Register Guidelines E-Books Search Today's Posts Mark Forums Read

Go Back   MobileRead Forums > E-Book Software > Calibre > Server

Notices

Reply
 
Thread Tools Search this Thread
Old 05-03-2024, 06:55 AM   #1
netchild
Junior Member
netchild began at the beginning.
 
Posts: 8
Karma: 10
Join Date: May 2024
Location: Germany
Device: webserver
External pre-authentication (instead of oauth/oidc)

Hi,

I've read that oauth (or oidc) doesn't seem to be on the plate as an alternative to the existing http auth. What about an optional external pre-authentication method?

What I have in mind is a way to specify for the server to not ask for the http auth (--auth-mode=pre --enable-auth) and to specify which http header is providing the username (--http-user-header=ABC), and the calibre server would blindly use the username from this header without any password. This way a tool in front of calibre (be it apache/nginx/whatever, or an oauth2-proxy) could then authenticate the user and provide access to various libraries via --manage-users (the password part is then useless/ignored in this mode).

To illustrate it a bit more:
- user goes to https://my.calibre.site/
- the webserver/reverse-proxy at my.calibre.site does the TLS handshake, sees the user is not authenticated, and provides a login page to the user without doing any request to the calibre server
- once the webserver/reverse-proxy has authenticated the user, it sets "X-My-Private-HTTP-Header: the-user-name" and makes a request to the calibre server
- the calibre server was configured to not send an http auth required but to use the username from the X-My-Private-HTTP-Header to check the access permissions versus the userdb (without validating/requesting any password itself) and provide only access to those libraries which the user is allowed to see

As an example, the oauth2-proxy on github has the option (https://oauth2-proxy.github.io/oauth...tion/overview/) "pass-user-headers" which then sets the http headers X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username to upstream after authentication. Calibre server could then be configured to use one of those to match against the calibre-internal userdb.

As side notes:
1) Calibre could gain free group management this way (free = no group-management code needed inside calibre), by entering group names inside calibre in the place of user names. By providing a group name by the preauthentication solution in the header field instead of the username the user would be still be authenticated based upon his private password/token, but calibre would only the see group name, match that group name against the username in the userdb, and give access to some of the libraries based upon the --manage-users settings for this username.
2) Depending on what is used to preauthenticate against, there is even free self-service password management/recovery. For some family members this is quite handy sometimes...

Thanks for considering this feature request.
netchild is offline   Reply With Quote
Old 05-03-2024, 07:03 AM   #2
kovidgoyal
creator of calibre
kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.
 
kovidgoyal's Avatar
 
Posts: 44,039
Karma: 22669822
Join Date: Oct 2006
Location: Mumbai, India
Device: Various
Just add the http basic auth header in your frontend.
kovidgoyal is offline   Reply With Quote
Old 05-03-2024, 08:39 AM   #3
netchild
Junior Member
netchild began at the beginning.
 
Posts: 8
Karma: 10
Join Date: May 2024
Location: Germany
Device: webserver
oauth2-proxy has an option to pass a http basic auth header. It also allows to set a generic pw for this header, but it does not use the "preferred username" for the user part. It uses the userid of the authentication provider, and this is an UUID and not an username.

While it is technically possible to add this UUID as an username inside calibre (it works), this is very ugly. Having some readable username instead of a string of random numbers (e.g. 38737660a-df157-2c82-a93c-0c223d6389dc) is much more convenient when configuring access to libraries.
netchild is offline   Reply With Quote
Old 05-03-2024, 10:46 AM   #4
kovidgoyal
creator of calibre
kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.
 
kovidgoyal's Avatar
 
Posts: 44,039
Karma: 22669822
Join Date: Oct 2006
Location: Mumbai, India
Device: Various
I have no clue what oauth-proxy is but surely it has some way to control what goes into the auth header or its basically useless. Maybe find a better proxy.
kovidgoyal is offline   Reply With Quote
Old 05-03-2024, 02:11 PM   #5
netchild
Junior Member
netchild began at the beginning.
 
Posts: 8
Karma: 10
Join Date: May 2024
Location: Germany
Device: webserver
Quote:
Originally Posted by kovidgoyal View Post
I have no clue what oauth-proxy is but surely it has some way to control what goes into the auth header or its basically useless. Maybe find a better proxy.
oauth2-proxy is a tool in the middle of a webserver and a backend (like calibre) to authenticate users. oauth2 / oidc are authentication protocols which require an authentication service as a backend. oauth2-proxy is one of the few open-source solutions in this regard, and of all the OSS solutions I've seen, it is the most capable one.

It is not a normal proxy, it is an authenticator-solution with a pass-through to the real application after successful auth:
user -> webserver -> oauth2-proxy -> sees no auth -> contacts the auth-backend (could be google, github, in my case my own oidc provider which provides multi-factor authentication like google does -> back to oauth2-proxy after successful auth -> pass-through to the backend application (calibre).

oauth2-proxy is mainly for applications which do not have an authentication or user management. And the OIDC / oauth2 single-sign-on possibility is something which is used in a lot of open source solutions. OSS webmail systems (roundcube / nextcloud), photo galleries (piwigo), personal document management systems (paperless-ngx), wordpress, wiki software and much more support oidc / oauth2 either natively or via plugins additionally to their in-build user/auth parts. Some don't, and there oauth2-proxy comes into play.

What oauth2-proxy puts into the username field makes sense, it is the uniq ID of the authentication backend which can not change. The "preferred username" or the email address which the backend provides too can be changed by the user, the ID can't. From an identity and authentication management perspective this is the right thing to do (my day to day job is in IT security, so I have a glue about this topic).

This may seem overkill to you, but it is not overkill to me (my family recipes, family photos, family documents are all protected by the single-sing-on solution). This solution regarding authentication is similar to what calibre is in the ebook world, a powerful and expert solution.

Do I understand you correctly, that you do not consider your powerfull, expert and outstanding ebook management software to be worth to be integrated into an existing, powerfull and expert authentication solution?
netchild is offline   Reply With Quote
Old 05-03-2024, 04:43 PM   #6
Quoth
the rook, bossing Never.
Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.
 
Quoth's Avatar
 
Posts: 11,760
Karma: 87663463
Join Date: Jun 2017
Location: Ireland
Device: All 4 Kinds: epub eink, Kindle, android eink, NxtPaper11
OAuth isn't as good as you think. It's about big corporations tracking and controlling you.

I only use it for desktop email client accessing gmail accounts and only because Google/Alphabet forces this. It's adding nothing except annoyance.
Quoth is offline   Reply With Quote
Old 05-03-2024, 09:32 PM   #7
kovidgoyal
creator of calibre
kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.
 
kovidgoyal's Avatar
 
Posts: 44,039
Karma: 22669822
Join Date: Oct 2006
Location: Mumbai, India
Device: Various
Again, if your oauth proxy software cannot maintain a mapping between whatever uuid it gets from the authentication backend to real usernames and use those real usernames in an auth header, then you need to find a better proxy.

Or write a simple proxy yourself to do that. One that sits in between oauth2-proxy and calibre and rewrites the authentication header.
kovidgoyal is offline   Reply With Quote
Old 05-04-2024, 08:53 AM   #8
netchild
Junior Member
netchild began at the beginning.
 
Posts: 8
Karma: 10
Join Date: May 2024
Location: Germany
Device: webserver
Quote:
Originally Posted by Quoth View Post
OAuth isn't as good as you think. It's about big corporations tracking and controlling you.
How are they tracking and controlling me if I use oauth internally?
Internally = an OSS auth backend (keycloak) which I host on my own hardware which is accessed by OSS frontend software I host on my own hardware, and which can not talk at all with the outside (firewall).

How are they tracking and controlling a corporation which uses commercial oauth software (Okta, OneIdentity, ...) internally for frontends which are hosted internally, which are running on local hardware and firewalled to the outside?

Answer to all above: they don't.

Again, you are mixing up an identity provider implementation (Google, Azure, ...) with the oauth protocol. If you don't use it to get tracked by google, don't use it with anyone except google. Most sites which allow to login with your google account, or facebook account, or whatver identity provider they support, also offer a local login possibility. To my experience this works well (when I can login locally, I do that, so I have experience in this regard).
netchild is offline   Reply With Quote
Old 05-04-2024, 09:20 AM   #9
netchild
Junior Member
netchild began at the beginning.
 
Posts: 8
Karma: 10
Join Date: May 2024
Location: Germany
Device: webserver
Quote:
Originally Posted by kovidgoyal View Post
Again, if your oauth proxy software cannot maintain a mapping between whatever uuid it gets from the authentication backend to real usernames and use those real usernames in an auth header, then you need to find a better proxy.

Or write a simple proxy yourself to do that. One that sits in between oauth2-proxy and calibre and rewrites the authentication header.
Most software has a pre-auth mode where they accept a particular http header or a configurable one as username. That's the reason why I asked here for this kind of feature.

Alright, I understand that you don't want to consider this as a possible feature for calibre and that I need to find a more complicated way.

Thanks for the time you spend answering.
netchild is offline   Reply With Quote
Old 05-05-2024, 10:08 AM   #10
Quoth
the rook, bossing Never.
Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.
 
Quoth's Avatar
 
Posts: 11,760
Karma: 87663463
Join Date: Jun 2017
Location: Ireland
Device: All 4 Kinds: epub eink, Kindle, android eink, NxtPaper11
Quote:
Originally Posted by netchild View Post
How are they tracking and controlling me if I use oauth internally?
They don't. But the only reason to use OAuth is because someone else is forcing it on you. It's pointless if you are in charge. There are loads of less complex solutions, some may even be better security.
Quoth is offline   Reply With Quote
Old 05-05-2024, 10:40 AM   #11
netchild
Junior Member
netchild began at the beginning.
 
Posts: 8
Karma: 10
Join Date: May 2024
Location: Germany
Device: webserver
Quote:
Originally Posted by Quoth View Post
They don't.
You are contradicting yourself.

Quote:
Originally Posted by Quoth View Post
But the only reason to use OAuth is because someone else is forcing it on you. It's pointless if you are in charge. There are loads of less complex solutions, some may even be better security.
I'm open for those less complex OSS solutions which offer SSO, multi-factor, and provide better security, and at the same time have support in wordpress, django, webmail solutions, IMAP, picture galleries, wiki software and so on. Please provide some examples, so far most of the OSS solutions I've found fail either on the multi-factor part (more detailed: on webauthn), or on the integration part.
netchild is offline   Reply With Quote
Reply

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Google Oauth 2.0 for user login MrSamG Server 8 05-03-2024 04:45 PM
Double Authentication dssbob Server 4 09-03-2019 11:45 AM
External Booting for Kobos (aka boot from external SD card) pazos Kobo Developer's Corner 6 02-23-2019 03:39 AM
Handling oAuth APIs tBunnyMan Recipes 4 11-29-2012 03:15 AM
Question: Iliad WiFi connection with 802.1x pre-authentication? obijoe iRex 1 10-30-2007 11:45 AM


All times are GMT -4. The time now is 01:03 PM.


MobileRead.com is a privately owned, operated and funded community.