2019-02-28 05:51:57 +00:00
|
|
|
|
###############################################################
|
|
|
|
|
# Authelia configuration #
|
|
|
|
|
###############################################################
|
|
|
|
|
|
|
|
|
|
# The port to listen on
|
|
|
|
|
port: 3000
|
|
|
|
|
|
|
|
|
|
# Log level
|
|
|
|
|
#
|
|
|
|
|
# Level of verbosity for logs
|
|
|
|
|
logs_level: debug
|
|
|
|
|
|
|
|
|
|
# Default redirection URL
|
|
|
|
|
#
|
|
|
|
|
# If user tries to authenticate without any referer, Authelia
|
|
|
|
|
# does not know where to redirect the user to at the end of the
|
|
|
|
|
# authentication process.
|
|
|
|
|
# This parameter allows you to specify the default redirection
|
|
|
|
|
# URL Authelia will use in such a case.
|
|
|
|
|
#
|
|
|
|
|
# Note: this parameter is optional. If not provided, user won't
|
|
|
|
|
# be redirected upon successful authentication.
|
|
|
|
|
default_redirection_url: ##DEFAULT_REDIRECT_URL
|
|
|
|
|
|
|
|
|
|
# TOTP Issuer Name
|
|
|
|
|
#
|
|
|
|
|
# This will be the issuer name displayed in Google Authenticator
|
|
|
|
|
# See: https://github.com/google/google-authenticator/wiki/Key-Uri-Format for more info on issuer names
|
|
|
|
|
totp:
|
2019-03-07 02:27:34 +00:00
|
|
|
|
issuer: ##APP_DOMAIN
|
2019-02-28 05:51:57 +00:00
|
|
|
|
|
|
|
|
|
# The authentication backend to use for verifying user passwords
|
|
|
|
|
# and retrieve information such as email address and groups
|
|
|
|
|
# users belong to.
|
|
|
|
|
#
|
|
|
|
|
# There are two supported backends: `ldap` and `file`.
|
|
|
|
|
authentication_backend:
|
|
|
|
|
# LDAP backend configuration.
|
|
|
|
|
#
|
|
|
|
|
# This backend allows Authelia to be scaled to more
|
|
|
|
|
# than one instance and therefore is recommended for
|
|
|
|
|
# production.
|
|
|
|
|
ldap:
|
|
|
|
|
# The url of the ldap server
|
|
|
|
|
url: ##LDAP_URL
|
|
|
|
|
|
|
|
|
|
# The base dn for every entries
|
2019-03-07 02:27:34 +00:00
|
|
|
|
base_dn: dc=cloudron
|
2019-02-28 05:51:57 +00:00
|
|
|
|
|
|
|
|
|
# An additional dn to define the scope to all users
|
2019-03-07 02:27:34 +00:00
|
|
|
|
# additional_users_dn: ##LDAP_USERS_BASE_DN
|
|
|
|
|
additional_users_dn: ou=users
|
2019-02-28 05:51:57 +00:00
|
|
|
|
|
|
|
|
|
# The users filter used to find the user DN
|
|
|
|
|
# {0} is a matcher replaced by username.
|
|
|
|
|
# 'cn={0}' by default.
|
|
|
|
|
users_filter: (&(objectclass=user)(|(username={0})(mail={0})))
|
|
|
|
|
|
|
|
|
|
# An additional dn to define the scope of groups
|
2019-03-07 02:27:34 +00:00
|
|
|
|
# additional_groups_dn: ##LDAP_GROUPS_BASE_DN
|
|
|
|
|
additional_groups_dn: ou=groups
|
2019-02-28 05:51:57 +00:00
|
|
|
|
|
|
|
|
|
# The groups filter used for retrieving groups of a given user.
|
|
|
|
|
# {0} is a matcher replaced by username.
|
|
|
|
|
# {dn} is a matcher replaced by user DN.
|
2019-03-07 02:27:34 +00:00
|
|
|
|
# {uid} is a matcher replaced by user uid.
|
2019-02-28 05:51:57 +00:00
|
|
|
|
# 'member={dn}' by default.
|
2019-03-07 02:27:34 +00:00
|
|
|
|
groups_filter: (&(memberuid={uid})(objectclass=group))
|
2019-02-28 05:51:57 +00:00
|
|
|
|
|
|
|
|
|
# The attribute holding the name of the group
|
|
|
|
|
group_name_attribute: cn
|
|
|
|
|
|
|
|
|
|
# The attribute holding the mail address of the user
|
|
|
|
|
mail_attribute: mail
|
|
|
|
|
|
|
|
|
|
# The username and password of the admin user.
|
|
|
|
|
user: ##LDAP_BIND_DN
|
|
|
|
|
password: ##LDAP_BIND_PASSWORD
|
|
|
|
|
|
|
|
|
|
|
2019-03-07 02:27:34 +00:00
|
|
|
|
# Access Control must be customized in /app/data/config.yml
|
|
|
|
|
# access_control:
|
2019-02-28 05:51:57 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# Configuration of session cookies
|
|
|
|
|
#
|
|
|
|
|
# The session cookies identify the user once logged in.
|
|
|
|
|
session:
|
|
|
|
|
# The name of the session cookie. (default: authelia_session).
|
|
|
|
|
name: authelia_session
|
|
|
|
|
|
|
|
|
|
# The secret to encrypt the session cookie.
|
2019-03-07 02:27:34 +00:00
|
|
|
|
secret: ##SESSION_SECRET
|
2019-02-28 05:51:57 +00:00
|
|
|
|
|
|
|
|
|
# The time in ms before the cookie expires and session is reset.
|
|
|
|
|
expiration: 3600000 # 1 hour
|
|
|
|
|
|
|
|
|
|
# The inactivity time in ms before the session is reset.
|
|
|
|
|
inactivity: 300000 # 5 minutes
|
|
|
|
|
|
|
|
|
|
# The domain to protect.
|
|
|
|
|
# Note: the authenticator must also be in that domain. If empty, the cookie
|
|
|
|
|
# is restricted to the subdomain of the issuer.
|
2019-03-07 02:27:34 +00:00
|
|
|
|
domain: ##APP_DOMAIN
|
2019-02-28 05:51:57 +00:00
|
|
|
|
|
|
|
|
|
# The redis connection details
|
|
|
|
|
redis:
|
2019-03-07 02:27:34 +00:00
|
|
|
|
host: ##REDIS_HOST
|
|
|
|
|
port: ##REDIS_PORT
|
|
|
|
|
password: ##REDIS_PASSWORD
|
2019-02-28 05:51:57 +00:00
|
|
|
|
|
|
|
|
|
# Configuration of the authentication regulation mechanism.
|
|
|
|
|
#
|
|
|
|
|
# This mechanism prevents attackers from brute forcing the first factor.
|
|
|
|
|
# It bans the user if too many attempts are done in a short period of
|
|
|
|
|
# time.
|
|
|
|
|
regulation:
|
|
|
|
|
# The number of failed login attempts before user is banned.
|
|
|
|
|
# Set it to 0 to disable regulation.
|
|
|
|
|
max_retries: 3
|
|
|
|
|
|
|
|
|
|
# The time range during which the user can attempt login before being banned.
|
|
|
|
|
# The user is banned if the authenticaction failed `max_retries` times in a `find_time` seconds window.
|
|
|
|
|
find_time: 120
|
|
|
|
|
|
|
|
|
|
# The length of time before a banned user can login again.
|
|
|
|
|
ban_time: 300
|
|
|
|
|
|
|
|
|
|
# Configuration of the storage backend used to store data and secrets.
|
|
|
|
|
#
|
|
|
|
|
# You must use only an available configuration: local, mongo
|
|
|
|
|
storage:
|
|
|
|
|
# Settings to connect to mongo server
|
|
|
|
|
mongo:
|
2019-03-07 02:27:34 +00:00
|
|
|
|
url: ##MONGODB_URL
|
|
|
|
|
database: ##MONGODB_DATABASE
|
2019-02-28 05:51:57 +00:00
|
|
|
|
auth:
|
2019-03-07 02:27:34 +00:00
|
|
|
|
username: ##MONGODB_USERNAME
|
|
|
|
|
password: ##MONGODB_PASSWORD
|
2019-02-28 05:51:57 +00:00
|
|
|
|
|
|
|
|
|
# Configuration of the notification system.
|
|
|
|
|
#
|
|
|
|
|
# Notifications are sent to users when they require a password reset, a u2f
|
|
|
|
|
# registration or a TOTP registration.
|
|
|
|
|
# Use only an available configuration: filesystem, gmail
|
|
|
|
|
notifier:
|
|
|
|
|
# Use a SMTP server for sending notifications
|
|
|
|
|
smtp:
|
2019-03-07 02:27:34 +00:00
|
|
|
|
username: ##MAIL_SMTP_USERNAME
|
|
|
|
|
password: ##MAIL_SMTP_PASSWORD
|
2019-02-28 05:51:57 +00:00
|
|
|
|
secure: false
|
2019-03-07 02:27:34 +00:00
|
|
|
|
host: ##MAIL_SMTP_SERVER
|
|
|
|
|
port: ##MAIL_SMTP_PORT
|
|
|
|
|
sender: ##MAIL_FROM
|