Welcome to tinyauth Discussions!

[steveiliop56]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about what you do with this community.

[mikeofree]

Any plans for Nginx Proxy Manager support in the future?

[steveiliop56]

It is actually implemented in tinyauth :). It will be released with the next version v3.0.0 (breaking unfortunately). I am on mobile right now so I can't link the commit.

[gurukulkarni]

Hey Slow down take your time, don't burn yourself out, but kudos for a nice project that is quite useful and usable everywhere 🚀

[Saisamarth21]

Hi, I'm running the Glance dashboard in Docker and have set up a reverse proxy using Nginx Proxy Manager. How can I add tinyauth authentication to the dashboard using my existing Nginx Proxy Manager?

[Saisamarth21]

Do I have to delete and re-setup Nginx Proxy Manager? I have around 15 reverse proxies configured with SSL certificates. Will I need to reconfigure all of them if I do?

[steveiliop56]

Nope, just add a new proxy host pointing to tinyauth and edit your glance one to include the advanced config mentioned in the documentation.

[Saisamarth21]

Hi,

I tried setting up Tinyauth on my Glance dashboard using nginx proxy manager, and Tinyauth is working fine at https://tinyauth.mydomain.duckdns.org/ on port 3000.

At https://tinyauth.mydomain.duckdns.org/login?redirect_uri=null, I am able to log in and log out. I have disabled "Cache Assets," "WebSockets Support," and "Block Common Exploits." Additionally, I added an SSL certificate and enabled "Force SSL" and "HTTP/2 Support."

However, for the Glance dashboard proxy at https://glance.mydomain.duckdns.org/, set to port 8080, I have enabled only "WebSockets Support" and "Block Common Exploits." I also added an SSL certificate and enabled "Force SSL" and "HTTP/2 Support."

I added the following config under Advanced Settings:

location / {
    proxy_pass          $forward_scheme://$server:$port;     
    auth_request        /tinyauth;                           
    error_page 401      = @tinyauth_login;                    
}

location /tinyauth {
    proxy_pass          http://tinyauth:3000/api/auth/nginx;  
    proxy_set_header    x-forwarded-proto $scheme;            
    proxy_set_header    x-forwarded-host  $http_host;         
    proxy_set_header    x-forwarded-uri   $request_uri;       
}

location @tinyauth_login {
    return 302 https://tinyauth.mydomain.duckdns.org/login?\ 
    redirect_uri=$scheme://$http_host$request_uri;          
}

After applying this configuration, my Glance proxy went offline. Could you help me fix this issue?

[hitafer]

How did you configure tinyauth.mydomain? With the container name or the IP address?

Perhaps you could try using your IP address in the proxy_pass line instead of tinyauth:3000. That worked for me, since I run tinyauth in a different LXC container than my apps.

[Saisamarth21]

I tried setting up proxy for TinyAuth using the IP address instead of the container name, but I couldn't access the site. I received a "502 Bad Gateway" error.

[hitafer]

Maybe you have a typo somewhere in your config

This is my compose-file i use tinyauth with Github OAuth

 tinyauth:
    image: ghcr.io/steveiliop56/tinyauth:v3
    container_name: tinyauth
    restart: unless-stopped
    ports:
      - 3000:3000
    environment:
      - SECRET=${SECRET}
      - APP_URL=https://tinyauth.${DOMAIN}
      - LOG_LEVEL=0
      - DISABLE_CONTINUE=false
      - LOGIN_MAX_RETRIES=3
      - LOGIN_TIMEOUT=300
      - OAUTH_WHITELIST=${OAUTH_WHITELIST}
      - GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID}
      - GITHUB_CLIENT_SECRET=${GITHUB_CLIENT_SECRET}

this is my tinyauth.mydomain.duckdns.org setting for npm:

i configurate my app in npm like this

with this in the advanced tab

# Root location
location / {
  # Pass the request to the app
  proxy_pass          $forward_scheme://$server:$port;

  # Add other app specific config here

  # Tinyauth auth request
  auth_request /tinyauth;
  error_page 401 = @tinyauth_login;
}

# Tinyauth auth request
location /tinyauth {
  # Pass request to tinyauth
  proxy_pass http://IP-TO-TINYAUTH:3000/api/auth/nginx;

  # Pass the request headers
  proxy_set_header x-forwarded-proto $scheme;
  proxy_set_header x-forwarded-host $http_host;
  proxy_set_header x-forwarded-uri $request_uri;
}

# Tinyauth login redirect
location @tinyauth_login {
  return 302 https://tinyauth.MYDOMAIN.duckdns.org/login?redirect_uri=$scheme://$http_host$request_uri; 
}

[Saisamarth21]

It’s working! Thank you so much for taking the time to help me.

[hitafer]

I'm glad I could help you 😊

[DyArt]

Is there any way to get the groups from Microsoft Entra in Tinyauth. GENERIC_SCOPES groups doesn't exist in Entra, I can get Group.Read.All as scope. Keycloack can match groups. https://news.lavx.hu/article/seamlessly-integrate-azure-entra-id-with-keycloak-a-step-by-step-guide

[steveiliop56]

From the tutorial you linked, it seems to be possible to just do GENERIC_SCOPES=openid email profile groups. If that's not the case then unfortunately I can't do much because I don't have access to Microsoft Entra as it seems to be a business feature?