Skip to content

authsec-ai/claw-auth

BranchesTags

Repository files navigation

authsec-openclaw

authsec-openclaw runs OpenClaw behind AuthSec SSO.

The current working path in this repository is a local, single-user operator setup:

  • browser login goes through AuthSec
  • OpenClaw sees the logged-in user identity
  • who am I? can answer from the authenticated session context
  • browser, Discord, and Windows local-machine actions work after a Windows node is paired and unlocked

This is the guide to follow if you want the setup that is working in this repo today.

What Is In This Repo

Current Scope

Use this repository for:

  • local development on Windows
  • one operator using AuthSec SSO
  • OpenClaw in Docker
  • optional Discord bot integration
  • local Windows command and browser access through a paired OpenClaw node

Do not treat the current checked-in config as a hardened public deployment. The local setup intentionally relaxes some Control UI auth/device rules so http://localhost:8080 works during development.

Quick Start

  1. Install prerequisites.

    • Docker Desktop
    • PowerShell
    • Node.js + npm
    • Go if you want to rebuild the proxy locally

  2. Configure the environment file.

    • Copy deploy/docker-compose/.env.example to deploy/docker-compose/.env if needed.
    • Fill in AuthSec values, gateway token, session secret, and model/provider keys.

  3. Start the stack.

    cd deploy/docker-compose
docker compose up -d --build

  4. Open the proxy.

    • Local HTTP: http://localhost:8080

  5. Sign in through AuthSec.

    • After login, ask who am I?
    • The answer should include your AuthSec identity.

  6. Pair your Windows node if you want local-machine access.

    • Install the OpenClaw CLI:
    npm install -g openclaw@latest
    • From the repo root:
    powershell -ExecutionPolicy Bypass -File deploy/docker-compose/run-openclaw-node.ps1 -Mode run
    • If the first run says pairing required, approve the pending request from another terminal:
    docker exec openclaw-gateway sh -lc "node /app/openclaw.mjs devices list --json"
docker exec openclaw-gateway sh -lc "node /app/openclaw.mjs devices approve <request-id> --json"
    • Then start the node again:
    powershell -ExecutionPolicy Bypass -File deploy/docker-compose/run-openclaw-node.ps1 -Mode run

  7. Unlock node exec approvals for local-machine actions.

    powershell -ExecutionPolicy Bypass -File deploy/docker-compose/run-openclaw-node.ps1 -Mode unlock
powershell -ExecutionPolicy Bypass -File deploy/docker-compose/run-openclaw-node.ps1 -Mode status

  8. Test local tools in chat.

    • who am I?
    • Open Notepad on node RitamKrKundu
    • Open my Downloads folder on node RitamKrKundu
    • Use the browser on node RitamKrKundu and open https://authsec.ai

Full Runbook

Use the complete Docker and pairing guide in deploy/docker-compose/README.md.

Tooling Notes

  • Browser automation and Windows app/file opening require a connected Windows node. The Docker container alone is not enough.
  • /host-home is only a mounted filesystem path. It does not mean Linux-in-Docker can launch Windows GUI apps by itself.
  • Discord must target a real channel or user, for example channel:<id> or user:<id>.
  • Web search is different from browser automation. If you want search results through the search tool, configure a provider such as Brave Search.

Useful Commands

From deploy/docker-compose:

docker compose up -d --build
docker compose up -d --build --force-recreate openclaw proxy
docker compose logs -f openclaw proxy
docker compose down

From the repo root:

powershell -ExecutionPolicy Bypass -File deploy/docker-compose/run-openclaw-node.ps1 -Mode run
powershell -ExecutionPolicy Bypass -File deploy/docker-compose/run-openclaw-node.ps1 -Mode unlock
powershell -ExecutionPolicy Bypass -File deploy/docker-compose/run-openclaw-node.ps1 -Mode status
openclaw.cmd nodes status

Troubleshooting

  • If who am I? does not show your identity, check internal/auth/middleware.go and confirm the proxy is writing USER.md.
  • If local-machine commands fail with SYSTEM_RUN_DENIED: approval required, run: 
    powershell -ExecutionPolicy Bypass -File deploy/docker-compose/run-openclaw-node.ps1 -Mode unlock
  • If OpenClaw says the node is not connected, leave the -Mode run terminal open and verify: 
    openclaw.cmd nodes status
  • If Discord says the target is unknown, give it a channel or user target instead of only the server name.

Security Notes

  • Keep the gateway token, AuthSec secrets, provider keys, and Discord token out of commits and screenshots.
  • The local config currently allows insecure localhost Control UI auth for development convenience.
  • Before exposing this stack publicly over HTTPS, tighten the OpenClaw Control UI auth/device settings and review deploy/docker-compose/openclaw-config/openclaw.json.

Legacy Docs

Older scaffold-era docs were written before the current local single-user flow was stabilized. If something in this README conflicts with an older note elsewhere, follow this README and the Docker guide linked above.

中文版本

authsec-openclaw

authsec-openclaw 在 AuthSec SSO 后面运行 OpenClaw。

本仓库当前的工作路径是本地单用户操作员设置：

  • 浏览器登录通过 AuthSec 进行
  • OpenClaw 能看到已登录的用户身份
  • who am I? 可以从已认证的会话上下文中作出回答
  • 在 Windows 节点配对并解锁后，浏览器、Discord 及 Windows 本机操作均可使用

如果你想使用本仓库目前正常运行的配置，请按照本指南操作。

仓库内容

当前适用范围

本仓库适用于：

  • Windows 上的本地开发
  • 使用 AuthSec SSO 的单个操作员
  • Docker 中运行的 OpenClaw
  • 可选的 Discord 机器人集成
  • 通过已配对的 OpenClaw 节点进行本地 Windows 命令和浏览器访问

请勿将当前提交的配置视为经过加固的公开部署。本地设置有意放宽了部分 Control UI 认证/设备规则，以便在开发期间 http://localhost:8080 能够正常工作。

快速开始

  1. 安装必备工具。

    • Docker Desktop
    • PowerShell
    • Node.js + npm
    • 如需在本地重新构建代理，还需安装 Go

  2. 配置环境文件。

    • 如有需要，将 deploy/docker-compose/.env.example 复制为 deploy/docker-compose/.env。
    • 填写 AuthSec 值、网关令牌、会话密钥以及模型/提供商密钥。

  3. 启动栈。

    cd deploy/docker-compose
docker compose up -d --build

  4. 打开代理。

    • 本地 HTTP：http://localhost:8080

  5. 通过 AuthSec 登录。

    • 登录后，询问 who am I?
    • 回答中应包含你的 AuthSec 身份信息。

  6. 如需本机访问，配对你的 Windows 节点。

    • 安装 OpenClaw CLI：
    npm install -g openclaw@latest
    • 在仓库根目录执行：
    powershell -ExecutionPolicy Bypass -File deploy/docker-compose/run-openclaw-node.ps1 -Mode run
    • 如果首次运行提示 pairing required，在另一个终端中批准待处理的请求：
    docker exec openclaw-gateway sh -lc "node /app/openclaw.mjs devices list --json"
docker exec openclaw-gateway sh -lc "node /app/openclaw.mjs devices approve <request-id> --json"
    • 然后再次启动节点：
    powershell -ExecutionPolicy Bypass -File deploy/docker-compose/run-openclaw-node.ps1 -Mode run

  7. 为本机操作解锁节点执行审批。

    powershell -ExecutionPolicy Bypass -File deploy/docker-compose/run-openclaw-node.ps1 -Mode unlock
powershell -ExecutionPolicy Bypass -File deploy/docker-compose/run-openclaw-node.ps1 -Mode status

  8. 在聊天中测试本地工具。

    • who am I?
    • Open Notepad on node RitamKrKundu
    • Open my Downloads folder on node RitamKrKundu
    • Use the browser on node RitamKrKundu and open https://authsec.ai

完整操作手册

请参阅 deploy/docker-compose/README.md 中的完整 Docker 和配对指南。

工具说明

  • 浏览器自动化和 Windows 应用/文件打开需要已连接的 Windows 节点，仅凭 Docker 容器是不够的。
  • /host-home 只是一个挂载的文件系统路径，并不意味着 Docker 中的 Linux 能自行启动 Windows GUI 应用。
  • Discord 必须指定真实的频道或用户，例如 channel:<id> 或 user:<id>。
  • 网络搜索与浏览器自动化不同。如果你希望通过搜索工具获取搜索结果，请配置 Brave Search 等提供商。

常用命令

在 deploy/docker-compose 目录下：

docker compose up -d --build
docker compose up -d --build --force-recreate openclaw proxy
docker compose logs -f openclaw proxy
docker compose down

在仓库根目录下：

powershell -ExecutionPolicy Bypass -File deploy/docker-compose/run-openclaw-node.ps1 -Mode run
powershell -ExecutionPolicy Bypass -File deploy/docker-compose/run-openclaw-node.ps1 -Mode unlock
powershell -ExecutionPolicy Bypass -File deploy/docker-compose/run-openclaw-node.ps1 -Mode status
openclaw.cmd nodes status

故障排查

  • 如果 who am I? 未显示你的身份，请检查 internal/auth/middleware.go，并确认代理正在写入 USER.md。
  • 如果本机命令因 SYSTEM_RUN_DENIED: approval required 失败，请执行： 
    powershell -ExecutionPolicy Bypass -File deploy/docker-compose/run-openclaw-node.ps1 -Mode unlock
  • 如果 OpenClaw 提示节点未连接，请保持 -Mode run 终端处于打开状态，并验证： 
    openclaw.cmd nodes status
  • 如果 Discord 提示目标未知，请提供频道或用户目标，而不仅仅是服务器名称。

安全说明

  • 不要在提交记录和截图中泄露网关令牌、AuthSec 密钥、提供商密钥和 Discord 令牌。
  • 当前本地配置出于开发便利允许不安全的 localhost Control UI 认证。
  • 在通过 HTTPS 公开暴露此栈之前，请收紧 OpenClaw Control UI 认证/设备设置，并检查 deploy/docker-compose/openclaw-config/openclaw.json。

历史文档

较早的脚手架时代文档是在当前本地单用户流程稳定之前编写的。如果本 README 与其他地方的旧说明有冲突，请以本 README 和上面链接的 Docker 指南为准。

About

No description, website, or topics provided.

Resources

Readme

License

Apache-2.0 license

Security policy

Security policy
Activity
Custom properties

Stars

1 star

Watchers

0 watching

Forks

1 fork
Report repository

Releases

No releases published

Packages

 
 
 

Contributors

Languages