Using Obligator to protect apps

[lastlogin-io]

Using Obligator to protect apps

[anderspitman]

Hey @MitPitt, forward auth should be what you want. This functionality is currently broken in obligator (it's not used by LastLogin), but it should be pretty easy for me to fix. The settings should be almost the same as Authentik. Do you know what Authentik headers you're currently making use of?

[MitPitt]

I'm protecting a dashboard and some other static pages, which do not require authorization. Hence I am not making use of any headers. Just protecting the dashboard with an authentication layer.

In the Caddy config I linked above, the uri /outpost.goauthentik.io/auth/caddy looks like a feature of Authentik which seems to autofill the auth request. Obligator should have something similar.

[anderspitman]

Ah ok you should be good to go then. Just use the /validate endpoint on the obligator server. Note that vouch might be a more battle-tested alternative that will work for you.

[anderspitman]

@MitPitt I just did a new beta release so you don't have to build manually if you wanted to try this.

[MitPitt]

Would you also mind building a docker image please? I noticed that latest image on docker hub is 6 months old now

[MitPitt]

I tried running the binary now with ./obligator-linux-x64-0.2.0 -storage-dir ./data -root-uri https://obligator.mywebsite.com -port 1616 -api-socket-dir ./api

Now it shows 404 page not found when I visit obligator.mywebsite.com. This doesn't happen when I run the binary of previous version (Beta 0.1.0) in the same way.

I also tried the following Caddyfile:

obligator.mysebsite.com {
    reverse_proxy localhost:1616
}

mysebsite.com {
    reverse_proxy /auth* http://obligator.mysebsite.com:1616

    forward_auth http://obligator.mysebsite.com:1616 {
        uri /validate
    }

    # the app i'm protecting
    reverse_proxy localhost:1234 
}

Shows client_id missing at https://obligator.mysebsite.com/auth?client_id=&redirect_uri=&response_type=code&state=&scope=

[anderspitman]

Hey @MitPitt, sorry I'm traveling at the moment, but I'll take a look at this when I get back.