[feature] protecting proxy hosts using lua-resty-openidc

[WirtsLegs]

Would love to see the oidc feature from the nginx proxy manager openidc branch make its way here (or another implementation)

Being able to setup other auth providers like say keycloak without needing a middleware auth proxy would be a a great addition

[Zoey2936]

if upstream merges this, then I will also merge it here

[alexsalex]

They have good PR for this future: NginxProxyManager#2630

It will be really easy to implement and really nice of you if you implement it.

[Zoey2936]

The problem is, if I merge it and then upstream merge it but makes adjustments, NPMplus could end up incompatible with upstream because of too different database scheme

[alexsalex]

I'm pretty sure this PR will never merge in NPM v2, because of v3 is coming with IODC and Fail2Ban support.

[Zoey2936]

are you sure? The upstream added tests 3 moths ago: NginxProxyManager@ca3ee98#diff-e12d5bbdb55f70049eda2d4935c56a851e846951cf593b46cbaf3b6358f4cda6

[alexsalex]

You send me the link with Postgres Support. It's not OIDC.

- Adds authentik in CI stack

[alexsalex]

So I'm pretty sure this future will not be implemented in version 2 of NPM. If you implement it, you will get a lot of users, who really waiting on this future for a long time.

[Zoey2936]

You send me the link with Postgres Support. It's not OIDC.

- Adds authentik in CI stack

They added tests (which are currently disabled because it was not merged to yeet) together with Postgres:

• https://github.com/NginxProxyManager/nginx-proxy-manager/blob/develop/test/cypress/e2e/api/Ldap.cy.js
• https://github.com/NginxProxyManager/nginx-proxy-manager/blob/develop/test/cypress/e2e/api/OAuth.cy.js

[Zoey2936]

So I'm pretty sure this future will not be implemented in version 2 of NPM.

I'm not see this PR: NginxProxyManager#4010 it seems that it will be merged soon

If you implement it, you will get a lot of users, who really waiting on this future for a long time.

This may be the case, but as I wrote in #1297 I still don't see a big advantage, as NPMplus is compared to Nextcloud for example not used by non-technical people, for which I would see an advantage, but they are not the group of users using NPMplus. I hope that people administrating their hosts and certs with NPMplus are able to set a long and secure password, and they should be able to save them in password manager like vaultwarden or KeePassXC.

What I would rather integrate would be something like MFA via TOTP (there is an upstream PR for this) or WebAuthn. Or the ability for NPMplus to interact with a Mail Server (via SMTP) to send MFA Tokens that way, reset the password via mail, send login notifications or notifications when errors occur etc. But I just don't have the time for that.

I hope you understand, but as I said, if upstream merges it, I will also merge it

[WirtsLegs]

This may be the case, but as I wrote in #1297 I still don't see a big advantage, as NPMplus is compared to Nextcloud for example not used by non-technical people, for which I would see an advantage, but they are not the group of users using NPMplus. I hope that people administrating their hosts and certs with NPMplus are able to set a long and secure password, and they should be able to save them in password manager like vaultwarden or KeePassXC.

I get wanting to wait and see if upstream merges,

but really OIDC support vs whether people set a strong password is sorta two different conversations. Many people run various idPs at home (keycloak, authelia, authentik, and so on) in order to provide SSO for their various services. OIDC is the most commonly supported auth method across all of these apps and the one people are most used to.

Supporting it enables proper SSO as it is frankly bad practice to have your proxy own your accounts. By supporting either OIDC (or the less common in home setups SAML) you allow people to move their auth to a app that is built for and dedicated to authentication, let those platforms offer webauth etc (as many do) and NPMplus stays a proxy as it should be and not a auth provider.

To be clear im not talking about logging into the management app using OIDC though that would be nice, I mean being able to gate access to proxied hsots based on a oidc config using a designated auth provider, and then insert headers for apps that support header-based auth

[alexsalex]

[alexsalex]

We're talking about this future.
And please, learn more about Okta, KeyCloack (Red Hat Inc.). This companies provide the Enterprise solution for SSO.

SSO simplify user management if you have multiple users and multiple applications (I have 35 applications in Authentik). I don't need to create user in application manually, I can control em in one place. It's much easier than share password, create multiple users manually in NPM (forget to delete it), and store MEGA password in KeePass or BitWarden.

[Zoey2936]

so you both talk about different things? or did I misunderstand something?
@WirtsLegs you want to protect the proxy host using OIDC? (so instead of the configuration via nginx auth_request)?
@alexsalex And you want to log into the NPMplus web GUI using SSO, right?

[WirtsLegs]

so you both talk about different things? or did I misunderstand something? @WirtsLegs you want to protect the proxy host using OIDC? (so instead of the configuration via nginx auth_request)? @alexsalex And you want to log into the NPMplus web GUI using SSO, right?

Yes on my half

Reason being is many auth providers don't support auth request and currently the solution requires deploying a auth proxy as extra middleware which isn't ideal

The branch I mentioned provides this via iirc lua-resty-oidc (branch in question: https://github.com/NginxProxyManager/nginx-proxy-manager/tree/openidc )