Feature Request: Support for external/proxy authentication about cerca

[bhartshorn]

My usecase gets a little muddy because the services are running in Docker behind Traefik as a web proxy.

I would probably use the 'OAuth2-Proxy' project I linked to. I get the impression that it's built to run one instance per service that needs authentication, so I would stand up a copy of it alongside cerca, just for cerca. (all in docker)

I might get around to making the changes in cerca and do a PR, but I'm not sure I have time to invest in learning the codebase right now. We'll see!

[cblgh]

thanks for the context!

if you do find yourself with some extra time, server/server.go contains all you want

here are some snippets that feel relevant:

• logging in & setting a cookie
• registering a user

and if you don't get to it, i'll see when i have a little bit of time to explore it :)

[decentral1se]

Hey sorry to jump in on this thread, the header fix seems to be a very nice minimal addition to support this!

I am very curious about "Single Sign On" which also continues in the tradition of cerca, that is, "lean".

This is not really a thing to solve in cerca and may be a wider discussion as to what is the suitable "go to" authentication solution for low-tech but I'm curious to have that chat somewhere!

I was thinking LDAP but after some chat on the pmc xmpp someone was saying that prosody has a nice model for just authenticating against the linux system user accounts with PAM https://modules.prosody.im/mod_auth_pam.html seems pretty neat 😌

Again, probably a wider discussion but I think low-tech self-hosting is going to need to cross this "one username/password for all" bridge at some point...

[cblgh]

@bhartshorn thank you for your thoughtfully written issue! i really appreciate when people take the time to understand a project and what may or may not be a suitable addition 🖤

let me look into the links you reference regarding enabling an authentication proxy and i'll get back to you! my initial reaction is that if it is a matter of handling a set of http headers to support such a usecase then it feels like a very reasonable tradeoff and addition c:

how do you see this working for your hackerspace usecase: would you be operating an oauth proxy? or is it already taken care of for the SSO provider you already have?