I am setting up an authentik instance with different tenants in a k8s cluster. Access to the cluster is done via pomerium reverse proxy. all traffic is directed to the default embedded outpost for the k8s cluster. When setting up tenant, what does the default tenant's domain authentik-default correspond to? How can I point to an oauth URL for a specific tenant if I am currently using the embedded outpost's url as oauth URL?
Thanks for your help
#Tenant Domains and Embedded outposts
fossil rose
red beacon
the tenants in authentik only configure default flows and branding for different domains, they are not a full tenancy
fossil rose
got it - but to initiate the flow for a tenant I must access that tenant's domain right?
red beacon
the active tenant is selected based on the URL you're accessing it on, yes
fossil rose
right, what does authentik-default correspond to (the default tenant's domain)? I currently access my default tenant using the embedded outposts url. Is that the authentik-default value?
or is authentik-default the authentik_host I have defined in my outpost? how can I know the value of my default tenant's domain
red beacon
authentik-default is just a placeholder, but because the default tenant is marked as "Default", it'll match for all domains where no other match is found
fossil rose
got it thanks - how can I access a different tenant domain if my reverse proxy routes to the embedded proxy's domain? Do I need to create an embedded outpost per tenant?
red beacon
the URL that the outpost redirects to is based on the authentik_host thats configured in its settings
so yeah you'd need another outpost
fossil rose
thank you for your help!
Creating an embedded outpost fails This list may not be empty." for the application list, but no application appear to pick from (although I have an application defined). How can I access my application in the application list when creating an outpost?
My default embedded outpost does not have any application selected but works fine
red beacon
the embedded outpost is special, all the other outposts require applications to be configured for them
the only applications that can be configured for outposts are Proxy provider based applications as all other providers don't require an outpost
fossil rose
I see. My authentik instance is available within my cluster at http://authentik.authentik, so to define tenant domains i can only define subdomains for this?
red beacon
no, you can define any domain you configure your ingress to route to authentik with
fossil rose
that's fair, if I define a domain customer.authenticate, how can k8s know that this corresponds to my authentik service accessible at http://authentik.authentik ?