Proxy auth w/ custom header for CouchDB | authentik | Page 1

undone rover Dec 18, 2023, 1:19 PM

Hi all, I'm having some trouble setting up a proxy provider for CouchDB, specifically that I'm struggling to get any custom header to show up (I think). CouchDB can do authentication via a proxy (https://docs.couchdb.org/en/stable/api/server/authn.html#proxy-authentication), and looks for X-Auth-CouchDB-UserName in the request. I have created a new Proxy provider in Authentik, and have added the additional scope that should provide this header. However when navigating to the URL, I don't see any headers set by Authentik. This seems to include the default ones (X-authentik-username, etc). Would appreciate any guidance on this. Thanks!

my nginx proxy conf for couchdb, if that's of any use (it's basically one taken from the LSIO/SWAG repo and repurposed): ```
server {
listen 80;

server_name couchdb-dev;

return 301 https://$server_name.domain.com$request_uri;

}

server {
listen 443 ssl http2;

server_name couchdb-dev.domain.com;

include /config/keys/domain.com/ssl.conf;

client_max_body_size 0;

location / {

    include /config/nginx/proxy.conf;
    resolver 127.0.0.11 valid=30s;
    set $upstream_app authentik-server;
    set $upstream_port 9000;
    set $upstream_proto http;
    proxy_pass $upstream_proto://$upstream_app:$upstream_port;

}

}```

I think I'm most suspicious of the fact that there are seemingly no authentik-related headers

response headers too:

there is an authentik one there, X-Powered-By

undone rover Dec 18, 2023, 2:23 PM

learnt about https://hub.docker.com/r/traefik/whoami, tested using that. looks like the header is being added, so looks like I'm sorted from an authentik side 🙂 ```Hostname: c09c1b602708
IP: 127.0.0.1
IP: 172.25.0.18
IP: 172.22.0.29
RemoteAddr: 172.25.0.14:40610
GET / HTTP/1.1
Host: couchdb-dev.domain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip
Accept-Language: en-US,en;q=0.9
Cookie: authentik_proxy_24TF3yOb=7VX4MW5NJ344DDGJ4CWPJGQJFMXAPSZ3IPLPONDVLFTYTJXLMWMB4JGHTP4NWAI6E3OV5Y4WWPSPQWQXLTZVL4DU4QQNU6LMY6QIXCI
Sec-Ch-Ua: "Not_A Brand";v="8", "Chromium";v="120", "Google Chrome";v="120"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Sentry-Trace: 150c46e064911798222adb250d0e6c93-7d55b13a8f217dd3-1
Upgrade-Insecure-Requests: 1
X-Auth-Couchdb-Username: MrMeeb
X-Authentik-Email: [redacted]
X-Authentik-Groups: Users|Developers|Bookstack Editor|Homelab
X-Authentik-Jwt: [redacted]
X-Authentik-Meta-App: couchdb
X-Authentik-Meta-Jwks: https://sso.domain.com/application/o/couchdb/jwks/
X-Authentik-Meta-Outpost: authentik Embedded Outpost
X-Authentik-Meta-Provider: CouchDB
X-Authentik-Meta-Version: goauthentik.io/outpost/2023.10.4
X-Authentik-Name: [redacted]
X-Authentik-Uid: 627326fb3c7390664b0af47c47d0cf4da4f42b77c6bafe130acffe70ca1c8aaf
X-Authentik-Username: MrMeeb
X-Forwarded-For: [redacted]
X-Forwarded-Host: couchdb-dev.domain.com
X-Forwarded-Proto: https
X-Forwarded-Ssl: on
X-Real-Ip: [redacted]

#Proxy auth w/ custom header for CouchDB