Query on multiple applications

[Brramble]

Hey - apologies if this is not a direct question to this plugin, but I do think it's valuable to know how it should be best handled:

I recently set up this plugin with pocket ID (thank you for your guide on this), I wanted to know how it's best to handle multiple site proxies. Is the consensus to add a wildcard callback and have all your sites under the middleware? For apps that require a limited user access, do we add another middleware with a new group, if that makes sense?

[viggy96]

If I'm understanding this question correctly, I believe I have the same one.

Right now I have many applications protected by the oidc-auth plugin that don't have suitable authentication of their own. And I've setup traefik as a OIDC client in Pocket ID. However, I want to be more granular with my user permissions with some of the applications. Some should be accessible to admins only, while others can be accessible to all users.

I'd really appreciate a concrete answer on how to do this.

[cdanis]

@viggy96 @Brramble I had the same issue in my homelab, and fixed it via internal headers + reusing another plugin: please see my comment on #131 for a detailed explanation

[viggy96]

@cdanis Will that have a great UX? I'd prefer that Pocket ID is able to turn away unauthorized users. So user tries to login to Pocket ID, they're just a regular user (not an admin) so Pocket ID shows it's "not authorized" screen.

Would your linked solution do this?

[cdanis]

You could use the built-in error middleware of Traefik to redirect them somewhere else on a 403.

Or I think it should work to have two instances of the OIDC plug-in with the same cookie secret and client secret, but different authorization policies. But I haven't tested that personally.

This is much easier for you to test out than it is to speculate or explain, so I encourage you to do that and then post your solution :) Just make a second account and use it in an incognito window.

[viggy96]

I just tried, and I think I've got a working solution. I just have a second instance of the plugin, with its own client id and secret. Its setup as its own OIDC client in Pocket ID. So I have both "Traefik" and "Traefik Administrator" in Pocket ID. "Traefik Administrator" only allows admins, and "Traefik" allows all users. And I linked each application to the appropriate middleware chain.

You can see at my config repo here: https://github.com/viggy96/container_config

Feel free to use it as an example.