authelia-config.yml

###############################################################
#                   Authelia configuration                    #
###############################################################

jwt_secret: ${AUTHELIA_JWT_SECRET}
default_redirection_url: ${AUTHELIA_DEFAULT_REDIRECT}

server:
  host: 0.0.0.0
  port: 9092
  buffers:
    read: 8192
    write: 8192

telemetry:
  metrics:
    enabled: true
    address: "tcp://0.0.0.0:9959"
    buffers:
      read: 4096
      write: 4096
    timeouts:
      read: 6s
      write: 6s
      idle: 30s

theme: auto

log:
  level: debug

totp:
  disable: false
  issuer: ${LDAP_DOMAIN}.${LDAP_TLD}
  algorithm: sha1
  digits: 6
  period: 30
  skew: 1
  secret_size: 32

# webauthn:
#   disable: false
#   display_name: Authelia
#   attestation_conveyance_preference: indirect
#   user_verification: preferred
#   timeout: 60s

authentication_backend:
  ldap:
    implementation: custom
    url: ldap://openldap
    timeout: 5s
    start_tls: false
    tls:
      server_name: openldap
      skip_verify: true
      minimum_version: TLS1.2
    base_dn: DC=${LDAP_DOMAIN},DC=${LDAP_TLD}
    additional_users_dn: OU=users
    users_filter: (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
    username_attribute: uid
    mail_attribute: mail
    display_name_attribute: displayName
    additional_groups_dn: OU=groups
    groups_filter: (&(member=UID={input},OU=users,DC=${LDAP_DOMAIN},DC=${LDAP_TLD})(objectClass=groupOfNames))
    group_name_attribute: cn
    user: cn=admin,dc=${LDAP_DOMAIN},dc=${LDAP_TLD}
    password: ${LDAP_ADMIN_PASSWORD}

access_control:
  default_policy: deny
  rules:
    - domain: www.${LDAP_DOMAIN}.${LDAP_TLD} # just an example
      policy: bypass # options are: bypass, one_factor and two_factor

session:
  name: authelia_session
  secret: ${AUTHELIA_SESSION_SECRET}
  expiration: 3600  # 1 hour
  inactivity: 300  # 5 minutes
  same_site: lax
  domain: ${LDAP_DOMAIN}.${LDAP_TLD}

  redis:
    host: authelia-redis
    port: 6379

regulation:
  max_retries: 3
  find_time: 120
  ban_time: 300

storage:
  encryption_key: ${AUTHELIA_STORAGE_ENCRYPTION_KEY}
  postgres:
    host: ${DATABASE_HOST}
    port: 5432
    database: authelia
    schema: public
    username: ${DATABASE_USER}
    password: ${DATABASE_PASSWORD}

notifier:
  smtp:
    username: ${MAILER_USERNAME}
    password: ${MAILER_PASSWORD}
    host: ${MAILER_HOST}
    port: ${MAILER_PORT}
    sender: ${MAILER_USERNAME}

identity_providers:
  oidc:
    hmac_secret: ${AUTHELIA_OAUTH_SECRET}
    issuer_private_key: |
      ${AUTHELIA_OAUTH_PRIVATE_KEY}
    access_token_lifespan: 1h
    authorize_code_lifespan: 1m
    id_token_lifespan: 1h
    refresh_token_lifespan: 90m
    enable_client_debug_messages: false
    enforce_pkce: public_clients_only
    cors:
      endpoints:
        - authorization
        - token
        - revocation
        - introspection
      allowed_origins:
        - https://${LDAP_DOMAIN}.${LDAP_TLD}
      allowed_origins_from_client_redirect_uris: false
    clients:
      - id: myapp
        description: My Application
        secret: 'clientsecret'
        public: false
        authorization_policy: two_factor
        pre_configured_consent_duration: 1w
        scopes:
          - openid
          - groups
          - email
          - profile
        redirect_uris:
          - https://oidc.${LDAP_DOMAIN}.${LDAP_TLD}/oauth2/callback # just an example
        grant_types:
          - refresh_token
          - authorization_code
        response_types:
          - code
        response_modes:
          - form_post
          - query
          - fragment
        userinfo_signing_algorithm: none