starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Enhancement]: Fallback Password Authentication with Environment Variable Trigger alongside OIDC #3006

New Issue
Open
opened 2026-04-25 00:12:55 +02:00 by adam · 1 comment
adam commented 2026-04-25 00:12:55 +02:00
Owner
Copy Link
Copy Source

Originally created by @TKaluza on GitHub (Sep 14, 2025).

Type of Enhancement

Server Backend

Describe the Feature/Enhancement

Currently, Audiobookshelf supports OIDC and password authentication in parallel. For better security, I like the ability to disable password authentication and rely mainly on OIDC. However, there should be a fallback password login option that can be enabled on demand, for example via a Docker environment variable, to ensure admin access if the OIDC provider becomes unavailable.

Why would this be helpful?

  • Improved security by avoiding unnecessary password login exposure during normal operations.
  • Increased reliability and admin access robustness, allowing recovery from external auth failures.
  • Flexibility for various deployment scenarios, from private self-hosting to enterprise-level setups.
  • Simplifies automated deployment via environment variables or config files.

Future Implementation (Screenshot)

The admin can start the container with an environment variable (e.g., AUTH_FALLBACK_PASSWORD=true) to enable password login and regain access until OIDC is restored.

Audiobookshelf Server Version

v2.29.0

Current Implementation (Screenshot)

No response

Originally created by @TKaluza on GitHub (Sep 14, 2025). ### Type of Enhancement Server Backend ### Describe the Feature/Enhancement Currently, Audiobookshelf supports OIDC and password authentication in parallel. For better security, I like the ability to disable password authentication and rely mainly on OIDC. However, there should be a **fallback password login option** that can be **enabled on demand**, for example via a Docker environment variable, to ensure admin access if the OIDC provider becomes unavailable. ### Why would this be helpful? - Improved security by avoiding unnecessary password login exposure during normal operations. - Increased reliability and admin access robustness, allowing recovery from external auth failures. - Flexibility for various deployment scenarios, from private self-hosting to enterprise-level setups. - Simplifies automated deployment via environment variables or config files. ### Future Implementation (Screenshot) The admin can start the container with an environment variable (e.g., AUTH_FALLBACK_PASSWORD=true) to enable password login and regain access until OIDC is restored. ### Audiobookshelf Server Version v2.29.0 ### Current Implementation (Screenshot) _No response_
adam added the enhancement label 2026-04-25 00:12:55 +02:00
adam commented 2026-04-25 00:12:55 +02:00
Author
Owner
Copy Link
Copy Source

@cordlord commented on GitHub (Mar 17, 2026):

I'm also looking for this feature. Disabling password authentication is useless/dangerous without this. There should at the very least be a very large warning to users who don't consider this situation.

In other applications where the OIDC config is either in env variables or a config file, they automatically re-enable the login page when the OIDC config gets disabled. That's not even an option here.

I'm not biased how it works, but there definitely needs to be a way to re-enable password auth from outside the WebUI before it can be disabled safely.

@cordlord commented on GitHub (Mar 17, 2026): I'm also looking for this feature. Disabling password authentication is useless/dangerous without this. There should at the very least be a very large warning to users who don't consider this situation. In other applications where the OIDC config is either in env variables or a config file, they automatically re-enable the login page when the OIDC config gets disabled. That's not even an option here. I'm not biased how it works, but there definitely needs to be a way to re-enable password auth from outside the WebUI before it can be disabled safely.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#3006
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?