Possibility of bypassing webui auth?

[artav4]

Hello,

I have this setup (all on archlinux bare metal) currently:

• Radicale listening on default port
• NGINX as reverse proxy to make radicale accessible at dav.domain.tld
• Authelia used in Radicale, with the aim of making it an SSO

In my radicale config, I have set up

[auth]
type = http_x_remote_user

Here is my nginx config

server {
    server_name     dav.domain.tld;

    include snippets/authelia-location.conf;

    error_log /var/log/nginx/radicale_error.log;
    access_log /var/log/nginx/radicale_access.log;

    # Test with authelia
    location / { # The trailing / is important!
    proxy_pass           http://localhost:5232/;
    proxy_pass_header Authorization;
    include snippets/proxy.conf;
    include snippets/authelia-authrequest.conf;
    proxy_set_header X-Remote-User $user;
    # proxy_set_header     X-Remote-User $remote_user;
    }

    # Test basic auth
    # location / { # The trailing / is important!
    # proxy_pass           http://localhost:5232/;
    # proxy_pass_header Authorization;
    # auth_basic           "Radicale - Password Required";
    # auth_basic_user_file /etc/nginx/auth/webdav-users.passwd;
    # proxy_set_header     X-Forwarded-For $proxy_add_x_forwarded_for;
    # proxy_set_header     X-Remote-User $remote_user;
    # proxy_set_header     Host $http_host;
    # }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/domain.tld/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/domain.tld/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot


}
server {
    if ($host = dav.domain.tld) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    server_name     dav.domain.tld;
    listen 80;
    return 404; # managed by Certbot


}

The snippets from Authelia can all be found (here)[https://www.authelia.com/integration/proxies/nginx/].

When I try to access dav.domain.tld or dav.domain.tld/.web/, I am redirected to auth.domain.tld where I can log into my account. However, I cannot manage to bypass the login screen of radicale and have to enter my username. I would like to know if it is possible to get directly on the interface with calendar, contacts and so on?

As it seems to break the DAV connection, even when I let authelia bypass the username, it just might not be viable...

[pbiering]

The WebUI (built-in for collection management and the potentially bundled InfCloud) are Javascript based clients running in browser and using towards Radicale the DAV connection. There is no server side implementation of these WebUIs.

-> if you want to suppress Login screen you have to adjust the Javascript served to the browser to handle this somehow, no clue whether this would work but give a try.

Most code the browser is executing is defined here
https://github.com/Kozea/Radicale/blob/master/radicale/web/internal_data/fn.js

BTW: also no clue whether DAV clients like "DAVx5" will be able to use your SSO setup.

[zacharyweiss]

@artav4 did you end up finding a solution? Wanting to do similar: Radicale behind Traefik reverse-proxy and Authelia SSO.

[artav4]

Hey! Unfortunately no, as Kozea said (#1753 (comment)), the webui is part of Radicale and it cannot be disabled just by modifying the config file, so I decided to give up on this.

[pbiering]

the "webui" can be disabled, but the problem here is that it's still unclear to serve the files without requiring authentication.

In Apache this can be done using "LocationMatch", see here for example https://github.com/Kozea/Radicale/blob/master/contrib/apache/radicale.conf

[Nicholas42]

For anyone using caddy: This does (roughly) the same (disabling auth on .web/* since it isn't needed there):

caldav.example.com {
    # Append / if GETting /.web
    @get-root {
        method GET
        path /.web
    }

    redir @get-root /.web/

    # Do not auth on /.web/* 
    @not-webui {
        not path /.web/*
    }

    basic_auth @not-webui {
        USER HASH
    }

    reverse_proxy localhost:5232 {
        header_up X-Remote-User {http.auth.user.id}
    }
}

(note that this is with a subdomain and radicale is served on / there, if you are serving on /radicale/ this needs to be prepended at the obvious places)

[pbiering]

caddy example added to contrib directory, thank you!
https://github.com/Kozea/Radicale/blob/master/contrib/caddy/radicale.caddyfile

Now one need to replicate the same for nginx and all 3 most used reverse proxy are covered then.