SSO with apps through Nginx Proxy Manager

[primal plover]

I have recently set up Nginx Proxy Manager to remotely access resources on my LAN. None of these resources (unfortunately) are able to use LDAP, OAuth etc. I followed the guide by Cooptonian (https://www.youtube.com/watch?v=Nh1qiqCYDt4&t=304s) so Authentik handles the logins.

My initial understanding of Authentik was that I would be able to have “X” amount of apps using Authentik, and once authenticated on one of them, any other queries to another app handled by Authentik would check the authentication state and let me through.

At the minute, if I authenticate on app1.domain.com, I still have to authenticate on app2.domain.com and so on.

Have I completely misunderstood how Authentik, and maybe SSO, works with this or is there a way for me to achieve what I want?

Thanks in advance!

[buoyant basalt]

From my understanding of Authentik, I could be wrong on this, but with every application or sub domain, you need to authenticate to it. In your Authentik User Settings you will see a Consent Tab. This shows you which applications or sub domains you have authenticated to and have allowed Authentik to temporarily store your credentials for that particular application with your user.

I also don't use a middle man like Traefik or NPM.

If any of your applications use basic authentication (a browser pop up usually) that asks for credentials you can follow this guide to allow authentik to automatically log you in.

https://youtu.be/S-CIGno0cdw?si=zZZJHmRI4T-IQwzw

[idle hull]

When you say you have to authenticate again, do you mean full login to authentik with username and password, or just "approve" the login to the app?

[buoyant basalt]

It depends on how long of a duration it has been between sessions. But for me, it will usually just ask for a reapproval to login to the app. If you setup your application provider Authorization Flow with default-provider-authorization-implicit-consent it should be like an "invisible" login prompt where it will push through the credentials and then just take you to what you want. If you use the explicit-consent one then a diaglog box pops up between authentication and your app and will make the user confirm the login process.

Either of these methods should just require you to sign in to Authentik then it should automagically take you to your app, as long as everything was setup correctly.

Depending on your token validity length and maybe some caching issues, the reapproval of logging into another app, at least for me, only happens about once a week, and I haven't had to relogin into my Authentik in at least a couple of weeks.

Hope I explained that good enough.

[idle hull]

Absolutely, although I also understand this is how that works. I asked OP since it sounds like they may have the explicit consent flow checked, not implicit consent. Great explanation though 😄

[buoyant basalt]

Haha. I didnt realize you weren't the OP. Haha. My bad.

[idle hull]

All good, we're just trying to help each other out here

[buoyant basalt]

For sure.

[primal plover]

@idle hull @buoyant basalt

Currently, all of my Providers are set to explicit consent. Authentic requires a full login (email/user + password) before forwarding me on to the requested domain.

Should I change them to Implicit and see if that makes a difference?

[buoyant basalt]

It doesn't hurt to try on one of them to test and see if that is what you were trying to achieve.

[idle hull]

I use Implicit and don't have the behavior you described, so I think it's worth a shot as pickit said

[primal plover]

@buoyant basalt @idle hull
So, i set all my Providers to Implicit and it does seem to have worked, but only on my laptop (Mac). My phone (iPhone) still requires full login for each domain which is weird. Not tested anything else yet. I'm gonna keep playing around with all the settings and stuff to see what i can change to suit me better, but at least I accomplished it for one device!