gitea-admin/gh-christianlouis-docuelevate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(auth): add configurable admin group name for OAuth user access

Browse Source
This commit is contained in:
Christian Krakau-Louis
2026-02-11 22:53:03 +01:00
parent 0a3c8987f8
commit 7222740204
6 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/AuthenticationSetup.md
+2
View File
@@ -10,6 +10,7 @@ This guide explains how to configure authentication for DocuElevate to secure yo
| `SESSION_SECRET` | Secret key for session encryption (min 32 characters) |
| `ADMIN_USERNAME` | Username for basic authentication |
| `ADMIN_PASSWORD` | Password for basic authentication |
| `ADMIN_GROUP_NAME` | OIDC group name that grants admin access (default: `admin`) |
| `AUTHENTIK_CLIENT_ID` | Client ID for OpenID Connect authentication |
| `AUTHENTIK_CLIENT_SECRET` | Client secret for OpenID Connect authentication |
| `AUTHENTIK_CONFIG_URL` | OpenID Connect discovery URL |
@@ -63,6 +64,7 @@ For smaller deployments or testing, simple authentication is easy to set up:
SESSION_SECRET=your-secure-random-string-at-least-32-chars
ADMIN_USERNAME=your_admin_username
ADMIN_PASSWORD=your_secure_password
ADMIN_GROUP_NAME=admin
```
2. Restart DocuElevate to apply the changes
docs/ConfigurationGuide.md
+2
View File
@@ -93,6 +93,7 @@ DocuElevate can monitor multiple IMAP mailboxes for document attachments. Each m
| `SESSION_SECRET` | Secret key used to encrypt sessions and cookies (at least 32 chars). |
| `ADMIN_USERNAME` | Username for basic authentication (when not using OIDC). |
| `ADMIN_PASSWORD` | Password for basic authentication (when not using OIDC). |
| `ADMIN_GROUP_NAME` | Group name in OIDC claims that grants admin access. Default: `admin`. |
| `AUTHENTIK_CLIENT_ID` | Client ID for Authentik OAuth2/OIDC authentication. |
| `AUTHENTIK_CLIENT_SECRET` | Client secret for Authentik OAuth2/OIDC authentication. |
| `AUTHENTIK_CONFIG_URL` | Configuration URL for Authentik OpenID Connect. |
@@ -519,6 +520,7 @@ AUTH_ENABLED=true
SESSION_SECRET=a-very-long-and-secure-random-secret-key-string-for-session-encryption
ADMIN_USERNAME=admin
ADMIN_PASSWORD=your_secure_password
ADMIN_GROUP_NAME=admin
AUTHENTIK_CLIENT_ID=...
AUTHENTIK_CLIENT_SECRET=...
AUTHENTIK_CONFIG_URL=https://auth.example.com/.well-known/openid-configuration
docs/SettingsManagement.md
+1 -1
View File
@@ -198,7 +198,7 @@ Settings are stored in the `application_settings` table with:
- **Check authentication**: Make sure you're logged in
- **Check admin status**:
- Local auth: Verify `ADMIN_USERNAME` and `ADMIN_PASSWORD` are correct
- OAuth: Verify your user is in the admin group
- OAuth: Verify your user is in the admin group (configurable via `ADMIN_GROUP_NAME`)
- **Check logs**: Look for "Non-admin user attempted to access settings page" messages
### Settings Not Taking Effect