Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen angezeigt.

--- content:serverbasics:docker-authentik [2025/04/04 15:31] – [Attaching SPNEGO] Daniel
+++ content:serverbasics:docker-authentik [2025/04/14 19:26] (aktuell) – [Secure LDAP- Users with TOTP] Daniel
@@ Zeile 2: / Zeile 2: @@
 Authentik is a middleware expanding the basic authentication- features of FreeIPA by many additional, modern ways of authentication which is used by modern Software. It will make SSO possible (Single-Sign-On: only logging into your pc will be enough to open all apps) by using the Kerberos-Credentials to login to authentik and than to authenticate the third-aprty app like Nextcloud without any additional User or Password- Dialog.
 ===== Dockerfile =====
@@ Zeile 62: / Zeile 61: @@
     volumes:
       - authentik_pgsql_data:/var/lib/postgresql/data
+      - authentik_backup:/tmp/backup
 #Defined in .env
 #    environment:
@@ Zeile 146: / Zeile 146: @@
 volumes:
   authentik_pgsql_data:
+  authentik_backup:
   authentik_media:
   authentik_custom_templates:
@@ Zeile 171: / Zeile 172: @@
 </file>
 ===== First start =====
@@ Zeile 178: / Zeile 180: @@
 and set the Password for the admin user ''akadmin''.
-===== Additional Doings =====
+===== Backup PostgresSQL Database =====
+This is really VERY Important! The reason is, that every PostgresDB- Version has it own Database- File- Format and if you update Postgres from on Major Version to the next, you WILL NOT BE ABLE to start your DB with the old Volume- Data!
+You NEED to have the DB-Backed up and restored to the next Version!
+Create a File in your Docker- Dir named e.g. ''docker_backup_authentik_db.sh:''
+<file>
+#!/bin/bash
+# Make Postgres-Backup of Authentik
+echo "Backup of authentik-postgres to servername-authentik_pgsql-1:/tmp/backup"
+/home/docker/bin/docker exec -t -e PGPASSWORD=YOURPASSWORD servername-authentik_pgsql-1 pg_dump --compress=zstd:8 -f /tmp/backup/pg_dump_authentik.sql -U authentik authentik
+echo "Done Backup of Authentik-DB."
+</file>
+Now add this script to  ''backup/docker_backup_all.sh'' .
 Don't forget to extend your ''backup/docker_backup_all.sh'' by adding ''authentik'' to the service- list if you have not done so far.
+If you Update the Major- Version, make sure to create a new Volume for your pgsql- data.
 ===== Configuring =====
@@ Zeile 190: / Zeile 212: @@
 To Sync FreeIPA with Authentik, follow this Guide: [[https://docs.goauthentik.io/docs/users-sources/sources/directory-sync/freeipa/|https://docs.goauthentik.io/docs/users-sources/sources/directory-sync/freeipa/]]
+When the Sync has been configured, all FreeIPA- Users should show up in Authentik.
 After SVC- user is created, use the following commands to modify password reset as written in the doc:
@@ Zeile 210: / Zeile 234: @@
 which should show the entry for ''passsyncmanagersdns'' .
+=== Secure LDAP- Users with TOTP ===
+Now any User can login with its FreeIPA- Password, also if SPNEGO/ kerberos as beneath is not setup yet.
+This is quite insecure, so you shoul add a second factor for that type of Login (for SPNEGO the second factor is your integrated Machine, which has the key stored already).
+To do so, in the Autentik Admin- Panel go to Stages and edit the Stage "default-authentication-mfa-validation"\\
+Change "Not configured action" → Force…\\
+At "Configuration stages" → default.authenticator-totp-setup
+The Next time you are logging in with User and Password in Authentik, it will ask to setup a TOTP- Device. You can for example use [[https://f-droid.org/de/packages/org.liberty.android.freeotpplus/|https://f-droid.org/de/packages/org.liberty.android.freeotpplus/]]
+Hint: There is also an default Flow for this to import in Authentik here [[https://docs.goauthentik.io/docs/add-secure-apps/flows-stages/flow/examples/flows#two-factor-login|https://docs.goauthentik.io/docs/add-secure-apps/flows-stages/flow/examples/flows#two-factor-login]]
+== Current Bug ==
+At the time of writing this, there was a bug here: https://github.com/goauthentik/authentik/issues/5972#issuecomment-2075631779
+So if you have to enter the OTP twice, than go to Flows, click on ''default-authentication-flow'', Tab Stage Bindings and delete the ''default-authentication-mfa-validation'' Stage (not the other MFA!)
@@ Zeile 239: / Zeile 282: @@
 This is the Keytab (a better "Password") that you will use for SPNEGO in Authentik.
-Use the Servicename ''HTTP/authentik.domain.tld''  as the Servername!
+Use the Servicename ''HTTP@authentik.domain.tld''  as the Servername!
 Important: Use "User matching mode" = "Link to User with identical Username. …“ - otherwise Kerberos may fail!