add endpoint: use "Authorization"-header with HTML login page

[Simske]

Feature Request

Description

Currently there are two ways to login with headers:

• using Proxy-Authorization header with default endpoint /api/verify
• using Authorization header with endpoint /api/verify?auth=basic.
  But this sends WWW-authenticate when the login header is missing, triggering the basic auth login dialog.

I suggest a third endpoint (e.g. /api/verify?auth=both), which checks both for the Proxy-Authorization and Authorization header, and forwards to the HTML login page if none is found.

This is achievable with minimal code change, see PR #2754.

Use Case

Some apps need to be accessed by both human users (who want the HTML login page), and programs which have native support for basic authentication.

In some reverse proxies this is not needed (e.g. nginx with proxy_set_header Proxy-Authorization $http_authorization;), but some (e.g. Traefik) don't support renaming a header.

[clems4ever]

What is the application causing you troubles which is using Proxy-Authorization with no option to use Authorization instead?

[Simske]

What is the application causing you troubles which is using Proxy-Authorization with no option to use Authorization instead?

I have a few services which rely on Authorization. It would be possible to switch them, but it seemed more convenient to do this server-side, which was quite easy with Nginx as the proxy. While switching to Traefik I didn't find a built-in way to do this on the reverse proxy (while it is possible to change some headers, renaming a header is not possible without plugins).

BUT: I found an easy workaround to this problem:
Assuming there are both a normal and a basic auth middleware defined:

- traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://login.example.com/
- traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true
- traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User, Remote-Groups, Remote-Name, Remote-Email
- traefik.http.middlewares.authelia-basic.forwardauth.address=http://authelia:9091/api/verify?auth=basic
- traefik.http.middlewares.authelia-basic.forwardauth.trustForwardHeader=true
- traefik.http.middlewares.authelia-basic.forwardauth.authResponseHeaders=Remote-User, Remote-Groups, Remote-Name, Remote-Email

On the endpoint which needs to use the "Authorization"-header without the basic-auth login prompt, two routers need to be set:

labels:
  - traefik.http.routers.service.rule=Host(`service.example.com`)
  - traefik.http.routers.service.middleware=authelia@docker
  - traefik.http.routers.service_basic.rule=Host(`service.example.com`) && HeadersRegexp(`Authorization`, `Basic .*`)
  - traefik.http.routers.service_basic.middleware=authelia-basic@docker

If a Autorization-header is present in a request, the service_basic-router will be used and the authentification will be performed by the basic-auth endpoint, while any request without it will use the normal Authelia endpoint.

Should I open a PR to add this to the docs? My request for the extra endpoint seems obsolete now.

[james-d-elliott]

This will probably be implemented by PR4296