Mapping Caddy forward_auth groups to Otterwiki perms

[freddyheppell]

I'm using Caddy's forward_auth (with Authelia) in front of Otter Wiki. It's well documented by Caddy how to map the proxy auth headers to some other value (or indeed to change the headers Otter Wiki wants). The difficult part is transforming the groups header to a permissions header. It took me an annoyingly long time to figure it out but it's actually very simple in the end.

In my case I just have an admins group which get all perms, and any other user gets read access.

Warning

This is actually just checking if the user's group string includes admins anywhere in it, so if you have groups admins and otherkindofadmins, both will match. If this is a concern, you probably want a regex like (^|,)admins(,|$) instead but I haven't tested this myself.

# snippet usable for any site
(secure) {
	forward_auth authelia:9091 {
		uri /api/authz/forward-auth
		copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
	}
}

wiki.example.org {
	import secure

	# all the otter wiki specific logic is here, so our snippet remains service-agnostic

	# match the Remote-Groups header into a placeholder
	# this header is a comma-separated string e.g.
	# "admins", "admins,group2" or "" if no groups
	map {rp.header.Remote-Groups} {otterwiki-perms} {
		~(.*)admins(.*) "READ,WRITE,UPLOAD,ADMIN"
		# e.g.:  ~(.*)authors(.*) "READ,WRITE,UPLOAD"
		default "READ"
	}

	reverse_proxy otterwikitest:80 {
		header_up X-Otterwiki-Name {rp.header.Remote-User}
		header_up X-Otterwiki-Email {rp.header.Remote-Email}
		header_up X-Otterwiki-Permissions {otterwiki-perms}
	}
}

I also wasn't expecting to have to give admins READ,WRITE,UPLOAD as well but it 403s if you don't.

Hopefully someone else finds this useful!

[redimp]

Hey @freddyheppell, thanks for sharing this configuration!