ISO Suggestions: File/Resource Access Distribution Service
Preface Info To get some insight as to where I’m coming from Hardware Server A: Custom NAS running TrueNAS Scale Server B: hypervisor (snagged a DL380 Gen9 from my last job, love it dearly). Firewalla Gold Pro: Network core, also handling DNS. I know I’ll be…
Preface Info To get some insight as to where I’m coming from Hardware Server A: Custom NAS running TrueNAS Scale Server B: hypervisor (snagged a DL380 Gen9 from my last job, love it dearly). Firewalla Gold Pro: Network core, also handling DNS. I know I’ll be hearing a lot of “it’s not packet inspecting” and “where are your reverse-proxies?” 60% of all remote access is through Firewalla’s WireGuard VPN. 30% is through secured apps. 10% is through a Cloudflare tunnel to my domain. I’m happy with where I’m at. Services: Current: Plex* Mounted SMB share from TrueNAS NetBox* Gramps* Axis Camera Station (Windows Server VM) AMP* (4 VMs, one for control and 3 for games) Storyteller* Mounted SMB share from TrueNAS Pending: Immich *(Ubuntu Server minimized VM) Miscellaneous My wife and I are currently Windows users, as are the majority of our friends. We both work at a school, so finding time to make the dedicated switch completely to Linux on our endpoints is not easy. Background given, I still have a bit of wiggle room to deploy more applications on my hypervisor. I do plan to upgrade its hardware at some point, but I'm trying to keep costs as low as possible. Predicament: I’ve been searching for a tool/combo that will allow me to create users and groups in one spot, preferably through a UI (think Authentik). After that’s done, I’d like to be able to go to my services and grant permissions to said users and groups, as the services would be able to see and access the users and groups from the tool. Any ideas on what route I should follow here? I’m looking for responses that outline something end-to-end. Thank you!
已收录讨论
Expand the replies to this comment to learn how AI was used in this post/project.
Authentik can do part of it, except I'm finding from my research that Authentik won't work for SMB shares. According to Authentik's own documentation, there is no TrueNAS integration.
Have you considered using nextcloud or something similar for this purpose rather than smb share? I'm a bit unclear unclear as to what you need the smb share for. Most of the services you listed have their own ways of letting users manage files.
This is similar to the route I ended up going, except I deployed UCS (Univention) DC instead of Samba AD. TrueNAS sees it as an AD and pulls users and groups, ACLs controlled through TrueNAS. Still need to work out group syncing from UCS to Authentik, but the users are syncing at least. Yeah, Nextcloud was on my planned list a while ago, but after evaluating my stack and use-case it's something I don't feel the need to pursue until my system is improved (hardware, storage, internet connection, etc). It's just another user front-end that doesn't help my apps talk to each other.
I really like the turnkey Nextcloud vm. I run it on proxmox. I keep a large chunk of files on nvme storage local to the vm and slow archive stuff on smb which is hosted by truenas. Nextcloud allows “external” shares I think nfs and samba maybe others. I’m a big fan of nextcloud.
I think you already found the solution. This is what authentik is built to do.
You are trying to solve three different jobs with one product: a directory of users and groups, SMB/NAS permissions, and web-app SSO. Keeping those separate will make this much cleaner. For Windows clients and TrueNAS SMB shares, I would start with Samba AD as the directory authority. It gives you users, groups, Kerberos, and SMB-compatible ACL behavior in the same model that the Windows clients and NAS understand. Join TrueNAS to that directory, make the SMB ACLs refer to those directory groups, and use the same group source for services that support LDAP or Kerberos. Authentik still has a place, but as the OIDC/SAML layer for web applications rather than the authority for SMB permissions. That avoids trying to make an SSO product own file ACLs it was not designed to manage. FreeIPA can work well in a Linux-first environment, but with Windows endpoints and TrueNAS SMB as hard requirements, Samba AD is usually the less awkward center of gravity. Nextcloud is useful when you want a web file platform. It is not a substitute for coherent SMB identity and ACL management underneath.