41
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 22 Jan 2024
41 points (97.7% liked)
Selfhosted
40749 readers
496 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
Highly recommend Authentik for SSO.
I run it on it's own sub domain and all my other apps on their own sub domains.
It has pretty much every login protocol you could want (oauth, saml, ldap) etc.
Currently using it for jellyfin, immich, linkwarden, freshrss, and seafile.
Sorry for a noobie question. But when people say using SSO for internal apps, does it mean we only need to log in once and then the various apps won't need us logging in again? And then the browser can stay connected for however long we want it to be?
This is typically the case. Increasingly, self-hosted apps use integrated OIDC or OAuth but for those that don't there are various other methods of integration into the SSO provider you're using including forward auth and remote username. Authentik is nice in that it is also a forward-auth proxy and so you don't need to use an additional oauth proxy software like oauth2-proxy.
This is the way. I just hope they don't start gatekeeping essential features behind the "enterprise" license. Already they have announced push-based 2fa (like Duo) will be enterprise which is a bit of a bummer but it's honestly awesome software otherwise and beggars can't be choosers!
Does it work for multiple domains (not Subdomains)? I'm currently using authelia, which can't do that, which sucks.
I can't imagine why it wouldn't. The configuration just needs a URL, what domain they are actually on should be irrelevant.
For authelia, iirc it's a problem with the way cookies work, but also with how they set their system up structurally. I don't know the details anymore.
It it useful to use authentik with vaultwarden? Or is it redundant?
They don't really do the same thing. I use both. Authentik provides 1 password/account for all my self hosted apps. Along with other people that use my services. I create one account on authentik and suddenly they can access everything.
I then save that password in vaultwarden.
For what it's worth I don't use SSO for my vault warden master password, that is a separate password not saved anywhere
I see thank you :)
Does it mean each time you host a new app you have to tie it to authentik? I will read aboot it later
Yes, when you look into a new self hosted app, you have to check if they offer some kind of SSO option. Authentik can pretty much do every protocol there is. Each all will have different instructions on how to set it up.