Getting Authentik to work with Container Pair of Client and Server

[earnest roost]

I currently have RX Resume v3 installed which is an open source based resume creation application. This application consists of a database, server and client. The main program for the user to interact with is the client application but this client needs to communicate with the server to be able to login. Currently I have the container stack running just fine behind Nginx Proxy Manager (NPM).

However, when I introduce Authentik to do the forward proxy in front of RX Resume, then RX resume doesnt work. I dont know if something in the Reverse Proxy code snippet that Authentik provides is what needs changing or if its some other setting in the Application-Provider section of Authentik.

I've provided the docker compose for RX Resume so you can see how it is interconnected. Could you please have a quick look? And a copy of the code snippet from Authentik to place in NPM is provided to.

Here's the code snippet from Authentik to put into NPM

Increase buffer size for large headers

This is needed only if you get 'upstream sent too big header while reading response

header from upstream' error when trying to access an application protected by goauthentik

proxy_buffers 8 16k;
proxy_buffer_size 32k;

location / {
# Put your proxy_pass to your application here
proxy_pass $forward_scheme://$server:$port;

# authentik-specific config
auth_request        /outpost.goauthentik.io/auth/nginx;
error_page          401 = @goauthentik_proxy_signin;
auth_request_set $auth_cookie $upstream_http_set_cookie;
add_header Set-Cookie $auth_cookie;

# translate headers from the outposts back to the actual upstream
auth_request_set $authentik_username $upstream_http_x_authentik_username;
auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
auth_request_set $authentik_email $upstream_http_x_authentik_email;
auth_request_set $authentik_name $upstream_http_x_authentik_name;
auth_request_set $authentik_uid $upstream_http_x_authentik_uid;

proxy_set_header X-authentik-username $authentik_username;
proxy_set_header X-authentik-groups $authentik_groups;
proxy_set_header X-authentik-email $authentik_email;
proxy_set_header X-authentik-name $authentik_name;
proxy_set_header X-authentik-uid $authentik_uid;

}

I had to break the code snippet into 2 sections because of character count limitations in discord. The rest of it is below

all requests to /outpost.goauthentik.io must be accessible without authentication

location /outpost.goauthentik.io {
proxy_pass http://NASIP:Port/outpost.goauthentik.io;
# ensure the host of this vserver matches your external URL you've configured
# in authentik
proxy_set_header Host $host;
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
add_header Set-Cookie $auth_cookie;
auth_request_set $auth_cookie $upstream_http_set_cookie;

# required for POST requests to work
proxy_pass_request_body off;
proxy_set_header Content-Length "";

}

Special location for when the /auth endpoint returns a 401,

redirect to the /start URL which initiates SSO

location @goauthentik_proxy_signin {
internal;
add_header Set-Cookie $auth_cookie;
return 302 /outpost.goauthentik.io/start?rd=$request_uri;
# For domain level, use the below error_page to redirect to your authentik server with the full redirect path
# return 302 https://authentik.company/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
}

[vocal pike]

relevant: https://github.com/AmruthPillai/Reactive-Resume/issues/703

Well, I guess more "related" than "relevant"

https://github.com/AmruthPillai/Reactive-Resume/issues/1072#issuecomment-1443819082 sounds like you may need to allow access to /api on server without authentication... maybe

[earnest roost]

Thanks for the leads @vocal pike So the first link is about integrating of OIDC login into RXResume which would be an RXResume issue and not Authentik. Would be great if they implement native OIDC and when they do, I'll connect Authenthik to it but for now I'm ok with having two logins one from Authentik (as per forward proxy) and one from RXResume. I want the server to be protected which doesnt have any authentication.

The second link is an issue the person is facing with their reverse proxy. However I already have RX Resume working just fine with NPM reverse proxy. My issue is when I try to integrate it with Authentik which leads me to believe there must be some config that needs setting in Authentik to allow it to act as a Forward Proxy for RX Resume.

I did add "^/api([/?].*)?$" to the "unauthenticated paths" section of the Proxy Provider section In Authentik for both RX Resume and the RX Resume Server. That didnt seem to fix my issue. I'm wondering what else the issue could be?

[vocal pike]

Another question - is this for just your use, or do you intend more people to use this server? I kinda worked around by similar issue by having tailscale connected to a headscale control server I run, and connecting that to authentik. So such services that I want to be able to reach from anywhere but don't want to expose to the world are reachable via an easy to set up VPN

[earnest roost]

thanks yes I intend to have more people use this server, some will not be on my home network and I certainly wouldnt want to give them VPN access to my whole network either 😉

Is it possible there is something wrong in the code snippet that Authentik provides for NPM? I'm not well versed in code so I cant decipher alot of what the code means

[vocal pike]

Tailscale has ACLs, so you can control what they get access to ;)

Sorry, I can't really help you with the snippets, since I'm using something else for accessing my stuff

[earnest roost]

Sounds good thanks alot though for your views. Hopefully there's some way within Authentik to get the RX Resume server and client communicating.

[earnest roost]

Would be very grateful @golden furnace @golden olive or others could provide your views or other leads as to how to get a client and server communicating to each other with Authentik in front of them

[golden furnace]

I have yet to integrate a Authentik proxy myself nor am I familiar with RXResume, however I noticed in the docker-compose you have the reverseproxy in its own network that the client is connected too. Are you not using the exposed ports then? And along with that, is the client the only thing that talks to that server? Or will the client defer to the server for specific content? (i.e. when you hit F12 in your browser and look at the network tab, you consistently talk back and forth between the client and server)

and I'm guessing the Authentik proxy is also on said external docker network? The one for the reverse proxy

[vocal pike]

Or I guess I have an architecture question: there are two components, "client" and "server". Is "client" container talking to "server" directly, or is it browser communicating with both?

[golden furnace]

a better phrasing of some of my questions ^

and even though you implemented the forward proxy, does authenticating and redirecting to Authentik work? and its just whats after authentication that doesnt work?

[earnest roost]

Thanks @golden furnace and @vocal pike to answer your questions, I'll start with your first one and then the third one. The second one is more technical so I hope I understood you correctly and will reply to that last:

1. No I am not using the exposed ports for the RXResumeClient and Server. As I have them both connected to my Reverse Proxy network (which has NPM in it in another container stack), I can refer to these two containers by their default container name and port instead of (my NAS-IP:LocalPort). In the RX Resume Client case its default port is 3000 so my NPM reverse proxy entry is containername:3000; and for the RXResumeServer its containername:3001. And then in Authentik's "Provider" section I have the FQDN for RX Resume and RX Resume (e.g., resume.mydomain.com) and RXResumeServer (e.g., resumeserver.mydomain.com). These FQDN are the same ones I have set up in NPM as well. When I have these two containers set up **without **the snippet that Authentik provides to put into NPM then both containers talk to each other fine and I can use the Resume service. The problem happens when the code snippet is put into NPM.

2. Correct Authentik is in its own container stack, and the docker compose has it connected to the same reverse proxy network that RXResumeClient and RXResumeServer (and NPM as well) are all connected. I'd be happy to provide my Docker Compose for Authentik if it's helpful.

I'm responding to question 2 below because of character count limitations I face in Discord.

2. On your question about whether the client is the only thing that talks to the server, I wasnt sure what you meant by that. Your example helped me somewhat because then I opened the network tab. When I remove the code snippet that Authentik provides to put into NPM and then I check F12 networking, I can login to the Reactive Resume service just fine and then once I login, the application is basically a template that you will out for your resume and it asks for various questions like phone number, email, address, all things that would go in a resume. As you enter data into the fields, there is an example resume that auto populates the text you are writing, so it seems like there is requests happening throughout each field I enter I see HTTP/2 OK on the right hand side of the "Requests" section. Is this helpful at all? I'm not sure if it answers your question because i'm still learning all this technical stuff but would be more than happy to do any other tests if it helps you detect what the issue could be.

[golden furnace]

That almost helps for this portion, what I was more looking for ks is if when you use the RXResume app, do you make connections to server and the client back and forth. So in your requests you would see requests to the client and then to the server and etc, using the ports that you're proxying.

It similar to when you might go other websites on the internet and they refer to images outside their website or css, html, resources, etc. You'll see them refer you to a bunch of different sites to pull information. So hence does your browser talk to the server and client, mainly because the client refers to the server for multiple resources or something.

Because if this is the case, when you set up the NPM, did you add two different authentik nginx portions for the server and client?

[earnest roost]

Thanks @golden furnace your post made me think of doing something I hadnt tried before. Up until now I had put the Authentik code snippet for NPM for BOTH the RXResume Client and RXResume Server. This morning I tried to see what would happen if I only put Authentik's code into NPM in either RXResume Client or Server. Turns out, that when the code snippet is put into RXResume Client (but not RX Resume Server) then the application service works perfectly and Authentik does the forward proxy part as intended. In this setup the RX Resume Server is set up behind NPM in its default port, but does not have Authentik in front of it and then RX Resume Client can communicate with it. When I try to do the reverse, which is to have RX Resume Server with Authentik in front of it and have the Authentik code snippet into its NPM entry but not RX Resume Client then RX Resume Client cannot communicate with the Server

So based on this finding, it seems somewhere the Server is prevented from being able to communicate with the Client when both are behind Authentik. Not sure why

[vocal pike]

There's two possibilities:

1. It's your browser making requests to both client and server. In theory, if you're logged into authentik it should work
2. something on the client_container talks to something on the server_container directly. Setup with requiring to be logged in to authentik to talk to them will break this, and this will be hard to fix.

[earnest roost]

Ok so I took a snapshot of my "network" section of the developer console when I have only RX Resume Client setup so that Authentik is in front of it as a forward proxy. If I also put RX Resume Server behind Authentik's forward proxy then I cannot login to the RX Resume Client service.

I hope this snapshot shows what may be going on between server and client when both are able to communicate with each other. This snapshot shows the data that is communicating back and forth between the RX Resume Client and RX Resume Server. However ,I also saw a couple of instances where there is "cdn.jsdeliver.net" with code 200, so does this prove that the browser seems to be communicating with both?

When I fill in the resume template I see connections mainly with the server but I saw a few instances of connections being made to cdn.jsdeliver.net so I'm not sure if this means the browser is involved or if its just client and server just communicating back and forth. If ther'es other clues to suss this out let me know. But otherwise I'm very puzzled why I cant seem to protect the RX Resume Server behind Authentik. Right now I can only get RX Resume Client communicating with RX Resume Server whne RX Resume Server is behind NPM reverse proxy without the Authentik code snippet. RX Resume Client has the code snippet in the NPM advanced config section.

And to answer your other question @golden furnace when I set up NPM, I set up two different proxy hosts, one for rxresumeclient.mydomain.com, and the other for rxresumeserver.mydomain.com. The address for both was their container name:default container port and in the docker compose I had them attached to an external network that NPM belongs to so this setup works. In the advanced config section of NPM I wanted to put the Authentik's code snippet to be a forward proxy in front of both client and server but unfortunately the two do not communicate with each other when set up like this. I can definitely get to the landing page for RX Resume Client, however I cannot "login" to the service because the Resume Client is not establishing a connection to the Server it seems.

[vocal pike]

This shows your browser communicating with both. Your browser is not in a position where it can know about any traffic happening directly between client_container and server_container

Hm. I wonder what would happen if instead of resume.example.com and resume-api.example.com you had say client.resume.example.com and api.resume.example.com, and set up a domain level forward auth at resume.example.com

[earnest roost]

I thought id also show the screen shot when RX Resume Server is also behind Authentik. When this happens, in the snapshot you'll see that I get a message at the login page for RX Resume Client that logging into the server failed. I get a "CORS failed" message. Any idea what that is?

[vocal pike]

https://en.wikipedia.org/wiki/Cross-origin_resource_sharing

[golden furnace]

Never knew it was called that, I learn something every day. Okay I have a suspicion @earnest roost , when you have the Authentik set up for the NPM of both servers as it originally was that caused this issue. Did you ever try to manually reach the RXResume Client and the RX Resume Server? For instance right now you're reaching the RX Client, which because of Authentik and the forward proxy, its forcibly authenticating you with Authentik and if you're successful in authenticating it continues to let you through to THE RX CLIENT. However have you specifically attempted to go straight to the RX Server bypassing the RX Client just to authenticate with Authentik first? For instance instead of going to rxresumeclient.mydomain.com, go straight to "https://rxresumeserver.mydomain.com".

I'm not sure exactly how Nginx and Authentik communicate but I'm wondering if because you have not authenticated to the Authentik proxy on the other port (RX Resume Server) single handedly then maybe its dropping your packets.

And therefore connections will not work until you do so. A way to maybe get around this is to use the "domain" proxy capability possibly?

Also the networks tab shows only connections to and from YOU, as @vocal pike basically pointed out. What you're seeing is your browser is actually the medium between the server and client and the server and client do not DIRECTLY COMMUNICATE with either at all.

[vocal pike]

Hint: CORS can be adjusted

[earnest roost]

Thanks for this post, to answer the question I did manually try to reach both RXResume Client and RXResume Server separately via NPM without Authentik in front of it (without the code snippet in the advanced config and by removing these two from the outpost). When I do that, the application works fine. Specifically for RXResume Server, when I navigate to rxresumeserver.mydomain.com I get the following which I attached as a snapshot:

I see that message from the server snapshot even when I have Authentik in front of the server and then navigate to rxresumeserver.domain.com after I put the code snippet into NPM as well. I think this is just what shows up when you try to access the server directly - there isnt much to do with it. It seems the RXresumeClient is where you need to navigate to, login and then it communicates with the server. When you try to connect to the server directly there's just this output and that's it

I also tried the domain auth method. I went to Providers -> RXResumeServer Proxy Provider Entry -> Auth url for https://auth.mydomain.com and cookie domain set to mydomain.com (which is the parent domain of rxresume.domain.com). Even when I do this, (with the Authentik code snippets in NPM for both RXresume Client and Server then I cannot access the RX Resume application I just get stuck at the login screen.

Something is going on when I try to get Authentik in front of this service. I can't seem to figure out what the problem is! Ahhh

Here's my Provider info for RX Resume Server.

[earnest roost]

When I check network tab of the browser after having set up domain auth then I keep getting CORS Failed and NS_ERROR_DOM_BAD_URI codes whenever I try to login to the RXResumeClient service and I cant login to the service. It doesnt matter whether the Proxy Provider Domain auth is set for both RXresumeClient and Server, or just one or the other. As long as the Authentik code snippet is put in NPM for the Server specifically, I cant login and use the RX Resume Service.

[golden furnace]

I'm out if ideas at that point, if the CORS is still having and issues as well BAD_URI, something in the requests is not happy with some of the headers