mirror of
https://github.com/authelia/authelia.git
synced 2026-10-28 09:34:52 +08:00
James Elliott
847afd67db
This adds the official OpenID Connect 1.0 Conformance Suites used by the OpenID Foundation to assert conformance for certification to our test suites. This allows us to offer the quality guarantee that every single commit of Authelia conforms to the OpenID Connect 1.0 and related specifications. The tests allow the following results to indicate success automatically: `PASSED`, `REVIEW` (result that manual review must occur), `SKIPPED` (result that indicates the conformance test is not needed due to reasonable criteria). In addition only the `FINISHED` status is accepted. If the result is `WARNING` which is just an informative result which does not indicate lack of conformance it can be manually allowed on a per module basis with an explanation. This allows both detecting new `WARNING` results and necessitates documenting them for future improvements. All of the result and status checks align entirely with the standard conformance certification process, ensuring that each commit would be certifiable. The storage for the suites is able to be configured for persistence, and every plan created carries the commit sha or tag; allowing for historical evidence of conformance.
111 lines
2.8 KiB
YAML
111 lines
2.8 KiB
YAML
# SPDX-FileCopyrightText: 2026 Authelia
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
---
|
|
certificates_directory: '/certs/'
|
|
|
|
server:
|
|
address: 'tcp://:9091'
|
|
timeouts:
|
|
read: '30s'
|
|
tls:
|
|
certificate: '/pki/public.backend.crt'
|
|
key: '/pki/private.backend.pem'
|
|
|
|
log:
|
|
level: 'debug'
|
|
|
|
storage:
|
|
encryption_key: 'a_not_so_secure_encryption_key'
|
|
postgres:
|
|
address: 'tcp://postgres:5432'
|
|
database: 'authelia'
|
|
username: 'admin'
|
|
password: 'password'
|
|
|
|
notifier:
|
|
smtp:
|
|
address: 'smtp://mail.example.com:1025'
|
|
sender: 'admin@example.com'
|
|
|
|
identity_validation:
|
|
reset_password:
|
|
jwt_secret: 'unsecure_secret'
|
|
|
|
|
|
# Every plan in this suite authenticates as the same user against this one Authelia, concurrently, and a module which
|
|
# leaves the sign in form on screen has its credentials resubmitted. Three failures within the default two minute
|
|
# window would ban the account for the default five minutes, failing unrelated modules in the other six plans with
|
|
# errors which point nowhere near the cause. Regulation is not what this suite tests, so it is disabled outright.
|
|
regulation:
|
|
max_retries: 0
|
|
|
|
session:
|
|
secret: 'unsecure_session_secret'
|
|
cookies:
|
|
- domain: 'example.com'
|
|
authelia_url: 'https://login.example.com:8080'
|
|
expiration: '1 hour'
|
|
inactivity: '5 minutes'
|
|
remember_me: '1 year'
|
|
redis:
|
|
host: 'redis'
|
|
port: 6379
|
|
|
|
authentication_backend:
|
|
file:
|
|
path: '/config/users.yml'
|
|
|
|
totp:
|
|
disable_reuse_security_policy: true
|
|
|
|
webauthn:
|
|
disable: false
|
|
enable_passkey_login: true
|
|
display_name: 'Authelia'
|
|
attestation_conveyance_preference: 'indirect'
|
|
timeout: '60 seconds'
|
|
filtering:
|
|
permitted_aaguids: []
|
|
prohibited_aaguids: []
|
|
prohibit_backup_eligibility: false
|
|
selection_criteria:
|
|
attachment: ''
|
|
discoverability: 'required'
|
|
user_verification: 'preferred'
|
|
metadata:
|
|
enabled: false
|
|
validate_trust_anchor: true
|
|
validate_entry: false
|
|
validate_entry_permit_zero_aaguid: true
|
|
validate_status: true
|
|
validate_status_permitted: []
|
|
validate_status_prohibited: []
|
|
|
|
identity_providers:
|
|
oidc:
|
|
enable_client_debug_messages: true
|
|
hmac_secret: 'IVPWBkAdJHje3uz7LtFTDU2pFUfh39Xm'
|
|
jwks:
|
|
- key: {{ secret "/pki/private.oidc.pem" | mindent 10 "|" | msquote }}
|
|
certificate_chain: {{ secret "/pki/public.oidc.chain.pem" | mindent 10 "|" | msquote }}
|
|
access_control:
|
|
default_policy: 'deny'
|
|
rules:
|
|
- domain: 'home.example.com'
|
|
policy: 'bypass'
|
|
- domain: 'public.example.com'
|
|
policy: 'bypass'
|
|
- domain: 'admin.example.com'
|
|
policy: 'two_factor'
|
|
- domain: 'secure.example.com'
|
|
policy: 'two_factor'
|
|
- domain: 'singlefactor.example.com'
|
|
policy: 'one_factor'
|
|
- domain: 'oidc.example.com'
|
|
policy: 'two_factor'
|
|
- domain: 'oidc-public.example.com'
|
|
policy: 'bypass'
|
|
...
|