Forward-auth for traefik does not work only with embedded outpost #3566
Comments
|
As someone who struggled setting up the proxy provider with Traefik as well, maybe I can try to help by showing on how I set it up. I'll show you both my Authentik settings, docker compose (partial) and Traefik middleware. AuthentikApplication Provider
Outpost (default)
services:
authentik-server:
image: ghcr.io/goauthentik/server:${AUTHENTIK_SERVER_IMAGE_VERSION}
<<: *restart-stopped
command: server
<<: *authentik-environment
volumes:
- media:/media
- geoip:/geoip
labels:
traefik.enable: true
traefik.docker.network: proxy
traefik.http.routers.authentik.tls: true
traefik.http.routers.authentik.priority: 50
traefik.http.routers.authentik.entrypoints: websecure
traefik.http.routers.authentik.service: authentik
traefik.http.routers.authentik.rule: Host(`authentik.${APP_DOMAIN}`, `www.authentik.${APP_DOMAIN}`) || HostRegexp(`{subdomain:[a-z0-9-]+}.${APP_DOMAIN}`) && PathPrefix(`/outpost.goauthentik.io/`)
traefik.http.services.authentik.loadbalancer.server.port: 9000
networks:
- authentik
- proxyTraefik
http:
middlewares:
authentik:
forwardAuth:
address: '{{ env "AUTHENTIK_AUTH_ENDPOINT" }}'
trustForwardHeader: true
authResponseHeaders:
- X-Authentik-Username
- X-Authentik-Groups
- X-Authentik-Email
- X-Authentik-Name
- X-Authentik-Uid
- X-Authentik-Jwt
- X-Authentik-Meta-Jwks
- X-Authentik-Meta-Outpost
- X-Authentik-Meta-Provider
- X-Authentik-Meta-App
- X-Authentik-Meta-VersionHere, Now using it in a whoami:
image: traefik/whoami:latest
restart: unless-stopped
labels:
traefik.enable: true
traefik.docker.network: proxy
traefik.http.routers.whoami.tls: true
traefik.http.routers.whoami.entrypoints: websecure
traefik.http.routers.whoami.rule: Host(`whoami.${APP_DOMAIN}`, `www.whoami.${APP_DOMAIN}`)
traefik.http.routers.whoami.middlewares: authentik@file #remove @file if you dont setup with file
traefik.http.routers.whoami.service: whoami
traefik.http.services.whoami.loadbalancer.server.port: 80
networks:
- proxyThis will redirect you to Authentik, and after logging in, you'll get redirected to the whoami page. Maybe this will (partially) help you debug your problem. |
|
Thanks a lot for your answer, I am still struggling to see what I have done differently but for sure I will try again as it seems you have successfully
Thanks a lot for the screenshot of your provider and app, I'll need a while to try those settings again from a fresh install. |
|
I got this more or less working today, had some very strange behaviors, at one point I had hello.example.com under auth by traefik but it didn't redirect to hello.example.com once auth was sucessfull, it always got back to auth.example.com, even if the cookie was set properly when browsing to hello.example.com.... Not sure what I did that fixed it, restarted traefik mainly, but hey, seems it works now... The fun part that got me a bit frightened is that I apply the middleware for the entire traefik entrypoint, so authentik itself is behind it's own auth middleware, but thankfully that works if I add https://auth.example.com/.* as well as wss://auth.example.com/.* under the "unauthenticated urls" |
*Describe the bug
Traefik forward auth is not working properly with the embedded outpost.
To Reproduce
Deploy something like this :
compose.yml (click to expand)
and have only traefik listen to 80 and 444 ports.
browse to auth.example.com/if/flow/initial-setup and create an admin user.
Add a proxy provider at domain level using
Add an app, name it example.com and select the provider you just created.
Expected behavior
browsing hello.example.com should redirect to auth.example.com and trigger auth, sucessfull auth should redirect to hello.example.com
But in fact it redirects to this :
https://auth.example.comhhttps//auth.example.comthttps://auth.example.comthttps://auth.example.comphttps://auth.example.com:https://auth.example.com/https://auth.example.com/https://auth.example.comlhttps://auth.example.comohttps://auth.example.comchttps://auth.example.comahttps://auth.example.comlhttps://auth.example.comhhttps://auth.example.comohttps://auth.example.comshttps://auth.example.comthttps://auth.example.com:https://auth.example.com8https://auth.example.com0https://auth.example.com0https://auth.example.com0https://auth.example.com/https://auth.example.comahttps://auth.example.comphttps://auth.example.comphttps://auth.example.comlhttps://auth.example.comihttps://auth.example.comchttps://auth.example.comahttps://auth.example.comthttps://auth.example.comihttps://auth.example.comohttps://auth.example.comnhttps://auth.example.com/https://auth.example.comohttps://auth.example.com/https://auth.example.comahttps://auth.example.comuhttps://auth.example.comthttps://auth.example.comhhttps://auth.example.comohttps://auth.example.comrhttps://auth.example.comihttps://auth.example.comzhttps://auth.example.comehttps://auth.example.com/https://auth.example.com?client_id=somethinglookingprivate&redirect_uri=https%3A%2F%2Fauth.example.com%2Foutpost.goauthentik.io%2Fcallback%3FX-authentik-auth-callback%3Dtrue&response_type=code&scope=ak_proxy+email+profile+openid&state=somethinglookinglessprivate
(no it's not a copy-paste problem...)
Logs
When I call hello.example.com, traefik debug logs show this :
So traefik did in fact contact the outpost to authorize the request.
Then
docker logs authentikshow this :(click to expand)
And the user gets redirected to this wrong url... browsers don't like malformed urls...
Version and Deployment (please complete the following information):
Additional context
I have looked at issue #2180 which put me on the track and pushed me to create a separate outpost.
But given there is a single container for authentik and it's outpost, I can't see how to apply any kind of other priorities. Maybe the outpost is running on port 8000 and could be accessed by traefik differently but that would contradict the docs and other examples found online (https://gist.github.com/LukasForst/9898e08b6290821d6ccfcd0b6ad4f376)
Anyway, when I create a new outpost named traefik, using the docker local integration, and giving it the following config :
Then update the embedded outpost to unselect the example provider from it and enabling it in the newly created traefik outpost.
Then modify my whole compose file to change the definition of the middleware like this :
Suddenly browsing to hello.example.com works just fine, I get a login page from authentik, and end up with the nging hello page displayed and a cookie stored for example.com
I even tried copy-pasting the config of this outpost (that works) to the config for the embedded outpost, knowing that not all values would apply, but anyway, no luck...
Trace logs are not helpful here sadly, I feel the embedded outpost is itself being redirected to auth itself but I don't get it as it shows as connected and "viewed" a few second ago...
Any help here is welcome ! I would really like to remove access from the docker socket and avoid having an extra container running just to run the outpost...
Thanks in advance
The text was updated successfully, but these errors were encountered: