User Management - GUI/CLI

[Crowley723]

It should be possible to create a register user workflow that would allow new users to create a user request which could then be accepted by a designated administrator.

I know that there are a host of features that are tied to the admin management interface which requires quite a few major backend changes. While currently there isn't a management interface, for the sake of usability, it should be possible to only show the menu option in user settings to users with the authelia-admin group.

While this doesn't align with the desire to make the admin interface hidden so that even if an admin account was compromised they wouldn't know they were an admin with access to the UI, it should be a fairly easy change to move the "user management" settings tab to the management UI.

I think it should be configurable to:

• Enable/Disable User Management
• Automatically Accept New Users or require approval from an admin
• Require admin-created users to change their password upon the first login.

From the "User management":

• Create users and manage existing users
• Force users to logout (may require the session rework)
• Require users to change their password, would log users out and require login. (may require the session rework)
• Edit a users groups, username, emails.
• Delete users
• Disable users

[jordigh]

This is something that has puzzled me about Authelia. It has all of this beautiful and complex handling around MFA and crypto and protocols and security... but the only way to add/edit/remove users is to edit a static yaml file where you manually stick in hashes of passwords?

[hendrik1120]

Authelia also supports a wide range of LDAP implementations, which you might have missed.

[jordigh]

Right, I've seen that.

Is Authelia self-managing users unloved or discouraged? Not the intended way? What is it for?

[Crowley723]

We are in no way against allowing administrators to manage users in a nice interface or via a command line. There are features that have higher priority (like passkeys) that take precedence.

We also want to make sure we do it right. There are a lot of things that need to be done from scratch because managing multiple users wasn't an issue that was built for previously.

It's being worked on, and hopefully, it will be part of v4.40.0. Unfortunately, we don't have an eta for that.

[Crowley723]

Relevant PR: PR#7925

[benyaminl]

I just want to ask, does the user management and registration including ability for front facing registration page, eg commerce registration page with email validation?

Or we need to implement it ourself?

Does Authelia also supporting multi tenant or it's not possible, eg. email@sample.com in tenant A, email@sample.com in tenant B, counted as different user?

Thank you

[Crowley723]

Thanks for expressing interest.

Currently the work being done is more focused on admin controls. So when this feature is released, it won't contain any logic for allowing users to register themselves. This feature will have an API that could be used for automating user creation, but that will likely be subject to change while we decide on how we want to go about versioning the API endpoints.

While we support multiple protected domains, there is no multi-tenant aspect. One user-one account, able to access multiple domains depending on the access control rules you have defined.

I can't say that we won't support registration in the future.

[alexander-potemkin]

I can see that once Authelia update the password, it adds a lot of the fields in the file, which makes me think that Authelia 'knows' what shall be in that file and it 'knows' the structure. If that is correct, it feels like it shall not be too complicated to dedicate some API to use / call that part of the code to create new user (for those, who don't want to have another moving part, called 'ldap')?

Or am I missing something?

[alexander-potemkin]

Thank you for sharing! Is there any rough estimations - when it could happen? Like Q4 2030? :)

[Crowley723]

We don't generally give any ETA for features.

[alexander-potemkin]

Got it, thanks. Makes sense. Any ticket / anything to follow this up?

[Crowley723]

Any updates will be made either here in this discussion or in the pull request mentioned earlier in the discussion.

[alexander-potemkin]

Subscribed, and thanks! And, I believe I didn't mentioned that - for a wonderful product as well!