Hello,

Was also looking at this but failed.
We also use an external authoritative server with reverse proxy authentication.

Tried to create a token with python requests.Session with all the session cookies/headers and using basicAuth but still get below which I think I can expected since the user is not managed by gitea nor is the gitea api ready for these types of setups.

{"message":"user does not exist [uid: 12, name: yourusername, keyid: 0]","url":"https://gitea.domain.net/api/swagger"}

if i dont use basicAuth i simply get

{"message":"Only signed in user is allowed to call APIs."}

Would be great to have the api follow similar authentication policies as set for the UI

thanks

Was trying this again but with oauth2_client configured on gitea, which works well, but the 3rd party provider JWTs does not seem to be supported by gitea.

Only the JWTs from gitea when gitea "acts" as a oauth2 provider, do the tokens work with api.

Would be nice if the oauth2_client was extended on the api side

Same need here. What must be done do get this Feature in?

After doing some research on the same topic, I found out that there is a way to have an external authentication source for the API.

in the app.ini

[service]
ENABLE_REVERSE_PROXY_AUTHENTICATION_API = true

curl -s -H "X-WEBAUTH-USER: admin" http://localhost:3000/api/v1/user | jq ".id"
1

You can place an authentication reverse proxy in front of your Gitea installation and implement whatever authentication you like. The documentation on https://docs.gitea.com/usage/authentication#reverse-proxy is outdated. I will create a PR for this.

After doing some research on the same topic, I found out that there is a way to have an external authentication source for the API.

in the app.ini

[service]
ENABLE_REVERSE_PROXY_AUTHENTICATION_API = true

curl -s -H "X-WEBAUTH-USER: admin" http://localhost:3000/api/v1/user | jq ".id"
1

You can place an authentication reverse proxy in front of your Gitea installation and implement whatever authentication you like. The documentation on https://docs.gitea.com/usage/authentication#reverse-proxy is outdated. I will create a PR for this.

This worked great in my scenario - Thank you!

I was already using nginx as a reverse proxy and authelia to authenticate/authorize several apps behind nginx. Gitea was set up a bit differently using authelia as an oauth2 provider.

I was able to use the nginx auth_request directive to authorize any api request that included an auth cookie and return headers that I could pass on to gitea (i.e. X-WEBAUTH-USER).

My custom web app can now access the Gitea API using the same authenticated session they logged into the web app with, without having to use the Gitea web UI to create a PAT, etc...