hjone72/plexauth

Plex based authentication using PHP

plexauth's Issues

Auth to another web server?

I'm having a lot of trouble getting things to load in the body area. Unless it's super simple to explain a better way, could you tell me what I have to modify to set the main page to another webpage? I'm really only using this to authenticate my automation tools which will be linked from another hosted site.

Endless redirect issue (inside docker)

So i wanted to go use it in docker, i used an alpine nginx (new enough) and based on that i installed php7 and fpm on top of that. Changed all the config to point to the correct session files, set the correct rights on all the files and changed the configs too.

Url comes in, everything looks fine (log wise) but then it start to create this endless loop where it keeps adding the return url to the url. So this ends up "dying" because of too many redirects.

I turned on debug on the config.ini and E_ALL on php.ini but i could not see much new in the logs. I don't think it is because of docker, since it loads fine. Only thing i can think off is that it uses php7. Since nginx is pretty new in the image with alpine, i only got php7 as an option.

So questions are really, does it work with php7 or is there a known redirect bug and how can we bump up debug to see more?

Thanks.

p.s. i do intend to opensource the docker container creating (since it did took me some time)

PlexPy SSO Fork - Error 500

Hello All,

This is just a quick writeup on how Hjone72 and myself resolved issues with a status 500 code which was being returned during logon of the PlexPy fork. The only messages I could see in the logs at the same time were;

2017-03-21 09:01:45 - DEBUG :: CP Server Thread-4 : PlexPy PlexAuth :: PlexAuth login attempt detected.
2017-03-21 09:01:45 - DEBUG :: CP Server Thread-4 : PlexPy PlexAuth :: Trying to auth user using PlexAuth.
2017-03-21 09:01:45 - DEBUG :: CP Server Thread-4 : PlexPy PlexAuth :: Session id detected as: '<SessionID>'
2017-03-21 09:01:46 - DEBUG :: CP Server Thread-5 : PlexPy PlexAuth :: PlexAuth login attempt detected.
2017-03-21 09:01:46 - DEBUG :: CP Server Thread-5 : PlexPy PlexAuth :: Trying to auth user using PlexAuth.
2017-03-21 09:01:47 - DEBUG :: CP Server Thread-5 : PlexPy PlexAuth :: Session id detected as: '<SessionID>'

1. I double checked the following two lines to make sure the PHP Session ID cookie was set correctly;
   https://github.com/hjone72/plexpy/blob/PlexAuth/plexpy/webauth.py#L45
   https://github.com/hjone72/plexpy/blob/PlexAuth/plexpy/webauth.py#L250

2. And that these two lines contained the IP of my PlexAuth SSO Server;
   https://github.com/hjone72/plexpy/blob/PlexAuth/plexpy/webauth.py#L46
   https://github.com/hjone72/plexpy/blob/PlexAuth/plexpy/webauth.py#L251

3. This all appeared correct. I double checked my server is correctly appearing on https://plex.tv/api/servers.xml which it was.

4. I then checked the response from https://secure.domain.com/auth/?info=plexpy. This prompted with an authentication box which took my plex credentials, but then brought me to an unexpected page. After discussing with hjone72 I was asked to change the following line to the IP of my PlexPy server;

https://github.com/hjone72/PlexAuth/blob/master/auth/index.php#L36

This worked! This line says that only the local machine can request session information, good for those who have all services on a single machine; but not so good for people who like separating of services like I do! A quick fix for this is to allow an array of IP addresses to be entered as below;

Replace lines 36-43 (https://github.com/hjone72/PlexAuth/blob/master/auth/index.php#L36-L43) with the following code;

$trustedIP = array('127.0.0.1', '127.0.0.1'); // Only add IP addresses you 100% trust.

if (in_array($_SERVER['REMOTE_ADDR'], $trustedIP)){ // If the request isn't coming from somewhere we trust then ignore the attempt to change Session_id.

		if (isset($_GET['session'])){
			$session_path = $GLOBALS['ini_array']['session_path'];
			$session_id = $_GET['session'];
			$session_info = file_get_contents($session_path . $session_id);
			session_decode($session_info);
		}
}

So in Summary;

If you run your PlexPy and PlexAuth instances on separate servers, you will need to modify the above code to ensure that your PlexPy service is authorised to access the session information from PlexAuth. It has been noted to ONLY allow IP addresses which you COMPLETELY trust to this list.

A huge thanks again for all hjone72's support and all his hard work with building this project.

Wiki Please

Hello,

I think your code is exactly what I'm looking for, for my Plex users.

I'm totally lost however on how to implement your code on my web server. I'm not the best when it comes to PHP.

Is it possible to create a Wiki or some type of walk through for me?

Thank you
-Tyler

500 Internal Server Error

Hi there, need some helps pls? Ok got nginx installed all working however the initial login is extremely slow, though it was because it was pulling the library data for the footer but that query is very quick. We will deal with this later.
I have installed the fork for plexpy, when i activate username and password in the plexpy admin section i am prevented from logging back into the server due to plexauth. below is the error i am getting trying to access it from within the portal: I hope you can assist

500 Internal Server Error

The server encountered an unexpected condition which prevented it from fulfilling the request.

Powered by CherryPy 5.1.0

Do the same for Emby?

Could you do this for Emby possibly? The devs seem to drag their feet doing most things and something like this would be amazing if you could use Emby local accounts as an auth directory. This way I can have one universal user directory.

Incorrect username and password error.

Using the correct username (email address) and password in the input form, I constantly get "incorrect username and password" errors.

I'm running on arch linux with php 5.6 and nginx. I've enabled openssl support for php. My server serves php files just fine. I've made the appropriate changes in my nginx configs as per example 2 (all domains were changed as well as pointing to the correct location of the fpm sock). So far I haven't configured any of my webapps to use authentication, but I put a simple html file that's served from the /content location and it loads just fine if I comment out the "auth_request /auth/;" line in the /content location block in nginx. When I uncomment that line, I get successfully redirected to the authentication page, but after entering my plex email address and password, I get a pop-up saying my username and password are incorrect. I have verified they are correct and work fine on plex.tv. There is nothing in my error logs. After 2 hours, I'm at a loss of where to check next.

Plexpy

Hi, love your work! Is it possible to use the plexpy stats in the footer without the mods to the plexpy installation? They're kinda hard to do when plexpy is running in a Docker.

How does PlexAuth work with other software?

There are some things about PlexAuth I don't get and couldn't find an answer to. I want users to login once with their Plex credentials and be logged into a custom portal, Plex and Ombi. If an admin logs in, Radarr, Sonarr, PlexPy, Jackett, Deluge, etc. should also be logged in. From what I understand PlexAuth is doing just that with Muximux.

Currently I'm running all software on seperate subdomains through nginx proxies. I still want to be able to use it like this, but I also want to give my users (and myself) 1 login screen for all software.
I use Organizr and I'd like to use PlexAuth with it. At least parts of it since they aren't compatable as far as I understand.

All the programs require their own set of information. Where and how is PlexAuth supplying the right information in order for these programs to be considered logged in?

Any possibility for apache support?

Disable Auth on location

I want to disable auth on a location (/RPC for rutorrent) and set auth basic but auth_request off, and auth_request "off", doesn't work. I'm using your musimux implementation.

1 time authentication for iDashboard

I have soooo many questions about that second screen shot lol. Did you fork muximux or idashboard or something? make it yourself? I'm doing something very similar to you (with iDashboard). I have everything up and running (though im still trying to pick the best service to handle my blog (wanted tumblr cause it's easy, but the lack of ssl makes it impossible to iframe) Also trying to get my "help" page to have a live chat with me through a slack channel, but i need to have some kind of authentication for that to work so i know who im talking to. so i was thinking about adding it to the root domain, and have everything else be unlocked... not really sure how i want to handle it yet, but my question for you (other than to see if you're willing to share some of the programs you're using lol) is, is there a way to get plex authentication for idashboard's guest page (the root page) and have it automatically log into all the plex services (for me that would be plex, plexrequests.net, and maybe plexpy if i decide to give guest access to that)?

More WebServer

Does this work with caddy?

ComicStreamer Admin permissions

Hey,

I'm not sure if this has been covered elsewhere, but couldn't find anything on the issues tracker.

I've managed to get the ComicStreamer SSO working with PlexAuth, but since doing so I'm unable to access any of the settings pages for ComicStreamer.

Is there a method for either the owner of the Plex server to be assigned these rights, or an alternate login option for managing these?

Thanks!

Allow only certain users to auth

Hey

I am unsure where I can set which users are allowed access or if that's possible at all.

Trouble since the introduction of the "RememberMe by gbirke" requirement

First off great job on this solution (quite worthy on it's own post on r/Plex and on the General (Third-Party Development) for the Plex forum. I've been tracking this project since you initially mentioned it on a Reddit thread for "Working on another Web Portal Manager". You gave me some initial pointers for setting it up, so thanks for including your nginx example.

Few questions:
-Does the RememberMe install have to be in the same directory as PlexAuth (I keep getting errors)?
-Can I tie your solution to Muximux (for authentication) replacing mainpage.php (in the INC folder) on the launch?
-Regarding Nginx, can your solution sit all on the same server block or does that have to be separated out (like you did in the example)?

Seems the trend are Plex users building out or finding additional offerings (PlexRequests, PlexPy (guest mode),PlexLanding, Ubooquity etc.) and then bundling them all via iFrame based offerings (Muximux/ManageThis/ManageThisNode) for folks they are sharing with (all tied under Ngninx/Apache setups with SSL/TLS). The missing piece (under Apache/Nginx) is the current way authentication is handled, which is where your solution comes in. Sure most have stated they are getting by with the "auth_basic" approach and not "auth_request" for inbound requests to their respective dashboards but PlexAuth seems to be the way forward (the Plex forum is also hopeful two factor is delivered in 2016). Hopefully with your latest update once folks log in through PlexAuth (when I get it working), the token passed will unlock and log users into the PlexPy, PlexRequests, and PlexTV ("IPaddress:32400/web" since use of plex.tv/app isn't allowed to be run within an iFrame) created tabs on Muximux (with their own PLEX account names).

The only suggestion I would make, is to utilize Plex colors on the login (even though we can do it ourselves).

Thanks for your time.

Feature Request: Seperate plex auth module for nginx

Any chance you could release plex auth just for nginx module so we could implement it for any custom page.

Example: I have simple readme.php page that I would like to go trough plex auth.