#ForwardAuth returning HTTP 404

1 messages · Page 1 of 1 (latest)

pallid estuary
#

I am trying to use http forward auth for a service, but when accessing the downstream service I only get a http 404 error instead of a login page.

I am using docker compose for deployment and traefik as my reverse proxy.

  • accessing https://service/outpost.goauthentik.io/ping works fine and gives me the expected 204 response.
  • disabling the provider from the embedded outpost and trying to access https://service/outpost.goauthentik.io/ gives me an authentik error page, so that part clearly is working.
  • when accessing https://service/ I can see that authentik is matching the correct app and host in the logs, but then nothing else happens. Worth noting here I do not get an authentik "not found" page, but just a raw HTTP 404 with a single line "page not found" response. so this might yet turn out to be an issue with traefik? not sure.

relevant log:

app=MYAPP event=Found app based direct host match host=service.domain.tld logger=authentik.outpost.proxyv2
event=passing to application mux host=service.domain.tld logger=authentik.outpost.proxyv2
dull olive
#

I havent really looked into forwardauth yet but im using a few reverse proxies. I would check the logs of the downstream service first. and on top of that since you get a 404 some server is actively telling you that. so shutting down your downstream service should give you bad gateway. if it doesnt, the 404 is coming from the reverse proxy and is clearly not going to the downstream. if it changes to bad gateway its actively going to the downstream. then in might be some simple thing as for example your downstream only being available via a specific SNI but your reverse proxy goes to the ip without a hostname as an example

pallid estuary
#

the downstream service works fine if I remove the forwardauth middleware

#

the 404 seems to be coming from authentik itself when it tries to contact the integrated outpost at http://authentik-internal-hostname/outpost.goauthentik.io/auth/servicename

dull olive
#

is the outpost displayed as healthy in the gui?

pallid estuary
#

yes

#

it works fine as forwardauth provider for traefik's own dashboard, just not for this 2nd service that I'm trying to add

dull olive
#

and the new service is also linked to that outpost?

pallid estuary
#

yes

dull olive
#

can you try spinning up another outpost dedicated to that new service just to see if it makes a difference?

pallid estuary
#

not easily 😬

dull olive
pallid estuary
#

should match the slug right?

pallid estuary
dull olive
#

ye it matches the app at least is how i would understand it

#

app is linked to provider and provider to outpost iirc

pallid estuary
#

yes

dull olive
#

well, im sorry to be of no help. would need to look into that myself. its on my todo list to use forwardauth instead of the apache plugin for oidc

pallid estuary
#

ehh I wouldnt recommend it. if you can use OIDC, stick to OIDC

#

I'm only using forwardauth for this one service because it requires http BASIC auth otherwise

dull olive
#

with multiple users on basic auth? or just one user? then apache with the oidc plugin works for that

pallid estuary
#

just one (I am not sure whether the underlying service even supports multiple users without using their enterprise offerring, at which point I could just use OIDC..)

#

tho I'm not using apache I'm using traefik as my reverse proxy

dull olive
#

which also has an oidc plugin. dont know how good that is but could be worth a look at at least