[TUTO] [Docker] Authelia : serveur d'authentification

[MilesTEG1]

Le 25/07/2021 à 00:54, .Shad. a dit :

6-C-3-b. log_level

log_level: info

Par défaut, le réglage se situe sur debug, qui est déjà très verbeux (trace est encore pire). Je vous conseille de passer sur info et éventuellement switcher sur debug en cas de problème.

Hello @.Shad.
Je suis en train de mettre en place authelia, et le fichier de configuration semble avoir quelque peu changé ^^

Le log_level n'est plus, bienvenue au log:                 level: info

 

 

Voilà le fichier de configuration que j'ai obtenu ce soir :
 

# yamllint disable rule:comments-indentation
---
###############################################################################
#                           Authelia Configuration                            #
###############################################################################

## Note: the container by default expects to find this file at /config/configuration.yml.

## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to
## the system certificates store.
## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem.
# certificates_directory: /config/certificates/

## The theme to display: light, dark, grey, auto.
theme: dark

## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be
## set using a secret: https://www.authelia.com/c/secrets
jwt_secret: a_very_important_secret

## Default redirection URL
##
## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end
## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use
## in such a case.
##
## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
default_redirection_url: https://home.example.com/

## Set the default 2FA method for new users and for when a user has a preferred method configured that has been
## disabled. This setting must be a method that is enabled.
## Options are totp, webauthn, mobile_push.
default_2fa_method: ""

##
## Server Configuration
##
server:

  ## The address to listen on.
  host: 0.0.0.0

  ## The port to listen on.
  port: 9091

  ## Set the single level path Authelia listens on.
  ## Must be alphanumeric chars and should not contain any slashes.
  path: "authelia"

  ## Set the path on disk to Authelia assets.
  ## Useful to allow overriding of specific static assets.
  # asset_path: /config/assets/

  ## Enables the pprof endpoint.
  enable_pprof: false

  ## Enables the expvars endpoint.
  enable_expvars: false

  ## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0.
  ## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist.
  disable_healthcheck: false

  ## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour.
  tls:
    ## The path to the DER base64/PEM format private key.
    key: ""

    ## The path to the DER base64/PEM format public certificate.
    certificate: ""

    ## The list of certificates for client authentication.
    client_certificates: []

  ## Server headers configuration/customization.
  headers:

    ## The CSP Template. Read the docs.
    csp_template: ""

  ## Server Buffers configuration.
  # buffers:

    ## Buffers usually should be configured to be the same value.
    ## Explanation at https://www.authelia.com/c/server#buffer-sizes
    ## Read buffer size adjusts the server's max incoming request size in bytes.
    ## Write buffer size does the same for outgoing responses.

    ## Read buffer.
    # read: 4096

    ## Write buffer.
    # write: 4096

  ## Server Timeouts configuration.
  # timeouts:

    ## Read timeout.
    # read: 2s

    ## Write timeout.
    # write: 2s

    ## Idle timeout.
    # idle: 30s

##
## Log Configuration
##
log:
  ## Level of verbosity for logs: info, debug, trace.
  level: debug

  ## Format the logs are written as: json, text.
  # format: json

  ## File path where the logs will be written. If not set logs are written to stdout.
  # file_path: /config/authelia.log

  ## Whether to also log to stdout when a log_file_path is defined.
  # keep_stdout: false

##
## Telemetry Configuration
##
telemetry:

  ##
  ## Metrics Configuration
  ##
  metrics:
    ## Enable Metrics.
    enabled: false

    ## The address to listen on for metrics. This should be on a different port to the main server.port value.
    address: tcp://0.0.0.0:9959

    ## Metrics Server Buffers configuration.
    # buffers:

      ## Read buffer.
      # read: 4096

      ## Write buffer.
      # write: 4096

    ## Metrics Server Timeouts configuration.
    # timeouts:

      ## Read timeout.
      # read: 2s

      ## Write timeout.
      # write: 2s

      ## Idle timeout.
      # idle: 30s

##
## TOTP Configuration
##
## Parameters used for TOTP generation.
totp:
  ## Disable TOTP.
  disable: false

  ## The issuer name displayed in the Authenticator application of your choice.
  issuer: authelia.com

  ## The TOTP algorithm to use.
  ## It is CRITICAL you read the documentation before changing this option:
  ## https://www.authelia.com/c/totp#algorithm
  algorithm: sha1

  ## The number of digits a user has to input. Must either be 6 or 8.
  ## Changing this option only affects newly generated TOTP configurations.
  ## It is CRITICAL you read the documentation before changing this option:
  ## https://www.authelia.com/c/totp#digits
  digits: 6

  ## The period in seconds a one-time password is valid for.
  ## Changing this option only affects newly generated TOTP configurations.
  period: 30

  ## The skew controls number of one-time passwords either side of the current one that are valid.
  ## Warning: before changing skew read the docs link below.
  skew: 1
  ## See: https://www.authelia.com/c/totp#input-validation to read
  ## the documentation.

  ## The size of the generated shared secrets. Default is 32 and is sufficient in most use cases, minimum is 20.
  secret_size: 32

##
## WebAuthn Configuration
##
## Parameters used for WebAuthn.
webauthn:
  ## Disable Webauthn.
  disable: false

  ## Adjust the interaction timeout for Webauthn dialogues.
  timeout: 60s

  ## The display name the browser should show the user for when using Webauthn to login/register.
  display_name: Authelia

  ## Conveyance preference controls if we collect the attestation statement including the AAGUID from the device.
  ## Options are none, indirect, direct.
  attestation_conveyance_preference: indirect

  ## User verification controls if the user must make a gesture or action to confirm they are present.
  ## Options are required, preferred, discouraged.
  user_verification: preferred

##
## Duo Push API Configuration
##
## Parameters used to contact the Duo API. Those are generated when you protect an application of type
## "Partner Auth API" in the management panel.
duo_api:
  disable: false
  hostname: api-123456789.example.com
  integration_key: ABCDEF
  ## Secret can also be set using a secret: https://www.authelia.com/c/secrets
  secret_key: 1234567890abcdefghifjkl
  enable_self_enrollment: false

##
## NTP Configuration
##
## This is used to validate the servers time is accurate enough to validate TOTP.
ntp:
  ## NTP server address.
  address: "time.cloudflare.com:123"

  ## NTP version.
  version: 4

  ## Maximum allowed time offset between the host and the NTP server.
  max_desync: 3s

  ## Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you
  ## set this to true, and can operate in a truly offline mode.
  disable_startup_check: false

  ## The default of false will prevent startup only if we can contact the NTP server and the time is out of sync with
  ## the NTP server more than the configured max_desync. If you set this to true, an error will be logged but startup
  ## will continue regardless of results.
  disable_failure: false

##
## Authentication Backend Provider Configuration
##
## Used for verifying user passwords and retrieve information such as email address and groups users belong to.
##
## The available providers are: `file`, `ldap`. You must use only one of these providers.
authentication_backend:

  ## Password Reset Options.
  password_reset:
    ## Disable both the HTML element and the API for reset password functionality.
    disable: false

    ## External reset password url that redirects the user to an external reset portal. This disables the internal reset
    ## functionality.
    custom_url: ""

  ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.
  ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
  ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
  ## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
  ## See the below documentation for more information.
  ## Duration Notation docs:  https://www.authelia.com/c/common#duration-notation-format
  ## Refresh Interval docs: https://www.authelia.com/c/1fa#refresh-interval
  refresh_interval: 5m

  ##
  ## LDAP (Authentication Provider)
  ##
  ## This is the recommended Authentication Provider in production
  ## because it allows Authelia to offload the stateful operations
  ## onto the LDAP service.
  ldap:
    ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
    ## Acceptable options are as follows:
    ## - 'activedirectory' - For Microsoft Active Directory.
    ## - 'custom' - For custom specifications of attributes and filters.
    ## This currently defaults to 'custom' to maintain existing behaviour.
    ##
    ## Depending on the option here certain other values in this section have a default value, notably all of the
    ## attribute mappings have a default value that this config overrides, you can read more about these default values
    ## at https://www.authelia.com/c/ldap#defaults
    implementation: custom

    ## The url to the ldap server. Format: <scheme>://<address>[:<port>].
    ## Scheme can be ldap or ldaps in the format (port optional).
    url: ldap://127.0.0.1

    ## The dial timeout for LDAP.
    timeout: 5s

    ## Use StartTLS with the LDAP connection.
    start_tls: false

    tls:
      ## Server Name for certificate validation (in case it's not set correctly in the URL).
      # server_name: ldap.example.com

      ## Skip verifying the server certificate (to allow a self-signed certificate).
      ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
      ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
      skip_verify: false

      ## Minimum TLS version for either Secure LDAP or LDAP StartTLS.
      minimum_version: TLS1.2

    ## The distinguished name of the container searched for objects in the directory information tree.
    ## See also: additional_users_dn, additional_groups_dn.
    base_dn: dc=example,dc=com

    ## The attribute holding the username of the user. This attribute is used to populate the username in the session
    ## information. It was introduced due to #561 to handle case insensitive search queries. For you information,
    ## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this
    ## attribute holds the unique identifiers for the users binding the user and the configuration stored in database.
    ## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user
    ## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also
    ## be used but we don't recommend using them, we instead advise to use the attributes mentioned above
    ## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt.
    # username_attribute: uid

    ## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users.
    ## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users.
    additional_users_dn: ou=users

    ## The users filter used in search queries to find the user profile based on input filled in login form.
    ## Various placeholders are available in the user filter which you can read about in the documentation which can
    ## be found at: https://www.authelia.com/c/ldap#users-filter-replacements
    ##
    ## Recommended settings are as follows:
    ## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
    ## - OpenLDAP:
    ##   - (&({username_attribute}={input})(objectClass=person))
    ##   - (&({username_attribute}={input})(objectClass=inetOrgPerson))
    ##
    ## To allow sign in both with username and email, one can use a filter like
    ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
    users_filter: (&({username_attribute}={input})(objectClass=person))

    ## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups.
    ## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups.
    additional_groups_dn: ou=groups

    ## The groups filter used in search queries to find the groups based on relevant authenticated user.
    ## Various placeholders are available in the groups filter which you can read about in the documentation which can
    ## be found at: https://www.authelia.com/c/ldap#groups-filter-replacements
    ##
    ## If your groups use the `groupOfUniqueNames` structure use this instead:
    ##    (&(uniqueMember={dn})(objectClass=groupOfUniqueNames))
    groups_filter: (&(member={dn})(objectClass=groupOfNames))

    ## The attribute holding the name of the group.
    # group_name_attribute: cn

    ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
    ## first one returned by the LDAP server is used.
    # mail_attribute: mail

    ## The attribute holding the display name of the user. This will be used to greet an authenticated user.
    # display_name_attribute: displayName

    ## Follow referrals returned by the server.
    ## This is especially useful for environments where read-only servers exist. Only implemented for write operations.
    permit_referrals: false

    ## The username and password of the admin user.
    user: cn=admin,dc=example,dc=com
    ## Password can also be set using a secret: https://www.authelia.com/c/secrets
    password: password

  ##
  ## File (Authentication Provider)
  ##
  ## With this backend, the users database is stored in a file which is updated when users reset their passwords.
  ## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia
  ## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security
  ## implications it is highly recommended you leave the default values. Before considering changing these settings
  ## please read the docs page below:
  ## https://www.authelia.com/r/passwords#tuning
  ##
  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
  ##
  # file:
  #   path: /config/users_database.yml
  #   password:
  #     algorithm: argon2id
  #     iterations: 1
  #     key_length: 32
  #     salt_length: 16
  #     memory: 1024
  #     parallelism: 8

##
## Password Policy Configuration.
##
password_policy:

  ## The standard policy allows you to tune individual settings manually.
  standard:
    enabled: false

    ## Require a minimum length for passwords.
    min_length: 8

    ## Require a maximum length for passwords.
    max_length: 0

    ## Require uppercase characters.
    require_uppercase: true

    ## Require lowercase characters.
    require_lowercase: true

    ## Require numeric characters.
    require_number: true

    ## Require special characters.
    require_special: true

  ## zxcvbn is a well known and used password strength algorithm. It does not have tunable settings.
  zxcvbn:
    enabled: false

    ## Configures the minimum score allowed.
    min_score: 3

##
## Access Control Configuration
##
## Access control is a list of rules defining the authorizations applied for one resource to users or group of users.
##
## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed
## to anyone. Otherwise restrictions follow the rules defined.
##
## Note: One can use the wildcard * to match any subdomain.
## It must stand at the beginning of the pattern. (example: *.mydomain.com)
##
## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct.
##
## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'.
##
## - 'domain' defines which domain or set of domains the rule applies to.
##
## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not
##    provided. If provided, the parameter represents either a user or a group. It should be of the form
##    'user:<username>' or 'group:<groupname>'.
##
## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'.
##
## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter
##   is optional and matches any resource if not provided.
##
## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.
access_control:
  ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
  ## resource if there is no policy to be applied to the user.
  default_policy: deny

  networks:
    - name: internal
      networks:
        - 10.10.0.0/16
        - 192.168.2.0/24
    - name: VPN
      networks: 10.9.0.0/16

  rules:
    ## Rules applied to everyone
    - domain: 'public.example.com'
      policy: bypass

    ## Domain Regex examples. Generally we recommend just using a standard domain.
    # - domain_regex: '^(?P<User>\w+)\.example\.com$'
    #   policy: one_factor
    # - domain_regex: '^(?P<Group>\w+)\.example\.com$'
    #   policy: one_factor
    # - domain_regex:
    #    - '^appgroup-.*\.example\.com$'
    #    - '^appgroup2-.*\.example\.com$'
    #   policy: one_factor
    # - domain_regex: '^.*\.example\.com$'
    #   policy: two_factor

    - domain: 'secure.example.com'
      policy: one_factor
      ## Network based rule, if not provided any network matches.
      networks:
        - internal
        - VPN
        - 192.168.1.0/24
        - 10.0.0.1

    - domain:
        - 'secure.example.com'
        - 'private.example.com'
      policy: two_factor

    - domain: 'singlefactor.example.com'
      policy: one_factor

    ## Rules applied to 'admins' group
    - domain: 'mx2.mail.example.com'
      subject: 'group:admins'
      policy: deny

    - domain: '*.example.com'
      subject:
        - 'group:admins'
        - 'group:moderators'
      policy: two_factor

    ## Rules applied to 'dev' group
    - domain: 'dev.example.com'
      resources:
        - '^/groups/dev/.*$'
      subject: 'group:dev'
      policy: two_factor

    ## Rules applied to user 'john'
    - domain: 'dev.example.com'
      resources:
        - '^/users/john/.*$'
      subject: 'user:john'
      policy: two_factor

    ## Rules applied to user 'harry'
    - domain: 'dev.example.com'
      resources:
        - '^/users/harry/.*$'
      subject: 'user:harry'
      policy: two_factor

    ## Rules applied to user 'bob'
    - domain: '*.mail.example.com'
      subject: 'user:bob'
      policy: two_factor
    - domain: 'dev.example.com'
      resources:
        - '^/users/bob/.*$'
      subject: 'user:bob'
      policy: two_factor

##
## Session Provider Configuration
##
## The session cookies identify the user once logged in.
## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined.
session:
  ## The name of the session cookie.
  name: authelia_session

  ## The domain to protect.
  ## Note: the authenticator must also be in that domain.
  ## If empty, the cookie is restricted to the subdomain of the issuer.
  domain: example.com

  ## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
  ## Please read https://www.authelia.com/c/session#same_site
  same_site: lax

  ## The secret to encrypt the session data. This is only used with Redis / Redis Sentinel.
  ## Secret can also be set using a secret: https://www.authelia.com/c/secrets
  secret: insecure_session_secret

  ## The value for expiration, inactivity, and remember_me_duration are in seconds or the duration notation format.
  ## See: https://www.authelia.com/c/common#duration-notation-format
  ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure
  ## because a stolen cookie will last longer giving attackers more time to spy or attack.

  ## The time before the cookie expires and the session is destroyed if remember me IS NOT selected.
  expiration: 1h

  ## The inactivity time before the session is reset. If expiration is set to 1h, and this is set to 5m, if the user
  ## does not select the remember me option their session will get destroyed after 1h, or after 5m since the last time
  ## Authelia detected user activity.
  inactivity: 5m

  ## The time before the cookie expires and the session is destroyed if remember me IS selected.
  ## Value of -1 disables remember me.
  remember_me_duration: 1M

  ##
  ## Redis Provider
  ##
  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
  ##
  redis:
    host: 127.0.0.1
    port: 6379
    ## Use a unix socket instead
    # host: /var/run/redis/redis.sock

    ## Username used for redis authentication. This is optional and a new feature in redis 6.0.
    # username: authelia

    ## Password can also be set using a secret: https://www.authelia.com/c/secrets
    password: authelia

    ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
    database_index: 0

    ## The maximum number of concurrent active connections to Redis.
    maximum_active_connections: 8

    ## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
    minimum_idle_connections: 0

    ## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).
    # tls:
      ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
      # server_name: myredis.example.com

      ## Skip verifying the server certificate (to allow a self-signed certificate).
      ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
      ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
      # skip_verify: false

      ## Minimum TLS version for the connection.
      # minimum_version: TLS1.2

    ## The Redis HA configuration options.
    ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
    # high_availability:
      ## Sentinel Name / Master Name.
      # sentinel_name: mysentinel

      ## Specific username for Redis Sentinel. The node username and password is configured above.
      # sentinel_username: sentinel_specific_user

      ## Specific password for Redis Sentinel. The node username and password is configured above.
      # sentinel_password: sentinel_specific_pass

      ## The additional nodes to pre-seed the redis provider with (for sentinel).
      ## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
      ## For high availability to be used you must have either defined; the host above or at least one node below.
      # nodes:
      #   - host: sentinel-node1
      #     port: 6379
      #   - host: sentinel-node2
      #     port: 6379

      ## Choose the host with the lowest latency.
      # route_by_latency: false

      ## Choose the host randomly.
      # route_randomly: false

##
## Regulation Configuration
##
## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are made
## in a short period of time.
regulation:
  ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
  max_retries: 3

  ## The time range during which the user can attempt login before being banned. The user is banned if the
  ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
  ## See: https://www.authelia.com/c/common#duration-notation-format
  find_time: 2m

  ## The length of time before a banned user can login again. Ban Time accepts duration notation.
  ## See: https://www.authelia.com/c/common#duration-notation-format
  ban_time: 5m

##
## Storage Provider Configuration
##
## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
storage:
  ## The encryption key that is used to encrypt sensitive information in the database. Must be a string with a minimum
  ## length of 20. Please see the docs if you configure this with an undesirable key and need to change it.
  # encryption_key: you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this

  ##
  ## Local (Storage Provider)
  ##
  ## This stores the data in a SQLite3 Database.
  ## This is only recommended for lightweight non-stateful installations.
  ##
  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
  ##
  # local:
  #   path: /config/db.sqlite3

  ##
  ## MySQL / MariaDB (Storage Provider)
  ##
  mysql:
    host: 127.0.0.1
    port: 3306
    database: authelia
    username: authelia
    ## Password can also be set using a secret: https://www.authelia.com/c/secrets
    password: mypassword
    timeout: 5s

  ##
  ## PostgreSQL (Storage Provider)
  ##
  # postgres:
  #   host: 127.0.0.1
  #   port: 5432
  #   database: authelia
  #   schema: public
  #   username: authelia
  #   ## Password can also be set using a secret: https://www.authelia.com/c/secrets
  #   password: mypassword
  #   timeout: 5s
  #   ssl:
  #     mode: disable
  #     root_certificate: disable
  #     certificate: disable
  #     key: disable

##
## Notification Provider
##
## Notifications are sent to users when they require a password reset, a Webauthn registration or a TOTP registration.
## The available providers are: filesystem, smtp. You must use only one of these providers.
notifier:
  ## You can disable the notifier startup check by setting this to true.
  disable_startup_check: false

  ##
  ## File System (Notification Provider)
  ##
  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
  ##
  # filesystem:
  #   filename: /config/notification.txt

  ##
  ## SMTP (Notification Provider)
  ##
  ## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate.
  ## [Security] By default Authelia will:
  ##   - force all SMTP connections over TLS including unauthenticated connections
  ##      - use the disable_require_tls boolean value to disable this requirement
  ##        (only works for unauthenticated connections)
  ##   - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates
  ##     (configure in tls section)
  smtp:
    ## The SMTP host to connect to.
    host: 127.0.0.1

    ## The port to connect to the SMTP host on.
    port: 1025

    ## The connection timeout.
    timeout: 5s

    ## The username used for SMTP authentication.
    username: test

    ## The password used for SMTP authentication.
    ## Can also be set using a secret: https://www.authelia.com/c/secrets
    password: password

    ## The sender is used to is used for the MAIL FROM command and the FROM header.
    ## If this is not defined and the username is an email, we use the username as this value. This can either be just
    ## an email address or the RFC5322 'Name <email address>' format.
    sender: "Authelia <admin@example.com>"

    ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.
    identifier: localhost

    ## Subject configuration of the emails sent. {title} is replaced by the text from the notifier.
    subject: "[Authelia] {title}"

    ## This address is used during the startup check to verify the email configuration is correct.
    ## It's not important what it is except if your email server only allows local delivery.
    startup_check_address: test@authelia.com

    ## By default we require some form of TLS. This disables this check though is not advised.
    disable_require_tls: false

    ## Disables sending HTML formatted emails.
    disable_html_emails: false

    tls:
      ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
      # server_name: smtp.example.com

      ## Skip verifying the server certificate (to allow a self-signed certificate).
      ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
      ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
      skip_verify: false

      ## Minimum TLS version for either StartTLS or SMTPS.
      minimum_version: TLS1.2

##
## Identity Providers
##
# identity_providers:

  ##
  ## OpenID Connect (Identity Provider)
  ##
  ## It's recommended you read the documentation before configuration of this section:
  ## https://www.authelia.com/c/oidc
  # oidc:
    ## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens).
    ## HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets
    # hmac_secret: this_is_a_secret_abc123abc123abc

    ## The issuer_private_key is used to sign the JWT forged by OpenID Connect.
    ## Issuer Private Key can also be set using a secret: https://www.authelia.com/c/secrets
    # issuer_private_key: |
    #   -----BEGIN RSA PRIVATE KEY-----
    #   MXIEogIB$AKCAQEAxZVJP3WF//PG2fLQoEC9DtdiFG/+00vqlbVzz47nyxKONIPI
    #   lmL3UdmqpGTKMe/5Brqse4ZAKlQHiDbwzK9ypnfigtHuvh/JO0S7ChP70RC67ed1
    #   HV1nyfz5eW3llbtGJPrlYLqITNgctHp6zmRUFtSzPj9qFvozI93LJi492yL1+vu8
    #   Un3Dm8+Qq6XM2tPdEcldB/dtBwOWoF+8eOOVsu0TDuB5bwlhBVGJuSAuzBPRS2bF
    #   Ga4uk0JDdkDOMCEQxC5uWDFxgfERSMFyfLVWD47woDbuWEBq10c0z+dpWPMp7Ain
    #   YnnkqicwCN88Z0zid6MmMQ65F4+9Hc+qC/p6xwIDAQABAoIBAGlhaAHKor+Su3o/
    #   AXqXTL5/rbYMzbLQiLt0XeJT69jpeqMTroZXHmWvXE3128mqnf0yzw/K2Ko6yxGh
    #   i+j/onya8FqpsVYCCgfsbn2/js1AyRJeIp6Y1ORsYnqbXJnxmkXa80AV/OBPW2/+
    #   60TtSdQrebY3iFPc+i2k+9bPTvpyyDLKlz8UwdZG+k5uyYNIyQTccz+PjwsIvDij
    #   7tKYamhhLN3QXt3/aZTFpjTgezP4WyriZxjWrddHowc47q2rwNS95ND39JcysJAc
    #   0Pcbu8A5lVa7Fx33uOtzDfKWIW7xVEN+OtPgN+FbTjXcXk5IZedl+pW5lU5P++G/
    #   ZPvz+WECgYEA9g6HwdODW3e68bOqsFoKg35+vfUFMzlyMF8HFylNVfnLpTEDr637
    #   owzMFvcUxVd71b+gV5nnnbI+riUFIgyR8vhCjhy4moopDPahC4/KwN4NG6uz+i1h
    #   AB6D5+zn2BjnO/5xMMFGlApWtRNmJVGYlNDj3bXKh2VXzzy03VNeD8kCgYEAzZFL
    #   OlzoRB1HKpTWIECcuvxofMxLOLb3zs0k2t/FYNYIpovmGWCCAULz13y53e5+/+5m
    #   7I9VUZJFaIhaZ36qVBApCKdru69pZMkWCcQO9jELFcx51Ez7OgJWzu7GS1QJCPKC
    #   fEDxI0rZK21j93/Sl/nUnEir7CYpQ+wvCaGuHg8CgYAXgbncfY1+DokwkB6NbHy2
    #   pT4Mfbz6cNGE538w6kQ2I4AeDvmwLentYMqaow478CinegAiflSPTzkHwAemghbr
    #   ZGZPV1UXhn13fJRUG2+eT1hnPVcbXnx223N0k8Bud6qXo65CnyRT/kzcTbcjd5Eh
    #   Hne2daicmMTzynPo9Q72aQKBgBmobO9X8VWvIdbaxO85oVZlctVA2pK1o7CYQmVf
    #   UM+JZ4MCKzI3rYJizPS0iK5+ujNPmmEkcs2/qBIoEsCgOrpLWhPOcc/3UPxXbPzD
    #   D+sCrBOIdhxdj23qJNOnUfDNCGOpgUfpAzAYg4q8GKInvi1h7XukRnEvQi9MJ4LY
    #   P1dZAoGASGcGnTMkmeSXP8ux+dvQJAiJskn/sJIgBZ5uq5GRCeLBUosRSVxM75UK
    #   vAh/c/RBj+pYXVKuPuHGZCQJxsdcRXzXNGouUtgbaYML5Me/Hagt20QzDRBfuGBg
    #   qeZBJaXhjElvw6PUWtg4x+LYRCBpq/bS3LK3ozZrSTukVkKDegw=
    #   -----END RSA PRIVATE KEY-----

    ## The lifespans configure the expiration for these token types.
    # access_token_lifespan: 1h
    # authorize_code_lifespan: 1m
    # id_token_lifespan: 1h
    # refresh_token_lifespan: 90m

    ## Enables additional debug messages.
    # enable_client_debug_messages: false

    ## SECURITY NOTICE: It's not recommended changing this option and values below 8 are strongly discouraged.
    # minimum_parameter_entropy: 8

    ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it set to 'never'
    ## for security reasons.
    # enforce_pkce: public_clients_only

    ## Cross-Origin Resource Sharing (CORS) settings.
    # cors:
      ## List of endpoints in addition to the metadata endpoints to permit cross-origin requests on.
      # endpoints:
      #    - authorization
      #    - token
      #    - revocation
      #    - introspection
      #    - userinfo

      ## List of allowed origins.
      ## Any origin with https is permitted unless this option is configured or the
      ## allowed_origins_from_client_redirect_uris option is enabled.
      # allowed_origins:
      #   - https://example.com

      ## Automatically adds the origin portion of all redirect URI's on all clients to the list of allowed_origins,
      ## provided they have the scheme http or https and do not have the hostname of localhost.
      # allowed_origins_from_client_redirect_uris: false

    ## Clients is a list of known clients and their configuration.
    # clients:
      # -
        ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
        # id: myapp

        ## The description to show to users when they end up on the consent screen. Defaults to the ID above.
        # description: My Application

        ## The client secret is a shared secret between Authelia and the consumer of this client.
        # secret: this_is_a_secret

        ## Sector Identifiers are occasionally used to generate pairwise subject identifiers. In most cases this is not
        ## necessary. Read the documentation for more information.
        ## The subject identifier must be the host component of a URL, which is a domain name with an optional port.
        # sector_identifier: example.com

        ## Sets the client to public. This should typically not be set, please see the documentation for usage.
        # public: false

        ## The policy to require for this client; one_factor or two_factor.
        # authorization_policy: two_factor

        ## By default users cannot remember pre-configured consents. Setting this value to a period of time using a
        ## duration notation will enable users to remember consent for this client. The time configured is the amount
        ## of time the pre-configured consent is valid for granting new authorizations to the user.
        # pre_configured_consent_duration:

        ## Audience this client is allowed to request.
        # audience: []

        ## Scopes this client is allowed to request.
        # scopes:
          # - openid
          # - groups
          # - email
          # - profile

        ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
        # redirect_uris:
        # - https://oidc.example.com:8080/oauth2/callback

        ## Grant Types configures which grants this client can obtain.
        ## It's not recommended to define this unless you know what you're doing.
        # grant_types:
          # - refresh_token
          # - authorization_code

        ## Response Types configures which responses this client can be sent.
        ## It's not recommended to define this unless you know what you're doing.
        # response_types:
          # - code

        ## Response Modes configures which response modes this client supports.
        # response_modes:
          # - form_post
          # - query
          # - fragment

        ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
        # userinfo_signing_algorithm: none
...

 

Chose étrange, j'ai trois points à la fin du fichier, c'est normal ça ?

Le 25/07/2021 à 00:54, .Shad. a dit :

6-C-3-d. default_redirection_url

default_redirection_url: https://ndd.tld

Authelia est directement accessible par proxy inversé, c'est un des templates de fichier conf de SWAG.
Lorsque vous vous identifierez sur cette page, vous serez redirigé vers la page définie par default_redirection_url.

Pour ça, je n'ai pas saisi quelle URL je vais devoir mettre...

 

[MilesTEG1]

Le 25/07/2021 à 00:54, .Shad. a dit :

rules:
 # Bypass 2FA when connected to VPN on pfSense or being connected to the LAN
 - domain:
   - ndd.tld
   - "*.ndd.tld"
   policy: bypass
   networks:
   - local
   - openvpn

 

Petite erreur ici, il manque l'indentation pour les networks :

rules:
 # Bypass 2FA when connected to VPN on pfSense or being connected to the LAN
 - domain:
   - ndd.tld
   - "*.ndd.tld"
   policy: bypass
   networks:
     - local
     - openvpn

 

Le 25/07/2021 à 00:54, .Shad. a dit :

6-C-3-g. session

session:
  ## The name of the session cookie.
  name: authelia_session
  [...]
  domain: ndd.tld

On pensera à renseigner le domaine racine qu'on souhaite protéger dans la valeur de la clé domain.
ATTENTION : Authelia ne peut pas protéger plusieurs domaines racines simultanément.

Pour cette partie, mon domaine racine ne pointe sur rien du tout...
ça me fait une erreur 404 (personnalisée ^^) :

 

Dernière chose pour ce soir :

en ce qui concerne les rules pour le access_control, les services que je ne laisse en accès que via le LAN ou le VPN, je n'ai pas besoin de les mettre dedans non ? (à moins que je veuille avoir du 2FA depuis le LAN/VPN)

Et enfin, si je n'active pas les lignes suivantes dans mes fichiers nginx/site-confs/blabla.conf, on est d'accord que authelia ne s'appliquera pas et que je peux activer sur un sous-domaine pour voir si ça fonctionne bien comme il faut avant de généraliser ?
r

Dans cette capture (fichier pour dashy), j'ai restreint l'accès aux seules IP LAN et VPN via le fichier ACL.IP-LAN.conf que j'inclu. Voilà ce fichier :

## ACL.IP-LAN.conf
# For my Synology DSM, I created an Access Control Profiles to restrict access only to LAN and VPN IP adresses
# This Access Control Profile is a file in the /etc/nginx/conf.d folder
# But for SWAG-Nginx, it must be with another file.

# Allow all from LAN IPs
allow 192.168.2.0/24;

# Allow all from VPNs IPs
allow 192.168.10.0/24;
allow 192.168.11.0/24;

# Deny all
deny all;

 

[.Shad.]

@MilesTEG1 Merci pour la remarque, j'avais màj mon fichier mais oublié de màj le tuto, c'est réparé. 🙂 

Il y a 15 heures, MilesTEG1 a dit :

Chose étrange, j'ai trois points à la fin du fichier, c'est normal ça ?

Oui en yaml :

Citation

YAML uses three dashes (“---”) to separate documents within a stream. Three dots ( “...”) indicate the end of a document without starting a new one, for use in communication channels. Comment lines begin with the Octothorpe (also called “hash”, “sharp”, or “number sign” - “#”).

tiré de yaml.org directement.

Il y a 15 heures, MilesTEG1 a dit :

Pour ça, je n'ai pas saisi quelle URL je vais devoir mettre...

Une site vers lequel tu renvoies l'utilisateur au cas où le proxy inversé n'aurait nulle part vers où renvoyer derrière, ou si tu demandes authelia.ndd.tld par exemple.

Il y a 15 heures, MilesTEG1 a dit :

Pour cette partie, mon domaine racine ne pointe sur rien du tout...

Je ne pense pas que ça ait d'importance, Authelia doit savoir quel domaine il est sensé protéger, il ne peut pas protéger plusieurs domaines simultanément (tu pourrais avoir plusieurs ndd qui servent ton réseau).

Pour ta question concernant les accès locaux, oui tu peux désactiver authelia via le fichier conf de SWAG et ajouter des règles dans nginx, mais est-ce que traiter indifféremment les entrées de proxy pour LAN uniquement ou LAN/WAN et se contenter d'ajouter simplement un bloc de rules dans Authelia n'est pas plus simple ? Moi je trouve que si.

[MilesTEG1]

@.Shad. Ok pour le YAML, je ne connaissais pas ces subtilités ^^

Il y a 7 heures, .Shad. a dit :

Une site vers lequel tu renvoies l'utilisateur au cas où le proxy inversé n'aurait nulle part vers où renvoyer derrière, ou si tu demandes authelia.ndd.tld par exemple.

Ok, à voir ce que je mets du coup... peut-être un ndd qui n'existe pas 🙂 ou une page d'erreur 403.

 

Il y a 7 heures, .Shad. a dit :

Je ne pense pas que ça ait d'importance, Authelia doit savoir quel domaine il est sensé protéger, il ne peut pas protéger plusieurs domaines simultanément (tu pourrais avoir plusieurs ndd qui servent ton réseau).

Pour ta question concernant les accès locaux, oui tu peux désactiver authelia via le fichier conf de SWAG et ajouter des règles dans nginx, mais est-ce que traiter indifféremment les entrées de proxy pour LAN uniquement ou LAN/WAN et se contenter d'ajouter simplement un bloc de rules dans Authelia n'est pas plus simple ? Moi je trouve que si.

C'est pas très clair ce dont tu parles...

Le fichier conf de SWAG ? tu parles duquel ? de configuration.yml pour authelia ?
Pour les règles dans nginx, tu parles de nginx.conf ?

En gros, mes fichiers d'entrées de reverse proxy sont dans : nginx/site-confs/service.subdomain.conf
Pour certains je n'autorise l'accès qu'en local ou via le VPN, via l'ajout de ceci :

# Allow all from LAN IPs
allow 192.168.2.0/24;

# Allow all from VPNs IPs
allow 192.168.10.0/24;
allow 192.168.11.0/24;

# Deny all
deny all;

Ces mêmes entrées de reverse proxy seront présentes dans le fichier de configuration de authelia : configuration.yml 

  rules:
    ## Rules applied to everyone
    - domain:
      - 'mon-ndd.ovh'
      - "*.mon-nddovh"
      policy: bypass
      networks:
        - local
        - VPN

    # Open public access
    - domain:
      - drive.mon-ndd.ovh
      - files.mon-ndd.ovh
      - photos.mon-ndd.ovh
      - camera.mon-ndd.ovh
      - plex.mon-ndd.ovh
      - vault.mon-ndd.ovh
      - gitea.mon-ndd.ovh
      policy: bypass

    # 2FA for sensitive services
    - domain:
        - 'calibre-web.mon-ndd.ovh'
        - 'dashy.mon-ndd.ovh'
        - 'portainer.mon-ndd.ovh'
      policy: two_factor

Pour le cas de dashy, je ne le laisse accessible qu'en local/VPN.
Si je laisse le configuration.yml avec ce qui précède, et que je ne décommente pas les deux lignes includes suivantes des entrées de reverse proxy, est-ce que ça va fonctionner ?

server {
...
    # enable for Authelia
    #include /config/nginx/authelia-server.conf;
...
    location / {
...
        # enable for Authelia
        #include /config/nginx/authelia-location.conf;
...

 

[.Shad.]

Il y a 13 heures, MilesTEG1 a dit :

Ok, à voir ce que je mets du coup... peut-être un ndd qui n'existe pas 🙂 ou une page d'erreur 403.

Google ça marche aussi.
Ou www.perdu.com

Concernant les règles d'accès, ce que je veux dire c'est qu'autant tout laisser dans Authelia plutôt que de mettre des règles dans Nginx ET dans Authelia. Si tu enlèves dashy.ndd.ovh de ton fichier de conf, ça revient à faire ce que tu veux, seuls les accès locaux et vpn seront autorisés (ton premier bloc de règles).

[lacasa]

Hello,

Le but serait de mettre les containers docker de Komga et Authelia en phase pour que le LDAP derrière Authelia servent les comptes à Komga.

Il s'agit de configurer le paramètre issuer_private_key  dans identity_providers.oidc ... mais il me résiste !

 

je tourne en boucle entre 2 erreurs :

1 :

identity_providers:
  oidc:
    ## a Random Alphanumeric String with 64 or more characters ; hmac_secret : required
    hmac_secret: this_is_a_secret_abc123XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXanonymisation
    issuer_private_key: IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY

 

qui donne :

time="2023-01-08T17:55:21+01:00" level=error msg="Configuration: secrets: error loading secret into key 'identity_providers.oidc.issuer_private_key': it's already defined in other configuration sources"

time="2023-01-08T17:55:21+01:00" level=fatal msg="Can't continue due to the errors loading the configuration"

2 :

Ou bien en commentant issuer_private_key ... qui est "required" donc cette piste est plus un test en pure perte à priori.

identity_providers:
  oidc:
    ## a Random Alphanumeric String with 64 or more characters ; hmac_secret : required
    hmac_secret: this_is_a_secret_abc123XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXanonymisation
    # issuer_private_key: IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY

 

qui donne :

time="2023-01-08T18:04:41+01:00" level=error msg="could not import certificate key_library.pem" stack="github.com/spf13/cobra@v1.5.0/command.go:876            (*Command).execute\ngithub.com/spf13/cobra@v1.5.0/command.go:990            (*Command).ExecuteC\ngithub.com/spf13/cobra@v1.5.0/command.go:918            (*Command).Execute\ngithub.com/authelia/authelia/v4/cmd/authelia/main.go:10 main\nruntime/proc.go:250                                     main\nruntime/asm_amd64.s:1571  

 

comment faut il valoriser ce paramètre ?

[.Shad.]

Pour l'erreur 1, est-ce que tu as testé de mettre le hmac_secret dans un fichier aux droits d'accès limités comme pour les autres clés ?

   - AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE=/config/secrets/oidc

Pour les secrets c'est ici : https://www.authelia.com/configuration/methods/secrets/

Et du coup ne rien mettre en regard de hmac_secret dans le fichier de configuration ? le message laisse supposer que tu l'as défini aux deux endroits.

Erreur 2, a priori le hmac_secret est bien importé, mais comment savoir dans quel ordre les données sont traitées, l'erreur 1 aurait peut-être pu surgir juste après.

[lacasa]

bon j'ai arrêté d'utiliser un secret et j'ai mis le certificat directement dans la configuration d'Authelia et c'est OK.

enfin, "ok", ... je suis à l'erreur suivante.

 

komga  | org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'securityConfiguration' defined in file [/app/BOOT-INF/classes/org/gotson/komga/infrastructure/security/SecurityConfiguration.class]: Unsatisfied dependency expressed through constructor parameter 7; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'clientRegistrationRepository' defined in class path resource [org/springframework/boot/autoconfigure/security/oauth2/client/servlet/OAuth2ClientRegistrationRepositoryConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository]: Factory method 'clientRegistrationRepository' threw exception; nested exception is java.lang.IllegalArgumentException: Unable to resolve Configuration with the provided Issuer of "< là il met bien l'URL d'Authelia" >

 

 

[.Shad.]

C'est moi ou c'est dans Komga cette erreur ? Je ne connais pas l'application désolé, je suis tombé sur ça, j'imagine que toi aussi : https://www.authelia.com/integration/openid-connect/komga/

En dernier recours, tu peux toujours aller sur le Discord d'Authelia, les gars sont très dispos, ils m'ont bien dépanné à l'époque.

[.Shad.]

La version 4.38 pointe le bout de son nez, elle introduit des changements importants, que ce soit au niveau du fichier de configuration ou bien du point de vue des fonctionnalités.

Je vais la tester dans les prochaines semaines et remettre à jour le tutoriel en conséquence.

[Soixante Sept]

Le 18/01/2024 à 11:47 PM, .Shad. a dit :

La version 4.38 pointe le bout de son nez, elle introduit des changements importants, que ce soit au niveau du fichier de configuration ou bien du point de vue des fonctionnalités.

Je vais la tester dans les prochaines semaines et remettre à jour le tutoriel en conséquence.

Bonjour, avez vous pu avancer dans vos tests et la maj du tutoriel, 

merci

[.Shad.]

Hello, en fait la version 4.38 est en beta depuis plus d'un an, je pensais qu'elle sortait en janvier.
Je tiendrai à jour le sujet si ça évolue.

[.Shad.]

@Soixante Sept Donc c'est sorti entre temps 😄 voir ma réponse ici : 

 

[.Shad.]

Refonte du tutoriel prévue pour mi/fin avril, dans la même idée que celle prévue ici. Les deux tutoriels allant de pair.

[MilesTEG1]

Top 🙂 

J'espère pouvoir adapter ton futur tuto à mon installation (Portainer entre-autre) 😀

[.Shad.]

Je voudrais explorer les possibilités d'OIDC (OpenID Connect), que je trouve intéressantes car de plus en plus intégrées nativement aux softwares. La 4.38 introduit des avancées majeures.

J'ai essayé Authentik et un excellent dashboard, mais beaucoup plus lourd à configurer je trouve. Il est clairement adapté à un portail d'entreprise par contre, c'est un bijou de logiciel.

Pour l'implémentation il n'y aura rien de très différent en revanche.

Modifié le 22 mars par .Shad.