-
|
Hi, Wondering if anyone can help me? I'm installing FreshRSS with docker and a mariadb database, can get it working beautifully with web based auth (which I used to test FreshRSS itself) behind traefik, but I'm very keen on adding OIDC which I already have implemented with Authelia and successfully working with other applications (gitea, immich, nextcloud, podfetch, synapse) FreshRSS is being served on My docker-compose.yml networks:
freshrss:
external: false
name: freshrss
services:
freshrss:
image: freshrss/freshrss:edge
container_name: freshrss
networks:
- freshrss
- traefik
ports:
- 8003:80
environment:
- TZ=${TZ}
- PUID=${PUID}
- PGID=${PGID}
- CRON_MIN=${CRON_MIN}
- OIDC_ENABLED=${OIDC_ENABLED}
- OIDC_PROVIDER_METADATA_URL=${OIDC_PROVIDER_METADATA_URL}
- OIDC_CLIENT_ID=${OIDC_CLIENT_ID}
- OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET}
# - OIDC_CLIENT_CRYPTO_KEY=${OIDC_CLIENT_CRYPTO_KEY}
- OIDC_REMOTE_USER_CLAIM=${OIDC_REMOTE_USER_CLAIM}
- OIDC_SCOPES=${OIDC_SCOPES}
- OIDC_X_FORWARDED_HEADERS=${OIDC_X_FORWARDED_HEADERS}
volumes:
- ${CONFIG}/freshrss/.htaccess:/var/www/FreshRSS/p/i/.htaccess
- ${CONFIG}/freshrss/.htpasswd:/var/www/FreshRSS/data/.htpasswd
- ${CONFIG}/freshrss/freshrss/data:/var/www/FreshRSS/data
- ${CONFIG}/freshrss/freshrss/extensions:/var/www/FreshRSS/extensions
restart: unless-stopped
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik"
- "traefik.http.services.freshrss.loadbalancer.server.port=80"
- "traefik.http.routers.freshrss.entrypoints=https"
- "traefik.http.routers.freshrss.rule=Host(`freshrss.${TRAEFIK_DOMAIN}`)"
- "traefik.http.routers.freshrss.middlewares=authelia@file, securityHeaders@file"
freshrss-mariadb:
image: lscr.io/linuxserver/mariadb
container_name: freshrss-mariadb
networks:
- freshrss
# ports:
# - 3306:3306
environment:
- TZ=${TZ}
- PUID=${PUID}
- PGID=${PGID}
- MYSQL_ROOT_PASSWORD=${FRESHRSS_MARIADB_ROOT_PASS}
- MYSQL_USER=${FRESHRSS_MARIADB_USER}
- MYSQL_PASSWORD=${FRESHRSS_MARIADB_PASS}
- MYSQL_DATABASE=${FRESHRSS_MARIADB_DB_NAME}
volumes:
- ${CONFIG}/freshrss/freshrss-mariadb:/config
restart: unless-stoppedMy Reading the docs I need to setup FreshRSS with http based auth first so I've volume mounted both:
and can successfully use http auth to login, the contents of each file are:
However once I've completed the initial setup, logged in as
I'm clearly doing something wrong but I don't know what and would really appreciate a second pair of eyes and any suggestions anyone could be kind enough to give. For reference, here's how I currently have the Authelia OIDC client config: - id: freshrss
description: FreshRSS
secret: $pbkdf2-sha512xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
public: false
authorization_policy: one_factor
redirect_uris:
- https://freshrss.DOMAIN.COM/i/oidc/
scopes:
- openid
- groups
- email
- profile
userinfo_signed_response_alg: none |
Beta Was this translation helpful? Give feedback.
Replies: 4 comments 9 replies
-
Beta Was this translation helpful? Give feedback.
-
|
Could you try removing the mount for .htaccess? It's probably overriding the configuration that makes OIDC work: https://github.com/FreshRSS/FreshRSS/blob/edge/Docker/FreshRSS.Apache.conf#L76-L84 PS: do you have a suggestion on how we could improve the documentation to prevent others from running into the same issue (assuming this is indeed the issue)? |
Beta Was this translation helpful? Give feedback.
-
|
@otaconix Just tried that and it's working, thanks. As regards suggestions, I agree the method to get OIDC working is a bit opaque. Ideally there shouldn't be a need to use the http auth method at all, I'm fairly new to OIDC and need to investigate scopes and how to implement them as currently whilst I can login with Authelia to FreshRSS I'm not an admin, and as far as I can tell there's no way to login as my admin user that I created with http aut (which is to be expected) Let me have a think about it and see if I can get scopes working and I'll write something up for the docs. |
Beta Was this translation helpful? Give feedback.
-
|
OK setting I get what they docs are saying now, in a fresh install, last step, create the user (that you've just logged in as using OIDC) and set it to http-auth. I was setting up my initial user with http-auth and then activating all the OIDC stuff. |
Beta Was this translation helpful? Give feedback.
-
|
EDIT: I just now see that you came to the same conclusion. I'll keep this reply anyway, maybe it'll be useful to someone. My apologies, I was a little wrong in my earlier reply. The way you'd set up a new instance is by having all the OIDC environment variables set, then opening the web interface, which will immediately try to log you in. Once you're logged in, you go through the setup wizard, and where it asks you for the default user and authentication method (currently the title of the wizard step is "step 4"), you enter some name for the default user (pick whatever random value, it won't be used as long as you have OIDC enabled), and select the HTTP authentication method. If all is setup correctly, it should show you your current username (it should look like Then you complete the installation, and you're all set: you're logged in, and you're the instance administrator. |
Beta Was this translation helpful? Give feedback.
-
|
This answer helped me a lot! It is worth noting that I only got the initial user to be admin if I actually put in the corresponding oidc user as the default user, eg Ie, 1. have fresh instance, 2. run with oidc env vars, 3. run through setup wizard, 4. put in the correct default user (with random password), 5. select HTTP authenticaion method, 6. profit |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
One last question, what is the purpose of the |
Beta Was this translation helpful? Give feedback.
-
|
This is what the documentation in mod_auth_openidc says:
Seems like it's just supposed to be a random password that is used internally |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
Could you try removing the mount for .htaccess? It's probably overriding the configuration that makes OIDC work: https://github.com/FreshRSS/FreshRSS/blob/edge/Docker/FreshRSS.Apache.conf#L76-L84
PS: do you have a suggestion on how we could improve the documentation to prevent others from running into the same issue (assuming this is indeed the issue)?