mirror of
https://github.com/advplyr/audiobookshelf.git
synced 2026-05-30 23:40:40 +02:00
[Enhancement]: Password-less authentication using link sent to email address #2308
Assignees
adam (Adam Melkus)
Clear assignees
adam (Adam Melkus)
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: starred/audiobookshelf#2308
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @ZLoth on GitHub (Oct 13, 2024).
Type of Enhancement
Web Interface/Frontend
Describe the Feature/Enhancement
I would like to be able to configure my server to offer a password-less authenticaiton. The process would work as follows:
The server administrator still needs a password "just in case", and that username/password can be bypassed by going to https://abs.yoursite.com/login/?autoLaunch=0
Why would this be helpful?
I share my server with one-two other people who can be best described as technically challeged. This includes setting the password using a very weak and well-known password think it is secure. By setting up a email link, this eliminates the password.
Future Implementation (Screenshot)
Initial login:
Once the user enters in their email address (and possibly a CAPTCHA test), they will see the following:
If your email address is found on the server, you will receive a email with a link to click on to log into the server. Please note that this link will expire at 6:24 AM Eastern Time.
The Email will look like:
Subject: Audiobookshelf login request for user@example.com
Text:
A login request has been received for the audiobookshelf server at abs.example.com for the (Web Client/Android Client/iOS Client). If this is you, please click on the link below by 6:24 AM Eastern Time:
https://abs.example.com/login/?token=EJoxARR9Yn9OSnbNo1ZMnMFM0K2g1jLPwcOSXatozEC2W3EnnV
If this isn't you, then delete this email.
Once the link is clicked, the appropriate screen comes up for Web Page or mobile device login...
Web Page:
You are now successfully logged in. Click here to go to audiobookshelf.
Mobile Login:
You are now successfully logged in. Please close this page and return to the audiobookshelf app to complete the login process.
Audiobookshelf Server Version
v2.14.0
Current Implementation (Screenshot)
Currently, only username/password authentication.
@advplyr commented on GitHub (Oct 13, 2024):
I'm pretty sure you can set up a flow like that using OIDC with an auth provider like Authentik.
One of the benefits of us adding in OIDC is it allows users to use an auth provider that can do these things instead of us building out every different use-case. Building out different auth methods and flows could be a full time dev effort so we want to leverage auth providers that are already doing this really well.
@Sapd did the bulk of the OIDC implementation for Abs and may have more thoughts.
When we do start working on the authentication again I'd really like to focus on implementing the JWT auth in a more standard way
@Sapd commented on GitHub (Oct 14, 2024):
Yep what you are describing is usually called magic link login.
You can do it with keycloak with this additional software: https://github.com/p2-inc/keycloak-magic-link
However keycloak is not so easy to configure if you're new in that topic
Otherwise if you have access for setup of the other peoples computer, I would suggest you just use Authentik with Webauthn. They do not need to have any password then, they can just authenticate using their browser (the browser will either ask for a PIN or fingerprint to unlock an automatically generated secure key on the computer).
You just have to login them once and then webauthn.