value.
|
|
inactivity: '5m'
|
|
|
|
## Cookie Session Domain default 'expiration' value.
|
|
expiration: '1h'
|
|
|
|
## Cookie Session Domain default 'remember_me' value.
|
|
remember_me: '1M'
|
|
|
|
##
|
|
## Redis Provider
|
|
##
|
|
## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
|
|
##
|
|
# redis:
|
|
# host: '127.0.0.1'
|
|
# port: 6379
|
|
## Use a unix socket instead
|
|
# host: '/var/run/redis/redis.sock'
|
|
|
|
## Username used for redis authentication. This is optional and a new feature in redis 6.0.
|
|
# username: 'authelia'
|
|
|
|
## Password can also be set using a secret: https://www.authelia.com/c/secrets
|
|
# password: 'authelia'
|
|
|
|
## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
|
|
# database_index: 0
|
|
|
|
## The maximum number of concurrent active connections to Redis.
|
|
# maximum_active_connections: 8
|
|
|
|
## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
|
|
# minimum_idle_connections: 0
|
|
|
|
## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).
|
|
# tls:
|
|
## The server subject name to check the servers certificate against during the validation process.
|
|
## This option is not required if the certificate has a SAN which matches the host option.
|
|
# server_name: 'myredis.example.com'
|
|
|
|
## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
|
|
## certificate or the certificate of the authority signing the certificate to the certificates directory which is
|
|
## defined by the `certificates_directory` option at the top of the configuration.
|
|
## It's important to note the public key should be added to the directory, not the private key.
|
|
## This option is strongly discouraged but may be useful in some self-signed situations where validation is not
|
|
## important to the administrator.
|
|
# skip_verify: false
|
|
|
|
## Minimum TLS version for the connection.
|
|
# minimum_version: 'TLS1.2'
|
|
|
|
## Maximum TLS version for the connection.
|
|
# maximum_version: 'TLS1.3'
|
|
|
|
## The certificate chain used with the private_key if the server requests TLS Client Authentication
|
|
## i.e. Mutual TLS.
|
|
# certificate_chain: |
|
|
# -----BEGIN CERTIFICATE-----
|
|
# MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT
|
|
# MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3
|
|
# NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
|
|
# AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00
|
|
# z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud
|
|
# JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8
|
|
# Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx
|
|
# 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE=
|
|
# -----END CERTIFICATE-----
|
|
# -----BEGIN CERTIFICATE-----
|
|
# MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT
|
|
# MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3
|
|
# NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
|
|
# AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00
|
|
# z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud
|
|
# JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8
|
|
# Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx
|
|
# 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE=
|
|
# -----END CERTIFICATE-----
|
|
|
|
## The private key used with the certificate_chain if the server requests TLS Client Authentication
|
|
## i.e. Mutual TLS.
|
|
# private_key: |
|
|
# -----BEGIN RSA PRIVATE KEY-----
|
|
# MIIBPAIBAAJBAK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZF
|
|
# p7aTcToHMf00z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAQJBAJdpB0+RQ9ZFwy9Uk38P
|
|
# 5zZpUB8cL8ZFeEFluQeVbt0vyNa+cPLvDLouY87onduXtMz5AKIatLaTOjuG2thh
|
|
# SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH
|
|
# ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg
|
|
# 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg
|
|
# HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE=
|
|
# -----END RSA PRIVATE KEY-----
|
|
|
|
## The Redis HA configuration options.
|
|
## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
|
|
# high_availability:
|
|
## Sentinel Name / Master Name.
|
|
# sentinel_name: 'mysentinel'
|
|
|
|
## Specific username for Redis Sentinel. The node username and password is configured above.
|
|
# sentinel_username: 'sentinel_specific_user'
|
|
|
|
## Specific password for Redis Sentinel. The node username and password is configured above.
|
|
# sentinel_password: 'sentinel_specific_pass'
|
|
|
|
## The additional nodes to pre-seed the redis provider with (for sentinel).
|
|
## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
|
|
## For high availability to be used you must have either defined; the host above or at least one node below.
|
|
# nodes:
|
|
# - host: 'sentinel-node1'
|
|
# port: 6379
|
|
# - host: 'sentinel-node2'
|
|
# port: 6379
|
|
|
|
## Choose the host with the lowest latency.
|
|
# route_by_latency: false
|
|
|
|
## Choose the host randomly.
|
|
# route_randomly: false
|
|
|
|
##
|
|
## Regulation Configuration
|
|
##
|
|
## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are made
|
|
## in a short period of time.
|
|
regulation:
|
|
## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
|
|
max_retries: 3
|
|
|
|
## The time range during which the user can attempt login before being banned in the duration common syntax. The user
|
|
## is banned if the authentication failed 'max_retries' times in a 'find_time' seconds window.
|
|
find_time: '2m'
|
|
|
|
## The length of time before a banned user can login again in the duration common syntax.
|
|
ban_time: '5m'
|
|
|
|
##
|
|
## Storage Provider Configuration
|
|
##
|
|
## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
|
|
# storage:
|
|
## The encryption key that is used to encrypt sensitive information in the database. Must be a string with a minimum
|
|
## length of 20. Please see the docs if you configure this with an undesirable key and need to change it, you MUST use
|
|
## the CLI to change this in the database if you want to change it from a previously configured value.
|
|
# encryption_key: 'you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this'
|
|
|
|
##
|
|
## Local (Storage Provider)
|
|
##
|
|
## This stores the data in a SQLite3 Database.
|
|
## This is only recommended for lightweight non-stateful installations.
|
|
##
|
|
## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
|
|
##
|
|
# local:
|
|
## Path to the SQLite3 Database.
|
|
# path: '/config/db.sqlite3'
|
|
|
|
##
|
|
## MySQL / MariaDB (Storage Provider)
|
|
##
|
|
# mysql:
|
|
## The address of the MySQL server to connect to in the address common syntax.
|
|
## Format: [<scheme>://]<hostname>[:<port>].
|
|
## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix`.
|
|
## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '3306'.
|
|
# address: 'tcp://127.0.0.1:3306'
|
|
|
|
## The database name to use.
|
|
# database: 'authelia'
|
|
|
|
## The username used for SQL authentication.
|
|
# username: 'authelia'
|
|
|
|
## The password used for SQL authentication.
|
|
## Can also be set using a secret: https://www.authelia.com/c/secrets
|
|
# password: 'mypassword'
|
|
|
|
## The connection timeout in the duration common syntax.
|
|
# timeout: '5s'
|
|
|
|
## MySQL TLS settings. Configuring this requires TLS.
|
|
# tls:
|
|
## The server subject name to check the servers certificate against during the validation process.
|
|
## This option is not required if the certificate has a SAN which matches the address options hostname.
|
|
# server_name: 'mysql.example.com'
|
|
|
|
## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
|
|
## certificate or the certificate of the authority signing the certificate to the certificates directory which is
|
|
## defined by the `certificates_directory` option at the top of the configuration.
|
|
## It's important to note the public key should be added to the directory, not the private key.
|
|
## This option is strongly discouraged but may be useful in some self-signed situations where validation is not
|
|
## important to the administrator.
|
|
# skip_verify: false
|
|
|
|
## Minimum TLS version for the connection.
|
|
# minimum_version: 'TLS1.2'
|
|
|
|
## Maximum TLS version for the connection.
|
|
# maximum_version: 'TLS1.3'
|
|
|
|
## The certificate chain used with the private_key if the server requests TLS Client Authentication
|
|
## i.e. Mutual TLS.
|
|
# certificate_chain: |
|
|
# -----BEGIN CERTIFICATE-----
|
|
# MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT
|
|
# MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3
|
|
# NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
|
|
# AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00
|
|
# z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud
|
|
# JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8
|
|
# Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx
|
|
# 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE=
|
|
# -----END CERTIFICATE-----
|
|
# -----BEGIN CERTIFICATE-----
|
|
# MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT
|
|
# MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3
|
|
# NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
|
|
# AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00
|
|
# z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud
|
|
# JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8
|
|
# Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx
|
|
# 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE=
|
|
# -----END CERTIFICATE-----
|
|
|
|
## The private key used with the certificate_chain if the server requests TLS Client Authentication
|
|
## i.e. Mutual TLS.
|
|
# private_key: |
|
|
# -----BEGIN RSA PRIVATE KEY-----
|
|
# MIIBPAIBAAJBAK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZF
|
|
# p7aTcToHMf00z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAQJBAJdpB0+RQ9ZFwy9Uk38P
|
|
# 5zZpUB8cL8ZFeEFluQeVbt0vyNa+cPLvDLouY87onduXtMz5AKIatLaTOjuG2thh
|
|
# SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH
|
|
# ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg
|
|
# 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg
|
|
# HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE=
|
|
# -----END RSA PRIVATE KEY-----
|
|
|
|
##
|
|
## PostgreSQL (Storage Provider)
|
|
##
|
|
# postgres:
|
|
## The address of the PostgreSQL server to connect to in the address common syntax.
|
|
## Format: [<scheme>://]<hostname>[:<port>].
|
|
## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix`.
|
|
## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '5432'.
|
|
# address: 'tcp://127.0.0.1:5432'
|
|
|
|
## The database name to use.
|
|
# database: 'authelia'
|
|
|
|
## The schema name to use.
|
|
# schema: 'public'
|
|
|
|
## The username used for SQL authentication.
|
|
# username: 'authelia'
|
|
|
|
## The password used for SQL authentication.
|
|
## Can also be set using a secret: https://www.authelia.com/c/secrets
|
|
# password: 'mypassword'
|
|
|
|
## The connection timeout in the duration common syntax.
|
|
# timeout: '5s'
|
|
|
|
## PostgreSQL TLS settings. Configuring this requires TLS.
|
|
# tls:
|
|
## The server subject name to check the servers certificate against during the validation process.
|
|
## This option is not required if the certificate has a SAN which matches the address options hostname.
|
|
# server_name: 'postgres.example.com'
|
|
|
|
## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
|
|
## certificate or the certificate of the authority signing the certificate to the certificates directory which is
|
|
## defined by the `certificates_directory` option at the top of the configuration.
|
|
## It's important to note the public key should be added to the directory, not the private key.
|
|
## This option is strongly discouraged but may be useful in some self-signed situations where validation is not
|
|
## important to the administrator.
|
|
# skip_verify: false
|
|
|
|
## Minimum TLS version for the connection.
|
|
# minimum_version: 'TLS1.2'
|
|
|
|
## Maximum TLS version for the connection.
|
|
# maximum_version: 'TLS1.3'
|
|
|
|
## The certificate chain used with the private_key if the server requests TLS Client Authentication
|
|
## i.e. Mutual TLS.
|
|
# certificate_chain: |
|
|
# -----BEGIN CERTIFICATE-----
|
|
# MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT
|
|
# MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3
|
|
# NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
|
|
# AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00
|
|
# z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud
|
|
# JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8
|
|
# Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx
|
|
# 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE=
|
|
# -----END CERTIFICATE-----
|
|
# -----BEGIN CERTIFICATE-----
|
|
# MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT
|
|
# MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3
|
|
# NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
|
|
# AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00
|
|
# z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud
|
|
# JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8
|
|
# Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx
|
|
# 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE=
|
|
# -----END CERTIFICATE-----
|
|
|
|
## The private key used with the certificate_chain if the server requests TLS Client Authentication
|
|
## i.e. Mutual TLS.
|
|
# private_key: |
|
|
# -----BEGIN RSA PRIVATE KEY-----
|
|
# MIIBPAIBAAJBAK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZF
|
|
# p7aTcToHMf00z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAQJBAJdpB0+RQ9ZFwy9Uk38P
|
|
# 5zZpUB8cL8ZFeEFluQeVbt0vyNa+cPLvDLouY87onduXtMz5AKIatLaTOjuG2thh
|
|
# SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH
|
|
# ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg
|
|
# 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg
|
|
# HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE=
|
|
# -----END RSA PRIVATE KEY-----
|
|
|
|
##
|
|
## Notification Provider
|
|
##
|
|
## Notifications are sent to users when they require a password reset, a WebAuthn registration or a TOTP registration.
|
|
## The available providers are: filesystem, smtp. You must use only one of these providers.
|
|
notifier:
|
|
## You can disable the notifier startup check by setting this to true.
|
|
disable_startup_check: false
|
|
|
|
##
|
|
## File System (Notification Provider)
|
|
##
|
|
## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
|
|
##
|
|
# filesystem:
|
|
# filename: '/config/notification.txt'
|
|
|
|
##
|
|
## SMTP (Notification Provider)
|
|
##
|
|
## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate.
|
|
## [Security] By default Authelia will:
|
|
## - force all SMTP connections over TLS including unauthenticated connections
|
|
## - use the disable_require_tls boolean value to disable this requirement
|
|
## (only works for unauthenticated connections)
|
|
## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates
|
|
## (configure in tls section)
|
|
# smtp:
|
|
## The address of the SMTP server to connect to in the address common syntax.
|
|
# address: 'smtp://127.0.0.1:25'
|
|
|
|
## The connection timeout in the duration common syntax.
|
|
# timeout: '5s'
|
|
|
|
## The username used for SMTP authentication.
|
|
# username: 'test'
|
|
|
|
## The password used for SMTP authentication.
|
|
## Can also be set using a secret: https://www.authelia.com/c/secrets
|
|
# password: 'password'
|
|
|
|
## The sender is used to is used for the MAIL FROM command and the FROM header.
|
|
## If this is not defined and the username is an email, we use the username as this value. This can either be just
|
|
## an email address or the RFC5322 'Name <email address>' format.
|
|
# sender: 'Authelia <admin@example.com>'
|
|
|
|
## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.
|
|
# identifier: 'localhost'
|
|
|
|
## Subject configuration of the emails sent. {title} is replaced by the text from the notifier.
|
|
# subject: '[Authelia] {title}'
|
|
|
|
## This address is used during the startup check to verify the email configuration is correct.
|
|
## It's not important what it is except if your email server only allows local delivery.
|
|
# startup_check_address: 'test@authelia.com'
|
|
|
|
## By default we require some form of TLS. This disables this check though is not advised.
|
|
# disable_require_tls: false
|
|
|
|
## Disables sending HTML formatted emails.
|
|
# disable_html_emails: false
|
|
|
|
# tls:
|
|
## The server subject name to check the servers certificate against during the validation process.
|
|
## This option is not required if the certificate has a SAN which matches the address options hostname.
|
|
# server_name: 'smtp.example.com'
|
|
|
|
## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
|
|
## certificate or the certificate of the authority signing the certificate to the certificates directory which is
|
|
## defined by the `certificates_directory` option at the top of the configuration.
|
|
## It's important to note the public key should be added to the directory, not the private key.
|
|
## This option is strongly discouraged but may be useful in some self-signed situations where validation is not
|
|
## important to the administrator.
|
|
# skip_verify: false
|
|
|
|
## Minimum TLS version for the connection.
|
|
# minimum_version: 'TLS1.2'
|
|
|
|
## Maximum TLS version for the connection.
|
|
# maximum_version: 'TLS1.3'
|
|
|
|
## The certificate chain used with the private_key if the server requests TLS Client Authentication
|
|
## i.e. Mutual TLS.
|
|
# certificate_chain: |
|
|
# -----BEGIN CERTIFICATE-----
|
|
# MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT
|
|
# MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3
|
|
# NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
|
|
# AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00
|
|
# z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud
|
|
# JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8
|
|
# Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx
|
|
# 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE=
|
|
# -----END CERTIFICATE-----
|
|
# -----BEGIN CERTIFICATE-----
|
|
# MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT
|
|
# MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3
|
|
# NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
|
|
# AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00
|
|
# z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud
|
|
# JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8
|
|
# Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx
|
|
# 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE=
|
|
# -----END CERTIFICATE-----
|
|
|
|
## The private key used with the certificate_chain if the server requests TLS Client Authentication
|
|
## i.e. Mutual TLS.
|
|
# private_key: |
|
|
# -----BEGIN RSA PRIVATE KEY-----
|
|
# MIIBPAIBAAJBAK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZF
|
|
# p7aTcToHMf00z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAQJBAJdpB0+RQ9ZFwy9Uk38P
|
|
# 5zZpUB8cL8ZFeEFluQeVbt0vyNa+cPLvDLouY87onduXtMz5AKIatLaTOjuG2thh
|
|
# SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH
|
|
# ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg
|
|
# 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg
|
|
# HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE=
|
|
# -----END RSA PRIVATE KEY-----
|
|
|
|
##
|
|
## Identity Providers
|
|
##
|
|
# identity_providers:
|
|
|
|
##
|
|
## OpenID Connect (Identity Provider)
|
|
##
|
|
## It's recommended you read the documentation before configuration of this section:
|
|
## https://www.authelia.com/c/oidc
|
|
# oidc:
|
|
## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens).
|
|
## HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets
|
|
# hmac_secret: 'this_is_a_secret_abc123abc123abc'
|
|
|
|
## Issuer JWKS configures multiple JSON Web Keys. It's required that at least one of these is RS256 or the
|
|
## option issuer_private_key is configured. There must only be one key per algorithm at this time.
|
|
## For RSA keys the minimum is a 2048 bit key.
|
|
# issuer_private_keys:
|
|
# -
|
|
## Key ID embedded into the JWT header for key matching. Must be an alphanumeric string with 7 or less characters.
|
|
## This value is automatically generated if not provided. It's recommended to not configure this.
|
|
# key_id: 'example'
|
|
|
|
## The key algorithm used with this key.
|
|
# algorithm: 'RS256'
|
|
|
|
## The key use expected with this key. Currently only 'sig' is supported.
|
|
# use: 'sig'
|
|
|
|
## Required Private Key in PEM DER form.
|
|
# key: |
|
|
# -----BEGIN RSA PRIVATE KEY-----
|
|
# MIIBPAIBAAJBAK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZF
|
|
# p7aTcToHMf00z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAQJBAJdpB0+RQ9ZFwy9Uk38P
|
|
# 5zZpUB8cL8ZFeEFluQeVbt0vyNa+cPLvDLouY87onduXtMz5AKIatLaTOjuG2thh
|
|
# SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH
|
|
# ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg
|
|
# 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg
|
|
# HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE=
|
|
# -----END RSA PRIVATE KEY-----
|
|
|
|
|
|
## Optional matching certificate chain in PEM DER form that matches the key. All certificates within the chain
|
|
## must be valid and current, and from top to bottom each certificate must be signed by the subsequent one.
|
|
# certificate_chain: |
|
|
# -----BEGIN CERTIFICATE-----
|
|
# MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT
|
|
# MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3
|
|
# NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
|
|
# AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00
|
|
# z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud
|
|
# JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8
|
|
# Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx
|
|
# 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE=
|
|
# -----END CERTIFICATE-----
|
|
|
|
## The issuer_private_key is used to sign the JWT forged by OpenID Connect. This is in addition to the
|
|
## issuer_private_keys option. Assumed to use the RS256 algorithm, and must not be specified if any of the
|
|
## keys in issuer_private_keys also has the algorithm RS256 or are an RSA key without an algorithm.
|
|
## Issuer Private Key can also be set using a secret: https://www.authelia.com/c/secrets
|
|
# issuer_private_key: |
|
|
# -----BEGIN RSA PRIVATE KEY-----
|
|
# MIIBPAIBAAJBAK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZF
|
|
# p7aTcToHMf00z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAQJBAJdpB0+RQ9ZFwy9Uk38P
|
|
# 5zZpUB8cL8ZFeEFluQeVbt0vyNa+cPLvDLouY87onduXtMz5AKIatLaTOjuG2thh
|
|
# SKECIQDY6G8gvsYJdXCE9UJ7ukoLrRHxt/frhAtmSY5lVAPuMwIhAMzuDrJo73LH
|
|
# ZyEaqIXc5pIiX3Sag43csPDHfuXdtT2NAiEAhyRKGJzDxiDlefFU+sGWYK/z/iYg
|
|
# 0Rvz/kbV8UvnJwECIQDAYN6VJ6NZmc27qv33JIejOfdoTEEhZMMKVg1PlxE0ZQIg
|
|
# HFpJiFxZES3QvVPr8deBXORPurqD5uU85NKsf61AdRsDO_NOT_USE=
|
|
# -----END RSA PRIVATE KEY-----
|
|
|
|
## Optional matching certificate chain in PEM DER form that matches the issuer_private_key. All certificates within
|
|
## the chain must be valid and current, and from top to bottom each certificate must be signed by the next
|
|
## certificate in the chain if provided.
|
|
# issuer_certificate_chain: |
|
|
# -----BEGIN CERTIFICATE-----
|
|
# MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT
|
|
# MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3
|
|
# NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
|
|
# AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00
|
|
# z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud
|
|
# JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8
|
|
# Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx
|
|
# 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE=
|
|
# -----END CERTIFICATE-----
|
|
# -----BEGIN CERTIFICATE-----
|
|
# MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT
|
|
# MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3
|
|
# NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
|
|
# AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00
|
|
# z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud
|
|
# JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8
|
|
# Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx
|
|
# 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE=
|
|
# -----END CERTIFICATE-----
|
|
|
|
## The lifespans configure the expiration for these token types in the duration common syntax.
|
|
# access_token_lifespan: '1h'
|
|
# authorize_code_lifespan: '1m'
|
|
# id_token_lifespan: '1h'
|
|
# refresh_token_lifespan: '90m'
|
|
|
|
## Enables additional debug messages.
|
|
# enable_client_debug_messages: false
|
|
|
|
## SECURITY NOTICE: It's not recommended changing this option and values below 8 are strongly discouraged.
|
|
# minimum_parameter_entropy: 8
|
|
|
|
## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it set to 'never'
|
|
## for security reasons.
|
|
# enforce_pkce: 'public_clients_only'
|
|
|
|
## Cross-Origin Resource Sharing (CORS) settings.
|
|
# cors:
|
|
## List of endpoints in addition to the metadata endpoints to permit cross-origin requests on.
|
|
# endpoints:
|
|
# - 'authorization'
|
|
# - 'token'
|
|
# - 'revocation'
|
|
# - 'introspection'
|
|
# - 'userinfo'
|
|
|
|
## List of allowed origins.
|
|
## Any origin with https is permitted unless this option is configured or the
|
|
## allowed_origins_from_client_redirect_uris option is enabled.
|
|
# allowed_origins:
|
|
# - 'https://example.com'
|
|
|
|
## Automatically adds the origin portion of all redirect URI's on all clients to the list of allowed_origins,
|
|
## provided they have the scheme http or https and do not have the hostname of localhost.
|
|
# allowed_origins_from_client_redirect_uris: false
|
|
|
|
## Clients is a list of known clients and their configuration.
|
|
# clients:
|
|
# -
|
|
## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
|
|
# id: 'myapp'
|
|
|
|
## The description to show to users when they end up on the consent screen. Defaults to the ID above.
|
|
# description: 'My Application'
|
|
|
|
## The client secret is a shared secret between Authelia and the consumer of this client.
|
|
# yamllint disable-line rule:line-length
|
|
# secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng' # The digest of 'insecure_secret'.
|
|
|
|
## Sector Identifiers are occasionally used to generate pairwise subject identifiers. In most cases this is not
|
|
## necessary. Read the documentation for more information.
|
|
## The subject identifier must be the host component of a URL, which is a domain name with an optional port.
|
|
# sector_identifier: 'example.com'
|
|
|
|
## Sets the client to public. This should typically not be set, please see the documentation for usage.
|
|
# public: false
|
|
|
|
## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
|
|
# redirect_uris:
|
|
# - 'https://oidc.example.com:8080/oauth2/callback'
|
|
|
|
## Audience this client is allowed to request.
|
|
# audience: []
|
|
|
|
## Scopes this client is allowed to request.
|
|
# scopes:
|
|
# - 'openid'
|
|
# - 'groups'
|
|
# - 'email'
|
|
# - 'profile'
|
|
|
|
## Grant Types configures which grants this client can obtain.
|
|
## It's not recommended to define this unless you know what you're doing.
|
|
# grant_types:
|
|
# - 'authorization_code'
|
|
|
|
## Response Types configures which responses this client can be sent.
|
|
## It's not recommended to define this unless you know what you're doing.
|
|
# response_types:
|
|
# - 'code'
|
|
|
|
## Response Modes configures which response modes this client supports.
|
|
# response_modes:
|
|
# - 'form_post'
|
|
# - 'query'
|
|
|
|
## The policy to require for this client; one_factor or two_factor.
|
|
# authorization_policy: 'two_factor'
|
|
|
|
## The consent mode controls how consent is obtained.
|
|
# consent_mode: 'auto'
|
|
|
|
## This value controls the duration a consent on this client remains remembered when the consent mode is
|
|
## configured as 'auto' or 'pre-configured' in the duration common syntax.
|
|
# pre_configured_consent_duration: '1w'
|
|
|
|
## Enforces the use of Pushed Authorization Requests for this client when set to true.
|
|
# enforce_par: false
|
|
|
|
## Enforces the use of PKCE for this client when set to true.
|
|
# enforce_pkce: false
|
|
|
|
## Enforces the use of PKCE for this client when configured, and enforces the specified challenge method.
|
|
## Options are 'plain' and 'S256'.
|
|
# pkce_challenge_method: 'S256'
|
|
|
|
## The permitted client authentication method for the Token Endpoint for this client.
|
|
# token_endpoint_auth_method: 'client_secret_basic'
|
|
|
|
## The permitted client authentication signing algorithm for the Token Endpoint for this client when using
|
|
## the 'client_secret_jwt' or 'private_key_jwt' token_endpoint_auth_method.
|
|
# token_endpoint_auth_signing_alg: 'RS256'
|
|
|
|
## The signing algorithm which must be used for request objects. A client JWK with a matching algorithm must be
|
|
## included if configured.
|
|
# request_object_signing_alg: 'RS256'
|
|
|
|
## The signing algorithm used for ID Tokens. Am issuer JWK with a matching algorithm must be included.
|
|
# id_token_signing_alg: 'RS256'
|
|
|
|
## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
|
|
# userinfo_signing_alg: 'none'
|
|
|
|
## Trusted public keys configuration for request object signing for things such as private_key_jwt
|
|
# public_keys:
|
|
|
|
## URL of the HTTPS endpoint which serves the keys. It's recommended to manually configure them in the
|
|
## values option below. Please note the URL and the individual values are mutually exclusive.
|
|
# uri: 'https://app.example.com/jwks.json'
|
|
|
|
## Values from the individual keys.
|
|
# values:
|
|
# -
|
|
## Key ID used to match the JWT's to an individual identifier. This option is required if configured.
|
|
# key_id: 'example'
|
|
|
|
## The key algorithm expected with this key.
|
|
# algorithm: 'RS256'
|
|
|
|
## The key use expected with this key. Currently only 'sig' is supported.
|
|
# use: 'sig'
|
|
|
|
## Required Public Key in PEM DER form.
|
|
# key: |
|
|
# -----BEGIN RSA PUBLIC KEY-----
|
|
# MEgCQQDAwV26ZA1lodtOQxNrJ491gWT+VzFum9IeZ+WTmMypYWyW1CzXKwsvTHDz
|
|
# 9ec+jserR3EMQ0Rr24lj13FL1ib5AgMBAAE=
|
|
# -----END RSA PUBLIC KEY----
|
|
|
|
## The matching certificate chain in PEM DER form that matches the key if available.
|
|
# certificate_chain: |
|
|
# -----BEGIN CERTIFICATE-----
|
|
# MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT
|
|
# MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3
|
|
# NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
|
|
# AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00
|
|
# z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud
|
|
# JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8
|
|
# Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx
|
|
# 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE=
|
|
# -----END CERTIFICATE-----
|
|
# -----BEGIN CERTIFICATE-----
|
|
# MIIBWzCCAQWgAwIBAgIQYAKsXhJOXKfyySlmpKicTzANBgkqhkiG9w0BAQsFADAT
|
|
# MREwDwYDVQQKEwhBdXRoZWxpYTAeFw0yMzA0MjEwMDA3NDRaFw0yNDA0MjAwMDA3
|
|
# NDRaMBMxETAPBgNVBAoTCEF1dGhlbGlhMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJB
|
|
# AK2i7RlJEYo/Xa6mQmv9zmT0XUj3DcEhRJGPVw2qMyadUFxNg/ZFp7aTcToHMf00
|
|
# z6T3b7mwdBkCFQOL3Kb7WRcCAwEAAaM1MDMwDgYDVR0PAQH/BAQDAgWgMBMGA1Ud
|
|
# JQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADQQB8
|
|
# Of2iM7fPadmtChCMna8lYWH+lEplj6BxOJlRuGRawxszLwi78bnq0sCR33LU6xMx
|
|
# 1oAPwIHNaJJwC4z6oG9E_DO_NOT_USE=
|
|
# -----END CERTIFICATE-----
|
|
...
|