Hi, I got an almost working SSO implementation with LibreNMS and ngnix/authelia. Using sso mode with headers, but the username defaults to “librenms” for all SSO logins. Other attributes from the logged in user are correct(real name, email). Logging in with another username just updates the existing librenms user with correct name and email.
Need some help to troubleshoot this 
If another user logs in, librenms user gets updated info on real name and email.
Setup is as follows, all runs in containers/stacks.
nginx-reverse proxy, connected to authelia for ldap and 2-fa.
Librenms runs in container:
===========================================
| Component | Version |
|---|---|
| LibreNMS | 23.8.0 (2023-08-29T08:54:42+02:00) |
| DB Schema | 2023_08_02_120455_vendor_ouis_unique_index (255) |
| PHP | 8.1.22 |
| Python | 3.10.13 |
| Database | MariaDB 10.5.19-MariaDB-1:10.5.19+maria~ubu2004 |
| RRDTool | 1.7.2 |
| SNMP | 5.9.3 |
| =========================================== |
SSO section in config.php
$config[‘auth_mechanism’] = “sso”;
$config[‘sso’][‘mode’] = “header”;
$config[‘sso’][‘group_strategy’] = “static”;
$config[‘sso’][‘static_level’] = 10;
$config[‘sso’][‘trusted_proxies’] = [‘127.0.0.1/8’, ‘10.0.0.0/8’, ‘192.168.0.0/16’, ‘172.16.0.0/12’];
$config[‘sso’][‘user_attr’] = ‘USER’;
$config[‘sso’][‘realname_attr’] = ‘NAME’;
$config[‘sso’][‘email_attr’] = ‘EMAIL’;
$config[‘sso’][‘create_users’] = true;
$config[‘sso’][‘update_users’] = true;
nginx config
location / {
include /etc/nginx/mime.types;
proxy_pass http://librenms:8200/;
auth_request /authelia;
auth_request_set $target_url $scheme://$http_host$request_uri;
auth_request_set $user $upstream_http_remote_user;
auth_request_set $groups $upstream_http_remote_groups;
auth_request_set $name $upstream_http_remote_name;
auth_request_set $email $upstream_http_remote_email;
error_page 401 =302 https://auth.internal.nu:9091/?rd=$target_url;
proxy_http_version 1.1;
proxy_set_header Host $host:$server_port;
proxy_set_header X-Forwarded-Proto “https”;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
add_header X-Content-Type-Options nosniff;
proxy_set_header USER $user; #$user/name/email from authelia
proxy_set_header NAME $name;
proxy_set_header EMAIL $email;
proxy_headers_hash_max_size 512;
proxy_headers_hash_bucket_size 128;
Confirmed http headers in wireshark in traffic sent from nginx to librenms get sets correctly.
VóRVóQGET /css/MarkerCluster.css HTTP/1.1
Host: librenms:443
X-Forwarded-Proto: https
X-Forwarded-Port: 443
X-Forwarded-Proto: https
X-Forwarded-For: 10.5.20.130
USER: nomas
NAME: nomas
EMAIL: [email protected]