authelia

2.9 KiB

Raw Blame History

title

description

lead

date

draft

images

weight

toc

community

Seafile

Integrating Seafile with the Authelia OpenID Connect Provider.

2022-06-15T17:51:47+10:00

false

integration

parent
openid-connect

620

true

Tested Versions

Authelia
- v4.36.9
Seafile Server
- 9.0.9

Before You Begin

Assumptions

This example makes the following assumptions:

Application Root URL: https://seafile.example.com
Authelia Root URL: https://auth.example.com
Client ID: seafile
Client Secret: insecure_secret

Configuration

Application

To configure Seafile to utilize Authelia as an OpenID Connect 1.0 Provider:

Seafile may require some dependencies such as requests_oauthlib to be manually installed. See the Seafile documentation in the see also section for more information.
Edit your Seafile seahub_settings.py configuration file and add configure the following:

ENABLE_OAUTH = True
OAUTH_ENABLE_INSECURE_TRANSPORT = False
OAUTH_CLIENT_ID = "seafile"
OAUTH_CLIENT_SECRET = "insecure_secret"
OAUTH_REDIRECT_URL = 'https://seafile.example.com/oauth/callback/'
OAUTH_PROVIDER_DOMAIN = 'auth.example.com'
OAUTH_AUTHORIZATION_URL = 'https://auth.example.com/api/oidc/authorization'
OAUTH_TOKEN_URL = 'https://auth.example.com/api/oidc/token'
OAUTH_USER_INFO_URL = 'https://auth.example.com/api/oidc/userinfo'
OAUTH_SCOPE = [
    "openid",
    "profile",
    "email",
]
OAUTH_ATTRIBUTE_MAP = {
    "email": (True, "email"),
    "name": (False, "name"),
    "id": (False, "not used"),
}

Authelia

The following YAML configuration is an example Authelia client configuration for use with Seafile which will operate with the above example:

identity_providers:
  oidc:
    ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
    ## See: https://www.authelia.com/c/oidc
    clients:
    - id: 'seafile'
      description: 'Seafile'
      secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
      public: false
      authorization_policy: 'two_factor'
      redirect_uris:
        - 'https://seafile.example.com/oauth/callback/'
      scopes:
        - 'openid'
        - 'profile'
        - 'email'
      userinfo_signing_algorithm: 'none'

2.9 KiB Raw Blame History