Authelia Integration

[viharm]

Since LDAP support was dropped in 5.7.0, I have been trying to migrate to Authelia. After weeks of trial and error, I've finally succeeded in integrating Authelia into FFIII.

The guidance in the documentation is spot on, thanks. Especially the one about empty guard header, where I had to specifically specify AUTHENTICATION_GUARD_HEADER=HTTP_REMOTE_USER

Since I am migrating from an instance which was using native LDAP, the old setup was such that the FFIII username was the email address taken from the LDAP directory.

With the new auth setup using remote_user_guard, the [ OpenLDAP → Authelia → NGINX ] chains sends the uid of the user in the Remote-User header, and not the email address.

Q1: Does this mean FFIII will treat it as a new user? (old: [email protected]; new: username)

I have tried utilize the guidance on customizing headers and specified AUTHENTICATION_GUARD_EMAIL=HTTP_REMOTE_EMAIL, but the FFIII username still appears to be the uid (I tried with a new user, just to be sure). Also, I check the users table in the database, and couldn't find the email anywhere.

Q2: Is the AUTHENTICATION_GUARD_EMAIL only for communicating with the user? Is it not store anywhere?

Q3: Can use the email from the header as the username? Like so... AUTHENTICATION_GUARD_HEADER=HTTP_REMOTE_EMAIL

Obviously my worry is to retain my existing data with months of accounts.

Thanks.

[JC5]

Hey,

Glad to hear it works as expected. I'll make sure your questions make it to the FAQ as well.

• Q1: Yes. You can safely rename the user in the database if you want to, but you may be able to setup Authelia in such a way that it puts the email address in the REMOTE_USER header, and not the username. I believe this is possible, but I'm not sure how.
• Q2: Yes. It is stored in the "preferences" table.
• Q3: Yes, as described in Q1.

Hope this helps, let me know if it works. Make sure you back up your database.

[JC5]

Apologies, the build is still running.

[viharm]

I have pulled a fresh copy of the image and launched again. Container has been up for 8 min, with no error emails. Docker ps shows (healthy)

[JC5]

Sounds good! The build was suspiciously fast, so I clear the build-cache just to be sure. When you do that, it takes over an hour lol. If it works I'm not complaining but I'm doublechecking just in case.

[viharm]

OK, that's cool. Thanks for the prompt action :-)

Please let me know if it needs further testing.

I will consolidate all my configs to post a sample suite of configs as examples for the FF3-Docker, NGINX, Authelia, OpenLDAP combination - hopefully over the next few days. Should I post it here?

[JC5]

That would be amazing, thanks!

[madewithpat]

Hey @viharm - did you ever get sample configuration put anywhere?

[viharm]

Hi, sorry about the late response. I have got this working, but haven't yet sanitized my config to share yet. Will do it over the next few days.

[panoskpv]

@viharm Any luck with the sample configuration. I would like to add authelia to my firefly.

[viharm]

Hi @panoskpv (&James), sorry about the delay. Life keeps getting in the way.

I believe my new/improved circumstances will allow me to provide one this weekend.

[viharm]

I've finally finished my write up and it includes all Firefly III settings needed to work with Authelia. Hope this helps.

https://cerebral.voyage/firefly-iii-on-docker-with-mariadb-redis-ldap/

[JC5]

Very cool!

[viharm]

cc @panoskpv , @madewithpat