modomofn/auth-portal repository overview

⁠AuthPortal (v2.0.5)

AuthPortal is a lightweight, self-hosted authentication gateway built for Plex, Jellyfin, and Emby ecosystems. It provides a unified login experience for media-based communities and home-lab environments, issuing secure signed sessions for intranet portals and apps.

AuthPortal authenticates users directly against connected media-server accounts, seals server tokens for reuse, and manages session lifecycle through HTTP-only cookies. Authorized users land on their personalized home page, while unrecognized users get a restricted guest experience.

---

⁠Features

• Unified login gateway

  • Supports Plex authentication and Emby/Jellyfin username+password login
  • Responsive modal-style interface for seamless in-browser authentication

• Secure session management

  • Signed, HTTP-only JWT cookie for authorized sessions
  • Optional TOTP-based multi-factor authentication (with recovery codes)
  • Per-tenant MFA enforcement toggles

• Runtime configuration & admin console

  • Web-based editing for Providers, Security, MFA, App Settings, and LDAP Sync configuration
  • Dedicated admin shell with sidebar navigation, theme picker, and account menu
  • Built-in backups with manual exports, scheduled runs, retention, restore, and download actions
  • Consolidated Logs tab with admin audit history, filters, sorting, and live log streaming

• RBAC, app entitlements, and admin controls

  • Database-backed roles, permissions, role-permission mappings, and user-role bindings
  • Access Control tab for managing roles, permissions, and manual user-role assignments
  • Permission-gated portal app buttons for downstream internal services

• Built-in LDAP Sync

  • Integrated LDAP Sync tab with persisted configuration and connection testing
  • Manual sync runs plus built-in hourly, daily, and weekly scheduling
  • Optional LDAP group-to-role mapping and managed-entry cleanup

• First-party OAuth 2.1 / OIDC

  • Authorization-code + PKCE, optional offline_access refresh rotation, RS256-signed ID tokens
  • Discovery, JWKS, token, and userinfo endpoints for downstream apps and identity brokers
  • OAuth client management with persistent audit history, change reasons, and permission-backed scopes

• Lightweight deployment

  • Single-binary, fully containerized service
  • Simple environment-variable configuration
  • Minimal external dependencies

---

⁠What's New in v2.0.5

• RBAC is now built in: AuthPortal now includes database-backed roles, permissions, user-role bindings, and permission-aware admin/API enforcement.
• Access Control tab: operators can create custom roles and permissions, assign permissions to roles, and manage user-role bindings from the admin console.
• Permission-aware app entitlements: App Settings service buttons can be gated by custom permissions, and downstream OAuth/OIDC clients can request those same permissions as scopes.
• Built-in LDAP Sync: the old standalone LDAP sync workflow is replaced by a first-class LDAP Sync admin tab with persisted config, manual runs, and scheduling.
• LDAP group-to-role mapping: optional group synchronization can grant or revoke RBAC roles during sync.
• Dedicated Logs tab: admin audit history is now consolidated into one place with filters, sorting, and a live application log stream.
• Expanded audit coverage: config, OAuth, Access Control, backups, and LDAP Sync actions now emit persistent server-side audit records.
• Container hardening: updated builder/runtime images and removed the explicit shipped openssl layer to address the CVE-2026-2673 scan finding.

---

⁠Security best practices

• Put AuthPortal behind HTTPS (Caddy / NGINX / Traefik)
• Set strong SESSION_SECRET, DATA_KEY, and database credentials
• Keep images and dependencies up to date
• Don’t expose Postgres or LDAP externally unless necessary
• Enforce MFA with MFA_ENABLE=1 and MFA_ENFORCE=1 where appropriate
• Keep rate limits aligned with your threat model

---

⁠Contributing

Issues and PRs welcome:
https://github.com/modom-ofn/auth-portal/issues⁠

---

⁠License

GPL-3.0
https://github.com/modom-ofn/auth-portal/blob/main/LICENSE⁠