website·Indexed 32 days ago
https://docs.authcrunch.com/Authentication and authorization for Caddy via the caddy-security module. Features include identity provider integration (OAuth2, SAML, Okta, Keycloak, Discord, GitLab), Caddyfile configuration, user transforms for role mapping, API key authentication, and a security portal for managing identity workflows.
caddy-security module. It manages user sign-in and verifies if a user's identity permits access to a specific application or resource.The Authorization Plugin for Caddy v2 provides authorization and resource access control based on the discovery of valid JWT or PASETO authentication tokens. Key capabilities include:
The Authentication Plugin for Caddy v2 provides authentication services by issuing JWT tokens upon successful user verification. It is designed to handle authentication only; the subsequent authorization of these tokens must be managed by the companion Authorization plugin.
Supported authentication stores and providers include:
authenticate plugin) on different instances to share state, synchronize authentication databases, and distribute revocation lists. It is also used by gatekeepers running authorization policies (authorize plugin) to perform remote API key and Basic authentication and to retrieve revocation lists to block disabled users with still-valid tokens.The registration process follows these steps:
The AuthCrunch security portal provides three primary API domains for programmatic interaction:
Important Pathing Note: All API endpoints are relative to the portal's serving path. If the portal is served from /auth/, an endpoint documented as /api/server/info must be accessed via the full path /auth/api/server/info.
AuthCrunch uses the OAuth 2.0 authorization code flow to turn an external identity into an application session. The process involves four main steps:
Note: There are two distinct tokens: the provider's token (used to get identity) and the AuthCrunch token (used by the app policy to verify roles).
https://region-code.signin.aws.amazon.com/saml). Key configurable attributes include SessionDuration for console session validity and session tags.The authentication portal identifies a user via their 'identity' (username or email) and an optional 'realm' (e.g., bar.baz). Once identity is established, the portal determines a sequence of 'challenges' or 'checkpoints' the user must pass to be granted access. These checkpoints are stored in the local authentication database or applied via 'User Transforms'. The order of checkpoints in User Transforms dictates the order in which the user encounters the challenges. Common challenge types include:
password: Password authenticationmfa: Application authentication or hardware tokensconsent: Acceptance of terms of use or conditions.Login hints (per OpenID Connect spec) allow you to notify the Authorization Server about a user's login identifier (e.g., email) to pre-fill login forms. When enable login hint is configured, the plugin forwards the login_hint query parameter from the protected route to the auth URL.
By default, it accepts email addresses, phone numbers, and alphanumeric characters. You can restrict which types are forwarded using the with keyword and the validators: email, phone, and alphanumeric.
{
security {
authorization policy mypolicy {
set auth url https://auth.example.com/auth
# Enable all default hints (email, phone, alphanumeric)
enable login hint
# Alternative: Only forward email and alphanumeric strings
# enable login hint with email alphanumeric
}
}
}
myapp.com {
route /protected* {
authorize with mypolicy
respond "myapp is running"
}
}roles and app_metadata are missing, or app_metadata lacks an authorization object), it automatically assigns the token the following two roles: anonymous and guest.