2020-02-29 00:43:59 +00:00
|
|
|
---
|
|
|
|
|
layout: default
|
|
|
|
|
title: Architecture
|
|
|
|
|
parent: Home
|
|
|
|
|
nav_order: 1
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
# Architecture
|
|
|
|
|
|
|
|
|
|
**Authelia** is a companion of reverse proxies like Nginx, Traefik and HAProxy.
|
|
|
|
|
It can be seen as an extension of those proxies providing authentication functions
|
|
|
|
|
and a login portal.
|
|
|
|
|
|
|
|
|
|
As shown in the following architecture diagram, Authelia is directly connected to
|
|
|
|
|
the reverse proxy but never directly connected to application backends.
|
|
|
|
|
|
|
|
|
|
<p align="center" style="margin:50px">
|
|
|
|
|
<img src="../images/archi.png"/>
|
|
|
|
|
</p>
|
|
|
|
|
|
|
|
|
|
## Workflow
|
|
|
|
|
|
|
|
|
|
Reverse proxies are configured so that every incoming requests generates an authentication
|
|
|
|
|
request sent to Authelia and to which Authelia responds to order the reverse
|
|
|
|
|
proxy to let the incoming request pass through or block it because user is not authenticated
|
|
|
|
|
or is not sufficiently authorized.
|
|
|
|
|
|
|
|
|
|
### Step by step
|
|
|
|
|
|
|
|
|
|
When the first request of an unauthenticated user hits the reverse proxy, Authelia
|
|
|
|
|
determines the user is not authenticated because no session cookie has been sent along with
|
|
|
|
|
the request. Consequently, Authelia redirects the user to the authentication portal provided
|
|
|
|
|
by Authelia itself. The user can then execute the authentication workflow using that portal
|
|
|
|
|
to obtain a session cookie valid for all subdomains of the domain protected by Authelia.
|
|
|
|
|
|
|
|
|
|
When the user visits the initial website again, the query is sent along with the
|
|
|
|
|
session cookie which is forwarded in the authentication request to Authelia. This time,
|
|
|
|
|
Authelia can verify the user is authenticated and order the reverse proxy to let the query
|
|
|
|
|
pass through.
|
|
|
|
|
|
|
|
|
|
### Sequence Diagram
|
|
|
|
|
|
|
|
|
|
Here is a description of the complete workflow:
|
|
|
|
|
|
|
|
|
|
<p align="center">
|
|
|
|
|
<img src="../images/sequence-diagram.png"/>
|
|
|
|
|
</p>
|
|
|
|
|
|
2020-03-01 13:08:09 +00:00
|
|
|
## HTTP/HTTPS
|
|
|
|
|
|
|
|
|
|
Authelia only works for websites served over HTTPS because the session cookie can only be
|
|
|
|
|
transmitted over secure connections. Please note that it has been decided that we won't
|
|
|
|
|
support websites served over HTTP in order to avoid any risk due to misconfiguration.
|
|
|
|
|
(see [#590](https://github.com/authelia/authelia/issues/590)).
|
|
|
|
|
|
|
|
|
|
If a self-signed certificate is required, the following command can be used to generate one:
|
|
|
|
|
|
|
|
|
|
# Generate a certificate covering "example.com" for one year in the /tmp/certs/ directory.
|
|
|
|
|
$ docker run authelia/authelia authelia certificates generate --host example.com --dir /tmp/certs/
|
