Unable to set authAccounts #72

UjCbFwtBayFM · 2019-09-07T23:58:12Z

Could you provide an example of authAccounts use ? I've been trying to make it work and nothing seems to pass validation.
The closest thing I guess shoud work (if I understand documentation correctly) is :

{
	"tree": "./webroot",

	"authAccounts": {
		"permissions": {
			"putsaver": true,
			"writeErrors": true,
			"upload": true,
			"mkdir": true,
			"websockets": true,
			"registerNotice": true
		},
		"clientKeys": {"user": {"hash", "salt"}},
	},
	
	"bindInfo": {
		"bindAddress": ["127.0.0.1"],
	},
	"putsaver": {
		"backupFolder": "../backups"
	},
	"$schema": "./settings-2-1.schema.json"
}

Instead it throws an invalid character error between hash and salt.

The text was updated successfully, but these errors were encountered:

Arlen22 · 2019-09-09T16:59:44Z

So when you enter a username and password at /admin/authenticate/login.html and the username doesn't exist and the registerNotice permission for the request is set to true (by default this would only be the case on localhost), it will print a bunch of information to the terminal, including the public key, which you then paste into the clientKeys hashmap. - clientKeys - A hashmap of { [username]: { publicKey, cookieSalt } } https://arlen22.github.io/tiddlyserver/docs/serverconfig.html#authaccounts So it would look like this. clientKeys: { "username": { "publicKey": "base64string", "cookieSalt": "anystring" } }

…

On Sat, Sep 7, 2019 at 19:58 UjCbFwtBayFM ***@***.***> wrote: Could you provide an example of authAccounts use ? I've been trying to make it work and nothing seems to pass validation. The closest thing I guess shoud work (if I understand documentation correctly) is : { "tree": "./webroot", "authAccounts": { "permissions": { "putsaver": true, "writeErrors": true, "upload": true, "mkdir": true, "websockets": true, "registerNotice": true }, "clientKeys": {"user": {"hash", "salt"}}, }, "bindInfo": { "bindAddress": ["127.0.0.1"], }, "putsaver": { "backupFolder": "../backups" }, "$schema": "./settings-2-1.schema.json" } Instead it throws an invalid character error between hash and salt. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#72?email_source=notifications&email_token=AADLMQHTFZOCOWJ7RUNFBPTQIQ5ZJA5CNFSM4IURUM62YY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4HJ7L7FQ>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AADLMQGO7GFG3NWBNNSHBVLQIQ5ZJANCNFSM4IURUM6Q> .

Arlen22 · 2019-09-09T17:15:18Z

I've updated the docs page authAccounts section to make it slightly clearer.

…

On Mon, Sep 9, 2019 at 12:59 PM Arlen Beiler ***@***.***> wrote: So when you enter a username and password at /admin/authenticate/login.html and the username doesn't exist and the registerNotice permission for the request is set to true (by default this would only be the case on localhost), it will print a bunch of information to the terminal, including the public key, which you then paste into the clientKeys hashmap. - clientKeys - A hashmap of { [username]: { publicKey, cookieSalt } } https://arlen22.github.io/tiddlyserver/docs/serverconfig.html#authaccounts So it would look like this. clientKeys: { "username": { "publicKey": "base64string", "cookieSalt": "anystring" } } On Sat, Sep 7, 2019 at 19:58 UjCbFwtBayFM ***@***.***> wrote: > Could you provide an example of authAccounts use ? I've been trying to > make it work and nothing seems to pass validation. > The closest thing I guess shoud work (if I understand documentation > correctly) is : > > { > "tree": "./webroot", > > "authAccounts": { > "permissions": { > "putsaver": true, > "writeErrors": true, > "upload": true, > "mkdir": true, > "websockets": true, > "registerNotice": true > }, > "clientKeys": {"user": {"hash", "salt"}}, > }, > > "bindInfo": { > "bindAddress": ["127.0.0.1"], > }, > "putsaver": { > "backupFolder": "../backups" > }, > "$schema": "./settings-2-1.schema.json" > } > > Instead it throws an invalid character error between hash and salt. > > — > You are receiving this because you are subscribed to this thread. > Reply to this email directly, view it on GitHub > <#72?email_source=notifications&email_token=AADLMQHTFZOCOWJ7RUNFBPTQIQ5ZJA5CNFSM4IURUM62YY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4HJ7L7FQ>, > or mute the thread > <https://github.com/notifications/unsubscribe-auth/AADLMQGO7GFG3NWBNNSHBVLQIQ5ZJANCNFSM4IURUM6Q> > . >

digitalap3 · 2020-01-09T08:00:02Z

okay I modified the file, taking out one of the 'trees' and seeing the part that states the key is the account id, which I took to be 'design team', I added an account id. The modified settings.json:
{
"tree": "../work",

"authAccounts": {
"mainuser": {
"clientKeys": {
"username": { "publicKey": "keyfromterminal", "cookieSalt": "salt" }
},
"permissions": {
"mkdir": true,
"putsaver": true,
"registerNotice": true,
"upload": true,
"websockets": true,
"writeErrors": true,
"loginlink": true
}
}
},

"bindInfo": {
"bindAddress": ["0.0.0.0"]
},

"$schema": "./settings-2-1.schema.json"
}

and the error :

{
"authAccounts": {
"mainuser": {
"permissions": "["authAccounts","mainuser","permissions"] missing required keys transfer\n"
}
}
}
uncaught error during server startup
ServerConfig did not pass validator

digitalap3 · 2020-01-09T08:09:15Z

I'm sorry I can't seem to edit my post above. So I just added a transfer: true key to the permissions section and the server starts. I cannot find any reference to this key or what it does, however.

SleepyGinger · 2020-04-21T00:05:48Z

@digitalap3 Thanks for posting this question. Im having the same problem. I added transfer:true to the permissions section but was unclear what you were referring to with "the server starts".

 "authAccounts": {
                "permissions": {
                        "putsaver": true,
                        "writeErrors": true,
                        "upload": true,
                        "mkdir": true,
                        "websockets": true,
                        "registerNotice": true,
                        "loginlink": true,
                        "registerNotice": true,
                        "transfer": true
                },
                "clientKeys": {
                        "username": { "publicKey": "base64string", "cookieSalt": "anystring" }
                },              
                        },

Arlen22 · 2020-04-22T13:46:06Z

@digitalap3 That looks good, but you need to wrap the whole thing in a authAccounts key. This should be sufficient to get the server started.

{
  "authAccounts": {
    "authAccountsKey1 or whatever you want to name it": {
      "permissions": {
        "putsaver": true,
        "writeErrors": true,
        "upload": true,
        "mkdir": true,
        "websockets": true,
        "registerNotice": true,
        "loginlink": true,
        "transfer": true
      },
      "clientKeys": {      }
    }
  }
}

Arlen22 · 2020-04-22T14:19:58Z

Here's a short video I made that demonstrates the login process. Let me know here if you have any further questions. https://youtu.be/UfAiyubP8nY

zevarela · 2020-04-22T16:38:59Z

Hi Arlen, thanks for your pointers.
I've manged to authenticate my user, but I can still access all my wiki folders whether I'm authenticated or not. Here's my full settings.json:

{
       "tree": { 
         "RememberAll": "~/tiddly/RememberAll/",
         "Cardo": "~/tiddly/Cardo/",
         "Biblioteca": "~/tiddly/library"
        },
        "bindInfo": {
                "port": 8080,
		"bindAddress": ["127.0.0.1"]
	},
	"putsaver": {
		"backupFolder": "../backups", 
                "gzipBackups": true
	},
	"$schema": "./settings-2-1.schema.json",
        "authAccounts": {
            "av": {
                "clientKeys": {
                  "jav": { "publicKey": "«key copied from failed login»", "cookieSalt": "«my salt»" }
                }, 
                "permissions": {
                  "mkdir": true,
                  "putsaver": true,
                  "registerNotice": true,
                  "upload": true,
                  "websockets": true,
                  "writeErrors": true,
                  "loginlink": true
                }
            }
        },
        "authCookieAge": 86400
}

EDIT: When I try to add the "transfer": true property I get the following error:

jav@dragon:~/tiddlyserver $ node server.js
Settings file: /home/jav/tiddlyserver/settings.json
{
  "authAccounts": {
    "av": {
      "permissions": {
        "transfer": "property is unexpected"
      }
    }
  }
}
uncaught error during server startup
ServerConfig did not pass validator
exiting

Also it might be important to mention that I'm running [email protected] and that I've just upgraded tiddlywiki to 5.1.22 by running sudo npm install -g [email protected] and linked the tiddlywiki folder in tiddlyserver to the global tiddlywiki (hope that's alright).

Any help you might provide is most welcome. Thanks!

Arlen22 · 2020-04-22T17:03:43Z

Replace your folder path string, with this object:

{ 
  "$element": "folder", 
  "path": "your folder path string", 
  "$options": [
    {"$element": "auth", "authList": ["av"] }
  ]
},

The authList array contains the authAccounts keys that are allowed to access this folder.

SleepyGinger · 2020-04-23T00:22:42Z

Thanks so much for the video @Arlen22 ! I got the same error as @zevarela. I have tried inserting the above object in the tree section in the settings.json and of course changing "your folder path string" to my actual folder path. Where should I insert it? Thanks again!

zevarela · 2020-04-23T12:58:09Z

Many thanks Arlen22!

It's working perfectly! Below is my final settings.json in case it helps SleepyGinger or anyone else.
This configuration has 3 tiddlywikis, that are only accessible to user jav of group av:

{
       "tree": { 
         "RememberAll": {
           "$element": "folder",
           "path": "~/tiddly/RememberAll/",
           "$options": [
             {"$element": "auth", "authList": ["av"] } ]
         },

         "Biblioteca": {
           "$element": "folder",
           "path": "~/tiddly/library",
           "$options": [
             {"$element": "auth", "authList": ["av"] } ]
         },

         "Cardo": {
           "$element": "folder",
           "path": "~/tiddly/Cardo/",
           "$options": [
             {"$element": "auth", "authList": ["av"] } ]
         },
        },
        "bindInfo": {
                "port": 8080,
		"bindAddress": ["127.0.0.1"]
	},
	"putsaver": {
		"backupFolder": "../backups", 
                "gzipBackups": true
	},
        "authAccounts": {
            "av": {
                "clientKeys": {
                  "jav": { "publicKey": "«key copied from failed login»", "cookieSalt": "«my salt»" }
                }, 
                "permissions": {
                  "mkdir": true,
                  "putsaver": true,
                  "registerNotice": true,
                  "upload": true,
                  "websockets": true,
                  "writeErrors": true,
                  "loginlink": true
                }
            }
        },
	"$schema": "./settings-2-1.schema.json",
        "authCookieAge": 864000
}

SleepyGinger · 2020-04-23T19:55:24Z

Thank you sooooo much @zevarela this helped more than youll ever know. :D

ohare93 · 2020-06-29T16:04:59Z

I was having similar issues setting up authentication. This thread helped greatly, though it is rather finicky.

I am not getting the following error when I visit my TiddlyWiki externally (via a reverse nginx proxy). I did not get this error before applying this authentication 🤔

I do not get the error when visiting via local host, though the permissions are the same. Any idea how I can fix this?

Settings.json file:

{
  "tree": {
    "wiki":{
	"$element": "group",
	"$children":  {
	  "Personal": "tw/Personal",
	  "WikiFiles": "/home/pi/SyncThing/WikiFiles"
	},
	"$options": [{"$element": "auth", "authList": ["jmo"] } ]
    }
  },

  "bindInfo": {
    "localAddressPermissions": {
      "*": {
	  "datafolder": true,
	  "loginlink": true,
	  "mkdir": true,
	  "putsaver": true,
	  "registerNotice": true,
	  "transfer": false,
	  "upload": true,
	  "websockets": true,
	  "writeErrors": false,
	}
    },
    "bindWildcard": true
  },
  "putsaver": {
    "backupFolder": ""
  },
  "authAccounts": {
	"jmo": {
		"clientKeys": {
		  "jmo": { "publicKey": "<key>", "cookieSalt": "<mineral>" }
		}, 
		"permissions": {
			"datafolder": true,
			"loginlink": true,
			"mkdir": true,
			"putsaver": true,
			"registerNotice": true,
			"transfer": false,
			"upload": true,
			"websockets": true,
	  		"writeErrors": false,
		}
  	}
  },
  "authCookieAge": 864000,
  "$schema": "./tiddlyserver-2-2.schema.json",
}

Also, must I apply the permissions to a top level group? Or is there some way I can simply set it to the entire server? I do not like that people can get to the landing page to see even the top level group without signing in 😞

Arlen22 · 2020-07-02T02:52:13Z

Yes, you can make a group the top level, and then apply everything to that.

  "tree": {
	"$element": "group",
	"$children":  {
	  "Personal": "tw/Personal",
	  "WikiFiles": "/home/pi/SyncThing/WikiFiles"
	},
	"$options": [{"$element": "auth", "authList": ["jmo"] } ]
  },

Arlen22 · 2020-07-02T02:58:44Z

The other problem is probably related to some kind of cookie or method related problem related to reverse proxy. Check for failed network requests. Normally TiddlyWiki is not affected by TiddlyServer in this way, but in this case it is possible. Are there any errors in the server or browser console?

Arlen22 · 2020-07-02T03:09:41Z

@ohare93 , also, it's better to open a new issue for a new or only partially related problem. It helps to keep things simpler and I still get notified the same.

ohare93 mentioned this issue Jul 2, 2020

Server Issues when benig an Nginx Reverse Proxy #97

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Unable to set authAccounts #72

Unable to set authAccounts #72

UjCbFwtBayFM commented Sep 7, 2019

Arlen22 commented Sep 9, 2019 via email

Arlen22 commented Sep 9, 2019 via email

digitalap3 commented Jan 9, 2020

digitalap3 commented Jan 9, 2020

SleepyGinger commented Apr 21, 2020

Arlen22 commented Apr 22, 2020 •

edited

Loading

Arlen22 commented Apr 22, 2020

zevarela commented Apr 22, 2020 •

edited

Loading

Arlen22 commented Apr 22, 2020

SleepyGinger commented Apr 23, 2020 •

edited

Loading

zevarela commented Apr 23, 2020

SleepyGinger commented Apr 23, 2020

ohare93 commented Jun 29, 2020

Arlen22 commented Jul 2, 2020

Arlen22 commented Jul 2, 2020 •

edited

Loading

Arlen22 commented Jul 2, 2020

Unable to set authAccounts #72

Unable to set authAccounts #72

Comments

UjCbFwtBayFM commented Sep 7, 2019

Arlen22 commented Sep 9, 2019 via email

Arlen22 commented Sep 9, 2019 via email

digitalap3 commented Jan 9, 2020

digitalap3 commented Jan 9, 2020

SleepyGinger commented Apr 21, 2020

Arlen22 commented Apr 22, 2020 • edited Loading

Arlen22 commented Apr 22, 2020

zevarela commented Apr 22, 2020 • edited Loading

Arlen22 commented Apr 22, 2020

SleepyGinger commented Apr 23, 2020 • edited Loading

zevarela commented Apr 23, 2020

SleepyGinger commented Apr 23, 2020

ohare93 commented Jun 29, 2020

Arlen22 commented Jul 2, 2020

Arlen22 commented Jul 2, 2020 • edited Loading

Arlen22 commented Jul 2, 2020

Arlen22 commented Apr 22, 2020 •

edited

Loading

zevarela commented Apr 22, 2020 •

edited

Loading

SleepyGinger commented Apr 23, 2020 •

edited

Loading

Arlen22 commented Jul 2, 2020 •

edited

Loading