techies/authelia
1
0
Fork 0
mirror of https://github.com/0rangebananaspy/authelia.git synced 2024-09-14 22:47:21 +07:00
Code Issues Projects Releases Wiki Activity
2,739 Commits 1 Branch 0 Tags 25 MiB
45df1ec7d0
Commit Graph

540 Commits

Author SHA1 Message Date
James Elliott
bda87db79c
test(suites): caddy (#3305) 2022-05-07 11:55:52 +10:00
James Elliott
0855ea2f71
fix(server): missing cache and xss headers (#3289) 
Addresses documentation and a couple of headers which were missed.
 2022-05-04 14:47:23 +10:00
Amir Zarrinkafsh
cac8919f97
test: add redis restart test back to traefik2 suite (#3298) 
* test: add redis restart test back to traefik2 suite

* refactor(suites): mustpress -> mustinput for totp

* refactor(suites): rename suites for test ordering
 2022-05-04 11:01:36 +10:00
renovate[bot]
f8bb51da4d
build(deps): update dependency traefik to v2.6.6 (#3296) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2022-05-04 09:29:51 +10:00
renovate[bot]
f88e7dd242
build(deps): update module github.com/go-rod/rod to v0.106.4 (#3042) 2022-05-03 22:37:56 +10:00
renovate[bot]
e6ad8fe83e
build(deps): update dependency golang to v1.18.1 (#3019) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2022-05-03 19:35:44 +10:00
James Elliott
1db00717ee
fix(oidc): pre-conf consent skipped entirely for anon users (#3250) 
This fixes an issue where pre-configured consent is entirely skipped if the process was initiated via an anonymous user.
 2022-05-03 15:28:58 +10:00
James Elliott
556a115c83
fix(server): missing modern security headers (#3288) 
This fixes an issue with missing modern security headers such as the X-Content-Type-Options, Referer-Policy, etc.
 2022-05-03 12:19:30 +10:00
Amir Zarrinkafsh
91c0c81818
refactor(suites): stop integration tests on first failure (#3270) 
* refactor(suites): stop integration tests on first failure

* refactor(suites): remove additional nginx instance

* refactor(suites): log relevant containers

* refactor(suites): add traefik2 logs to stdout

* refactor(suites): explicitly enable traefik for tests

* refactor(suites): remove redis restart and duplicate pathprefix tests

* ci(buildkite): allow manual retry on integration tests
 2022-05-02 14:50:37 +10:00
James Elliott
c7d992f341
fix(authentication): follow ldap referrals (#3251) 
This ensures we are able to follow referrals for LDAP password modify operations when permit_referrals is true.

Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
 2022-05-02 11:51:38 +10:00
renovate[bot]
8ee92231ba
build(deps): update dependency haproxy to v2.5.6 (#3255) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2022-04-27 16:12:44 +10:00
James Elliott
555746e771
refactor: exclude id from sqlite3 migration (#3242) 
* refactor: exclude id from sqlite3 table recreate

* docs: add migration docs
 2022-04-25 21:11:56 +10:00
James Elliott
06ba312c28
fix(commands): invalid opaque id service name (#3235) 
This fixes the service type being openid_connect instead of openid as expected. This also allows bulk generating opaque identifiers for users.
 2022-04-25 18:49:18 +10:00
James Elliott
861bcc898f
refactor: ensure bad consent sessions and identifiers are deleted (#3241) 2022-04-25 17:53:38 +10:00
James Elliott
abf1c86ab9
fix(oidc): subject generated for anonymous users (#3238) 
Fix and issue that would prevent a correct ID Token from being generated for users who start off anonymous. This also avoids generating one in the first place for anonymous users.
 2022-04-25 10:31:05 +10:00
renovate[bot]
b18eea039c
build(deps): update node.js to v18 (#3225) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2022-04-21 18:28:35 +10:00
Amir Zarrinkafsh
daaa16c182
refactor(suites): validate totp inputs (#3218) 
This change validates the inputs for the TOTP code entry.
This was previously discarded and left unvalidated during the move to rod from within the integration tests.
 2022-04-19 14:11:15 +10:00
Amir Zarrinkafsh
92e219b34b
fix(suites): add missing traefik routes (#3217) 
This change includes missing routes for both the Traefik and Traefik2 suites, issues would have manifested running dev mode tests for these suites when attempting to load translations.
 2022-04-19 13:36:49 +10:00
James Elliott
e99fb7a08f
feat(configuration): configurable default second factor method (#3081) 
This allows configuring the default second factor method.
 2022-04-18 09:58:24 +10:00
James Elliott
e56690c2df
refactor(configuration): ensure all keys are validated (#3208) 
This ensures keys that exist in slices are validated.
 2022-04-16 20:48:07 +10:00
James Elliott
dc7ca6f03c
refactor: introduce config key gen (#3206) 
This adjusts the validated keys to utilize a generated code section.
 2022-04-16 19:00:39 +10:00
James Elliott
5aa25ec275
fix(configuration): missing valid keys (#3207) 
This fixes an issue with three missing config keys.
 2022-04-16 17:49:13 +10:00
James Elliott
4710de33a4
refactor(configuration): remove ptr for duoapi and notifier (#3200) 
This adds to the ongoing effort to remove all pointers to structs in the configuration without breaking backwards compatibility.
 2022-04-16 09:34:26 +10:00
James Elliott
92aba8eb0b
feat(server): zxcvbn password policy server side (#3151) 
This is so the zxcvbn ppolicy is checked on the server.
 2022-04-15 19:30:51 +10:00
renovate[bot]
c5cb36c526
build(deps): update dependency golang to v1.17.9 (#3198) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2022-04-15 15:53:15 +10:00
James Elliott
6e0853a81b
build(deps): update dependency golang (#3180) 2022-04-13 14:28:31 +10:00
James Elliott
f97474f01b
fix(oidc): show detailed error reasons (#3175) 2022-04-12 21:39:15 +10:00
James Elliott
85a88de24d
test(oidc): fix disabled tests (#3173) 2022-04-12 13:02:12 +10:00
James Elliott
cf93e66391
test(suites): fix backend endpoints (#3158) 2022-04-10 08:05:27 +10:00
Manuel Nuñez
086b97d21f
test(suites): revert por binding (#3155) 
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
 2022-04-10 07:44:47 +10:00
James Elliott
79935c7e2e
fix(server): locale format incorrect (#3154) 
This fixes an issue where the locale would be formatted as en-en instead of en-US.
 2022-04-09 21:38:17 +10:00
James Elliott
5a0a15f377
feat(commands): user opaque identifiers commands (#3144) 
Add commands for handling user opaque identifiers.
 2022-04-09 17:13:19 +10:00
James Elliott
e7112bfbd6
feat(oidc): client id claims (#3150) 
Adds the authorized party (azp) and client_id registered claims to ID Tokens.
 2022-04-09 16:55:24 +10:00
James Elliott
148ec1e2e0
fix(oidc): missing amr claim supported in discovery (#3147) 
This adds the AMR claim to discovery.
 2022-04-09 09:35:13 +10:00
James Elliott
9d5ac4526e
fix(configuration): remove unused password policy option (#3149) 
Removes the min score option from the ZXCVBN policy and adds tests.
 2022-04-09 09:21:49 +10:00
James Elliott
f9da940bfc
fix(web): description of profile scope is not accurate (#3146) 
This adjusts the profile scope to be described as "Access your profile information" as it accesses more than the display name now.
 2022-04-09 08:47:21 +10:00
James Elliott
44bd70712c
fix(configuration): sector identifier not parsed correctly (#3142) 
This fixes an issue preventing the sector identifier for OpenID Connect clients from being parsed.
 2022-04-08 17:38:38 +10:00
James Elliott
66a450ed38
feat(oidc): pre-configured consent (#3118) 
Allows users to pre-configure consent if enabled by the client configuration by selecting a checkbox during consent.

Closes #2598
 2022-04-08 15:35:21 +10:00
James Elliott
4503ac07be
fix(web): lowercase locales are not consistent with localization platforms (#3141) 
This fixes an issue with localization platforms and the docs regarding localization, and the forcing locale names to lowercase.
 2022-04-08 14:53:46 +10:00
James Elliott
ce6bf74c8d
fix(server): incorrect remote ip logged in error handler (#3139) 
This fixes edge cases where the remote IP was not correctly logged. Generally this is not an issue as most errors do not hit this handler, but in instances where a transport error occurs this is important.
 2022-04-08 14:13:47 +10:00
James Elliott
90edf11b88
feat(web): add user display name to oidc consent view (#3138) 
This adds the current logged in users display name to the consent page as well as some other minor tweaks.

Closes #2595
 2022-04-08 12:50:55 +10:00
James Elliott
9b6bcca1ba
feat(totp): secret customization (#2681) 
Allow customizing the shared secrets size specifically for apps which don't support 256bit shared secrets.
 2022-04-08 09:01:01 +10:00
James Elliott
8bb8207808
feat(oidc): pairwise subject identifiers (#3116) 
Allows configuring clients with a sector identifier to allow pairwise subject types.
 2022-04-07 16:13:01 +10:00
James Elliott
0a970aef8a
feat(oidc): persistent storage (#2965) 
This moves the OpenID Connect storage from memory into the SQL storage, making it persistent and allowing it to be used with clustered deployments like the rest of Authelia.
 2022-04-07 15:33:53 +10:00
James Elliott
06fd7105ea
refactor(templates): utilize more accurate naming (#3125) 2022-04-07 13:05:20 +10:00
James Elliott
4ebd8fdf4e
feat(oidc): provide cors config including options handlers (#3005) 
This adjusts the CORS headers appropriately for OpenID Connect. This includes responding to OPTIONS requests appropriately. Currently this is only configured to operate when the Origin scheme is HTTPS; but can easily be expanded in the future to include additional Origins.
 2022-04-07 10:58:51 +10:00
renovate[bot]
d96c93ef2b
build(deps): update module github.com/valyala/fasthttp to v1.35.0 (#3120) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
 2022-04-06 07:57:23 +10:00
renovate[bot]
004490c7b1
build(deps): update dependency alpine to v3.15.4 (#3114) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2022-04-05 11:15:43 +10:00
Clément Michaud
3ca438e3d5
feat: implement mutual tls in the web server (#3065) 
Mutual TLS helps prevent untrusted clients communicating with services like Authelia. This can be utilized to reduce the attack surface.

Fixes #3041
 2022-04-05 09:57:47 +10:00
James Elliott
a2eb0316c8
feat(web): password reset custom url (#3111) 
This allows providing a custom URL for password resets. If provided the disable_reset_password option is ignored, the password reset API is disabled, and the button provided in the UI to reset the password redirects users to the configured endpoint.

Closes #1934, Closes #2854

Co-authored-by: you1996 <youssri@flyweight.tech>
 2022-04-04 17:46:55 +10:00