Help with NPM and Authentik
reddit / selfhosted

----------------------------------------------------------------------
void_the · 2023-11-11 01:50

I have followed the documentation created by u/itsmevins [here](https:
//www.reddit.com/r/selfhosted/comments/vs12ug/sso_with_authentik_and_n
ginx_proxy_manager/) for configuring NPM and Authentik together. I am
able to get it functioning when I specify the authentication
proxy\_pass to a local IP. When I try to set it to my host name that I
configured in NPM I get 500 errors.

When I check the error log for my app I see '''socket() failed (24:
Too many open files) while connecting to upstream''' I have looked
around the internet to see how I can increase the number of open file
descriptors for NPM but all I get is ones for NGINX.
Has anyone had a similar issue to me?


In case I have done something else wrong my configs are below

NPM auth proxy host config:


https://preview.redd.it/g8aam7xwjmzb1.png?width=753&format=png&auto=we
bp&s=f3f6a0ae719d43fde63e6c56ae76f7c4f55c24a6

NPM app proxy config:

https://preview.redd.it/zq93zbdejmzb1.png?width=1744&format=png&auto=w
ebp&s=07b7be8cd9f56779e350fcab331de806d53d8a71

Authentik Provider config:


https://preview.redd.it/d8k3h10ujmzb1.png?width=1684&format=png&auto=w
ebp&s=43252fdeb7fc4662d9f3386225509fdaee4a9051

Authentik app config:


https://preview.redd.it/53r4jojqimzb1.png?width=1668&format=png&auto=w
ebp&s=9d6b629dcec2ab586773733d3c79a8fe4c471bda

Authentik outpost config:

https://preview.redd.it/t9i1zgn6jmzb1.png?width=803&format=png&auto=we
bp&s=237ac8cd999f755f4ac51b8ec2b6e6123353fe6c

​

----------------------------------------------------------------------
javijuji · 2023-11-11 15:09

Are authentik and npm running in the same docker network? Otherwise
they won't be able to resolve hostnames. This isn't required though.
Using IP address is perfectly valid.

----------------------------------------------------------------------
void_the · 2023-11-11 21:23

Currently they are running of different hosts NPM ending:251,
authentik ending :246 I’ll check the dns on my npm box to see if that
was the issue

----------------------------------------------------------------------
void_the · 2023-11-12 01:31

I think I have found an issue with how NPM or nginx handles proxy pass
for authentication. I would expect that the exact string I put into
that field gets used for the connection. When checking the logs I see
that it is using the IP address. Normally this would be ok but since I
am using NPM to upgrade the connection to HTTPS as a separate proxy
host. When it goes to resolve
[auth.domain.name](https://auth.domain.name) it gets a CNAME record
from my dns server pointing to
[proxy.domain.name](https://proxy.domain.name). Rather than sending
the request to the host as
[auth.domain.name](https://auth.domain.name) it sends the request to
[proxy.domain.name](https://proxy.domain.name)'s ip address. There is
no proxy host configured for that "host" so NPM sends it to my
"default site" which is a redirect. This was not expected from the
proxy so the original request to my app for authentication returns
502.


I will add this to the main post

From the log file:

​

From the proxy host config: