This drastically improves the user feedback surrounding rate limited
endpoints displaying information about how long the user should wait.
This also drastically improves the related tooling including adding a
react hook and go funcs to ensure the desired outcome is always
achieved.
This fixes an issue where the resource indicators were not recorded or
granted in any scenario. This is a result of the audience and resource
concepts being partially split in authelia.com/provider/oauth2 v0.3.0.
Fixes#12970
This adapts some of the remaining warning items which were missed in the
v2 to v3 OpenAPI migration as well as a few nuances with the encoding of
certain values.
This change refactors web components to align with React best practices
by replacing `useEffect` with `useMemo` for derived state, consolidating
multiple `useState` hooks into `useReducer` for complex state
management, optimising imports and removing unnecessary dependencies and
simplifying conditional rendering to reduce re-renders and improve
performance.
Previously, components relied on imperative state updates and effects
that triggered unnecessary computations on every render, leading to
potential performance issues and inconsistent behaviour, whereas the new
implementation uses declarative patterns that compute values only when
dependencies change, ensuring more predictable and efficient updates
while maintaining the same functionality.
Additionally, wrap the application in `React.StrictMode` to enable
development-time checks for potential issues and enforce best practices,
and update the backend dev script to include the dev build tag for
proper container tagging, which affects the `DuoPush` suite in the
development environment.
---------
Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>
This fixes an issue where the consent session is bound to a subject immediately preventing the user from logging out and using another account to perform the consent. Instead, binding the subject occurs when they respond to the consent form.
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
Add the ability for users to change their password from their user settings, without requiring them to use the reset password workflow. User's are required to create a elevated session in order to change their password. Users may not change their password to their current password. The user's current password is required for the password change. Users must follow any established password policies. Administrators are able to turn this feature off.
Closes#3548
This adds rate limits to the TOTP second factor endpoint, the Duo second factor endpoint, Session Elevation endpoint, and the Reset Password endpoint. This protection exists as several configurable tokenized buckets anchored to the users remote IP address. In the event the rate limit is exceeded by the user the middleware will respond with a 429 status, a Retry-After header, and JSON body indicating it's rate limited, which the UI will gracefully handle. This has several benefits that compliment the 1FA regulation, specifically in simple architectures it limits the number of SMTP sends a unique client can make, as well as the number of requests a particular client can make in general on specific endpoints where too many requests may indicate either a fault or some form of abuse.
Closes#7353, Closes#1947
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
Add support for passkeys, granular attachment modality, granular authenticator selection, and authenticator filtering which is commonly used in an enterprise environment. This also adds metadata verification elements utilizing the MDS3 to the project, including saving attestation statements, verification of attestation statements, etc. This also makes a significant change to the authentication level logic to purely use RFC8176 authentication method references to ensure the future-proof nature of the implementation. This change paves the way for the future of Authelia ensuring we can add custom policies in the future to allow administrators to very deliberately decide what authentication methods are sufficient for a given resource as well as the ability to clearly communicate these authentication methods to third parties via OpenID Connect 1.0 and SAML 2.0. It should be noted that at the time of this commit Passkey authentication is considered a single factor and we will at a later stage add the customizable policies described here to handle other use cases, though we've included a flag that considers properly implemented passkeys as if they were MFA.
Closes#2827, Closes#2761
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
* fix: swagger-ui csp and cleanup unnecessary files
This change fixes CSP errors when browsing Swagger and cuts down the binary/image size 10%+ by keeping only required files from the swagger-ui package.
Signed-off-by: Amir Zarrinkafsh <nightah@me.com>
* fix(api): fix server url
Signed-off-by: Amir Zarrinkafsh <nightah@me.com>
* refactor: set strict csp on static served files
Signed-off-by: Amir Zarrinkafsh <nightah@me.com>
---------
Signed-off-by: Amir Zarrinkafsh <nightah@me.com>
Per our standard review process this adjusts the appropriate elements detected during the review.
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
This replaces the JWT method for Identity Verification for most elements with a One-Time Code which has a controllable lifetime. These codes elevate the session for a duration, are less likely to be accidentally clicked, can be revoked, and generally a better experience for users. Users will be able to copy the codes directly from the email or manually type them. This improves the process as the user is very unlikely to input the code into the wrong window, and can't open it in the wrong browser. In addition the process prevents accidental clicking from causing issues.
Closes#3801
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
This implements the standard for JWT encoded and signed responses from the introspection endpoint. This has been implemented as per the IETF draft https://datatracker.ietf.org/doc/html/draft-ietf-oauth-jwt-introspection-response and as it is a draft (it is also an expired draft) so it should be noted that this implementation may be removed or changed without any regard for breaking changes. While this factor points in the direction of this never receiving ratification the IANA has accepted registration of the metadata parameters for this specification which points to the fact that it probably will.
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
This adjusts the AuthRequest Authz implementation behave similarly to the other implementations in as much as Authelia can return the relevant redirection to the proxy and the proxy just utilizes it if possible. In addition it swaps the HAProxy examples over to the ForwardAuth implementation as that's now supported.
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
This should lead to a small performance gain by caching the openapi.yml with etags as well as eliminating the use of nonce crypto generation when not required.
This adds multiple consent modes to OpenID Connect clients. Specifically it allows configuration of a new consent mode called implicit which never asks for user consent.
This ensures that; the method set when a user does not have a preference is a method that is available, that if a user has a preferred method that is not available it is changed to an enabled method with preference put on methods the user has configured, that the frontend does not show the method selection option when only one method is available.
This implements Webauthn. Old devices can be used to authenticate via the appid compatibility layer which should be automatic. New devices will be registered via Webauthn, and devices which do not support FIDO2 will no longer be able to be registered. At this time it does not fully support multiple devices (backend does, frontend doesn't allow registration of additional devices). Does not support passwordless.
Allow users to configure the TOTP Algorithm and Digits. This should be used with caution as many TOTP applications do not support it. Some will also fail to notify the user that there is an issue. i.e. if the algorithm in the QR code is sha512, they continue to generate one time passwords with sha1. In addition this drastically refactors TOTP in general to be more user friendly by not forcing them to register a new device if the administrator changes the period (or algorithm).
Fixes#1226.
Allow users to select and save the preferred duo device and method, depending on availability in the duo account. A default enrollment URL is provided and adjusted if returned by the duo API. This allows auto-enrollment if enabled by the administrator.
Closes#594. Closes#1039.
James Elliott