feat: check for basic auth (#110)

[Janhouse]

Added a simple check for HTTP Basic authorization. Seems to work fine with Authentik SSO passing the auth header.

This does not add WWW-Authenticate header since it normally expects to receive Bearer auth for JWT.

I am not familiar with go, so I presume that bcrypt.CompareHashAndPassword takes care of timing attacks and I don't have to add ConstantTimeCompare myself. Please correct me if I am wrong.

Maybe adding rate limiting for brute force detection would be a good idea. Should it be added only for Basic auth, or is it relevant for Bearer token as well?

[garethgeorge]

Looks great! Thanks for contributing this!

[garethgeorge]

If you have a bit of bandwidth, a great followup to this would be a wiki page covering authentication if you want to add some details about how to use this with a common reverse proxy. I'll be happy to edit / expand on whatever initial content you seed.

[Janhouse]

Here is the guide, @garethgeorge feel free to add this to wiki:

Basic authentication for SSO

HTTP basic authentication can be used together with forward-auth to enable single-sign-on.

Forward-auth passes request headers to a 3rd party software, most commonly an SSO identity provider service, which can add additional headers to the proxied service (Backrest), in this case adding Authorization: Basic ...

All of the major web servers and proxies support forward-auth (Apache, Nginx, Traefik, Caddy, etc.), please consult their documentation on how to set it up.

Example with Authentik

Set username and password attributes

When using Authentik proxy provider for forward-auth, enable Send HTTP-Basic Authentication on the Backrest provider, set attribute names which will be read from either group or user profile.

Bind group or user to Backrest application

In the Authentik applications section, navigate to your Backrest application, and go to Policy/Group/User Binding. Click Bind existing policy button.

Choose the appropriate Group or User to bind to the application and click Create.

Set the username and password in group/user attributes

Add the previously chosen username and password attributes (with values from actual user in Backrest) in the group attributes section and click Update

Now when connecting to Backrest, Authentik will add HTTP-Basic authentication header with username and password from the group/user attributes and user should be automatically logged in.

[garethgeorge]

Hi, I'm evaluating relicensing Backrest as AGPL-3.0 . Thanks for contributing this fix!

I'm wondering if you'd be willing to retroactively sign a CLA? Or grant more specific permission to retain the copyright for your PRs but relicense your changes in the codebase under AGPL-3.0 .

I've become aware of a few SAAS looking at selling Backrest which goes philosophically against what I created it for (well they're welcome to -- but their platforms should be OSS and self-hostable re: the same freedoms Backrest provides!).

[Janhouse]

Sure thing, AGPL sounds great.