Adding Header-based authentication

[FunDeckHermit]

Is your feature request related to a problem? Please describe. Some people prefer to run their own authentication scheme in front of Monica. With Monica having authentication itself there are two authentication layers.

Describe the solution you'd like Implementing proxy header based authentication.

A reverse proxy will get the username from the primary authentication and put that in the header when calling Monica. Monica parses the header and will login the user automatically.

In my case I'm running nginx + Vouch Proxy with Github as authentication provider.

1. Nginx sees my attempt trying to reach monica.example.com and redirects me to Vouch Proxy
2. Vouch Proxy sends me to Github where I login.
3. Github redirects me back to Vouch Proxy and sets a cookie
4. Vouch Proxy gives the okay to nginx and I proceed to monica.example.com
5. At this point I would like to have Monica use the header set bij Vouch Proxy an automatically log me in

Additional context Some example implementations are Navidrome, FileServer or Grafana

[asbiin]

Monica is a Laravel based application. How will we do that in Laravel?

[FunDeckHermit]

With some sort of authentication middleware that intercepts the request and maps it to a valid user. Looks quite straightforward if implemented as middleware.

• Getting the headers

[mtakemoto]

Hey, I also want this feature. I've (finally) got my own instance stood up with Pomerium's Identity-aware proxy in front of it. Now my instance isn't exposed directly to the internet...but I have two login screens to deal with.

It'd be nice if Monica could be configured to accept a JWT header. Or even better, be configured to be fully OIDC compatible.

While I don't know much PHP I do identity and access management stuff on the cloud side for a living. I'd be happy to help out in that area if needed.

[strootje]

Header based, JWT based or full OIDC. I'm running caddy with authelia as my SSO and would love to use this to authenticate with monica