Caddy-Security and Multiple OIDC

[TreatnHerRight]

Im having trouble getting a working multi OIDC Client Caddyfile working. To work around this, I have two instances of Pocket ID and two instances of Caddy. This is working as I wanted, but I feel this is a workaround. I would like to combine this all into one instance.

My Caddyfile is below. How can I incorporate another OIDC Client on this file? Are there any examples?

I want to have two OIDC clients so i can manage the users for each.

{
	# Port to listen on
	https_port 443

	# Configure caddy-security.
	debug # makes Caddy logs more detailed (optional)
	order crowdsec first # forces the CrowdSec directive to be executed first
	order authenticate before respond
	security {
		oauth identity provider generic {
			delay_start 3
			realm generic
			driver generic
			client_id ABCDEFGHIJKLMNOPQRSTUVWQYZ # Replace with your own client ID
			client_secret ABCDEFGHIJKLMNOPQRSTUVWQYZ # Replace with your own client secret
			scopes openid email profile
			base_auth_url https://login.example.net/authorize
			metadata_url https://login.example.net/.well-known/openid-configuration
		}

		authentication portal myportal {
			crypto default token lifetime 86400 # Seconds until you have to re-authenticate
			enable identity provider generic
			cookie insecure off # Set to "on" if you're not using HTTPS

			transform user {
				match realm generic
				action add role user
			}
		}

		authorization policy mypolicy {
			set auth url /caddy-security/oauth2/generic
			allow roles user
			inject headers with claims
		}
	}
	crowdsec {
		api_url http://1.1.1.1:9090 # it should point to your CrowdSec API (it can be a remote URL)
		api_key ABCDEFGHIJKLMNOPQRSTUVWQYZ
	}
}

import example-net/*

import example2-com/*

[kmendell]

@TreatnHerRight I may be confused, but are you referring to have multiple caddy-security portals and auth policies? The way i have done this is just to setup a separate portal/policy and provider for each service that want to be seperate.

[TreatnHerRight]

Ill do my best to explain.

So im assuming I will need multiple of the following section in my Caddyfile:

oauth identity provider generic {
			delay_start 3
			realm generic
			driver generic
			client_id ABCDEFGHIJKLMNOPQRSTUVWQYZ # Replace with your own client ID
			client_secret ABCDEFGHIJKLMNOPQRSTUVWQYZ # Replace with your own client secret
			scopes openid email profile
			base_auth_url https://login.example.net/authorize
			metadata_url https://login.example.net/.well-known/openid-configuration
		}

This is my train of thought
On my Manage OIDC Clients page I currently have two OIDC Clients. One for admins and One for users.

Since they both have their own Client IDs and Client Secret i assumed I need a way to add multiple of that oauth section shown above.

Is there a better way to do this? Does this make more sense.

Thanks a lot!

[kmendell]

Yes correct, you'll have to define each provider, policy, and portal for each one, as far as i know. However since we don't maintain caddy-security that maybe a better question suited for that team.

[TreatnHerRight]

Yes correct, you'll have to define each provider, policy, and portal for each one, as far as i know. However since we don't maintain caddy-security that maybe a better question suited for that team.

Ill reach out to them and see what I can find out!

[TreatnHerRight]

@kmendell

After a bit of testing here is what I got working for me. I just posted this on reddit as well: https://www.reddit.com/r/selfhosted/comments/1jdq5xn/caddy_security_pocket_id_multiple_oidc_clients_my/

{
    https_port 443
    debug
    order crowdsec first
    order authenticate before respond
    order authorize before basicauth

    security {
        oauth identity provider private {
            realm private
            driver generic
            client_id client-id-from-pocket-id-private # Replace with your *PRIVATE* client ID
            client_secret client-secret-from-pocket-id-private # Replace with your *PRIVATE* secret
            scopes openid email profile
            base_auth_url [https://login.example.net/authorize](https://login.example.net/authorize) # Your Pocket ID base auth URL
            metadata_url [https://login.example.net/.well-known/openid-configuration](https://login.example.net/.well-known/openid-configuration) # Your Pocket ID metadata URL
        }
        oauth identity provider public {
            realm public
            driver generic
            client_id client-id-from-pocket-id-public # Replace with your *PUBLIC* client ID
            client_secret client-secret-from-pocket-id-public # Replace with your *PUBLIC* secret
            scopes openid email profile
            base_auth_url [https://login.example.net/authorize](https://login.example.net/authorize)  # Your Pocket ID base auth URL (likely the same)
            metadata_url [https://login.example.net/.well-known/openid-configuration](https://login.example.net/.well-known/openid-configuration) # Your Pocket ID metadata URL (likely the same)
        }
        authentication portal authportal {
            crypto default token lifetime 86400
            enable identity provider private
            enable identity provider public
            transform user {
                match realm private
                action add role private/user
            }
            transform user {
                match realm public
                action add role public/user
            }
        }
        authorization policy private_access {
            set auth url /caddy-security/oauth2/private
            allow roles private/user
            # IMPORTANT:  Deny all other roles to prevent bypass
            deny
        }
        authorization policy public_access {
            set auth url /caddy-security/oauth2/public
            allow roles public/user
            # IMPORTANT: Deny all other roles to prevent bypass
            deny
        }
    }
    crowdsec {
        api_url http://Enter.Your.IP.Address:Port  # Replace with your CrowdSec API URL
        api_key Enter-your-api-key   # Replace with your CrowdSec API key
    }
}

info.example.net {
    crowdsec
    @mygeofilter {
      maxmind_geolocation {
        db_path "/srv/GeoLite2-Country.mmdb" # Path to your GeoLite2 database
        allow_countries US
      }
    }
    @auth {
        path /caddy-security/*
    }

    route @auth {
        authenticate with authportal
    }

    route /* {
        authorize with private_access
        handle @mygeofilter {
            reverse_proxy 127.0.0.1:3011 # Example reverse proxy
        }
    }
}

example.com {
    crowdsec
    @mygeofilter {
      maxmind_geolocation {
        db_path "/srv/GeoLite2-Country.mmdb" # Path to your GeoLite2 database
        allow_countries US
      }
    }
    @auth {
        path /caddy-security/*
    }

    route @auth {
        authenticate with authportal
    }

    route /* {
        authorize with public_access
        respond "Hello world!" 200 # Example public response
        #reverse_proxy 127.0.0.1:7990
    }
}

[kmendell]

yeah that works, i just like each of my clients to have a icon and unique name which is why i did it the bloated way :D

[TreatnHerRight]

Could that be a possibility via PocketID setting in the future, each specific link, setting an icon? Is that possible?

[kmendell]

Its possible , you just have to create separate auth portals, and policies in caddy :)