Authenik looping on Sonarr/Radarr | authentik | Page 1

lapis anchor Mar 27, 2023, 9:26 PM

#

I must be missing a few things, because I've followed the documentation, and tried about 2-3 alternative guides, and can't get something as simple as Sonarr working.

I have a pretty basic Authentik setup, and my basic end goal is that if I try to his one of my services (like Sonarr), it will prompt me for an oauth login (google, discord, anything).

What I've found is that I can use Authentik as a dashboard for these services, but there's nothing stopping me from hitting them directly and bypassing Authentik. And when I go through Authentik, it's failing to log me into the services.

I have an application (Sonarr).
I have a provider (I've tried proxy, single app auth, and domain auth. It's currently on proxy), with the username/password saved.
I have a custom outpost with the applications added, using the local Kubernetes integration.

I can login with the local default admin user, but there's no prompt to login with Oauth, and I see sonarr on the dashboard, but clicking it will take me to the sonarr login page. If I use the sonarr URL, it will bypass Authentik and take me to the sonarr login page regardless.

I've played around with multiple versions of annotations, and I feel like I'm just doing something really dumb, but I've been staring at it for too long. I'm also trying to get this all automated via terraform.

I tried following both the Authentik documentation, and the Cooptonian video, and just can't seem to make it work how I expect it to.

#

https://github.com/LilDrunkenSmurf/k3s-home-cluster/blob/main/kubernetes/apps/security/authentik/app/helmrelease.yaml

https://github.com/LilDrunkenSmurf/k3s-home-cluster/blob/main/kubernetes/apps/security/authentik/app/ingress.yaml

https://github.com/LilDrunkenSmurf/k3s-home-cluster/blob/main/kubernetes/apps/media/sonarr/app/helmrelease.yaml

https://github.com/LilDrunkenSmurf/k3s-home-cluster/blob/main/terraform/idp/auth_media.tf

https://github.com/LilDrunkenSmurf/k3s-home-cluster/blob/main/terraform/idp/application_list.tf

#

Like I assumed I could leave my Sonarr ingress in place, and add annotations when using forward-auth, but that doesn't seem to be the case, as I never get redirected to Authentik. And obviously proxy won't intercept it unless I point the sonarr ingress at Authentik itself.

lapis anchor Mar 27, 2023, 10:30 PM

#

Okay, I see that I needed to connect my discord account, rather than sign up with it.

#

But I still get a 500 error when trying to go to Sonarr using domain-level forwarding.

#

#

Okay, update. If I go to the sonarr url, it now goes to authentik first, but then 404's and goes to my outpost URL id.<domain>

#

Further update. It loads the logon page, but still doesn't automatically log me in.

lapis anchor Mar 27, 2023, 10:54 PM

#

nevermind, still 404

#

Yeah, it just keeps redirecting back to the outpost URL after logon. So I go sonarr.domain > now logging you in > redirect to outpost URL authentik.domain

lapis anchor Mar 28, 2023, 1:39 PM

#

So it's pseudo working. I "borrowed" some TF code from @paper basin, and it's 90% of the way there (except I had to ditch Kyverno), but when I click on an app from the authentik dashboard, it takes me to an http 400 page, and the URL is set as my authentik dashboard, but if I manually type in the app URL, it authenticates against Authentik, and lets me through. Then the cookies exist and it's good.

lapis anchor Mar 28, 2023, 2:20 PM

#

IE: I go to authentik.domain. I log in (not with discord?), and I click on an app for the first time, like Tautulli. I can see the URL is set to tautulli.domain, as I mouseover, but when I click it, a new tab opens up to https://authentik.domain/outpost.goauthentik.io/start?rd=%2F and I see an HTTP 400 error from nginx.
If I manually type in tautulli.domain, this also happens.
However, if I now go modify the url to tautulli.domain/outpost.goauthentik.io/start?rd=%2F, it shows me the authentik logging in page, and forwards me to tautulli successfully.

#

Okay, I see I need to update the auth-signin notation.

lapis anchor Mar 28, 2023, 3:06 PM

#

Nope, sonarr and radarr just loop that way, but everything else works.

lapis anchor Mar 28, 2023, 5:57 PM

#

Authenik looping on Sonarr/Radarr

lapis anchor Mar 30, 2023, 1:24 AM

#

So I think I resolved it. I had sonarr and radarr set to popup for the login, but had no credentials in authentik. I flipped them to forms, and it started working and stopped looping. I have to figure out how to pass the credentials into the config via TF but keep it a secret (sops?).

Additionally, I still haven't figured out how to get the discord login working. I mean, it's enabled, but I haven't figured out how to configure a login flow for it.

vital granite Mar 30, 2023, 5:42 AM

#

lapis anchor So I think I resolved it. I had sonarr and radarr set to `popup` for the login, ...

First of all, great that you got it working, second: you need to go to flows, default authentication flow, stages and then click on edit stage for default-authentication-identification and scroll down to sources

#

And select discord along with the others currently enabled (currently authentik Built-in and Google for you i think)

lapis anchor Mar 30, 2023, 12:18 PM

#

That's fantastic, thanks so much.

vital granite Mar 30, 2023, 12:44 PM

#

You welcome

lapis anchor Mar 30, 2023, 2:17 PM

#

Well now that that's working. I guess it's back to why I can't auth/auto log into *arr. It just loops. I managed to get an http 400 error out of radarr, but I'm still confused.

lusty gate Mar 30, 2023, 8:29 PM

#

I would attempt it with radarr/sonarr authentication set to 'off'. Then try to visit them in a private window to verify that the ingress is redirecting to authentik. Assuming it redirects to Authentik and that after logging into Authentik it redirects back to radarr/sonarr, then start messing with authentication in them.

#

I have my *arrs set to use HTTP basic auth. The provider inside of Authentik has the "Send HTTP-Basic Authentication" option checked under "Authentication settings", and I have a group for each of the applications with the arr_username arr_password set as custom attributes.

So essentially you go to hit your app -> redirect to Authentik -> log in -> redirects to the app and passes the http basic auth in the headers to the app -> logs you in

#

The only issue I've had with this is that the provided ingress annotations (atleast for nginx ingress in kubernetes) also requires 'Authorization' to be listed in the "auth-response-headers" list or I was getting inconsistent results with *arrs logging in

#Authenik looping on Sonarr/Radarr