Two Factor Authentication / 2FA with TOTP

[TCB13]

Hello,

As requested multiple times before, but closed due to project changer owners etc. here I am requesting once again a method for optional 2FA TOTP for user login.

How I envision it working:

• Add an option so TOTP 2FA can be enabled for users;
• Generate a QR code for each account;
• Users scan the QR code into their phones with a TOTP compatible App such as Google Authenticator;
• On login users must provide username + password + temporary code.

Libraries:

• https://github.com/pquerna/otp

Previously mentioned at:

• https://github.com/filebrowser/filebrowser/issues/286
• https://github.com/filebrowser/filebrowser/issues/1674

Thank you.

[just5ky]

I have File browser behind Authelia. I also added a bypass rule in Authelia config for sharing files.

access_control:
  rules:
    - domain:
        - "file.DOMAIN"     #File Browser
      resources:
        - "^/api/public/dl/*"
        - "/share/*"
        - "/static/js/*"
        - "/static/css/*"
        - "/static/img/*"
        - "/static/themes/*"
        - "/static/fonts/*"
      policy: bypass

[TCB13]

@Just5KY that is a good solution in some more complex cases. But something built in filebrowser and the current authentication system would be nice.

[AlphaJack]

@Just5KY can you share your .filebrowser.json? I have

{
 "baseURL": "",
 "address": "",
 "port": 8080,
 "log": "stdout",
 "database": "/database.db",
 "root": "/srv",
 "auth": {
  "method": "proxy",
  "header": "Remote-User"
 }
}

But I am still prompted with the builtin auth even after I login on Authelia

[just5ky]

@Just5KY can you share your .filebrowser.json? I have

{
 "baseURL": "",
 "address": "",
 "port": 8080,
 "log": "stdout",
 "database": "/database.db",
 "root": "/srv",
 "auth": {
  "method": "proxy",
  "header": "Remote-User"
 }
}

But I am still prompted with the builtin auth even after I login on Authelia

My method is not bypassing the default login screen, that's still there. I'm just using authelia for extra security

[wlanut]

I have File browser behind Authelia. I also added a bypass rule in Authelia config for sharing files.

access_control:
  rules:
    - domain:
        - "file.DOMAIN"     #File Browser
      resources:
        - "^/api/public/dl/*"
        - "/share/*"
        - "/static/js/*"
        - "/static/css/*"
        - "/static/img/*"
        - "/static/themes/*"
        - "/static/fonts/*"
      policy: bypass

Would you mind sharing how/if you were able to resolve the issue of Authelia being bypassed when Filebrowser is accessed from a shared link? If accessing via a shared link, and then clicking the Login button on the sidebar, Authelia doesn't step in until the page refreshes. Pretty sure I have Authelia configured correctly (it works for all my other resources, and I copied the settings you listed to my config file).

[just5ky]

@wlanut

        - "^/api/public/dl/*"
        - "/share/*"

This URI path is bypassed So anyone clicks on the share link, they can access the share. But if they go anywhere else, they get authelia

[wlanut]

@Just5KY

I've got that part working, not sure if you're able to replicate the specific instance I'm talking about though.

If accessing via a shared link, and then clicking the Login button on the sidebar, Authelia doesn't step in until the page refreshes.

What I did notice from some brief testing, is that even if you type in the correct credentials at said login screen, access will be denied if you haven't authenticated with Authelia yet. For now, I suppose that works well enough. Having said that, I was using Cloudflare Zero Trust at first and that behavior was not happening, so if I could get to the login screen through the share link, I could successfully login if I knew the password. Might put in a feature request or something for this.

EDIT: just found a comment experiencing this same behavior on another issue - Issue #1878

[just5ky]

@wlanut I was able to reproduce it, but it's alright. No one can get in without interacting with authelia.

[github-actions[bot]]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[TCB13]

Ping… pong… just keeping this open.

[github-actions[bot]]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[TCB13]

Ping… pong… just keeping this open.

[github-actions[bot]]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[just5ky]

Ping… pong… just keeping this open.

[just5ky]

BTW, i just found out about this https://filebrowser.org/configuration/authentication-method#no-authentication @TCB13 @wlanut

[TCB13]

BTW, i just found out about this https://filebrowser.org/configuration/authentication-method#no-authentication @TCB13 @wlanut

That behind Authelia might be a good combination indeed.

[just5ky]

BTW, i just found out about this https://filebrowser.org/configuration/authentication-method#no-authentication @TCB13 @wlanut

That behind Authelia might be a good combination indeed.

Yeah, I've also switched from authelia to Authentik as i can Role based access control while having bypass paths on it. But I'm going to it later

[github-actions[bot]]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[TCB13]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

Bad bot 🗡️

[github-actions[bot]]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[TCB13]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

Bad bot 🗡️

[piraterx]

I would like that too so I can use from outside. I know other services such as authelia and other but built in is always best.

[github-actions[bot]]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[makkarakka3]

bot bad me want 2fa

[Forsskieken]

To keep open and to ask info.. Can somebody post the Authentik and/or authelia config compose.yml and config files?

[just5ky]

@Forsskieken

I have moved on to using Authentik, I just add these in Unauthenticated Paths in FileBrowsers Proxy Provider settings inside Authentik.

/static/.*
/share/.*
/api/public/dl/.*

this allows me to share files with anyone and they won't be able to go anywhere else except these three URI paths

Edit: See my first comment at the top, I share how to do it in Authelia too

[Forsskieken]

@Just5KY thanks for that info. Is there a way in FB to give users acces to their directory and a global read share? The way I think I can do it is via mount in the docker-compose.yml volumes: - /mnt/QData/QMedia/QDocu:/srv/users/PeterPan/Documentair - /mnt/QData/QMedia/QDocu:/srv/users/SnowWhite/Documentair but of course if you have a new user the container needs to be recreated. I tried with symlinks but that didn't worked out

[github-actions[bot]]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[TCB13]

Blah.

[pigate-eu]

Any news about two-step verification feature?