Authentik automatic login support (#4600) * feat: authentik auto login * refactor: move SSO login configuration under sso section in config * Migrate SSO config keys read --------- Co-authored-by: Cohee <18619528+Cohee1207@users.noreply.github.com>

e68f9e482e2fab8eeea3b5b7372fca2d6c75da98

Jakub Jędrzejczyk <aegiruchan@gmail.com>

Signed

Parents: d56c649d8690e4a52767e8386d64b6948270427e

default/config.yaml+16 -4 Viewed

 enableUserAccounts: false
 # Enable discreet login mode: hides user list on the login screen
 enableDiscreetLogin: false
+# If `basicAuthMode` and this are enabled then
+# the username and passwords for basic auth are the same as those
+# for the individual accounts
+perUserBasicAuth: false
+# -- SSO LOGIN CONFIGURATION --
+sso:
   # Enable's authlia based auto login. Only enable this if you
   # have setup and installed Authelia as a middle-ware on your
   # reverse proxy

   # as that used for authlia. (Ensure the username in authlia
   # is an exact match in lowercase with that in sillytavern)
   autheliaAuth: false
-# If `basicAuthMode` and this are enabled then
+  # Enable's authentik based auto login. Only enable this if you
-# the username and passwords for basic auth are the same as those
+  # have setup and installed Authentik as a middle-ware on your
-# for the individual accounts
+  # reverse proxy.
-perUserBasicAuth: false
+  # https://goauthentik.io/
+  # This will use auto login to an account with the same username
+  # as that used for authentik. (Ensure the username in authentik
+  # is an exact match in lowercase with that in sillytavern).
+  authentikAuth: false
 # Host whitelist configuration. Recommended if you're using a listen mode
 hostWhitelist:
   # Enable or disable host whitelisting

src/config-init.js+10 -0 Viewed

         migrate: () => void 0,
         remove: true,
     },
+    {
+        oldKey: 'autheliaAuth',
+        newKey: 'sso.autheliaAuth',
+        migrate: (value) => value,
+    },
+    {
+        oldKey: 'authentikAuth',
+        newKey: 'sso.authentikAuth',
+        migrate: (value) => value,
+    },
 ];
 /**

src/users.js+29 -3 Viewed

 export const KEY_PREFIX = 'user:';
 const AVATAR_PREFIX = 'avatar:';
 const ENABLE_ACCOUNTS = getConfigValue('enableUserAccounts', false, 'boolean');
-const AUTHELIA_AUTH = getConfigValue('autheliaAuth', false, 'boolean');
+const AUTHELIA_AUTH = getConfigValue('sso.autheliaAuth', false, 'boolean');
+const AUTHENTIK_AUTH = getConfigValue('sso.authentikAuth', false, 'boolean');
 const PER_USER_BASIC_AUTH = getConfigValue('perUserBasicAuth', false, 'boolean');
 const ANON_CSRF_SECRET = crypto.randomBytes(64).toString('base64');

@@ -716,6 +717,10 @@ export async function tryAutoLogin(request, basicAuthMode) {
716	return true;	717	return true;
717	}	718	}
718		719
		720	if (AUTHENTIK_AUTH && await authentikUserLogin(request)) {
		721	return true;
		722	}
		723
719	if (basicAuthMode && PER_USER_BASIC_AUTH && await basicUserLogin(request)) {	724	if (basicAuthMode && PER_USER_BASIC_AUTH && await basicUserLogin(request)) {
720	return true;	725	return true;
721	}	726	}

+}
 /**
- * Tries auto-login with authlia trusted headers.
+ * Attempts auto-login using an Authelia header.
  * https://www.authelia.com/integration/trusted-header-sso/introduction/
  * @param {import('express').Request} request Request object
  * @returns {Promise<boolean>} Whether auto-login was performed
  */
 async function autheliaUserLogin(request) {
+    return headerUserLogin(request, 'Remote-User');
+}
+/**
+ * Attempts auto-login using an Authentik header.
+ * https://docs.goauthentik.io/add-secure-apps/providers/proxy/forward_auth/
+ * @param {import('express').Request} request Request object
+ * @returns {Promise<boolean>} Whether auto-login was performed
+ */
+async function authentikUserLogin(request) {
+    return headerUserLogin(request, 'X-Authentik-Username');
+}
+/**
+ * Tries auto-login with a given header.
+ * @param {import('express').Request} request Request object
+ * @param {string} [header='Remote-User'] The header to use for the trusted user
+ * @returns {Promise<boolean>} Whether auto-login was performed
+ */
+async function headerUserLogin(request, header = 'Remote-User') {
     if (!request.session) {
         return false;
+    }
-    const remoteUser = request.get('Remote-User');
+    const remoteUser = request.get(header);
     if (!remoteUser) {
         return false;
+    }
+    console.debug(`Attempting auto-login for user from header ${header}: ${remoteUser}`);
     const userHandles = await getAllUserHandles();
     for (const userHandle of userHandles) {