multi tenant/domain not working

[jaunty bridge]

I saw video of @cooptonian about it but not sure how configured in one npm from other docker network. By docker proxy? When I set authentik proxy on home unraid npm it can't connect to authk.mydomain.com.

Having unraid home npm with authentik proxy authk.domain.work and
vps with npm + authentik server + worker auth.domain.net how to connect them?

[jaunty bridge]

i made local docker connection thrus tailscale for connect to docker network in unraid and made Proxy Outpost by this . but having error 404 : when access to authk.domain.work

if i set in outpost proxy AUTHENTIK_HOST: authk.domain.work have errors in log

In container I mean

@dapper steeple any advice?

if i set AUTHENTIK_HOST_BROWSER:authk.mydomain.com AUTHENTIK_HOST: auth.domain.net no errors but still 404

[dapper steeple]

...in the video, I tested with the manual outpost on a completely different machine but on the same network. From my understanding the Outpost communicates with the main instance to access the services. I will try to test over the weekend, setting this up again but on two physically different networks/locations.

[jaunty bridge]

Will be glad to see your result 😀
I'm really broken mind, maybe it's cloudflare issue, but I tryed add certificate to domain/tenant, also made outpost integration for docker proxy in Unraid 10.64.0.7 but it's builded in portainer where vps and authentik server... I have headscale and all machines connected... Just in case
But still have 502 in logs if I'm following the video

[jaunty bridge]

Did you had chance to check the issue?

[dapper steeple]

...was busy over the weekend and only looked into it briefly. My issue is when I create a new "brand/tenant" with the new/offsite domain (which is a completely separate cloudflare account I also control).

I spin up the manual outpost with the new "brand" authentik_host url (if I am following my video) but I obviously can't use that in NPM since I don't have certs for that domain on the host that has my main authentik install...those certs are on the remote location NPM instance that is also now running the manual Outpost... So thought maybe I would just need to manipulate the A record or make a redirect host...back to main authentik instance...but no. If i use my main authentik_host URL in the manual outpost instead, the console/logs show successful connection and healthy Outpost...however, when I then copy the code into the Advance field and edit the proxy_pass, my service goes offline

...so in short, got nowhere...I'll probably continue to experiment on it here and there...free time allowing...

[jaunty bridge]

Thats exactly same for me, tryed also add cert from npm to authentik outpost, also tryed outpost with docker proxy on unraid with headscale but no luck, will be happy to see if you will have time to fix it 😀

[dapper steeple]

...so, in the general chat @solemn ether sparked an idea of which I don't know why I didn't think of...guess that is why having a community is awesome; you can't think of everything and/or you may just miss something another set of eyes/ideas will see. Anyways, I made much greater progress in that NOW I can use authentik protecting a service on a completely different network... Instead of using forward auth (single/domain) use the transparent proxy instead...

now...I am using my main domain authentik instance and because of this there is a domain discontinuity, but at least it is more or less working as expected... What I mean by this is when I load up the protected speedtest site from the remote network, called it domainB, it redirects to my auth.domainA.tld (main authentik domain url)...and once authenticated, it jumps me back to speedtest.domainB...

...but yeah, I don't know what's up with the snippet of code being copy and pasted, however, the transparent proxy would be the easiest method between 2 networks...

[dapper steeple]

...if the different sites are on the same domain but different subdomains, this should be a simple fix with wildcard cert. What I am experimenting with are 2 different domains from 2 different cloudflare accounts and I think this is the farthest I can help with this... If I had both domains under 1 cloudflare account, I think I would just create multiple individual domain certs easily pluggable into NPM OR a UCC cert...1 cert that covers multiple domains.

[jaunty bridge]

I have 2 domains on same account

[jaunty bridge]

Sorry, not sure what is transparent proxy

[dapper steeple]

...then I think your solution should be pretty easy. Add the 2 SSL certs to your NPM host that has authentik also. Then use the transparent proxy method in authentik to have your remote service/external url point to the local IP address of the service on that remote host. Then adjust your DNS records to have your remote service point to your NPM that now has the 2 SSL certs

transparent proxy:

[jaunty bridge]

Thanks I will try it

[dapper steeple]

if I had my domains under 1 account I think I can resolve the issue I have where when it asks for authentication, it jumps to my primary authentik URL instead of the one I specified in the brand

so yeah, everything I said up top and so long as you have your brand and manual Outpost set up with the brand's authentik_host and the deployment token, you should be golden

[jaunty bridge]

Thanks will check it..

[dapper steeple]

and if you didn't know about the transparent proxy, in NPM you have your service point to the outpost instead of the service's IP and port

because then the Outpost will figure all the routing out (since you entered the info into the transparent proxy)

[jaunty bridge]

by #return 302 https://auth.domain.net/outpost.goauthentik.io/start?

[dapper steeple]

...oh one last thing, which you may already have done...add the outpost compose to your remote service compose so you don't have to worry about the Outpost not being able to reach your service...otherwise, if you start the outpost up as a separate project/stack, be sure to define the network to be the same as whatever service you are trying to reach

...you don't need any of that code stuff with transparent proxy/so nothing in the Advanced tab

[jaunty bridge]

yeah sure same network

Internal host = authk.domanin.work? External host : grafana.domain.work

[dapper steeple]

for the transparent proxy?

[jaunty bridge]

yes , or its 192.168.0.199:9001

[dapper steeple]

External would be whatever address you plan to use to reach the service...internal would be the internal IP address:port

[jaunty bridge]

do you mean compose from proxy auth ?

[dapper steeple]

I mean the manual Outpost compose from: https://docs.goauthentik.io/docs/outposts/manual-deploy-docker-compose
either copy the block to your existing compose to automatically be on the same network
or
if you spin it up in its own folder/project/stack...define the network to include the same network as the service you are trying to reach so that the Outpost can proxy/authenticate the service

[jaunty bridge]

oh i got already in unraid

[dapper steeple]

oh ok

[jaunty bridge]

but how to forward grafana to outpost ?

i mean should i add to advanced in grafana?

`# Increase buffer size for large headers

This is needed only if you get 'upstream sent too big header while reading response

header from upstream' error when trying to access an application protected by goauthentik

proxy_buffers 8 16k;
proxy_buffer_size 32k;

Make sure not to redirect traffic to a port 4443

port_in_redirect off;

location / {
# Put your proxy_pass to your application here
proxy_pass $forward_scheme://$server:$port;

# Set any other headers your application might need
# proxy_set_header Host $host;
# proxy_set_header ...`

oh , is authentik see my local adress from unraid ?

Authentik on vps in oracle cloud ?

[dapper steeple]

...I don't use unraid...however, if using transparent proxy (at least in docker) you don't need any of that code block

authentik essentially is serving as your reverse proxy (transparent as in it is almost like nginx proxy manager isn't even there)

in NPM you have your service (if it is Grafana) point to your manual Outpost address scheme: http domain/host: outpostName port:9000

when you navigate to grafana.domain.work, NPM will now just pass that traffic to the manual Outpost

Then, through the authentik_host and authentik_token this traffic is communicated to your authentik instance for authentication and if succesful...you've entered the external address this proxy is looking out for (grafana.domain.work) and will route it to it's internal IP:port

[jaunty bridge]

Yes but if I use internal ip:port of home in authentik in vps that another net... I can't see it navigate me through outpost

I have two npm in home and in vps where authentik

In home npm+outpost in vps npm+authentik

oh i have 500 error now , seems need 2 cert whats you told me

[dapper steeple]

I thought the internal IP:port would be an issue too...but the way the Outpost communicates it knows the local address of the host it is on

[jaunty bridge]

oh sorry its 500 when i entered snipped of proxy auth

[dapper steeple]

so for instance, my own home network is 192.168.0.0/24 the remote network 39 miles away has a lan of 192.168.1.0/24...I entered that local IP and it loads the expected site just fine

[jaunty bridge]

but you saying advanced in npm should be blank in grafana?

[dapper steeple]

yes...there is no use of the advanced tab at all in NPM when using the transparent proxy option of authentik, it essentially replaces NPM aside from providing the SSL cert

[jaunty bridge]

AUTHENTIK_HOST_BROWSER: should be not ussed ?

[dapper steeple]

only if it is different than your authentik_host (for internal communication as it states)...
So if you set your brand URL and authentik_host to the same URL in the config section, then AUTHENTIK_HOST_BROWSER does not need to be set

if you look at my multi-brand/tenant video...when I set up the brands you will see I set the URLs and authentik_host to be the same

[jaunty bridge]

in this case it cant be used ? as it should connect to auth.damain.net where authentik server ?

yes but you was not using in video AUTHENTIK_HOST_BROWSER at all

so for now i can see any of authentik outpost befor grafana ,maybe after i will add 2 cert for grafana domain ?

[dapper steeple]

since I have an SSL isssue I didn't set my authentik_host to the URL I want it to be (it is using the main URL) and I can't use the authentik_host_browser... That is why in my case, when I navigate to service.domainB.com it sends me to auth.domainA.com, I authenticate and then it redirects me back to service.domainB.com....it works, but if I have everything correct, it should have stayed on the same domain to authenticate with auth.domainB.com

correct, in the video I was not using AUTHENTIK_HOST_BROWSER at all because my authentik_host and my brand URL were the same/same domain

[jaunty bridge]

so for now i can see any of authentik outpost befor grafana ,maybe after i will add 2 cert for grafana domain ?

[dapper steeple]

see, they're the same so no need for authentik_host_browser to be set

[jaunty bridge]

i still cant see any authentik befor grafana , how i can add 2 cert for *.domain.work,*domian.net in cloudflare ? i can only use *domain.work ,domian.work or domain.net, *.domain.net

[jaunty bridge]

oh got it working like you said in grafan npm point to oupost internal ip:port but have error at end of auth :

OK now working ,after some time 😅

Thanks a lot for you time and help !

Also had no issue with cert ...

Its was a little confusing 😩

[dapper steeple]

ok great! so what finally fixed it all for you?

[jaunty bridge]

Just forgot to point to local outpost in grafana npm

Just interested if your examples still working now at latest version of authentik?

Becose maybe related to https://github.com/goauthentik/authentik/pull/7539/files

Becose found some issues opened for 404, 5xx errors for outpost for latest version but worked befor...

[jaunty bridge]

The error of screenshot not sure, just working after some seconds, maybe take time for update authentik worker stuff

[dapper steeple]

thank I'll check it out

[solemn ether]

This is my janky WYSIWYG write-up of my setup. My Authentik IP is 10.0.10.143, my protected app is 10.0.50.100, and everything is working. I am using the HASS method to pass trusted header authorization via Authentik Groups/Users to OliveTin to determine what features are available. This is a very rudimentary guide, but should illustrate the point. In retrospect, I will one day make something better on GitHub.

[dapper steeple]

@jaunty bridge @solemn ether ..if it is any consolation...kind of off-topic and not really talking about the 2 different networks now but instead talking about one of the issues encountered for the NPM part that I could not get the proxy host to stay online using forward auth and copy and pasting the code into the advanced tab...I finally got it to stay online with a (not too) janky workaround... I was trying to test what changed so I downgraded down back to 2024.2.3 and tried to set up a proxy host in NPM with copy and pasting the code and it worked as expected, upgraded to 2024.4.1 and even 2024.4.2 and copy and pasted the new code and update the proxy_pass and the proxy host immediately goes offline...so I downgraded yet again, copied the old sample code for NPM, upgraded back to 2024.4.2 and in NPM pasted the old code from 2024.2.3 and now my proxy host stayed online and working as expected...

...
most people that already have a bunch of apps that have their NPM set with the old code and just upgrade to latest authentik won't notice an issue (because they're working with old copy/pasted info). When they try to set up a new app and copy and paste the new code, they will most likely encounter same insta-offline issue...

[jaunty bridge]

Cool I will check this also, in way we talked befor I got working but have CORS errors in console of browser.
Maybe you can report to devs what you found?

[jaunty bridge]

What npm version?

[jaunty bridge]

i think only websocket part chenged in code ?

# Upgrade WebSocket if requested, otherwise use keepalive map $http_upgrade $connection_upgrade_keepalive { default upgrade; '' ''; } proxy_set_header Connection $connection_upgrade_keepalive;

[solemn ether]

Do you have a copy of the working stanza that could be reviewed?

[dapper steeple]

current/latest version 2.11.2

[dapper steeple]

here it is:

[jaunty bridge]

Do you have CORS errors when checked our case ?

i have a lot of this in log but seems all working ...

Also tryed to add headers for Access control allow origin but still...

[dapper steeple]

sorry, took down my test setup...so can't say unless I set it all back up

[jaunty bridge]

Also wanted to say Thanks for your great videos for Authentik.

It's very helped configure some things in Authentik.
Will be cool to see in future how to make self blueprints.
As like I made authentification flow for Authentik and wanted to make another for headscale oidc.

Found that blueprint needs to be edited manually befor import but had some issues where and how to store them....

[proven stump]

Woah thank you! I found Authentik with a link to your video sent by a friend and encountered this exact issue. Thanks for the video and thanks for the tip! :)

[glossy dawn]

Sorry to call you again about this issue. I'm trying to set it up myself. Have 2 domains. I want them to use the same authentik service. I followed your video: https://www.youtube.com/watch?v=tqimi3SdvCQ

I set it all up according to your video. Created a separate Brand pointing to the new auth address (even though it uses the same Authentik service). Create new provider, outpost and application. I use a Forward Auth for the whole domain. Once I copy the provider config to Nginx Proxy Manager, it stops working

[dapper steeple]

....if it is failing from copying the code to NPM, it probably is the code... See: #1236010860300730573 message

[glossy dawn]

I actually managed to make it connect to authentik, but now my login doesn't work

I was inputing the wrong port (I use a custom port for authentik, was inputting that)

I'm now stuck here

for some reason my login doesn't work

doesn't even say wrong password

INF event=/outpost.goauthentik.io/start?rd=/ host=pterodactyl.mydomain.ltd logger=authentik.outpost.proxyv2.application method=GET name=mydomain.ltd - Provider for Domain Wide Forward Auth Catch All remote=172.16.0.1:50306 runtime=1.036 scheme=http size=694 status=302 timestamp=2025-03-06T19:04:48Z user_agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0```

getting this warning for the domain 2 container

[dapper steeple]

your first setup is working? double check your 2nd brand is setup like your first in regard to stages applied

[glossy dawn]

my first setup is working. The domain 1 has always been working. I'm trying to add a 2nd domain

[dapper steeple]

did you create all new stages for the 2nd brand? or are you using the same stages the first brand is using?

[glossy dawn]

by stages, you mean, application, provider and outpost?

[dapper steeple]

no i mean identification, authentication, mfa, login stage...etc

[glossy dawn]

ah, no

do I have to create them? And how?

wouldn't my admin accounts be able to access the new service?

[dapper steeple]

yes your admin accounts, unless you restricted them should be able to access all

[glossy dawn]

Also, I have the authentik.mydomain1.ltd and authentik.mydomain2.ltd pointing to the same authentik panel, is that alright?

[dapper steeple]

yes they point to the same authentik instance

[glossy dawn]

ok, I got them both at http://192.168.0.20:9006 (example)

[glossy dawn]

I wonder why it's not working

[dapper steeple]

it has been awhile since i messed with 2 domains but I am looking now and my 2nd brand has its own authentication flow (but uses the default stages)

[glossy dawn]

So, I'd have to duplicate all this?

[dapper steeple]

only if you're customizing them in anyway for the other brand

...if i remember correctly

for instance, my cooptonian brand is highly customized so I made custom stages for it:

and my 2nd test brand was basic so used the default stages:

...but I don't think this is your issue (I just like to keep my brands separated)

[dapper steeple]

...also, at this timestamp, are you following it exactly? even updating the address in the config for 2nd brand outpost? https://youtu.be/tqimi3SdvCQ?t=650

[glossy dawn]

I followed it exactly like that

when I look at my deployment info though, it points to the original authentik domain (Outpost Deployment Info)

[dapper steeple]

🤔

[glossy dawn]

I do get that error in my outpost container

[dapper steeple]

I am not sure...I would have to update my authentik and try to set up a 2nd domain again to see if I come across the same issue

[glossy dawn]

For info, I'm using a domain wide forward auth

I have the Authentication URL and Cookie Domain pointing to my domain 2 instead of the domain 1

Also tried changing the authentik_host_browser: ""

doesn't work

[glossy dawn]

Hmmm, thing is, I'm using Local Docker connection for the outpost for domain 2

But I'm connecting for the proxy pass in Nginx PM using the local IP instead, because if I use the container name, it gives me an SSL handshake fail

[glossy dawn]

I managed to set up proper branding too, ty for the tutorials!

But still have the login issue for my second domain

This is webauthn

It says Security Key invalid