mirror of
https://github.com/glenndehaan/unifi-voucher-site.git
synced 2026-05-09 08:25:29 +02:00
[GH-ISSUE #36] Adding Email Support & Seperate Users #18
Labels
No labels
bug
enhancement
pull-request
question
question
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/unifi-voucher-site#18
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @jlengelbrecht on GitHub (Aug 14, 2024).
Original GitHub issue: https://github.com/glenndehaan/unifi-voucher-site/issues/36
Originally assigned to: @glenndehaan on GitHub.
Got this spun up in my homelab. Awesome work. Love this!
A few questions.
Would it be possible to add an option to send email via SMTP?
I would like to be able to email guests the tokens that get created.
What about additional users. Would it be possible to allow more then one user to have access? It be nice to see OIDC support or something similar in the future.
@glenndehaan commented on GitHub (Aug 15, 2024):
Hey thank you for the nice words, and good suggestions.
I can have a look into the email feature this weekend to see what is possible.
In terms of the OIDC I would need to have look since I don't want to make the application to complex and to heavy. There is already an option to disable the built-in auth, this could be used in combination with for example a proxy like: https://docs.goauthentik.io/docs/providers/proxy/
But I do get your point and this has also been asked for before, so I will have a look to see what is possible.
@glenndehaan commented on GitHub (Aug 17, 2024):
Goodmorning,
I have just release version 2.7.3 that contains the mail functionality.
Please checkout the readme on how to configure it: https://github.com/glenndehaan/unifi-voucher-site?tab=readme-ov-file#email-functionality
In regards to the OIDC I need some more time to refactor the application to make that happen. I will keep this issue open to provide updates when I have more news.
@jlengelbrecht commented on GitHub (Aug 17, 2024):
Awesome! Thank you so much for taking the time to implement this. I will test this later tonight and will provide feedback.
@jlengelbrecht commented on GitHub (Aug 18, 2024):
Tested this today. Email system works great. Thanks again.
@aroundmyroom commented on GitHub (Aug 18, 2024):
Maybe a comment to add that if you use TLS (Secure = True) to use port 465 otherwise use port 587?
If not than you will get errors about incorrect SSL.
I understand that this could be 'only for people who understand what they are doing' but otherwise it could give more questions or remarks that it does not work. (both is tested and working here).
@glenndehaan commented on GitHub (Aug 19, 2024):
@aroundmyroom Yeah I get your point. The problem is that this isn't always the case. For example: My SMTP server provider utilizes port 25 but does require TLS (needs Secure = True). Thats why I kept both options open since not all providers are following the 'loose' standard
@glenndehaan commented on GitHub (Aug 23, 2024):
Hi @jlengelbrecht,
I have some good news. After a lot of testing I have finally released version 3.1.0 that now has support for OIDC authentication.
Please have a look at the updated README on how to set it up: https://github.com/glenndehaan/unifi-voucher-site?tab=readme-ov-file#openid-connect-oidc-authentication
Also don't forget If you are still on v2 to read the migration documentation found here: https://github.com/glenndehaan/unifi-voucher-site?tab=readme-ov-file#migration-from-2x-to-3x
@jlengelbrecht commented on GitHub (Aug 25, 2024):
Hi @glenndehaan started testing this but seem to be running into some issues. As I mentioned in my other post I use Unifi's Identity Enterprise as my IDP. From what I can tell implicit flow should be supported.
What does the Redirect url need to be set to in the IDP? I originally thought it would be
https://your-domain.com/vouchersas this is the url you normally land on after signing in but this does not seem to be the case.I have tried using
https://your-domain.com/callback/oidc,https://your-domain.comand a few other iterations but I cant seem to get it to authenticate. Regardless of what i enter for the Redirect URL I get aui.com/portal/fail-info?errorCode=E_U_APP_OIDC_NOT_MATCH_REDIRECT_URLerror.I followed the instructions and updated the values that were included in the upgrade guide but still can't seem to get OIDC sign in to work. Any guidance you could give me as to what I might be doing wrong is much appreciated.
Container logs
@glenndehaan commented on GitHub (Aug 25, 2024):
Hi @jlengelbrecht,
Wow I didn't know UID could act as an OIDC client. What I did within Keycloak and Authentik is set the url as: https://your-domain.com/*
However the direct url should be https://your-domain.com/callback
I hope this helps you
@jlengelbrecht commented on GitHub (Aug 25, 2024):
@glenndehaan Yeah UID Enterprise has a good selection SSO options. It also supports SAML auth.
So i updated the Sign-In Redirect URL to
https://mydomain.com/callbackand the Initiate Sign-In URI tohttps://mydomain.com/loginthe container logs seem to indicate that the app isn't getting the right information from the IDP.Not sure what I am doing wrong.
Container logs
The app now lands on a Bad Request page but the URL seems correct.
@glenndehaan commented on GitHub (Aug 25, 2024):
I have only seen this error once and that had to due with me being silly and restarting the service in between logins. This causes the secret to reset and the cookie to fail. But 3 things seem off here:
and the Initiate Sign-In URI to https://mydomain.com/login, I have not set this up in both Keycloak and Authentik. And I want to understand the flow you are now trying. Are you logging in via UID or via the app itself. The reason I ask has to do with the cookie I mentioned earlyer, that cookie contains thestateand if you now are trying to do a sort of silence sign in via UID I think that won't work.@jlengelbrecht commented on GitHub (Aug 25, 2024):
@glenndehaan So there is no explicit option to set a flow type in UID you can select between OIDC, SAML, or a Shortcut. When you add an app in UID you are given the following options. See screenshot below. It is required that a
Initiate Sign-In URIandSign-In Redirect URLare set in order to use OIDC.I typically access the app via homepage which is outside of UID but I have users using the UID app and accessing the voucher site via UID's apps section. Currently the voucher site is setup as a Shortcut that points at the DNS entry from traefik. From there sign in via password.I have seperate app setup to test OIDC for the voucher site. If i access the app via homepage you are redirected to sign into UID if you have not signed in within the past 4 hours.From there UID redirects you to the app. If you are using UID to access the app you are automatically redirected as no sign in is required as you are already authenticated into UID.
I use wildcard certificates to get SSL certs for my self hosted apps.
Traefik is setup to point at my domain on cloudflare and retrieves wildcard certs from letsencrypt. I don't make any physical changes to apps or containers themself for SSL. Traefik manages all my SSL encryption to my apps.
@glenndehaan commented on GitHub (Aug 26, 2024):
After going through everything you send I think I see the issue. Since they are giving you a Client Secret within UID my guess is they only support Confidential Standard Flow clients. I think I should be able to refactor the client a bit to make that work. One thing I want to make sure is the following, if you open up the
.well-known/openid-configurationwithin you browser can you check the following sections:grant_types_supported,response_types_supported. The output should look something like this:My guess is that your output won't contain:
implicitandid_tokenbut will contain:authorization_codeandcode. If that is the case then I should be able to replicate some things locally. If not then we might have to see if we can schedule some sort of call to debug it on the fly.@glenndehaan commented on GitHub (Aug 26, 2024):
@jlengelbrecht I have just released version 3.3.0. This option now has support for the confidential flow that I think UID needs. Ensure the following environment variables are set:
AUTH_OIDC_CLIENT_SECRETshould contain the secret given by UIDThe full guide can be found here: https://github.com/glenndehaan/unifi-voucher-site#configuration-2
@jlengelbrecht commented on GitHub (Aug 26, 2024):
sorry for the delay. My proxy broke have been trying to figure out why acme can't get new certs. Here is the screenshot of the
well-known/openid-configurationI think your right UID doesn't seem to use implicit flow.@jlengelbrecht commented on GitHub (Aug 26, 2024):
Thank you for updating this. You have put a lot of work into this. I really appreciate it. I will test this shortly still working on getting traefik back up and running.
@jlengelbrecht commented on GitHub (Aug 27, 2024):
@glenndehaan Got my proxy issue sorted. Did some more testing with the new changes you made. Setting the
OIDC_CLIENT_TYPEas confidential. Still getting aerrorCode=E_U_APP_OIDC_NOT_MATCH_REDIRECT_URLerror. Here is what I set my values to. UID requires theInitiate Sign-In URIso I set it to/login. Using/callbackfor the Sign-In Redirect URL doesn't seem to work the confidential flow type. I also tested using a wildcard/*like you recommended earlier. Same result.@jlengelbrecht commented on GitHub (Aug 27, 2024):
@glenndehaan nevermind got it to work using the
confidentialflow. My proxy issue from earlier required me to change my domain. Going over the config I forgot to take out the the old domain from the docker-compose file. I ended up setting the Sign-In Redirect URL to/callbackand the Initiate Sign-In URI tomy-domain.com.OIDC now works from within UID, but when accessing the app via the url from outside of UID, you are still redirected to
https://my-domain.com/loginwhich then asks for a password. Is this expected? The documentation mentions that when OIDC is used the password would be disabled, but this does not seem to be the case.@glenndehaan commented on GitHub (Aug 27, 2024):
@jlengelbrecht That is great to hear. In terms of the original login page. This should indeed be disabled since UID should now handle the authentication even if you direct access the app. Are you dropped onto the app's password only page?
@glenndehaan commented on GitHub (Aug 27, 2024):
Ah also before I forget if you have some time, and are willing to create a small readme on how to configure UID. I want to create a list of 'tested' idP's with some short guides on how to set them up. It would be great if you could provide some details and some screenshots (also since docs about UID are already in short supply) (of course without private info). Could be an MR or just post it here, then I will convert it and will provide credits within the file to you
@jlengelbrecht commented on GitHub (Aug 27, 2024):
@glenndehaan Yeah, if I access the application externally, I am redirected to the login page that you would normally see when you hit access the app without OIDC and am prompted for a password. However, when accessing from within UID, I am signed in automatically.
@jlengelbrecht commented on GitHub (Aug 27, 2024):
@glenndehaan Absolutely. I will create a PR later today or tomorrow for UID. Then, link it back to the main README.md in a table of tested IDPs.
@glenndehaan commented on GitHub (Aug 27, 2024):
That is weird since that view should not even be loaded within the app when the OIDC variables are set. I did read back the whole conversation we had, and at some point you mentioned you had 2 instances running, one with OIDC and one without. Are you sure you are using the one with OIDC enabled? If so could you have a look at the logs on start of the container to see if you get a '[JWT]' message?
@glenndehaan commented on GitHub (Aug 27, 2024):
Thanks man awesome. I will push an update later this evening to add the initial Keycloak and Authentik docs.
@aroundmyroom commented on GitHub (Aug 30, 2024):
@jlengelbrecht @glenndehaan trying to check the manual and test the OIDC with keycloak. I have an up and running SSO with proxmox, so I know that things can work
What do I wrong as I get no login or redirect, I cannot access http://voucher.xxx.net:3000/callback (page not found)
in the log of @jlengelbrecht I see that OIDC is mentioned, but I do not see that.
I do not have docker, so I pass the environment variables through my bin/bash script
all other env. do work: like mail, login etc..
I think this is the part what is necessary
export AUTH_PASSWORD='1234'
export AUTH_DISABLE='false'
export AUTH_OIDC_APP_BASE_URL: 'http://voucher.xxxx.net:3000'
export AUTH_OIDC_CLIENT_TYPE='public'
export AUTH_OIDC_CLIENT_ID: ''
export AUTH_OIDC_ISSUER_BASE_URL='https://sso.xxxx.net/realms/Production/.well-known/openid-configuration'
export AUTH_OIDC_CLIENT_SECRET: ''
When starting my shell, the login page is gone and I am in the app without being authorised (hence I even do not see a logout button)
What part am i missing?
I think I am missing something as I think I need to see that OIDC is enabled like what I saw here above:
2024-08-25 03:46:37.861 INFO [UniFi] Using Controller on: 10.20.66.1:443 (Site ID: default)
2024-08-25 03:46:37.867 INFO [OIDC] Set secret: 8xx352e
2024-08-25 03:46:37.961 INFO [OIDC] Issuer: https://my-domain.ui.com/gw/idp/api/v1/public/oauth/super-secret-token/.well-known/openid-configuration, Client: my-client-id
this I do not see when I start the tool
@glenndehaan commented on GitHub (Aug 30, 2024):
I see a lot of red flags here.
First I need logs. Without logs I don't know what the app is doing. So please strip confidential info and upload the logs of the startup sequence.
Second local hosting without docker as already said within other posts is not recommended since after large refactors code can be messed up of not properly updated. (And the auth refactor was a big one, hence the v3 generation)
Third i'm seeing a mismatch in the app and IdP transport. Your app is now running on http and the IdP on https. This can cause trouble.
Fourth the
AUTH_OIDC_CLIENT_IDcan't be empty. This needs to contain the client id created in keycloak.Fifth you are mixing variables. If you are going to OIDC then drop the
AUTH_PASSWORDandAUTH_DISABLEThese are not required.Sixth the callback url you mentioned is a POST request. This leads me to believe you have not used OAuth before? If that is the case then debugging this will become an issue since this is not an easy topic.
@aroundmyroom commented on GitHub (Aug 30, 2024):
Ok added some items to my script to get proper debugging..
have it working now ..
your input gave me some extra info needed. (remiving the auth_password and auth_disable), Which I probably overlooked reading in the howto.
Thanks ..