# yamllint disable rule:comments-indentation
---
###############################################################################
#                           Authelia Configuration                            #
###############################################################################

## Note: the container by default expects to find this file at /config/configuration.yml.

## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to
## the system certificates store.
## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem.
# certificates_directory: /config/certificates/

## The theme to display: light, dark, grey, auto.
theme: dark

## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be
## set using a secret: https://www.authelia.com/c/secrets
jwt_secret: mydwxdd-c2hbo6zcmab1mzj232zx4

## Default redirection URL
##
## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end
## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use
## in such a case.
##
## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
default_redirection_url: https://auth.godopu.net/authenticated

## Set the default 2FA method for new users and for when a user has a preferred method configured that has been
## disabled. This setting must be a method that is enabled.
## Options are totp, webauthn, mobile_push.
default_2fa_method: ""

##
## Server Configuration
##
server:

  ## The address to listen on.
  host: 0.0.0.0

  ## The port to listen on.
  port: 9091

  ## Set the single level path Authelia listens on.
  ## Must be alphanumeric chars and should not contain any slashes.
  path: ""

  ## Set the path on disk to Authelia assets.
  ## Useful to allow overriding of specific static assets.
  # asset_path: /config/assets/

  ## Buffers usually should be configured to be the same value.
  ## Explanation at https://www.authelia.com/c/server#buffer-sizes
  ## Read buffer size adjusts the server's max incoming request size in bytes.
  ## Write buffer size does the same for outgoing responses.
  read_buffer_size: 4096
  write_buffer_size: 4096

  ## Enables the pprof endpoint.
  enable_pprof: false

  ## Enables the expvars endpoint.
  enable_expvars: false

  ## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0.
  ## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist.
  disable_healthcheck: false

  ## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour.
  tls:
    ## The path to the DER base64/PEM format private key.
    key: ""

    ## The path to the DER base64/PEM format public certificate.
    certificate: ""

    ## The list of certificates for client authentication.
    client_certificates: []

  ## Server headers configuration/customization.
  headers:

    ## The CSP Template. Read the docs.
    csp_template: ""

##
## Log Configuration
##
log:
  ## Level of verbosity for logs: info, debug, trace.
  level: debug

  ## Format the logs are written as: json, text.
  # format: json

  ## File path where the logs will be written. If not set logs are written to stdout.
  # file_path: /config/authelia.log

  ## Whether to also log to stdout when a log_file_path is defined.
  # keep_stdout: false

##
## Telemetry Configuration
##
telemetry:

  ##
  ## Metrics Configuration
  ##
  metrics:
    ## Enable Metrics.
    enabled: false

    ## The address to listen on for metrics. This should be on a different port to the main server.port value.
    address: tcp://0.0.0.0:9959

##
## TOTP Configuration
##
## Parameters used for TOTP generation.
totp:
  ## Disable TOTP.
  disable: false

  ## The issuer name displayed in the Authenticator application of your choice.
  issuer: godopu.net

  ## The TOTP algorithm to use.
  ## It is CRITICAL you read the documentation before changing this option:
  ## https://www.authelia.com/c/totp#algorithm
  algorithm: sha1

  ## The number of digits a user has to input. Must either be 6 or 8.
  ## Changing this option only affects newly generated TOTP configurations.
  ## It is CRITICAL you read the documentation before changing this option:
  ## https://www.authelia.com/c/totp#digits
  digits: 6

  ## The period in seconds a one-time password is valid for.
  ## Changing this option only affects newly generated TOTP configurations.
  period: 30

  ## The skew controls number of one-time passwords either side of the current one that are valid.
  ## Warning: before changing skew read the docs link below.
  skew: 1
  ## See: https://www.authelia.com/c/totp#input-validation to read
  ## the documentation.

  ## The size of the generated shared secrets. Default is 32 and is sufficient in most use cases, minimum is 20.
  secret_size: 32

##
## WebAuthn Configuration
##
## Parameters used for WebAuthn.
webauthn:
  ## Disable Webauthn.
  disable: false

  ## Adjust the interaction timeout for Webauthn dialogues.
  timeout: 60s

  ## The display name the browser should show the user for when using Webauthn to login/register.
  display_name: Authelia

  ## Conveyance preference controls if we collect the attestation statement including the AAGUID from the device.
  ## Options are none, indirect, direct.
  attestation_conveyance_preference: indirect

  ## User verification controls if the user must make a gesture or action to confirm they are present.
  ## Options are required, preferred, discouraged.
  user_verification: preferred

##
## Duo Push API Configuration
##
## Parameters used to contact the Duo API. Those are generated when you protect an application of type
## "Partner Auth API" in the management panel.
duo_api:
  disable: false
  hostname: api-123456789.example.com
  integration_key: ABCDEF
  ## Secret can also be set using a secret: https://www.authelia.com/c/secrets
  secret_key: 1234567890abcdefghifjkl
  enable_self_enrollment: false

##
## NTP Configuration
##
## This is used to validate the servers time is accurate enough to validate TOTP.
ntp:
  ## NTP server address.
  address: "time.cloudflare.com:123"

  ## NTP version.
  version: 4

  ## Maximum allowed time offset between the host and the NTP server.
  max_desync: 3s

  ## Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you
  ## set this to true, and can operate in a truly offline mode.
  disable_startup_check: false

  ## The default of false will prevent startup only if we can contact the NTP server and the time is out of sync with
  ## the NTP server more than the configured max_desync. If you set this to true, an error will be logged but startup
  ## will continue regardless of results.
  disable_failure: false

##
## Authentication Backend Provider Configuration
##
## Used for verifying user passwords and retrieve information such as email address and groups users belong to.
##
## The available providers are: `file`, `ldap`. You must use only one of these providers.
authentication_backend:

  # ## Password Reset Options.
  # password_reset:
  #   ## Disable both the HTML element and the API for reset password functionality.
  #   disable: false

  #   ## External reset password url that redirects the user to an external reset portal. This disables the internal reset
  #   ## functionality.
  #   custom_url: ""

  # ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.
  # ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
  # ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
  # ## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
  # ## See the below documentation for more information.
  # ## Duration Notation docs:  https://www.authelia.com/c/common#duration-notation-format
  # ## Refresh Interval docs: https://www.authelia.com/c/1fa#refresh-interval
  # refresh_interval: 5m

  # ##
  # ## LDAP (Authentication Provider)
  # ##
  # ## This is the recommended Authentication Provider in production
  # ## because it allows Authelia to offload the stateful operations
  # ## onto the LDAP service.
  # ldap:
  #   ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
  #   ## Acceptable options are as follows:
  #   ## - 'activedirectory' - For Microsoft Active Directory.
  #   ## - 'custom' - For custom specifications of attributes and filters.
  #   ## This currently defaults to 'custom' to maintain existing behaviour.
  #   ##
  #   ## Depending on the option here certain other values in this section have a default value, notably all of the
  #   ## attribute mappings have a default value that this config overrides, you can read more about these default values
  #   ## at https://www.authelia.com/c/ldap#defaults
  #   implementation: custom

  #   ## The url to the ldap server. Format: <scheme>://<address>[:<port>].
  #   ## Scheme can be ldap or ldaps in the format (port optional).
  #   url: ldap://127.0.0.1

  #   ## The dial timeout for LDAP.
  #   timeout: 5s

  #   ## Use StartTLS with the LDAP connection.
  #   start_tls: false

  #   tls:
  #     ## Server Name for certificate validation (in case it's not set correctly in the URL).
  #     # server_name: ldap.example.com

  #     ## Skip verifying the server certificate (to allow a self-signed certificate).
  #     ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
  #     ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
  #     skip_verify: false

  #     ## Minimum TLS version for either Secure LDAP or LDAP StartTLS.
  #     minimum_version: TLS1.2

  #   ## The distinguished name of the container searched for objects in the directory information tree.
  #   ## See also: additional_users_dn, additional_groups_dn.
  #   base_dn: dc=example,dc=com

  #   ## The attribute holding the username of the user. This attribute is used to populate the username in the session
  #   ## information. It was introduced due to #561 to handle case insensitive search queries. For you information,
  #   ## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this
  #   ## attribute holds the unique identifiers for the users binding the user and the configuration stored in database.
  #   ## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user
  #   ## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also
  #   ## be used but we don't recommend using them, we instead advise to use the attributes mentioned above
  #   ## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt.
  #   # username_attribute: uid

  #   ## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users.
  #   ## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users.
  #   additional_users_dn: ou=users

  #   ## The users filter used in search queries to find the user profile based on input filled in login form.
  #   ## Various placeholders are available in the user filter which you can read about in the documentation which can
  #   ## be found at: https://www.authelia.com/c/ldap#users-filter-replacements
  #   ##
  #   ## Recommended settings are as follows:
  #   ## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
  #   ## - OpenLDAP:
  #   ##   - (&({username_attribute}={input})(objectClass=person))
  #   ##   - (&({username_attribute}={input})(objectClass=inetOrgPerson))
  #   ##
  #   ## To allow sign in both with username and email, one can use a filter like
  #   ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
  #   users_filter: (&({username_attribute}={input})(objectClass=person))

  #   ## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups.
  #   ## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups.
  #   additional_groups_dn: ou=groups

  #   ## The groups filter used in search queries to find the groups based on relevant authenticated user.
  #   ## Various placeholders are available in the groups filter which you can read about in the documentation which can
  #   ## be found at: https://www.authelia.com/c/ldap#groups-filter-replacements
  #   ##
  #   ## If your groups use the `groupOfUniqueNames` structure use this instead:
  #   ##    (&(uniqueMember={dn})(objectClass=groupOfUniqueNames))
  #   groups_filter: (&(member={dn})(objectClass=groupOfNames))

  #   ## The attribute holding the name of the group.
  #   # group_name_attribute: cn

  #   ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
  #   ## first one returned by the LDAP server is used.
  #   # mail_attribute: mail

  #   ## The attribute holding the display name of the user. This will be used to greet an authenticated user.
  #   # display_name_attribute: displayName

  #   ## Follow referrals returned by the server.
  #   ## This is especially useful for environments where read-only servers exist. Only implemented for write operations.
  #   permit_referrals: false

  #   ## The username and password of the admin user.
  #   user: cn=admin,dc=example,dc=com
  #   ## Password can also be set using a secret: https://www.authelia.com/c/secrets
  #   password: password

  ##
  ## File (Authentication Provider)
  ##
  ## With this backend, the users database is stored in a file which is updated when users reset their passwords.
  ## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia
  ## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security
  ## implications it is highly recommended you leave the default values. Before considering changing these settings
  ## please read the docs page below:
  ## https://www.authelia.com/r/passwords#tuning
  ##
  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
  ##
  file:
    path: /config/users_database.yml
    password:
      algorithm: argon2id
      iterations: 1
      key_length: 32
      salt_length: 16
      memory: 1024
      parallelism: 8

##
## Password Policy Configuration.
##
password_policy:

  ## The standard policy allows you to tune individual settings manually.
  standard:
    enabled: false

    ## Require a minimum length for passwords.
    min_length: 8

    ## Require a maximum length for passwords.
    max_length: 0

    ## Require uppercase characters.
    require_uppercase: true

    ## Require lowercase characters.
    require_lowercase: true

    ## Require numeric characters.
    require_number: true

    ## Require special characters.
    require_special: true

  ## zxcvbn is a well known and used password strength algorithm. It does not have tunable settings.
  zxcvbn:
    enabled: false

    ## Configures the minimum score allowed.
    min_score: 3

##
## Access Control Configuration
##
## Access control is a list of rules defining the authorizations applied for one resource to users or group of users.
##
## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed
## to anyone. Otherwise restrictions follow the rules defined.
##
## Note: One can use the wildcard * to match any subdomain.
## It must stand at the beginning of the pattern. (example: *.mydomain.com)
##
## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct.
##
## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'.
##
## - 'domain' defines which domain or set of domains the rule applies to.
##
## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not
##    provided. If provided, the parameter represents either a user or a group. It should be of the form
##    'user:<username>' or 'group:<groupname>'.
##
## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'.
##
## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter
##   is optional and matches any resource if not provided.
##
## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.
access_control:
  ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
  ## resource if there is no policy to be applied to the user.
  default_policy: deny

  networks:
    - name: internal
      networks:
        - 10.10.0.0/16
        - 192.168.2.0/24
    - name: VPN
      networks: 10.9.0.0/16

  rules:
    ## Rules applied to everyone
    - domain: 'auth.godopu.net'
      policy: bypass

    ## Domain Regex examples. Generally we recommend just using a standard domain.
    # - domain_regex: '^(?P<User>\w+)\.example\.com$'
    #   policy: one_factor
    # - domain_regex: '^(?P<Group>\w+)\.example\.com$'
    #   policy: one_factor
    # - domain_regex:
    #    - '^appgroup-.*\.example\.com$'
    #    - '^appgroup2-.*\.example\.com$'
    #   policy: one_factor
    # - domain_regex: '^.*\.example\.com$'
    #   policy: two_factor

    - domain: 'iot.knu.ac.kr'
      policy: one_factor
    - domain: 'protocol.knu.ac.kr'
      policy: one_factor
      ## Network based rule, if not provided any network matches.
      # networks:
      #   - internal
      #   - VPN
      #   - 192.168.1.0/24
      #   - 10.0.0.1

    # - domain:
    #     - 'auth.godopu.com'
    #     - 'auth.godopu.com'
    #   policy: two_factor

    # - domain: 'singlefactor.example.com'
    #   policy: one_factor

    # ## Rules applied to 'admins' group
    # - domain: 'mx2.mail.example.com'
    #   subject: 'group:admins'
    #   policy: deny

    # - domain: '*.example.com'
    #   subject:
    #     - 'group:admins'
    #     - 'group:moderators'
    #   policy: two_factor

    # ## Rules applied to 'dev' group
    # - domain: 'dev.example.com'
    #   resources:
    #     - '^/groups/dev/.*$'
    #   subject: 'group:dev'
    #   policy: two_factor

    # ## Rules applied to user 'john'
    # - domain: 'dev.example.com'
    #   resources:
    #     - '^/users/john/.*$'
    #   subject: 'user:john'
    #   policy: two_factor

    # ## Rules applied to user 'harry'
    # - domain: 'dev.example.com'
    #   resources:
    #     - '^/users/harry/.*$'
    #   subject: 'user:harry'
    #   policy: two_factor

    # ## Rules applied to user 'bob'
    # - domain: '*.mail.example.com'
    #   subject: 'user:bob'
    #   policy: two_factor
    # - domain: 'dev.example.com'
    #   resources:
    #     - '^/users/bob/.*$'
    #   subject: 'user:bob'
    #   policy: two_factor

##
## Session Provider Configuration
##
## The session cookies identify the user once logged in.
## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined.
session:
  ## The name of the session cookie.
  name: authelia_session

  ## The domain to protect.
  ## Note: the authenticator must also be in that domain.
  ## If empty, the cookie is restricted to the subdomain of the issuer.
  domain: godopu.net

  ## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
  ## Please read https://www.authelia.com/c/session#same_site
  same_site: lax

  ## The secret to encrypt the session data. This is only used with Redis / Redis Sentinel.
  ## Secret can also be set using a secret: https://www.authelia.com/c/secrets
  secret: insecure_session_secret

  ## The value for expiration, inactivity, and remember_me_duration are in seconds or the duration notation format.
  ## See: https://www.authelia.com/c/common#duration-notation-format
  ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure
  ## because a stolen cookie will last longer giving attackers more time to spy or attack.

  ## The time before the cookie expires and the session is destroyed if remember me IS NOT selected.
  expiration: 1h

  ## The inactivity time before the session is reset. If expiration is set to 1h, and this is set to 5m, if the user
  ## does not select the remember me option their session will get destroyed after 1h, or after 5m since the last time
  ## Authelia detected user activity.
  inactivity: 5m

  ## The time before the cookie expires and the session is destroyed if remember me IS selected.
  ## Value of -1 disables remember me.
  remember_me_duration: 1M

  ##
  ## Redis Provider
  ##
  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
  ##
  # redis:
  #   host: outline-redis
  #   port: 6379
  #   ## Use a unix socket instead
  #   # host: /var/run/redis/redis.sock

  #   ## Username used for redis authentication. This is optional and a new feature in redis 6.0.
  #   # username: authelia

  #   ## Password can also be set using a secret: https://www.authelia.com/c/secrets
  #   password: authelia

  #   ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
  #   database_index: 0

  #   ## The maximum number of concurrent active connections to Redis.
  #   maximum_active_connections: 8

  #   ## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
  #   minimum_idle_connections: 0

    ## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).
    # tls:
      ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
      # server_name: myredis.example.com

      ## Skip verifying the server certificate (to allow a self-signed certificate).
      ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
      ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
      # skip_verify: false

      ## Minimum TLS version for the connection.
      # minimum_version: TLS1.2

    ## The Redis HA configuration options.
    ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
    # high_availability:
      ## Sentinel Name / Master Name.
      # sentinel_name: mysentinel

      ## Specific username for Redis Sentinel. The node username and password is configured above.
      # sentinel_username: sentinel_specific_user

      ## Specific password for Redis Sentinel. The node username and password is configured above.
      # sentinel_password: sentinel_specific_pass

      ## The additional nodes to pre-seed the redis provider with (for sentinel).
      ## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
      ## For high availability to be used you must have either defined; the host above or at least one node below.
      # nodes:
      #   - host: sentinel-node1
      #     port: 6379
      #   - host: sentinel-node2
      #     port: 6379

      ## Choose the host with the lowest latency.
      # route_by_latency: false

      ## Choose the host randomly.
      # route_randomly: false

##
## Regulation Configuration
##
## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are made
## in a short period of time.
regulation:
  ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
  max_retries: 3

  ## The time range during which the user can attempt login before being banned. The user is banned if the
  ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
  ## See: https://www.authelia.com/c/common#duration-notation-format
  find_time: 2m

  ## The length of time before a banned user can login again. Ban Time accepts duration notation.
  ## See: https://www.authelia.com/c/common#duration-notation-format
  ban_time: 5m

##
## Storage Provider Configuration
##
## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
storage:
  ## The encryption key that is used to encrypt sensitive information in the database. Must be a string with a minimum
  ## length of 20. Please see the docs if you configure this with an undesirable key and need to change it.
  encryption_key: mydwxdd-c2hbo6zcmab1mzj232zx4

  ##
  ## Local (Storage Provider)
  ##
  ## This stores the data in a SQLite3 Database.
  ## This is only recommended for lightweight non-stateful installations.
  ##
  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
  ##
  local:
    path: /config/db.sqlite3

  ##
  ## MySQL / MariaDB (Storage Provider)
  ##
  # mysql:
  #   host: 127.0.0.1
  #   port: 3306
  #   database: authelia
  #   username: authelia
  #   ## Password can also be set using a secret: https://www.authelia.com/c/secrets
  #   password: mypassword
  #   timeout: 5s

  ##
  ## PostgreSQL (Storage Provider)
  ##
  # postgres:
  #   host: 127.0.0.1
  #   port: 5432
  #   database: authelia
  #   schema: public
  #   username: authelia
  #   ## Password can also be set using a secret: https://www.authelia.com/c/secrets
  #   password: mypassword
  #   timeout: 5s
  #   ssl:
  #     mode: disable
  #     root_certificate: disable
  #     certificate: disable
  #     key: disable

##
## Notification Provider
##
## Notifications are sent to users when they require a password reset, a Webauthn registration or a TOTP registration.
## The available providers are: filesystem, smtp. You must use only one of these providers.
notifier:
  ## You can disable the notifier startup check by setting this to true.
  disable_startup_check: false

  ##
  ## File System (Notification Provider)
  ##
  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
  ##
  # filesystem:
  #   filename: /config/notification.txt

  ##
  ## SMTP (Notification Provider)
  ##
  ## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate.
  ## [Security] By default Authelia will:
  ##   - force all SMTP connections over TLS including unauthenticated connections
  ##      - use the disable_require_tls boolean value to disable this requirement
  ##        (only works for unauthenticated connections)
  ##   - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates
  ##     (configure in tls section)

  smtp:
    username: godopu16@gmail.com #your email address
    password: cdjdagxrmywcbaqf #your email password
    host: smtp.gmail.com #email smtp server
    port: 587 #email smtp port
    sender: godopu16@gmail.com
    identifier: localhost
    subject: "[Authelia] {title}" #email subject
    startup_check_address: godopu16@gmail.com
    disable_require_tls: false
    disable_html_emails: false
##
## Identity Providers
##
identity_providers:

  ##
  ## OpenID Connect (Identity Provider)
  ##
  ## It's recommended you read the documentation before configuration of this section:
  ## https://www.authelia.com/c/oidc
  oidc:
    # The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens).
    # HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets
    hmac_secret: mydwxdd-c2hbo6zcmab1mzj232zx4

    # The issuer_private_key is used to sign the JWT forged by OpenID Connect.
    # Issuer Private Key can also be set using a secret: https://www.authelia.com/c/secrets
    issuer_private_key: |
      -----BEGIN RSA PRIVATE KEY-----
      MIIJKAIBAAKCAgEA6O7deUistjW6/6AuZNk/bA6AsL4/s2VTfm1PQv3juAnnvU8K
      hd8xb/nXV1B7AjsxGzP06BiJa0VzyM7pi0l3Y2bxxJPSNWojg5HNzsZ24BebzAH8
      oCHo/NU1OWw5eJNDIT/kuFJ0vImR6ransev56MZ2Ton2WrTF9jfBQQrQT6RoE1y6
      okrHI+lVNkAwilDAALXhvdpeWuQ2vLem973ZHlSsHHUazEfjAkbT96r74vhmd6rQ
      wJEAKnGYwsKUvxX8UschUnlr8t3tDEZuDEW2+fZ1P4QTwK5Y5WY4QCUFVBaY+MDo
      sXDzCe/Wsw1yX0A3KpJq6+wI+r6/DMQUFcZoMQvU6IFfNk/l5ATAOmt/VZVeX3XW
      QbdbkDwGE1su+VMM7efQw0kIXqcWWYJ48tcMxAPGnXtZ6i6smlbFtSW1rVB5WOnc
      mv8ER5C0lqswp7yC0W9hBSM5xphlgS6909RzhIBPJavcorN18BukrN0+EA37NW3a
      p+oNHSQHOMbAXrChYdUSwma/gcUfXy+WtU147N2PzPZTSe7CXiSIodNPbC62IGqu
      BkTrVNpROncvnH55sZ8qhZVPP70qylIvXFEDjpCwWmObsPehGMMJN8DW3xDd7WrI
      eXlNGsAQHs7Dihp1opUeBF0n1gS6dNweFI1aG3+gVtpPiHQumC69bdO52KcCAwEA
      AQKCAgEAnj23w681dctmsEY3fleAGH55uphkWhEZ+ad000P7sYk5H4hU08Feqn2G
      Z1DLYCaqI5rWY95XbMKP9/lo+zD7pFHJKQxrH9JtMfKZaEG3fGFNe/hVkMu4phqJ
      v+rf2CPi1PG9BeMuXu7ubA+OOPbgndxFfvGGpPRuD+ispu0bux8rfQvf1mUKiED5
      nJNa5nwZE+J76ygwNXsYHHh/O4qDt3E6Q1Li06h6dY98bKKB4B10LxOiIU/gVvU5
      HAZoWrAq7GlPH+JRDXrqkQ4/sKKjvYhK+s1VRe6rgZxB1oHP7uIzJbqX2gOreDKx
      Ho6iBkdvssIpVQDS0NVIoPmL04coO+1171p94lI0BjgU/+9kr3rSpSDqJETuyUwL
      m4dnfuEE2CHU0tOeb7i/Mw55rJ2YtfXddWH7u0hp5AHLWqoEFBKjhYwzvim40Ghd
      Acr2z52X9WkoNU2kuBIHF+MnZ/4E1w2jIhsrxi5R8fVa3C8OKVTYIjA5Cj8IWe18
      c+pQrwGSNMaKJyOZFNAF9J22hXgY3BJNOyVX2JGA4+HYfAMxiaEPnZqQlkAsDoSb
      LcdVSQ/bJH2dXJg2kosa5okwI//GPo8Kj1GyPUlu/3C7IoehHEnGsfbgzjg5yhs8
      htyZObzeNqf6mf7AjTVtnDneUKYurI8inoJgePc0aKBOc0ZzPTECggEBAOlRWUWz
      ZvLdZNJmo4fvzZp91wDsI5gnG0GKaWMxqDpcasv8midRdEcZ9y4r489vF7xNVpeM
      dHUnmyeiq3GR+beFDAZTXmt1VxY87kdbmXMzc/jxxrmY76NQRIVoe372sromCS/7
      mTF1fpsASFHXbcHEe0RE8jcrCFFiSsHWrHeux9iiVHlF3d+MLua/pYuCM9wu6uq0
      /VQXK1RLcTQn5O6nUtwhVWuCaHfyTjEXsr9nZ85lNFlb0qOSscZErlNmPreFyoPd
      FphLx14GdjfYGnf3Nz6q0KXqVk2FUJ2cZ+0u5yfjbVFD5eZbs/fHFtA+1MZjoRFf
      K486uJFI0yCOBvMCggEBAP+T8TXGq0+EzwdSWxk3Pb0/i7a1t5gEYsrSd8b1nDYH
      BP8ekqzv2wEVSFdg+GbuZL8NqjTb9Dkds7Y94zqAGl5FwNge5/l3E4X+Y9yue1Cd
      a704BLrURN6SJlPBQ+zDr/YmE6Zz1mbNvRKVReLeDv1CIRLDCjA3q3kOvnxNPlYO
      +zmo07ElLq7gedn8VmjiJfjZeXYxq9+UVxR6Pm9aDeZFTBzQa7URfESB2JU9x7Mz
      zBImE5jUQcsHn9Ha/KaU5FzPoUWdDVPdv4T9IBJaOjam0ck/G0FwqzvSZ0i9HRrX
      mXpO/bXGlyHchMvadJZvqJPd+cc+JvYmDHXvfrcivH0CggEAMJLrDwPGjxFgiB0u
      NoLKPzuro1mGH4sktYRnZGtWJrBO26D/RuhCWPsi5s3kY68xNda0DGEFbc6NErdf
      Egnd/0MHudlpct2+/7Y3tUtwqvcvUcikIsegPFPdsBiMfWZG11JL3112C0H21bY9
      WCyNgSWytAfWlX20AZ2BCtHynggZOxSwmX7eLkg1C30ireSxf0mVRr/fbb5VGvuJ
      2d3kX3seWQ3nhrZjoXUkqjvQzuBsUB/pwiDHvZ4wvKJX2K0UqYiFHObOaW59Vynp
      Or8W45roOXe+cIxU41a57dY+HLcDEN7cR2rnVgoJcbBVI42xJoxfYAp8Oxlyi2yp
      58Ep2QKCAQAXxtqs5xOu7SsZgkbpXKNIxO2pjNRMtzO9rMDp6JWkzRhg56Y7ooDc
      Y+97+ZCCevEyeQH5svDQk3vRm4ZVPe+2D4U2VgG8yqAtWhJOSIk+YbbRPrHp86+I
      iU45goRgNYBcRQSU+rfajo9leC+tQH1igFF1XmHHRJaWR5HfHIyNEw26OoOfOldS
      e526cuhTD576vLi5DzvvK+zCAfFnCJi8cHv5PkaW7M6DzRSqJbo7aLk2gwZVtIF+
      cvIiYt4YXUe1freBM3A2+i1EIQxnyK8bwH9J2q4dc27qvNNRCA76HU6w+0JNM/GB
      e/N6x5MLH84uG3uOVrDnO3jzS9mdDgU9AoIBAAHACoyvwR7nAN3ZdyzMzsfcqZno
      tCtHpaxm3k/rz81b7rLdCh6+rO44QmQxl/fEQwrx2lhCCzNC5JRXXdWjlY7pul6Z
      Rse3kpuHMiprQhZcbPTW11JrQrz/UOsCy6x9axEjL3PRAfc9HK9byz00CwTNLlx8
      0QKaVqk61VcUGcaOPCgQmnvSt9EQQwWhCaozF67GXBSooaA7RtrUeKIENDSrYZbc
      BrHj8cxynIM56zJJ9YE3eyY4gsa2T6ChtRcY6edvzmwaKFz4PEtkZSHm6uc1Mu83
      Z5H4liEDpxHfvUuYjRIdvILtb4M2rgpQGkt+TDrvv1150DexQWS7UMDv2Fo=
      -----END RSA PRIVATE KEY-----

    # The lifespans configure the expiration for these token types.
    access_token_lifespan: 1h
    authorize_code_lifespan: 1m
    id_token_lifespan: 1h
    refresh_token_lifespan: 90m

    # Enables additional debug messages.
    enable_client_debug_messages: false
    clients:
      - id: iot-ws
        description: iot server
        secret: mydwxdd-c2hbo6zcmab1mzj232zx4
        public: false
        authorization_policy: one_factor
        audience: []
        scopes:
          - openid
          - groups
          - email
          - profile
        redirect_uris:
          - https://iot.knu.ac.kr/auth/oidc.callback
        grant_types:
          - refresh_token
          - authorization_code
        response_types:
          - code
        response_modes:
          - form_post
          - query
          - fragment
        userinfo_signing_algorithm: none
    # SECURITY NOTICE: It's not recommended changing this option and values below 8 are strongly discouraged.
    minimum_parameter_entropy: 8

    # SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it set to 'never'
    # for security reasons.
    enforce_pkce: public_clients_only

    ## Cross-Origin Resource Sharing (CORS) settings.
    # cors:
      ## List of endpoints in addition to the metadata endpoints to permit cross-origin requests on.
      # endpoints:
      #    - authorization
      #    - token
      #    - revocation
      #    - introspection
      #    - userinfo

      ## List of allowed origins.
      ## Any origin with https is permitted unless this option is configured or the
      ## allowed_origins_from_client_redirect_uris option is enabled.
      # allowed_origins:
      #   - https://example.com

      ## Automatically adds the origin portion of all redirect URI's on all clients to the list of allowed_origins,
      ## provided they have the scheme http or https and do not have the hostname of localhost.
      # allowed_origins_from_client_redirect_uris: false

    ## Clients is a list of known clients and their configuration.
    # clients:
      # -
        ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
        # id: myapp

        ## The description to show to users when they end up on the consent screen. Defaults to the ID above.
        # description: My Application

        ## The client secret is a shared secret between Authelia and the consumer of this client.
        # secret: this_is_a_secret

        ## Sector Identifiers are occasionally used to generate pairwise subject identifiers. In most cases this is not
        ## necessary. Read the documentation for more information.
        ## The subject identifier must be the host component of a URL, which is a domain name with an optional port.
        # sector_identifier: example.com

        ## Sets the client to public. This should typically not be set, please see the documentation for usage.
        # public: false

        ## The policy to require for this client; one_factor or two_factor.
        # authorization_policy: two_factor

        ## By default users cannot remember pre-configured consents. Setting this value to a period of time using a
        ## duration notation will enable users to remember consent for this client. The time configured is the amount
        ## of time the pre-configured consent is valid for granting new authorizations to the user.
        # pre_configured_consent_duration:

        ## Audience this client is allowed to request.
        # audience: []

        ## Scopes this client is allowed to request.
        # scopes:
          # - openid
          # - groups
          # - email
          # - profile

        ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
        # redirect_uris:
        # - https://oidc.example.com:8080/oauth2/callback

        ## Grant Types configures which grants this client can obtain.
        ## It's not recommended to define this unless you know what you're doing.
        # grant_types:
          # - refresh_token
          # - authorization_code

        ## Response Types configures which responses this client can be sent.
        ## It's not recommended to define this unless you know what you're doing.
        # response_types:
          # - code

        ## Response Modes configures which response modes this client supports.
        # response_modes:
          # - form_post
          # - query
          # - fragment

        ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
        # userinfo_signing_algorithm: none
...