SSO / Login
Software
We use Authentik to manage access to different resources. It is hosted on IN-SMN and provides federated access to resources and apps. It can be used as a backend for OAuth2, SAML, and OIDC. This is supported by Google Workspace via LDAP as the source for accounts and groups.
It is hosted at sso.kth.it, which is used for logins and displays a dashboard with apps available to the authenticated user.
Configuration
Services that should require authentication to be accessed can use Authentik as middleware through the Traefik proxy, as detailed in the routing documentation. For the middleware to work, create an application with a corresponding proxy provider, then add that provider to the embedded outpost as described below.
Go to the Applications panel and click "Create with Provider". Give the application a name, slug, and optionally an icon and group.
Choose the provider type. When using the Traefik middleware this will be "Proxy Provider". If the application itself allows for authentication through OAuth, "OAuth2/OpenID Provider" can be used and the Traefik proxy can be skipped.
The provider name can be kept as-is, and the authorization flow can be set to either explicit or implicit consent. This controls whether the user is prompted to log in. Implicit consent is generally preferred.
The proxy provider allows protecting a page behind Authentik without requiring specific support from the application.
When used with the Traefik middleware, it should be set to "Forward auth (single application)",
with the external host set to the URL at which the site is served (e.g. https://shit.kth.it).
To decide who has access, configure bindings for the application's provider. You can create bindings for groups and specific users (also policies but we don't use them).
Most groups are sourced from the chapter's Google Workspace and sync automatically. Their names should be largely self-explanatory. A few groups are special and are not defined in Google Workspace, notably:
| Group | Who | Why |
|---|---|---|
| itsektionen | Everyone who has logged in with a kth.it account | The preferred option when anyone active in the chapter should have access |
| Server Maintainers | People who maintain our infrastructure (i.e. init and SMN) | Used for more sensitive or critical systems such as Grafana |
If using a proxy provider, add it to the Embedded Outpost.