search

advplyr / audiobookshelf

Self-hosted audiobook and podcast server
https://audiobookshelf.org
GNU General Public License v3.0
6.52k stars 466 forks source link

[Enhancement]: Password-less authentication using link sent to email address #3509

Closed ZLoth closed 2 days ago

ZLoth commented 5 days ago

Type of Enhancement

Web Interface/Frontend

Describe the Feature/Enhancement

I would like to be able to configure my server to offer a password-less authenticaiton. The process would work as follows:

  1. User enters in their login name or email address.
  2. Once user is authenticated, a unique time-limited token is generated. (e.g. Time limit is 30 minutes)
  3. That token is embedded into a link and emailed to the user.
  4. The user clicks on the link to authenticate the device.
  5. User is logged in.

The server administrator still needs a password "just in case", and that username/password can be bypassed by going to https://abs.yoursite.com/login/?autoLaunch=0

Why would this be helpful?

I share my server with one-two other people who can be best described as technically challeged. This includes setting the password using a very weak and well-known password think it is secure. By setting up a email link, this eliminates the password.

Future Implementation (Screenshot)

Initial login: image

Once the user enters in their email address (and possibly a CAPTCHA test), they will see the following: If your email address is found on the server, you will receive a email with a link to click on to log into the server. Please note that this link will expire at 6:24 AM Eastern Time.

The Email will look like: Subject: Audiobookshelf login request for user@example.com Text:

A login request has been received for the audiobookshelf server at abs.example.com for the (Web Client/Android Client/iOS Client). If this is you, please click on the link below by 6:24 AM Eastern Time:

https://abs.example.com/login/?token=EJoxARR9Yn9OSnbNo1ZMnMFM0K2g1jLPwcOSXatozEC2W3EnnV

If this isn't you, then delete this email.

Once the link is clicked, the appropriate screen comes up for Web Page or mobile device login...

Web Page: You are now successfully logged in. Click here to go to audiobookshelf.

Mobile Login: You are now successfully logged in. Please close this page and return to the audiobookshelf app to complete the login process.

Audiobookshelf Server Version

v2.14.0

Current Implementation (Screenshot)

Currently, only username/password authentication.

advplyr commented 5 days ago

I'm pretty sure you can set up a flow like that using OIDC with an auth provider like Authentik.

One of the benefits of us adding in OIDC is it allows users to use an auth provider that can do these things instead of us building out every different use-case. Building out different auth methods and flows could be a full time dev effort so we want to leverage auth providers that are already doing this really well.

@Sapd did the bulk of the OIDC implementation for Abs and may have more thoughts.

When we do start working on the authentication again I'd really like to focus on implementing the JWT auth in a more standard way

Sapd commented 4 days ago

Yep what you are describing is usually called magic link login. You can do it with keycloak with this additional software: https://github.com/p2-inc/keycloak-magic-link However keycloak is not so easy to configure if you're new in that topic

Otherwise if you have access for setup of the other peoples computer, I would suggest you just use Authentik with Webauthn. They do not need to have any password then, they can just authenticate using their browser (the browser will either ask for a PIN or fingerprint to unlock an automatically generated secure key on the computer).
You just have to login them once and then webauthn.