[Solved] Property Mapping + lsio/SWAG + Overseer/Plex SSO

[unkempt steeple]

While I understand there are already multiple threads related to Plex SSO, and forwarding the plex credentials across other services. I seem to be experiencing an odd issue.
When creating the scope mapping as per multiple posts state it should be created, everything tests out fine using the test function next to the property mapping.
I press the button, choose the user and it returns the Set-Cookie additional header of connect.sid and all appears to be working.

However, when applying a "real-world" test by attempting to access my overseerr instance with the same user that previously worked during the tests, the plex connection seems to be invalid, and/or no longer works as expected. Even after this, I can run the test again and see that it's working as expected.

The script provided seems to hang up on something when accessing Overseer, and eventually times out after a few minutes stating "PLEX: No Plex connection found" causing a user to not get authenticated with overseer upon accessing it, and eventually the error shows up in the logs.

I'm not sure what's breaking between the test function and the actual attempt to use the property mapping, and I've attempted multiple different ways to accomplish the result with little to no luck, if not making it worse. Below are my logs, and the script I'm currently using.

I'm using the lsio/SWAG container for my proxy provider, and have not changed the defaults within the configs provided by lsio.

Fix: Add the following to the authentik-location.conf file under the error_page 401 = @goauthentik_proxy_signin; (at the time of this post, this is found on line 8)

## Include the Set-Cookie header if present
add_header Set-Cookie $set_cookie;

Testing the property mapping:
https://pastebin.com/bfHc7eFj

Using the property mapping against overseerr:
https://pastebin.com/5MHDGJMh

Trace logs
https://pastebin.com/dUmnBT2j

Property map script

from authentik.sources.plex.models import PlexSourceConnection
import json

connection = PlexSourceConnection.objects.filter(user=request.user).first()
if not connection:
    ak_logger.info("PLEX: No Plex connection found")
    return {}

base_url = "http://10.0.0.12:5055"
end_point = "/api/v1/auth/plex"
token = "${overseer_token}"

headers = {
    "Content-Type": "application/json",
}

data = {
    "authToken": connection.plex_token
}


response = requests.post(base_url + end_point,
                         headers=headers, data=json.dumps(data))

if (response.status_code == 200):
    sid_value = response.cookies.get("connect.sid")
    cookie_obj = f"connect.sid={sid_value}"
    ak_logger.info("PLEX: The request was a success!")
    return {
        "ak_proxy": {
            "user_attributes": {
                "additionalHeaders": {
                    "Cookie": cookie_obj
                }
            }
        }
    }
else:
    ak_logger.info(f"PLEX: The request failed with: {response.text}")
    return {}

If there's anything else I can share, or clarify, just let me know. I've been staring at this stuff for a few days now and can't wrap my head around the issue.

Switching to trace logs, I can see that the connect.sid cookie is created and added to the additional headers, but there are no logs of that happening when my logs are set to info. Only after 5+ minutes of reaching my overseerr instance do I see logged info from the property mapping

[unkempt steeple]

overseerr.subdomain.conf

## Version 2023/05/31
# make sure that your overseerr container is named overseerr
# make sure that your dns has a cname set for overseerr

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name requests.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    # enable for ldap auth (requires ldap-location.conf in the location block)
    #include /config/nginx/ldap-server.conf;

    # enable for Authelia (requires authelia-location.conf in the location block)
    #include /config/nginx/authelia-server.conf;

    # enable for Authentik (requires authentik-location.conf in the location block)
    include /config/nginx/authentik-server.conf;

    location / {
        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable for ldap auth (requires ldap-server.conf in the server block)
        #include /config/nginx/ldap-location.conf;

        # enable for Authelia (requires authelia-server.conf in the server block)
        #include /config/nginx/authelia-location.conf;

        # enable for Authentik (requires authentik-server.conf in the server block)
        include /config/nginx/authentik-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app overseerr;
        set $upstream_port 5055;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

    }

    location ~ (/overseerr)?/api {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app overseerr;
        set $upstream_port 5055;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

    }
}

authentik-location.conf

## Version 2023/04/27 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authentik-location.conf.sample
# Make sure that your authentik container is in the same user defined bridge network and is named authentik-server
# Rename /config/nginx/proxy-confs/authentik.subdomain.conf.sample to /config/nginx/proxy-confs/authentik.subdomain.conf

## Send a subrequest to Authentik to verify if the user is authenticated and has permission to access the resource
auth_request /outpost.goauthentik.io/auth/nginx;
## If the subreqest returns 200 pass to the backend, if the subrequest returns 401 redirect to the portal
error_page 401 = @goauthentik_proxy_signin;

## Translate the user information response headers from the auth subrequest into variables
auth_request_set $authentik_email $upstream_http_x_authentik_email;
auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
auth_request_set $authentik_name $upstream_http_x_authentik_name;
auth_request_set $authentik_uid $upstream_http_x_authentik_uid;
auth_request_set $authentik_username $upstream_http_x_authentik_username;

## Inject the user information into the request made to the actual upstream
proxy_set_header X-authentik-email $authentik_email;
proxy_set_header X-authentik-groups $authentik_groups;
proxy_set_header X-authentik-name $authentik_name;
proxy_set_header X-authentik-uid $authentik_uid;
proxy_set_header X-authentik-username $authentik_username;

## Translate the Set-Cookie response header from the auth subrequest into a variable
auth_request_set $set_cookie $upstream_http_set_cookie;

authentik-server.conf

## Version 2023/04/27 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authentik-server.conf.sample
# Make sure that your authentik container is in the same user defined bridge network and is named authentik-server
# Rename /config/nginx/proxy-confs/authentik.subdomain.conf.sample to /config/nginx/proxy-confs/authentik.subdomain.conf

# location for authentik subfolder requests
location ^~ /outpost.goauthentik.io {
    auth_request off; # requests to this subfolder must be accessible without authentication
    include /config/nginx/proxy.conf;
    include /config/nginx/resolver.conf;
    set $upstream_authentik authentik-server;
    proxy_pass http://$upstream_authentik:9000;
}

# location for authentik auth requests
location = /outpost.goauthentik.io/auth/nginx {
    internal;

    include /config/nginx/proxy.conf;
    include /config/nginx/resolver.conf;
    set $upstream_authentik authentik-server;
    proxy_pass http://$upstream_authentik:9000;

    ## Include the Set-Cookie header if present
    auth_request_set $set_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $set_cookie;

    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
}

# virtual location for authentik 401 redirects
location @goauthentik_proxy_signin {
    internal;

    ## Include the Set-Cookie header if present
    auth_request_set $set_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $set_cookie;

    ## Set the $target_url variable based on the original request
    set_escape_uri $target_url $scheme://$http_host$request_uri;

    ## Set the $signin_url variable
    set $signin_url https://$http_host/outpost.goauthentik.io/start?rd=$target_url;

    ## Redirect to login
    return 302 $signin_url;
}

I've tried a handful of different attempts

• Tried changing base URL from overseerr:5055 to 10.0.0.12:5055
• Tried changing base URL from overseerr:5055 to requests.mydomain.net
• Changed Set-Cookie to just Cookie:
• Tried with a different Plex user account
• Tried logging in to authentik purely with Plex
• Tried logging in to authentik with Discord login
• Tried logging in to authentik with local account
• Restarted all containers often
• Changed provider auth flow from default-provider-authorization-implicit-consent (Authorize Application) to default-provider-authorization-explicit-consent (Authorize Application)
• Ran a variation of the requests script locally via terminal, which returned the expected cookie
• Constantly ran in fresh incognito browsers
• Looked at the request/response headers via burp suite with and without interception turned on/off
• Deleted everything and started fresh, blew out Swag directory, blew out Overseerr directory, blew out Authentik
• Using purely default settings provided by Authentik (not including the mapping, or adding Plex login)
• Tried multiple different browsers
• Had a different user outside of my network attempt -> This produced a connect.sid cookie, but did not bypass the login screen and refreshing resulted in the same issue as I'm experiencing

Looks like the looping was fixed with the newest update.

[unkempt steeple]

[Solved] Property Mapping + SWAG + Overseer/Plex SSO

[Solved] Property Mapping + lsio/SWAG + Overseer/Plex SSO