Support external login?

[Rycochet]

When you first run this it asks to create a local user for use as the main user, you can also create other users which states that not everything supports them. For a not insignificant number of people that main user is the only one we use (especially with sub-users for syncing).

My setup has external SSO before anyone can even access the server (with me as the only user) - which I feel is a somewhat standard config for a lot of homelabs.

For the other *arr servers there is an option to set that login as External (often by manually editing a config file while the server is not running - it is an advanced option!) to bypass having a local login (and it behaves identically as if logged in).

Slightly more advanced in some servers is the ability to tell them which specific headers to trust (although offhand I can't remember seeing any where that was a requirement - it has generally been added when multiple users are supported and is used for identifying them).

[arabcoders]

Hello,

I need to clarify few things, Users in WatchState means sync users not an actual login users. they are just a file in the system. The management isn't tied to them. The login flow solely based on one user mainly WS_AUTH_USERNAME and WS_AUTH_PASSWORD.

We do have a way to bypass local auth WS_TRUST_LOCAL when set it will automatically login anyone who has a local ip address., bypassing the entire auth flow. However, be warned, if you mis-configure your frontend proxy, the external auth or someone gain access they will be able to see your entire data including the tokens for the media servers they could do serious damage.

We generally don't recommend it. However if you know what you are doing and the risk is acceptable. simply flipping the switch will turn off the auth for local_net provided you also enable WS_TRUST_PROXY.

[Rycochet]

Nice - I didn't find that when looking (for the wrong things apparently) - sitting behind a cloudflared tunnel, traefik proxy, and tinyauth SSO layer - it definitely isn't a stack that anyone wants to go wrong (plus this means there is no "local" access) 😅

Thank you for the answer and the server! 😁

[arabcoders]

No worries, you are right we had something in FAQ before about it but when we cleaned up stuff for release we didn't want ppl shooting themselves in the foot by turning it on. Now things has stabilized, i'll add it back to FAQ.