mirror of https://github.com/maxdorninger/MediaManager.git synced 2026-08-02 10:06:36 -04:00

Files

Konstantin Chernyshev bdb886d076 feat: add auth.registration_enabled flag and admin ui user creation (#543 )

Hey! @maxdorninger, could you please take a look on the other one ;) ?

Closes #145 ; seems like a must have thing

- Add `auth.registration_enabled` flag (default `false` — sounds safer
default in current setup)
- Password registration: `/auth/register` route will return 403 if
disabled
- OIDC registration: `UserManager.oauth_callback` is overridden to
reject user without match; so no auto-provision
- `/auth/metadata` exposes the flag to the frontend
- Frontend: signup link hidden on the login card; direct navigation to
`/login/signup` redirects to `/login` via a `+page.ts` load guard
  
  
<img width="463" height="461" alt="Screenshot 2026-05-16 at 20 52 11"
src="https://github.com/user-attachments/assets/1def5142-e930-4aa6-8771-cbff54250c1f"
/>
<img width="450" height="391" alt="Screenshot 2026-05-16 at 20 52 22"
src="https://github.com/user-attachments/assets/b4013964-cace-4aeb-a848-48ced86fcc5f"
/>

  
Also this means uses need to be created somehow -- so..
- Add POST `/users` - admin-protected endpoint to create a new users
(created user can be used with OIDC)
- Fronted: Add new user button and modal dialog  

<img width="800" height="379" alt="Screenshot 2026-05-17 at 11 32 06"
src="https://github.com/user-attachments/assets/048e6c43-a1c1-42ce-a19c-fd9d916a47d9"
/>
<img width="537" height="439" alt="Screenshot 2026-05-17 at 11 32 12"
src="https://github.com/user-attachments/assets/3f83c2c1-027b-4279-b6a1-bbc8da77efed"
/>

---

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Add config toggle to enable/disable user registration; when disabled
sign-up endpoints return 403 and OIDC won’t auto-create unknown users.
Added admin API to create users.

* **Frontend**
* Login UI hides signup link when registration is disabled; signup page
redirects to login. Admin users list gains “Add User” modal to create
users.

* **Documentation**
* Authentication docs and config examples updated to document the new
option.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/maxdorninger/MediaManager/pull/543?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

2026-07-05 19:41:04 +02:00

3.6 KiB

Raw Blame History

description

description
MediaManager supports multiple authentication methods. Email/password authentication is the default, but you can also enable OpenID Connect (OAuth 2.0) for integration with external identity providers

Authentication

All authentication settings are configured in the [auth] section of your config.toml file.

General Authentication Settings (`[auth]`)

token_secret
Strong secret key for signing JWTs (create with openssl rand -hex 32). This is required.
session_lifetime
Lifetime of user sessions in seconds. Default is 86400 (1 day).
admin_emails
A list of email addresses for administrator accounts. This is required.
email_password_resets
Enables password resets via email. Default is false.
registration_enabled
Allows new users to sign up for an account. Default is false.

!!! info To use email password resets, you must also configure SMTP settings in the [notifications.smtp_config] section.

!!! info When registration_enabled is false, the sign-up page is hidden, /auth/register returns 403, and OIDC rejects unknown users (existing users keep working). The bootstrap admin (see admin_emails) is unaffected.

!!! tip "Adding users when registration is disabled" Administrators can add users at any time from the Settings → Users page via the "Add User" button. For OIDC-only users, leave the password field blank — a random password is generated and the user is matched to their OIDC account by email on first sign-in.

!!! info When setting up MediaManager for the first time, you should add your email to admin_emails in the [auth] config section. MediaManager will then use this email instead of the default admin email. Your account will automatically be created as an admin account, allowing you to manage other users, media and settings.

OpenID Connect Settings (`[auth.openid_connect]`)

OpenID Connect allows you to integrate with external identity providers like Google, Microsoft Azure AD, Keycloak, or any other OIDC-compliant provider.

enabled
Set to true to enable OpenID Connect authentication. Default is false.
client_id
Client ID provided by your OpenID Connect provider.
client_secret
Client secret provided by your OpenID Connect provider.
configuration_endpoint
OpenID Connect configuration endpoint URL. Do not include a trailing slash. Usually ends with /.well-known/openid-configuration.
name
Display name for the OpenID Connect provider shown on the login page.

Configuration for your OpenID Connect Provider

Redirect URI

The OpenID server will likely require a redirect URI. This URL will usually look something like this:

{MEDIAMANAGER_URL}/api/v1/auth/oauth/callback

!!! warning It is very important that you set the correct callback URI, otherwise it won't work!

Authentik Example

Here is an example configuration for the OpenID Connect provider for Authentik.

Example Configuration

Here's a complete example of the authentication section in your config.toml:

[auth]
token_secret = "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6"
session_lifetime = 604800  # 1 week
admin_emails = ["admin@example.com", "manager@example.com"]
email_password_resets = true
registration_enabled = false

[auth.openid_connect]
enabled = true
client_id = "mediamanager-client"
client_secret = "your-secret-key-here"
configuration_endpoint = "https://auth.example.com/.well-known/openid-configuration"
name = "Authentik"

3.6 KiB Raw Blame History