Open Wingysam opened 1 year ago
Depends on #23
A possible alternative option to consider, rather than adding to the existing auth options, could be to add support for using headers set by a proxy for authentication. For example, put the app behind a proxy like Caddy, and have Caddy send users to something like Authelia for auth. If successful, Authelia sets the Remote-User header with the username, Caddy passes it to the application, user is allowed in and identified. I've got a version of this working but it's rough and would need some work to be merged.
This could make things simpler in terms of outsourcing authentication to another app (like Authelia, which already has TOTP and Webauthn built-in), but it would make deployment more complex (you'd need a proxy, Authelia plus it's supporting services, plus this project). But if it was a configurable option, it would be avoidable for users where password is all that is required.
I can look at trying to work something up and send a PR if it's of interest? I did it using passport-reverseproxy however, so if you're looking to remove Passport per #25, or want to go a different direction, happy to skip it.
What exactly does Authelia pass as a header? And how does user management work with it?
Authentik will pass the header X-Authentik-Username
with the authenticated user's name. When the app receives that header, it will auto login with the user in the value and create the user if it doesn't already exist, bypassing the app's default login form.
What exactly does Authelia pass as a header? And how does user management work with it?
Authelia will pass Remote-User
with a username but as @004a mentioned different solutions might pass something else.
In terms of user management, to add a user, the workflow would be something like this:
Basically, the only part of user management that remains is adding a user account to Christmas-Community so its in the database. I guess it would be possible to remove the need to do that somehow but that's more complicated than I've needed to go into.
Okay, so I add an env variable that will check Remote-User and X-Authentik-Username, then automatically create/log in that user on every request?
Okay, so I add an env variable that will check Remote-User and X-Authentik-Username, then automatically create/log in that user on every request?
Works for me!
Christmas Community should allow users to sign in with TOTP 2FA codes.