caddy-auth-portal VS caddy-security

Caddy Auth Portal. Also has the advantage of providing unified secure 2FA.

I am very happy with the this caddy extension: https://github.com/greenpau/caddy-auth-portal.

Sorts this precise use case for me, need for common login provider. Without the banality of basic auth.

Check out caddy-auth-portal

After dabbling with Caddy's auth-portal, nginx Vouch proxy, Keycloak and Authelia I found Authentik.

Usually with this plugin: https://github.com/greenpau/caddy-auth-portal

There’s caddy-auth-portal which I’ve not used myself, but heard good things about.

I hope this post helps setting up your SSO with Caddy. I'd highly recommend trying it out if you find yourself always needing to authenticate with different services on your domain – and check out caddy-auth-portal's docs for even more advanced features!

This sounds like an XY Problem. It sounds like you're missing a good IAP solution to deal with access controls. Something like oauth2_proxy, Keycloak, Pomerium, etc. Hell, I've even set up a basic IAP with Caddy and Oauth Portal.

There is no "refusal" as far as I can tell. The issues were reported [1] in September 2023 (as was this blog post) and the simplest one has been fixed (insecure random seed). I'm not aware of any public statements from the plugin maintainers, and there is no hostility in the issue comments.

[1]: https://github.com/greenpau/caddy-security/issues?q=is%3Aiss...

> September 18, 2023: The disclosure blog post was released and issues were filed with the original project repository.

I don't see those issues listed in the GitHub project issue tracker https://github.com/greenpau/caddy-security/issues. Have they been deleted?

Check out https://github.com/greenpau/caddy-security

There a pretty comprehensive auth plugin for Caddy. It can do local authentication with a session cookie, which should work with your IPTV apps. If your app can show a login form, it's super easy, but if I remember correctly you can also authenticate with basic auth and store the session in a cookie (this is mostly used to carry over the authentication to a different subdomain).

I use Caddy + Caddy Security, set up OAuth, and also only expose services over IPv6. It's not extra security, but it's less logs to deal with because nobody is scanning IPv6 address ranges, and there are less IPv6 capable hosts who are compromised.

Not sure if this fits your bill, but have a look at Caddy web server and its available authentification methods or even more with a plugin

Also look at github.com/greenpau/caddy-security to enable MFA for Caddy.

- Guacamole docker connects to Debian VNC Desktop - Caddy docker offers HTTPS proxy with Guacamole and the Caddy Security plug in for Auth with TOTP