Welcome to tinyauth Discussions!

[steveiliop56]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about what you do with this community.

[mikeofree]

Any plans for Nginx Proxy Manager support in the future?

[steveiliop56]

It is actually implemented in tinyauth :). It will be released with the next version v3.0.0 (breaking unfortunately). I am on mobile right now so I can't link the commit.

[gurukulkarni]

Hey Slow down take your time, don't burn yourself out, but kudos for a nice project that is quite useful and usable everywhere 🚀

[Saisamarth21]

Hi, I'm running the Glance dashboard in Docker and have set up a reverse proxy using Nginx Proxy Manager. How can I add tinyauth authentication to the dashboard using my existing Nginx Proxy Manager?

[Saisamarth21]

Do I have to delete and re-setup Nginx Proxy Manager? I have around 15 reverse proxies configured with SSL certificates. Will I need to reconfigure all of them if I do?

[steveiliop56]

Nope, just add a new proxy host pointing to tinyauth and edit your glance one to include the advanced config mentioned in the documentation.

[Saisamarth21]

Hi,

I tried setting up Tinyauth on my Glance dashboard using nginx proxy manager, and Tinyauth is working fine at https://tinyauth.mydomain.duckdns.org/ on port 3000.

At https://tinyauth.mydomain.duckdns.org/login?redirect_uri=null, I am able to log in and log out. I have disabled "Cache Assets," "WebSockets Support," and "Block Common Exploits." Additionally, I added an SSL certificate and enabled "Force SSL" and "HTTP/2 Support."

However, for the Glance dashboard proxy at https://glance.mydomain.duckdns.org/, set to port 8080, I have enabled only "WebSockets Support" and "Block Common Exploits." I also added an SSL certificate and enabled "Force SSL" and "HTTP/2 Support."

I added the following config under Advanced Settings:

location / {
    proxy_pass          $forward_scheme://$server:$port;     
    auth_request        /tinyauth;                           
    error_page 401      = @tinyauth_login;                    
}

location /tinyauth {
    proxy_pass          http://tinyauth:3000/api/auth/nginx;  
    proxy_set_header    x-forwarded-proto $scheme;            
    proxy_set_header    x-forwarded-host  $http_host;         
    proxy_set_header    x-forwarded-uri   $request_uri;       
}

location @tinyauth_login {
    return 302 https://tinyauth.mydomain.duckdns.org/login?\ 
    redirect_uri=$scheme://$http_host$request_uri;          
}

After applying this configuration, my Glance proxy went offline. Could you help me fix this issue?

[hitafer]

How did you configure tinyauth.mydomain? With the container name or the IP address?

Perhaps you could try using your IP address in the proxy_pass line instead of tinyauth:3000. That worked for me, since I run tinyauth in a different LXC container than my apps.

[Saisamarth21]

I tried setting up proxy for TinyAuth using the IP address instead of the container name, but I couldn't access the site. I received a "502 Bad Gateway" error.

[hitafer]

Maybe you have a typo somewhere in your config

This is my compose-file i use tinyauth with Github OAuth

 tinyauth:
    image: ghcr.io/steveiliop56/tinyauth:v3
    container_name: tinyauth
    restart: unless-stopped
    ports:
      - 3000:3000
    environment:
      - SECRET=${SECRET}
      - APP_URL=https://tinyauth.${DOMAIN}
      - LOG_LEVEL=0
      - DISABLE_CONTINUE=false
      - LOGIN_MAX_RETRIES=3
      - LOGIN_TIMEOUT=300
      - OAUTH_WHITELIST=${OAUTH_WHITELIST}
      - GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID}
      - GITHUB_CLIENT_SECRET=${GITHUB_CLIENT_SECRET}

this is my tinyauth.mydomain.duckdns.org setting for npm:

i configurate my app in npm like this

with this in the advanced tab

# Root location
location / {
  # Pass the request to the app
  proxy_pass          $forward_scheme://$server:$port;

  # Add other app specific config here

  # Tinyauth auth request
  auth_request /tinyauth;
  error_page 401 = @tinyauth_login;
}

# Tinyauth auth request
location /tinyauth {
  # Pass request to tinyauth
  proxy_pass http://IP-TO-TINYAUTH:3000/api/auth/nginx;

  # Pass the request headers
  proxy_set_header x-forwarded-proto $scheme;
  proxy_set_header x-forwarded-host $http_host;
  proxy_set_header x-forwarded-uri $request_uri;
}

# Tinyauth login redirect
location @tinyauth_login {
  return 302 https://tinyauth.MYDOMAIN.duckdns.org/login?redirect_uri=$scheme://$http_host$request_uri; 
}

[Saisamarth21]

It’s working! Thank you so much for taking the time to help me.

[hitafer]

I'm glad I could help you 😊

[Stephan-P]

Please allow met to revive above thread, as it has been quite helpfull in getting my first docker app (bentopdf) to pass through nginx-pm and tinyauth.
Many things are going well:

• I get the tinyauth login
• I can succefully enter the credentials (alice or bob)
• I receive a brief "Welcome back" and "Redirecting"

But ultimately, I end up at Error: 502 - Bad Gateway.

Looking at above config from @hitafer I have a few questions:

• In the tinyauth compose shown above, port 3000 is mentioned, whereas the NPM config for tinyauth shows a forward to port 3040. Is this a typo or am I missing something relevant here?
• In my docker setup I've got separate compose files for nginx-pm, tinyauth and bentopdf, all connected to the same docker network. I had hopes to use proxy_pass http://tinyauth:3000/api/auth/nginx;, but it turned out that this HAS to be the local server ip-address. Is this correct?
• tinyauth is currently at version 4. Does this have any bearing on above configurations that could help me get passed this error 502 - Bad Gateway?
• bentopdf is a docker container app that does not have any login. It just works without. Does this have implcations for the tinyauth login redirect?
• I assume that the cause of the Bad Gateway redirection lies in the last definition in the Proxy Host Advanced config. Do you have suggestions?

# Tinyauth login redirect
location @tinyauth_login {
  return 302 http://tinyauth.MYDOMAIN.TLD/login?redirect_uri=$scheme://$http_host$request_uri; # Replace with your tinyauth URL
}

[steveiliop56]

Bad gateway usually means that the reverse proxy cannot reach your app. Tinyauth seems to be working correctly but when your proxy tries to well...proxy it cannot reach your app and it fails. Perhaps you have configured something wrong?

[Stephan-P]

Solution/fix found in NPM's Proxy Host settings: use the IP of the destination instead of the container name.
I'd have expected that - since the docker containers are in a common external docker network - the container name would do as well.
Maybe this was a misassumption of mine.

[DyArt]

Is there any way to get the groups from Microsoft Entra in Tinyauth. GENERIC_SCOPES groups doesn't exist in Entra, I can get Group.Read.All as scope. Keycloack can match groups. https://news.lavx.hu/article/seamlessly-integrate-azure-entra-id-with-keycloak-a-step-by-step-guide

[steveiliop56]

From the tutorial you linked, it seems to be possible to just do GENERIC_SCOPES=openid email profile groups. If that's not the case then unfortunately I can't do much because I don't have access to Microsoft Entra as it seems to be a business feature?