Open ghost opened 4 years ago
First we need to decide whether we can use the same UI for both administrator and a regular user. The problem is that currently if the server starts to respond with an error to all requests except get /querylog
UI will show tons of error messages. So either:
@szolin re-assigned this task to v0.103, I think it's too early for us to go this deep with users management.
I didn't quite get the point of adding the "Language" settings into this panel. Based on my experience of the current version, obtaining language from the browser's request is quite enough.
Regarding https://github.com/AdguardTeam/AdGuardHome/issues/1235#issuecomment-562979662
i think user account more convenient to preserve any changes, settings properly than simplified web panel without authentication and hold an account is not that much complex as https://github.com/AdguardTeam/AdGuardHome/issues/1235#issuecomment-563309566 mentioned. optionally able to use simple password, saved logins or without clear cookies etc.
non-authentication accesses also make trouble when user needs to give personal desktop, mobile for someone else temporally or public devices in schools, classes, cafe etc.
Like this idea - as a second iteration of this it could be nice to be able to have users authenticate through some SSO or LDAP service rather than having to manage them manually
@szolin First we need to decide whether we can use the same UI for both administrator and a regular user.
Please refer new changes above; i forgot to mention
Like this idea - as a second iteration of this it could be nice to be able to have users authenticate through some SSO or LDAP service rather than having to manage them manually
Agreed. OAuth 2.0 / OpenID Connect and SAML support would be amazing. There's a ton of awesome ready to go libraries out there.
From #3243:
Add, remove and disable users;
Password changes and disable it;
IP and subnet restrictions (incl. access only from local networks or via unique url maybe, idk);
Session frame time options (web_session_ttl?);
Disable authorization entirely?
From #3806:
I would like the ability to create additional read-only users. I would like the ability to grant access to the */control/querylog path
From https://github.com/AdguardTeam/AdGuardHome/issues/4426:
Can you provide a way (in the yaml file) to actually disable the native authentication process for these kind of settings.
I think that this feature a multi user setup would be an overshoot and is not worth developing.
Regards
I would love this feature. Right now if I want to fetch AdGuard data like in Heimdal or other integrations, I need to provide my username and paassword which is used for admin access. A read only user would be much more secure.
I guess this must not be an overshoot or overengineered solution with different ui or anything. Just a check if the user is admin or not on any set/update operations.
I would love this feature. Right now if I want to fetch AdGuard data like in Heimdal or other integrations, I need to provide my username and paassword which is used for admin access. A read only user would be much more secure.
I guess this must not be an overshoot or overengineered solution with different ui or anything. Just a check if the user is admin or not on any set/update operations.
Same here, I think a simple auth token would be sufficient. Ideally the access rights of the token could be restricted to e.g. only show info. I also think implementing a whole multi user system would be a massive overshoot.
I'd love to have this! It'd be great if I could grant my partner access to our AGH instance to help manage our kid's stuff.
It's only been 4 years, so I guess this is still in the consideration stage?
root user default (and only) login is not within acceptable use policy for any such service.
Enhance AGHome as a multi-user system that handles multiple simultaneous active sessions with role of administrators and standard users.
Benefits
https://www.ntop.org/products/traffic-analysis/ntop/ https://github.com/ntop/ntopng
Any other reasons? To prevent implement https://github.com/AdguardTeam/AdGuardHome/issues/628
Above mentioned user roles seems extend the development task too much due other adguardhome users various expectations then i prefer suggest to discard user roles and use custom permissions method with 'Client Settings' for user accounts.
Preference (this's an another column necessary to add next to 'main settings', 'block services', 'upstream servers')
Filters (it's possible to keep that under client settings too, so we can add necessary filter lists) https://github.com/AdguardTeam/AdGuardHome/issues/435
Locked settings effect![Screenshot_1](https://user-images.githubusercontent.com/46082456/71949246-70634280-3205-11ea-86cc-422707accfdc.png)