feat(authelia): Update Authelia question tooltips and defaults (#13487)
**Description** <!-- Replaced some descriptions with text from: https://www.authelia.com/configuration/session https://www.authelia.com/configuration/security Added default settings to align with https://truecharts.org/charts/enterprise/authelia/Setup-Guide/#setup-authelia --> ⚒️ Fixes # <!--(issue)--> **⚙️ Type of change** - [X] ⚙️ Feature/App addition - [ ] 🪛 Bugfix - [ ] ⚠️ Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] 🔃 Refactor of current code **🧪 How Has This Been Tested?** <!-- Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration --> **📃 Notes:** <!-- Please enter any other relevant information here --> **✔️ Checklist:** - [ ] ⚖️ My code follows the style guidelines of this project - [X] 👀 I have performed a self-review of my own code - [X] #️⃣ I have commented my code, particularly in hard-to-understand areas - [ ] 📄 I have made corresponding changes to the documentation - [X] ⚠️ My changes generate no new warnings - [ ] 🧪 I have added tests to this description that prove my fix is effective or that my feature works - [ ] ⬆️ I increased versions for any altered app according to semantic versioning **➕ App addition** If this PR is an app addition please make sure you have done the following. - [ ] 🪞 I have opened a PR on [truecharts/containers](https://github.com/truecharts/containers) adding the container to TrueCharts mirror repo. - [ ] 🖼️ I have added an icon in the Chart's root directory called `icon.png` --- _Please don't blindly check all the boxes. Read them and only check those that apply. Those checkboxes are there for the reviewer to see what is this all about and the status of this PR with a quick glance._ --------- Signed-off-by: depasseg <depasseg@users.noreply.github.com> Signed-off-by: Stavros Kois <47820033+stavros-k@users.noreply.github.com> Signed-off-by: Kjeld Schouten <kjeld@schouten-lebbing.nl> Co-authored-by: Stavros Kois <47820033+stavros-k@users.noreply.github.com> Co-authored-by: Xstar97TheNoob <9399967+xstar97@users.noreply.github.com> Co-authored-by: Kjeld Schouten <kjeld@schouten-lebbing.nl>
This commit is contained in:
parent
f04ecbf916
commit
d42be3f9a5
|
@ -35,7 +35,7 @@ sources:
|
||||||
- https://github.com/authelia/chartrepo
|
- https://github.com/authelia/chartrepo
|
||||||
- https://github.com/authelia/authelia
|
- https://github.com/authelia/authelia
|
||||||
type: application
|
type: application
|
||||||
version: 19.0.11
|
version: 19.0.12
|
||||||
annotations:
|
annotations:
|
||||||
truecharts.org/category: security
|
truecharts.org/category: security
|
||||||
truecharts.org/SCALE-support: "true"
|
truecharts.org/SCALE-support: "true"
|
||||||
|
|
|
@ -230,14 +230,20 @@ questions:
|
||||||
attrs:
|
attrs:
|
||||||
- variable: name
|
- variable: name
|
||||||
label: "Cookie Name"
|
label: "Cookie Name"
|
||||||
description: "The name of the session cookie."
|
description: |
|
||||||
|
The name of the session cookie. By default this is set to authelia_session.
|
||||||
|
It’s mostly useful to change this if you are doing development or running multiple instances of Authelia.
|
||||||
schema:
|
schema:
|
||||||
type: string
|
type: string
|
||||||
required: true
|
required: true
|
||||||
default: "authelia_session"
|
default: "authelia_session"
|
||||||
- variable: same_site
|
- variable: same_site
|
||||||
label: "SameSite Value"
|
label: "SameSite Value"
|
||||||
description: "Sets the Cookie SameSite value"
|
description: |
|
||||||
|
You can read about the SameSite cookie in detail on the MDN. In short setting SameSite to Lax is generally
|
||||||
|
the most desirable option for Authelia. None is not recommended unless you absolutely know what you’re doing
|
||||||
|
and trust all the protected apps. Strict is not going to work in many use cases and we have not tested it in
|
||||||
|
this state but it’s available as an option anyway.
|
||||||
schema:
|
schema:
|
||||||
type: string
|
type: string
|
||||||
default: "lax"
|
default: "lax"
|
||||||
|
@ -248,21 +254,27 @@ questions:
|
||||||
description: "strict"
|
description: "strict"
|
||||||
- variable: expiration
|
- variable: expiration
|
||||||
label: "Expiration Time"
|
label: "Expiration Time"
|
||||||
description: "The time in seconds before the cookie expires and session is reset."
|
description: |
|
||||||
|
The period of time before the cookie expires and the session is destroyed. This is overriden by
|
||||||
|
remember_me_duration when the remember me box is checked.
|
||||||
schema:
|
schema:
|
||||||
type: string
|
type: string
|
||||||
default: "1h"
|
default: "1h"
|
||||||
required: true
|
required: true
|
||||||
- variable: inactivity
|
- variable: inactivity
|
||||||
label: "Inactivity Time"
|
label: "Inactivity Time"
|
||||||
description: "The inactivity time in seconds before the session is reset."
|
description: |
|
||||||
|
The period of time the user can be inactive for until the session is destroyed when the remember me box is
|
||||||
|
not checked or is otherwise disabled. Useful if you want long session timers but don’t want unused devices to be vulnerable.
|
||||||
schema:
|
schema:
|
||||||
type: string
|
type: string
|
||||||
default: "5m"
|
default: "5m"
|
||||||
required: true
|
required: true
|
||||||
- variable: remember_me_duration
|
- variable: remember_me_duration
|
||||||
label: "Remember-Me duration"
|
label: "Remember-Me duration"
|
||||||
description: "The remember me duration"
|
description: |
|
||||||
|
The period of time before the cookie expires and the session is destroyed when the remember me box is checked, a user
|
||||||
|
selecting this option negates the inactivity timeout. Setting this to -1 disables this feature entirely.
|
||||||
schema:
|
schema:
|
||||||
type: string
|
type: string
|
||||||
default: "5M"
|
default: "5M"
|
||||||
|
@ -283,14 +295,18 @@ questions:
|
||||||
default: 3
|
default: 3
|
||||||
- variable: find_time
|
- variable: find_time
|
||||||
label: "Find Time"
|
label: "Find Time"
|
||||||
description: "The time range during which the user can attempt login before being banned."
|
description: |
|
||||||
|
The period of time analyzed for failed attempts. For example if you set max_retries to 3 and find_time to
|
||||||
|
2m this means the user must have 3 failed logins in 2 minutes.
|
||||||
schema:
|
schema:
|
||||||
type: string
|
type: string
|
||||||
default: "2m"
|
default: "2m"
|
||||||
required: true
|
required: true
|
||||||
- variable: ban_time
|
- variable: ban_time
|
||||||
label: "Ban Duration"
|
label: "Ban Duration"
|
||||||
description: "The length of time before a banned user can login again"
|
description: |
|
||||||
|
The period of time the user is banned for after meeting the max_retries and find_time configuration.
|
||||||
|
After this duration the account will be able to login again.
|
||||||
schema:
|
schema:
|
||||||
type: string
|
type: string
|
||||||
default: "5m"
|
default: "5m"
|
||||||
|
@ -298,7 +314,9 @@ questions:
|
||||||
- variable: authentication_backend
|
- variable: authentication_backend
|
||||||
group: "App Configuration"
|
group: "App Configuration"
|
||||||
label: "Authentication Backend Provider"
|
label: "Authentication Backend Provider"
|
||||||
description: "sed for verifying user passwords and retrieve information such as email address and groups users belong to."
|
description: |
|
||||||
|
Used for verifying user passwords and retrieve information such as email
|
||||||
|
address and groups users belong to.
|
||||||
schema:
|
schema:
|
||||||
additional_attrs: true
|
additional_attrs: true
|
||||||
type: dict
|
type: dict
|
||||||
|
@ -405,14 +423,14 @@ questions:
|
||||||
description: "The attribute holding the username of the user"
|
description: "The attribute holding the username of the user"
|
||||||
schema:
|
schema:
|
||||||
type: string
|
type: string
|
||||||
default: ""
|
default: "uid"
|
||||||
required: true
|
required: true
|
||||||
- variable: additional_users_dn
|
- variable: additional_users_dn
|
||||||
label: "Additional Users DN"
|
label: "Additional Users DN"
|
||||||
description: "An additional dn to define the scope to all users."
|
description: "An additional dn to define the scope to all users."
|
||||||
schema:
|
schema:
|
||||||
type: string
|
type: string
|
||||||
default: "OU=Users"
|
default: "OU=people"
|
||||||
required: true
|
required: true
|
||||||
- variable: users_filter
|
- variable: users_filter
|
||||||
label: "Users Filter"
|
label: "Users Filter"
|
||||||
|
@ -440,27 +458,27 @@ questions:
|
||||||
description: "The attribute holding the name of the group"
|
description: "The attribute holding the name of the group"
|
||||||
schema:
|
schema:
|
||||||
type: string
|
type: string
|
||||||
default: ""
|
default: "cn"
|
||||||
required: true
|
required: true
|
||||||
- variable: mail_attribute
|
- variable: mail_attribute
|
||||||
label: "Mail Attribute"
|
label: "Mail Attribute"
|
||||||
description: "The attribute holding the primary mail address of the user"
|
description: "The attribute holding the primary mail address of the user"
|
||||||
schema:
|
schema:
|
||||||
type: string
|
type: string
|
||||||
default: ""
|
default: "mail"
|
||||||
required: true
|
required: true
|
||||||
- variable: display_name_attribute
|
- variable: display_name_attribute
|
||||||
label: "Display Name Attribute"
|
label: "Display Name Attribute"
|
||||||
description: "he attribute holding the display name of the user. This will be used to greet an authenticated user."
|
description: "he attribute holding the display name of the user. This will be used to greet an authenticated user."
|
||||||
schema:
|
schema:
|
||||||
type: string
|
type: string
|
||||||
default: ""
|
default: "displayName"
|
||||||
- variable: user
|
- variable: user
|
||||||
label: "Admin User"
|
label: "Admin User"
|
||||||
description: "The username of the admin user used to connect to LDAP."
|
description: "The username of the admin user used to connect to LDAP."
|
||||||
schema:
|
schema:
|
||||||
type: string
|
type: string
|
||||||
default: "CN=Authelia,DC=example,DC=com"
|
default: "CN=admin,ou=people,DC=example,DC=com"
|
||||||
required: true
|
required: true
|
||||||
- variable: plain_password
|
- variable: plain_password
|
||||||
label: "Password"
|
label: "Password"
|
||||||
|
@ -688,10 +706,13 @@ questions:
|
||||||
attrs:
|
attrs:
|
||||||
- variable: default_policy
|
- variable: default_policy
|
||||||
label: "Default Policy"
|
label: "Default Policy"
|
||||||
description: "Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'."
|
description: |
|
||||||
|
The default policy defines the policy applied if no rules section apply to the information known about the request.
|
||||||
|
It is recommended that this is configured to deny for security reasons. Sites which you do not wish to secure at all
|
||||||
|
with Authelia should not be configured in your reverse proxy to perform authentication with Authelia at all for performance reasons.
|
||||||
schema:
|
schema:
|
||||||
type: string
|
type: string
|
||||||
default: "two_factor"
|
default: "deny"
|
||||||
enum:
|
enum:
|
||||||
- value: "bypass"
|
- value: "bypass"
|
||||||
description: "bypass"
|
description: "bypass"
|
||||||
|
@ -745,7 +766,7 @@ questions:
|
||||||
attrs:
|
attrs:
|
||||||
- variable: domain
|
- variable: domain
|
||||||
label: "Domains"
|
label: "Domains"
|
||||||
description: "defines which domain or set of domains the rule applies to."
|
description: "Defines which domain or set of domains the rule applies to."
|
||||||
schema:
|
schema:
|
||||||
type: list
|
type: list
|
||||||
default: []
|
default: []
|
||||||
|
@ -758,7 +779,9 @@ questions:
|
||||||
required: true
|
required: true
|
||||||
- variable: policy
|
- variable: policy
|
||||||
label: "Policy"
|
label: "Policy"
|
||||||
description: "The policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'."
|
description: |
|
||||||
|
The specific policy to apply to the selected rule. This is not criteria for a match, this is the
|
||||||
|
action to take when a match is made.
|
||||||
schema:
|
schema:
|
||||||
type: string
|
type: string
|
||||||
default: "two_factor"
|
default: "two_factor"
|
||||||
|
@ -773,7 +796,11 @@ questions:
|
||||||
description: "deny"
|
description: "deny"
|
||||||
- variable: subject
|
- variable: subject
|
||||||
label: "Subject"
|
label: "Subject"
|
||||||
description: "defines the subject to apply authorizations to. This parameter is optional and matching any user if not provided"
|
description: |
|
||||||
|
This criteria matches identifying characteristics about the subject. Currently this is either
|
||||||
|
user or groups the user belongs to. This allows you to effectively control exactly what each user is
|
||||||
|
authorized to access or to specifically require two-factor authentication to specific users. Subjects
|
||||||
|
are prefixed with either user: or group: to identify which part of the identity to check.
|
||||||
schema:
|
schema:
|
||||||
type: list
|
type: list
|
||||||
default: []
|
default: []
|
||||||
|
@ -982,7 +1009,9 @@ questions:
|
||||||
description: "two_factor"
|
description: "two_factor"
|
||||||
- variable: consent_mode
|
- variable: consent_mode
|
||||||
label: "Consent Mode"
|
label: "Consent Mode"
|
||||||
description: "Configures the consent mode. This can be set to auto (default), explicit (consent required every time) or implicit (automatically assumes consent for every authorization, never asking the user if they wish to give consent.)"
|
description: |
|
||||||
|
Configures the consent mode. This can be set to auto (default), explicit (consent required every time) or
|
||||||
|
implicit (automatically assumes consent for every authorization, never asking the user if they wish to give consent.)
|
||||||
schema:
|
schema:
|
||||||
type: string
|
type: string
|
||||||
default: "auto"
|
default: "auto"
|
||||||
|
|
|
@ -228,7 +228,7 @@ authentication_backend:
|
||||||
## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also
|
## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also
|
||||||
## be used but we don't recommend using them, we instead advise to use the attributes mentioned above
|
## be used but we don't recommend using them, we instead advise to use the attributes mentioned above
|
||||||
## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt.
|
## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt.
|
||||||
username_attribute: ""
|
username_attribute: "uid"
|
||||||
|
|
||||||
## An additional dn to define the scope to all users.
|
## An additional dn to define the scope to all users.
|
||||||
additional_users_dn: OU=Users
|
additional_users_dn: OU=Users
|
||||||
|
@ -270,17 +270,17 @@ authentication_backend:
|
||||||
groups_filter: ""
|
groups_filter: ""
|
||||||
|
|
||||||
## The attribute holding the name of the group
|
## The attribute holding the name of the group
|
||||||
group_name_attribute: ""
|
group_name_attribute: "cn"
|
||||||
|
|
||||||
## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
|
## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
|
||||||
## first one returned by the LDAP server is used.
|
## first one returned by the LDAP server is used.
|
||||||
mail_attribute: ""
|
mail_attribute: "mail"
|
||||||
|
|
||||||
## The attribute holding the display name of the user. This will be used to greet an authenticated user.
|
## The attribute holding the display name of the user. This will be used to greet an authenticated user.
|
||||||
display_name_attribute: ""
|
display_name_attribute: "displayname"
|
||||||
|
|
||||||
## The username of the admin user.
|
## The username of the admin user.
|
||||||
user: CN=Authelia,DC=example,DC=com
|
user: CN=admin,DC=example,DC=com
|
||||||
plain_password: ""
|
plain_password: ""
|
||||||
|
|
||||||
##
|
##
|
||||||
|
|
Loading…
Reference in New Issue