Issue following migration to version 4.38

[aldialloMC]

Hi all,

I've started the migration of my Authelia container to version 4.38, I've made all of the change using the the config template file but while I get my container to start, I'm getting the below error in the logs:

time="2024-05-10T12:03:43+02:00" level=error msg="Configuration: error occurred during unmarshalling configuration: 1 error(s) decoding:\n\n* 'access_control.networks[0]' expected a map, got 'string'" stack="github.com/authelia/authelia/v4/internal/commands/context.go:324 (*CmdCtx).ConfigValidateLogRunE\ngithub.com/authelia/authelia/v4/internal/commands/context.go:186 NewRootCmd.(*CmdCtx).ChainRunE.func1\ngithub.com/spf13/[email protected]/command.go:968 (*Command).execute\ngithub.com/spf13/[email protected]/command.go:1115 (*Command).ExecuteC\ngithub.com/spf13/[email protected]/command.go:1039 (*Command).Execute\ngithub.com/authelia/authelia/v4/cmd/authelia/main.go:10 main\nruntime/internal/atomic/types.go:194 (*Uint32).Load\nruntime/asm_amd64.s:1695 goexit" time="2024-05-10T12:03:43+02:00" level=error msg="Configuration: configuration key not expected: address" stack="github.com/authelia/authelia/v4/internal/commands/context.go:324 (*CmdCtx).ConfigValidateLogRunE\ngithub.com/authelia/authelia/v4/internal/commands/context.go:186 NewRootCmd.(*CmdCtx).ChainRunE.func1\ngithub.com/spf13/[email protected]/command.go:968 (*Command).execute\ngithub.com/spf13/[email protected]/command.go:1115 (*Command).ExecuteC\ngithub.com/spf13/[email protected]/command.go:1039 (*Command).Execute\ngithub.com/authelia/authelia/v4/cmd/authelia/main.go:10 main\nruntime/internal/atomic/types.go:194 (*Uint32).Load\nruntime/asm_amd64.s:1695 goexit" time="2024-05-10T12:03:43+02:00" level=error msg="Configuration: configuration key not expected: server" stack="github.com/authelia/authelia/v4/internal/commands/context.go:324 (*CmdCtx).ConfigValidateLogRunE\ngithub.com/authelia/authelia/v4/internal/commands/context.go:186 NewRootCmd.(*CmdCtx).ChainRunE.func1\ngithub.com/spf13/[email protected]/command.go:968 (*Command).execute\ngithub.com/spf13/[email protected]/command.go:1115 (*Command).ExecuteC\ngithub.com/spf13/[email protected]/command.go:1039 (*Command).Execute\ngithub.com/authelia/authelia/v4/cmd/authelia/main.go:10 main\nruntime/internal/atomic/types.go:194 (*Uint32).Load\nruntime/asm_amd64.s:1695 goexit" time="2024-05-10T12:03:43+02:00" level=error msg="Configuration: configuration key not expected: session.cookies.authelia_url" stack="github.com/authelia/authelia/v4/internal/commands/context.go:324 (*CmdCtx).ConfigValidateLogRunE\ngithub.com/authelia/authelia/v4/internal/commands/context.go:186 NewRootCmd.(*CmdCtx).ChainRunE.func1\ngithub.com/spf13/[email protected]/command.go:968 (*Command).execute\ngithub.com/spf13/[email protected]/command.go:1115 (*Command).ExecuteC\ngithub.com/spf13/[email protected]/command.go:1039 (*Command).Execute\ngithub.com/authelia/authelia/v4/cmd/authelia/main.go:10 main\nruntime/internal/atomic/types.go:194 (*Uint32).Load\nruntime/asm_amd64.s:1695 goexit" time="2024-05-10T12:03:43+02:00" level=error msg="Configuration: configuration key not expected: session.cookies.domain" stack="github.com/authelia/authelia/v4/internal/commands/context.go:324 (*CmdCtx).ConfigValidateLogRunE\ngithub.com/authelia/authelia/v4/internal/commands/context.go:186 NewRootCmd.(*CmdCtx).ChainRunE.func1\ngithub.com/spf13/[email protected]/command.go:968 (*Command).execute\ngithub.com/spf13/[email protected]/command.go:1115 (*Command).ExecuteC\ngithub.com/spf13/[email protected]/command.go:1039 (*Command).Execute\ngithub.com/authelia/authelia/v4/cmd/authelia/main.go:10 main\nruntime/internal/atomic/types.go:194 (*Uint32).Load\nruntime/asm_amd64.s:1695 goexit" time="2024-05-10T12:03:43+02:00" level=error msg="Configuration: configuration key not expected: session.cookies.name" stack="github.com/authelia/authelia/v4/internal/commands/context.go:324 (*CmdCtx).ConfigValidateLogRunE\ngithub.com/authelia/authelia/v4/internal/commands/context.go:186 NewRootCmd.(*CmdCtx).ChainRunE.func1\ngithub.com/spf13/[email protected]/command.go:968 (*Command).execute\ngithub.com/spf13/[email protected]/command.go:1115 (*Command).ExecuteC\ngithub.com/spf13/[email protected]/command.go:1039 (*Command).Execute\ngithub.com/authelia/authelia/v4/cmd/authelia/main.go:10 main\nruntime/internal/atomic/types.go:194 (*Uint32).Load\nruntime/asm_amd64.s:1695 goexit" time="2024-05-10T12:03:43+02:00" level=error msg="Configuration: configuration key not expected: session.cookies.same_site" stack="github.com/authelia/authelia/v4/internal/commands/context.go:324 (*CmdCtx).ConfigValidateLogRunE\ngithub.com/authelia/authelia/v4/internal/commands/context.go:186 NewRootCmd.(*CmdCtx).ChainRunE.func1\ngithub.com/spf13/[email protected]/command.go:968 (*Command).execute\ngithub.com/spf13/[email protected]/command.go:1115 (*Command).ExecuteC\ngithub.com/spf13/[email protected]/command.go:1039 (*Command).Execute\ngithub.com/authelia/authelia/v4/cmd/authelia/main.go:10 main\nruntime/internal/atomic/types.go:194 (*Uint32).Load\nruntime/asm_amd64.s:1695 goexit" time="2024-05-10T12:03:43+02:00" level=error msg="Configuration: access_control: rule #1 (domain '*.mydomain.tld'): the network 'internal' is not a valid Group Name, IP, or CIDR notation" stack="github.com/authelia/authelia/v4/internal/commands/context.go:324 (*CmdCtx).ConfigValidateLogRunE\ngithub.com/authelia/authelia/v4/internal/commands/context.go:186 NewRootCmd.(*CmdCtx).ChainRunE.func1\ngithub.com/spf13/[email protected]/command.go:968 (*Command).execute\ngithub.com/spf13/[email protected]/command.go:1115 (*Command).ExecuteC\ngithub.com/spf13/[email protected]/command.go:1039 (*Command).Execute\ngithub.com/authelia/authelia/v4/cmd/authelia/main.go:10 main\nruntime/internal/atomic/types.go:194 (*Uint32).Load\nruntime/asm_amd64.s:1695 goexit" time="2024-05-10T12:03:43+02:00" level=error msg="Configuration: session: option 'domain' and option 'cookies' can't be specified at the same time" stack="github.com/authelia/authelia/v4/internal/commands/context.go:324 (*CmdCtx).ConfigValidateLogRunE\ngithub.com/authelia/authelia/v4/internal/commands/context.go:186 NewRootCmd.(*CmdCtx).ChainRunE.func1\ngithub.com/spf13/[email protected]/command.go:968 (*Command).execute\ngithub.com/spf13/[email protected]/command.go:1115 (*Command).ExecuteC\ngithub.com/spf13/[email protected]/command.go:1039 (*Command).Execute\ngithub.com/authelia/authelia/v4/cmd/authelia/main.go:10 main\nruntime/internal/atomic/types.go:194 (*Uint32).Load\nruntime/asm_amd64.s:1695 goexit" time="2024-05-10T12:03:43+02:00" level=fatal msg="Can't continue due to the errors loading the configuration" stack="github.com/authelia/authelia/v4/internal/commands/context.go:327 (*CmdCtx).ConfigValidateLogRunE\ngithub.com/authelia/authelia/v4/internal/commands/context.go:186 NewRootCmd.(*CmdCtx).ChainRunE.func1\ngithub.com/spf13/[email protected]/command.go:968 (*Command).execute\ngithub.com/spf13/[email protected]/command.go:1115 (*Command).ExecuteC\ngithub.com/spf13/[email protected]/command.go:1039 (*Command).Execute\ngithub.com/authelia/authelia/v4/cmd/authelia/main.go:10 main\nruntime/internal/atomic/types.go:194 (*Uint32).Load\nruntime/asm_amd64.s:1695 goexit" time="2024-05-10T12:03:44+02:00" level=debug msg="Loaded Configuration Sources" files="[/config/configuration.yml]" filters="[]" time="2024-05-10T12:03:44+02:00" level=debug msg="Logging Initialized" fields.level=debug file=/config/authelia.log format= keep_stdout=true time="2024-05-10T12:03:44+02:00" level=debug msg="Process user information" gid=0 gids="1,2,3,4,6,10,11,20,26,27" name=root uid=0 username=root time="2024-05-10T12:03:44+02:00" level=warning msg="Configuration: configuration key 'jwt_secret' is deprecated in 4.38.0 and has been replaced by 'identity_validation.reset_password.jwt_secret': this has not been automatically mapped for you because the replacement key also exists and you will need to adjust your configuration to remove this message" time="2024-05-10T12:03:44+02:00" level=error msg="Configuration: secrets: error loading secret into key 'storage.encryption_key': it's already defined in other configuration sources" stack="github.com/authelia/authelia/v4/internal/commands/context.go:324 (*CmdCtx).ConfigValidateLogRunE\ngithub.com/authelia/authelia/v4/internal/commands/context.go:186 NewRootCmd.(*CmdCtx).ChainRunE.func1\ngithub.com/spf13/[email protected]/command.go:968 (*Command).execute\ngithub.com/spf13/[email protected]/command.go:1115 (*Command).ExecuteC\ngithub.com/spf13/[email protected]/command.go:1039 (*Command).Execute\ngithub.com/authelia/authelia/v4/cmd/authelia/main.go:10 main\nruntime/internal/atomic/types.go:194 (*Uint32).Load\nruntime/asm_amd64.s:1695 goexit" time="2024-05-10T12:03:44+02:00" level=error msg="Configuration: error occurred during unmarshalling configuration: 1 error(s) decoding:\n\n* 'access_control.networks[0]' expected a map, got 'string'" stack="github.com/authelia/authelia/v4/internal/commands/context.go:324 (*CmdCtx).ConfigValidateLogRunE\ngithub.com/authelia/authelia/v4/internal/commands/context.go:186 NewRootCmd.(*CmdCtx).ChainRunE.func1\ngithub.com/spf13/[email protected]/command.go:968 (*Command).execute\ngithub.com/spf13/[email protected]/command.go:1115 (*Command).ExecuteC\ngithub.com/spf13/[email protected]/command.go:1039 (*Command).Execute\ngithub.com/authelia/authelia/v4/cmd/authelia/main.go:10 main\nruntime/internal/atomic/types.go:194 (*Uint32).Load\nruntime/asm_amd64.s:1695 goexit"

Here's my config file, I've checked the yaml validity and it seems ok, so trying to figure out what I've done wrong but can't seem to get my head around it, any help to hunt down the errors in my config file to solve this will be highly appreciated so thanks in advance.

`# yamllint disable rule:comments-indentation

###############################################################################

Authelia Configuration

###############################################################################

Notes:

- the default location of this file is assumed to be configuration.yml unless otherwise noted

- when using docker the container expects this by default to be at /config/configuration.yml

- the default location where this file is loaded from can be overridden with the X_AUTHELIA_CONFIG environment var

- the comments in this configuration file are helpful but users should consult the official documentation on the

website at https://www.authelia.com/ or https://www.authelia.com/configuration/prologue/introduction/

- this configuration file template is not automatically updated

Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to

the system certificates store.

They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem.

certificates_directory: '/config/certificates/'

The theme to display: light, dark, grey, auto.

theme: 'dark'

Set the default 2FA method for new users and for when a user has a preferred method configured that has been

disabled. This setting must be a method that is enabled.

Options are totp, webauthn, mobile_push.

default_2fa_method: ''

Server Configuration

server:

The address for the Main server to listen on in the address common syntax.

Formats:

- [://][:][/]

- [://][hostname]:[/]

Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'.

The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9091'.

If the path is specified this configures the router to handle both the / path and the configured path.

address: 'tcp://:9091/authelia'

Set the path on disk to Authelia assets.

Useful to allow overriding of specific static assets.

asset_path: '/config/assets/'

Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0.

This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist.

disable_healthcheck: false

Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour.

tls:

## The path to the DER base64/PEM format private key.
# key: ''

## The path to the DER base64/PEM format public certificate.
# certificate: ''

## The list of certificates for client authentication.
# client_certificates: []

Server headers configuration/customization.

headers:

## The CSP Template. Read the docs.
# csp_template: ''

Server Buffers configuration.

buffers:

## Buffers usually should be configured to be the same value.
## Explanation at https://www.authelia.com/c/server#buffer-sizes
## Read buffer size adjusts the server's max incoming request size in bytes.
## Write buffer size does the same for outgoing responses.

## Read buffer.
# read: 4096

## Write buffer.
# write: 4096

Server Timeouts configuration.

timeouts:

## Read timeout in the duration common syntax.
# read: '6 seconds'

## Write timeout in the duration common syntax.
# write: '6 seconds'

## Idle timeout in the duration common syntax.
# idle: '30 seconds'

Server Endpoints configuration.

This section is considered advanced and it SHOULD NOT be configured unless you've read the relevant documentation.

endpoints:

## Enables the pprof endpoint.
# enable_pprof: false

## Enables the expvars endpoint.
# enable_expvars: false

## Configure the authz endpoints.
# authz:
  # forward-auth:
    # implementation: 'ForwardAuth'
    # authn_strategies: []
  # ext-authz:
    # implementation: 'ExtAuthz'
    # authn_strategies: []
  # auth-request:
    # implementation: 'AuthRequest'
    # authn_strategies: []
  # legacy:
    # implementation: 'Legacy'
    # authn_strategies: []

Log Configuration

log:

Level of verbosity for logs: info, debug, trace.

level: 'debug'

Format the logs are written as: json, text.

format: 'json'

File path where the logs will be written. If not set logs are written to stdout.

file_path: '/config/authelia.log'

Whether to also log to stdout when a log_file_path is defined.

keep_stdout: true

Telemetry Configuration

telemetry:

Metrics Configuration

metrics:
## Enable Metrics.
enabled: false

## The address for the Metrics server to listen on in the address common syntax.
## Formats:
##  - [<scheme>://]<hostname>[:<port>][/<path>]
##  - [<scheme>://][hostname]:<port>[/<path>]
## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'.
## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9959'.
## If the path is not specified it defaults to `/metrics`.
# address: 'tcp://:9959/metrics'

## Metrics Server Buffers configuration.
# buffers:

  ## Read buffer.
  # read: 4096

  ## Write buffer.
  # write: 4096

## Metrics Server Timeouts configuration.
# timeouts:

  ## Read timeout in the duration common syntax.
  # read: '6 seconds'

  ## Write timeout in the duration common syntax.
  # write: '6 seconds'

  ## Idle timeout in the duration common syntax.
  # idle: '30 seconds'

TOTP Configuration

Parameters used for TOTP generation.

totp:

Disable TOTP.

disable: false

The issuer name displayed in the Authenticator application of your choice.

issuer: 'mydomain.tld'

The TOTP algorithm to use.

It is CRITICAL you read the documentation before changing this option:

https://www.authelia.com/c/totp#algorithm

algorithm: 'SHA1'

The number of digits a user has to input. Must either be 6 or 8.

Changing this option only affects newly generated TOTP configurations.

It is CRITICAL you read the documentation before changing this option:

https://www.authelia.com/c/totp#digits

digits: 6

The period in seconds a Time-based One-Time Password is valid for.

Changing this option only affects newly generated TOTP configurations.

period: 30

The skew controls number of Time-based One-Time Passwords either side of the current one that are valid.

Warning: before changing skew read the docs link below.

skew: 1

See: https://www.authelia.com/c/totp#input-validation to read

the documentation.

The size of the generated shared secrets. Default is 32 and is sufficient in most use cases, minimum is 20.

secret_size: 32

The allowed algorithms for a user to pick from.

allowed_algorithms:

- 'SHA1'

The allowed digits for a user to pick from.

allowed_digits:

- 6

The allowed periods for a user to pick from.

allowed_periods:

- 30

Disable the reuse security policy which prevents replays of one-time password code values.

disable_reuse_security_policy: false

WebAuthn Configuration

Parameters used for WebAuthn.

webauthn:

Disable WebAuthn.

disable: false

The interaction timeout for WebAuthn dialogues in the duration common syntax.

timeout: '60 seconds'

The display name the browser should show the user for when using WebAuthn to login/register.

display_name: 'Authelia'

Conveyance preference controls if we collect the attestation statement including the AAGUID from the device.

Options are none, indirect, direct.

attestation_conveyance_preference: 'indirect'

User verification controls if the user must make a gesture or action to confirm they are present.

Options are required, preferred, discouraged.

user_verification: 'preferred'

Identity Validation Configuration

This configuration tunes the identity validation flows.

identity_validation:

Reset Password flow. Adjusts how the reset password flow operates.

reset_password:
## Maximum allowed time before the JWT is generated and when the user uses it in the duration common syntax.
jwt_lifespan: '5 minutes'

## The algorithm used for the Reset Password JWT.
jwt_algorithm: 'HS256'

## The secret key used to sign and verify the JWT.
jwt_secret: 'v3ry_important_s3cr3t'

Elevated Session flows. Adjusts the flow which require elevated sessions for example managing credentials, adding,

removing, etc.

elevated_session:

## Maximum allowed lifetime after the One-Time Code is generated that it is considered valid.
# code_lifespan: '5 minutes'

## Maximum allowed lifetime after the user uses the One-Time Code and the user must perform the validation again in
## the duration common syntax.
# elevation_lifespan: '10 minutes'

## Number of characters the one-time password contains.
# characters: 8

## In addition to the One-Time Code requires the user performs a second factor authentication.
# require_second_factor: false

## Skips the elevation requirement and entry of the One-Time Code if the user has performed second factor
## authentication.
# skip_second_factor: false

NTP Configuration

This is used to validate the servers time is accurate enough to validate TOTP.

ntp:

The address of the NTP server to connect to in the address common syntax.

Format: [://][:].

Square brackets indicate optional portions of the format. Scheme must be 'udp', 'udp4', or 'udp6'.

The default scheme is 'udp'. The default port is '123'.

address: 'udp://time.cloudflare.com:123'

NTP version.

version: 4

Maximum allowed time offset between the host and the NTP server in the duration common syntax.

max_desync: '3 seconds'

Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you

set this to true, and can operate in a truly offline mode.

disable_startup_check: false

The default of false will prevent startup only if we can contact the NTP server and the time is out of sync with

the NTP server more than the configured max_desync. If you set this to true, an error will be logged but startup

will continue regardless of results.

disable_failure: false

Authentication Backend Provider Configuration

Used for verifying user passwords and retrieve information such as email address and groups users belong to.

The available providers are: file, ldap. You must use only one of these providers.

authentication_backend:

Password Reset Options.

password_reset:
## Disable both the HTML element and the API for reset password functionality.
disable: false

## External reset password url that redirects the user to an external reset portal. This disables the internal reset
## functionality.
# custom_url: ''

## The dial timeout for LDAP in the duration common syntax.
# timeout: '5 seconds'

## Use StartTLS with the LDAP connection.
# start_tls: false

# tls:
  ## The server subject name to check the servers certificate against during the validation process.
  ## This option is not required if the certificate has a SAN which matches the address options hostname.
  # server_name: 'ldap.example.com'

  ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
  ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
  ## defined by the `certificates_directory` option at the top of the configuration.
  ## It's important to note the public key should be added to the directory, not the private key.
  ## This option is strongly discouraged but may be useful in some self-signed situations where validation is not
  ## important to the administrator.
  # skip_verify: false

  ## Minimum TLS version for the connection.
  # minimum_version: 'TLS1.2'

  ## Maximum TLS version for the connection.
  # maximum_version: 'TLS1.3'

  ## The certificate chain used with the private_key if the server requests TLS Client Authentication
  ## i.e. Mutual TLS.
  # certificate_chain: |
    # -----BEGIN CERTIFICATE-----
    # ...
    # -----END CERTIFICATE-----
    # -----BEGIN CERTIFICATE-----
    # ...
    # -----END CERTIFICATE-----

  ## The private key used with the certificate_chain if the server requests TLS Client Authentication
  ## i.e. Mutual TLS.
  # private_key: |
    # -----BEGIN RSA PRIVATE KEY-----
    # ...
    # -----END RSA PRIVATE KEY-----

## The distinguished name of the container searched for objects in the directory information tree.
## See also: additional_users_dn, additional_groups_dn.
# base_dn: 'dc=example,dc=com'

## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users.
## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users.
# additional_users_dn: 'ou=users'

## The users filter used in search queries to find the user profile based on input filled in login form.
## Various placeholders are available in the user filter which you can read about in the documentation which can
## be found at: https://www.authelia.com/c/ldap#users-filter-replacements
##
## Recommended settings are as follows:
## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
## - OpenLDAP:
##   - (&({username_attribute}={input})(objectClass=person))
##   - (&({username_attribute}={input})(objectClass=inetOrgPerson))
##
## To allow sign in both with username and email, one can use a filter like
## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
# users_filter: '(&({username_attribute}={input})(objectClass=person))'

## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups.
## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups.
# additional_groups_dn: 'ou=groups'

## The groups filter used in search queries to find the groups based on relevant authenticated user.
## Various placeholders are available in the groups filter which you can read about in the documentation which can
## be found at: https://www.authelia.com/c/ldap#groups-filter-replacements
##
## If your groups use the `groupOfUniqueNames` structure use this instead:
##    (&(uniqueMember={dn})(objectClass=groupOfUniqueNames))
# groups_filter: '(&(member={dn})(objectClass=groupOfNames))'

## The group search mode to use. Options are 'filter' or 'memberof'. It's essential to read the docs if you wish to
## use 'memberof'. Also 'filter' is the best choice for most use cases.
# group_search_mode: 'filter'

## Follow referrals returned by the server.
## This is especially useful for environments where read-only servers exist. Only implemented for write operations.
# permit_referrals: false

## The username and password of the admin user.
# user: 'cn=admin,dc=example,dc=com'
## Password can also be set using a secret: https://www.authelia.com/c/secrets
# password: 'password'

## The attributes for users and objects from the directory server.
# attributes:

  ## The distinguished name attribute if your directory server supports it. Users should read the docs before
  ## configuring. Only used for the 'memberof' group search mode.
  # distinguished_name: ''

  ## The attribute holding the username of the user. This attribute is used to populate the username in the session
  ## information. For your information, Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP
  ## usually uses 'uid'. Beware that this attribute holds the unique identifiers for the users binding the user and
  ## the configuration stored in database; therefore only single value attributes are allowed and the value must
  ## never be changed once attributed to a user otherwise it would break the configuration for that user.
  ## Technically non-unique attributes like 'mail' can also be used but we don't recommend using them, we instead
  ## advise to use a filter to perform alternative lookups and the attributes mentioned above
  ## (sAMAccountName and uid) to follow https://datatracker.ietf.org/doc/html/rfc2307.
  # username: 'uid'

  ## The attribute holding the display name of the user. This will be used to greet an authenticated user.
  # display_name: 'displayName'

  ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only
  ## the first one returned by the directory server is used.
  # mail: 'mail'

  ## The attribute which provides distinguished names of groups an object is a member of.
  ## Only used for the 'memberof' group search mode.
  # member_of: 'memberOf'

  ## The attribute holding the name of the group.
  # group_name: 'cn'

File (Authentication Provider)

With this backend, the users database is stored in a file which is updated when users reset their passwords.

Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia

to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security

implications it is highly recommended you leave the default values. Before considering changing these settings

please read the docs page below:

https://www.authelia.com/r/passwords#tuning

Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness

file:
path: '/config/users_database.yml'
password:
algorithm: 'argon2'
argon2:
variant: 'argon2id'
iterations: 3
memory: 4096
parallelism: 8
key_length: 32
salt_length: 16

Password Policy Configuration.

password_policy:

The standard policy allows you to tune individual settings manually.

standard:
enabled: false

## Require a minimum length for passwords.
min_length: 8

## Require a maximum length for passwords.
max_length: 0

## Require uppercase characters.
require_uppercase: true

## Require lowercase characters.
require_lowercase: true

## Require numeric characters.
require_number: true

## Require special characters.
require_special: true

zxcvbn is a well known and used password strength algorithm. It does not have tunable settings.

zxcvbn:
enabled: false

## Configures the minimum score allowed.
min_score: 3

Privacy Policy Configuration

Parameters used for displaying the privacy policy link and drawer.

privacy_policy:

Enables the display of the privacy policy using the policy_url.

enabled: false

Enables the display of the privacy policy drawer which requires users accept the privacy policy

on a per-browser basis.

require_user_acceptance: false

The URL of the privacy policy document. Must be an absolute URL and must have the 'https://' scheme.

If the privacy policy enabled option is true, this MUST be provided.

policy_url: ''

Access Control Configuration

Access control is a list of rules defining the authorizations applied for one resource to users or group of users.

If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed

to anyone. Otherwise restrictions follow the rules defined.

Note: One can use the wildcard * to match any subdomain.

It must stand at the beginning of the pattern. (example: *.example.com)

Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct.

Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'.

- 'domain' defines which domain or set of domains the rule applies to.

- 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not

provided. If provided, the parameter represents either a user or a group. It should be of the form

'user:' or 'group:'.

- 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'.

- 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter

is optional and matches any resource if not provided.

Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.

access_control:

Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any

resource if there is no policy to be applied to the user.

default_policy: 'deny'

networks:
- name: 'internal'
networks:
- '10.0.1.0/24'
- '172.16.0.0/12'

rules:

Rules applied to everyone

 - domain: '*.mydomain.tld'
   policy: 'two_factor'
   networks:
     - 'internal'
 - domain: '*.mydomain.tld'
   policy: 'one_factor'

networks:

# - name: 'internal'
#   networks:
    # - '10.10.0.0/16'
    # - '192.168.2.0/24'
# - name: 'VPN'
#   networks: '10.9.0.0/16'

Session Provider Configuration

The session cookies identify the user once logged in.

The available providers are: memory, redis. Memory is the provider unless redis is defined.

session:

The secret to encrypt the session data. This is only used with Redis / Redis Sentinel.

Secret can also be set using a secret: https://www.authelia.com/c/secrets

secret: '1ns3cur3_s3ss10n_s3cr3t'

Cookies configures the list of allowed cookie domains for sessions to be created on.

Undefined values will default to the values below.

cookies:

-

  ## The name of the session cookie.
  name: 'authelia_session'

  ## The domain to protect.
  ## Note: the Authelia portal must also be in that domain.
  domain: 'mydomain.tld'

  ## Required. The fully qualified URI of the portal to redirect users to on proxies that support redirections.
  ## Rules:
  ##   - MUST use the secure scheme 'https://'
  ##   - The above 'domain' option MUST either:
  ##      - Match the host portion of this URI.
  ##      - Match the suffix of the host portion when prefixed with '.'.
  authelia_url: 'https://auth.mydomain.tld'

  ## Optional. The fully qualified URI used as the redirection location if the portal is accessed directly. Not
  ## configuring this option disables the automatic redirection behaviour.
  ##
  ## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication
  ## unless they were redirected to Authelia by the proxy.
  ##
  ## Rules:
  ##   - MUST use the secure scheme 'https://'
  ##   - MUST not match the 'authelia_url' option.
  ##   - The above 'domain' option MUST either:
  ##      - Match the host portion of this URI.
  ##      - Match the suffix of the host portion when prefixed with '.'.
  # default_redirection_url: 'https://www.example.com'

  ## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
  ## Please read https://www.authelia.com/c/session#same_site
  same_site: 'lax'

Regulation Configuration

This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are made

in a short period of time.

regulation:

The number of failed login attempts before user is banned. Set it to 0 to disable regulation.

max_retries: 3

The time range during which the user can attempt login before being banned in the duration common syntax. The user

is banned if the authentication failed 'max_retries' times in a 'find_time' seconds window.

find_time: '2 minutes'

The length of time before a banned user can login again in the duration common syntax.

ban_time: '5 minutes'

Storage Provider Configuration

The available providers are: local, mysql, postgres. You must use one and only one of these providers.

storage:

The encryption key that is used to encrypt sensitive information in the database. Must be a string with a minimum

length of 20. Please see the docs if you configure this with an undesirable key and need to change it, you MUST use

the CLI to change this in the database if you want to change it from a previously configured value.

encryption_key: 'an0th3r_v3ry_important_s3cr3t'

Local (Storage Provider)

This stores the data in a SQLite3 Database.

This is only recommended for lightweight non-stateful installations.

Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness

local:
## Path to the SQLite3 Database.
path: '/config/db.sqlite3'

Notification Provider

Notifications are sent to users when they require a password reset, a WebAuthn registration or a TOTP registration.

The available providers are: filesystem, smtp. You must use only one of these providers.

notifier:

You can disable the notifier startup check by setting this to true.

disable_startup_check: false

File System (Notification Provider)

Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness

filesystem:
filename: '/config/notification.txt'
`

[james-d-elliott]

You have two primary issues.

Your session config doesn't match the template or the docs (need to uncomment the cookies list), see here: https://www.authelia.com/configuration/session/introduction/#configuration

Your server config section doesn't match the template or the docs (indentation issue on address), see here: https://www.authelia.com/configuration/miscellaneous/server/#configuration

[aldialloMC]

Hi @james-d-elliott ,

First of all thank you for the helping hand, really appreciate it.

Concerning the cookie list, I thought I had it uncomment as per below, is it the fact that inactivity, expiration and remember_me are not uncommented that is causing one of the primary issues? I'm still checking the server section to try to understand.

`##

Session Provider Configuration

The session cookies identify the user once logged in.

The available providers are: memory, redis. Memory is the provider unless redis is defined.

session:

The secret to encrypt the session data. This is only used with Redis / Redis Sentinel.

Secret can also be set using a secret: https://www.authelia.com/c/secrets

secret: '1ns3cur3_s3ss10n_s3cr3t'

Cookies configures the list of allowed cookie domains for sessions to be created on.

Undefined values will default to the values below.

cookies:

-

  ## The name of the session cookie.
  name: 'authelia_session'

  ## The domain to protect.
  ## Note: the Authelia portal must also be in that domain.
  domain: 'mydomain.tld'

  ## Required. The fully qualified URI of the portal to redirect users to on proxies that support redirections.
  ## Rules:
  ##   - MUST use the secure scheme 'https://'
  ##   - The above 'domain' option MUST either:
  ##      - Match the host portion of this URI.
  ##      - Match the suffix of the host portion when prefixed with '.'.
  authelia_url: 'https://auth.mydomain.tld'

  ## Optional. The fully qualified URI used as the redirection location if the portal is accessed directly. Not
  ## configuring this option disables the automatic redirection behaviour.
  ##
  ## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication
  ## unless they were redirected to Authelia by the proxy.
  ##
  ## Rules:
  ##   - MUST use the secure scheme 'https://'
  ##   - MUST not match the 'authelia_url' option.
  ##   - The above 'domain' option MUST either:
  ##      - Match the host portion of this URI.
  ##      - Match the suffix of the host portion when prefixed with '.'.
  # default_redirection_url: 'https://www.example.com'

  ## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
  ## Please read https://www.authelia.com/c/session#same_site
  same_site: 'lax'

  ## The value for inactivity, expiration, and remember_me are in seconds or the duration common syntax.
  ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure
  ## because a stolen cookie will last longer giving attackers more time to spy or attack.

  ## The inactivity time before the session is reset. If expiration is set to 1h, and this is set to 5m, if the user
  ## does not select the remember me option their session will get destroyed after 1h, or after 5m since the last
  ## time Authelia detected user activity.
  # inactivity: '5 minutes'

  ## The time before the session cookie expires and the session is destroyed if remember me IS NOT selected by the
  ## user.
  # expiration: '1 hour'

  ## The time before the cookie expires and the session is destroyed if remember me IS selected by the user. Setting
  ## this value to -1 disables remember me for this session cookie domain. If allowed and the user uses the remember
  ## me checkbox this overrides the expiration option and disables the inactivity option.
  # remember_me: '1 month'

Cookie Session Domain default 'name' value.

name: 'authelia_session'

Cookie Session Domain default 'same_site' value.

same_site: 'lax'

Cookie Session Domain default 'inactivity' value.

inactivity: '5m'

Cookie Session Domain default 'expiration' value.

expiration: '1h'

Cookie Session Domain default 'remember_me' value.

remember_me: '1M'
`

[james-d-elliott]

The YAML list itself is not uncommented, denoted by a - or [].

[aldialloMC]

Thanks @james-d-elliott

I've made some progress but seem to be blocked here with this section:

`access_control:
default_policy: 'deny'
networks:

• name: 'internal'
  networks:
  • '10.0.1.0/24'
  • '172.16.0.0/12'

rules:

Rules applied to everyone

• domain: '*.mydomain.tld'
  policy: 'one_factor'
  networks:
  • 'internal'
• domain: '*.mydomain.tld'
  policy: 'two_factor'

Session Provider Configuration`

as I keep getting the below error in the logs:

ime="2024-05-10T16:55:48+02:00" level=warning msg="Configuration: session: option 'domain' is deprecated in v4.38.0 and has been replaced by a multi-domain configuration: this has automatically been mapped for you but you will need to adjust your configuration to remove this message and receive the latest messages" time="2024-05-10T16:55:48+02:00" level=error msg="Configuration: failed to load configuration from file path(/config/configuration.yml) source: yaml: line 591: did not find expected key" time="2024-05-10T16:55:48+02:00" level=error msg="Configuration: error occurred during unmarshalling configuration: 1 error(s) decoding:\n\n* 'access_control.networks[0]' expected a map, got 'string'" time="2024-05-10T16:55:48+02:00" level=error msg="Configuration: access_control: 'default_policy' option 'deny' is invalid: when no rules are specified it must be 'two_factor' or 'one_factor'"

The syntax seems to match what I can see here , the yaml syntax also seems to be ok, so not sure what I'm doing wrong here.

[james-d-elliott]

You've not fixed the indentation. You have 5 spaces instead of 4. You should check this section of the docs out: https://www.authelia.com/configuration/methods/files/#yaml-validation

[aldialloMC]

Sorry, I'm already using VS code and the following site to check the code, I've recheck and it does seem that I have 4 spaces and not 5 before the 1st character, maybe I didn't do my copy/paste correctly and still had the old code in cache or I'm definitively missing something, may I ask you to check again and advise if you still see 5 space on your side please? , I've also added a screenshot just in case

`## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter

is optional and matches any resource if not provided.

Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.

access_control:
default_policy: 'deny'
networks:

• name: 'internal'
  networks:
  • '10.0.1.0/24'
  • '172.16.0.0/12'

rules:

Rules applied to everyone

• domain: '*.mydomain.tld'
  policy: 'one_factor'
  networks:
  • 'internal'
• domain: '*.mydomain.tld'
  policy: 'two_factor'

Session Provider Configuration

The session cookies identify the user once logged in.

The available providers are: memory, redis. Memory is the provider unless redis is defined.

session:
secret: 'ins3cur3_s3ss10n_s3cr3t'
name: 'authelia_session'
same_site: 'lax'
inactivity: '5 minutes'
expiration: '1 hour'
remember_me: '1 day'
cookies:
- domain: 'mydomain.tld'
authelia_url: 'https://auth.mydomain.tld'
name: 'authelia_session'
same_site: 'lax'
inactivity: '5 minutes'
expiration: '1 hour'
remember_me: '1 day'

Cookie Session Domain default 'name' value.

name: 'authelia_session'

Cookie Session Domain default 'same_site' value.

same_site: 'lax'

Cookie Session Domain default 'inactivity' value.

inactivity: '5m'

Cookie Session Domain default 'expiration' value.

expiration: '1h'

Cookie Session Domain default 'remember_me' value.

remember_me: '1M'

`

[james-d-elliott]

With the indentation fixes to everything I've shown you the config validates with 4.38.8 other than the parts included as secrets. The section copied there looks fine.

[james-d-elliott]

You probably want to check all the options under server: again as they were notably wrong again in the previous full config, specifically address and diable_healthcheck were not intended.

[aldialloMC]

Will do that, thank you.