proof of concept login mechanism using trusted SSO headers as described here:

https://www.authelia.com/integration/trusted-header-sso/introduction/

backend/app/api/handlers/v1/v1_ctrl_auth.go

@@ -123,6 +123,28 @@ func (ctrl *V1Controller) HandleSsoHeaderLogin() errchain.HandlerFunc {
 	}
 }
 
+func (ctrl *V1Controller) HandleSsoHeaderLogin() server.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) error {
+		var username = r.Header.Get("Remote-Email")
+
+		if username == "" {
+			return validate.NewRequestError(errors.New("authentication failed. not SSO header found"), http.StatusInternalServerError)
+		}
+
+		newToken, err := ctrl.svc.User.LoginWithoutPassword(r.Context(), strings.ToLower(username))
+
+		if err != nil {
+			return validate.NewRequestError(errors.New("authentication failed"), http.StatusInternalServerError)
+		}
+
+		return server.Respond(w, http.StatusOK, TokenResponse{
+			Token:           "Bearer " + newToken.Raw,
+			ExpiresAt:       newToken.ExpiresAt,
+			AttachmentToken: newToken.AttachmentToken,
+		})
+	}
+}
+
 // HandleAuthLogout godoc
 //
 //	@Summary  User Logout

backend/internal/core/services/service_user.go

@@ -204,6 +204,18 @@ func (svc *UserService) LoginWithoutPassword(ctx context.Context, username strin
 	return svc.createSessionToken(ctx, usr.ID, extendedSession)
 }
 
+func (svc *UserService) LoginWithoutPassword(ctx context.Context, username string) (UserAuthTokenDetail, error) {
+	usr, err := svc.repos.Users.GetOneEmail(ctx, username)
+
+	if err != nil {
+		// SECURITY: Perform hash to ensure response times are the same
+		hasher.CheckPasswordHash("not-a-real-password", "not-a-real-password")
+		return UserAuthTokenDetail{}, ErrorInvalidLogin
+	}
+
+	return svc.createSessionToken(ctx, usr.ID)
+}
+
 func (svc *UserService) Logout(ctx context.Context, token string) error {
 	hash := hasher.HashToken(token)
 	err := svc.repos.AuthTokens.DeleteToken(ctx, hash)

frontend/pages/index.vue

@@ -45,6 +45,19 @@
     navigateTo("/home");
   }
 
+  const { data, error } = await api.login_sso_header();
+
+  if (!error) {
+    // @ts-expect-error - expires is either a date or a string, need to figure out store typing
+    authStore.$patch({
+      token: data.token,
+      expires: data.expiresAt,
+      attachmentToken: data.attachmentToken,
+    });
+
+    navigateTo("/home");
+  }
+
   const route = useRoute();
   const router = useRouter();