feat: support for forwardAuth - #580
Conversation
557af26 to
c9efbb9
Compare
|
This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged. |
ef325ba to
b4143ef
Compare
github-actions
Bot
removed
the
merge conflict
b4143ef to
386293c
Compare
386293c to
01665c4
Compare
gauthier-th
left a comment
gauthier-th
left a comment
There was a problem hiding this comment.
Could you please add a bit of documentation for this?
|
|
||
| This works by passing the authenticated user e-mail in `X-Forwarded-User` header by the auth server, therefore enabling single-sign-on (SSO) login. | ||
|
|
||
| > The user has to exist, it will not be created automatically. |
There was a problem hiding this comment.
Probably better to use a warning instead of a citation.
| > The user has to exist, it will not be created automatically. | |
| :::warning | |
| The user has to exist, it will not be created automatically. | |
| ::: |
| if (user) { | ||
| req.user = user; | ||
| } | ||
|
|
||
| req.locale = user?.settings?.locale | ||
| ? user.settings.locale | ||
| : settings.main.locale; |
There was a problem hiding this comment.
This is not necessary, it's a duplicate from below.
| enableForwardAuth: | ||
| type: boolean | ||
| example: true |
There was a problem hiding this comment.
You wrote the setting here, but it is not available anywhere.
You should add this as a general setting, by adding a new properties in the MainSettings type in server/lib/settings.ts and adding a new input in the settings page in src/components/Settings/SettingsMain/index.tsx. You should also check that this setting is enabled before allowing login with forwardAuth.
Or did you intend to not make a setting and set it enabled by default?
| security: | ||
| - cookieAuth: [] | ||
| - apiKey: [] | ||
| - forwardAuth: [] |
There was a problem hiding this comment.
This is not in the OpenAPI spec?
https://spec.openapis.org/oas/latest.html#security-scheme-object-0
| import type { GetServerSidePropsContext, PreviewData } from 'next/types'; | ||
| import type { ParsedUrlQuery } from 'querystring'; | ||
|
|
||
| export const getRequestHeaders = ( |
There was a problem hiding this comment.
Shouldn't this function be called something like getAuthHeaders instead of getRequestHeaders?
There was a problem hiding this comment.
Wdyt about renaming this file to something like serverSidePropsHelpers?
|
This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged. |
|
LMK if any help is needed here, would love to get this through! |
|
@hiasr @gauthier-th, feel free to make the necessary changes. I made them when I had some free time but that is currently not the case. |
|
Closed in favor of #1341 |
3 participants
Description
Add support for forwardAuth available with nginx, caddy, traefik, etc. which allows use of SSO without exposing any jellyseerr services to unauthenticated users.
Inspired by similar PR in overseer but slightly simplified, requiring existing user to authenticate.
To-Dos
yarn buildFixes