Forward Auth with Authentik via Traefik
Desired Goal
- Have a SSO authentication page that is SSL secured for all of my services. Authentication will be controlled on a per-service basis using Authentik Application level proxy provider (not using Authentik as a reverse proxy, just as an SSO service)
Authentik Implementation
Provider
- Name:
freshrss
- Auhorization Flow:
Authorize Application
- Provider Type:
Proxy Provider: Forward Auth (single application)
- External host:
https://freshrss.mydomain.com
Application
- Name:
freshrss
- Slug:
freshrss
- Provider:
freshrss
- No policies attached
Outpost
- Name:
Authentik Embedded Outpost
- Type:
Proxy
- Applications:
freshrss (https://freshrss.mydomain.com)
Traefik Implementation
- I am using the base Traefik configuration method (non-docker-label)
- I am using Traefik for all of my SSL
Static Configuration (traefik.yml)
Dynamic Configuration (config.yml)
Docker Compose (docker-compose.yml)
Issues
Issues with above implementation
- Implementation works for users internal to the network (due to the forwardAuth middleware address being resolvable).
authentik-host.site.mydomain.com
is an static DNS entry on my PFSense host. Theauthentik-router
traefik router provides SSL to when users directyl access the Authentik service. - Authentik forwardAuth SSO page is not SSL secured since the forward auth address points directly to the backend service (rather than through the traefik router which provides SSL).
Issue when forwardAuth address as http://authentik.mydomain.com/outpost.goauthentik.io/auth/traefik
- Idea: the idea with the implementation is that the forwardAuth page will be resolvable by outside hosts since the SSO page is now routed through the Traefik reverse proxy. Additionally, the SSO page will also get SSL since traefik is routing.
- Issue: Because traefik is now routing the forwardAuth request, it is modifying the
X-Forwarded*
headers to point back toauthentik.mydomain.com
rather thanfreshrss.mydomain.com
. This causes the Authentik when the forwardAuth request is routed to it to fail withUnknown app
since it is looking for anauthentik
application (in the Authentik terminology) rathern thanfreshrss
- Note that if you add an
Authentik
application + provider + outpost, it will correctly resolve but authentik will SSO auth to itself (will not forward back to freshrss).
- Note that if you add an
- I think this is the right idea though, I just need to fix the
X-Forwarded issue
Atttempt 1 to fix: Edit traefik entrypoints with forwardedHeaders
- Expectation: the forwardAuth will use the existing freshrss
X-Forwarded
added by Traefik by default.- Known: This opens security issues but we can fix those with
forwardedHeaders.trustedIPs
instead
- Known: This opens security issues but we can fix those with
- Result/Issue: This appears to do nothing? I am not sure why.