From 7d1f448c2139a9c604a0797a7e5e34589f10e805 Mon Sep 17 00:00:00 2001 From: Monviech <79600909+Monviech@users.noreply.github.com> Date: Wed, 3 Jul 2024 14:05:30 +0200 Subject: [PATCH] www/caddy: Add forward_auth functionality, auth provider Authelia added. (#4063) * Add forward_auth functionality, Provider Authelia added. * www/caddy: Change position of forward auth in dialogHandle, add ForwardAuth to bootgrid. * www/caddy: Add IPv6 detection logic to the Forward Auth Domain. * Disallow wildcards in hostnames. * Disallow wildcards in hostnames. Fixed spot where it applies. * Remove keys that are already defaults. * Allowing WellKnown is wrong in this context. --- .../OPNsense/Caddy/GeneralController.php | 1 + .../OPNsense/Caddy/forms/authprovider.xml | 32 +++++++++++++++++++ .../OPNsense/Caddy/forms/dialogHandle.xml | 11 +++++++ .../mvc/app/models/OPNsense/Caddy/Caddy.xml | 14 ++++++++ .../mvc/app/views/OPNsense/Caddy/general.volt | 5 +++ .../views/OPNsense/Caddy/reverse_proxy.volt | 1 + .../templates/OPNsense/Caddy/Caddyfile | 3 ++ .../OPNsense/Caddy/includeAuthProvider | 13 ++++++++ 8 files changed, 80 insertions(+) create mode 100644 www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/authprovider.xml create mode 100644 www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeAuthProvider diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/GeneralController.php b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/GeneralController.php index 6d64473de..7cc6639f6 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/GeneralController.php +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/GeneralController.php @@ -42,6 +42,7 @@ class GeneralController extends IndexController $this->view->generalForm = $this->getForm("general"); $this->view->dnsproviderForm = $this->getForm("dnsprovider"); $this->view->dynamicdnsForm = $this->getForm("dynamicdns"); + $this->view->authproviderForm = $this->getForm("authprovider"); $this->view->logsettingsForm = $this->getForm("logsettings"); } } diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/authprovider.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/authprovider.xml new file mode 100644 index 000000000..1790ceda4 --- /dev/null +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/authprovider.xml @@ -0,0 +1,32 @@ +
+ + caddy.general.AuthProvider + + dropdown + + + + caddy.general.AuthToDomain + + text + + + + caddy.general.AuthToPort + + text + + + + caddy.general.AuthToTls + + checkbox + + + + caddy.general.AuthToUri + + text + + +
diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml index c554d2eb8..a0dd633c9 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml @@ -36,6 +36,17 @@ text + + header + + true + + + handle.ForwardAuth + + checkbox + + header diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml index a8bc042c8..93960a2ec 100644 --- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml +++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml @@ -126,6 +126,19 @@ Please enter a valid number from 0 to 2147483647 seconds or leave empty for default. + + None (default) + + Authelia + + + + + + + /^(\/.*)?$/u + Please enter a valid 'URI' that starts with '/'. + @@ -300,6 +313,7 @@ 100 Please enter a value between 1 to 100. + diff --git a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/general.volt b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/general.volt index 272973e4f..38bb9c3ad 100644 --- a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/general.volt +++ b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/general.volt @@ -137,6 +137,7 @@
  • {{ lang._('General') }}
  • {{ lang._('DNS Provider') }}
  • {{ lang._('Dynamic DNS') }}
    • +
  • {{ lang._('Auth Provider') }}
  • {{ lang._('Log Settings') }}
    • @@ -154,6 +155,10 @@
    {{ partial("layout_partials/base_form", ['fields': dynamicdnsForm, 'action': '/ui/caddy/general', 'id': 'frm_GeneralSettings']) }}
    + +
    + {{ partial("layout_partials/base_form", ['fields': authproviderForm, 'action': '/ui/caddy/general', 'id': 'frm_GeneralSettings']) }} +
    {{ partial("layout_partials/base_form", ['fields': logsettingsForm, 'action': '/ui/caddy/general', 'id': 'frm_GeneralSettings']) }} diff --git a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt index 5884a9eb4..e3b559237 100644 --- a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt +++ b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt @@ -334,6 +334,7 @@ {{ lang._('Upstream Port') }} {{ lang._('Upstream Path') }} {{ lang._('Fail Duration') }} + {{ lang._('Forward Auth') }} {{ lang._('TLS') }} {{ lang._('TLS CA') }} {{ lang._('TLS Server Name') }} diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile index 670984981..5070878d5 100644 --- a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile +++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile @@ -346,6 +346,9 @@ #} {% macro reverse_proxy_configuration(handle) %} {{ handle.HandleType }} {{ handle.HandlePath|default("") }} { + {% if handle.ForwardAuth|default("0") == "1" %} + {% include "OPNsense/Caddy/includeAuthProvider" %} + {% endif %} {% if handle.ToPath|default("") != "" %} rewrite * {{ handle.ToPath }}{uri} {% endif %} diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeAuthProvider b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeAuthProvider new file mode 100644 index 000000000..4bf4b09ef --- /dev/null +++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeAuthProvider @@ -0,0 +1,13 @@ +{# +# This file gets imported to configure forward auth in handlers. +# - Section: Reverse Proxy Configurations +#} +{% if generalSettings.AuthProvider == 'authelia' %} + {# Check if the domain is IPv6 and wrap in square brackets if necessary #} + {% set is_ipv6 = (':' in generalSettings.AuthToDomain and generalSettings.AuthToDomain.count(':') >= 2) %} + forward_auth {% if generalSettings.AuthToTls|default("0") == "1" %}https://{% endif %}{{ '[' if is_ipv6 else '' }}{{ generalSettings.AuthToDomain|default("") }}{{ ']' if is_ipv6 else '' }}{% if generalSettings.AuthToPort %}:{{ generalSettings.AuthToPort }}{% endif %} { + {% if generalSettings.AuthToUri %}uri {{ generalSettings.AuthToUri|default("") }}{% endif %} + + copy_headers Remote-User Remote-Groups Remote-Name Remote-Email + } +{% endif %}