Authelia: SSO for Authentication

Created on 3 Sep 2020 · 5Comments · Source: authelia/authelia

Currently, we're using Apache AuthType Kerberos to provide authentication on an application, with AuthLdap* attributes to provide authorization with LDAP groups after the authentication is complete.

Authelia can currently replace this functionality in almost every way, except that it requires entering of credentials to provide the authentication step.

It would be awesome of Kerberos and/or SAML support could be added for zero-touch authentication (authorization could continue with LDAP with no changes once you've found the username). This would allow - for example - domain joined computers to have zero touch sign on if there's no 2fa enabled, or a direct jump to the 2fa if it is enabled, bypassing the credential collection for LDAP.

If kerberos failed, for some reason, it could then fall back to LDAP cred collection.

Feature Request P3

Source

benyanke

👍3

Most helpful comment

We could implement this, would require a bit of research and by default I think it should be disabled with a configuration option to enable it.

james-d-elliott on 10 Sep 2020

👍2

All 5 comments

We could implement this, would require a bit of research and by default I think it should be disabled with a configuration option to enable it.

james-d-elliott on 10 Sep 2020

👍2

Absolutely - implementing as an optional choice would be default.

I may also start working on a PR if you'd be open to it. I have a proof of concept for kerberos working, and may look at SAML at some point as well (though sadly it's a bit more complex).

benyanke on 18 Sep 2020

We'd 100% be open to a PR. Please make sure you use a branch like feature-kerberos-support instead of master.

james-d-elliott on 19 Sep 2020

👍1

Hi @benyanke. I'm searching if there is any SAML support in Authelia and found this thread.

Is there any progress? I also want to use this feature so if possible or necessary, I can join the development.