Source
r/selfhosted•
510Threaded

Redirect to different dashboard depending on auth group/level

Need Help

Is there a way to redirect to a different dashboard/url after someone logs in via authelia w/caddy?

Example:
Access https://example.com
Login
If in User Group, then redir https://example.com/user
If in Admin Group, then redir https://example.com/admin

Where /user and /admin are 2 different homepage containers that are reverse proxied with forward_auth.

While Organizr has this built in, I am looking to use something like https://github.com/benphelps/homepage.

Posted Jan 20, 2023, 4:20 AM UTC

34
rl_debugger•

Yes, I think, this is possible. If you use forward_auth with authelia and copy the response headers in that directive (so copy_headers Remote-Groups, see authelias docs for more - for this you only require that header), you can use these headers to determine the groups of that user. You can match the header in named matchers. Like this:

example.com {
  import authelia

  @user header Remote-Groups User
  @admin header Remote-Groups Admin
  handle @user {
    redir / https://example.com/user
    reverse_proxy *host and port*
  }
  handle @admin {
    redir / https://example.com/admin
    reverse_proxy *host and port*
  }
}

That should work, however I did not try it. I also dont use subpaths, so yeah, you have to see for yourself. The snippet authelia contains my forward_auth directive. You should also specify the base url accordingly in both homepage instances. I dont know if these named matchers work in situations, where you have two similar named groups or where you have users with more than one group. In these cases you might want to use header_regex. I hope, I could help :D

Also you might want to use subdomains for other services, since I dont believe, you can reach other services with subpaths in that example. There may be other ways that allow it, however this is the best I can come up with.

2
510ThreadedOP•

I have actually been playing around with caddy for a bit and figured out it was possible with what you said. Like for example, I am using a named matcher so only either local source ips are allowed or only cloudflare’s ips are allowed.

1
rl_debugger•

Yeah, named matchers are really great. It opens up ways to handle some more advanced cases and it is rather simple. I mainly use named matchers in a huge block of domain and all subdomains (so "example.com, *.example.com"), where the subdomains I use are matched via host and then handled via handle directive. That way I can have a wildcard certificate for *.example.com and dont have to deal with services not behaving, when using subpaths.

1
maximus459•

You can have a URL point to Authentik and use it for authentication. It can also function as a reverse proxy to redirect you to a certain URL.

Not entirely sure if can redirect based on user

1
xolhos•

how did you end up doing this? i am looking for the exact same thing.

1