How to get the hostname in Expression Policy?

[adoyle-h]

I create an expression policy and bind it with my authorization flow. When user visit subdomain.my.com, I want to get the value of hostname in the expression policy.
I have tried request.http_request.get_host() but it seems return auth.my.com (the authentik domain), not the domain the user visiting (subdomain.my.com).
How to get the hostname in Expression Policy?

[dewi-tik]

Could you explain the use case for this? It's possible that there's a better method for achieving your desired outcome.

[adoyle-h]

In my scenario, I'm using domain level forward auth, and there are many static websites "a.my.com", "b.my.com", "c.my.com", "d.my.com"...
I create one outpost, one application, one domain level forward provider, and one authorization flow binding with multiple expression policies.

I want use expression policies to control the access to each websites for each user. In my plan, the users in "anonymous" group should only be allowed to "a.my.com" and "b.my.com", and users in "authentik Admins" group should be allowed to all subdomains.

My provider-authorization flow is:

Expression policy for anonymous: return ak_is_group_member(request.user, name='anonymous') and request.http_request.get_host() in ["a.my.com", "b.my.com"]
Expression policy for admin: return ak_is_group_member(request.user, name='authentik Admins')
The policy engine mode is "any".

[BeryJu]

This is not how domain-level forward auth works. When using domain-level forward auth, authorization will happen once when the user access anything.my.com and then the user will have access to *.my.com without further re-authorization

[gravity182]

This is not how domain-level forward auth works. When using domain-level forward auth, authorization will happen once when the user access anything.my.com and then the user will have access to *.my.com without further re-authorization

So it's not possible to implement subdomain-level authorization, while keeping SSO? For example, user A has access to the "foo.my.com" app while user B has access to all the subdomains. That is, authentication happens only once, while authorization applies on each subdomain's visit.

Apparently Authelia does have such a feature: https://www.authelia.com/configuration/security/access-control/.

[BeryJu]

to do that you'd need to do Forward auth (single application)

[gravity182]

But does it allow for SSO authentication? afaik the users will have to login on each subdomain (per application), since the domain of the cookie won't be the root domain?

[BeryJu]

The user will have to authorize for each domain (which with the default flows is seamless and not visible to the user), the won't have to login for each subdomain

[adoyle-h]

@dewi-tik Do you have any advice?

[dewi-tik]

I believe that what you're looking for is something like this

redirect_url=request.http_request.GET["redirect_uri"]

if (redirect_url == "https://a.my.com/") and (ak_is_group_member(request.user, name='anonymous')):
    return True

[adoyle-h]

I tried below policies, but both of them not work. The user still get permission denied.

redirect_url=request.http_request.GET["redirect_uri"]
return  (redirect_url == "https://a.my.com/") 

redirect_url=request.http_request.GET["redirect_uri"]
return  (redirect_url == "https://a.my.com") 

[dewi-tik]

I recommend enabling execution logging on the expression policy. This will allow you to see if the expression policy is passing/failing in Events > Logs. The expression policy simply acts as a pass/fail gate, you'll still need to ensure that users have the relevant permissions to access the application.

[adoyle-h]

The policy execution log shows that the "redirect_uri" is "https://auth.my.com/outpost.goauthentik.io/callback?X-authentik-auth-callback=true", not "https://a.my.com".

[adoyle-h]

I'm still waiting for an answer. Could anyone help me?

[gravity182]

I'm also curious. It would be nice to apply authorization based on a group for the domain level provider.

[gravity182]

btw I've found a similar issue #2807