Auth and SSO

[iBicha]

I don't have a particular system/app in mind, but since tipi is an opinionated system, I wonder if it makes sense to find a Single Sign On (SSO) system that manages login for all these apps.
Managing passwords for all of these is not particularly fun.
Looking around, https://goauthentik.io/ might be a good candidate, but personally I haven't looked at auth solutions for self-hosted before, so there might be better opinions

[meienberger]

Hello, thanks for your suggestion! This has been discussed and is definitely something we need and that is planned. It all comes down to the time I can commit and the backlogs size.
I previously looked int Authelia (which works well with traefik) but authentik looks indeed like a great candidate also

[DrMxrcy]

If something like this was added, should we prioritize apps to use the SSO feature if it is accepted. Not every app has an OIDC or SAML, but the ones that do, we could maybe have a toggle to choose an SSO login or a local login.

[sclaren]

If something like this was added, should we prioritize apps to use the SSO feature if it is accepted. Not every app has an OIDC or SAML, but the ones that do, we could maybe have a toggle to choose an SSO login or a local login.

This sounds like a great idea :).

[jaffo73]

I currently use Authelia with DUO Push and it is fantastic with Traefik. Simply put a dynamic rule which contains the middlewares for authelia, following as an example and its automatically protected with the already setup authelia.

http: routers: notes-rtr: rule: "Host(notes.{{env "DOMAINNAME"}})" entryPoints: - https middlewares: - chain-authelia service: notes-svc tls: certResolver: dns-cloudflare options: tls-opts@file services: notes-svc: loadBalancer: passHostHeader: true serversTransport: "notes" servers: - url: "http://192.168.1.163:8080" serversTransports: notes: insecureSkipVerify: true

[AAGaming00]

I run Authentik and it works great for everything I've tried it with. Super easy to hook up OpenID Connect/OAuth 2 and it also has support for authenticating via reverse proxies.

[falkheiland]

i added OAUTH2 to wekan, freshrss, immich, linkwarden used with authentik and have user-configs here:

https://github.com/falkheiland/user-config

Not every app has an OIDC or SAML, but the ones that do, we could maybe have a toggle to choose an SSO login or a local login

maybe it makes sense to have a special user documentation added for people who want to configure sso/oauth2