techies/authelia
1
0
Fork 0
mirror of https://github.com/0rangebananaspy/authelia.git synced 2024-09-14 22:47:21 +07:00
Code Issues Projects Releases Wiki Activity
2,473 Commits 1 Branch 0 Tags 25 MiB
f439b85141
Commit Graph

460 Commits

Author SHA1 Message Date
James Elliott
337dd61468
docs: add docs about remember me duration (#2979) 
This documents disabling remember me.
 2022-03-09 13:25:11 +11:00
James Elliott
6a1c5ed533
fix(configuration): invalid password algorithm tag (#2972) 
This fixes a configuration parsing issue that could potentially occur if we were to change the internal name of the struct field.
 2022-03-07 00:01:46 +11:00
James Elliott
6d937cf6cc
refactor(model): rename from models (#2968) 2022-03-06 16:47:40 +11:00
James Elliott
1c1030c742
fix(configuration): time duration decode hook panic (#2960) 
This fixes a potential panic in the time duration decode hook when the YAML value is a zero integer.
 2022-03-05 16:51:41 +11:00
James Elliott
204cef4d03
fix(storage): webauthn kid too short for some devices (#2957) 
This fixes an issue that may cause the kid length of a webauthn device to exceed that length allowed by the database column.
 2022-03-04 21:21:08 +11:00
James Elliott
fd3a2bb1c5
fix(configuration): pkce config keys not allowed (#2954) 
This fixes a bug that prevents the PKCE configuration keys from being configurable.
 2022-03-04 16:46:05 +11:00
James Elliott
a8f5a70b03
feat(oidc): add automatic allow all cors to discovery (#2953) 
This adds a Cross Origin Resource Sharing policy that automatically allows any cross-origin request to the OpenID Connect discovery documents.
 2022-03-04 15:46:12 +11:00
James Elliott
a5c400cb1d
fix(commands): use consistent config file name (#2952) 
Adjusts the default filename for all configuration files to configuration.yml.
 2022-03-04 14:39:22 +11:00
James Elliott
c9d86a9240
feat(oidc): oauth2 discovery support (#2925) 
* feat(oidc): oauth2 discovery and endpoint rename

This implements the oauth2 authorization server discovery document, adds tests to the discovery documents, implements an efficiency upgrade to these docs, and renames some endpoints to be uniform.
 2022-03-04 14:09:27 +11:00
James Elliott
042cd21800
build(deps): utilize github.com/go-webauthn/webauthn (#2947) 2022-03-04 10:56:30 +11:00
James Elliott
8f05846e21
feat: webauthn (#2707) 
This implements Webauthn. Old devices can be used to authenticate via the appid compatibility layer which should be automatic. New devices will be registered via Webauthn, and devices which do not support FIDO2 will no longer be able to be registered. At this time it does not fully support multiple devices (backend does, frontend doesn't allow registration of additional devices). Does not support passwordless.
 2022-03-03 22:20:43 +11:00
James Elliott
1b2af90e5a
feat(commands): totp qr code in png format (#2673) 
This allows exporting the TOTP QR code for easy registration when using `authelia storage totp generate` or `authelia storage totp export`.
 2022-03-02 18:50:36 +11:00
James Elliott
6276883f04
refactor(configuration): utilize time duration decode hook (#2938) 
This enhances the existing time.Duration parser to allow multiple units, and implements a decode hook which can be used by koanf to decode string/integers into time.Durations as applicable.
 2022-03-02 17:40:26 +11:00
James Elliott
d867fa1a63
fix(storage): return reason for identity verification not being found (#2937) 
This includes the reason a token was not found during the identity verification process.
 2022-03-02 16:33:47 +11:00
Andrew Moore
6ef6d0499a
feat(oidc): add pkce support (#2924) 
Implements Proof Key for Code Exchange for OpenID Connect Authorization Code Flow. By default this is enabled for the public client type and requires the S256 challenge method.

Closes #2921
 2022-03-02 15:44:05 +11:00
renovate[bot]
f8d9c6eab7
build(deps): update dependency haproxy to v2.5.4 (#2931) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2022-03-01 15:04:34 +11:00
James Elliott
c479ba6386
fix(oidc): make preferred_username a profile scope claim (#2930) 
This corrects an issue with the preferred_username which should be part of the profile scope as per https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims.

Introduced in ddbb21a via #2829
 2022-03-01 14:07:39 +11:00
James Elliott
3c81e75d79
feat(commands): add access-control check-policy command (#2871) 
This adds an access-control command that checks the policy enforcement for a given criteria using a configuration file and refactors the configuration validation command to include all configuration sources.
 2022-02-28 14:15:01 +11:00
renovate[bot]
e286741357
build(deps): update dependency mariadb to v10.8.2 (#2917) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2022-02-27 10:12:17 +11:00
renovate[bot]
4b1bd01167
build(deps): update dependency traefik to v2.6.1 (#2912) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2022-02-24 21:13:08 +11:00
renovate[bot]
eb76de6cdc
build(deps): update dependency haproxy to v2.5.3 (#2897) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
 2022-02-24 03:12:26 +11:00
James Elliott
bed7a8ae32
feat(server): csp template (#2856) 
Implements the ability for advanced users to override the CSP and easily include the required nonce.
 2022-02-21 10:14:09 +11:00
James Elliott
ddbb21af90
fix(handlers): include preferred_username claim in meta (#2829) 
This includes the preferred_username claim in the meta. Also uses the consts for all the applicable claims and scopes.
 2022-02-10 09:55:28 +11:00
Clément Michaud
5d4003c291
refactor: directly return error where sufficient (#2855) 2022-02-10 09:07:53 +11:00
James Elliott
fcdd41ea2a
feat: oidc scope i18n (#2799) 
This adds i18n for the OIDC scope descriptsions descriptions.
 2022-02-08 01:18:16 +11:00
James Elliott
26236f491e
fix(server): use of inconsistent methods for determining origin (#2848) 
This unifies the methods to obtain the X-Forwarded-* header values and provides logical fallbacks. In addition, so we can ensure this functionality extends to the templated files we've converted the ServeTemplatedFile method into a function that operates as a middlewares.RequestHandler.

Fixes #2765
 2022-02-07 00:37:28 +11:00
James Elliott
7775d2af0e
fix(ntp): disable failure ignored (#2835) 
Disable failure was ignored previously, this ensures it isn't.
 2022-02-03 14:04:24 +11:00
James Elliott
1772a83190
refactor: apply godot recommendations (#2839) 2022-01-31 16:25:15 +11:00
Clément Michaud
a7a2bc63fe
feat(configuration): support private-use redirect uris in oidc (#2796) 
Private-use redirect URIs are used to redirect the user to native apps initiating the authentication flow on a device as described in https://datatracker.ietf.org/doc/html/rfc8252#section-7.1

Fix #2742
 2022-01-21 22:05:53 +11:00
James Elliott
e59f571816
refactor(oidc): add client id to two factor log message (#2816) 
Adds the client id to a log message where it's likely useful. Additionally adds beta stage for prompt/display handling.
 2022-01-21 14:15:50 +11:00
renovate[bot]
d8cf272757
build(deps): update traefik docker tag to v2.5.7 (#2815) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2022-01-21 13:43:06 +11:00
James Elliott
9a8c6602dd
fix(middlewares): smart delay on reset password (#2767) 
This adds a smart delay on reset password attempts to prevent username enumeration. Additionally utilizes crypto rand instead of math rand. It also moves the timing delay functionality into its own handler func.
 2022-01-21 10:46:13 +11:00
James Elliott
06641cd15a
fix(oidc): add preferred username claim (#2801) 
This adds the missing preferred username claim to the ID Token for OIDC.

Fixes #2798
 2022-01-18 20:32:06 +11:00
James Elliott
fe4bfc1c75
fix(configuration): mail address decode hook func (#2790) 
This fixes an issue with the mail address decode hook func which previously would attempt to decode any struct type to a mail address.
 2022-01-15 13:01:40 +11:00
renovate[bot]
526d71ae8c
build(deps): update module github.com/ory/fosite to v0.42.0 (#2691) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
 2022-01-13 02:52:15 +11:00
James Elliott
d103585aba
fix(storage): use boolean instead of integer (#2776) 
This fixes an issue where an integer is used instead of a boolean.
 2022-01-13 01:42:41 +11:00
renovate[bot]
535ad2a697
build(deps): update haproxy docker tag to v2.5.1 (#2793) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
 2022-01-12 23:54:50 +11:00
renovate[bot]
2a1e7fc793
build(deps): update traefik docker tag to v2.5.6 (#2738) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-12-23 10:44:39 +11:00
renovate[bot]
93352aa36b
build(deps): update traefik docker tag to v2.5.5 (#2706) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-12-12 14:47:03 +11:00
renovate[bot]
f9586b99a9
build(deps): update traefik docker tag to v1.7.34 (#2705) 
Co-authored-by: Renovate Bot <bot@renovateapp.com>
 2021-12-12 11:15:01 +11:00
James Elliott
c01759715c
fix(models): potential panic generating jti (#2669) 
This ensures that at the time the JWT is generated for identity verification requests that a panic can't occur and instead an error will be returned.
 2021-12-04 15:48:22 +11:00
James Elliott
5a223b5a56
fix(storage): don't check exp against time using sql (#2676) 
This is already checked by JWT validation. There is no need and it's leading to timezone issues.

Fixes #2672
 2021-12-04 15:34:20 +11:00
James Elliott
95a5e326a5
fix(storage): postgres schema hardcoded for tables query (#2667) 
This removes the hardcoded schema value from the PostgreSQL existing tables query, making it compatible with the new schema config option.
 2021-12-03 17:29:55 +11:00
James Elliott
255aaeb2ad
feat(storage): encrypt u2f key (#2664) 
Adds encryption to the U2F public keys. While the public keys cannot be used to authenticate, only to validate someone is authenticated, if a rogue operator changed these in the database they may be able to bypass 2FA. This prevents that.
 2021-12-03 11:04:11 +11:00
James Elliott
104a61ecd6
refactor(web): only fetch totp conf if required (#2663) 
Prevents the TOTP user config from being requested when the user has not registered or is already authenticated 2FA.
 2021-12-02 21:28:16 +11:00
James Elliott
9045b75344
fix(storage): rebind all queries (#2662) 
Fixes an issue in the new storage system. We forgot to rebind a few queries to the PostgreSQL compatible format.
 2021-12-02 17:06:04 +11:00
James Elliott
f90ca855e3
feat(storage): postgresql schema and ssl options (#2659) 
Adds the schema name and all ssl options for PostgreSQL. Also a significant refactor of the storage validation process.
 2021-12-02 16:36:03 +11:00
Aram Akhavan
5b3fa1fffb
docs: consistent naming for configuration file (#2626) 
* change all instances (file names and docs) of "config.template.yml" to "configuration.template.yml" so its consistent with the expectations of the Dockerfile

* Keep config.template.yml named as is

Co-authored-by: Amir Zarrinkafsh <nightah@me.com>

* Update index.html

* revert filename changes and add a note about docker

* refactor: apply suggestions from code review

Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
 2021-12-02 15:50:05 +11:00
James Elliott
a79e4dc592
fix(storage): duo/u2f upsert failure on postgresql (#2658) 
This replaces the standard duo_devices upsert with a PostgreSQL specific one and ensures the u2f_devices upsert uses the new unique key for the ON CONFLICT check.
 2021-12-02 15:16:45 +11:00
James Elliott
bf9ab360bd
refactor(handlers): utilize referer for auth logging rm/rd (#2655) 
This utilizes the referrer query parameters instead of current request query parameters for logging the requested URI and method. Minor performance improvements to header peek/sets.
 2021-12-02 13:21:46 +11:00