summaryrefslogtreecommitdiff
path: root/internal/authentication
AgeCommit message (Collapse)Author
2025-03-08refactor(handlers): add more detailed errors for password-change failures ↵Brynn Crowley
(#8899) Adds some more helpful log information to the change password feature. Signed-off-by: Brynn Crowley <littlehill723@gmail.com> Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com> Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2025-03-09feat(embed): make authelia embedable (#8841)James Elliott
This adds a highly experimental option for developers looking to embed Authelia within another go binary. Closes #5803 Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2025-03-06feat(web): change password (#7676)Brynn Crowley
Add the ability for users to change their password from their user settings, without requiring them to use the reset password workflow. User's are required to create a elevated session in order to change their password. Users may not change their password to their current password. The user's current password is required for the password change. Users must follow any established password policies. Administrators are able to turn this feature off. Closes #3548
2025-02-24feat(handlers): basic authz caching (#8320)James Elliott
This adds the ability to cache successful basic authz attempts. This is done via a memory store that uses the HMAC-SHA256 algorithm to perform irreversible comparison of input parameters and has a maximum lifetime. Closes #5006 Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2025-02-23feat(authentication): ldap connection pooling (#7217)James Elliott
This implements optional LDAP connection pooling to optimize the speed of LDAP transactions. Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2025-02-22feat(authentication): additional and custom attributes (#8078)James Elliott
This facilitates adding additional attributes to the Authelia authentication backends as well as custom attributes based on the Common Expression Language. This will be utilized in the future to facilitate additional features. Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2024-12-29refactor: yaml vs yml (#8527)James Elliott
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2024-10-19refactor: generate mocks (#8057)James Elliott
2024-09-20refactor: linting (#7863)James Elliott
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2024-09-01fix(authentication): ldap attributes treated case-sensitive (#7793)James Elliott
This fixes an issue where LDAP attribute names are treated as case-sensitive when they normally shouldn't be. This was caused by improvements to the attribute matching pattern which caused a regression. Fixes #7791 Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2024-05-29fix(authentication): memberof included in groups searches (#7359)James Elliott
This fixes an issue where the memberof attribute is requested needlessly. While not necessarily a bug it's not really a feature either. The only reported issue with the current functionality is an annoying log message. In the instance this turns out to be a regression this commit should be immediately reverted. Closes #7310 Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2024-03-29fix(oidc): delayed user details refresh (#7035)James Elliott
The user details refresh does not naturally occur via OpenID Connect 1.0 flows and instead relies on alternative activity. This helps ensure the details are more frequently updated via normal OAuth 2.0 flows. Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2024-03-04refactor: apply suggestions from code reviewJames Elliott
Per our standard review process this adjusts the appropriate elements detected during the review. Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2024-03-04build(deps): use go.uber.org/mockJames Elliott
Use the new go.uber.org/mock which is currently maintained. Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2024-02-19ci: remove container read-only mounts (#6709)Amir Zarrinkafsh
* ci: remove container read-only mounts Signed-off-by: Amir Zarrinkafsh <nightah@me.com> * refactor: linting updates Signed-off-by: Amir Zarrinkafsh <nightah@me.com> --------- Signed-off-by: Amir Zarrinkafsh <nightah@me.com>
2023-10-08refactor: clock newups (#6101)James Elliott
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-10-08refactor: clock package (#6100)James Elliott
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-09-17test: misc lint updates (#6004)James Elliott
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-09-03docs: jsonschema (#5493)James Elliott
Adds a JSON Schema for the configuration, user database, and most exports. Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-06-18feat(authentication): ldap memberof group search (#5418)James Elliott
Introduces the concept of group search mode into the LDAP configuration. This also adds the filter and memberof search modes. The full description of these is included in the docs but the filter mode is the same mode as previous which is also the default and recommended value. The memberof mode should only be used by users who are aware of how the concept works as per the docs. Closes #2161 Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-05-25test(authentication): add missing type tests (#5483)James Elliott
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-05-25test(authentication): add missing tests (#5482)James Elliott
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-05-24test(authentication): file provider (#5473)James Elliott
Add additional tests to the file provider. Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-05-07feat(authentication): suport ldap over unix socket (#5397)James Elliott
This adds support for LDAP unix sockets using the ldapi scheme. In addition it improves all of the address related parsing significantly deprecating old options. Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-05-06build(deps): update module github.com/go-ldap/ldap/v3 to b50d289 (#5396)James Elliott
This fixes various issues. Fixes #4199 Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-04-15refactor(authentication): remove deprecated func (#5246)James Elliott
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-04-14refactor: misc out of band changes (#5238)James Elliott
This just implements some changes from feat-settings-ui that are out of scope. Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-01-25feat(server): customizable authz endpoints (#4296)James Elliott
This allows users to customize the authz endpoints. Closes #2753, Fixes #3716 Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2022-12-22docs: fix misc mistakes and adjust placeholders (#4614)James Elliott
2022-12-21feat(authentication): ldap time replacements (#4483)James Elliott
This adds and utilizes several time replacements for both specialized LDAP implementations. Closes #1964, Closes #1284
2022-12-17refactor: const int type stringers (#4588)James Elliott
2022-12-05build(deps): update module github.com/go-crypt/crypt to v0.2.2 (#4452)James Elliott
2022-10-28fix(authentication): erroneously escaped group base dn (#4288)James Elliott
The BaseDN for groups was escaped improperly and failed on any BaseDN with special characters. This fixes the issue.
2022-10-23refactor: update users_database examples (#4240)James Elliott
2022-10-21feat(configuration): mtls clients (#4221)James Elliott
This implements mTLS support for LDAP, Redis, and SMTP. Specified via the tls.certificate_chain and tls.private_key options. Closes #4044
2022-10-18feat(authentication): file case-insensitive and email search (#4194)James Elliott
This allows both case-insensitive and email searching for the file auth provider. Closes #3383
2022-10-18feat(authentication): disabled users in yaml file (#4193)James Elliott
Allows setting users as disabled.
2022-10-17feat(authentication): file provider hot reload (#4188)James Elliott
This adds hot reloading to the file auth provider.
2022-10-17feat(authentication): file password algorithms (#3848)James Elliott
This adds significant enhancements to the file auth provider including multiple additional algorithms.
2022-10-05refactor: any (#4133)James Elliott
* refactor: any * refactor: fix test
2022-10-02feat(authentication): permit feature detection failures (#4061)James Elliott
This adds a configuration option which permits the failure of feature detection (control type OIDs and extension OIDs).
2022-07-26fix(handlers): consent session prevents standard flow (#3668)James Elliott
This fixes an issue where consent sessions prevent the standard workflow.
2022-07-18fix(notification): incorrect date header format (#3684)James Elliott
* fix(notification): incorrect date header format The date header in the email envelopes was incorrectly formatted missing a space between the `Date:` header and the value of this header. This also refactors the notification templates system allowing people to manually override the envelope itself. * test: fix tests and linting issues * fix: misc issues * refactor: misc refactoring * docs: add example for envelope with message id * refactor: organize smtp notifier * refactor: move subject interpolation * refactor: include additional placeholders * docs: fix missing link * docs: gravity * fix: rcpt to command * refactor: remove mid * refactor: apply suggestions Co-authored-by: Amir Zarrinkafsh <nightah@me.com> * refactor: include pid Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2022-06-28feat(configuration): automatically map old keys (#3199)James Elliott
This performs automatic remapping of deprecated configuration keys in most situations.
2022-06-21fix(authentication): poorly formatted log message (#3563)James Elliott
This fixes an issue with a log format for LDAP.
2022-06-17feat(authentication): unauthenticated ldap bind (#3291)James Elliott
This allows configuring unauthenticated LDAP binding.
2022-06-14fix(handler): oidc two factor handling (#3512)James Elliott
2022-06-02fix(commands): hash-password usage instructions (#3437)James Elliott
This fixes the hash-password usage instructions and ensures it uses mostly a configuration source based config. In addition it updates our recommended argon2id parameters with the RFC recommendations.
2022-05-15fix(authentication): err when user/display name same ldap attribute (#3364)James Elliott
This fixes an issue when both the username and display name attributes are the same. If the username attribute is the same as the display name attribute previously we only set the display name profile value which is incorrect. We should set the username profile value instead and allow the display name to be blank.
2022-05-10fix(authentication): utilize msad password history control (#3256)James Elliott
This fixes an issue where the Microsoft Active Directory Server Policy Hints control was not being used to prevent avoidance of the PSO / FGPP applicable to the user.