feat(session): multiple cookie domains #3754

mind-ar · 2022-07-27T00:48:01Z

This PR replaces #3744 and implements support for multiple domains

Configuration will looks like:

session:
  domain: example.com
  expiration: 3600
  inactivity: 300
  remember_me_duration: 1y
  portal_url: https://login.example.com
  domains:
    - domain: "example2.com"
      portal_url: https://login.example2.com
      expiration: 3600
      inactivity: 300
      remember_me_duration: 1y
    - domain: example3.com
      portal_url: https://example3.com/auth

Expected features

Support for Multiple root domains

Task List:

authelia · 2022-07-27T00:48:05Z

Artifacts

These changes are published for testing on Buildkite, DockerHub and GitHub Container Registry.

Docker Container

docker pull authelia/authelia:feat-multi-root-domain-2
docker pull ghcr.io/authelia/authelia:feat-multi-root-domain-2

internal/configuration/validator/session_test.go

codecov · 2022-07-28T02:25:09Z

Codecov Report

Merging #3754 (f4079d0) into master (ad1a804) will decrease coverage by 0.04%.
The diff coverage is 73.75%.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3754      +/-   ##
==========================================
- Coverage   67.19%   67.15%   -0.05%     
==========================================
  Files         266      267       +1     
  Lines       19505    19727     +222     
  Branches      429      429              
==========================================
+ Hits        13106    13247     +141     
- Misses       5639     5704      +65     
- Partials      760      776      +16

Flag	Coverage Δ
backend	`67.50% <73.75%> (-0.07%)`	⬇️
frontend	`62.74% <ø> (+0.09%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
internal/handlers/handler_sign_totp.go	`39.13% <0.00%> (ø)`
internal/handlers/handler_sign_webauthn.go	`0.00% <0.00%> (ø)`
internal/notification/smtp_notifier.go	`53.98% <ø> (-0.81%)`	⬇️
internal/handlers/handler_firstfactor.go	`60.00% <21.05%> (-7.28%)`	⬇️
internal/handlers/handler_verify.go	`74.27% <50.00%> (-2.53%)`	⬇️
internal/utils/strings.go	`94.30% <50.00%> (-1.75%)`	⬇️
internal/middlewares/authelia_context.go	`75.86% <58.49%> (-4.06%)`	⬇️
internal/session/session.go	`58.82% <58.82%> (ø)`
internal/session/provider.go	`64.70% <60.86%> (+3.16%)`	⬆️
internal/utils/url.go	`92.30% <62.50%> (-7.70%)`	⬇️
... and 19 more

netlify · 2022-07-31T02:17:25Z

✅ Deploy Preview for authelia-staging ready!

Name	Link
🔨 Latest commit	`d4ae073`
🔍 Latest deploy log	https://app.netlify.com/sites/authelia-staging/deploys/63bd1f8483833d0009f891d3
😎 Deploy Preview	https://deploy-preview-3754--authelia-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

…ain-2 # Conflicts: # internal/session/encrypting_serializer.go # internal/session/provider_config_test.go

…a/authelia into feat-multi-root-domain-2

james-d-elliott

LGTM

Leopere · 2023-01-14T15:30:06Z

I'm not sure I know the release cycle of Authelia will this be in the docker images any time soon now that its done?

james-d-elliott · 2023-01-14T20:49:36Z

It's part of the master image already, I've got a few more things I'd like to finish for 4.38, I'd suspect we'll be ready to release next weekend however. #4296 is going to add some sweet functionality to this as well with authelia portal URL detection by matching the cookie domain to an optional configuration option when using the new endpoints so you only need a single middleware for traefik, or single snippet for caddy, envoy, etc. Only proxies not receiving this benefit due to technical limitations on their end are NGINX and HAProxy.

Leopere · 2023-01-15T20:25:24Z

I am absolutely elated that this is about to exist you have no idea. I have a multi-tennancy cloud deployment that has both staging and production nodes within it and I want to Authelia-off a number of things.

ColinHebert · 2023-01-16T15:09:49Z

Hihi quick piece of feedback, the release cycle of the documentation is slightly out of sync with the latest version, which means that the current version of the documentation doesn't quite work in reality.
I've been banging my head against the wall because session.domain is "deprecated" but the latest version of authelia wouldn't let me set it up without session.domain being defined.

Additionally, it introduces a new environment variable (which is auto-documented) AUTHELIA_SESSION_COOKIES which I now gather isn't quite meant to be used.
If I understand correctly, the Environment page should be updated to mention that:

It is not possible to configure the session cookies, the access control rules section , or OpenID Connect identity provider clients section using environment variables at this time.

james-d-elliott · 2023-01-16T20:40:38Z

Hihi quick piece of feedback, the release cycle of the documentation is slightly out of sync with the latest version, which means that the current version of the documentation doesn't quite work in reality.
I've been banging my head against the wall because session.domain is "deprecated" but the latest version of authelia wouldn't let me set it up without session.domain being defined.

Yeah this is unfortunately occasionally the case with the docs. With bigger features we either have to do some inhuman juggling with pull requests, get versioned documentation working which is also pretty difficult to do right (you don't want docs only changes being excluded from updating the current docs, but also don't want the ones which only affect new features to affect old, etc), or we do it as we do now where as features are merged the docs are updated.

The likely future for this is versioned docs. However this project is entirely supported by the free time of individuals and provided completely free of charge, corporate interests, etc.

Additionally, it introduces a new environment variable (which is auto-documented) AUTHELIA_SESSION_COOKIES which I now gather isn't quite meant to be used.

Yeah the generators seem to include the key names of lists, we welcome a PR to fix this.

If I understand correctly, the Environment page should be updated to mention that:

It is not possible to configure the session cookies, the access control rules section , or OpenID Connect identity provider clients section using environment variables at this time.

Correct, feel free to make a PR.

These matters can be further discussed in an appropriate setting such as the PR in question, or the GitHub Discussions.

james-d-elliott · 2023-01-17T03:33:11Z

I've also reverted the docs for now.

gpnunes75 · 2024-05-02T16:31:37Z

my Authelia is showing this message:
"level=warning msg="Configuration: session: option 'domain' is deprecated in v4.38.0 and has been replaced by a multi-domain configuration: this has automatically been mapped for you but you will need to adjust your configuration to remove this message and receive the latest messages"

if it automatically mapped to me, it should show me this mapped.

I couldn't find any documentation about what I need to change. Can you help me and point a a multi-domain documentation ?

mind-ar added 6 commits July 25, 2022 19:30

feat(configuration): add slice of domains

5c3e216

fix(configuration): fix invalid domain name

8a97d97

feat(suites): add dynamic domain on example html

fc2b129

test: fix session tests

c31d954

feat(session): add validations

68530eb

Merge branch 'master' into feat-multi-root-domain-2

3c0a3ec

mind-ar mentioned this pull request Jul 27, 2022

feat(session): support for multiple root domain #3744

Closed

15 tasks

mind-ar self-assigned this Jul 27, 2022

refactor: change in configuration

c24ef21

mind-ar marked this pull request as draft July 27, 2022 01:27

mind-ar added 2 commits July 27, 2022 01:56

feat(configuration): add validations for multiple session domains

5f5e395

test: fix test

bf5c47d

autheliabot reviewed Jul 27, 2022

View reviewed changes

internal/configuration/validator/session_test.go Show resolved Hide resolved

mind-ar added 7 commits July 27, 2022 02:17

test: fix test

a99a47e

test: add tests for multipe domains in session

8080498

Merge branch 'master' into feat-multi-root-domain-2

7b69925

fix(suites): fix nginx config for multi-domain

d5b674e

test: fix cli suite test

af494eb

test: add more time to highavailability test

fcf9423

fix(suites): fix nginx configuration

d7d12df

mind-ar added 3 commits July 30, 2022 23:40

feat(handlers): validate multiple protected domains

764b66d

test: update existing tests

31a3161

feat(handlers): enable redirection to portal url

4671d28

mind-ar added 4 commits July 30, 2022 23:19

Merge branch 'master' into feat-multi-root-domain-2

62dde0b

refactor(handlers): revert portal_url redirection

fb7ea44

feat(suites): add example2.com to nginx

1648db9

Merge branch 'master' into feat-multi-root-domain-2

46813ec

james-d-elliott and others added 19 commits January 10, 2023 10:00

Merge remote-tracking branch 'origin/master' into feat-multi-root-dom…

5493d21

…ain-2 # Conflicts: # internal/session/encrypting_serializer.go # internal/session/provider_config_test.go

refactor(handlers): remove debug logging

0365e43

refactor(suites): consolidate nginx backend configuration

e999ccb

test: add acls

6735372

refactor(suites): re-add missing whitespace

e930147

refactor(session): require -> assert

a1d2282

refactor(web): gitignore ordering

e79312f

refactor(configuration): refactor of session domain validator

e09a6a0

Merge branch 'feat-multi-root-domain-2' of https://github.com/autheli…

2cb9842

…a/authelia into feat-multi-root-domain-2

Merge branch 'master' into feat-multi-root-domain-2

8d6222b

docs: update docs

c20d85f

docs: update docs

fe63102

fix: remember me mapping

7755922

docs: gen

05e86fc

Merge branch 'master' into feat-multi-root-domain-2

cdc2cc0

refactor: remove disable_remember_me

d4ae073

Merge branch 'master' into feat-multi-root-domain-2

a444a48

refactor: portal_url to authelia_url

5d89c79

Merge branch 'master' into feat-multi-root-domain-2

f4079d0

james-d-elliott approved these changes Jan 12, 2023

View reviewed changes

james-d-elliott merged commit 8b29cf7 into master Jan 12, 2023

james-d-elliott deleted the feat-multi-root-domain-2 branch January 12, 2023 10:57

james-d-elliott added the area/session Session related features/bugs label Aug 20, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(session): multiple cookie domains #3754

feat(session): multiple cookie domains #3754

mind-ar commented Jul 27, 2022 •

edited

authelia bot commented Jul 27, 2022

codecov bot commented Jul 28, 2022 •

edited

netlify bot commented Jul 31, 2022 •

edited

james-d-elliott left a comment

Leopere commented Jan 14, 2023

james-d-elliott commented Jan 14, 2023 •

edited

Leopere commented Jan 15, 2023

ColinHebert commented Jan 16, 2023 •

edited

james-d-elliott commented Jan 16, 2023 •

edited

james-d-elliott commented Jan 17, 2023

gpnunes75 commented May 2, 2024 •

edited

feat(session): multiple cookie domains #3754

feat(session): multiple cookie domains #3754

Conversation

mind-ar commented Jul 27, 2022 • edited

Expected features

Task List:

authelia bot commented Jul 27, 2022

Artifacts

Docker Container

codecov bot commented Jul 28, 2022 • edited

Codecov Report

netlify bot commented Jul 31, 2022 • edited

✅ Deploy Preview for authelia-staging ready!

james-d-elliott left a comment

Choose a reason for hiding this comment

Leopere commented Jan 14, 2023

james-d-elliott commented Jan 14, 2023 • edited

Leopere commented Jan 15, 2023

ColinHebert commented Jan 16, 2023 • edited

james-d-elliott commented Jan 16, 2023 • edited

james-d-elliott commented Jan 17, 2023

gpnunes75 commented May 2, 2024 • edited

mind-ar commented Jul 27, 2022 •

edited

codecov bot commented Jul 28, 2022 •

edited

netlify bot commented Jul 31, 2022 •

edited

james-d-elliott commented Jan 14, 2023 •

edited

ColinHebert commented Jan 16, 2023 •

edited

james-d-elliott commented Jan 16, 2023 •

edited

gpnunes75 commented May 2, 2024 •

edited