#traefik forward auth infinite redirects

1 messages · Page 1 of 1 (latest)

abstract rune
#

I am trying to secure the traefik dashboard using forward auth; traefik picks up the middleware just fine and redirects to the outpost, however, after that I get stuck on the outpost page indefinitely redirecting to itself.

#

relevant configuration:

  • authentik server: auth.domain.tld
  • traefik dashboard url: domain.tld/dashboard/

traefik route for the dashboard:

http:
  routers:
    dashboard:
      rule: "Host(`domain.tld`) && PathPrefix(`/dashboard`)"
      service: dashboard@internal
      middlewares:
        - "dashboard-auth"
    api:
      rule: "Host(`domain.tld`) && PathPrefix(`/api`)"
      service: api@internal
      middlewares:
        - "dashboard-auth"

  middlewares:
    dashboard-auth:
      forwardAuth:
        address: https://domain.tld/outpost.goauthentik.io/auth/traefik
        trustForwardHeader: true
        authResponseHeaders:
          - X-authentik-username
          - X-authentik-groups
          - X-authentik-email
          - X-authentik-name
          - X-authentik-uid
          - X-authentik-jwt
          - X-authentik-meta-jwks
          - X-authentik-meta-outpost
          - X-authentik-meta-provider
          - X-authentik-meta-app
          - X-authentik-meta-version
#

I am trying to use the internal outpost, which is configured to use my traefik auth provider

#

traefik provider external URL set to: https://domain.tld/dashboard/
mode: Forward auth (single application)

#

I keep being redirected to a URL that looks like this:
https://auth.domain.tld/if/flow/default-provider-authorization-implicit-consent/?client_id=abc&redirect_uri=https%3A%2F%2Fdomain.tld%2Fdashboard%2Foutpost.goauthentik.io%2Fcallback%3FX-authentik-auth-callback%3Dtrue&response_type=code&scope=openid+email+profile+ak_proxy&state=abcd

and then get stuck on it redirecting to itself.

lean jasper
#

Do you have a route for the dashboard/outpost.goauthentik.io too?

#

Iirc thats a route thats used by the proxy provider

#

I suppose its trying to redirect to that, but since its getting matched by the dashboard rule it tries to forward auth that path... Which tries to redirect it again? And repeat?

abstract rune
abstract rune
#

update: fixed a typo, now I get redirected back to /dashboard/outpost.goauthentik.io/callback, and get a 404 page.

#

new route:

dashboard-outpost:
      rule: "Host(`domain.tld`) && PathPrefix(`/dashboard/outpost.goauthentik.io`)"
      service: authentik-outpost # this points to the authentik container at port 9000
lean jasper
#

I've never did your particular approach since i usually do one application per subdomain

#

But it seems like maybe the authentik outpost only has it on /outpost.getauthentik.io?

#

And the application configured as a subdir needs in the subdir?

#

In which case, you might need the strip prefix Middleware on the route for that path

abstract rune
#

I suppose :/

had really hoped I could have the traefik dashboard on the root domain, but after spending another hour or so and not being able to resolve it, I moved it to a subdomain