How to always force authentication with Authentik (for Seafile)
reddit / selfhosted

----------------------------------------------------------------------
xBeo_x · 2023-12-15 10:00

Hi,

i've got a general question about SSO and IDP/IAM, especially for the
use with Seafile.

I installed Authentik a while ago and got it running with my (puclicly
reachable) NPM instance. I have some services that are protected by
forward auth (e.g. Mealie) and some that have SSO with OAuth bzw. OID
(e.g.) Seafile. This far everything works great.

I'm happy with the forward auth part, since every viewer for the site
is now forced to login to authentik (with his account, 2FA, it's quite
secure I guess).

I'm not sure about the SSO part though. Right now if users visit my
seafile instance, they have the option to login by SSO, or use their
(seafile) login credentials. At no point they're forced to actually
authenticate against Authentik. With some system against brute force
attacks (like fail2ban or crowdsec) this seems fine, but I'd like to
knwo, if there's some concept I'm missing that allows me to check for
a valid Authentik session, including my services that offer SSO. In
other words, is IDP (OAuth) and IAM (forward auth) exclusive, or can I
have both?

I tried adding the forward auth part to NPM for Seafile, so I would
first have to authenticate, and then I can login with SSO (or
username/password), but that doesn't work for some reason. That way
seems quite hacky to me anyways.

Is there something I'm missing or missunderstanding?

----------------------------------------------------------------------
xervir-445 · 2023-12-15 15:07

According to [seafile's
manual](https://manual.seafile.com/deploy/remote_user/) it supports a
few different sso protocols including shibboleth, ldap, and kerberos,
but most notably reverse proxy headers. If all the other protocols
don't actually force a user to login with sso and still permit local
logins then reverse proxy authentication may be the trick, since using
that the reverse proxy will force users to log in through authentik
before letting them to the site. This is how you secure services that
don't even offer authentication in the first place. I would try making
a proxy provider in authentik and tying your application to that.

----------------------------------------------------------------------
xBeo_x · 2023-12-16 23:02

Hm, I never looked at that, only the OAuth part. Sounds interesting,
I'll try that.

Thank you very much!

----------------------------------------------------------------------
sk1nT7 · 2023-12-26 23:37

You can actually use both.

1. Configure the forward auth in Authentik for Seafile.
2. Configure the corresponding Seafile application in Authentik using
the forward auth provider.
3. Enable it at your outpost.

Now users must be authenticated via Authentik to reach Seafile.

Then configure OAuth separately:

1. Configure an Oauth provider in Authentik
2. Configure OAuth within Seafile