Authelia: Dynamically checking if auth needed based on request? reddit / selfhosted ---------------------------------------------------------------------- softwareguy74 · 2023-10-19 18:52 I'm building a multi tenant SaaS offering on top of Kubernetes. My understanding is that Authelia runs at the ingress/proxy later (nginx, traefik, etc) before hitting the app service. I like this idea since you technically would not have to build anything directly in each of the apps to handle authentication. However, because of the dymoc nature of this SaaS I need to have a layer in there somewhere that can first query something (API, database, cache,etc) that based on data from the incoming request would tell authelia if auth is required or not. Is this possible with authelia? If so, any examples of how this might work? ---------------------------------------------------------------------- thekrautboy · 2023-10-19 19:17 Authelia can use LDAP for example as source of users etc, maybe you could connect your app to that? LLDAP is a very light and easy to use one. Or maybe use a tool like n8n or automatisch to act as a middleman between Authelia/LDAP and your apps API etc. ---------------------------------------------------------------------- lilolalu · 2023-10-19 19:34 Can you not just send the users request to two different URL, based on the decision if it needs auth or not? That would not be authelias task but your internal url routers. Authelia would handle the authentication on the path that requires auth and your proxy would directly serve the "open" content. The logic would have to take place in your app. myapp.org/ checks what it's going to be myapp.org/secret/ serves content you need to be authenticated for myapp.ort/open/ serves content that doesn't need auth. ---------------------------------------------------------------------- probablyjustpaul · 2023-10-19 19:37 Authelia can operate at the proxy level as you said, but it can also work at the application level. Authelia implements the OpenIDConnect standard which is designed first as a way for applications to authenticate users using client side redirects. My recommendation would be to build (or potentially find) a piece of middleware that performs your API/DB query and then redirects to Authelia based on the response. Depending on what proxy/LB you're using it might even support this natively ---------------------------------------------------------------------- softwareguy74 · 2023-10-19 19:45 So the url can be anything and would not be known ahead of time if it is secure or not, because we allow the user to set a flag on that "resource" which is database driven. So, if someone goes to myapp.com/path1 right now, it may allow anonymous but 10 minutes later may require authentication. So we can't hardcode paths in authelia ahead of time. I'm thinking more about this, sounds like we need something in FRONT of authelia for this, right? So whatever that thing is, will forward to authelia or not. ---------------------------------------------------------------------- lilolalu · 2023-10-19 20:05 I think that authelia is not really made for this scenario, so if you want to use authelia, I think you would have to loop back to before authelia and redirect to the different (auth / non-auth) urls. I am pretty sure though you are not the first person to have this requirement so probably there is a better solution, but I would have no idea what to search for. Generally speaking most proxies like haproxy or nginx are scriptable (HAproxy via Lua for example) so maybe that's something you could let ok into. This article sounds s bit like your scenario: https://www.egnyte.com/blog/post/dynamic-backends-in-haproxy-with-lua ---------------------------------------------------------------------- lilolalu · 2023-10-19 20:41 So, couldn't your app write to redis what resource has which status atm (open / protected) and for each request you get that status via a script in Lua, in your proxy that asks redis and then redirects to either o.app.org/resource or p.app.org/resource But what happens if the status changes while a user is browsing it? So you really need to check for request... ---------------------------------------------------------------------- softwareguy74 · 2023-10-20 01:59 Yes that sounds like a good solution and you're correct... It would have to check that on every call. Perhaps something like Apisix would be a better solution since it seems to be extensible by design and backed by etcd which would theoretically be more accurate.