Issue:

I’m currently trying to implement support for openID authentication using guardian for a RESTful api.

The api i’m currently working with supports authentication with a password stored as a hash on the api’s db. I’d like to add another option to login using openID through authelia.

All users have a :distant, :boolean field used to denote wether a user authenticates through a password in the db or authelia. I want to make it so that guardian generates a token itself only when a user is not distant. If it is distant i want instead for guardian to store the token given by authelia, and use that token afterwards. That way i can use the protected endpoints of my project (based on the EnsureAuthenticated Plug) without any modifications

Goal:

I want to modify the way guardian creates and verifies tokens to switch between verifying the password itself or letting authelia handle verifications/token creation.
I want the resulting token to be used transparently by the EnsureAuthneicated Guardian plug so that i don’t have to modifiy the endpoints of my project.

I don’t fully understand the authentication life cycle of the phoenix connection, so i don’t know where to start.

Current pipeline

This is the pipeline is use for authentication. ideally i’d like to only modify this part so that changes are transparent for the rest of the code (apart from the new routes needed to authenticate through authelia ofc.)

defmodule Backend24hWeb.Auth.SwimmerPipeline do
  use Guardian.Plug.Pipeline, otp_app: :backend24,
  module: Backend24hWeb.Auth.GuardianNageur,
  error_handler: Backend24hWeb.Auth.GuardianErrorHandler

  plug Guardian.Plug.VerifySession
  plug Guardian.Plug.VerifyHeader
  plug Guardian.Plug.EnsureAuthenticated
  plug Guardian.Plug.LoadResource


end

Thanks in advance.