Authelia woes
reddit / selfhosted

----------------------------------------------------------------------
charmstrong70 · 2023-11-04 10:18

Hi,

Don't know how many of you are using authelia but it's fantastic.

However, I am having a problem and was hoping somebody who's smarter
than me may have an idea.

I've got two groups that have access to my hosted vaultwarden instance
- dev and board.

I want dev to have access to vaultwarden/admin but not the board group
but somehow both have access.

Here's the relevant bit from configuration.yml:

    access_control:
      default_policy: deny
      rules:

        - domain:
            - "vault.*****.******"
          resources:
            - "^*/admin.*$"
          subject:
            - "group:dev"
          policy: two_factor

        - domain:
            - "vault.*****.******"
          subject:
            - "group:board"
          policy: two_factor

        - domain:
            - "vault.*****.******"
          policy: deny

​

----------------------------------------------------------------------
Normanras · 2023-11-04 11:08

Maybe it’s just early, but I want to confirm I understand. You want
both board and dev to have access to vaultwarden, in general. However,
only dev should have access to admin, correct?

When you access admin with a board member, what do the logs say?

----------------------------------------------------------------------
charmstrong70 · 2023-11-04 11:13

Hey, thanks for the reply, you've got it exactly - both need access to
vaultwarden but I want to tie down access to the admin panel.

The logs are....lacking, i'm going to turn up the logging level and
see if that helps.

----------------------------------------------------------------------
charmstrong70 · 2023-11-04 11:18

Yeah, even with debug, logs are not super helpful:

`time="2023-11-04T11:16:17Z" level=debug msg="Successful TOTP
authentication attempt made by user 'board2'" method=POST
path=/api/secondfactor/totp remote_ip=xx.xx.xx.xx`
`time="2023-11-04T11:16:17Z" level=debug msg="Redirection URL
https://vault.xxx.xxx.xxx/admin is safe" method=POST
path=/api/secondfactor/totp remote_ip=xx.xx.xx.xx`

----------------------------------------------------------------------
Normanras · 2023-11-04 11:19

I’d have to test and get back to you, but I had some access control
issues a while back and I always forget that the order of the rules
matters with Authelia. You also have the deny policy twice, which is
redundant. Not sure if that will make a difference.

Can you switch the dev and board rules and remove the vault.*** deny
policy and see what happens?

Also, I’m assuming that two-factor is kicking in as expected. Is that
true?

----------------------------------------------------------------------
moontear · 2023-11-04 11:24

There is a very helpful Authelia discord - I would ask there TBH.

----------------------------------------------------------------------
buneech · 2023-11-04 12:00

I think you have to have a separate rule for /admin to deny, as board
inherently has access to all vault resources.

----------------------------------------------------------------------
charmstrong70 · 2023-11-04 12:01

>I’d have to test and get back to you, but I had some access control
issues a while back and I always forget that the order of the rules
matters with Authelia. You also have the deny policy twice, which is
redundant. Not sure if that will make a difference.

I realise the deny is in twice but guess it doesn't really matter?

I also thought the policy was most permissive to least?

2FA is golden.

Will try switching the rules and see what happens.

Thanks

----------------------------------------------------------------------
ArgoPanoptes · 2023-11-04 12:02

The second rule gives access to any resources to board on that domain.

After the first rule, add a rule that denies access to the /admin
resource.

----------------------------------------------------------------------
schklom · 2023-11-04 12:20

Authelia rules are considered from the top. When `board` people go to
`vault.***/admin`, Authelia sees that there are no restrictions, so it
lets them pass.

What you want is to deny access to `/admin` to everyone except `dev`.

```
    # Allow dev admin access
    - domain:
        - "vault.*****.******"
      resources:
        - "^*/admin.*$"
      subject:
        - "group:dev"
      policy: two_factor

    # Deny by default admin access
    - domain:
        - "vault.*****.******"
      resources:
        - "^*/admin.*$"
      policy: deny

    - domain:
        - "vault.*****.******"
      subject:
        - "group:board"
      policy: two_factor

    - domain:
        - "vault.*****.******"
      policy: deny
```

----------------------------------------------------------------------
charmstrong70 · 2023-11-04 15:43

Thank you so much, made perfect sense and worked a charm (after I
managed to hose my yaml and spent a couple of hours fixing - I hate
the formatting in yaml).

----------------------------------------------------------------------
Normanras · 2023-11-04 16:00

Boom! Glad you got it solved.