Replies: 23 comments 36 replies
-
https://www.authelia.com/integration/openid-connect/introduction/#discoverable-endpoints |
Beta Was this translation helpful? Give feedback.
-
----edit--- the below was written while @arcoast was posting his reply. I leave it for completeness while I look at what he has suggested. I echo the creating of admin user question. Not really. I've tried a few things, based on working configurations that I have for authelia and other clients, and some guesswork from the podfetch documentation, but I have not hit upon the magic incantation. The documentation does not seem to lead me towards any solution, presumably because nobody has actually done this? In the wiki the heading (under tutorials) How to setup OIDC/OAuth2 actually links to the basic auth tutorial. Which actual OIDC endpoints are used by the environment variables that I mentioned? What is the form of the request to the authentication provider? What response is required? How do I create a user that will map to the OIDC authentication request? I can use the CLI to create users, but that seems only applicable to basic auth. If I use the /api/oidc/authorization endpoint as OIDC_AUTHORITY I get an empty query visiting the podfetch url, pressing the connect with OIDC button repeats the same empty query. In the form (obviously it is using the actual location of my authelia instance rather than 'auth.example.com'):
I just generally feel like I lack the information to make suitable informed guesses to move it forward....obviously this is largely down to my inability to understand and configure what is going on...and obviously there's the problem of the authelia client id settings to consider as well. The keycloak model of realms is not applicable in authelia, so keycloak settings are not proving instructive to me. I could quit and just use basic auth and invites...but I would very much prefer to use my existing OIDC which is particularly important in terms of individual users managing their logins/passwords so that I have zero knowledge (and no maintenance). I have a sense that authelia and podfetch are not really sympathetic partners. |
Beta Was this translation helpful? Give feedback.
-
@tetricky I agree that where we are now is not really workable with Authelia and Podfetch, and I've also noticed the incorrect link in the wiki but did find this document in the actual repository regarding OIDC. One thing I will say, I had an issue with Podfetch and URL encoding, it was a huge thread, but full credit to @SamTV12345 he worked away at it and solved the issue in the end, so I suspect being somewhat pioneers of Authelia OIDC with Podfetch, we're alpha/beta testing here a little but if we can work together I know Sam is incredibly responsive to issues. |
Beta Was this translation helpful? Give feedback.
-
@arcoast ...yes, I set out on this from a position of little knowledge, but in the hope of making progress, in a constructive spirit! Your comments are very helpful. What is clear is that you are using a different version of authelia from me (for example my configuration.yml will not parse if I set I am on authelia v4.37.5 (running in a container), which from github appears to be the latest version...but I see that you have references to, and specific syntax for, 4.38. What version of authelia are you running? Are you running a published version, or development? Is a container available for that do you know? My situation is slightly complicated by testing on a live production stack (albeit not actually business critical/important...it's just a community site).......I know, I know.... |
Beta Was this translation helpful? Give feedback.
-
I have not found a way to do this...the authelia logs are not mounted permanently (and I don't know where they are, if at all, in the container). The container stops on a false configuration, so I can't exec in and see the logs (if I knew where they were)....log level is set to debug. So I can't check what is actually happening....but if I have a working config where the container runs, and ONLY change |
Beta Was this translation helpful? Give feedback.
-
Starting from a completely new install: # docker exec -it podfetch /app/podfetch users add
Debug file located at /home/rust/src/target/x86_64-unknown-linux-musl/release/build/podfetch-433e4bf6518fbe3b/out/built.rs
Starting from command line
User management
Enter your username:
fred
Connecting to postgresql://podfetch:password@podfetch-postgres/podfetch
User does not exist
Enter your password:
Select your role user, admin, uploader
admin
Should a user with the following settings be applied User { id: 0, username: "fred", role: "admin", password: Some("password"), explicit_consent: false, created_at: 2023-09-06T13:11:13.809415057 }
Y[es]/N[o]
Y
Connecting to postgresql://podfetch:password@podfetch-postgres/podfetch
User succesfully created And then trying to login as the user |
Beta Was this translation helpful? Give feedback.
-
I've also tried adding a user called |
Beta Was this translation helpful? Give feedback.
-
I am now where @arcoast is. I hadn't got I have the same behaviour regarding users and admin. |
Beta Was this translation helpful? Give feedback.
-
I pushed a commit that outputs the username of the token and also the result of the lookup in the database. Should arrive shortly on the develop tags. |
Beta Was this translation helpful? Give feedback.
-
The positive, for me, is that the config examples provided by @arcoast work to allow login to podfetch using authelia. The issues regarding user and admin accounts aside. |
Beta Was this translation helpful? Give feedback.
-
@arcoast Could you please send a starting point for a configuration.yml. I am getting errors that my configuration file is invalid but I cannot really find the error. It just says error parsing file and then crashes. |
Beta Was this translation helpful? Give feedback.
-
Here's a basic authelia:
image: authelia/authelia
container_name: authelia
ports:
- 9091:9091
environment:
- TZ=${TZ}
volumes:
- ${CONFIG}/authelia/authelia:/config
restart: unless-stopped configuration.yml theme: dark
jwt_secret: 'a_very_important_secret'
server:
host: 0.0.0.0
port: 9091
path: ""
log:
level: info
format: text
# file_path: /config/authelia.log
# keep_stdout: true
totp:
issuer: Podfetch
period: 30
skew: 1
webauthn:
disable: false
display_name: Authelia
attestation_conveyance_preference: indirect
user_verification: preferred
timeout: 60s
authentication_backend:
password_reset:
disable: false
refresh_interval: 5m
file:
path: '/config/users_database.yml'
watch: false
search:
email: false
case_insensitive: false
session:
name: authelia_session
domain: SERVER.COM
same_site: lax
expiration: 1h
inactivity: 5m
remember_me_duration: 1M
regulation:
max_retries: 3
find_time: 2m
ban_time: 5m
storage:
encryption_key: you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this
local:
path: /config/db.sqlite3
notifier:
disable_startup_check: false
filesystem:
filename: /config/notification.txt
access_control:
default_policy: one_factor
rules:
# Allow free access from local network
- domain: "*.SERVER.COM"
policy: bypass
networks:
- 192.168.0.0/16
- 172.16.0.0/12
- 10.0.0.0/8
identity_providers:
oidc:
hmac_secret: this_is_a_secret_abc123abc123abc
issuer_private_key: |
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAu1oYYPDQQwEeMTPoFs/VIBjCpXPfaJF30KBVRGCtCB7s4cYm
3DUZkm6JNHD8lA6RpwOg8MDF/4TOnCZpX1c15uCPfpfCbXdeAtNW8SNFZcFabCVr
XnoftaQ69F9jyRWcxgroeHzY/Y4JikyfYPGKv1i9ZVPFIStFweXJNZBmW81bqyb4
5Qv7yrvqh80jIKh9w0LyZXDf4J6DGn19h0uByx7BZIplxoxp9TsBHyriTGRPKNhh
TGXAFqSfk4Sc6sb7Q/SFRBqMRjh3/gxup1yAUG+pmz2bGedWPz3+day1+Bvccfoo
R8HVVK146LJutc/3MqfDMiXaSUgzIPFK9JqNawIDAQABAoIBAFsi0IkXm7d8a7tz
jIrMPtiGMulZHGw5lxcdZ10DyigRIxoQ0gZ8rhvVOVkRPUyoaaHc2gVDQQ2zBO5g
oRGH0uikhCkImcO2NT0aoUhb5/4/uESzTy9+KL6rTSJi5J+Eq+aKl9tEoCl3Vpy3
+S+nT98Uw8zumw4vhpdzuBUeUSyGO82pWO1UKgiSLcEDeE339/u5Xij1mDBzk16R
ZdVV6QWDYPkxy948v6F9ou1r9zsoYtzelnCUEFKp2eFMwMZsiRMDt/20unmGgQSy
YHRX3FXfJKLdpGXXTOOYs2g59xZD397fvD59heZaZT3ufBgnv9LdpgnQSG1+lyZF
cdpPl8ECgYEA4ewnYOCaKgBc5LxsTKAAX54U72AQu/HMUqfjkoO9quMffk6vpZCc
D6fdWwG50t7KDYU20lWBg67DD7w6AOVg7LbfMh/c3SPBObwbV4s2SjPqBa6ShR4q
dA6qtm9m2Ru0xID3mhulIRPT2pp9UlPdOZR5NkoCv20hLPcFJI7VnmUCgYEA1Etj
PiesBuE1BcTQ3QsobFxqgvheZYneTNMuaFupmtBBw3dZlgEQTC7wBLeg8lWD6p1j
WMB1mxtqvnRfFezAcqRdQB1kvbs5CZ5bbo1W1hbnt08hncK5+IW2wBVTjTNL/7NX
hWKz5FawiiGYJ3FmPvpjSPG49gDn92nemBscF48CgYEAyJlWMbfcSvT9hoAjrTnY
ew4zSoTC9w5wvOejsoFVVLnMSet2HI01dNU5P8hdhfYZ9D1XexU/JXx0aLFZ01fY
YvbRYYFXK+fGdwwmPuo2L1a/MYJbSOWLDnfDbq+l45qtPFnDAEwRqDghwRWxtvsO
EEVcBy9aFzy/21wObfKBjN0CgYAkMi5bnJwCGEfYEfSim5Jq1175sas2mMkkRCV3
eZlzYeq0jxbhMpE6zA30X/K7HsV9LRSRP09OAOC0VFcZ/+HYKhoUIm7YwqE4+J0S
Plr96a3cXUuYAGmA7Bt6qKg0PPjKQiO8BFYzqmwzQQMWRoluV3ayKzSkDQd/8bcY
LBcgFQKBgGj1Nos02yLFoghHzKdTK5gATc2ZpwBCs7ZckCVuqGTHr/2xc87Jnoyo
DaYf2i3hYkkxComTEYxrnG4SX9xLMSMxYi0jl6uL6GAaTSo90LUygd+y51gDnLvz
Bim50KFgeTCEpjdEqStFqsRbvT4j4msJMKDMrVeHAoCbgC4CE270
-----END RSA PRIVATE KEY-----
access_token_lifespan: 1h
authorize_code_lifespan: 1m
id_token_lifespan: 1h
refresh_token_lifespan: 90m
enable_client_debug_messages: false
minimum_parameter_entropy: 8
enforce_pkce: public_clients_only
cors:
endpoints:
- authorization
- token
- revocation
- introspection
- userinfo
allowed_origins:
- "*"
allowed_origins_from_client_redirect_uris: false
clients:
- id: podfetch
description: Podfetch
public: true
authorization_policy: one_factor
scopes:
- openid
- profile
- email
consent_mode: explicit
redirect_uris:
- https://podfetch.SERVER.COM/ui/login
userinfo_signing_algorithm: none user_database.yml # List of users
users:
authelia:
disabled: false
displayname: "Authelia User"
# Password is authelia
password: "$6$rounds=50000$BpLnfgDsc2WD8F2q$Zis.ixdg9s/UOJYrs56b5QEZFiZECu0qZVNsIYxBaNJ7ucIL.nlxVCT5tqh8KHG8X4tlwCFm5r6NTOZZ5qRFN/" # yamllint disable-line rule:line-length
email: authelia@authelia.com
groups:
- admins
- dev
...
|
Beta Was this translation helpful? Give feedback.
-
If it helps, here's how it's set up for Traefik, I know you've set that up before but posted my setup as well below. Traefik Middleware http:
middlewares:
authelia:
forwardauth:
address: http://authelia:9091/api/verify?rd=https://login.{{env "TRAEFIK_DOMAIN"}}/
trustForwardHeader: true
authResponseHeaders:
- Remote-User
- Remote-Groups
- Remote-Name
- Remote-Email Podfetch & Authelia services:
podfetch:
image: samuel19982/podfetch
container_name: podfetch
user: ${PUID}:${PGID}
networks:
- traefik
ports:
- 8000:8000
volumes:
- ${PODCASTS}:/app/podcasts
- ${CONFIG}/podfetch/podfetch/db:/app/db
environment:
- POLLING_INTERVAL=${POLLING_INTERVAL}
- SERVER_URL=${SERVER_URL}
- GPODDER_INTEGRATION_ENABLED=${GPODDER_INTEGRATION_ENABLED}
- PODINDEX_API_KEY=${PODINDEX_API_KEY}
- PODINDEX_API_SECRET=${PODINDEX_API_SECRET}
- OIDC_AUTH=${PODFETCH_OIDC_AUTH}
- OIDC_AUTHORITY=${PODFETCH_OIDC_AUTHORITY}
- OIDC_CLIENT_ID=${PODFETCH_OIDC_CLIENT_ID}
- OIDC_REDIRECT_URI=${PODFETCH_OIDC_REDIRECT_URI}
- OIDC_SCOPE=${PODFETCH_OIDC_SCOPE}
- OIDC_JWKS=${PODFETCH_OIDC_JWKS}
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik"
- "traefik.http.services.podfetch.loadbalancer.server.port=8000"
- "traefik.http.routers.podfetch.entrypoints=https"
- "traefik.http.routers.podfetch.rule=Host(`podfetch.${TRAEFIK_DOMAIN}`)"
- "traefik.http.routers.podfetch.middlewares=authelia@file"
authelia:
image: authelia/authelia
container_name: authelia
networks:
- traefik
ports:
- 9091:9091
environment:
- TZ=${TZ}
volumes:
- ${CONFIG}/authelia/authelia:/config
restart: unless-stopped
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik"
- "traefik.http.services.authelia.loadbalancer.server.port=9091"
- "traefik.http.routers.authelia.entrypoints=https"
- "traefik.http.routers.authelia.rule=Host(`login.${TRAEFIK_DOMAIN}`)"
traefik:
image: traefik:v2.10.4
container_name: traefik
networks:
- traefik
ports:
# - 80:80
- 443:443
environment:
- TZ=$TZ
- TRAEFIK_DOMAIN=${TRAEFIK_DOMAIN}
- CF_API_EMAIL=${TRAEFIK_CF_API_EMAIL}
- CF_DNS_API_TOKEN=${TRAEFIK_CF_DNS_API_TOKEN}
volumes:
- ${CONFIG}/traefik/traefik/traefik.yaml:/traefik.yaml:ro
- ${CONFIG}/traefik/traefik/configs:/configs:ro
- ${CONFIG}/traefik/traefik/acme.json:/acme.json # Must create file and chmod 600
- ${CONFIG}/traefik/traefik/logs/:/logs
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik"
- "traefik.http.routers.traefik.service=api@internal"
- "traefik.http.routers.traefik.entrypoints=https"
- "traefik.http.routers.traefik.rule=Host(`traefik.${TRAEFIK_DOMAIN}`)"
- "traefik.http.routers.traefik.middlewares=authelia@file" |
Beta Was this translation helpful? Give feedback.
-
@SamTV12345 Forgot to say, if you want me to run anything locally to help figure things out just shout. |
Beta Was this translation helpful? Give feedback.
-
Thanks for the help and the code snippets. Can I also setup authelia without a domain? I'd like to setup authelia on an external computer and have PodFetch running on my own computer so I can debug and restart it more easily. |
Beta Was this translation helpful? Give feedback.
-
Discord is easiest for me, which channel? |
Beta Was this translation helpful? Give feedback.
-
I've been away for a few days, but have an authelia and caddy setup, with a podman stack running containers. Am available today and can help/test if needed. |
Beta Was this translation helpful? Give feedback.
-
@tetricky You can now use Authelia without a problem. @arcoast helped me a lot with debugging the issue. Thanks 🙏 . |
Beta Was this translation helpful? Give feedback.
-
What do I have to do? Obviously my setup doesn't work. What is the resolution? |
Beta Was this translation helpful? Give feedback.
-
I have that (although I had to rebuild from scratch - the container wouldn't run if I just updated the image). I also am turning to the gpodder element. I do not see how that can work. Suppose that I want to connect using antennapod. If I point that to my service, there is no facility within antennapod to log in using oidc. That is the login credentials/token that exist within a browser login, can never be accessible from antennapod. So the login (correctly) fails. It seems to me that there needs to be a separate service for a basic auth type format, that exists as a sub-service, enabled when an oidc user has joined. Such that clients like antennapod have a supported authentication method. This could then be reverse proxied differently (podfetch.domain web client login using oidc, gpodfetch.domain a basic auth type scheme with username and password set within the web client). I just can't see any other way that clients can hurdle the OIDC auth. Unless there are clients that I don't know that support OIDC login? Does that make any sense, or am I completely misunderstanding what is going on? |
Beta Was this translation helpful? Give feedback.
-
My problem with this workflow is that with OIDC I operate zero knowledge of the users password. They set and manage it. For me to set a password in podfetch I need to compromise that, or set a different password, that I then manage, for podfetch on it's own. Which is sub-optimal, and undermines the advantages of OIDC. I might as well just use basic auth, and set the users credentials. Which I don't really want to do. The current alternative is to only use the web-client. |
Beta Was this translation helpful? Give feedback.
-
That's fair enough. I will consider them separately managed services. |
Beta Was this translation helpful? Give feedback.
-
Hi, i have another issue using Authelia and PodFetch. I am using But now whenever I refresh the site the login screen ('Sign in' with button 'OIDC Login') is shown. When refreshing again I am logged in and can see the podcasts etc. Could you maybe look into this? I guess the frontend somehow is not able to see that I am already logged in on every other refresh. Thanks a lot! |
Beta Was this translation helpful? Give feedback.
-
I have a stack using authelia as an authentication provider, which is using OIDC successfully for a number of services.
podfetch:postgres is running successfully in a container.
I am struggling with appropriate setting for the following environment variables, and a corresponding authelia client id config.
OIDC_AUTHORITY
OIDC_REDIRECT_URI
OIDC_SCOPE
OIDC_JWKS
Does anyone have an example or a guide that might help me crack it?
I am passing values and the container is running, and logs echoing setup. Also I can exec to run /app/podfetch
...is there a working shall accessible in the container? (/bin/bash, /bin/sh not working for me)
Beta Was this translation helpful? Give feedback.
All reactions