starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Enhancement]: 2FA with OTP and/or Passkeys #2884

New Issue
Closed
opened 2026-04-25 00:11:34 +02:00 by adam · 14 comments
adam commented 2026-04-25 00:11:34 +02:00
Owner
Copy Link
Copy Source

Originally created by @alexanderkuenzel on GitHub (Jul 13, 2025).

Type of Enhancement

Server Backend

Describe the Feature/Enhancement

More Security for the Accounts by adding option to activate 2FA via OTP. And may also add option to use Passkeys.

Why would this be helpful?

More security for user accounts.

Future Implementation (Screenshot)

Options to activate the functions on profile page.

Audiobookshelf Server Version

2.26.0

Current Implementation (Screenshot)

No response

Originally created by @alexanderkuenzel on GitHub (Jul 13, 2025). ### Type of Enhancement Server Backend ### Describe the Feature/Enhancement More Security for the Accounts by adding option to activate 2FA via OTP. And may also add option to use Passkeys. ### Why would this be helpful? More security for user accounts. ### Future Implementation (Screenshot) Options to activate the functions on profile page. ### Audiobookshelf Server Version 2.26.0 ### Current Implementation (Screenshot) _No response_
adam added the enhancement label 2026-04-25 00:11:34 +02:00
adam closed this issue 2026-04-25 00:11:35 +02:00
adam commented 2026-04-25 00:11:35 +02:00
Author
Owner
Copy Link
Copy Source

@vehagn commented on GitHub (Jul 13, 2025):

@alexanderkuenzel Using OpenID Connect Authentication and disabling Password Authentication can grant you 2FA via OTP given that the OIDC Provider supports it.

I can recommend trying out Keycloak, Authelia or Kanidm for this.

@vehagn commented on GitHub (Jul 13, 2025): @alexanderkuenzel Using _OpenID Connect Authentication_ and disabling _Password Authentication_ can grant you 2FA via OTP given that the OIDC Provider supports it. I can recommend trying out [Keycloak](https://www.keycloak.org/), [Authelia](https://www.authelia.com/) or [Kanidm](https://kanidm.com/) for this.
adam commented 2026-04-25 00:11:35 +02:00
Author
Owner
Copy Link
Copy Source

@alexanderkuenzel commented on GitHub (Jul 13, 2025):

Ok, thats one option. But i thing simple native OTP would be more comfortable because you don‘t need to create account on another service first.

@alexanderkuenzel commented on GitHub (Jul 13, 2025): Ok, thats one option. But i thing simple native OTP would be more comfortable because you don‘t need to create account on another service first.
adam commented 2026-04-25 00:11:35 +02:00
Author
Owner
Copy Link
Copy Source

@Vito0912 commented on GitHub (Jul 13, 2025):

I am currently working on adding 2FA (TOTP and email - maybe passkeys, but I am not very familiar with them and it depends on how easy they are to set up) for another project, so I might look at this for ABS after I finish if @advplyr is generally okay with adding 2FA to ABS.

@Vito0912 commented on GitHub (Jul 13, 2025): I am currently working on adding 2FA (TOTP and email - maybe passkeys, but I am not very familiar with them and it depends on how easy they are to set up) for another project, so I might look at this for ABS after I finish if @advplyr is generally okay with adding 2FA to ABS.
adam commented 2026-04-25 00:11:35 +02:00
Author
Owner
Copy Link
Copy Source

@advplyr commented on GitHub (Jul 13, 2025):

I don't think we should because this was the big reason for adding OIDC. Users can set up whatever auth method they want through OIDC.
This allows us to not have to manage all the different auth methods that come with overhead and careful security considerations. It is a full time effort maintaining highly configurable authentication and software like Authentik does this well already.

@advplyr commented on GitHub (Jul 13, 2025): I don't think we should because this was the big reason for adding OIDC. Users can set up whatever auth method they want through OIDC. This allows us to not have to manage all the different auth methods that come with overhead and careful security considerations. It is a full time effort maintaining highly configurable authentication and software like Authentik does this well already.
adam commented 2026-04-25 00:11:36 +02:00
Author
Owner
Copy Link
Copy Source

@Vito0912 commented on GitHub (Jul 13, 2025):

Pretty neutral in regards if this should get added, but some considerations why this is being added in the other project I am currently worked on (/wished for):

Pro:

  1. Way steeper learning curve just to get basic security implemented (depending on used provider)
  2. More to maintain for the admin. Users now need to be edited in two places. Also more resource consumption.
  3. All users would be forced to switch (or even worse you would have a mix of local and oidc users)
  4. Deployment on sharing hosted/container hosts has no option to host an OIDC provider

Cons:

  1. Work that needs to be made in the codebase
  2. 2FA can be somewhat easily be done via OIDC providers and at the level where 2FA is considered most admins have the knowledge to setup an OIDC
  3. And probably more I forgot
@Vito0912 commented on GitHub (Jul 13, 2025): Pretty neutral in regards if this should get added, but some considerations why this is being added in the other project I am currently worked on (/wished for): Pro: 1. Way steeper learning curve just to get basic security implemented (depending on used provider) 2. More to maintain for the admin. Users now need to be edited in two places. Also more resource consumption. 3. All users would be forced to switch (or even worse you would have a mix of local and oidc users) 4. Deployment on sharing hosted/container hosts has no option to host an OIDC provider Cons: 1. Work that needs to be made in the codebase 2. 2FA can be somewhat easily be done via OIDC providers and at the level where 2FA is considered most admins have the knowledge to setup an OIDC 3. And probably more I forgot
adam commented 2026-04-25 00:11:36 +02:00
Author
Owner
Copy Link
Copy Source

@advplyr commented on GitHub (Jul 13, 2025):

Using an identity provider like Authentik is more secure because they are singularly focused on authentication. The user has to run it separately and learn how to set it up which is a valid pro argument but I don't think it outweighs the cons.

For notifications we use apprise for the same reason. There are dozens of ways that users want to configure notifications. Supporting apprise in Abs instead of trying to handle SMS, push notifications, Discord, etc. is much better in my opinion. I think we will add support for email notifications since we already have email configuration but I don't think we should build in SMS support.

@advplyr commented on GitHub (Jul 13, 2025): Using an identity provider like Authentik is more secure because they are singularly focused on authentication. The user has to run it separately and learn how to set it up which is a valid pro argument but I don't think it outweighs the cons. For notifications we use apprise for the same reason. There are dozens of ways that users want to configure notifications. Supporting apprise in Abs instead of trying to handle SMS, push notifications, Discord, etc. is much better in my opinion. I think we will add support for email notifications since we already have email configuration but I don't think we should build in SMS support.
adam commented 2026-04-25 00:11:36 +02:00
Author
Owner
Copy Link
Copy Source

@vehagn commented on GitHub (Jul 13, 2025):

This might be irrelevant, but I just finished an article on how to configure Authelia (which has support for MFA) as an OIDC provider for Abs: https://blog.stonegarden.dev/articles/2025/07/custom-oidc-claims/. All in all I think Abs has a rather mature OIDC implementation.

@vehagn commented on GitHub (Jul 13, 2025): This might be irrelevant, but I just finished an article on how to configure Authelia (which has support for MFA) as an OIDC provider for Abs: https://blog.stonegarden.dev/articles/2025/07/custom-oidc-claims/. All in all I think Abs has a rather mature OIDC implementation.
adam commented 2026-04-25 00:11:36 +02:00
Author
Owner
Copy Link
Copy Source

@dedors commented on GitHub (Jul 14, 2025):

Just wanted to share my thoughts as a hobbyist running a home lab. I have never heard of OIDC before, and even after going through the (abs) guide, I'm honestly lost on how to get started. It seems like I'd need another service or container, but the top results I find on Google seems to be outdated by a few years.

I get what this is trying to achieve and the benefits are clear, but it feels overly complicated for my needs. It would be a whole project just to test it and switch everything over.

Currently, I use two-factor authentication (2FA) via an authenticator app for services exposed to the internet, such as Nextcloud, Home Assistant, and Vaultwarden, and I was able to set them up directly. A solution that does not require advanced configuration would be more preferable.

@dedors commented on GitHub (Jul 14, 2025): Just wanted to share my thoughts as a hobbyist running a home lab. I have never heard of OIDC before, and even after going through the (abs) guide, I'm honestly lost on how to get started. It seems like I'd need another service or container, but the top results I find on Google seems to be outdated by a few years. I get what this is trying to achieve and the benefits are clear, but it feels overly complicated for my needs. It would be a whole project just to test it and switch everything over. Currently, I use two-factor authentication (2FA) via an authenticator app for services exposed to the internet, such as Nextcloud, Home Assistant, and Vaultwarden, and I was able to set them up directly. A solution that does not require advanced configuration would be more preferable.
adam commented 2026-04-25 00:11:36 +02:00
Author
Owner
Copy Link
Copy Source

@nichwall commented on GitHub (Jul 14, 2025):

I agree with advplyr that the point of implementing OIDC (which is a standard) is so users can use software dedicated for authentication, such as Authentik, Authelia, or Keycloak.

Because OIDC is a standard that can be built to, you can then use the same authentication system for multiple projects and only need to manage one set of authorization keys for users across multiple services (assuming your other services also supports OIDC, not everything does).

If you want to use MFA or additional security, I think it is worth the time to learn how to set up the dedicated authentication infrastructure so you can make use of it for multiple projects rather than relying on every project to implement MFA.

@nichwall commented on GitHub (Jul 14, 2025): I agree with advplyr that the point of implementing OIDC (which is a standard) is so users can use software dedicated for authentication, such as Authentik, Authelia, or Keycloak. Because OIDC is a standard that can be built to, you can then use the same authentication system for multiple projects and only need to manage one set of authorization keys for users across multiple services (assuming your other services also supports OIDC, not everything does). If you want to use MFA or additional security, I think it is worth the time to learn how to set up the dedicated authentication infrastructure so you can make use of it for multiple projects rather than relying on every project to implement MFA.
adam commented 2026-04-25 00:11:36 +02:00
Author
Owner
Copy Link
Copy Source

@TheTerrasque commented on GitHub (Jul 14, 2025):

Just wanted to share my thoughts as a hobbyist running a home lab. I have never heard of OIDC before, and even after going through the (abs) guide, I'm honestly lost on how to get started. It seems like I'd need another service or container, but the top results I find on Google seems to be outdated by a few years.

I get what this is trying to achieve and the benefits are clear, but it feels overly complicated for my needs. It would be a whole project just to test it and switch everything over.

Currently, I use two-factor authentication (2FA) via an authenticator app for services exposed to the internet, such as Nextcloud, Home Assistant, and Vaultwarden, and I was able to set them up directly. A solution that does not require advanced configuration would be more preferable.

I would recommend starting with setting up authentik and go from there. I found it pretty easy to set up, and it also has guides on how to set up many different clients.

Regarding the topic itself, I feel advanced security is best served with a dedicated project like authentik, authelia, keycloak and similar.

@TheTerrasque commented on GitHub (Jul 14, 2025): > Just wanted to share my thoughts as a hobbyist running a home lab. I have never heard of OIDC before, and even after going through the (abs) guide, I'm honestly lost on how to get started. It seems like I'd need another service or container, but the top results I find on Google seems to be outdated by a few years. > > I get what this is trying to achieve and the benefits are clear, but it feels overly complicated for my needs. It would be a whole project just to test it and switch everything over. > > Currently, I use two-factor authentication (2FA) via an authenticator app for services exposed to the internet, such as Nextcloud, Home Assistant, and Vaultwarden, and I was able to set them up directly. A solution that does not require advanced configuration would be more preferable. I would recommend starting with setting up authentik and go from there. I found it pretty easy to set up, and it also has [guides](https://integrations.goauthentik.io/) on how to set up many different clients. Regarding the topic itself, I feel advanced security is best served with a dedicated project like authentik, authelia, keycloak and similar.
adam commented 2026-04-25 00:11:36 +02:00
Author
Owner
Copy Link
Copy Source

@vehagn commented on GitHub (Jul 14, 2025):

It should also be possible to configure a third-party IdP like e.g. a Google OAuth Client, though I haven't looked into it I think this is where to start: https://support.google.com/cloud/answer/15549257

@vehagn commented on GitHub (Jul 14, 2025): It should also be possible to configure a third-party IdP like e.g. a Google OAuth Client, though I haven't looked into it I think this is where to start: https://support.google.com/cloud/answer/15549257
adam commented 2026-04-25 00:11:36 +02:00
Author
Owner
Copy Link
Copy Source

@advplyr commented on GitHub (Jul 14, 2025):

I can see the argument for rolling our own 2FA but not something we're going to do in the foreseeable future. I appreciate everyone's input on this

@advplyr commented on GitHub (Jul 14, 2025): I can see the argument for rolling our own 2FA but not something we're going to do in the foreseeable future. I appreciate everyone's input on this
adam commented 2026-04-25 00:11:36 +02:00
Author
Owner
Copy Link
Copy Source

@Meharis108 commented on GitHub (Dec 8, 2025):

I just got familiar with OICD and it works like a charm. That said, it was a steep learning curve with Authentik.

Now i want to expose the Host via reverse proxy, for that i want to disable password authentication.
When i do so, is there any way should Authentik Fail or my OICD Adminuser gets broken, to enable password authentication again from database or shell or so to login with root? I just always like to have a fallback plan if something breaks.

Thanks for all the Work

@Meharis108 commented on GitHub (Dec 8, 2025): I just got familiar with OICD and it works like a charm. That said, it was a steep learning curve with Authentik. Now i want to expose the Host via reverse proxy, for that i want to disable password authentication. When i do so, is there any way should Authentik Fail or my OICD Adminuser gets broken, to enable password authentication again from database or shell or so to login with root? I just always like to have a fallback plan if something breaks. Thanks for all the Work
adam commented 2026-04-25 00:11:36 +02:00
Author
Owner
Copy Link
Copy Source

@tiodonas commented on GitHub (Feb 12, 2026):

I can see the argument for rolling our own 2FA but not something we're going to do in the foreseeable future. I appreciate everyone's input on this

I wholeheartedly disagree. It's already hard enough to get people to move to self hosted options. Asking users to go through a steep learning curve just to enable 2FA is an unreasonable ask and unnecessary friction point. Most users already have some sort of OTP app. It's the lowest common denominator and should be a standard baseline to target.

@tiodonas commented on GitHub (Feb 12, 2026): > I can see the argument for rolling our own 2FA but not something we're going to do in the foreseeable future. I appreciate everyone's input on this I wholeheartedly disagree. It's already hard enough to get people to move to self hosted options. Asking users to go through a steep learning curve just to enable 2FA is an unreasonable ask and unnecessary friction point. Most users already have some sort of OTP app. It's the lowest common denominator and should be a standard baseline to target.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#2884
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?