HTTP Basic auth with Traefik as proxy provider for *arrs

[weak saffron]

Hi, I want to keep auth enabled on my *arr application while using Traefik as reverse proxy. I added the credentials to ´Radarr under the Advanced protocol settings for its provider but when I open radarr the basic form auth still shows up.

[peak briar]

heads up, i am not affiliated with authentik but i thought i would share my thoughts.

Have you looked at the docs here?:
https://goauthentik.io/docs/providers/proxy/forward_auth

Looks like it uses forward auth, not basic auth

[weak saffron]

Yes, every apps provider I have is set to Forward auth since I'm using Traefik to proxy my services. And under the Radarr provider I added the Radarr login username and password as "HTTP-Basic Username Key" and "HTTP-Basic Password Key". Shouldn't this then bypass the Radarr login if I'm logged in to AuthentiK?

[mild geyser]

Yes

[digital trout]

I have this setup working on my k8s cluster w/ traefik ingress, I needed to add the authorization header to the middleware to have authentik forward them through https://github.com/mchestr/home-cluster/blob/main/cluster/apps/auth-system/authentik/middleware.yaml#L23-L24

[weak saffron]

Thanks, I added it to my middleware but it still does not work. I'm seeing this error in Radarr.

[Info] Radarr.Http.Authentication.BasicAuthenticationHandler: AuthenticationScheme: Basic was challenged.```

[digital trout]

sorry can't be much more help, not sure why it is not working, I have my entire setup in terraform if you wanted to compare how the provider/apps are setup https://github.com/mchestr/home-cluster/blob/main/provision/terraform/authentik/applications.tf#L80

[weak saffron]

Really appreciate it, could you perhaps send pictures of what the actual config looks like inside of your Authentik gui with details blurred? I think that would be the easiest way for me to make sure I haven't made some simple error.

[digital trout]

sure, this is the proxy and group which contains the username/pass