techies/authelia
1
0
Fork 0
mirror of https://github.com/0rangebananaspy/authelia.git synced 2024-09-14 22:47:21 +07:00
Code Issues Projects Releases Wiki Activity
298 Commits 1 Branch 0 Tags 25 MiB
92b78f7c15
Commit Graph

298 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Clement Michaud
92b78f7c15 Enable secure and httpOnly option for sessions 
These are 2 measures for improving security of cookies. One is used to
not send the cookie over HTTP (only HTTPS) and the other tells the browser to
disallow client-side code accessing the cookie.
 2017-10-16 20:56:26 +02:00
Clément Michaud
6e3a9494ce Merge pull request #158 from clems4ever/anonymous-smtp 
Allow anonymous user in SMTP notifier
 2017-10-16 00:09:55 +02:00
Clément Michaud
35b934ecea Merge branch 'develop' into anonymous-smtp 2017-10-15 23:25:47 +02:00
Clément Michaud
5bac2b75b0 Merge pull request #159 from clems4ever/publish-develop-to-docker 
Publish 'develop' tag to dockerhub
 2017-10-15 23:24:28 +02:00
Clément Michaud
565fc35f07 Merge branch 'develop' into anonymous-smtp 2017-10-15 22:50:05 +02:00
Clément Michaud
15615b2741 Merge branch 'develop' into publish-develop-to-docker 2017-10-15 22:49:58 +02:00
Clément Michaud
3236b97ffd Merge pull request #156 from clems4ever/remove-schema-from-source 
Remove configuration schema from source since it is generated
 2017-10-15 22:49:23 +02:00
Clement Michaud
e8e8c8f7da Publish 'develop' tag to dockerhub 2017-10-15 22:48:56 +02:00
Clement Michaud
d3a2251d4a Allow anonymous user in SMTP notifier 
SMTP notifier should be able to send emails with anonymous user, i.e. without
providing username and password in configuration file.
 2017-10-15 22:41:22 +02:00
Clément Michaud
b6aca2619b Merge branch 'develop' into remove-schema-from-source 2017-10-15 22:31:06 +02:00
Clément Michaud
329927b865 Merge pull request #157 from clems4ever/already-logged-username 
Add username to the 'already logged in' page
 2017-10-15 22:30:55 +02:00
Clement Michaud
e8a1e7c52c Remove configuration schema from source since it is generated 2017-10-15 22:17:36 +02:00
Clement Michaud
daee042368 Add username to the 'already logged in' page 2017-10-15 22:15:54 +02:00
Clément Michaud
35b66ba630 Merge pull request #155 from clems4ever/block-logged-in-page 
Block 'already logged in' page to unauthenticated user
 2017-10-15 22:03:11 +02:00
Clement Michaud
f2ae1cd044 Block 'already logged in' page to unauthenticated user 2017-10-15 21:52:12 +02:00
Clément Michaud
8fa50482df Merge pull request #153 from clems4ever/opt-subdomain-methods 
Make per_subdomain_methods optional in configuration file
 2017-10-15 21:39:24 +02:00
Clement Michaud
12a8626ef7 Make per_subdomain_methods optional in configuration file 2017-10-15 20:01:16 +02:00
Clément Michaud
b3479c19da Merge pull request #149 from clems4ever/npm-package-fix 
Do not include client/ and server/ in npm package
 2017-10-15 16:09:50 +02:00
Clement Michaud
e599ac78ae Do not include client/ and server/ in npm package 2017-10-15 15:52:34 +02:00
Clément Michaud
4b51ae30cc Merge pull request #147 from clems4ever/userdn-ldap-filter 
Add {dn} as an available matcher in LDAP groups filter
 2017-10-15 15:02:46 +02:00
Clement Michaud
ce264ff4d3 Add {dn} as an available matcher in LDAP groups filter 
Sometimes, LDAP organization is such that groups membership cannot be computed
with username only. User DN is required to retrieve groups.

e.g. user Joe has a username joe and a cn of Joe Blogs, resulting in a dn of
cn=Joe Blogs,ou=users,dc=example,dc=com which is needed to retrieve groups
but cannot be computed from joe only.

Issue was reported in issue #146
 2017-10-15 14:51:26 +02:00
Clément Michaud
15fa6286ad Merge pull request #143 from clems4ever/protect-ldap-injection 
Add input sanitizer to LDAP client to protect against LDAP injections
 2017-10-15 13:36:38 +02:00
Clement Michaud
2e087f12f4 Fix out of bound access in LDAP results array 2017-10-15 02:07:04 +02:00
Clément Michaud
9fe202f227 Merge pull request #144 from clems4ever/test-forward-headers 
Fix unhandled rejections in unit tests
 2017-10-15 01:55:31 +02:00
Clement Michaud
1dd0343860 Add input sanitizer to LDAP client to protect against LDAP injections 2017-10-15 01:35:33 +02:00
Clement Michaud
bf3e71d732 Fix unhandled rejections in unit tests 2017-10-15 01:34:37 +02:00
Clément Michaud
cb139997d2 Merge pull request #142 from clems4ever/test-forward-headers 
Add test for headers forwarding feature
 2017-10-15 01:13:57 +02:00
Clement Michaud
3a88ca95b8 Check TOTP token with window of 1 
A window of 1 means the token is checked against current time slot T
as well as at time slot T-1 and T+1.
A time slot is 30 seconds by default in Authelia.
 2017-10-15 00:44:10 +02:00
Clement Michaud
c02d9b4a6e Display current URL when redirection step fails in integration tests 2017-10-14 22:12:00 +02:00
Clement Michaud
8cf58d7b31 Add tests on headers forwarded to backend 
Ensure Remote-User and Remote-Groups can be forwarded to the backend app.
 2017-10-14 22:11:56 +02:00
Clément Michaud
f041b946d9 Merge pull request #140 from clems4ever/improve-endpoint-errors 
Every public endpoints return 200 with harmonized error messages or 401
 2017-10-14 12:22:24 +02:00
Clement Michaud
56fdc40290 Every public endpoints return 200 with harmonized error messages or 401 
Now, /verify can return 401 or 403 depending on the user authentication.
Every public API endpoints and pages return 200 with error message in
JSON body or 401 if the user is not authorized.

This policy makes it complicated for an attacker to know what is the source of
the failure and hide server-side bugs (not returning 500), bugs being potential
threats.
 2017-10-14 11:57:38 +02:00
Clément Michaud
3bea8a290a Merge pull request #137 from clems4ever/mail-sender 
Specify mail sender for SMTP and Gmail notifiers
 2017-10-10 23:08:55 +02:00
Clement Michaud
ab8aaeda25 Add configuration schema validation before starting Authelia 2017-10-10 21:59:20 +02:00
Clement Michaud
2a3fde5ee7 Add a schema validator to check user configuration 2017-10-10 01:14:36 +02:00
Clement Michaud
1ab09b71d4 Specify the sender email in Gmail and Smtp notifier configuration 
Sender email address can now be specified in configuration and applies to
GMail notifier and SMTP notifier.
 2017-10-10 00:07:12 +02:00
Clément Michaud
d5035b8704 Merge pull request #131 from clems4ever/disable-second-factor 
Allow basic authentication in configuration
 2017-10-09 23:27:36 +02:00
Clement Michaud
9624aa6311 Adapt authentication methods configuration to be backward compatible 
Prior version of configuration file can be used, the authentication methods
will be set to default values (two_factor as default method).
 2017-10-09 23:14:05 +02:00
Clement Michaud
bc8fe623df Use minified version of Authelia in npm package 2017-10-09 02:03:11 +02:00
Clement Michaud
9559bff5de Remove artifacts of only_basic_auth query param 2017-10-09 02:03:05 +02:00
Clément Michaud
2641fb1620 Merge pull request #130 from clems4ever/revert-filesystem-notifier 
Revert filesystem notifier
 2017-10-09 01:58:06 +02:00
Clement Michaud
46deb765bb 3.5.0 2017-10-09 01:15:40 +02:00
Clement Michaud
a0aab77449 Add a section dealing with basic auth in README 2017-10-09 01:14:19 +02:00
Clement Michaud
9ddc0949b6 Add a way to logout at second factor stage 2017-10-09 01:07:43 +02:00
Clement Michaud
1cf4e57bb1 Redirect user when he has already validated some factors 
Example 1: The user has validated first factor when accessing a service
protected by basic auth. When he tries to access another service protected
by second factor, he is redirected to second factor step to complete
authentication.

Example 2: The user has already validated second factor. When he access auth
service, he is redirected either to /loggedin page that displays an "already
logged in" page or to the URL provided in the "redirect" query parameter.
 2017-10-09 01:07:32 +02:00
Clement Michaud
c061dbfda4 Customize the authentication method to be used by a sub-domain 
One can now customize the default authentication method for all sub-domains,
i.e., either 'two_factor' or 'basic_auth' and define specific authentication
method per sub-domain.

For example, one can specify that every sub-domain must be authenticated with
two factor except one sub-domain that must be authenticated with basic auth.
 2017-10-08 23:39:29 +02:00
Clement Michaud
e4274fbe1b Add a note about filesystem notifier option 
This note tells the users testing with npm that they can enable the
filesystem notifier feature to test identity validation without access
to mailcatcher webmail.
 2017-10-08 22:58:56 +02:00
Clément Michaud
6940e15ffa Merge pull request #125 from clems4ever/improve-logs 
Improve logging format for clarity
 2017-10-08 22:49:50 +02:00
Clément Michaud
83348f49c2 Merge pull request #129 from clems4ever/dockerhub-deployment 
Deploy latest along with release tag
 2017-10-08 22:49:41 +02:00
Clement Michaud
346c559141 Make file system an available notifier option for testing purpose 2017-10-08 22:48:20 +02:00