mirror of
https://github.com/0rangebananaspy/authelia.git
synced 2024-09-14 22:47:21 +07:00
3f374534ab
* [FIX] LDAP Not Checking for Updated Groups * refactor handlers verifyFromSessionCookie * refactor authorizer selectMatchingObjectRules * refactor authorizer isDomainMatching * add authorizer URLHasGroupSubjects method * add user provider ProviderType method * update tests * check for new LDAP groups and update session when: * user provider type is LDAP * authorization is forbidden * URL has rule with group subjects * Implement Refresh Interval * add default values for LDAP user provider * add default for refresh interval * add schema validator for refresh interval * add various tests * rename hasUserBeenInactiveLongEnough to hasUserBeenInactiveTooLong * use Authelia ctx clock * add check to determine if user is deleted, if so destroy the * make ldap user not found error a const * implement GetRefreshSettings in mock * Use user not found const with FileProvider * comment exports * use ctx.Clock instead of time pkg * add debug logging * use ptr to reference userSession so we don't have to retrieve it again * add documenation * add check for 0 refresh interval to reduce CPU cost * remove badly copied debug msg * add group change delta message * add SliceStringDelta * refactor ldap refresh to use the new func * improve delta add/remove log message * fix incorrect logic in SliceStringDelta * add tests to SliceStringDelta * add always config option * add tests for always config option * update docs * apply suggestions from code review Co-Authored-By: Amir Zarrinkafsh <nightah@me.com> * complete mocks and fix an old one * show warning when LDAP details failed to update for an unknown reason * golint fix * actually fix existing mocks * use mocks for LDAP refresh testing * use mocks for LDAP refresh testing for both added and removed groups * use test mock to verify disabled refresh behaviour * add information to threat model * add time const for default Unix() value * misc adjustments to mocks * Suggestions from code review * requested changes * update emails * docs updates * test updates * misc * golint fix * set debug for dev testing * misc docs and logging updates * misc grammar/spelling * use built function for VerifyGet * fix reviewdog suggestions * requested changes * Apply suggestions from code review Co-authored-by: Amir Zarrinkafsh <nightah@me.com> Co-authored-by: Clément Michaud <clement.michaud34@gmail.com>
35 lines
1.4 KiB
Markdown
35 lines
1.4 KiB
Markdown
---
|
|
layout: default
|
|
title: Security
|
|
nav_order: 6
|
|
has_children: true
|
|
---
|
|
|
|
# Security
|
|
|
|
Authelia takes security very seriously. We follow the rule of
|
|
[responsible disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure), and we
|
|
encourage the community to as well.
|
|
|
|
If you discover a vulnerability in Authelia, please first contact one of the maintainers privately
|
|
either via [Matrix](#matrix) or [email](#email) as described in the [contact options](#contact-options) below.
|
|
|
|
For details about security measures implemented in Authelia, please follow
|
|
this [link](https://docs.authelia.com/security/measures.html) and for reading about
|
|
the threat model follow this [link](https://docs.authelia.com/security/threat-model.html).
|
|
|
|
## Contact Options
|
|
|
|
### Matrix
|
|
|
|
Join the [Matrix Room](https://riot.im/app/#/room/#authelia:matrix.org) and locate one of the maintainers.
|
|
You can identify them as they are the room administrators. Alternatively you can just ask for one of the
|
|
maintainers. Once you've made contact we ask you privately message the maintainer to communicate the vulnerability.
|
|
|
|
### Email
|
|
|
|
You can contact any of the maintainers for security vulnerability related issues by emailing
|
|
[security@authelia.com](mailto:security@authelia.com). This email is strictly reserved for security and vulnerability
|
|
disclosure related matters. If you need to contact us for another reason please use [Matrix](#matrix) or
|
|
[team@authelia.com](mailto:security@authelia.com).
|