(Simple) SSO - what and how? reddit / selfhosted ---------------------------------------------------------------------- Lombravia · 2023-09-30 17:00 Hi, I've been meaning to get some kind of SSO setup going for a long time, but it's all very overwhelming. My primary goal is to reduce the number of credentials needed. My understanding of authentication is rudimentary. I don't know what OIDC or SAML is. (but maybe I don't need to) I'm looking for something simple. I think. I'm not sure what kind of functionality is available, but I just want to be able to create users in this central directory and connect applications to it. I understand Keycloak and Authentik are popular options that comes with batteries included, but also are rather resource heavy. I might have a different use case where resources is less of an issue, but I prefer to keep it lightweight for now. Notably, Authelia seems like a lightweight alternative, but also requires complementing with additional services. I'm willing to do some configuration, but only if it's "easy". I saw someone using it together with some LDAP service and an LDAP web interface. Not sure how far that gets me. I'm only looking to use applications with native support. (no proxy stuff) What do I actually look for in order to determine whether an application supports SSO? What kind of implementations are generally used? What might I need to add to Authelia, should I choose to use that? ---------------------------------------------------------------------- GolemancerVekk · 2023-09-30 17:39 Try the [Boruta](https://github.com/malach-it) or [Ory](https://github.com/ory) platforms. Boruta server is all-in-one, Ory has 4 separate components for Identity Management, Authorization, Proxying and Policies. [This Lemmy discussion](https://feddit.nl/post/3920913) may help you get started with LDAP. > I don't know what OIDC or SAML is. I guess at this point I should ask what exactly are you trying to accomplish. From the rest of your post it seems you're trying to "login everywhere with one account", with "everywhere" being all the services you're selfhosting, did I get that right? If so, please note that generally speaking each service usually implements its own user identity, authentication and authorization. Some of them may have support for delegating some or all of that to other services, which is called federated authentication. If they do then that's where a platform like Boruta, Ory, Authelia, Keycloak, Authentik etc. come into play. OIDC (Open ID Connect) is a standard for delegating login to another platform. Oauth2 is a mechanism for accomplishing that. LDAP is a user management backend. But if a service *doesn't* support delegating anything then the most you can do is proxying, which means using one of these platforms as an additional layer on top of that service, but it would also mean that users will log in twice (once to the outer layer and once to the service). The benefit in this case would be that you're wrapping a less secure service into a more secure platform, but users aren't gonna love it. You should read up on the differences between identification (defining who you are), authentication (proving who you are) and authorization (what you're allowed to do). Unfortunately there's going to be some conceptual complexity no matter which platform you use because it's a complex topic. ---------------------------------------------------------------------- nosyrbllewe · 2023-09-30 18:21 I personally wanted to do SSO myself, but I eventually gave up on it; too many services didn't support SSO which caused more problems for me. It ended up requiring many services to be wrapped in another layer of authentication, now requiring the user to login twice (once for SSO and another for the service's own authentication). Unfortunately, this also breaks any mobile applications for said services, which isn't worth the benefits of SSO. I recall there being a list somewhere on this subreddit of services that used SSO, but I can't remember where it is. Honestly, if you can get all of your services to support SSO without resorting to proxying then you are pretty lucky; most applications don't seem to support SSO from my experience. ---------------------------------------------------------------------- Lombravia · 2023-09-30 18:43 Thank you. This is helpful. > it seems you're trying to "login everywhere with one account", with "everywhere" being all the services you're selfhosting, did I get that right? Yes, exactly. Well, more like "wherever possible". I understand that not all applications will have support for this. Here are a couple of examples of application that I think supports what I'm looking for, though I have not necessarily seen the term "federated authentication" being used: - https://docs.gitea.com/usage/authentication - https://grafana.com/docs/grafana/latest/setup-grafana/configure- security/configure-authentication/ - https://docs.portainer.io/admin/settings/authentication I understand the concepts of authentication and authorization. I don't expect to manage authorization via the SSO platform. Except maybe whether they can log in at all? Not sure how all that works in practice. If it turns out I have fundamentally misunderstood these things, or maybe regardless, what do people (self hosters) use something like Keycloak or Authentik for? ---------------------------------------------------------------------- Lombravia · 2023-09-30 19:00 I will just leave the services that don't support SSO. If I can consolidate even three of my services into a single login (without spending too much time and resources on the SSO platform itself), that's still a win to me! ---------------------------------------------------------------------- SadMaverick · 2023-09-30 19:09 I personally use Keycloak (using Docker) which is connected to a backend postgres instance. It works for most services like Gitea, Grafana etc. which support OIDC. For services which don’t support delegating auth like *arr apps, I have to use [vouch proxy](https://github.com/vouch/vouch-proxy) along with Keycloak and my reverse proxy. What still is missing from this setup is LDAP based login, which can enable true SSO for all apps. ---------------------------------------------------------------------- GolemancerVekk · 2023-09-30 20:39 > If it turns out I have fundamentally misunderstood these things, or maybe regardless, what do people (self hosters) use something like Keycloak or Authentik for? You got it right, they're used for SSO for services that support it. Between Oauth and LDAP you can probably cover a healthy amount of services. You can also use them to apply that extra layer I mentioned over services that have no security (whether by default or because you disabled it and prefer the extra layer). You can protect for example web pages that show system status or resources etc. You can also set up your own OIDC server for public services that require one. Tailscale for example doesn't do any user management themselves, they require you to use an OIDC service; you can use one provided by Google, Microsoft etc. or you can use your own. > It seems like LDAP might just be what I need, after all. If you don't do anything else at least set up an LDAP server. Lots of services are perfectly fine delegating to an LDAP without any further complications. And if later you find a SSO platform you like it will more than likely support LDAP too so it won't be a wasted effort. ---------------------------------------------------------------------- NikStalwart · 2023-10-01 02:58 Seconding what /u/GolemancerVekk's comment. I would have told you the same thing if he hadn't beat me to it. Having said that, the simplicity (or not) of SSO solutions depends on the services you want to use and how many users you need to allow. For instance, if you are going to be the only user, you might consider not running any authentication at all and putting your services behind a VPN. You said you don't want to do anything with proxies, but, unfortunately, that seriously limits your options because not all services will support SSO mechanisms. Without knowing what it is, exactly, that you want to protect, it is hard to give you specific, actionable advice. Something I have used myself is [vouch- proxy](https://github.com/vouch/vouch-proxy). It utilizes the very simple [nginx auth_request](https://nginx.org/en/docs/http/ngx_http_au th_request_module.html) module. The TL;DR is: every time nginx receives a request, it makes a subrequest to the auth_proxy endpoint. If the subrequest returns 200, nginx allows the connection, otherwise it fails and tells you to log in. vouch-proxy integrates with Google (or another SSO provider) to handle authentication. [Okta has a good guide](https://developer.okta.com/blog/2018/08/28/nginx-auth-request) on setting this up. The reason I am comfortable using vouch/authelia is because I use a reverse proxy for all my services. It is just so much easier for me to set up SSL termination at a reverse proxy, use vanity hostnames and reuse common ports. So, integrating something at the reverse proxy to also handle authentication makes sense. ---------------------------------------------------------------------- adamshand · 2023-10-01 05:50 LLDAP is much, much simpler than any of the various single sign on packages. And while not everything supports LDAP they have working, example configurations for a bunch of commonly selfhosted apps. https://github.com/lldap/lldap#compatible-services