Authelia: question: rbac roles/groups

[greenpau]

Is there a concept of roles/groups when authelia grants a token? I maintain caddy-auth-jwt plugin and the question came up whether the tokens issues by authelia could be used with the plugin. My understanding is that the answer is yet. However, I was not sure whether authelia provides RBAC info. The plugin looks at the following info to determine user roles: https://github.com/greenpau/caddy-auth-jwt#sources-of-role-information.

[clems4ever]

Hello @greenpau , authelia does not handle JWT authentication tokens, it does use JWT for other purposes though.

However, JWT as authentication will likely be introduced with the introduction of OpenID Connect in Authelia. Stay tuned on https://github.com/authelia/authelia/issues/189

[greenpau]

@clems4ever , what I meant is “does it issue jwt tokens” (appears yes) and If so “does it include role/group info in the tokens” (appers no).

[nightah]

Hello @greenpau, so to answer your question it depends entirely on how the upstream authentication backend and user are configured.
Groups specified in the LDAP (which the user is a member of) or file based backend are included, but that doesn't necessarily mean that they're tied to an ACL in Authelia.

Authelia was designed originally with the ngx_http_auth_request_module in mind.

The ngx_http_auth_request_module module (1.5.4+) implements client authorization based on the result of a subrequest. If the subrequest returns a 2xx response code, the access is allowed. If it returns 401 or 403, the access is denied with the corresponding error code. Any other response code returned by the subrequest is considered an error.

While it's likely that Authelia could potentially work with caddy-auth-jwt, it wouldn't work based on the core integration principal which the application was designed with.
Ideally for Authelia and Caddy integration we would be looking to integrate with a similar type of module/plugin, this will make the behaviour consistent with the current integrations for nginx, Traefik and HAProxy.

[greenpau]

Ideally for Authelia and Caddy integration we would be looking to integrate with a similar type of module/plugin, this will make the behaviour consistent with the current integrations for nginx, Traefik and HAProxy.

@nightah , thank you for the explanation! I think the caddy plugin would work find with Aurelia.