search

blakeblackshear / frigate

NVR with realtime local object detection for IP cameras
https://frigate.video
MIT License
19.17k stars 1.75k forks source link

Support for `@` in usernames #12817

Closed dgoodlad closed 3 months ago

dgoodlad commented 3 months ago

Describe what you are trying to accomplish and why in non technical terms I want to be able to use the set of characters allowed in email addresses for usernames so that I can use the Tailscale-User-Login header as a proxy auth header.

Describe the solution you'd like I use Tailscale as a docker sidecar, along with tailscale serve, to wrap Frigate with both a valid SSL cert and to apply Tailscale's ACLs. Tailscale serve sets identity headers, including Tailscale-User-Login which act like other proxy auth headers. That value is often an email address, but characters such as @ are currently disallowed by the user management UI.

I'd like to relax the username format requirements to allow all the valid email address characters.

Describe alternatives you've considered I could simply disable authentication on Frigate, and assume that Tailscale ACLs will cover me. That does work but will lose out on any future user-by-user customisation in the UI.

Additional context A further improvement would be to automatically allow the Tailscale headers to function properly, and to include support for e.g. the profile picture and name headers.

When using Serve to proxy traffic to a local service running on your machine, a few Tailscale identity headers are added to the request sent to your backend. These can be used by your destination service to identify the Tailscale user associated with the request.

Tailscale-User-Login: Filled with the requester’s login name (for example, alice@example.com) Tailscale-User-Name: Filled with the requester’s display name (for example, Alice Architect) Tailscale-User-Profile-Pic: Filled with the requester’s profile picture URL, if their identity provider provides one (for example, https://example.com/photo.jpg)

If the values contain non-ASCII values, they may be RFC 2047 "Q" encoded (for example, =?utf-8?q?Ferris_B=C3=BCller?=)

NickM-27 commented 3 months ago

I think you are misunderstanding how authentication works. If you are using external auth provider then you should not be creating these users inside of frigate itself. We already have plans to support user-by-user customization for proxied users

dgoodlad commented 3 months ago

Oh ok, makes sense! So they won't be tracked in the db in the same way as "internal" Frigate users, rather managed ad hoc?

NickM-27 commented 3 months ago

It hasn't been implemented yet but I think they will be tracked in the DB, just automatically