Feature Request: Support for external/proxy authentication

bhartshorn commented 7 months ago

Hello! I'm a merveillesian looking to use cerca for a makerspace organization. I installed phpBB and was almost immediately disturbed by the clunkiness and complexity of the admin interface. I think FluxBB is closest to what I want, but it's definitely not a workable solution anymore. I would rather err on the side of too simple, thus cerca!

I'm trying to keep all the IT services behind SSO so folks don't have to keep track of multiple logins. For example right now, I have Dokuwiki and Nextcloud authenticating against Keycloak.

I wouldn't propose adding OIDC or SAML support, that's way beyond the complexity of this project. BUT, there are ways to handle the authentication using a proxy in front of cerca:

My understanding is that the proxy adds some HTTP headers specifying whether the user is authenticated and if so, some identification info. I don't know all the intricacies, but it seems cerca would "just" need to catch the headers and correlate with a user account (creating a new one if necessary).

Would this be a reasonable feature? It could actually be useful for the merveilles community, allowing a proxy to check membership on the Masto instance instead of manually confirming accounts, etc.

cblgh commented 7 months ago

@bhartshorn thank you for your thoughtfully written issue! i really appreciate when people take the time to understand a project and what may or may not be a suitable addition 🖤

let me look into the links you reference regarding enabling an authentication proxy and i'll get back to you! my initial reaction is that if it is a matter of handling a set of http headers to support such a usecase then it feels like a very reasonable tradeoff and addition c:

how do you see this working for your hackerspace usecase: would you be operating an oauth proxy? or is it already taken care of for the SSO provider you already have?

bhartshorn commented 7 months ago

My usecase gets a little muddy because the services are running in Docker behind Traefik as a web proxy.

I would probably use the 'OAuth2-Proxy' project I linked to. I get the impression that it's built to run one instance per service that needs authentication, so I would stand up a copy of it alongside cerca, just for cerca. (all in docker)

I might get around to making the changes in cerca and do a PR, but I'm not sure I have time to invest in learning the codebase right now. We'll see!

cblgh commented 7 months ago

thanks for the context!

if you do find yourself with some extra time, server/server.go contains all you want

here are some snippets that feel relevant:

and if you don't get to it, i'll see when i have a little bit of time to explore it :)

decentral1se commented 4 weeks ago

Hey sorry to jump in on this thread, the header fix seems to be a very nice minimal addition to support this!

I am very curious about "Single Sign On" which also continues in the tradition of cerca, that is, "lean".

This is not really a thing to solve in cerca and may be a wider discussion as to what is the suitable "go to" authentication solution for low-tech but I'm curious to have that chat somewhere!

I was thinking LDAP but after some chat on the pmc xmpp someone was saying that prosody has a nice model for just authenticating against the linux system user accounts with PAM https://modules.prosody.im/mod_auth_pam.html seems pretty neat 😌

Again, probably a wider discussion but I think low-tech self-hosting is going to need to cross this "one username/password for all" bridge at some point...

decentral1se commented 2 days ago

cblgh commented 1 day ago

@decentral1se: Related: #55

That links to the issue we are writing in, what were you thinking of linking to instead?

cblgh / cerca

Feature Request: Support for external/proxy authentication #55