How to Authenticate into the web GUI with Token

[moutasem1989]

I am trying to understand the process of authentication into the Web GUI and I have a couple of questions:
When loging in, some data is passed to the server and it responds with Token.
{"user":"[my user name]","pass":"[my password]","includeInfo":"true","_":"[a random number?]"}
what are the headers/values needed to get an authentication Token from the server?
How is the token used to remain authenticated?

Users are also able to create tokens in the GUI. Is it posible to use a generated token to login?
it would be amazing if someone could point me in the right direction

[ShreyasZare]

Thanks for asking. You can check out the API docs for this to understand the exact request and response details. Let me know if you have any queries.

[ShreyasZare]

Thanks for the details. What are you exactly trying to achieve here by doing reverse proxy to a specific API call?

[moutasem1989]

I understand that OIDC/LDAP Authentication is still a feature request and not yet implemented. I am tring to use Authentik/NginX Proxy authentication as a workaround.

Configure Authentik:
In this example, I am using group_attributes(), but user attributes is also posible.
In Authentik > Admin Panel > Directory > Groups
Edit the Group of users you wish to give access. in the attributes add the following:

technitium_user: [username of a technitium user]
technitium_password: [password of a technitium user]

For each User/Group in Authentik, a diffrent technitium user can be linked by changing the values above.

In Authentik > Admin Panel > Customization > Property Mappings > Create new Scope Maping:
Name: Technitium Token
Scope Name: ak_proxy
Expression:

import json
from urllib.parse import urlencode
from urllib.request import Request, urlopen
if request.user.username == "":
  return {"ak_proxy": {"user_attributes": {"additionalHeaders": {"X-Technitium-Token": "null"}}}}
else:
  technitiumuser = request.user.group_attributes().get("technitium_user", "")
  technitiumpass = request.user.group_attributes().get("technitium_password", "")
base_url = "http://technitium:5380"
end_point = "/api/user/login?"
headers = {"Content-Type": "application/x-www-form-urlencoded"}
try:
  httprequest = Request(base_url + end_point + "user=" + technitiumuser + "&pass=" + technitiumpass + "&includeInfo=false", method="POST", headers=headers)
  with urlopen(httprequest) as response:
    responddata = json.loads(response.read().decode())
  return {"ak_proxy": {"user_attributes": {"additionalHeaders": {"X-Technitium-Token": responddata['token']}}}}
except: return {"ak_proxy": {"user_attributes": {"additionalHeaders": {"X-Technitium-Token": "null"}}}}

Testing the Scope Maping should return either Null or Token depending wether a user/group have the correct attributes.

In Authentik > Admin Panel > Applcations > Providers: Create a new Proxy Provider. Fill out Name and External host accordingly. Under Additional scopes add the scope we just created.

In Authentik > Admin Panel > Applcations > Applcations: Create a new Application and select the Provider we just created. Adjust UI settings accordingly.

In Authentik > Admin Panel > Applcations > Outposts: Select Embeded Outpost and make sure the Application we just created is selected.

Configure NginX Proxy Manager:
In NginX Proxy Manager, Create a new Host/or edit the Host of Technitium. Make sure the created Host works and the Web UI can be accessed through the URL. Under Advanced, add Custom Nginx Configuration to enable Authentik Authentication:

proxy_buffers 8 16k;
proxy_buffer_size 32k;
port_in_redirect off;
location / {
    proxy_pass          $forward_scheme://$server:$port?token=$authentik_auth;
    proxy_set_header Host $host;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Content-Type "application/x-www-form-urlencoded";
    auth_request     /outpost.goauthentik.io/auth/nginx;
    error_page       401 = @goauthentik_proxy_signin;
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header       Set-Cookie $auth_cookie;
    auth_request_set $authentik_auth $upstream_http_x_technitium_token;
}
location /outpost.goauthentik.io {
    proxy_pass              https://authentik-server:9443/outpost.goauthentik.io;
    proxy_set_header        Host $host;
    proxy_set_header        X-Original-URL $scheme://$http_host$request_uri;
    add_header              Set-Cookie $auth_cookie;
    auth_request_set        $auth_cookie $upstream_http_set_cookie;
    proxy_pass_request_body off;
    proxy_set_header        Content-Length "";
}
location @goauthentik_proxy_signin {
    internal;
    add_header Set-Cookie $auth_cookie;
    return 302 /outpost.goauthentik.io/start?rd=$request_uri;
}

This part auth_request_set $authentik_auth $upstream_http_x_technitium_token; calls the Token Value created in the Scope in Authentik. I need to pass the Token correctly to access the Web UI and Bypass Authentication without disabling it in Technitium. This is the part I need Help With.

[moutasem1989]

It seems that here Tokens are only saved from and to “localStorage?” as in DnsServer/DnsServerCore/www/js/auth.js.
var token = localStorage.getItem("token");

[ShreyasZare]

Thanks for the details. I am not sure how this could work out. I don't think reverse proxy to the API URL this way will work. I have no experience with Authentik so not sure about its features or how it works.

The web app stores token in local storage so that it can be reused if you refresh the webpage. The web app is designed to work in a specific way so the authentik/nginx config may not work with it.