Authentik automatic login support (#4600) * feat: authentik auto login * refactor: move SSO login configuration under sso section in config * Migrate SSO config keys read --------- Co-authored-by: Cohee <18619528+Cohee1207@users.noreply.github.com>

e68f9e482e2fab8eeea3b5b7372fca2d6c75da98

Jakub Jędrzejczyk <aegiruchan@gmail.com>

Signed

default/config.yaml+16 -4 Viewed

 enableUserAccounts: false
 # Enable discreet login mode: hides user list on the login screen
 enableDiscreetLogin: false
 +# If `basicAuthMode` and this are enabled then
 +# the username and passwords for basic auth are the same as those
 +# for the individual accounts
 +perUserBasicAuth: false
++
 +# -- SSO LOGIN CONFIGURATION --
 +sso:
   # Enable's authlia based auto login. Only enable this if you
   # have setup and installed Authelia as a middle-ware on your
   # reverse proxy

   # as that used for authlia. (Ensure the username in authlia
   # is an exact match in lowercase with that in sillytavern)
   autheliaAuth: false
 -# If `basicAuthMode` and this are enabled then
 +  # Enable's authentik based auto login. Only enable this if you
 -# the username and passwords for basic auth are the same as those
 +  # have setup and installed Authentik as a middle-ware on your
 -# for the individual accounts
 +  # reverse proxy.
 -perUserBasicAuth: false
 +  # https://goauthentik.io/
 +  # This will use auto login to an account with the same username
 +  # as that used for authentik. (Ensure the username in authentik
 +  # is an exact match in lowercase with that in sillytavern).
 +  authentikAuth: false
++
 # Host whitelist configuration. Recommended if you're using a listen mode
 hostWhitelist:
   # Enable or disable host whitelisting

src/config-init.js+10 -0 Viewed

         migrate: () => void 0,
         remove: true,
     },
 +    {
 +        oldKey: 'autheliaAuth',
 +        newKey: 'sso.autheliaAuth',
 +        migrate: (value) => value,
 +    },
 +    {
 +        oldKey: 'authentikAuth',
 +        newKey: 'sso.authentikAuth',
 +        migrate: (value) => value,
 +    },
 ];
 /**

src/users.js+29 -3 Viewed

 export const KEY_PREFIX = 'user:';
 const AVATAR_PREFIX = 'avatar:';
 const ENABLE_ACCOUNTS = getConfigValue('enableUserAccounts', false, 'boolean');
 const AUTHELIA_AUTH = getConfigValue('sso.autheliaAuth', false, 'boolean');
 +const AUTHENTIK_AUTH = getConfigValue('sso.authentikAuth', false, 'boolean');
 const PER_USER_BASIC_AUTH = getConfigValue('perUserBasicAuth', false, 'boolean');
 const ANON_CSRF_SECRET = crypto.randomBytes(64).toString('base64');

@@ -716,6 +717,10 @@ export async function tryAutoLogin(request, basicAuthMode) {
716	717	return true;
717	718	}
718	719
	720	+ if (AUTHENTIK_AUTH && await authentikUserLogin(request)) {
	721	+ return true;
	722	+ }
	723	+
719	724	if (basicAuthMode && PER_USER_BASIC_AUTH && await basicUserLogin(request)) {
720	725	return true;
721	726	}

+}
 /**
  * TriesAttempts auto-login withusing authliaan trustedAuthelia headersheader.
  * https://www.authelia.com/integration/trusted-header-sso/introduction/
  * @param {import('express').Request} request Request object
  * @returns {Promise<boolean>} Whether auto-login was performed
  */
 async function autheliaUserLogin(request) {
 +    return headerUserLogin(request, 'Remote-User');
 +}
++
 +/**
 + * Attempts auto-login using an Authentik header.
 + * https://docs.goauthentik.io/add-secure-apps/providers/proxy/forward_auth/
 + * @param {import('express').Request} request Request object
 + * @returns {Promise<boolean>} Whether auto-login was performed
 + */
 +async function authentikUserLogin(request) {
 +    return headerUserLogin(request, 'X-Authentik-Username');
 +}
++
 +/**
 + * Tries auto-login with a given header.
 + * @param {import('express').Request} request Request object
 + * @param {string} [header='Remote-User'] The header to use for the trusted user
 + * @returns {Promise<boolean>} Whether auto-login was performed
 + */
 +async function headerUserLogin(request, header = 'Remote-User') {
     if (!request.session) {
         return false;
+    }
     const remoteUser = request.get('Remote-User'header);
     if (!remoteUser) {
         return false;
+    }
 +    console.debug(`Attempting auto-login for user from header ${header}: ${remoteUser}`);
     const userHandles = await getAllUserHandles();
     for (const userHandle of userHandles) {