diff --git a/templates/docs/self_hosted_configuration.html b/templates/docs/self_hosted_configuration.html index a54d9c78..2af87cec 100644 --- a/templates/docs/self_hosted_configuration.html +++ b/templates/docs/self_hosted_configuration.html @@ -230,11 +230,13 @@ to your team account.

reverse proxies or the WSGI server. This allows you to integrate it into your existing authentication system (e.g., LDAP or OAuth) via an authenticating proxy. When this option is enabled, Healtchecks will trust the header's value implicitly, so it is very important to ensure that attackers cannot set the value themselves (and thus impersonate any user). How to do this varies by your chosen proxy, but generally involves configuring it to strip out headers that normalize to the same name as the chosen identity header.

To enable this feature, set the REMOTE_USER_HEADER value to a header you wish to authenticate with. HTTP headers will be prefixed with HTTP_ and have any dashes converted to underscores. Headers without that prefix can be set by the WSGI server itself only, which is more secure.

-

When REMOTE_USER_HEADER is set, Healthchecks will: - - assume the header contains user's email address - - look up and automatically log in the user with a matching email address - - automatically create an user account if it does not exist - - disable the default authentication methods (login link to email, password)

+

When REMOTE_USER_HEADER is set, Healthchecks will:

+

RP_ID

Default: None

The Relying Party identifier, diff --git a/templates/docs/self_hosted_configuration.md b/templates/docs/self_hosted_configuration.md index 423feb64..17d4376e 100644 --- a/templates/docs/self_hosted_configuration.md +++ b/templates/docs/self_hosted_configuration.md @@ -382,6 +382,7 @@ existing authentication system (e.g., LDAP or OAuth) via an authenticating proxy To enable this feature, set the `REMOTE_USER_HEADER` value to a header you wish to authenticate with. HTTP headers will be prefixed with `HTTP_` and have any dashes converted to underscores. Headers without that prefix can be set by the WSGI server itself only, which is more secure. When `REMOTE_USER_HEADER` is set, Healthchecks will: + - assume the header contains user's email address - look up and automatically log in the user with a matching email address - automatically create an user account if it does not exist