Files

T

nessi f925009977 chore: initial project setup with backend, frontend, Android app, and CI/CD

Add complete NexaMFA push MFA system with:
- FastAPI backend with PostgreSQL, Redis, OIDC provider, and Prometheus metrics
- React TypeScript admin console
- Android Kotlin/Jetpack Compose app with biometric authentication
- Docker Compose deployment configuration
- Gitea CI workflow for backend, frontend, and Android builds
- Environment configuration template with security settings
- Documentation for security model, deployment

2026-06-28 09:37:51 +02:00

1.7 KiB

Raw Blame History

authentik Integration

NexaMFA acts as an OIDC provider that authentik can call as an external authentication source.

NexaMFA Settings

Set:

PUBLIC_BASE_URL=https://mfa.example.com
OIDC_ISSUER=https://mfa.example.com
OIDC_CLIENT_ID=authentik
OIDC_CLIENT_SECRET=generate-a-long-secret
OIDC_REDIRECT_URIS=https://authentik.example.com/application/o/nexamfa/callback/

The discovery URL is:

https://mfa.example.com/.well-known/openid-configuration

authentik Setup

In authentik, create an OAuth2/OIDC source or provider entry for NexaMFA.
Use the discovery URL above if your authentik flow supports discovery.
Set client ID to authentik.
Set client secret to OIDC_CLIENT_SECRET.
Set scopes to openid profile email.
Configure the redirect URI in NexaMFA and authentik to match exactly.
Ensure authentik sends the username as login_hint during /oauth/authorize.

Flow

authentik redirects the browser to /oauth/authorize.
NexaMFA validates the client and redirect URI.
NexaMFA creates a challenge for the login_hint user and sends FCM push containing only challenge_id.
The browser waits on the NexaMFA approval page.
The Android app fetches challenge details, shows service, username, IP, timestamp, and location if present.
The user approves with biometric or device credential.
The Android app signs the canonical payload and posts approval.
NexaMFA issues an authorization code and redirects back to authentik.
authentik exchanges the code at /oauth/token.

Zoraxy

Route https://mfa.example.com to backend:8000 and keep HTTPS enabled. The OIDC issuer must exactly match the public HTTPS origin.

1.7 KiB Raw Blame History