#OAuth2 / SSO Setup for Seafile Guide:

1 messages · Page 1 of 1 (latest)

grim herald
#

OAuth2 / SSO Setup for Seafile Guide:

Since no Guide for integration exists for Seafile over at Authentik docs this here will help you out:

Step (A). Setup a OAuth Provider in Authentik:

  1. Applications -> Providers -> Add Provider
  2. Name: Seafile-oauth2-provider
  3. Authorization flow -> default-provider-authorization-implicit-consent (Authorize Application)
  4. Client type: Confidential
  5. Client ID: <client_id>
  6. Client Secret: <client_secret>
  7. Redirect URIs/Origins (RegEx): https://<seafile.domain.com>/oauth/callback/
  8. Scopes: email, openid, profile
  9. Leave the rest as default and save

Step (B). Setup an Application in Authentik:

  1. Applications -> Applications -> Add Application
  2. Name: Seafile
  3. Slug: seafile-oauth-application-slug
  4. Provider: Seafile-oauth2-provider
  5. Save

Step (C). Edit the Seafile Configuration:

  1. Open the Seafile configuration file: /seafile-data/seafile/conf/seahub_settings.py
    this is path you set bind to "/shared" on your seafile docker compose file
#
  1. Add the following lines to the end of the seahub_settings.py file:
# <-_-_-_-_-_-_-_-_-_-_-> OAuth2 <-_-_-_-_-_-_-_-_-_-_-> #
ENABLE_OAUTH = True

# If create new user when he/she logs in Seafile for the first time, defalut `True`.
OAUTH_CREATE_UNKNOWN_USER = True

# If active new user when he/she logs in Seafile for the first time, defalut `True`.
OAUTH_ACTIVATE_USER_AFTER_CREATION = True

# Usually OAuth works through SSL layer. If your server is not parametrized to allow HTTPS, some method will raise an "oauthlib.oauth2.rfc6749.errors.InsecureTransportError". Set this to `True` to avoid this error.
OAUTH_ENABLE_INSECURE_TRANSPORT = True

# Client id/secret generated by authorization server when you register your client application.
OAUTH_CLIENT_ID = "<client_id>"
OAUTH_CLIENT_SECRET = "<client_secret>"

# Callback url when user authentication succeeded. Note, the redirect url you input when you register your client application MUST be exactly the same as this value.
OAUTH_REDIRECT_URL = 'https://<seafile.domain.com>/oauth/callback/'

# The following should NOT be changed if you are using Github as OAuth provider.
# OAUTH_PROVIDER_DOMAIN = 'goauthentik.io' 
OAUTH_PROVIDER_DOMAIN = 'domain.com' 

OAUTH_AUTHORIZATION_URL = 'https://<auth.domain.com>/application/o/authorize/'
OAUTH_TOKEN_URL = 'https://<auth.domain.com>/application/o/token/'
OAUTH_USER_INFO_URL = 'https://<auth.domain.com>/application/o/userinfo/'
OAUTH_SCOPE = ["email", "openid", "profile"]
OAUTH_ATTRIBUTE_MAP = {
    # "id": (False, "not used"),
    "name": (False, "name"),
    "email": (True, "contact_email"),
    # "uid": (False, "preferred_username"),
    "sub": (True, "uid"),
}

# LOGIN_URL forces oauth as the default login method.
LOGIN_URL = 'https://<seafile.domain.com>/oauth/login/'

# <-_-_-_-_-_-_-_-_-_-_-> \OAuth2 <-_-_-_-_-_-_-_-_-_-_-> #
#
  1. Save the file and restart the Seafile docker container.
docker compose down && \
docker compose up -d
  1. Now you can login to Seafile using Authentik OAuth2 SSO Button on the login page.