v4.38.0

4.38.0 (2024-3-14)

Overview

It's important users check the Release Notes on the Blog as there are potential necessary changes with experimental/beta features. This fairly large release is primarily a culmination of effort from @smkent, @nightah, @clems4ever, @mind-ar, @joshgordon, @ezrizhu, and @james-d-elliott. Many others have made contributions in this time either in the form of pull requests, feedback, or some even went as far as contributing their attitudes.

See the change log below for more information about this release.

Bug Fixes

• commands: internal services not cleaned up properly (#4966) (f44700c), closes #4963
• commands: missing pkcs8 option (#5270) (033d3c0)
• commands: no args not enforced on crypto hash generate (#5237) (0f4f5d5)
• commands: storage cmd fail when implicit config absent (#5213) (569af0f)
• configuration: deprecated secrets not mapped (#6150) (5446efb)
• configuration: fail to parse large int duration (#5408) (713f8e9)
• configuration: illogical refresh interval default (#6319) (c49b973)
• configuration: optional value not treated as optional (#5853) (5edd5fc)
• configuration: regression in redis default port (#6428) (f93a0b5)
• configuration: secret permission errors panic (#5141) (622bf42), closes #5138
• configuration: warning about log level env (#6784) (c70c83f)
• handlers: legacy authz failure on nginx (#4956) (ab01fa6)
• logging: injected time format inconsistent (#5004) (b9a6856)
• middlewares: failure to detect remote ip (#5339) (34ec813)
• model: yaml encoding of totp and webauthn fails (#5204) (dfbbf1a)
• notification: error on non-normative login responses (#4729) (8ef90ca), closes #4717
• notification: missing display name (#4653) (a771cc6)
• notification: missing use of timeout (#4652) (a691131)
• notification: smtp auth not configured (#4647) (7b8ed46)
• notifier: mime parts in reverse order (#5623) (13b54b4), closes #5617
• ntp: startup check skipped when it shouldn't be (#5701) (934f68b)
• ntp: version 4 encoded incorrectly (#4773) (b815521)
• oidc: client auth basic fails on correctly encoded header (#5632) (cb116db)
• oidc: client credentials flow not populating session (#5797) (62c36eb)
• oidc: client id not in audience whitelist (#5980) (ad82ec7)
• oidc: csp blocks form_post response form submit (#4719) (cf4010b), closes #4669
• oidc: default response mode not validated (#5129) (c8f75b1)
• oidc: failure to insert with client credentials grant (#5809) (895cdc2)
• oidc: insufficient debug logs on some endpoints (#5783) (f09dbee)
• oidc: par consent state error (#5880) (321a380)
• oidc: par context redirect (#6450) (0d0fda8)
• oidc: par model mapping (#5879) (e42bbca)
• oidc: pkce session generated needlessly (#5762) (896752c)
• oidc: pre-config audience not matched (#6513) (aee9d28)
• oidc: refresh flow scope parameter ignored (#5782) (e250ad3)
• oidc: userinfo endpoint returns additional audience (#5781) (0919173)
• server: errors not logged (#4682) (53a6275)
• storage: postgresql webauthn tbl invalid aaguid constraint (#5183) (fa250ea), closes #5182
• templates: plain text email misleading (#5036) (a91762c), closes #4915
• utils: fix suite setup timeout (#4771) (56f0282), closes #4751
• webauthn credential user id missing (#5882) (4903567)
• webauthn user handle encoding (f567b67)

Features

• add systemd security hardening (#6480) (648fdfe)
• authentication: ldap memberof group search (#5418) (f79db58), closes #2161
• authentication: ldap time replacements (#4483) (d67554a), closes #1964 #1284
• authentication: suport ldap over unix socket (#5397) (fb5c285)
• commands: config template command (#6013) (16b0e20)
• commands: go build info (#5775) (37ee009)
• commands: storage import/export commands (#4545) (d7ab3bb)
• configuration: disallow public suffix domains (#4855) (598ea2b)
• configuration: env config file discovery (#4618) (0130edb)
• configuration: file filters (#4515) (c7f4d59)
• configuration: freeipa ldap implementation (#4482) (d0d80b4), closes #2177 #2161
• configuration: glauth ldap implementation (#4499) (d3d87ff)
• configuration: lldap implementation (#4498) (5b8b314)
• configuration: load config from directory (#4616) (cc1e58e)
• configuration: rfc2307bis implementation (#4900) (2e6d17b)
• configuration: unix socket listener subpath (#6463) (7a97373)
• handlers: authz authrequest authelia url (#5181) (2dcfc0b)
• logging: date time layout (#6333) (786985e), closes #6136
• metrics: record openid connect histogram (#5769) (bd04624)
• notification: important events notifications (#4644) (f685f24)
• oauth2 authorization bearer (#6774) (fb50f1a), closes #2023 #188
• oidc: auth policy applied per-subject (#5486) (db6d95c), closes #2621
• oidc: client authentication modes (#5150) (3d2da0b)
• oidc: client credentials grant type (#5729) (b829e1b)
• oidc: client_secret_jwt client auth (#5031) (42671d3)
• oidc: client_secret_jwt client auth (#5253) (1dbfbc5)
• oidc: disable minimum parameter entropy (#5495) (32c6880)
• oidc: jwk selection by id (#5464) (65f69ae)
• oidc: jwt profile for oauth 2.0 access tokens (#5913) (9a28de5)
• oidc: jwt response for introspection (#5840) (34b7a47)
• oidc: jwt secured authorization response mode (#5914) (0196e0b)
• oidc: per-client custom token lifespans (#5741) (788be59)
• oidc: per-client pkce enforcement policy (#4692) (adaf069)
• oidc: private_key_jwt client auth (#5280) (65ecfe4)
• oidc: pushed authorization requests (#4546) (ff6be40)
• oidc: requested audience policy (#6002) (c950736)
• oidc: server issuer identification (#5912) (0da4abf)
• oidc: signed discovery (#6003) (357ce8e)
• server: customizable authz endpoints (#4296) (65705a6), closes #2753 #3716
• server: handle head method (#5003) (a345490)
• server: listen on unix sockets (#5038) (90d1901)
• server: recover panics (2c6a8e1)
• server: update default headers (#5881) (e9e2969)
• session: multiple session cookie domains (#3754) (8b29cf7), closes #1198
• session: redirection by cookie domain (#6017) (6a6059d)
• templates: add multiline helper functions (#6227) (00725ec)
• templates: templating functions (#4635) (55a6794)
• totp: reuse policy (5d3e7a0)
• web: add password policy visible feedback on password change (#5714) (b0746dc), closes #5048
• web: caps lock detection (61c30b3)
• web: multiple webauthn credential registration (c0dbdd9), closes #275 #4366
• web: one-time codes for identity verification (e618cf3), closes #3801
• web: per-device two factor method (b33dabb), closes #1699
• web: privacy policy url (#4625) (a566c16), closes #2639
• web: revoke reset password tokens (2a38819), closes #136
• web: second factor identity verification (d62d79e), closes #135
• web: user one-time password preferences (87d2a34)

Performance Improvements

• server: cached openapi document (#4674) (1c3219e)
• web: lazy loading (87747a5)

Docker Container

• docker pull authelia/authelia:4.38.0
• docker pull ghcr.io/authelia/authelia:4.38.0