Authelia: How to disable Two Factor Registration?

[jrruethe]

TLDR; When specifying one_factor, Authelia is still asking me to register a "One Time Password".

Hello, I've been working on getting Authelia set up to protect my server.
I would like to use Authelia in one_factor mode (username and password), I don't want users to be required to register a second factor.

In my config file, I have set up the relevant section like this:

access_control:
  default_policy: deny
  rules:

    - domain: private.jrruethe.com
      policy: deny

    - domain: private.jrruethe.com
      policy: one_factor
      networks:
        - 192.168.1.0/24

    - domain: public.jrruethe.com
      policy: bypass

My goal here is to have "public.jrruethe.com" be available to everyone publicly, while "private.jrruethe.com" can only be accessed from the 192.168.1.0/24 network with a username/password, and outside that network the request is blocked.

I have also configured Authelia to use my FreeIPA instance for LDAP, and I believe that this connection is working.

The issue I am running into is that when I visit "private.jrruethe.com" from the 192.168.1.0/24 network, I am prompted for my username and password (which I enter), then Authelia asks me for a "One Time Password" with a link that says "Register New Device". I am using the file-based notifier, so I am able to register, then see the notification on the filesystem, however I am not specifying "two_factor" anywhere in my config file, so I don't understand why it is requiring me to register and provide the second factor.

I was hoping to use Authelia as a sort of "single sign on" in front of my Traefik reverse proxy, in a way where I could create users for my family in FreeIPA and allow them to sign on once through Authelia. I don't want to force the requirement of having each family member "register" a new device, and I thought that "one_factor" mode would allow this.

Is this behavior expected? Or do I have something misconfigured?
Thank you for your time

[jrruethe]

I have been playing with the config file and reading the logs, but I still cannot figure out why Authelia is still asking for me to register a second factor when I have it configured it for one_factor mode.

I am using the latest "clems4ever/authelia" Docker image. My reverse proxy is Traefik, and I have the following services running:

• auth.jrruethe.com : Authelia
• admin.jrruethe.com : The service I want to protect with Authelia
• test.jrruethe.com : A test service

For "admin" and "test", I have set the following Traefik label:
traefik.frontend.auth.forward.address : http://auth.jrruethe.com/api/verify?rd=https://auth.jrruethe.com/#/

My config file is now set to this:

access_control:
  default_policy: deny
  rules:

    - domain: admin.jrruethe.com
      policy: deny

    - domain: admin.jrruethe.com
      policy: one_factor
      networks:
        - 192.168.1.0/24

    - domain: auth.jrruethe.com
      policy: bypass

    - domain: test.jrruethe.com
      policy: bypass

I have verified that "test.jrruethe.com" works fine. When I go to "admin.jrruethe.com", I am presented with the "first factor" login screen. After entering my username and password, Authelia asks me for a "one time password".

I have tried repeating this with a fresh Docker instance, so the volume is cleared out, and I have even gone into the Redis cache and remove all sessions. Even though Authelia is configured with "one_factor", it is asking me to register for a second factor.

Below is the log:

debug: date='Wed Jul 17 2019 22:30:02 GMT+0000 (UTC)' method='GET', path='/api/verify' requestId='31639ac4-7e8f-40b0-a767-aa9310c38c5a' sessionId='UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z' ip='192.168.1.4' message='Headers = {"host":"auth:9091","user-agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:67.0) Gecko/20100101 Firefox/67.0","accept":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.5","cookie":"authelia_session=s%3AztOxK7AxG34xKXz01TKAYMn0ARuoiibh.4iFWX6ltgtQLV5XBz2VbUW9H4%2FYW%2F2R6z6S6T%2BsCIYc","dnt":"1","upgrade-insecure-requests":"1","x-forwarded-for":"192.168.1.4","x-forwarded-host":"admin.jrruethe.com","x-forwarded-method":"GET","x-forwarded-proto":"https","x-forwarded-uri":"/"}'
debug: date='Wed Jul 17 2019 22:30:02 GMT+0000 (UTC)' method='GET', path='/api/verify' requestId='31639ac4-7e8f-40b0-a767-aa9310c38c5a' sessionId='UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z' ip='192.168.1.4' message='Authentication session UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z was undefined. Resetting... If it's unexpected, make sure you are visiting the expected domain.'
debug: date='Wed Jul 17 2019 22:30:02 GMT+0000 (UTC)' method='GET', path='/api/verify' requestId='31639ac4-7e8f-40b0-a767-aa9310c38c5a' sessionId='UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z' ip='192.168.1.4' message='Header x-forwarded-proto is set to https'
debug: date='Wed Jul 17 2019 22:30:02 GMT+0000 (UTC)' method='GET', path='/api/verify' requestId='31639ac4-7e8f-40b0-a767-aa9310c38c5a' sessionId='UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z' ip='192.168.1.4' message='Header x-forwarded-host is set to admin.jrruethe.com'
debug: date='Wed Jul 17 2019 22:30:02 GMT+0000 (UTC)' method='GET', path='/api/verify' requestId='31639ac4-7e8f-40b0-a767-aa9310c38c5a' sessionId='UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z' ip='192.168.1.4' message='Header x-forwarded-uri is set to /'
debug: date='Wed Jul 17 2019 22:30:02 GMT+0000 (UTC)' method='GET', path='/api/verify' requestId='31639ac4-7e8f-40b0-a767-aa9310c38c5a' sessionId='UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z' ip='192.168.1.4' message='domain=admin.jrruethe.com, path=/, user=unknown, groups=unknown, ip=192.168.1.4'
debug: date='Wed Jul 17 2019 22:30:02 GMT+0000 (UTC)' method='GET', path='/api/verify' requestId='31639ac4-7e8f-40b0-a767-aa9310c38c5a' sessionId='UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z' ip='192.168.1.4' message='Header x-forwarded-proto is set to https'
debug: date='Wed Jul 17 2019 22:30:02 GMT+0000 (UTC)' method='GET', path='/api/verify' requestId='31639ac4-7e8f-40b0-a767-aa9310c38c5a' sessionId='UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z' ip='192.168.1.4' message='Header x-forwarded-host is set to admin.jrruethe.com'
debug: date='Wed Jul 17 2019 22:30:02 GMT+0000 (UTC)' method='GET', path='/api/verify' requestId='31639ac4-7e8f-40b0-a767-aa9310c38c5a' sessionId='UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z' ip='192.168.1.4' message='Header x-forwarded-uri is set to /'
error: date='Wed Jul 17 2019 22:30:02 GMT+0000 (UTC)' method='GET', path='/api/verify' requestId='31639ac4-7e8f-40b0-a767-aa9310c38c5a' sessionId='UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z' ip='192.168.1.4' message='Error: User 'unknown' is not sufficiently authorized to access admin.jrruethe.com/.'
debug: date='Wed Jul 17 2019 22:30:02 GMT+0000 (UTC)' method='GET', path='/api/verify' requestId='31639ac4-7e8f-40b0-a767-aa9310c38c5a' sessionId='UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z' ip='192.168.1.4' message='Redirecting to https://auth.jrruethe.com/#/?rd=https://admin.jrruethe.com/'
debug: date='Wed Jul 17 2019 22:30:04 GMT+0000 (UTC)' method='GET', path='/api/state' requestId='85c65dc1-1d9b-4395-a7ad-b84597c2e029' sessionId='UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z' ip='192.168.1.4' message='Headers = {"host":"auth.jrruethe.com","user-agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:67.0) Gecko/20100101 Firefox/67.0","accept":"*/*","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.5","cookie":"authelia_session=s%3AUOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z.fiNs6Sgt2lujQaJQYCNyI89qpeYwZCWbJA4LVFnlFsg","dnt":"1","if-none-match":"W/\"68-yuPI5iVko62JPo/teP/2/jHA6qU\"","referer":"https://auth.jrruethe.com/","te":"trailers","x-forwarded-for":"192.168.1.4","x-forwarded-host":"auth.jrruethe.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-forwarded-server":"route","x-real-ip":"192.168.1.4"}'
debug: date='Wed Jul 17 2019 22:30:21 GMT+0000 (UTC)' method='POST', path='/api/firstfactor' requestId='5124a07c-868c-4791-aa06-d7fc2cd9fb31' sessionId='UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z' ip='192.168.1.4' message='Headers = {"host":"auth.jrruethe.com","user-agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:67.0) Gecko/20100101 Firefox/67.0","content-length":"74","accept":"application/json","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.5","content-type":"application/json","cookie":"authelia_session=s%3AUOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z.fiNs6Sgt2lujQaJQYCNyI89qpeYwZCWbJA4LVFnlFsg","dnt":"1","origin":"https://auth.jrruethe.com","referer":"https://auth.jrruethe.com/","te":"trailers","x-forwarded-for":"192.168.1.4","x-forwarded-host":"auth.jrruethe.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-forwarded-server":"route","x-real-ip":"192.168.1.4","x-target-url":"https://admin.jrruethe.com/"}'
info: date='Wed Jul 17 2019 22:30:21 GMT+0000 (UTC)' method='POST', path='/api/firstfactor' requestId='5124a07c-868c-4791-aa06-d7fc2cd9fb31' sessionId='UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z' ip='192.168.1.4' message='Starting authentication of user "jrruethe"'
info: date='Wed Jul 17 2019 22:30:21 GMT+0000 (UTC)' method='POST', path='/api/firstfactor' requestId='5124a07c-868c-4791-aa06-d7fc2cd9fb31' sessionId='UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z' ip='192.168.1.4' message='No regulation applied.'
debug: LDAP: Bind user 'uid=huevos,cn=users,cn=accounts,dc=jrruethe,dc=com'
debug: Computed users filter is uid=jrruethe
debug: LDAP: searching for user dn of jrruethe
debug: LDAP: retrieved user dn is uid=jrruethe,cn=users,cn=accounts,dc=jrruethe,dc=com
debug: LDAP: Bind user 'uid=jrruethe,cn=users,cn=accounts,dc=jrruethe,dc=com'
debug: LDAP: Unbind user 'uid=jrruethe,cn=users,cn=accounts,dc=jrruethe,dc=com'
debug: Computed users filter is uid=jrruethe
debug: LDAP: searching for user dn of jrruethe
debug: Computed users filter is uid=jrruethe
debug: LDAP: searching for user dn of jrruethe
debug: LDAP: retrieved user dn is uid=jrruethe,cn=users,cn=accounts,dc=jrruethe,dc=com
debug: LDAP: retrieved user dn is uid=jrruethe,cn=users,cn=accounts,dc=jrruethe,dc=com
debug: Computed groups filter is (&(member=uid=jrruethe,cn=users,cn=accounts,dc=jrruethe,dc=com)(objectclass=groupOfNames))
debug: LDAP: emails of user 'jrruethe' are [email protected]
debug: LDAP: groups of user jrruethe are [ipausers,rw]
debug: LDAP: Unbind user 'uid=huevos,cn=users,cn=accounts,dc=jrruethe,dc=com'
debug: date='Wed Jul 17 2019 22:30:22 GMT+0000 (UTC)' method='POST', path='/api/firstfactor' requestId='5124a07c-868c-4791-aa06-d7fc2cd9fb31' sessionId='UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z' ip='192.168.1.4' message='Mark successful authentication to regulator.'
info: date='Wed Jul 17 2019 22:30:22 GMT+0000 (UTC)' method='POST', path='/api/firstfactor' requestId='5124a07c-868c-4791-aa06-d7fc2cd9fb31' sessionId='UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z' ip='192.168.1.4' message='LDAP binding successful. Retrieved information about user are {"groups":["ipausers","rw"],"emails":["[email protected]"]}'
debug: date='Wed Jul 17 2019 22:30:22 GMT+0000 (UTC)' method='POST', path='/api/firstfactor' requestId='5124a07c-868c-4791-aa06-d7fc2cd9fb31' sessionId='UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z' ip='192.168.1.4' message='Header x-target-url is set to https://admin.jrruethe.com/'
debug: date='Wed Jul 17 2019 22:30:22 GMT+0000 (UTC)' method='GET', path='/api/state' requestId='aecbfb3c-d0e0-46ec-821e-172c9cf82d40' sessionId='UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z' ip='192.168.1.4' message='Headers = {"host":"auth.jrruethe.com","user-agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:67.0) Gecko/20100101 Firefox/67.0","accept":"*/*","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.5","cookie":"authelia_session=s%3AUOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z.fiNs6Sgt2lujQaJQYCNyI89qpeYwZCWbJA4LVFnlFsg","dnt":"1","if-none-match":"W/\"52-M5Mkw/LnC35BdvXf191mk2fm7HM\"","referer":"https://auth.jrruethe.com/","te":"trailers","x-forwarded-for":"192.168.1.4","x-forwarded-host":"auth.jrruethe.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-forwarded-server":"route","x-real-ip":"192.168.1.4"}'
debug: date='Wed Jul 17 2019 22:30:22 GMT+0000 (UTC)' method='GET', path='/api/secondfactor/preferences' requestId='5e294710-4b16-4b01-9f3b-63c2117774a6' sessionId='UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z' ip='192.168.1.4' message='Headers = {"host":"auth.jrruethe.com","user-agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:67.0) Gecko/20100101 Firefox/67.0","accept":"*/*","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.5","cookie":"authelia_session=s%3AUOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z.fiNs6Sgt2lujQaJQYCNyI89qpeYwZCWbJA4LVFnlFsg","dnt":"1","if-none-match":"W/\"2-vyGp6PvFo4RvsFtPoIWeCReyIC8\"","referer":"https://auth.jrruethe.com/","te":"trailers","x-forwarded-for":"192.168.1.4","x-forwarded-host":"auth.jrruethe.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-forwarded-server":"route","x-real-ip":"192.168.1.4"}'
debug: date='Wed Jul 17 2019 22:30:22 GMT+0000 (UTC)' method='GET', path='/api/secondfactor/available' requestId='221b0025-95e9-4044-8aa8-2822c3a88347' sessionId='UOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z' ip='192.168.1.4' message='Headers = {"host":"auth.jrruethe.com","user-agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:67.0) Gecko/20100101 Firefox/67.0","accept":"*/*","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.5","cookie":"authelia_session=s%3AUOTSPY9pPjLaYdOTHKY0r1RCu5UhdQ3z.fiNs6Sgt2lujQaJQYCNyI89qpeYwZCWbJA4LVFnlFsg","dnt":"1","if-none-match":"W/\"e-QsPuhBabBK8ps0jrOkNEROmF/5M\"","referer":"https://auth.jrruethe.com/","te":"trailers","x-forwarded-for":"192.168.1.4","x-forwarded-host":"auth.jrruethe.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-forwarded-server":"route","x-real-ip":"192.168.1.4"}'

I noticed the GET requests /api/secondfactor/preferences and /api/secondfactor/available. I used Firefox's network developer tool to read the responses of those GET requests. preferences just returns {}, while available returns ["u2f","totp"].

What am I missing?

[jrruethe]

After playing around with this some more, I think I found my error:

    - domain: admin.jrruethe.com
      policy: deny

    - domain: admin.jrruethe.com
      policy: one_factor
      networks:
        - 192.168.1.0/24

My intention with this was to allow password-based authentication when on the 192.168.1.0/24 network, and deny access when on any other network.

For some reason, this was causing Authelia to ask me for user/pass, then required me to register my token, and finally it just left me stuck on the "jrruethe is authenticated" page without redirection.

I dug into the logs some more and saw an error about how "jrruethe is not authorized to access admin.jrruethe.com", so I took that first block out, and everything started working, including redirection.

After changing that block to be like the below, everything works. I can't believe I didn't figure that out earlier!

    - domain: admin.jrruethe.com
      policy: one_factor
      networks:
        - 192.168.1.0/24

Thanks again for making Authelia!

[It4lik]

Hi ! I have the same problem here, here is my config :

access_control:
  default_policy: "one_factor"
  rules:
    - domain: "*.<DOMAIN>"
      policy: "one_factor"
    - domain: "traefik.<DOMAIN>"
      policy: "one_factor"
    - domain: "auth.<DOMAIN>"
      policy: "one_factor"

After the first LDAP authent, Authelia keeps asking me for a One-time password (I can also choose U2F)
I mean, what can I do more ? I commented out everything except general conf, LDAP conf and this excerpt above. Why is 2FA still enabled ?