LLDAP question
reddit / selfhosted

----------------------------------------------------------------------
Timmeh8907 · 2023-12-22 10:19

So, I think we’ve all ran into the problem where when I’m heavily
working on my homelab I have renter passwords 50 times a session. Then
learned about LDAP. Basically, the system we use at work uses a USB
with our credentials loaded on it and we plug it in for access, so
even if you got my laptop or whatever it wouldn’t matter. I want that
same security set up. Where would I begin down this journey?

----------------------------------------------------------------------
Cylian91460 · 2023-12-22 10:48

Ping me when answered

----------------------------------------------------------------------
adamshand · 2023-12-22 11:23

LDAP allows you to centrally managed users and passwords for all
services.

For authenticating via a hardware token you want something like
Yubikey.

----------------------------------------------------------------------
cheesecloth62026 · 2023-12-22 12:21

Authelia supports key based authentication, and I believe authentik
does as well. Basically, you remove password auth from all of your
services you can, then use a reverse proxy (caddy, nginx, etc.) place
the authentication server "in front of" your services (each auth
server has instructions on how to do this). At this point you sign in
once using a yubikey/windows hello for key based auth or a phone code
for 2 factor auth and you are kept signed in on all your services
until your session expires, which is however long you set it to.

Services that don't allow you to remove local authentication generally
will support OIDC, allowing you to add authentication support for them
in the auth server.

----------------------------------------------------------------------
arcadianarcadian · 2023-12-22 13:28

Your search keyword is SSO.

I'm using Authelia+LLDAP for such cases.

If your application supports SSO methods which Authelia does too, you
can integrate it. So when you try to reach your service through the
web, Authelia intercepts and asks for authentication to LLDAP. If your
credentials are OK, Authelia redirects to the service.

In the meantime, if you try to reach a second service which integrated
with Authelia and SSO, Authelia will redirect you to the second
service without asking for authentication, because you already signed.
(That's what SSO means.  Examples? log in with Google, log in with
Facebook, etc.)

----------------------------------------------------------------------
sk1nT7 · 2023-12-22 13:39

You'll want SSO with Yubikey 2FA.

Have a look at Authelia or Authentik/Keycloak and use a proper reverse
proxy. I prefer Traefik.

----------------------------------------------------------------------
Timmeh8907 · 2023-12-22 21:44

Thanks man!

----------------------------------------------------------------------
Timmeh8907 · 2023-12-22 21:46

Yeah man single sign on ! That’s what I want but I want credentials on
separate hardware I can keep on a keychain with me.