How To Authenticate API Tokens/ App Passwords

[fari-99]

so my user can generate api token / app passwords on their user profile, i can create them as admin too if i want, but how to authenticate those tokens?

thank you.

[ruohki]

Thats an untold secret as it seems

[atol71]

As far as I have reached one needs to setup proxy or use internal proxy. First one makes in Applications - create with provider - app type and proxy provider that in it's config one selects forward auth (single app). On advanced protocol most likely Proxy outpost. After this in Directory - tokens and App passwords create an app password. In applications - outposts associate this app password to outpost (mostly internal is used). In case of Traefik an proxy config on Traefik side is need that is explained in Applications - Providers - the app/provider name you created.
So:

1. App with provider type of proxy and single app
2. Tokens and apps - app password
3. Applications - outpost association of app password to proxy outpost
4. Proxy config that are explained in Applications - Providers of your app name.

[atol71]

"A masterpiece in UI design and ease of use" TM Trough solution of single flow!

[TheCataliasTNT2k]

This does not explain, what an app password or a token can be used for, when generated by a user.
This description looks more like "traefik can use this password to authenticate against the outpost when checking user credentials", right?

Users do not have the ability to do that workflow at least.

[atol71]

Nope, the proxy docker container (Outpost) can be queried with standard header with payload of app password you generated. Traefik do not have the app password it is relayed to it by application with API password post header: Authorization: Bearer <app_password>.

1. Authentik app password and other things set up
2. Proxy Outpost insertion of app password
3. standard header post with app password from used application either with Traefik proxy in the middle or directly to Outpost
4. If app password matches Outpost redirects to requested resource.