{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://www.authelia.com/schemas/v4.39/json-schema/configuration.json",
  "$ref": "#/$defs/Configuration",
  "$defs": {
    "AccessControl": {
      "properties": {
        "default_policy": {
          "type": "string",
          "enum": [
            "deny",
            "one_factor",
            "two_factor"
          ],
          "title": "Default Authorization Policy",
          "description": "The default policy applied to all authorization requests unrelated to OpenID Connect 1.0.",
          "default": "deny"
        },
        "networks": {
          "items": {
            "$ref": "#/$defs/AccessControlNetwork"
          },
          "type": "array",
          "title": "Named Networks",
          "description": "The list of named networks which can be reused in any ACL rule."
        },
        "rules": {
          "items": {
            "$ref": "#/$defs/AccessControlRule"
          },
          "type": "array",
          "title": "Rules List",
          "description": "The list of ACL rules to enumerate for requests."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "AccessControl represents the configuration related to ACLs."
    },
    "AccessControlNetwork": {
      "properties": {
        "name": {
          "type": "string",
          "title": "Network Name",
          "description": "The name of this network to be used in the networks section of the rules section."
        },
        "networks": {
          "oneOf": [
            {
              "type": "string"
            },
            {
              "items": {
                "type": "string"
              },
              "type": "array"
            }
          ],
          "title": "Networks",
          "description": "The remote IP's or network ranges in CIDR notation that this rule applies to."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "required": [
        "name",
        "networks"
      ],
      "description": "AccessControlNetwork represents one ACL network group entry."
    },
    "AccessControlRule": {
      "oneOf": [
        {
          "required": [
            "domain"
          ],
          "title": "Domain"
        },
        {
          "required": [
            "domain_regex"
          ],
          "title": "Domain Regex"
        }
      ],
      "properties": {
        "domain": {
          "$ref": "#/$defs/AccessControlRuleDomains",
          "title": "Domain Literals",
          "description": "The literal domains to match the domain against that this rule applies to."
        },
        "domain_regex": {
          "$ref": "#/$defs/AccessControlRuleRegexCI",
          "title": "Domain Regex Patterns",
          "description": "The regex patterns to match the domain against that this rule applies to."
        },
        "policy": {
          "type": "string",
          "enum": [
            "bypass",
            "deny",
            "one_factor",
            "two_factor"
          ],
          "title": "Rule Policy",
          "description": "The policy this rule applies when all criteria match."
        },
        "subject": {
          "$ref": "#/$defs/AccessControlRuleSubjects",
          "title": "AccessControlRuleSubjects",
          "description": "The users or groups that this rule applies to."
        },
        "networks": {
          "oneOf": [
            {
              "type": "string"
            },
            {
              "items": {
                "type": "string"
              },
              "type": "array"
            }
          ],
          "title": "Networks",
          "description": "The remote IP's, network ranges in CIDR notation, or network definition names that this rule applies to."
        },
        "resources": {
          "$ref": "#/$defs/AccessControlRuleRegex",
          "title": "Resources or Paths",
          "description": "The regex patterns to match the resource paths that this rule applies to."
        },
        "methods": {
          "$ref": "#/$defs/AccessControlRuleMethods",
          "title": "Methods",
          "description": "The list of request methods this rule applies to."
        },
        "query": {
          "items": {
            "items": {
              "$ref": "#/$defs/AccessControlRuleQuery"
            },
            "type": "array"
          },
          "type": "array",
          "title": "Query Rules",
          "description": "The list of query parameter rules this rule applies to."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "required": [
        "policy"
      ],
      "description": "AccessControlRule represents one ACL rule entry."
    },
    "AccessControlRuleDomains": {
      "oneOf": [
        {
          "type": "string"
        },
        {
          "items": {
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true
        }
      ]
    },
    "AccessControlRuleMethods": {
      "oneOf": [
        {
          "type": "string",
          "enum": [
            "GET",
            "HEAD",
            "POST",
            "PUT",
            "PATCH",
            "DELETE",
            "TRACE",
            "CONNECT",
            "OPTIONS",
            "COPY",
            "LOCK",
            "MKCOL",
            "MOVE",
            "PROPFIND",
            "PROPPATCH",
            "UNLOCK"
          ]
        },
        {
          "items": {
            "type": "string",
            "enum": [
              "GET",
              "HEAD",
              "POST",
              "PUT",
              "PATCH",
              "DELETE",
              "TRACE",
              "CONNECT",
              "OPTIONS",
              "COPY",
              "LOCK",
              "MKCOL",
              "MOVE",
              "PROPFIND",
              "PROPPATCH",
              "UNLOCK"
            ]
          },
          "type": "array",
          "uniqueItems": true
        }
      ]
    },
    "AccessControlRuleQuery": {
      "properties": {
        "operator": {
          "type": "string",
          "enum": [
            "equal",
            "not equal",
            "present",
            "absent",
            "pattern",
            "not pattern"
          ],
          "title": "Operator",
          "description": "The list of query parameter rules this rule applies to."
        },
        "key": {
          "type": "string",
          "title": "Key",
          "description": "The Query Parameter key this rule applies to."
        },
        "value": {
          "title": "Value",
          "description": "The Query Parameter value for this rule."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "required": [
        "key"
      ],
      "description": "AccessControlRuleQuery represents the ACL query criteria."
    },
    "AccessControlRuleRegex": {
      "oneOf": [
        {
          "type": "string",
          "format": "regex"
        },
        {
          "items": {
            "type": "string",
            "format": "regex"
          },
          "type": "array",
          "uniqueItems": true
        }
      ]
    },
    "AccessControlRuleRegexCI": {
      "oneOf": [
        {
          "type": "string",
          "format": "regex"
        },
        {
          "items": {
            "type": "string",
            "format": "regex"
          },
          "type": "array",
          "uniqueItems": true
        }
      ]
    },
    "AccessControlRuleSubjects": {
      "oneOf": [
        {
          "type": "string",
          "pattern": "^(user|group|oauth2:client):.+$"
        },
        {
          "items": {
            "type": "string",
            "pattern": "^(user|group|oauth2:client):.+$"
          },
          "type": "array"
        },
        {
          "items": {
            "items": {
              "type": "string",
              "pattern": "^(user|group|oauth2:client):.+$"
            },
            "type": "array"
          },
          "type": "array",
          "uniqueItems": true
        }
      ]
    },
    "AddressLDAP": {
      "type": "string",
      "pattern": "^((ldaps?:\\/\\/)?([^:\\/]*(:\\d+)|[^:\\/]+(:\\d+)?)?|ldapi:\\/\\/(\\/[^?\\n]+)?)$",
      "format": "uri"
    },
    "AddressSMTP": {
      "type": "string",
      "pattern": "^((smtp|submissions?):\\/\\/)?([^:\\/]*(:\\d+)|[^:\\/]+(:\\d+)?)?$",
      "format": "uri"
    },
    "AddressTCP": {
      "type": "string",
      "pattern": "^((tcp[46]?:\\/\\/)?([^:\\/]*(:\\d+)|[^:\\/]+(:\\d+)?)(\\/.*)?|unix:\\/\\/\\/[^?\\n]+(\\?(umask=[0-7]{3,4}|path=[a-z]+)(\u0026(umask=[0-7]{3,4}|path=[a-zA-Z0-9.~_-]+))?)?)$",
      "format": "uri"
    },
    "AddressUDP": {
      "type": "string",
      "pattern": "^(udp[46]?:\\/\\/)?([^:\\/]*(:\\d+)|[^:\\/]+(:\\d+)?)(\\/.*)?$",
      "format": "uri"
    },
    "AuthenticationBackend": {
      "properties": {
        "password_reset": {
          "$ref": "#/$defs/AuthenticationBackendPasswordReset",
          "title": "Password Reset",
          "description": "Allows configuration of the password reset behavior."
        },
        "password_change": {
          "$ref": "#/$defs/AuthenticationBackendPasswordChange",
          "title": "Password Change",
          "description": "Allows configuration of the password change behavior."
        },
        "refresh_interval": {
          "$ref": "#/$defs/RefreshIntervalDuration",
          "title": "Refresh Interval",
          "description": "How frequently the user details are refreshed from the backend."
        },
        "file": {
          "$ref": "#/$defs/AuthenticationBackendFile",
          "title": "File Backend",
          "description": "The file authentication backend configuration."
        },
        "ldap": {
          "$ref": "#/$defs/AuthenticationBackendLDAP",
          "title": "LDAP Backend",
          "description": "The LDAP authentication backend configuration."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "AuthenticationBackend represents the configuration related to the authentication backend."
    },
    "AuthenticationBackendExtraAttribute": {
      "properties": {
        "multi_valued": {
          "type": "boolean",
          "title": "Multi-Valued",
          "description": "Defines the attribute as multi-valued."
        },
        "value_type": {
          "type": "string",
          "enum": [
            "boolean",
            "integer",
            "string"
          ],
          "title": "Value Type",
          "description": "Defines the value type for the attribute."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "AuthenticationBackendExtraAttribute represents the configuration of an extra user attribute."
    },
    "AuthenticationBackendFile": {
      "properties": {
        "path": {
          "type": "string",
          "title": "Path",
          "description": "The file path to the user database."
        },
        "watch": {
          "type": "boolean",
          "title": "Watch",
          "description": "Enables watching the file for external changes and dynamically reloading the database.",
          "default": false
        },
        "password": {
          "$ref": "#/$defs/AuthenticationBackendFilePassword",
          "title": "Password Options",
          "description": "Allows configuration of the password hashing options when the user passwords are changed directly by Authelia."
        },
        "search": {
          "$ref": "#/$defs/AuthenticationBackendFileSearch",
          "title": "Search",
          "description": "Configures the user searching behavior."
        },
        "extra_attributes": {
          "patternProperties": {
            ".*": {
              "$ref": "#/$defs/AuthenticationBackendExtraAttribute"
            }
          },
          "type": "object",
          "title": "Extra Attributes",
          "description": "Configures the extra attributes available in expressions and other areas of Authelia."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "AuthenticationBackendFile represents the configuration related to file-based backend."
    },
    "AuthenticationBackendFilePassword": {
      "properties": {
        "algorithm": {
          "type": "string",
          "enum": [
            "argon2",
            "sha2crypt",
            "pbkdf2",
            "bcrypt",
            "scrypt"
          ],
          "title": "Algorithm",
          "description": "The password hashing algorithm to use.",
          "default": "argon2"
        },
        "argon2": {
          "$ref": "#/$defs/AuthenticationBackendFilePasswordArgon2",
          "title": "Argon2",
          "description": "Configure the Argon2 password hashing parameters."
        },
        "sha2crypt": {
          "$ref": "#/$defs/AuthenticationBackendFilePasswordSHA2Crypt",
          "title": "SHA2Crypt",
          "description": "Configure the SHA2Crypt password hashing parameters."
        },
        "pbkdf2": {
          "$ref": "#/$defs/AuthenticationBackendFilePasswordPBKDF2",
          "title": "PBKDF2",
          "description": "Configure the PBKDF2 password hashing parameters."
        },
        "bcrypt": {
          "$ref": "#/$defs/AuthenticationBackendFilePasswordBcrypt",
          "title": "Bcrypt",
          "description": "Configure the Bcrypt password hashing parameters."
        },
        "scrypt": {
          "$ref": "#/$defs/AuthenticationBackendFilePasswordScrypt",
          "title": "Scrypt",
          "description": "Configure the Scrypt password hashing parameters."
        },
        "iterations": {
          "type": "integer",
          "title": "Iterations",
          "description": "Deprecated: Use individual password options instead.",
          "deprecated": true
        },
        "memory": {
          "type": "integer",
          "title": "Memory",
          "description": "Deprecated: Use individual password options instead.",
          "deprecated": true
        },
        "parallelism": {
          "type": "integer",
          "title": "Parallelism",
          "description": "Deprecated: Use individual password options instead.",
          "deprecated": true
        },
        "key_length": {
          "type": "integer",
          "title": "Key Length",
          "description": "Deprecated: Use individual password options instead.",
          "deprecated": true
        },
        "salt_length": {
          "type": "integer",
          "title": "Salt Length",
          "description": "Deprecated: Use individual password options instead.",
          "deprecated": true
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "AuthenticationBackendFilePassword represents the configuration related to password hashing."
    },
    "AuthenticationBackendFilePasswordArgon2": {
      "properties": {
        "variant": {
          "type": "string",
          "enum": [
            "argon2id",
            "argon2i",
            "argon2d"
          ],
          "title": "Variant",
          "description": "The Argon2 variant to be used.",
          "default": "argon2id"
        },
        "iterations": {
          "type": "integer",
          "title": "Iterations",
          "description": "The number of Argon2 iterations (parameter t) to be used.",
          "default": 3
        },
        "memory": {
          "type": "integer",
          "maximum": 4294967295,
          "minimum": 8,
          "title": "Memory",
          "description": "The Argon2 amount of memory in kibibytes (parameter m) to be used.",
          "default": 65536
        },
        "parallelism": {
          "type": "integer",
          "maximum": 16777215,
          "minimum": 1,
          "title": "Parallelism",
          "description": "The Argon2 degree of parallelism (parameter p) to be used.",
          "default": 4
        },
        "key_length": {
          "type": "integer",
          "maximum": 2147483647,
          "minimum": 4,
          "title": "Key Length",
          "description": "The Argon2 key output length.",
          "default": 32
        },
        "salt_length": {
          "type": "integer",
          "maximum": 2147483647,
          "minimum": 1,
          "title": "Salt Length",
          "description": "The Argon2 salt length.",
          "default": 16
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "AuthenticationBackendFilePasswordArgon2 represents the argon2 hashing settings."
    },
    "AuthenticationBackendFilePasswordBcrypt": {
      "properties": {
        "variant": {
          "type": "string",
          "enum": [
            "standard",
            "sha256"
          ],
          "title": "Variant",
          "description": "The Bcrypt variant to be used.",
          "default": "standard"
        },
        "cost": {
          "type": "integer",
          "maximum": 31,
          "minimum": 10,
          "title": "Cost",
          "description": "The Bcrypt cost to be used.",
          "default": 12
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "AuthenticationBackendFilePasswordBcrypt represents the bcrypt hashing settings."
    },
    "AuthenticationBackendFilePasswordPBKDF2": {
      "properties": {
        "variant": {
          "type": "string",
          "enum": [
            "sha1",
            "sha224",
            "sha256",
            "sha384",
            "sha512"
          ],
          "title": "Variant",
          "description": "The PBKDF2 variant to be used.",
          "default": "sha512"
        },
        "iterations": {
          "type": "integer",
          "maximum": 2147483647,
          "minimum": 100000,
          "title": "Iterations",
          "description": "The PBKDF2 iterations to be used.",
          "default": 310000
        },
        "salt_length": {
          "type": "integer",
          "maximum": 2147483647,
          "minimum": 8,
          "title": "Salt Length",
          "description": "The PBKDF2 salt length to be used.",
          "default": 16
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "AuthenticationBackendFilePasswordPBKDF2 represents the PBKDF2 hashing settings."
    },
    "AuthenticationBackendFilePasswordSHA2Crypt": {
      "properties": {
        "variant": {
          "type": "string",
          "enum": [
            "sha256",
            "sha512"
          ],
          "title": "Variant",
          "description": "The SHA2Crypt variant to be used.",
          "default": "sha512"
        },
        "iterations": {
          "type": "integer",
          "maximum": 999999999,
          "minimum": 1000,
          "title": "Iterations",
          "description": "The SHA2Crypt iterations (parameter rounds) to be used.",
          "default": 50000
        },
        "salt_length": {
          "type": "integer",
          "maximum": 16,
          "minimum": 1,
          "title": "Salt Length",
          "description": "The SHA2Crypt salt length to be used.",
          "default": 16
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "AuthenticationBackendFilePasswordSHA2Crypt represents the sha2crypt hashing settings."
    },
    "AuthenticationBackendFilePasswordScrypt": {
      "properties": {
        "variant": {
          "type": "string",
          "enum": [
            "scrypt",
            "yescrypt"
          ],
          "title": "Variant",
          "description": "The Scrypt variant to be used.",
          "default": "scrypt"
        },
        "iterations": {
          "type": "integer",
          "maximum": 58,
          "minimum": 1,
          "title": "Iterations",
          "description": "The Scrypt iterations to be used.",
          "default": 16
        },
        "block_size": {
          "type": "integer",
          "maximum": 36028797018963967,
          "minimum": 1,
          "title": "Block Size",
          "description": "The Scrypt block size to be used.",
          "default": 8
        },
        "parallelism": {
          "type": "integer",
          "maximum": 1073741823,
          "minimum": 1,
          "title": "Parallelism",
          "description": "The Scrypt parallelism factor to be used.",
          "default": 1
        },
        "key_length": {
          "type": "integer",
          "maximum": 137438953440,
          "minimum": 1,
          "title": "Key Length",
          "description": "The Scrypt key length to be used.",
          "default": 32
        },
        "salt_length": {
          "type": "integer",
          "maximum": 1024,
          "minimum": 8,
          "title": "Salt Length",
          "description": "The Scrypt salt length to be used.",
          "default": 16
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "AuthenticationBackendFilePasswordScrypt represents the scrypt hashing settings."
    },
    "AuthenticationBackendFileSearch": {
      "properties": {
        "email": {
          "type": "boolean",
          "title": "Email Searching",
          "description": "Allows users to either use their username or their configured email as a username.",
          "default": false
        },
        "case_insensitive": {
          "type": "boolean",
          "title": "Case Insensitive Searching",
          "description": "Allows usernames to be any case during the search.",
          "default": false
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "AuthenticationBackendFileSearch represents the configuration related to file-based backend searching."
    },
    "AuthenticationBackendLDAP": {
      "properties": {
        "address": {
          "$ref": "#/$defs/AddressLDAP",
          "title": "Address",
          "description": "The address of the LDAP directory server."
        },
        "implementation": {
          "type": "string",
          "enum": [
            "custom",
            "activedirectory",
            "rfc2307bis",
            "freeipa",
            "lldap",
            "glauth"
          ],
          "title": "Implementation",
          "description": "The implementation which mostly decides the default values.",
          "default": "custom"
        },
        "timeout": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Timeout",
          "description": "The LDAP directory server connection timeout."
        },
        "start_tls": {
          "type": "boolean",
          "title": "StartTLS",
          "description": "Enables the use of StartTLS.",
          "default": false
        },
        "tls": {
          "$ref": "#/$defs/TLS",
          "title": "TLS",
          "description": "The LDAP directory server TLS connection properties."
        },
        "pooling": {
          "$ref": "#/$defs/AuthenticationBackendLDAPPooling",
          "title": "Pooling",
          "description": "The LDAP Connection Pooling properties."
        },
        "base_dn": {
          "type": "string",
          "title": "Base DN",
          "description": "The base for all directory server operations."
        },
        "additional_users_dn": {
          "type": "string",
          "title": "Additional User Base",
          "description": "The base in addition to the Base DN for all directory server operations for users."
        },
        "users_filter": {
          "type": "string",
          "title": "Users Filter",
          "description": "The LDAP filter used to search for user objects."
        },
        "additional_groups_dn": {
          "type": "string",
          "title": "Additional Group Base",
          "description": "The base in addition to the Base DN for all directory server operations for groups."
        },
        "groups_filter": {
          "type": "string",
          "title": "Groups Filter",
          "description": "The LDAP filter used to search for group objects."
        },
        "group_search_mode": {
          "type": "string",
          "enum": [
            "filter",
            "memberof"
          ],
          "title": "Groups Search Modes",
          "description": "The LDAP group search mode used to search for group objects.",
          "default": "filter"
        },
        "attributes": {
          "$ref": "#/$defs/AuthenticationBackendLDAPAttributes",
          "title": "Attributes",
          "description": "The LDAP directory server attributes."
        },
        "permit_referrals": {
          "type": "boolean",
          "title": "Permit Referrals",
          "description": "Enables chasing LDAP referrals.",
          "default": false
        },
        "permit_unauthenticated_bind": {
          "type": "boolean",
          "title": "Permit Unauthenticated Bind",
          "description": "Enables omission of the password to perform an unauthenticated bind.",
          "default": false
        },
        "user": {
          "type": "string",
          "title": "User",
          "description": "The user distinguished name for LDAP binding."
        },
        "password": {
          "type": "string",
          "title": "Password",
          "description": "The password for LDAP authenticated binding."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "AuthenticationBackendLDAP represents the configuration related to LDAP server."
    },
    "AuthenticationBackendLDAPAttributes": {
      "properties": {
        "distinguished_name": {
          "type": "string",
          "title": "Attribute: Distinguished Name",
          "description": "The directory server attribute which contains the distinguished name for all objects."
        },
        "username": {
          "type": "string",
          "title": "Attribute: User Username",
          "description": "The directory server attribute which contains the username for all users."
        },
        "display_name": {
          "type": "string",
          "title": "Attribute: User Display Name",
          "description": "The directory server attribute which contains the display name for all users."
        },
        "family_name": {
          "type": "string",
          "title": "Attribute: Family Name",
          "description": "The directory server attribute which contains the family name for all users."
        },
        "given_name": {
          "type": "string",
          "title": "Attribute: Given Name",
          "description": "The directory server attribute which contains the given name for all users."
        },
        "middle_name": {
          "type": "string",
          "title": "Attribute: Middle Name",
          "description": "The directory server attribute which contains the middle name for all users."
        },
        "nickname": {
          "type": "string",
          "title": "Attribute: Nickname",
          "description": "The directory server attribute which contains the nickname for all users."
        },
        "gender": {
          "type": "string",
          "title": "Attribute: Gender",
          "description": "The directory server attribute which contains the gender for all users."
        },
        "birthdate": {
          "type": "string",
          "title": "Attribute: Birthdate",
          "description": "The directory server attribute which contains the birthdate for all users."
        },
        "website": {
          "type": "string",
          "title": "Attribute: Website",
          "description": "The directory server attribute which contains the website URL for all users."
        },
        "profile": {
          "type": "string",
          "title": "Attribute: Profile",
          "description": "The directory server attribute which contains the profile URL for all users."
        },
        "picture": {
          "type": "string",
          "title": "Attribute: Picture",
          "description": "The directory server attribute which contains the picture URL for all users."
        },
        "zoneinfo": {
          "type": "string",
          "title": "Attribute: Zone Information",
          "description": "The directory server attribute which contains the time zone information for all users."
        },
        "locale": {
          "type": "string",
          "title": "Attribute: Locale",
          "description": "The directory server attribute which contains the locale information for all users."
        },
        "phone_number": {
          "type": "string",
          "title": "Attribute: Phone Number",
          "description": "The directory server attribute which contains the phone number for all users."
        },
        "phone_extension": {
          "type": "string",
          "title": "Attribute: Phone Extension",
          "description": "The directory server attribute which contains the phone extension for all users."
        },
        "street_address": {
          "type": "string",
          "title": "Attribute: Street Address",
          "description": "The directory server attribute which contains the street address for all users."
        },
        "locality": {
          "type": "string",
          "title": "Attribute: Locality",
          "description": "The directory server attribute which contains the locality for all users."
        },
        "region": {
          "type": "string",
          "title": "Attribute: Region",
          "description": "The directory server attribute which contains the region for all users."
        },
        "postal_code": {
          "type": "string",
          "title": "Attribute: Postal Code",
          "description": "The directory server attribute which contains the postal code for all users."
        },
        "country": {
          "type": "string",
          "title": "Attribute: Country",
          "description": "The directory server attribute which contains the country for all users."
        },
        "mail": {
          "type": "string",
          "title": "Attribute: User Mail",
          "description": "The directory server attribute which contains the mail address for all users and groups."
        },
        "member_of": {
          "type": "string",
          "title": "Attribute: Member Of",
          "description": "The directory server attribute which contains the objects that an object is a member of."
        },
        "group_name": {
          "type": "string",
          "title": "Attribute: Group Name",
          "description": "The directory server attribute which contains the group name for all groups."
        },
        "extra": {
          "patternProperties": {
            ".*": {
              "$ref": "#/$defs/AuthenticationBackendLDAPAttributesAttribute"
            }
          },
          "type": "object",
          "title": "Extra Attributes",
          "description": "Configures the extra attributes available in expressions and other areas of Authelia."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "AuthenticationBackendLDAPAttributes represents the configuration related to LDAP server attributes."
    },
    "AuthenticationBackendLDAPAttributesAttribute": {
      "properties": {
        "name": {
          "type": "string",
          "title": "Name",
          "description": "The name of the attribute within Authelia. This does not adjust the attribute queried from the LDAP server."
        },
        "multi_valued": {
          "type": "boolean",
          "title": "Multi-Valued",
          "description": "Defines the attribute as multi-valued."
        },
        "value_type": {
          "type": "string",
          "enum": [
            "boolean",
            "integer",
            "string"
          ],
          "title": "Value Type",
          "description": "Defines the value type for the attribute."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "AuthenticationBackendLDAPAttributesAttribute represents the configuration of an extra LDAP attribute."
    },
    "AuthenticationBackendLDAPPooling": {
      "properties": {
        "enable": {
          "type": "boolean",
          "title": "Enable",
          "description": "Enable LDAP connection pooling.",
          "default": false
        },
        "count": {
          "type": "integer",
          "title": "Count",
          "description": "The number of connections to keep open for LDAP connection pooling.",
          "default": 5
        },
        "retries": {
          "type": "integer",
          "title": "Retries",
          "description": "The number of attempts to retrieve a connection from the pool during the timeout.",
          "default": 2
        },
        "timeout": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Timeout",
          "description": "The duration of time to wait for a connection to become available in the connection pool."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "AuthenticationBackendLDAPPooling represents the LDAP connection pooling configuration."
    },
    "AuthenticationBackendPasswordChange": {
      "properties": {
        "disable": {
          "type": "boolean",
          "title": "Disable",
          "description": "Disables the Password Change option.",
          "default": false
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "AuthenticationBackendPasswordChange represents the configuration related to password reset functionality."
    },
    "AuthenticationBackendPasswordReset": {
      "properties": {
        "disable": {
          "type": "boolean",
          "title": "Disable",
          "description": "Disables the Password Reset option.",
          "default": false
        },
        "custom_url": {
          "type": "string",
          "format": "uri",
          "title": "Custom URL",
          "description": "Disables the internal Password Reset option and instead redirects users to this specified URL."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "AuthenticationBackendPasswordReset represents the configuration related to password reset functionality."
    },
    "Configuration": {
      "properties": {
        "theme": {
          "type": "string",
          "enum": [
            "auto",
            "light",
            "dark",
            "grey",
            "oled"
          ],
          "title": "Theme Name",
          "description": "The name of the theme to apply to the web UI.",
          "default": "light"
        },
        "certificates_directory": {
          "type": "string",
          "title": "Certificates Directory Path",
          "description": "The path to a directory which is used to determine the certificates that are trusted."
        },
        "default_2fa_method": {
          "type": "string",
          "enum": [
            "totp",
            "webauthn",
            "mobile_push"
          ],
          "title": "Default 2FA method",
          "description": "When a user logs in for the first time this is the 2FA method configured for them."
        },
        "log": {
          "$ref": "#/$defs/Log",
          "title": "Log",
          "description": "Logging Configuration."
        },
        "identity_providers": {
          "$ref": "#/$defs/IdentityProviders",
          "title": "Identity Providers",
          "description": "Identity Providers Configuration."
        },
        "authentication_backend": {
          "$ref": "#/$defs/AuthenticationBackend",
          "title": "Authentication Backend",
          "description": "Authentication Backend Configuration."
        },
        "session": {
          "$ref": "#/$defs/Session",
          "title": "Session",
          "description": "Session Configuration."
        },
        "totp": {
          "$ref": "#/$defs/TOTP",
          "title": "TOTP",
          "description": "Time-based One-Time Password Configuration."
        },
        "duo_api": {
          "$ref": "#/$defs/DuoAPI",
          "title": "Duo API",
          "description": "Duo API Configuration."
        },
        "access_control": {
          "$ref": "#/$defs/AccessControl",
          "title": "Access Control",
          "description": "Access Control Configuration."
        },
        "ntp": {
          "$ref": "#/$defs/NTP",
          "title": "NTP",
          "description": "Network Time Protocol Configuration."
        },
        "regulation": {
          "$ref": "#/$defs/Regulation",
          "title": "Regulation",
          "description": "Regulation Configuration."
        },
        "storage": {
          "$ref": "#/$defs/Storage",
          "title": "Storage",
          "description": "Storage Configuration."
        },
        "notifier": {
          "$ref": "#/$defs/Notifier",
          "title": "Notifier",
          "description": "Notifier Configuration."
        },
        "server": {
          "$ref": "#/$defs/Server",
          "title": "Server",
          "description": "Server Configuration."
        },
        "telemetry": {
          "$ref": "#/$defs/Telemetry",
          "title": "Telemetry",
          "description": "Telemetry Configuration."
        },
        "webauthn": {
          "$ref": "#/$defs/WebAuthn",
          "title": "WebAuthn",
          "description": "WebAuthn Configuration."
        },
        "password_policy": {
          "$ref": "#/$defs/PasswordPolicy",
          "title": "Password Policy",
          "description": "Password Policy Configuration."
        },
        "privacy_policy": {
          "$ref": "#/$defs/PrivacyPolicy",
          "title": "Privacy Policy",
          "description": "Privacy Policy Configuration."
        },
        "identity_validation": {
          "$ref": "#/$defs/IdentityValidation",
          "title": "Identity Validation",
          "description": "Identity Validation Configuration."
        },
        "definitions": {
          "$ref": "#/$defs/Definitions",
          "title": "Definitions",
          "description": "Definitions for items reused elsewhere in the configuration."
        },
        "default_redirection_url": {
          "type": "string",
          "format": "uri",
          "title": "The default redirection URL",
          "description": "Deprecated: Use the session cookies option with the same name instead.",
          "deprecated": true
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "Configuration object extracted from YAML configuration file."
    },
    "Definitions": {
      "properties": {
        "network": {
          "patternProperties": {
            ".*": {
              "oneOf": [
                {
                  "type": "string"
                },
                {
                  "items": {
                    "type": "string"
                  },
                  "type": "array"
                }
              ]
            }
          },
          "type": "object",
          "title": "Network Definitions",
          "description": "Networks CIDR ranges that can be utilized elsewhere in the configuration."
        },
        "user_attributes": {
          "patternProperties": {
            ".*": {
              "$ref": "#/$defs/UserAttribute"
            }
          },
          "type": "object",
          "title": "User Attributes",
          "description": "User attributes derived from other attributes."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "Definitions represents the definitions which can be referenced elsewhere in the configuration."
    },
    "DuoAPI": {
      "properties": {
        "disable": {
          "type": "boolean",
          "title": "Disable",
          "description": "Disable the Duo API integration.",
          "default": false
        },
        "hostname": {
          "type": "string",
          "format": "hostname",
          "title": "Hostname",
          "description": "The Hostname provided by your Duo API dashboard."
        },
        "integration_key": {
          "type": "string",
          "title": "Integration Key",
          "description": "The Integration Key provided by your Duo API dashboard."
        },
        "secret_key": {
          "type": "string",
          "title": "Secret Key",
          "description": "The Secret Key provided by your Duo API dashboard."
        },
        "enable_self_enrollment": {
          "type": "boolean",
          "title": "Enable Self Enrollment",
          "description": "Enable the Self Enrollment flow.",
          "default": false
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "DuoAPI represents the configuration related to Duo API."
    },
    "IdentityProviders": {
      "properties": {
        "oidc": {
          "$ref": "#/$defs/IdentityProvidersOpenIDConnect",
          "title": "OpenID Connect 1.0",
          "description": "OpenID Connect 1.0 configuration."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "IdentityProviders represents the Identity Providers configuration for Authelia."
    },
    "IdentityProvidersOpenIDConnect": {
      "properties": {
        "hmac_secret": {
          "type": "string",
          "title": "HMAC Secret",
          "description": "The HMAC Secret used to sign Access Tokens."
        },
        "jwks": {
          "items": {
            "$ref": "#/$defs/JWK"
          },
          "type": "array",
          "title": "Issuer JSON Web Keys",
          "description": "The JWK's which are to be used to sign various objects like ID Tokens."
        },
        "enable_client_debug_messages": {
          "type": "boolean",
          "title": "Enable Client Debug Messages",
          "description": "Enables additional debug messages for clients.",
          "default": false
        },
        "minimum_parameter_entropy": {
          "type": "integer",
          "minimum": -1,
          "title": "Minimum Parameter Entropy",
          "description": "The minimum entropy of the nonce parameter.",
          "default": 8
        },
        "enforce_pkce": {
          "type": "string",
          "enum": [
            "public_clients_only",
            "never",
            "always"
          ],
          "title": "Enforce PKCE",
          "description": "Controls enforcement of the use of Proof Key for Code Exchange on all clients.",
          "default": "public_clients_only"
        },
        "enable_pkce_plain_challenge": {
          "type": "boolean",
          "title": "Enable PKCE Plain Challenge",
          "description": "Enables use of the discouraged plain Proof Key for Code Exchange challenges.",
          "default": false
        },
        "enable_jwt_access_token_stateless_introspection": {
          "type": "boolean",
          "title": "Enable JWT Access Token Stateless Introspection",
          "description": "Allows the use of stateless introspection of JWT Access Tokens which is not recommended."
        },
        "discovery_signed_response_alg": {
          "type": "string",
          "enum": [
            "",
            "none",
            "RS256",
            "RS384",
            "RS512",
            "ES256",
            "ES384",
            "ES512",
            "PS256",
            "PS384",
            "PS512",
            "Ed25519",
            "EdDSA",
            "ML-DSA-44",
            "ML-DSA-65",
            "ML-DSA-87"
          ],
          "title": "Discovery Response Signing Algorithm",
          "description": "The Algorithm this provider uses to sign the Discovery and Metadata Document responses. The Edwards-curve identifier 'EdDSA' is also accepted for compatibility with RFC 8037, however RFC 9864 deprecates it in favor of 'Ed25519' which is recommended instead.",
          "default": "none"
        },
        "discovery_signed_response_key_id": {
          "type": "string",
          "title": "Discovery Response Signing Key ID",
          "description": "The Key ID this provider uses to sign the Discovery and Metadata Document responses (overrides the 'discovery_signed_response_alg')."
        },
        "require_pushed_authorization_requests": {
          "type": "boolean",
          "title": "Require Pushed Authorization Requests",
          "description": "Requires Pushed Authorization Requests for all clients for this Issuer."
        },
        "cors": {
          "$ref": "#/$defs/IdentityProvidersOpenIDConnectCORS",
          "title": "CORS",
          "description": "Configuration options for Cross-Origin Request Sharing."
        },
        "clients": {
          "items": {
            "$ref": "#/$defs/IdentityProvidersOpenIDConnectClient"
          },
          "type": "array",
          "title": "Clients",
          "description": "OpenID Connect 1.0 clients registry."
        },
        "authorization_policies": {
          "patternProperties": {
            ".*": {
              "$ref": "#/$defs/IdentityProvidersOpenIDConnectPolicy"
            }
          },
          "type": "object",
          "title": "Authorization Policies",
          "description": "Custom client authorization policies."
        },
        "lifespans": {
          "$ref": "#/$defs/IdentityProvidersOpenIDConnectLifespans",
          "title": "Lifespans",
          "description": "Token lifespans configuration."
        },
        "claims_policies": {
          "patternProperties": {
            ".*": {
              "$ref": "#/$defs/IdentityProvidersOpenIDConnectClaimsPolicy"
            }
          },
          "type": "object",
          "title": "Claims Policies",
          "description": "The dictionary of claims policies which can be applied to clients."
        },
        "scopes": {
          "patternProperties": {
            ".*": {
              "$ref": "#/$defs/IdentityProvidersOpenIDConnectScope"
            }
          },
          "type": "object",
          "title": "Scopes",
          "description": "List of custom scopes."
        },
        "issuer_certificate_chain": {
          "$ref": "#/$defs/X509CertificateChain",
          "title": "Issuer Certificate Chain",
          "description": "The Issuer Certificate Chain with an RSA Public Key used to sign ID Tokens.",
          "deprecated": true
        },
        "issuer_private_key": {
          "type": "string",
          "pattern": "^-{5}(BEGIN (RSA )?PRIVATE KEY-{5}\\n([a-zA-Z0-9\\/+]{1,64}\\n)+([a-zA-Z0-9\\/+]{1,64}[=]{0,2})\\n-{5}END (RSA )?PRIVATE KEY-{5}\\n?)+$",
          "title": "Issuer Private Key",
          "description": "The Issuer Private Key with an RSA Private Key used to sign ID Tokens.",
          "deprecated": true
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "IdentityProvidersOpenIDConnect represents the configuration for OpenID Connect 1.0."
    },
    "IdentityProvidersOpenIDConnectCORS": {
      "properties": {
        "endpoints": {
          "items": {
            "type": "string",
            "enum": [
              "authorization",
              "device-authorization",
              "pushed-authorization-request",
              "token",
              "introspection",
              "revocation",
              "userinfo"
            ]
          },
          "type": "array",
          "uniqueItems": true,
          "title": "Endpoints",
          "description": "List of endpoints to enable CORS handling for."
        },
        "allowed_origins": {
          "items": {
            "type": "string",
            "format": "uri"
          },
          "type": "array",
          "title": "Allowed Origins",
          "description": "List of arbitrary allowed origins for CORS requests."
        },
        "allowed_origins_from_client_redirect_uris": {
          "type": "boolean",
          "title": "Allowed Origins From Client Redirect URIs",
          "description": "Automatically include the redirect URIs from the registered clients.",
          "default": false
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "IdentityProvidersOpenIDConnectCORS represents an OpenID Connect 1.0 CORS config."
    },
    "IdentityProvidersOpenIDConnectClaimsPolicy": {
      "properties": {
        "id_token": {
          "items": {
            "type": "string"
          },
          "type": "array",
          "title": "ID Token",
          "description": "The list of claims to automatically apply to an ID Token in addition to the specified ID Token Claims."
        },
        "access_token": {
          "items": {
            "type": "string"
          },
          "type": "array",
          "title": "Access Token",
          "description": "The list of claims to automatically apply to an Access Token in addition to the specified Access Token Claims."
        },
        "id_token_audience_mode": {
          "type": "string",
          "enum": [
            "specification",
            "experimental-merged"
          ],
          "title": "ID Token Audience Mode",
          "description": "Sets the mode for ID Token audience derivation for clients that use this policy.",
          "default": "specification"
        },
        "custom_claims": {
          "$ref": "#/$defs/IdentityProvidersOpenIDConnectCustomClaims",
          "title": "Custom Claims",
          "description": "The custom claims available in this policy in addition to the Standard Claims."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "IdentityProvidersOpenIDConnectClaimsPolicy represents the claims policy configuration."
    },
    "IdentityProvidersOpenIDConnectClient": {
      "properties": {
        "client_id": {
          "type": "string",
          "minLength": 1,
          "title": "Client ID",
          "description": "The Client ID."
        },
        "client_name": {
          "type": "string",
          "title": "Client Name",
          "description": "The Client Name displayed to End-Users."
        },
        "client_secret": {
          "$ref": "#/$defs/PasswordDigest",
          "title": "Client Secret",
          "description": "The Client Secret for Client Authentication."
        },
        "sector_identifier_uri": {
          "type": "string",
          "format": "uri",
          "title": "Sector Identifier URI",
          "description": "The Client Sector Identifier URI for Privacy Isolation via Pairwise subject types."
        },
        "public": {
          "type": "boolean",
          "title": "Public",
          "description": "Enables the Public Client Type.",
          "default": false
        },
        "redirect_uris": {
          "$ref": "#/$defs/IdentityProvidersOpenIDConnectClientURIs",
          "title": "Redirect URIs",
          "description": "List of whitelisted redirect URIs."
        },
        "request_uris": {
          "$ref": "#/$defs/IdentityProvidersOpenIDConnectClientURIs",
          "title": "Request URIs",
          "description": "List of whitelisted request URIs."
        },
        "audience": {
          "items": {
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true,
          "title": "Audience",
          "description": "List of authorized audiences."
        },
        "scopes": {
          "items": {
            "type": "string",
            "enum": [
              "openid",
              "offline_access",
              "profile",
              "email",
              "address",
              "phone",
              "groups",
              "authelia.bearer.authz",
              "authelia.pam"
            ]
          },
          "type": "array",
          "uniqueItems": true,
          "title": "Scopes",
          "description": "The Scopes this client is allowed request and be granted."
        },
        "grant_types": {
          "items": {
            "type": "string",
            "enum": [
              "authorization_code",
              "implicit",
              "refresh_token",
              "client_credentials",
              "urn:ietf:params:oauth:grant-type:device_code"
            ]
          },
          "type": "array",
          "uniqueItems": true,
          "title": "Grant Types",
          "description": "The Grant Types this client is allowed to use for the protected endpoints."
        },
        "response_types": {
          "items": {
            "type": "string",
            "enum": [
              "code",
              "id_token token",
              "id_token",
              "token",
              "code token",
              "code id_token",
              "code id_token token"
            ]
          },
          "type": "array",
          "uniqueItems": true,
          "title": "Response Types",
          "description": "The Response Types the client is authorized to request."
        },
        "response_modes": {
          "items": {
            "type": "string",
            "enum": [
              "form_post",
              "form_post.jwt",
              "query",
              "query.jwt",
              "fragment",
              "fragment.jwt",
              "jwt"
            ]
          },
          "type": "array",
          "uniqueItems": true,
          "title": "Response Modes",
          "description": "The Response Modes this client is authorized request."
        },
        "authorization_policy": {
          "type": "string",
          "title": "Authorization Policy",
          "description": "The Authorization Policy to apply to this client."
        },
        "lifespan": {
          "type": "string",
          "title": "Lifespan Name",
          "description": "The name of the custom lifespan to utilize for this client."
        },
        "claims_policy": {
          "type": "string",
          "title": "Claims Policy",
          "description": "The claims policy to apply to this client."
        },
        "requested_audience_mode": {
          "type": "string",
          "enum": [
            "explicit",
            "implicit"
          ],
          "title": "Requested Audience Modes",
          "description": "The Requested Audience Modes used for this client."
        },
        "consent_mode": {
          "type": "string",
          "enum": [
            "auto",
            "explicit",
            "implicit",
            "pre-configured"
          ],
          "title": "Consent Modes",
          "description": "The Consent Modes used for this client."
        },
        "pre_configured_consent_duration": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Pre-Configured Consent Duration",
          "description": "The Pre-Configured Consent Duration when using Consent Modes pre-configured for this client."
        },
        "require_pushed_authorization_requests": {
          "type": "boolean",
          "title": "Require Pushed Authorization Requests",
          "description": "Requires Pushed Authorization Requests for this client to perform an authorization.",
          "default": false
        },
        "require_pkce": {
          "type": "boolean",
          "title": "Require PKCE",
          "description": "Requires a Proof Key for this client to perform Code Exchange.",
          "default": false
        },
        "pkce_challenge_method": {
          "type": "string",
          "enum": [
            "",
            "plain",
            "S256"
          ],
          "title": "PKCE Challenge Method",
          "description": "The PKCE Challenge Method enforced on this client."
        },
        "authorization_signed_response_alg": {
          "type": "string",
          "enum": [
            "",
            "HS256",
            "HS384",
            "HS512",
            "RS256",
            "RS384",
            "RS512",
            "ES256",
            "ES384",
            "ES512",
            "PS256",
            "PS384",
            "PS512",
            "Ed25519",
            "EdDSA",
            "ML-DSA-44",
            "ML-DSA-65",
            "ML-DSA-87"
          ],
          "title": "Authorization Signing Algorithm",
          "description": "The JOSE signing algorithm (JWS) this client uses to sign the Authorization objects that it generates and responds with. i.e. the JWS 'alg' value. The Edwards-curve identifier 'EdDSA' is also accepted for compatibility with RFC 8037, however RFC 9864 deprecates it in favor of 'Ed25519' which is recommended instead.",
          "default": "RS256"
        },
        "authorization_signed_response_key_id": {
          "type": "string",
          "title": "Authorization Signing Key ID",
          "description": "The Key ID of a JOSE signing key (JWS) this client uses to sign the Authorization objects that it generates and responds with. This value overrides the 'authorization_signed_response_alg'. i.e. the JWS 'kid' value."
        },
        "authorization_encrypted_response_alg": {
          "type": "string",
          "enum": [
            "",
            "none",
            "RSA1_5",
            "RSA-OAEP",
            "RSA-OAEP-256",
            "A128KW",
            "A192KW",
            "A256KW",
            "dir",
            "ECDH-ES",
            "ECDH-ES+A128KW",
            "ECDH-ES+A192KW",
            "ECDH-ES+A256KW",
            "A128GCMKW",
            "A192GCMKW",
            "A256GCMKW",
            "PBES2-HS256+A128KW",
            "PBES2-HS384+A192KW",
            "PBES2-HS512+A256KW"
          ],
          "title": "Authorization Encryption Algorithm (CEK)",
          "description": "The JOSE encryption algorithm (JWE) this client uses to encrypt the Authorization objects CEK that it generates and responds with. i.e. the JWE 'alg' value.",
          "default": "none"
        },
        "authorization_encrypted_response_enc": {
          "type": "string",
          "enum": [
            "",
            "A128CBC-HS256",
            "A192CBC-HS384",
            "A256CBC-HS512",
            "A128GCM",
            "A192GCM",
            "A256GCM"
          ],
          "title": "Authorization Encryption Algorithm (Content)",
          "description": "The JOSE encryption algorithm (JWE) this client uses to encrypt the Authorization objects content that it generates and responds with. i.e. the JWE 'enc' value.",
          "default": "A128CBC-HS256"
        },
        "authorization_encrypted_response_key_id": {
          "type": "string",
          "title": "Authorization Signing Key ID",
          "description": "The Key ID of a JOSE encryption key (JWE) this client uses to encrypt the Authorization objects that it generates and responds with. This value overrides the 'authorization_encrypted_response_alg' and 'authorization_encrypted_response_enc'. i.e. the JWE 'kid' value."
        },
        "id_token_signed_response_alg": {
          "type": "string",
          "enum": [
            "",
            "HS256",
            "HS384",
            "HS512",
            "RS256",
            "RS384",
            "RS512",
            "ES256",
            "ES384",
            "ES512",
            "PS256",
            "PS384",
            "PS512",
            "Ed25519",
            "EdDSA",
            "ML-DSA-44",
            "ML-DSA-65",
            "ML-DSA-87"
          ],
          "title": "ID Token Signing Algorithm",
          "description": "The JOSE signing algorithm (JWS) this client uses to sign the ID Token objects that it generates and responds with. i.e. the JWS 'alg' value. The Edwards-curve identifier 'EdDSA' is also accepted for compatibility with RFC 8037, however RFC 9864 deprecates it in favor of 'Ed25519' which is recommended instead.",
          "default": "RS256"
        },
        "id_token_signed_response_key_id": {
          "type": "string",
          "title": "ID Token Signing Key ID",
          "description": "The Key ID of a JOSE signing key (JWS) this client uses to sign the ID Token objects that it generates and responds with. This value overrides the 'id_token_signed_response_alg'. i.e. the JWS 'kid' value."
        },
        "id_token_encrypted_response_alg": {
          "type": "string",
          "enum": [
            "",
            "none",
            "RSA1_5",
            "RSA-OAEP",
            "RSA-OAEP-256",
            "A128KW",
            "A192KW",
            "A256KW",
            "dir",
            "ECDH-ES",
            "ECDH-ES+A128KW",
            "ECDH-ES+A192KW",
            "ECDH-ES+A256KW",
            "A128GCMKW",
            "A192GCMKW",
            "A256GCMKW",
            "PBES2-HS256+A128KW",
            "PBES2-HS384+A192KW",
            "PBES2-HS512+A256KW"
          ],
          "title": "ID Token Encryption Algorithm (CEK)",
          "description": "The JOSE encryption algorithm (JWE) this client uses to encrypt the ID Token objects CEK that it generates and responds with. i.e. the JWE 'alg' value.",
          "default": "none"
        },
        "id_token_encrypted_response_enc": {
          "type": "string",
          "enum": [
            "",
            "A128CBC-HS256",
            "A192CBC-HS384",
            "A256CBC-HS512",
            "A128GCM",
            "A192GCM",
            "A256GCM"
          ],
          "title": "ID Token Encryption Algorithm (Content)",
          "description": "The JOSE encryption algorithm (JWE) this client uses to encrypt the ID Token objects content that it generates and responds with. i.e. the JWE 'enc' value.",
          "default": "A128CBC-HS256"
        },
        "id_token_encrypted_response_key_id": {
          "type": "string",
          "title": "ID Token Signing Key ID",
          "description": "The Key ID of a JOSE encryption key (JWE) this client uses to encrypt the ID Token objects that it generates and responds with. This value overrides the 'id_token_encrypted_response_alg' and 'id_token_encrypted_response_enc'. i.e. the JWE 'kid' value."
        },
        "access_token_signed_response_alg": {
          "type": "string",
          "enum": [
            "",
            "none",
            "HS256",
            "HS384",
            "HS512",
            "RS256",
            "RS384",
            "RS512",
            "ES256",
            "ES384",
            "ES512",
            "PS256",
            "PS384",
            "PS512",
            "Ed25519",
            "EdDSA",
            "ML-DSA-44",
            "ML-DSA-65",
            "ML-DSA-87"
          ],
          "title": "Access Token Signing Algorithm",
          "description": "The JOSE signing algorithm (JWS) this client uses to sign the Access Token objects that it generates and responds with. i.e. the JWS 'alg' value. The Edwards-curve identifier 'EdDSA' is also accepted for compatibility with RFC 8037, however RFC 9864 deprecates it in favor of 'Ed25519' which is recommended instead.",
          "default": "none"
        },
        "access_token_signed_response_key_id": {
          "type": "string",
          "title": "Access Token Signing Key ID",
          "description": "The Key ID of a JOSE signing key (JWS) this client uses to sign the Access Token objects that it generates and responds with. This value overrides the 'access_token_signed_response_alg'. i.e. the JWS 'kid' value."
        },
        "access_token_encrypted_response_alg": {
          "type": "string",
          "enum": [
            "",
            "none",
            "RSA1_5",
            "RSA-OAEP",
            "RSA-OAEP-256",
            "A128KW",
            "A192KW",
            "A256KW",
            "dir",
            "ECDH-ES",
            "ECDH-ES+A128KW",
            "ECDH-ES+A192KW",
            "ECDH-ES+A256KW",
            "A128GCMKW",
            "A192GCMKW",
            "A256GCMKW",
            "PBES2-HS256+A128KW",
            "PBES2-HS384+A192KW",
            "PBES2-HS512+A256KW"
          ],
          "title": "Access Token Encryption Algorithm (CEK)",
          "description": "The JOSE encryption algorithm (JWE) this client uses to encrypt the Access Token objects CEK that it generates and responds with. i.e. the JWE 'alg' value.",
          "default": "none"
        },
        "access_token_encrypted_response_enc": {
          "type": "string",
          "enum": [
            "",
            "A128CBC-HS256",
            "A192CBC-HS384",
            "A256CBC-HS512",
            "A128GCM",
            "A192GCM",
            "A256GCM"
          ],
          "title": "Access Token Encryption Algorithm (Content)",
          "description": "The JOSE encryption algorithm (JWE) this client uses to encrypt the Access Token objects content that it generates and responds with. i.e. the JWE 'enc' value.",
          "default": "A128CBC-HS256"
        },
        "access_token_encrypted_response_key_id": {
          "type": "string",
          "title": "Access Token Signing Key ID",
          "description": "The Key ID of a JOSE encryption key (JWE) this client uses to encrypt the Access Token objects that it generates and responds with. This value overrides the 'access_token_encrypted_response_alg' and 'access_token_encrypted_response_enc'. i.e. the JWE 'kid' value."
        },
        "userinfo_signed_response_alg": {
          "type": "string",
          "enum": [
            "",
            "none",
            "HS256",
            "HS384",
            "HS512",
            "RS256",
            "RS384",
            "RS512",
            "ES256",
            "ES384",
            "ES512",
            "PS256",
            "PS384",
            "PS512",
            "Ed25519",
            "EdDSA",
            "ML-DSA-44",
            "ML-DSA-65",
            "ML-DSA-87"
          ],
          "title": "Userinfo Signing Algorithm",
          "description": "The JOSE signing algorithm (JWS) this client uses to sign the Userinfo objects that it generates and responds with. i.e. the JWS 'alg' value. The Edwards-curve identifier 'EdDSA' is also accepted for compatibility with RFC 8037, however RFC 9864 deprecates it in favor of 'Ed25519' which is recommended instead.",
          "default": "none"
        },
        "userinfo_signed_response_key_id": {
          "type": "string",
          "title": "Userinfo Signing Key ID",
          "description": "The Key ID of a JOSE signing key (JWS) this client uses to sign the Userinfo objects that it generates and responds with. This value overrides the 'userinfo_signed_response_alg'. i.e. the JWS 'kid' value."
        },
        "userinfo_encrypted_response_alg": {
          "type": "string",
          "enum": [
            "",
            "none",
            "RSA1_5",
            "RSA-OAEP",
            "RSA-OAEP-256",
            "A128KW",
            "A192KW",
            "A256KW",
            "dir",
            "ECDH-ES",
            "ECDH-ES+A128KW",
            "ECDH-ES+A192KW",
            "ECDH-ES+A256KW",
            "A128GCMKW",
            "A192GCMKW",
            "A256GCMKW",
            "PBES2-HS256+A128KW",
            "PBES2-HS384+A192KW",
            "PBES2-HS512+A256KW"
          ],
          "title": "Userinfo Encryption Algorithm (CEK)",
          "description": "The JOSE encryption algorithm (JWE) this client uses to encrypt the Userinfo objects CEK that it generates and responds with. i.e. the JWE 'alg' value.",
          "default": "none"
        },
        "userinfo_encrypted_response_enc": {
          "type": "string",
          "enum": [
            "",
            "A128CBC-HS256",
            "A192CBC-HS384",
            "A256CBC-HS512",
            "A128GCM",
            "A192GCM",
            "A256GCM"
          ],
          "title": "Userinfo Encryption Algorithm (Content)",
          "description": "The JOSE encryption algorithm (JWE) this client uses to encrypt the Userinfo objects content that it generates and responds with. i.e. the JWE 'enc' value.",
          "default": "A128CBC-HS256"
        },
        "userinfo_encrypted_response_key_id": {
          "type": "string",
          "title": "Userinfo Signing Key ID",
          "description": "The Key ID of a JOSE encryption key (JWE) this client uses to encrypt the Userinfo objects that it generates and responds with. This value overrides the 'userinfo_encrypted_response_alg' and 'userinfo_encrypted_response_enc'. i.e. the JWE 'kid' value."
        },
        "introspection_signed_response_alg": {
          "type": "string",
          "enum": [
            "",
            "none",
            "HS256",
            "HS384",
            "HS512",
            "RS256",
            "RS384",
            "RS512",
            "ES256",
            "ES384",
            "ES512",
            "PS256",
            "PS384",
            "PS512",
            "Ed25519",
            "EdDSA",
            "ML-DSA-44",
            "ML-DSA-65",
            "ML-DSA-87"
          ],
          "title": "Introspection Signing Algorithm",
          "description": "The JOSE signing algorithm (JWS) this client uses to sign the Introspection objects that it generates and responds with. i.e. the JWS 'alg' value. The Edwards-curve identifier 'EdDSA' is also accepted for compatibility with RFC 8037, however RFC 9864 deprecates it in favor of 'Ed25519' which is recommended instead.",
          "default": "none"
        },
        "introspection_signed_response_key_id": {
          "type": "string",
          "title": "Introspection Signing Key ID",
          "description": "The Key ID of a JOSE signing key (JWS) this client uses to sign the Introspection objects that it generates and responds with. This value overrides the 'introspection_signed_response_alg'. i.e. the JWS 'kid' value."
        },
        "introspection_encrypted_response_alg": {
          "type": "string",
          "enum": [
            "",
            "none",
            "RSA1_5",
            "RSA-OAEP",
            "RSA-OAEP-256",
            "A128KW",
            "A192KW",
            "A256KW",
            "dir",
            "ECDH-ES",
            "ECDH-ES+A128KW",
            "ECDH-ES+A192KW",
            "ECDH-ES+A256KW",
            "A128GCMKW",
            "A192GCMKW",
            "A256GCMKW",
            "PBES2-HS256+A128KW",
            "PBES2-HS384+A192KW",
            "PBES2-HS512+A256KW"
          ],
          "title": "Introspection Encryption Algorithm (CEK)",
          "description": "The JOSE encryption algorithm (JWE) this client uses to encrypt the Introspection objects CEK that it generates and responds with. i.e. the JWE 'alg' value.",
          "default": "none"
        },
        "introspection_encrypted_response_enc": {
          "type": "string",
          "enum": [
            "",
            "A128CBC-HS256",
            "A192CBC-HS384",
            "A256CBC-HS512",
            "A128GCM",
            "A192GCM",
            "A256GCM"
          ],
          "title": "Introspection Encryption Algorithm (Content)",
          "description": "The JOSE encryption algorithm (JWE) this client uses to encrypt the Introspection objects content that it generates and responds with. i.e. the JWE 'enc' value.",
          "default": "A128CBC-HS256"
        },
        "introspection_encrypted_response_key_id": {
          "type": "string",
          "title": "Introspection Signing Key ID",
          "description": "The Key ID of a JOSE encryption key (JWE) this client uses to encrypt the Introspection objects that it generates and responds with. This value overrides the 'introspection_encrypted_response_alg' and 'introspection_encrypted_response_enc'. i.e. the JWE 'kid' value."
        },
        "request_object_signing_alg": {
          "type": "string",
          "enum": [
            "",
            "none",
            "RS256",
            "RS384",
            "RS512",
            "ES256",
            "ES384",
            "ES512",
            "PS256",
            "PS384",
            "PS512",
            "Ed25519",
            "EdDSA",
            "ML-DSA-44",
            "ML-DSA-65",
            "ML-DSA-87"
          ],
          "title": "Request Object Signing Algorithm",
          "description": "The JOSE signing algorithm (JWS) this client must use to sign Request Objects that it uses. i.e. the JWS 'alg' value. The Edwards-curve identifier 'EdDSA' is also accepted for compatibility with RFC 8037, however RFC 9864 deprecates it in favor of 'Ed25519' which is recommended instead."
        },
        "request_object_encryption_alg": {
          "type": "string",
          "enum": [
            "",
            "none",
            "RSA1_5",
            "RSA-OAEP",
            "RSA-OAEP-256",
            "A128KW",
            "A192KW",
            "A256KW",
            "dir",
            "ECDH-ES",
            "ECDH-ES+A128KW",
            "ECDH-ES+A192KW",
            "ECDH-ES+A256KW",
            "A128GCMKW",
            "A192GCMKW",
            "A256GCMKW",
            "PBES2-HS256+A128KW",
            "PBES2-HS384+A192KW",
            "PBES2-HS512+A256KW"
          ],
          "title": "Request Object Encryption Algorithm (CEK)",
          "description": "The JOSE encryption algorithm (JWE) this client must use to encrypt the Request Object CEK. i.e. the JWE 'alg' value.",
          "default": "none"
        },
        "request_object_encryption_enc": {
          "type": "string",
          "enum": [
            "",
            "A128CBC-HS256",
            "A192CBC-HS384",
            "A256CBC-HS512",
            "A128GCM",
            "A192GCM",
            "A256GCM"
          ],
          "title": "Request Object Encryption Algorithm (Content)",
          "description": "The JOSE encryption algorithm (JWE) this client must use to encrypt the Request Object content. i.e. the JWE 'enc' value.",
          "default": "A128CBC-HS256"
        },
        "token_endpoint_auth_method": {
          "type": "string",
          "enum": [
            "",
            "none",
            "client_secret_post",
            "client_secret_basic",
            "private_key_jwt",
            "client_secret_jwt"
          ],
          "title": "Token Endpoint Auth Method",
          "description": "The Token Endpoint Auth Method enforced by the provider for this client.",
          "default": "client_secret_basic"
        },
        "token_endpoint_auth_signing_alg": {
          "type": "string",
          "enum": [
            "",
            "HS256",
            "HS384",
            "HS512",
            "RS256",
            "RS384",
            "RS512",
            "ES256",
            "ES384",
            "ES512",
            "PS256",
            "PS384",
            "PS512",
            "Ed25519",
            "EdDSA",
            "ML-DSA-44",
            "ML-DSA-65",
            "ML-DSA-87"
          ],
          "title": "Token Endpoint Auth Signing Algorithm",
          "description": "The Token Endpoint Auth Signing Algorithm the provider accepts for this client. The Edwards-curve identifier 'EdDSA' is also accepted for compatibility with RFC 8037, however RFC 9864 deprecates it in favor of 'Ed25519' which is recommended instead."
        },
        "revocation_endpoint_auth_method": {
          "type": "string",
          "enum": [
            "",
            "none",
            "client_secret_post",
            "client_secret_basic",
            "private_key_jwt",
            "client_secret_jwt"
          ],
          "title": "Revocation Endpoint Auth Method",
          "description": "The Revocation Endpoint Auth Method enforced by the provider for this client.",
          "default": "client_secret_basic"
        },
        "revocation_endpoint_auth_signing_alg": {
          "type": "string",
          "enum": [
            "",
            "HS256",
            "HS384",
            "HS512",
            "RS256",
            "RS384",
            "RS512",
            "ES256",
            "ES384",
            "ES512",
            "PS256",
            "PS384",
            "PS512",
            "Ed25519",
            "EdDSA",
            "ML-DSA-44",
            "ML-DSA-65",
            "ML-DSA-87"
          ],
          "title": "Revocation Endpoint Auth Signing Algorithm",
          "description": "The Revocation Endpoint Auth Signing Algorithm the provider accepts for this client. The Edwards-curve identifier 'EdDSA' is also accepted for compatibility with RFC 8037, however RFC 9864 deprecates it in favor of 'Ed25519' which is recommended instead."
        },
        "introspection_endpoint_auth_method": {
          "type": "string",
          "enum": [
            "",
            "none",
            "client_secret_post",
            "client_secret_basic",
            "private_key_jwt",
            "client_secret_jwt"
          ],
          "title": "Introspection Endpoint Auth Method",
          "description": "The Introspection Endpoint Auth Method enforced by the provider for this client.",
          "default": "client_secret_basic"
        },
        "introspection_endpoint_auth_signing_alg": {
          "type": "string",
          "enum": [
            "",
            "HS256",
            "HS384",
            "HS512",
            "RS256",
            "RS384",
            "RS512",
            "ES256",
            "ES384",
            "ES512",
            "PS256",
            "PS384",
            "PS512",
            "Ed25519",
            "EdDSA",
            "ML-DSA-44",
            "ML-DSA-65",
            "ML-DSA-87"
          ],
          "title": "Introspection Endpoint Auth Signing Algorithm",
          "description": "The Introspection Endpoint Auth Signing Algorithm the provider accepts for this client. The Edwards-curve identifier 'EdDSA' is also accepted for compatibility with RFC 8037, however RFC 9864 deprecates it in favor of 'Ed25519' which is recommended instead."
        },
        "pushed_authorization_request_endpoint_auth_method": {
          "type": "string",
          "enum": [
            "",
            "none",
            "client_secret_post",
            "client_secret_basic",
            "private_key_jwt",
            "client_secret_jwt"
          ],
          "title": "Pushed Authorization Request Endpoint Auth Method",
          "description": "The Pushed Authorization Request Endpoint Auth Method enforced by the provider for this client.",
          "default": "client_secret_basic"
        },
        "pushed_authorization_request_endpoint_auth_signing_alg": {
          "type": "string",
          "enum": [
            "",
            "HS256",
            "HS384",
            "HS512",
            "RS256",
            "RS384",
            "RS512",
            "ES256",
            "ES384",
            "ES512",
            "PS256",
            "PS384",
            "PS512",
            "Ed25519",
            "EdDSA",
            "ML-DSA-44",
            "ML-DSA-65",
            "ML-DSA-87"
          ],
          "title": "Pushed Authorization Request Endpoint Auth Signing Algorithm",
          "description": "The Pushed Authorization Request Endpoint Auth Signing Algorithm the provider accepts for this client. The Edwards-curve identifier 'EdDSA' is also accepted for compatibility with RFC 8037, however RFC 9864 deprecates it in favor of 'Ed25519' which is recommended instead."
        },
        "allow_multiple_auth_methods": {
          "type": "boolean",
          "title": "Allow Multiple Authentication Methods",
          "description": "Permits this registered client to accept misbehaving clients which use a broad authentication approach. This is not standards complaint, use at your own security risk."
        },
        "jwks_uri": {
          "type": "string",
          "format": "uri",
          "title": "JSON Web Keys URI",
          "description": "URI of the JWKS endpoint which contains the Public Keys used to validate request objects and the 'private_key_jwt' client authentication method for this client."
        },
        "jwks": {
          "items": {
            "$ref": "#/$defs/JWK"
          },
          "type": "array",
          "title": "JSON Web Keys",
          "description": "List of arbitrary Public Keys used to validate request objects and the 'private_key_jwt' client authentication method for this client."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "required": [
        "client_id",
        "scopes"
      ],
      "description": "IdentityProvidersOpenIDConnectClient represents a configuration for an OpenID Connect 1.0 client."
    },
    "IdentityProvidersOpenIDConnectClientURIs": {
      "oneOf": [
        {
          "type": "string",
          "format": "uri"
        },
        {
          "items": {
            "type": "string",
            "format": "uri"
          },
          "type": "array",
          "uniqueItems": true
        }
      ]
    },
    "IdentityProvidersOpenIDConnectCustomClaim": {
      "properties": {
        "name": {
          "type": "string",
          "title": "Name",
          "description": "The name of claim."
        },
        "attribute": {
          "type": "string",
          "title": "Attribute",
          "description": "The attribute that populates this claim."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "IdentityProvidersOpenIDConnectCustomClaim represents a single custom claim configuration."
    },
    "IdentityProvidersOpenIDConnectCustomClaims": {
      "patternProperties": {
        ".*": {
          "$ref": "#/$defs/IdentityProvidersOpenIDConnectCustomClaim"
        }
      },
      "type": "object",
      "description": "IdentityProvidersOpenIDConnectCustomClaims represents the custom claims configuration."
    },
    "IdentityProvidersOpenIDConnectLifespan": {
      "properties": {
        "access_token": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Access Token Lifespan",
          "description": "The duration an Access Token is valid for."
        },
        "refresh_token": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Refresh Token Lifespan",
          "description": "The duration a Refresh Token is valid for."
        },
        "id_token": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "ID Token Lifespan",
          "description": "The duration an ID Token is valid for."
        },
        "authorize_code": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Authorize Code Lifespan",
          "description": "The duration an Authorization Code is valid for."
        },
        "device_code": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Device Code Lifespan",
          "description": "The duration an Device Code is valid for."
        },
        "grants": {
          "$ref": "#/$defs/IdentityProvidersOpenIDConnectLifespanGrants",
          "title": "Grant Types",
          "description": "Allows tuning the token lifespans for individual grant types."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "IdentityProvidersOpenIDConnectLifespan allows tuning the lifespans for OpenID Connect 1.0 issued tokens."
    },
    "IdentityProvidersOpenIDConnectLifespanGrants": {
      "properties": {
        "authorize_code": {
          "$ref": "#/$defs/IdentityProvidersOpenIDConnectLifespanToken",
          "title": "Authorize Code Grant",
          "description": "Allows tuning the token lifespans for the authorize code grant."
        },
        "device_code": {
          "$ref": "#/$defs/IdentityProvidersOpenIDConnectLifespanToken",
          "title": "Device Code Grant",
          "description": "Allows tuning the token lifespans for the device code grant."
        },
        "implicit": {
          "$ref": "#/$defs/IdentityProvidersOpenIDConnectLifespanToken",
          "title": "Implicit Grant",
          "description": "Allows tuning the token lifespans for the implicit flow and grant."
        },
        "client_credentials": {
          "$ref": "#/$defs/IdentityProvidersOpenIDConnectLifespanToken",
          "title": "Client Credentials Grant",
          "description": "Allows tuning the token lifespans for the client credentials grant."
        },
        "refresh_token": {
          "$ref": "#/$defs/IdentityProvidersOpenIDConnectLifespanToken",
          "title": "Refresh Token Grant",
          "description": "Allows tuning the token lifespans for the refresh token grant."
        },
        "jwt_bearer": {
          "$ref": "#/$defs/IdentityProvidersOpenIDConnectLifespanToken",
          "title": "JWT Bearer Grant",
          "description": "Allows tuning the token lifespans for the JWT bearer grant."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "IdentityProvidersOpenIDConnectLifespanGrants allows tuning the lifespans for each grant type."
    },
    "IdentityProvidersOpenIDConnectLifespanToken": {
      "properties": {
        "access_token": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Access Token Lifespan",
          "description": "The duration an Access Token is valid for."
        },
        "refresh_token": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Refresh Token Lifespan",
          "description": "The duration a Refresh Token is valid for."
        },
        "id_token": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "ID Token Lifespan",
          "description": "The duration an ID Token is valid for."
        },
        "authorize_code": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Authorize Code Lifespan",
          "description": "The duration an Authorization Code is valid for."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "IdentityProvidersOpenIDConnectLifespanToken allows tuning the lifespans for each token type."
    },
    "IdentityProvidersOpenIDConnectLifespans": {
      "properties": {
        "access_token": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Access Token Lifespan",
          "description": "The duration an Access Token is valid for."
        },
        "refresh_token": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Refresh Token Lifespan",
          "description": "The duration a Refresh Token is valid for."
        },
        "id_token": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "ID Token Lifespan",
          "description": "The duration an ID Token is valid for."
        },
        "authorize_code": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Authorize Code Lifespan",
          "description": "The duration an Authorization Code is valid for."
        },
        "device_code": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Device Code Lifespan",
          "description": "The duration an Device Code is valid for."
        },
        "jwt_secured_authorization": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "JARM",
          "description": "Allows tuning the token lifespan for the JWT Secured Authorization Response Modes (JARM)."
        },
        "custom": {
          "patternProperties": {
            ".*": {
              "$ref": "#/$defs/IdentityProvidersOpenIDConnectLifespan"
            }
          },
          "type": "object",
          "title": "Custom Lifespans",
          "description": "Allows creating custom lifespans to be used by individual clients."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "IdentityProvidersOpenIDConnectLifespans represents the token lifespan configuration."
    },
    "IdentityProvidersOpenIDConnectPolicy": {
      "properties": {
        "default_policy": {
          "type": "string",
          "enum": [
            "one_factor",
            "two_factor",
            "deny"
          ],
          "title": "Default Policy",
          "description": "The default policy action for this policy."
        },
        "rules": {
          "items": {
            "$ref": "#/$defs/IdentityProvidersOpenIDConnectPolicyRule"
          },
          "type": "array",
          "title": "Rules",
          "description": "The list of rules for this policy."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "IdentityProvidersOpenIDConnectPolicy configuration for OpenID Connect 1.0 authorization policies."
    },
    "IdentityProvidersOpenIDConnectPolicyRule": {
      "properties": {
        "policy": {
          "type": "string",
          "enum": [
            "one_factor",
            "two_factor",
            "deny"
          ],
          "title": "Policy",
          "description": "The policy to apply to this rule."
        },
        "subject": {
          "$ref": "#/$defs/AccessControlRuleSubjects",
          "title": "Subject",
          "description": "Subject criteria of the Authorization for this rule to be a match."
        },
        "networks": {
          "oneOf": [
            {
              "type": "string"
            },
            {
              "items": {
                "type": "string"
              },
              "type": "array"
            }
          ],
          "title": "Networks",
          "description": "Networks criteria of the Authorization for this rule to be a match."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "IdentityProvidersOpenIDConnectPolicyRule configuration for OpenID Connect 1.0 authorization policies rules."
    },
    "IdentityProvidersOpenIDConnectScope": {
      "properties": {
        "claims": {
          "items": {
            "type": "string"
          },
          "type": "array",
          "title": "Claims",
          "description": "The list of claims that this scope includes. When this scope is used by a client the clients claim policy must satisfy every claim."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "IdentityProvidersOpenIDConnectScope represents a single custom scope configuration."
    },
    "IdentityValidation": {
      "properties": {
        "reset_password": {
          "$ref": "#/$defs/IdentityValidationResetPassword",
          "title": "Reset Password",
          "description": "Identity Validation options for the Reset Password flow."
        },
        "elevated_session": {
          "$ref": "#/$defs/IdentityValidationElevatedSession",
          "title": "Elevated Session",
          "description": "Identity Validation options for obtaining an Elevated Session for flows such as the Credential Management flows."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "IdentityValidation represents the configuration for identity verification actions/flows."
    },
    "IdentityValidationElevatedSession": {
      "properties": {
        "code_lifespan": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Code Lifespan",
          "description": "The lifespan of the randomly generated One Time Code after which it's considered invalid."
        },
        "elevation_lifespan": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Elevation Lifespan",
          "description": "The lifespan of the elevation after initially validating the One-Time Code before it expires."
        },
        "characters": {
          "type": "integer",
          "maximum": 12,
          "minimum": 6,
          "title": "OTP Characters",
          "description": "Number of characters in the generated OTP codes.",
          "default": 8
        },
        "require_second_factor": {
          "type": "boolean",
          "title": "Require Second Factor",
          "description": "Requires the user use a second factor if they have any known second factor methods.",
          "default": false
        },
        "skip_second_factor": {
          "type": "boolean",
          "title": "Skip Second Factor",
          "description": "Skips the primary identity verification process if the user has authenticated with a second factor.",
          "default": false
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "IdentityValidationElevatedSession represents the tunable aspects of the credential control identity verification action/flow."
    },
    "IdentityValidationResetPassword": {
      "properties": {
        "jwt_lifespan": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "JWT Lifespan",
          "description": "The lifespan of the JSON Web Token after it's initially generated after which it's considered invalid."
        },
        "jwt_algorithm": {
          "type": "string",
          "enum": [
            "HS256",
            "HS384",
            "HS512"
          ],
          "title": "JWT Algorithm",
          "description": "The JSON Web Token Algorithm (JWA) used to sign the Reset Password flow JSON Web Token's.",
          "default": "HS256"
        },
        "jwt_secret": {
          "type": "string",
          "title": "JWT Secret",
          "description": "The secret key used to sign the Reset Password flow JSON Web Token's."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "IdentityValidationResetPassword represents the tunable aspects of the reset password identity verification action/flow."
    },
    "JWK": {
      "properties": {
        "key_id": {
          "type": "string",
          "maxLength": 100,
          "title": "Key ID",
          "description": "The ID of this JWK."
        },
        "use": {
          "type": "string",
          "enum": [
            "sig"
          ],
          "title": "Use",
          "description": "The Use of this JWK.",
          "default": "sig"
        },
        "algorithm": {
          "type": "string",
          "enum": [
            "HS256",
            "HS384",
            "HS512",
            "RS256",
            "RS384",
            "RS512",
            "ES256",
            "ES384",
            "ES512",
            "PS256",
            "PS384",
            "PS512",
            "Ed25519",
            "EdDSA",
            "ML-DSA-44",
            "ML-DSA-65",
            "ML-DSA-87"
          ],
          "title": "Algorithm",
          "description": "The Algorithm of this JWK. The Edwards-curve identifier 'EdDSA' is also accepted for compatibility with RFC 8037, however RFC 9864 deprecates it in favor of 'Ed25519' which is recommended instead."
        },
        "key": {
          "type": "string",
          "pattern": "^-{5}BEGIN (((RSA|EC) )?(PRIVATE|PUBLIC) KEY|CERTIFICATE)-{5}\\n([a-zA-Z0-9\\/+]{1,64}\\n)+([a-zA-Z0-9\\/+]{1,64}[=]{0,2})\\n-{5}END (((RSA|EC) )?(PRIVATE|PUBLIC) KEY|CERTIFICATE)-{5}\\n?$",
          "title": "Key",
          "description": "The Private/Public key material of this JWK in Base64 PEM format."
        },
        "certificate_chain": {
          "$ref": "#/$defs/X509CertificateChain",
          "title": "Certificate Chain",
          "description": "The optional associated certificate which matches the Key public key portion for this JWK."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "JWK represents a JWK."
    },
    "Log": {
      "properties": {
        "level": {
          "type": "string",
          "enum": [
            "error",
            "warn",
            "info",
            "debug",
            "trace"
          ],
          "title": "Level",
          "description": "The minimum Level a Log message must be before it's added to the log."
        },
        "format": {
          "type": "string",
          "enum": [
            "json",
            "text"
          ],
          "title": "Format",
          "description": "The Format of Log messages."
        },
        "file_path": {
          "type": "string",
          "title": "File Path",
          "description": "The File Path to save the logs to instead of sending them to stdout, it's strongly recommended this option is only enabled with 'keep_stdout' also enabled."
        },
        "keep_stdout": {
          "type": "boolean",
          "title": "Keep Stdout",
          "description": "Enables keeping stdout when using the File Path option.",
          "default": false
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "Log represents the logging configuration."
    },
    "NTP": {
      "properties": {
        "address": {
          "$ref": "#/$defs/AddressUDP",
          "title": "NTP Address",
          "description": "The remote address of the NTP server."
        },
        "version": {
          "type": "integer",
          "enum": [
            3,
            4
          ],
          "title": "NTP Version",
          "description": "The NTP Version to use."
        },
        "max_desync": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Maximum Desync",
          "description": "The maximum amount of time that the server can be out of sync."
        },
        "disable_startup_check": {
          "type": "boolean",
          "title": "Disable Startup Check",
          "description": "Disables the NTP Startup Check entirely.",
          "default": false
        },
        "disable_failure": {
          "type": "boolean",
          "title": "Disable Failure",
          "description": "Disables complete failure when the Startup Check fails and instead just logs the error.",
          "default": false
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "NTP represents the configuration related to ntp server."
    },
    "Notifier": {
      "properties": {
        "disable_startup_check": {
          "type": "boolean",
          "title": "Disable Startup Check",
          "description": "Disables the notifier startup checks.",
          "default": false
        },
        "filesystem": {
          "$ref": "#/$defs/NotifierFileSystem",
          "title": "File System",
          "description": "The File System notifier."
        },
        "smtp": {
          "$ref": "#/$defs/NotifierSMTP",
          "title": "SMTP",
          "description": "The SMTP notifier."
        },
        "template_path": {
          "type": "string",
          "title": "Template Path",
          "description": "The path for notifier template overrides."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "Notifier represents the configuration of the notifier to use when sending notifications to users."
    },
    "NotifierFileSystem": {
      "properties": {
        "filename": {
          "type": "string",
          "title": "Filename",
          "description": "The file path of the notifications."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "NotifierFileSystem represents the configuration of the notifier writing emails in a file."
    },
    "NotifierSMTP": {
      "properties": {
        "address": {
          "$ref": "#/$defs/AddressSMTP",
          "title": "Address",
          "description": "The SMTP server address."
        },
        "timeout": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Timeout",
          "description": "The SMTP server connection timeout."
        },
        "username": {
          "type": "string",
          "title": "Username",
          "description": "The username for SMTP authentication."
        },
        "password": {
          "type": "string",
          "title": "Password",
          "description": "The password for SMTP authentication."
        },
        "identifier": {
          "type": "string",
          "title": "Identifier",
          "description": "The identifier used during the HELO/EHLO command.",
          "default": "localhost"
        },
        "sender": {
          "oneOf": [
            {
              "type": "string",
              "format": "email"
            },
            {
              "type": "string",
              "pattern": "^[^\u003c]+\\s\\\u003c[a-zA-Z0-9._~!#$%\u0026'*/=?^{|}+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z0-9-]+\\\u003e$"
            }
          ],
          "title": "Sender",
          "description": "The sender used for SMTP."
        },
        "subject": {
          "type": "string",
          "title": "Subject",
          "description": "The subject format used.",
          "default": "[Authelia] {title}"
        },
        "startup_check_address": {
          "oneOf": [
            {
              "type": "string",
              "format": "email"
            },
            {
              "type": "string",
              "pattern": "^[^\u003c]+\\s\\\u003c[a-zA-Z0-9._~!#$%\u0026'*/=?^{|}+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z0-9-]+\\\u003e$"
            }
          ],
          "title": "Startup Check Address",
          "description": "The address used for the recipient in the startup check."
        },
        "disable_require_tls": {
          "type": "boolean",
          "title": "Disable Require TLS",
          "description": "Disables the requirement to use TLS. This means security critical information and SMTP auth credentials will be sent in the clear due to an unencrypted connection. While this option exists, we heavily discourage it and do not support it.",
          "default": false
        },
        "disable_html_emails": {
          "type": "boolean",
          "title": "Disable HTML Emails",
          "description": "Disables the mixed content type of emails and only sends the plaintext version.",
          "default": false
        },
        "disable_starttls": {
          "type": "boolean",
          "title": "Disable StartTLS",
          "description": "Disables the opportunistic StartTLS functionality which is useful for bad SMTP servers which advertise support for it but don't actually support it.",
          "default": false
        },
        "tls": {
          "$ref": "#/$defs/TLS",
          "title": "TLS",
          "description": "The SMTP server TLS connection properties."
        },
        "host": {
          "type": "string",
          "description": "Deprecated: use address instead.",
          "deprecated": true
        },
        "port": {
          "type": "integer",
          "description": "Deprecated: use address instead.",
          "deprecated": true
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "NotifierSMTP represents the configuration of the SMTP server to send emails with."
    },
    "PasswordDigest": {
      "type": "string",
      "pattern": "^\\$((argon2(id|i|d)\\$v=19\\$m=\\d+,t=\\d+,p=\\d+|scrypt\\$ln=\\d+,r=\\d+,p=\\d+)\\$[a-zA-Z0-9\\/+]+\\$[a-zA-Z0-9\\/+]+|pbkdf2(-sha(224|256|384|512))?\\$\\d+\\$[a-zA-Z0-9\\/.]+\\$[a-zA-Z0-9\\/.]+|bcrypt-sha256\\$v=2,t=2b,r=\\d+\\$[a-zA-Z0-9\\/.]+\\$[a-zA-Z0-9\\/.]+|2(a|b|y)?\\$\\d+\\$[a-zA-Z0-9.\\/]+|(5|6)\\$rounds=\\d+\\$[a-zA-Z0-9.\\/]+\\$[a-zA-Z0-9.\\/]+|plaintext\\$.+|base64\\$[a-zA-Z0-9.=\\/]+)$"
    },
    "PasswordPolicy": {
      "properties": {
        "standard": {
          "$ref": "#/$defs/PasswordPolicyStandard",
          "title": "Standard",
          "description": "The standard password policy engine."
        },
        "zxcvbn": {
          "$ref": "#/$defs/PasswordPolicyZXCVBN",
          "title": "ZXCVBN",
          "description": "The ZXCVBN password policy engine."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "PasswordPolicy represents the configuration related to password policy."
    },
    "PasswordPolicyStandard": {
      "properties": {
        "enabled": {
          "type": "boolean",
          "title": "Enabled",
          "description": "Enables the standard password policy engine.",
          "default": false
        },
        "min_length": {
          "type": "integer",
          "title": "Minimum Length",
          "description": "Minimum password length."
        },
        "max_length": {
          "type": "integer",
          "title": "Maximum Length",
          "description": "Maximum password length.",
          "default": 8
        },
        "require_uppercase": {
          "type": "boolean",
          "title": "Require Uppercase",
          "description": "Require uppercase characters.",
          "default": false
        },
        "require_lowercase": {
          "type": "boolean",
          "title": "Require Lowercase",
          "description": "Require lowercase characters.",
          "default": false
        },
        "require_number": {
          "type": "boolean",
          "title": "Require Number",
          "description": "Require numeric characters.",
          "default": false
        },
        "require_special": {
          "type": "boolean",
          "title": "Require Special",
          "description": "Require symbolic characters.",
          "default": false
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "PasswordPolicyStandard represents the configuration related to standard parameters of password policy."
    },
    "PasswordPolicyZXCVBN": {
      "properties": {
        "enabled": {
          "type": "boolean",
          "title": "Enabled",
          "description": "Enables the ZXCVBN password policy engine.",
          "default": false
        },
        "min_score": {
          "type": "integer",
          "title": "Minimum Score",
          "description": "The minimum ZXCVBN score allowed.",
          "default": 3
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "PasswordPolicyZXCVBN represents the configuration related to ZXCVBN parameters of password policy."
    },
    "PrivacyPolicy": {
      "properties": {
        "enabled": {
          "type": "boolean",
          "title": "Enabled",
          "description": "Enables the Privacy Policy functionality.",
          "default": false
        },
        "require_user_acceptance": {
          "type": "boolean",
          "title": "Require User Acceptance",
          "description": "Enables the requirement for users to accept the policy.",
          "default": false
        },
        "policy_url": {
          "type": "string",
          "format": "uri",
          "title": "Policy URL",
          "description": "The URL of the privacy policy."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "PrivacyPolicy is the privacy policy configuration."
    },
    "RefreshIntervalDuration": {
      "oneOf": [
        {
          "type": "string",
          "enum": [
            "always",
            "never"
          ]
        },
        {
          "type": "string",
          "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
        },
        {
          "type": "integer",
          "description": "The duration in seconds"
        }
      ],
      "default": "5 minutes"
    },
    "Regulation": {
      "properties": {
        "modes": {
          "items": {
            "type": "string",
            "enum": [
              "user",
              "ip"
            ]
          },
          "type": "array",
          "title": "Regulation Modes",
          "description": "The modes to use for regulation.",
          "default": [
            "user"
          ]
        },
        "max_retries": {
          "type": "integer",
          "title": "Maximum Retries",
          "description": "The maximum number of failed attempts permitted before banning a user.",
          "default": 3
        },
        "find_time": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Find Time",
          "description": "The amount of time to consider when determining the number of failed attempts."
        },
        "ban_time": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Ban Time",
          "description": "The amount of time to ban the user for when it's determined the maximum retries has been exceeded."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "Regulation represents the configuration related to regulation."
    },
    "Server": {
      "properties": {
        "address": {
          "$ref": "#/$defs/AddressTCP",
          "title": "Address",
          "description": "The address to listen on."
        },
        "asset_path": {
          "type": "string",
          "title": "Asset Path",
          "description": "The directory where the server asset overrides reside."
        },
        "disable_healthcheck": {
          "type": "boolean",
          "title": "Disable Healthcheck",
          "description": "Disables the healthcheck functionality.",
          "default": false
        },
        "tls": {
          "$ref": "#/$defs/ServerTLS",
          "title": "TLS",
          "description": "The server TLS configuration."
        },
        "headers": {
          "$ref": "#/$defs/ServerHeaders",
          "title": "Headers",
          "description": "The server headers configuration."
        },
        "endpoints": {
          "$ref": "#/$defs/ServerEndpoints",
          "title": "Endpoints",
          "description": "The server endpoints configuration."
        },
        "buffers": {
          "$ref": "#/$defs/ServerBuffers",
          "title": "Buffers",
          "description": "The server buffers configuration."
        },
        "timeouts": {
          "$ref": "#/$defs/ServerTimeouts",
          "title": "Timeouts",
          "description": "The server timeouts configuration."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "Server represents the configuration of the http server."
    },
    "ServerBuffers": {
      "properties": {
        "read": {
          "type": "integer",
          "title": "Read",
          "description": "The read buffer size.",
          "default": 4096
        },
        "write": {
          "type": "integer",
          "title": "Write",
          "description": "The write buffer size.",
          "default": 4096
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "ServerBuffers represents server buffer configurations."
    },
    "ServerEndpointRateLimit": {
      "properties": {
        "enable": {
          "type": "boolean",
          "title": "Enable",
          "description": "Enables the rate limiter for this endpoint.",
          "default": true
        },
        "buckets": {
          "items": {
            "$ref": "#/$defs/ServerEndpointRateLimitBucket"
          },
          "type": "array",
          "title": "Buckets",
          "description": "The list of rate limit buckets."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "ServerEndpointRateLimit represents the rate limiter configuration for a single endpoint."
    },
    "ServerEndpointRateLimitBucket": {
      "properties": {
        "period": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Period",
          "description": "The period of time this rate limit bucket applies to."
        },
        "requests": {
          "type": "integer",
          "title": "Requests",
          "description": "The number of requests allowed in this rate limit bucket for the configured period before the rate limit kicks in."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "ServerEndpointRateLimitBucket represents a single rate limit bucket."
    },
    "ServerEndpointRateLimits": {
      "properties": {
        "reset_password_start": {
          "$ref": "#/$defs/ServerEndpointRateLimit",
          "title": "Reset Password Start",
          "description": "Configures the rate limiter which applies to the endpoint that initializes the reset password flow."
        },
        "reset_password_finish": {
          "$ref": "#/$defs/ServerEndpointRateLimit",
          "title": "Reset Password Finish",
          "description": "Configures the rate limiter which applies to endpoints which consume tokens for the reset password flow."
        },
        "second_factor_totp": {
          "$ref": "#/$defs/ServerEndpointRateLimit",
          "title": "Second Factor TOTP",
          "description": "Configures the rate limiter which applies to the TOTP endpoint code submissions for the second factor flow."
        },
        "second_factor_duo": {
          "$ref": "#/$defs/ServerEndpointRateLimit",
          "title": "Second Factor Duo",
          "description": "Configures the rate limiter which applies to the Duo endpoint which initializes the application authorization flow for the second factor flow."
        },
        "second_factor_password": {
          "$ref": "#/$defs/ServerEndpointRateLimit",
          "title": "Second Factor Password",
          "description": "Configures the rate limiter which applies to the Password endpoint for the second factor flow."
        },
        "session_elevation_start": {
          "$ref": "#/$defs/ServerEndpointRateLimit",
          "title": "Session Elevation Start",
          "description": "Configures the rate limiter which applies to the Elevated Session endpoint which initializes the code generation and notification for the elevated session flow."
        },
        "session_elevation_finish": {
          "$ref": "#/$defs/ServerEndpointRateLimit",
          "title": "Session Elevation Finish",
          "description": "Configures the rate limiter which applies to the Elevated Session endpoint which consumes the code for the elevated session flow."
        },
        "openid_connect_token": {
          "$ref": "#/$defs/ServerEndpointRateLimit",
          "title": "OpenID Connect Token",
          "description": "Configures the rate limiter which applies to the OpenID Connect 1.0 Token Endpoint."
        },
        "openid_connect_pushed_authorization_request": {
          "$ref": "#/$defs/ServerEndpointRateLimit",
          "title": "OpenID Connect Pushed Authorization Request",
          "description": "Configures the rate limiter which applies to the OpenID Connect 1.0 Pushed Authorization Request Endpoint."
        },
        "openid_connect_userinfo": {
          "$ref": "#/$defs/ServerEndpointRateLimit",
          "title": "OpenID Connect UserInfo",
          "description": "Configures the rate limiter which applies to the OpenID Connect 1.0 UserInfo Endpoint."
        },
        "openid_connect_introspection": {
          "$ref": "#/$defs/ServerEndpointRateLimit",
          "title": "OpenID Connect Introspection",
          "description": "Configures the rate limiter which applies to the OpenID Connect 1.0 Introspection Endpoint."
        },
        "openid_connect_revocation": {
          "$ref": "#/$defs/ServerEndpointRateLimit",
          "title": "OpenID Connect Revocation",
          "description": "Configures the rate limiter which applies to the OpenID Connect 1.0 Revocation Endpoint."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "ServerEndpointRateLimits represents the rate limiter configuration for each endpoint."
    },
    "ServerEndpoints": {
      "properties": {
        "enable_pprof": {
          "type": "boolean",
          "title": "Enable PProf",
          "description": "Enables the developer specific pprof endpoints which should not be used in production and only used for debugging purposes.",
          "default": false
        },
        "enable_expvars": {
          "type": "boolean",
          "title": "Enable ExpVars",
          "description": "Enables the developer specific ExpVars endpoints which should not be used in production and only used for debugging purposes.",
          "default": false
        },
        "rate_limits": {
          "$ref": "#/$defs/ServerEndpointRateLimits",
          "title": "Rate Limits",
          "description": "Configure the endpoint rate limits."
        },
        "authz": {
          "patternProperties": {
            ".*": {
              "$ref": "#/$defs/ServerEndpointsAuthz"
            }
          },
          "type": "object",
          "title": "Authz",
          "description": "Configures the Authorization endpoints."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "ServerEndpoints is the endpoints configuration for the HTTP server."
    },
    "ServerEndpointsAuthz": {
      "properties": {
        "implementation": {
          "type": "string",
          "enum": [
            "ForwardAuth",
            "AuthRequest",
            "ExtAuthz",
            "Legacy"
          ],
          "title": "Implementation",
          "description": "The specific Authorization implementation to use for this endpoint."
        },
        "authn_strategies": {
          "items": {
            "$ref": "#/$defs/ServerEndpointsAuthzAuthnStrategy"
          },
          "type": "array",
          "title": "Authn Strategies",
          "description": "The specific Authorization strategies to use for this endpoint."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "ServerEndpointsAuthz is the Authz endpoints configuration for the HTTP server."
    },
    "ServerEndpointsAuthzAuthnStrategy": {
      "properties": {
        "name": {
          "type": "string",
          "enum": [
            "HeaderAuthorization",
            "HeaderProxyAuthorization",
            "HeaderAuthRequestProxyAuthorization",
            "HeaderLegacy",
            "CookieSession"
          ],
          "title": "Name",
          "description": "The name of the Authorization strategy to use."
        },
        "schemes": {
          "items": {
            "type": "string",
            "enum": [
              "basic",
              "bearer"
            ]
          },
          "type": "array",
          "title": "Authorization Schemes",
          "description": "The name of the authorization schemes to allow with the header strategies.",
          "default": [
            "basic"
          ]
        },
        "scheme_basic_cache_lifespan": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Scheme Basic Cache Lifespan",
          "description": "The lifespan for cached basic scheme authorization attempts."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "ServerEndpointsAuthzAuthnStrategy is the Authz endpoints configuration for the HTTP server."
    },
    "ServerHeaders": {
      "properties": {
        "csp_template": {
          "type": "string",
          "title": "CSP Template",
          "description": "The Content Security Policy template.",
          "default": "default-src 'self'; base-uri 'self'; connect-src 'self'; frame-ancestors 'none'; frame-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'nonce-%s'"
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "ServerHeaders represents the customization of the http server headers."
    },
    "ServerTLS": {
      "properties": {
        "certificate": {
          "type": "string",
          "title": "Certificate",
          "description": "Path to the Certificate."
        },
        "key": {
          "type": "string",
          "title": "Key",
          "description": "Path to the Private Key."
        },
        "client_certificates": {
          "items": {
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true,
          "title": "Client Certificates",
          "description": "Path to the Client Certificates to trust for mTLS."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "ServerTLS represents the configuration of the http servers TLS options."
    },
    "ServerTimeouts": {
      "properties": {
        "read": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Read",
          "description": "The read timeout."
        },
        "write": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Write",
          "description": "The write timeout."
        },
        "idle": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Idle",
          "description": "The idle timeout."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "ServerTimeouts represents server timeout configurations."
    },
    "Session": {
      "properties": {
        "name": {
          "type": "string",
          "title": "Name",
          "description": "The session cookie name.",
          "default": "authelia_session"
        },
        "same_site": {
          "type": "string",
          "enum": [
            "lax",
            "strict",
            "none"
          ],
          "title": "Same Site",
          "description": "The session cookie same site value.",
          "default": "lax"
        },
        "expiration": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Expiration",
          "description": "The session cookie expiration when remember me is not checked."
        },
        "inactivity": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Inactivity",
          "description": "The session inactivity timeout."
        },
        "remember_me": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Remember Me",
          "description": "The session cookie expiration when remember me is checked."
        },
        "secret": {
          "type": "string",
          "title": "Secret",
          "description": "Secret used to encrypt the session data."
        },
        "cookies": {
          "items": {
            "$ref": "#/$defs/SessionCookie"
          },
          "type": "array",
          "title": "Cookies",
          "description": "List of cookie domain configurations."
        },
        "redis": {
          "$ref": "#/$defs/SessionRedis",
          "title": "Redis",
          "description": "Redis Session Provider configuration."
        },
        "domain": {
          "type": "string",
          "title": "Domain",
          "description": "Deprecated: Use the session cookies option with the same name instead.",
          "deprecated": true
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "Session represents the configuration related to user sessions."
    },
    "SessionCookie": {
      "properties": {
        "name": {
          "type": "string",
          "title": "Name",
          "description": "The session cookie name.",
          "default": "authelia_session"
        },
        "same_site": {
          "type": "string",
          "enum": [
            "lax",
            "strict",
            "none"
          ],
          "title": "Same Site",
          "description": "The session cookie same site value.",
          "default": "lax"
        },
        "expiration": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Expiration",
          "description": "The session cookie expiration when remember me is not checked."
        },
        "inactivity": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Inactivity",
          "description": "The session inactivity timeout."
        },
        "remember_me": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Remember Me",
          "description": "The session cookie expiration when remember me is checked."
        },
        "domain": {
          "type": "string",
          "format": "hostname",
          "title": "Domain",
          "description": "The domain for this session cookie configuration."
        },
        "authelia_url": {
          "type": "string",
          "format": "uri",
          "title": "Authelia URL",
          "description": "The Root Authelia URL to redirect users to for this session cookie configuration."
        },
        "default_redirection_url": {
          "type": "string",
          "format": "uri",
          "title": "Default Redirection URL",
          "description": "The default redirection URL for this session cookie configuration."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "SessionCookie represents the configuration for a cookie domain."
    },
    "SessionRedis": {
      "properties": {
        "host": {
          "type": "string",
          "title": "Host",
          "description": "The redis server host."
        },
        "port": {
          "type": "integer",
          "title": "Port",
          "description": "The redis server port.",
          "default": 6379
        },
        "timeout": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Timeout",
          "description": "The Redis server connection timeout."
        },
        "max_retries": {
          "type": "integer",
          "title": "Maximum Retries",
          "description": "The maximum number of retries on a failed command.",
          "default": 3
        },
        "username": {
          "type": "string",
          "title": "Username",
          "description": "The redis username."
        },
        "password": {
          "type": "string",
          "title": "Password",
          "description": "The redis password."
        },
        "database_index": {
          "type": "integer",
          "title": "Database Index",
          "description": "The redis database index.",
          "default": 0
        },
        "maximum_active_connections": {
          "type": "integer",
          "title": "Maximum Active Connections",
          "description": "The maximum connections that can be made to redis at one time.",
          "default": 8
        },
        "minimum_idle_connections": {
          "type": "integer",
          "title": "Minimum Idle Connections",
          "description": "The minimum idle connections that should be open to redis."
        },
        "tls": {
          "$ref": "#/$defs/TLS",
          "title": "TLS",
          "description": "The TLS configuration for the redis server."
        },
        "high_availability": {
          "$ref": "#/$defs/SessionRedisHighAvailability",
          "title": "High Availability",
          "description": "The redis high availability configuration."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "SessionRedis represents the configuration related to redis session store."
    },
    "SessionRedisHighAvailability": {
      "properties": {
        "sentinel_name": {
          "type": "string",
          "title": "Sentinel Name",
          "description": "The name of the sentinel instance."
        },
        "sentinel_username": {
          "type": "string",
          "title": "Sentinel Username",
          "description": "The username for the sentinel instance."
        },
        "sentinel_password": {
          "type": "string",
          "title": "Sentinel Password",
          "description": "The password for the sentinel instance."
        },
        "route_by_latency": {
          "type": "boolean",
          "title": "Route by Latency",
          "description": "Uses the Route by Latency mode.",
          "default": false
        },
        "route_randomly": {
          "type": "boolean",
          "title": "Route Randomly",
          "description": "Uses the Route Randomly mode.",
          "default": false
        },
        "nodes": {
          "items": {
            "$ref": "#/$defs/SessionRedisHighAvailabilityNode"
          },
          "type": "array",
          "title": "Nodes",
          "description": "The pre-populated list of nodes for the sentinel instance."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "SessionRedisHighAvailability holds configuration variables for Redis Cluster/Sentinel."
    },
    "SessionRedisHighAvailabilityNode": {
      "properties": {
        "host": {
          "type": "string",
          "title": "Host",
          "description": "The redis sentinel node host."
        },
        "port": {
          "type": "integer",
          "title": "Port",
          "description": "The redis sentinel node port.",
          "default": 26379
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "SessionRedisHighAvailabilityNode Represents a Node."
    },
    "Storage": {
      "properties": {
        "local": {
          "$ref": "#/$defs/StorageLocal",
          "title": "Local",
          "description": "The Local SQLite3 Storage configuration settings."
        },
        "mysql": {
          "$ref": "#/$defs/StorageMySQL",
          "title": "MySQL",
          "description": "The MySQL/MariaDB Storage configuration settings."
        },
        "postgres": {
          "$ref": "#/$defs/StoragePostgreSQL",
          "title": "PostgreSQL",
          "description": "The PostgreSQL Storage configuration settings."
        },
        "encryption_key": {
          "type": "string",
          "title": "Encryption Key",
          "description": "The Storage Encryption Key used to secure security sensitive values in the storage engine."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "Storage represents the configuration of the storage backend."
    },
    "StorageLocal": {
      "properties": {
        "path": {
          "type": "string",
          "title": "Path",
          "description": "The Path for the SQLite3 database file."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "StorageLocal represents the configuration when using local storage."
    },
    "StorageMySQL": {
      "properties": {
        "address": {
          "$ref": "#/$defs/AddressTCP",
          "title": "Address",
          "description": "The address of the SQL Server."
        },
        "database": {
          "type": "string",
          "title": "Database",
          "description": "The database name to use upon a successful connection."
        },
        "username": {
          "type": "string",
          "title": "Username",
          "description": "The username to use to authenticate."
        },
        "password": {
          "type": "string",
          "title": "Password",
          "description": "The password to use to authenticate."
        },
        "timeout": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Timeout",
          "description": "The timeout for the database connection."
        },
        "tls": {
          "$ref": "#/$defs/TLS",
          "title": "TLS",
          "description": "The TLS configuration for the SQL Server."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "StorageMySQL represents the configuration of a MySQL database."
    },
    "StoragePostgreSQL": {
      "properties": {
        "address": {
          "$ref": "#/$defs/AddressTCP",
          "title": "Address",
          "description": "The address of the SQL Server."
        },
        "database": {
          "type": "string",
          "title": "Database",
          "description": "The database name to use upon a successful connection."
        },
        "username": {
          "type": "string",
          "title": "Username",
          "description": "The username to use to authenticate."
        },
        "password": {
          "type": "string",
          "title": "Password",
          "description": "The password to use to authenticate."
        },
        "timeout": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Timeout",
          "description": "The timeout for the database connection."
        },
        "tls": {
          "$ref": "#/$defs/TLS",
          "title": "TLS",
          "description": "The TLS configuration for the SQL Server."
        },
        "schema": {
          "type": "string",
          "title": "Schema",
          "description": "The default schema name to use.",
          "default": "public"
        },
        "servers": {
          "items": {
            "$ref": "#/$defs/StoragePostgreSQLServer"
          },
          "type": "array",
          "title": "Servers",
          "description": "The fallback PostgreSQL severs to connect to in addition to the one defined by the address."
        },
        "ssl": {
          "$ref": "#/$defs/StoragePostgreSQLSSL",
          "title": "SSL",
          "description": "Deprecated: Use the TLS configuration instead.",
          "deprecated": true
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "StoragePostgreSQL represents the configuration of a PostgreSQL database."
    },
    "StoragePostgreSQLSSL": {
      "properties": {
        "mode": {
          "type": "string",
          "enum": [
            "disable",
            "verify-ca",
            "require",
            "verify-full"
          ],
          "title": "Mode",
          "description": "The SSL mode to use, deprecated and replaced with the TLS options.",
          "deprecated": true
        },
        "root_certificate": {
          "type": "string",
          "title": "Root Certificate",
          "description": "Path to the Root Certificate to use, deprecated and replaced with the TLS options.",
          "deprecated": true
        },
        "certificate": {
          "type": "string",
          "title": "Certificate",
          "description": "Path to the Certificate to use, deprecated and replaced with the TLS options.",
          "deprecated": true
        },
        "key": {
          "type": "string",
          "title": "Key",
          "description": "Path to the Private Key to use, deprecated and replaced with the TLS options.",
          "deprecated": true
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "StoragePostgreSQLSSL represents the SSL configuration of a PostgreSQL database."
    },
    "StoragePostgreSQLServer": {
      "properties": {
        "address": {
          "$ref": "#/$defs/AddressTCP",
          "title": "Address",
          "description": "The address of the PostgreSQL Server."
        },
        "tls": {
          "$ref": "#/$defs/TLS",
          "title": "TLS",
          "description": "The TLS configuration for the PostgreSQL Server."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "StoragePostgreSQLServer represents the PostgreSQL server configuration."
    },
    "TLS": {
      "properties": {
        "minimum_version": {
          "$ref": "#/$defs/TLSVersion",
          "title": "Minimum Version",
          "description": "The minimum TLS version accepted."
        },
        "maximum_version": {
          "$ref": "#/$defs/TLSVersion",
          "title": "Maximum Version",
          "description": "The maximum TLS version accepted."
        },
        "skip_verify": {
          "type": "boolean",
          "title": "Skip Verify",
          "description": "Disable all verification of the TLS properties.",
          "default": false
        },
        "server_name": {
          "type": "string",
          "format": "hostname",
          "title": "Server Name",
          "description": "The expected server name to match the certificate against."
        },
        "private_key": {
          "type": "string",
          "pattern": "^-{5}BEGIN ((RSA|EC) )?PRIVATE KEY-{5}\\n([a-zA-Z0-9\\/+]{1,64}\\n)+([a-zA-Z0-9\\/+]{1,64}[=]{0,2})\\n-{5}END ((RSA|EC) )?PRIVATE KEY-{5}\\n?$",
          "title": "Private Key",
          "description": "The private key."
        },
        "certificate_chain": {
          "$ref": "#/$defs/X509CertificateChain",
          "title": "Certificate Chain",
          "description": "The certificate chain."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "TLS is a representation of the TLS configuration."
    },
    "TLSVersion": {
      "type": "string",
      "enum": [
        "TLS 1.0",
        "TLS1.0",
        "TLS 1.1",
        "TLS1.1",
        "TLS 1.2",
        "TLS1.2",
        "TLS 1.3",
        "TLS1.3"
      ]
    },
    "TOTP": {
      "properties": {
        "disable": {
          "type": "boolean",
          "title": "Disable",
          "description": "Disables the TOTP 2FA functionality.",
          "default": false
        },
        "issuer": {
          "type": "string",
          "title": "Issuer",
          "description": "The issuer value for generated TOTP keys.",
          "default": "Authelia"
        },
        "algorithm": {
          "type": "string",
          "enum": [
            "SHA1",
            "SHA256",
            "SHA512"
          ],
          "title": "Algorithm",
          "description": "The algorithm value for generated TOTP keys.",
          "default": "SHA1"
        },
        "digits": {
          "type": "integer",
          "enum": [
            6,
            8
          ],
          "title": "Digits",
          "description": "The digits value for generated TOTP keys.",
          "default": 6
        },
        "period": {
          "type": "integer",
          "title": "Period",
          "description": "The period value for generated TOTP keys.",
          "default": 30
        },
        "skew": {
          "type": "integer",
          "title": "Skew",
          "description": "The permitted skew for generated TOTP keys.",
          "default": 1
        },
        "secret_size": {
          "type": "integer",
          "minimum": 20,
          "title": "Secret Size",
          "description": "The secret size for generated TOTP keys.",
          "default": 32
        },
        "allowed_algorithms": {
          "items": {
            "type": "string",
            "enum": [
              "SHA1",
              "SHA256",
              "SHA512"
            ]
          },
          "type": "array",
          "title": "Allowed Algorithms",
          "description": "List of algorithms the user is allowed to select in addition to the default.",
          "default": [
            "SHA1"
          ]
        },
        "allowed_digits": {
          "items": {
            "type": "integer",
            "enum": [
              6,
              8
            ]
          },
          "type": "array",
          "title": "Allowed Digits",
          "description": "List of digits the user is allowed to select in addition to the default.",
          "default": [
            6
          ]
        },
        "allowed_periods": {
          "items": {
            "type": "integer"
          },
          "type": "array",
          "title": "Allowed Periods",
          "description": "List of periods the user is allowed to select in addition to the default.",
          "default": [
            30
          ]
        },
        "disable_reuse_security_policy": {
          "type": "boolean",
          "title": "Disable Reuse Security Policy",
          "description": "Disables the security policy that prevents reuse of a TOTP code.",
          "default": false
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "TOTP represents the configuration related to TOTP options."
    },
    "Telemetry": {
      "properties": {
        "metrics": {
          "$ref": "#/$defs/TelemetryMetrics",
          "title": "Metrics",
          "description": "The telemetry metrics server configuration."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "Telemetry represents the telemetry config."
    },
    "TelemetryMetrics": {
      "properties": {
        "enabled": {
          "type": "boolean",
          "title": "Enabled",
          "description": "Enables the metrics server.",
          "default": false
        },
        "address": {
          "$ref": "#/$defs/AddressTCP",
          "title": "Address",
          "description": "The address for the metrics server to listen on."
        },
        "buffers": {
          "$ref": "#/$defs/ServerBuffers",
          "title": "Buffers",
          "description": "The server buffers configuration for the metrics server."
        },
        "timeouts": {
          "$ref": "#/$defs/ServerTimeouts",
          "title": "Timeouts",
          "description": "The server timeouts configuration for the metrics server."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "TelemetryMetrics represents the telemetry metrics config."
    },
    "UUID": {
      "items": {
        "type": "integer"
      },
      "type": "array",
      "maxItems": 16,
      "minItems": 16
    },
    "UserAttribute": {
      "properties": {
        "expression": {
          "type": "string",
          "title": "Expression",
          "description": "Expression to derive the user attribute using the common expression language."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "required": [
        "expression"
      ],
      "description": "UserAttribute represents a user attribute definition."
    },
    "WebAuthn": {
      "properties": {
        "disable": {
          "type": "boolean",
          "title": "Disable",
          "description": "Disables the WebAuthn 2FA functionality.",
          "default": false
        },
        "enable_passkey_login": {
          "type": "boolean",
          "title": "Enable Passkey Logins",
          "description": "Allows users to sign in via Passkeys.",
          "default": false
        },
        "experimental_enable_passkey_uv_two_factors": {
          "type": "boolean",
          "title": "Experimental: Enable User Verified Passkey Second Factor",
          "description": "This option is experimental and WILL be removed. When true this will consider a Passkey login where the WebAuthn user verification requirement is met as being a single event 2FA login.",
          "default": false
        },
        "experimental_enable_passkey_upgrade": {
          "type": "boolean",
          "title": "Experimental: Enable User Verified Passkey Second Factor",
          "description": "When true this will attempt to automatically upgrade a WebAuthn credential to a Passkey when the browser or authenticator does not report a newly registered WebAuthn credential to be a Passkey.",
          "default": false
        },
        "display_name": {
          "type": "string",
          "title": "Display Name",
          "description": "The display name attribute for the WebAuthn relying party.",
          "default": "Authelia"
        },
        "attestation_conveyance_preference": {
          "type": "string",
          "enum": [
            "none",
            "indirect",
            "direct"
          ],
          "title": "Conveyance Preference",
          "description": "The default conveyance preference for all WebAuthn credentials.",
          "default": "indirect"
        },
        "timeout": {
          "oneOf": [
            {
              "type": "string",
              "pattern": "^\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?))(\\s*(\\s+and\\s+)?\\d+\\s*(y|M|w|d|h|m|s|ms|((year|month|week|day|hour|minute|second|millisecond)s?)))*$"
            },
            {
              "type": "integer",
              "description": "The duration in seconds"
            }
          ],
          "title": "Timeout",
          "description": "The default timeout for all WebAuthn ceremonies."
        },
        "filtering": {
          "$ref": "#/$defs/WebAuthnFiltering",
          "title": "Filtering",
          "description": "WebAuthn Authenticator filtering settings."
        },
        "selection_criteria": {
          "$ref": "#/$defs/WebAuthnSelectionCriteria",
          "title": "Selection Criteria",
          "description": "WebAuthn Authenticator selection criteria settings."
        },
        "metadata": {
          "$ref": "#/$defs/WebAuthnMetadata",
          "title": "Metadata",
          "description": "WebAuthn Metadata Service settings."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "WebAuthn represents the webauthn config."
    },
    "WebAuthnFiltering": {
      "properties": {
        "prohibit_backup_eligibility": {
          "type": "boolean",
          "title": "Prohibit Backup Eligibility",
          "description": "Prohibits registering authenticators which claim backup eligibility i.e. exporting credentials off of the device.",
          "default": false
        },
        "permitted_aaguids": {
          "items": {
            "$ref": "#/$defs/UUID"
          },
          "type": "array",
          "title": "Permitted AAGUIDs",
          "description": "List of allowed WebAuthn AAGUIDs. No other authenticator can be registered."
        },
        "prohibited_aaguids": {
          "items": {
            "$ref": "#/$defs/UUID"
          },
          "type": "array",
          "title": "Prohibited AAGUIDs",
          "description": "List of prohibited WebAuthn AAGUIDs. Authenticators with these AAGUIDs cannot be registered."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "WebAuthnFiltering represents the WebAuthn authenticator filtering configuration."
    },
    "WebAuthnMetadata": {
      "properties": {
        "enabled": {
          "type": "boolean",
          "title": "Enabled",
          "description": "Enables the use of the WebAuthn Metadata Service.",
          "default": false
        },
        "cache_policy": {
          "type": "string",
          "enum": [
            "strict",
            "relaxed"
          ],
          "title": "Cache Policy",
          "description": "WebAuthn Authenticator metadata cache policy.",
          "default": "strict"
        },
        "validate_trust_anchor": {
          "type": "boolean",
          "title": "Validate Trust Anchor",
          "description": "WebAuthn Authenticator metadata entry trust anchor validation.",
          "default": true
        },
        "validate_entry": {
          "type": "boolean",
          "title": "Validate Entry",
          "description": "WebAuthn Authenticator metadata entry validation requires the AAGUID exists as a MDS3 registered entry.",
          "default": true
        },
        "validate_entry_permit_zero_aaguid": {
          "type": "boolean",
          "title": "Validate Entry Permit Zero AAGUID",
          "description": "WebAuthn Authenticator metadata entry validation zero AAGUID's can be skipped.",
          "default": true
        },
        "validate_status": {
          "type": "boolean",
          "title": "Validate Status",
          "description": "WebAuthn Authenticator status validation.",
          "default": true
        },
        "validate_status_permitted": {
          "items": {
            "type": "string",
            "enum": [
              "FIDO_NOT_CERTIFIED",
              "FIDO_CERTIFIED",
              "USER_VERIFICATION_BYPASS",
              "ATTESTATION_KEY_COMPROMISE",
              "USER_KEY_REMOTE_COMPROMISE",
              "USER_KEY_PHYSICAL_COMPROMISE",
              "UPDATE_AVAILABLE",
              "REVOKED",
              "SELF_ASSERTION_SUBMITTED",
              "FIDO_CERTIFIED_L1",
              "FIDO_CERTIFIED_L1plus",
              "FIDO_CERTIFIED_L2",
              "FIDO_CERTIFIED_L2plus",
              "FIDO_CERTIFIED_L3",
              "FIDO_CERTIFIED_L3plus"
            ]
          },
          "type": "array",
          "title": "Validate Status (Permitted Statuses)",
          "description": "WebAuthn Authenticator status validation can be configured to permit certain statuses. Generally this is discouraged."
        },
        "validate_status_prohibited": {
          "items": {
            "type": "string",
            "enum": [
              "FIDO_NOT_CERTIFIED",
              "FIDO_CERTIFIED",
              "USER_VERIFICATION_BYPASS",
              "ATTESTATION_KEY_COMPROMISE",
              "USER_KEY_REMOTE_COMPROMISE",
              "USER_KEY_PHYSICAL_COMPROMISE",
              "UPDATE_AVAILABLE",
              "REVOKED",
              "SELF_ASSERTION_SUBMITTED",
              "FIDO_CERTIFIED_L1",
              "FIDO_CERTIFIED_L1plus",
              "FIDO_CERTIFIED_L2",
              "FIDO_CERTIFIED_L2plus",
              "FIDO_CERTIFIED_L3",
              "FIDO_CERTIFIED_L3plus"
            ]
          },
          "type": "array",
          "title": "Validate Status (Prohibited Statuses)",
          "description": "WebAuthn Authenticator status validation can prohibit certain statuses. Generally this is discouraged as the defaults are safe."
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "WebAuthnMetadata represents the WebAuthn Metadata Service configuration."
    },
    "WebAuthnSelectionCriteria": {
      "properties": {
        "attachment": {
          "type": "string",
          "enum": [
            "",
            "platform",
            "cross-platform"
          ],
          "title": "Attachment",
          "description": "WebAuthn Authenticator attachment preference.",
          "default": ""
        },
        "discoverability": {
          "type": "string",
          "enum": [
            "discouraged",
            "preferred",
            "required"
          ],
          "title": "Discoverability Selection",
          "description": "The default discoverable preference when registering WebAuthn credentials.",
          "default": "preferred"
        },
        "user_verification": {
          "type": "string",
          "enum": [
            "discouraged",
            "preferred",
            "required"
          ],
          "title": "User Verification",
          "description": "The default user verification preference for all WebAuthn credentials.",
          "default": "preferred"
        }
      },
      "additionalProperties": false,
      "type": "object",
      "description": "WebAuthnSelectionCriteria represents the WebAuthn authenticator selection criteria configuration."
    },
    "X509CertificateChain": {
      "type": "string",
      "pattern": "^(-{5}BEGIN CERTIFICATE-{5}\\n([a-zA-Z0-9\\/+]{1,64}\\n)+([a-zA-Z0-9\\/+]{1,64}[=]{0,2})\\n-{5}END CERTIFICATE-{5}\\n?)+$"
    }
  }
}