Uptime Kuma

Tested Versions

• Authelia
  • v4.38.0
• Uptime Kuma
  • v1.23.11

{{% oidc-common %}}

Assumptions

This example makes the following assumptions:

• Application Root URL: https://uptime-kuma.{{< sitevar name="domain" nojs="example.com" >}}/
• Authelia Root URL: https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/
• Client ID: uptime-kuma
• Client Secret: insecure_secret
• Secured Resource URL: https://application.{{< sitevar name="domain" nojs="example.com" >}}/

Some of the values presented in this guide can automatically be replaced with documentation variables.

{{< sitevar-preferences >}}

Important Notes

This implementation has several facets which must be configured as a security precaution. It's advised people read the OAuth 2.0 Bearer Token Usage integration guide in addition to this guide to properly understand this process.

For example this guide has a requirement to adapt a fairly new and special section of Authelia. It's important to take the time to understand it before you attempt to do it. Some notes about this are below.

1. The implementation value of the server authz endpoints section must be the appropriate implementation for your proxy.
2. The endpoint_name in the server authz endpoints section is the actual name of the endpoint which must be configured in your proxy for the Forwarded / Redirected Authorization Flow:
   1. You can customize this name but by configuring just one all other default endpoints for authorization are removed such as /api/verify, /api/authz/forward-auth, etc.
   2. The name represents the endpoint path, for example setting endpoint_name will configure an endpoint at /api/authz/endpoint_name.
3. The use of the HeaderAuthorization strategy and how it's configured here accepts bearer tokens in the Authorization header as one of the possible ways to authenticate, but still allows cookie-based authorization.

See more information about the server authz endpoints section in the Configuration Guide and Reference Guide.

Configuration

Authelia

The following YAML configuration is an example Authelia client configuration for use with Uptime Kuma which will operate with the above example:

server:
  endpoints:
    authz:
      endpoint_name:
        implementation: ''
        authn_strategies:
          - name: 'HeaderAuthorization'
            schemes:
              - 'Basic'
              - 'Bearer'
          - name: 'CookieSession'
access_control:
  rules:
    - domain:
      - 'application.{{< sitevar name="domain" nojs="example.com" >}}'
      subject: 'oauth2:client:uptime-kuma'
      policy: 'one_factor'
identity_providers:
  oidc:
    ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
    ## See: https://www.authelia.com/c/oidc
    clients:
      - client_id: 'uptime-kuma'
        client_name: 'Uptime Kuma'
        client_secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
        public: false
        require_pkce: false
        pkce_challenge_method: ''
        requested_audience_mode: 'implicit'
        scopes:
          - 'authelia.bearer.authz'
        audience:
          - 'https://application.{{< sitevar name="domain" nojs="example.com" >}}/'
        grant_types:
          - 'client_credentials'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_basic'

Notes:

• The configuration has a requested_audience_mode value of implicit which is used to automatically grant all audiences the client is permitted to request, the default is explicit which does not do this and the client must also request the audience using the audience form parameter. As Uptime Kuma does not currently support this configuration is required.
• The audience (or multiple) is the endpoints of the secured resource you want to monitor using Uptime Kuma.
• The oauth2:client:uptime-kuma is a special subject which refers to the uptime-kuma client id and allows Access Tokens granted via the Client Credentials Flow to be used provided they were granted to this client.

Application

To configure Uptime Kuma there is one method, using the Web GUI.

Web GUI

To configure Uptime Kuma to utilize Authelia as an OpenID Connect 1.0 Provider, use the following instructions:

1. Create a new status monitor or configure an existing one
2. Choose monitor type e.g. HTTP(s) Keyword and set a keyword you want to find
3. Set the URL to be monitored (this corresponds to the audience parameter in Authelia)
4. Configure the following options:
   • Method: OAuth2: Client Credentials
   • Authentication Method: Authorization Header
   • OAuth Token URL: https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/api/oidc/token
   • Client ID: uptime-kuma
   • Client Secret: insecure_secret
   • OAuth Scope: authelia.bearer.authz

See the following screenshot for an authentication example of the above:

{{< figure src="uptime-kuma-authentication.png" alt="Uptime Kuma Authentication example" width="300" >}}