[GH-ISSUE #69] oauth or client certificate authentication

Author

Owner

@walthowd commented on GitHub (Mar 1, 2019):

I would like to see this too!

@walthowd commented on GitHub (Mar 1, 2019): I would like to see this too!

kerem commented

Author

Owner

@hallveticapro commented on GitHub (Mar 3, 2019):

OAuth would be nice to see, I don't really trust the login forms of applications like Sonarr or Radarr that much but OAuth would be okay in my book.

@hallveticapro commented on GitHub (Mar 3, 2019): OAuth would be nice to see, I don't really trust the login forms of applications like Sonarr or Radarr that much but OAuth would be okay in my book.

kerem commented

Author

Owner

@jc21 commented on GitHub (Mar 3, 2019):

What services do you want to oauth with though?

On the topic of login security, passwords are stored in an encrypted state against the database and login tokens are not stored in cookies, they are stored in localstorage. The login token is in JWT format and can be revoked for all users by removing the generated encryption keys in your config file.

@jc21 commented on GitHub (Mar 3, 2019): What services do you want to oauth with though? On the topic of login security, passwords are stored in an encrypted state against the database and login tokens are not stored in cookies, they are stored in localstorage. The login token is in JWT format and can be revoked for all users by removing the generated encryption keys in your config file.

kerem commented

Author

Owner

@hallveticapro commented on GitHub (Mar 3, 2019):

One of the biggest reasons I would like OAuth is 2FA. My Google account is secured not only with a complex password but a YubiKey as well. It would be nice to be able to place access to any host behind that to ensure that I am the only able to access them. I'm not saying the included Access Lists is bad but if someone were to get access to a password, they'd have access until I realize and am able to revoke it.

@hallveticapro commented on GitHub (Mar 3, 2019): One of the biggest reasons I would like OAuth is 2FA. My Google account is secured not only with a complex password but a YubiKey as well. It would be nice to be able to place access to any host behind that to ensure that I am the only able to access them. I'm not saying the included Access Lists is bad but if someone were to get access to a password, they'd have access until I realize and am able to revoke it.

kerem commented

Author

Owner

@maciekish commented on GitHub (Apr 10, 2019):

+1 for client cert auth please

@maciekish commented on GitHub (Apr 10, 2019): +1 for client cert auth please

kerem commented

Author

Owner

@misse commented on GitHub (May 2, 2019):

I would also like to se 2FA and client certificate auth.

@misse commented on GitHub (May 2, 2019): I would also like to se 2FA and client certificate auth.

kerem commented

Author

Owner

@jeroenpardon commented on GitHub (May 31, 2019):

It's definitely needed for me too +1

@jeroenpardon commented on GitHub (May 31, 2019): It's definitely needed for me too +1

kerem commented

Author

Owner

@Elmardus commented on GitHub (Apr 29, 2020):

Is there a way to use the auth_request Nginx module, so a service like Vouch could be used?

If I understood correctly, this would require auth_request /validate; to be set in the 'server' block, the other required config could be entered in the Custom Nginx Configuration in the Advanced tab using the NPM gui.

@Elmardus commented on GitHub (Apr 29, 2020): Is there a way to use the auth_request Nginx module, so a service like [Vouch](https://github.com/vouch/vouch-proxy) could be used? If I understood correctly, this would require `auth_request /validate;` to be set in the 'server' block, the other required config could be entered in the _Custom Nginx Configuration_ in the _Advanced_ tab using the NPM gui.

kerem commented

Author

Owner

@Simon-CR commented on GitHub (May 25, 2020):

I to would love for an easy way to add google 2fa auth in front.

@Simon-CR commented on GitHub (May 25, 2020): I to would love for an easy way to add google 2fa auth in front.

kerem commented

Author

Owner

@cammurray commented on GitHub (Jul 22, 2020):

Certificate authentication would be amazing, but with the projects mentality of keeping the barrier for entry low, you could; automate the generation of the CA certificate (so this is hidden from the user), and just tie the user certificates to the ACLs some how, resulting in simple SSO provided by certs, no third-party auth providers, all integrated.

@cammurray commented on GitHub (Jul 22, 2020): Certificate authentication would be amazing, but with the projects mentality of keeping the barrier for entry low, you could; automate the generation of the CA certificate (so this is hidden from the user), and just tie the user certificates to the ACLs some how, resulting in simple SSO provided by certs, no third-party auth providers, all integrated.

kerem commented

Author

Owner

@hlidar85 commented on GitHub (Jun 28, 2021):

+1 for client cert auth please

@hlidar85 commented on GitHub (Jun 28, 2021): +1 for client cert auth please

kerem commented

Author

Owner

@cammurray commented on GitHub (Jun 29, 2021):

I needed this functionality (it makes it easy and more secure to expose internal services when they're behind a cert auth mechanism), so I created a proxy manager like nginx proxy manager however with caddy instead. Sharing how I went about this for info sharing purposes because I think it would be useful to do a similar approach in nginx proxy manager. I'd personally prefer to use Nginx Proxy Manager if there was cert auth in it.

Certificate Auth Providers (essentially a certificate authority) can be set up from within the proxy manager. You can download the root CA public cert from the proxy manager, and you can generate client certificates (that go on the devices) from the same page.

You can generate as many Root CA's as you want so that you can have different proxy hosts require different certificates.

When creating the proxy host itself, under the auth page you select the Root CA you want to authenticate users against

@cammurray commented on GitHub (Jun 29, 2021): I needed this functionality (it makes it easy and more secure to expose internal services when they're behind a cert auth mechanism), so I created a proxy manager like nginx proxy manager however with caddy instead. Sharing how I went about this for info sharing purposes because I think it would be useful to do a similar approach in nginx proxy manager. I'd personally prefer to use Nginx Proxy Manager if there was cert auth in it. Certificate Auth Providers (essentially a certificate authority) can be set up from within the proxy manager. You can download the root CA public cert from the proxy manager, and you can generate client certificates (that go on the devices) from the same page. You can generate as many Root CA's as you want so that you can have different proxy hosts require different certificates. ![image](https://user-images.githubusercontent.com/26195772/123722573-f4aef700-d8cb-11eb-8bac-11d1eea3641a.png) When creating the proxy host itself, under the auth page you select the Root CA you want to authenticate users against ![image](https://user-images.githubusercontent.com/26195772/123722846-7d2d9780-d8cc-11eb-8b21-58a840b6697e.png)

kerem commented

Author

Owner

@dmwilson1990 commented on GitHub (Sep 5, 2021):

I tinkered around for a bit and figured out how to add certificate authentication. For whatever reason you're very limited in what you can add to the Edit Proxy Host >> Advance >> Custom Nginx Configuration section. However, you can put include. I wanted to authenticate with my smart card so I added two read only binds to the docker-compose stack:

      - /docker/proxy/DoD_CAs.pem:/etc/ssl/certs/DoD_CAs.pem:ro
      - /docker/proxy/cac_auth.conf:/etc/nginx/conf.d/include/cac_auth.conf:ro

Inside the custom nginx configuration section I added include conf.d/include/cac_auth.conf;

You should be able to add any custom nginx config using this method that would otherwise be unsupported in NPM. Here's what is inside my cac_auth.conf.

ssl_client_certificate /etc/ssl/certs/DoD_CAs.pem;
ssl_verify_client on;
if ($ssl_client_s_dn !~ "CN=YOURCERTCOMMONNAMEHERE") {
  return 403;
}

Hope this helps someone!

@dmwilson1990 commented on GitHub (Sep 5, 2021): I tinkered around for a bit and figured out how to add certificate authentication. For whatever reason you're very limited in what you can add to the Edit Proxy Host >> Advance >> Custom Nginx Configuration section. However, you can put **include**. I wanted to authenticate with my smart card so I added two read only binds to the docker-compose stack: ``` - /docker/proxy/DoD_CAs.pem:/etc/ssl/certs/DoD_CAs.pem:ro - /docker/proxy/cac_auth.conf:/etc/nginx/conf.d/include/cac_auth.conf:ro ``` Inside the custom nginx configuration section I added `include conf.d/include/cac_auth.conf;` You should be able to add any custom nginx config using this method that would otherwise be unsupported in NPM. Here's what is inside my cac_auth.conf. ``` ssl_client_certificate /etc/ssl/certs/DoD_CAs.pem; ssl_verify_client on; if ($ssl_client_s_dn !~ "CN=YOURCERTCOMMONNAMEHERE") { return 403; } ``` Hope this helps someone!

kerem commented

Author

Owner

@felix-exon commented on GitHub (Sep 15, 2022):

How about integrating with keycloak? That would be super-awesome!

@felix-exon commented on GitHub (Sep 15, 2022): How about integrating with keycloak? That would be super-awesome!

kerem commented

Author

Owner

@marekful commented on GitHub (Feb 24, 2023):

FYI https://github.com/NginxProxyManager/nginx-proxy-manager/pull/2630 @deibertf

@marekful commented on GitHub (Feb 24, 2023): FYI https://github.com/NginxProxyManager/nginx-proxy-manager/pull/2630 @deibertf

kerem commented

Author

Owner

@cammurray commented on GitHub (Aug 15, 2023):

On top of #2630
@wrouesnel has done the work for client certificate auth in #2956

So there are active PR's in for this feature ask - would be great to see if we can get some commitment to pull both of those :)

@cammurray commented on GitHub (Aug 15, 2023): On top of #2630 @wrouesnel has done the work for client certificate auth in #2956 So there are active PR's in for this feature ask - would be great to see if we can get some commitment to pull both of those :)

kerem commented

Author

Owner

@github-actions[bot] commented on GitHub (Apr 3, 2024):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Apr 3, 2024): Issue is now considered stale. If you want to keep it open, please comment :+1:

kerem commented

Author

Owner

@strongy commented on GitHub (Apr 3, 2024):

So what’s happening

@strongy commented on GitHub (Apr 3, 2024): So what’s happening

kerem commented

Author

Owner

@GregTheHun commented on GitHub (Sep 13, 2024):

I would also like this feature

@GregTheHun commented on GitHub (Sep 13, 2024): I would also like this feature

kerem commented

Author

Owner

@metahertz commented on GitHub (Sep 24, 2024):

Please add your support to @wrouesnel's PR here. Have a current build working for testing: https://github.com/NginxProxyManager/nginx-proxy-manager/pull/2956

@metahertz commented on GitHub (Sep 24, 2024): Please add your support to @wrouesnel's PR here. Have a current build working for testing: https://github.com/NginxProxyManager/nginx-proxy-manager/pull/2956

kerem commented

Author

Owner

@sametflo commented on GitHub (Nov 17, 2024):

Yes, please add your support to @wrouesnel's PR. He did most of the work and we've been waiting since May 28th. We all know it require some verification, but it would be a great feature.

@sametflo commented on GitHub (Nov 17, 2024): Yes, please add your support to @wrouesnel's PR. He did most of the work and we've been waiting since May 28th. We all know it require some verification, but it would be a great feature.

kerem commented

Author

Owner

@github-actions[bot] commented on GitHub (Jun 22, 2025):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Jun 22, 2025): Issue is now considered stale. If you want to keep it open, please comment :+1:

kerem commented

Author

Owner

@sametflo commented on GitHub (Jun 22, 2025):

This feature should not be considered obsolete !
This would still be a great feature for npm.
Please consider adding it.

@sametflo commented on GitHub (Jun 22, 2025): This feature should not be considered obsolete ! This would still be a great feature for npm. Please consider adding it.

kerem commented

Author

Owner

@felix-exon commented on GitHub (Jun 22, 2025):

👍

@felix-exon commented on GitHub (Jun 22, 2025): 👍

kerem commented

Author

Owner

@RonarPS commented on GitHub (Oct 23, 2025):

Whats with this feature? @cammurray is this a feature, which is already implemented in Caddy Proxy Manager? Does Caddy Proxy Manager also exists docker-compose ready?

@RonarPS commented on GitHub (Oct 23, 2025): Whats with this feature? @cammurray is this a feature, which is already implemented in Caddy Proxy Manager? Does Caddy Proxy Manager also exists docker-compose ready?

kerem commented