App doesn't work with 2fA

[timaschew]

I've setup authelia with nginx and the webinterface works fine, but not the app.

I've adjusted the authelia config:

access_control:
  default_policy: deny
  rules:
    - domain: paperless.MYDOMAIN.de
      resources:
        - '^/api.*'
      policy: bypass
    - domain: paperless.MYDOMAIN.de
      policy: two_factor

I can login but I cannot see document previews (thumbs) even showing the document.
I also canno edit anything. There is no error in that case and also no authelia logging.

Upload works somehow and I see the preview and doc for the docs which I've uploaded from the app, but not docs which I've uploaded via webinterface. It seems that the app using a cache.

Here are some example logs

authelia    | time="2022-08-25T15:35:20+02:00" level=info msg="Access to https://paperless.MYDOMAIN.de/fetch/thumb/5 (method GET) is not authorized to user <anonymous>, responding with status code 401" method=GET path=/api/verify remote_ip=91.34.77.101
authelia    | time="2022-08-25T15:36:29+02:00" level=info msg="Access to https://paperless.MYDOMAIN.de/fetch/doc/10 (method GET) is not authorized to user <anonymous>, responding with status code 401" method=GET path=/api/verify remote_ip=91.34.77.101

---

Here are some more requests, which authelia is logging.

authelia    | time="2022-08-25T15:50:42+02:00" level=info msg="Access to https://paperless.MYDOMAIN.de/assets/js/pdf.worker.min.js (method GET) is not authorized to user <anonymous>, responding with status code 401" method=GET path=/api/verify remote_ip=91.34.77.101
authelia    | time="2022-08-25T15:50:42+02:00" level=info msg="Access to https://paperless.MYDOMAIN.de/assets/js/pdf.worker.min.js (method GET) is not authorized to user <anonymous>, responding with status code 401" method=GET path=/api/verify remote_ip=91.34.77.101
authelia    | time="2022-08-25T15:51:49+02:00" level=info msg="Access to https://paperless.MYDOMAIN.de/documents?sort=created&reverse=1&page=1 (method GET) is not authorized to user <anonymous>, responding with status code 401" method=GET path=/api/verify remote_ip=91.34.77.101
authelia    | time="2022-08-25T15:51:58+02:00" level=warning msg="https://paperless.MYDOMAIN.de/documents?sort=created requires 2FA, cannot be redirected yet" method=POST path=/api/firstfactor remote_ip=91.34.77.101

But I didn't see any requests which tried to update a document.

Would'n it be possible to show a webview to use 2FA even via the app?

[bauerj]

Would'n it be possible to show a webview to use 2FA even via the app?

Sure, that would be possible. But how could the app detect that that should be done? Is there a standard practice in place with using Authelia?

[timaschew]

You could check if there is an redirect to a different host or something like that.
Usually it rediects from paperless.tld.com to auth.tld.com or something like that.

So if the hostname where paperless is running is different from the redirected hostname, then you can probably just show a webview or something like that.