LoginSign Up
← Back to all sparks
A

Authelia

INFRA · APIS
Velocity0.0

Open-source authentication and two-factor authorization server.

www.authelia.com ↗

Authelia's 4.39 line is a long hardening run, not a feature line

authenticationssoldapoidcaccess-controlsecurity-hardening
◆Current state
Authelia is an open-source authentication and authorization gateway, and the entire recent window is 4.39 point releases. The content is almost exclusively LDAP behaviour, OIDC/OAuth2 error semantics, and access-control evaluation, punctuated by two releases carrying security advisories — one for access-control rules missing a domain match without canonicalization, one for username canonicalization in Basic Auth against LDAP.
◆Where it's heading
The recurring theme is normalization: several fixes come down to Authelia comparing two strings that mean the same thing and getting a different answer. Domain matching, username canonicalization, issuer suffix checks and AMR consistency are all the same class of bug in different code paths, and they are being closed one at a time rather than by a single refactor. Alongside that, the LDAP client keeps yielding pool deadlocks, referral chasing, and health-check errors under load.
◆Prediction
Given how many of these fixes cluster on the same identifier-comparison problem, the likely next step is more 4.39 patches in the same two areas — LDAP connection handling and access-control matching — before any 4.40 feature work becomes visible.

◆Recent moves

  1. 2mo ago

    Security release: access-control and LDAP username canonicalization

    Two advisories land together, both instances of the normalization problem running through this whole line: an access-control rule could miss its domain when the value was not canonicalized, and Basic Auth against LDAP skipped username canonicalization. Both are authorization-boundary correctness rather than new capability.

    View source ↗
  2. 2mo ago

    LDAP version check, AMR consistency, and stricter domain matching

    Fixes an LDAPv3 version check, an authentication cache miss, a deref panic in the one-time-code handler, and tightens domain matching in middleware. The domain-matching change is the same theme the later security release formalizes — this release was already narrowing the gap.

    View source ↗
  3. 2mo ago

    Security fixes plus LDAP discovery and filter-escaping repairs

    Carries a GHSA advisory alongside an over-strict discovery check and an excessive filter escape in the LDAP path. Directory integration is where most of this line's defects live, and this release is a concentrated pass at it.

    View source ↗
  4. 2mo ago

    LDAP health-check errors and unapplied server authz defaults fixed

    Corrects a spurious error when determining LDAP server health and a case where configuration defaults were not applied to server authz. The second is the more consequential one — silently missing authz defaults is a deployment that believes it is configured and is not.

    View source ↗
  5. 2mo ago

    LDAP connection-pool deadlock and referral chasing fixed

    Resolves a pool deadlock that could stall authentication outright, plus unchased referrals and a shallow expression value resolution. Availability-grade fixes for the component that most Authelia deployments depend on for every login.

    View source ↗
  6. 2mo ago

    Basic-auth cache and regulation logging fixes

    A multi-flight case in the basic-auth cache and a mislogged regulation pool deadline. Internal edge cases most operators would never observe directly, typical of the small-batch releases this line ships between the larger security rollups.

    View source ↗