Authentik Forward Auth redirecting to Authentik user Dasboard instead of the real aplication (Using Kubernetes and Traefik reddit / selfhosted ---------------------------------------------------------------------- fabio_teixei · 2023-12-14 20:21 So i follow all the guides i did not seem to have found the issue with my config so i'm asking for help. I have an Kubernetes environement using Traefik as my Ingress Controller. Every thing works great with Kubernetes and Traefik, no problems there. Now i have deployed Authentik using Helm on my Kubernetes. Authentik server itself seems to be running fine, no problems. So i want now to add auth to my apps, i will use Bazarr as an exemple because its already working and does not demands any kind of auth for simplicity. First i have created the forward auth Middleware on Traefik --- apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: name: authentik namespace: auth spec: forwardAuth: address: https://authentik.domain.com/outpost.goauthentik.io/auth/traefik trustForwardHeader: true authResponseHeaders:             - X-authentik-username             - X-authentik-groups             - X-authentik-email             - X-authentik-name             - X-authentik-uid             - X-authentik-jwt             - X-authentik-meta-jwks             - X-authentik-meta-outpost             - X-authentik-meta-provider             - X-authentik-meta-app             - X-authentik-meta-version After that i created the Authentik Ingress Route on Kubernetes --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: authentik-ingress namespace: auth spec: entryPoints:     - websecure routes:     - match: Host(`authentik.domain.com`) kind: Rule middlewares:       - name: traefik-redirectscheme namespace: traefik services:         - name: authentik port: 80 tls: secretName: auth-tls After that i configured Authentik Provider (Domain Level): ​ https://preview.redd.it/95bv68gn9b6c1.png?width=1092&format=png&auto=w ebp&s=673ba67fdfcafef9117ecb4d4c1dadbf2f24d1bd After i created the Application on Authentik: ​ https://preview.redd.it/ttdmkss0ab6c1.png?width=1103&format=png&auto=w ebp&s=aa8870e55762e248f8517a161988ba5ac789597a Now updated the embebed outpost on authentik ​ https://preview.redd.it/f5cpsd0oab6c1.png?width=1179&format=png&auto=w ebp&s=00cace85c94805da12aca64812446d25c48f11f3 ​ https://preview.redd.it/j5igtb3xab6c1.png?width=1096&format=png&auto=w ebp&s=2e264c8a0e7863954fbb5af416f56ec15e0b8b6c And on the end i updated my Bazarr Ingress route to add the middleware --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: bazarr-ingress namespace: media spec: entryPoints:     - websecure routes:     - match: Host(`bazarr.domain.com`) kind: Rule middlewares:       - name: traefik-redirectscheme namespace: traefik - name: authentik namespace: auth services:         - name: bazarr port: 6767 tls: secretName: media-tls When i open the bazarr page the forward auth middleware does his job and request the auth: ​ https://preview.redd.it/9q15k60oib6c1.png?width=947&format=png&auto=we bp&s=256f233aae2fd90d597b46e8298c68dbb6e17b49 We can see that we have used the right application. But after the log in i'm being redirected to the Authentik User Dashboard: ​ https://preview.redd.it/dnnhjisdjb6c1.png?width=939&format=png&auto=we bp&s=2b87ac9bfdb7e2571ececb562a6e256fd2193c25 But the weird think is that the domain cookie works, so when i try again to open the [bazarr.domain.com](https://bazarr.domain.com) url i'm able to open bazarr with no issue. I don't have any idea on how to fix this. I have even completley redeployed Authentik on Kubernetes but no go. I have searched all over the web, many mentions on this issue but no fix. Do you have any idea on how to fix that? ---------------------------------------------------------------------- [deleted] · 2023-12-14 20:29 [deleted] ---------------------------------------------------------------------- fabio_teixei · 2023-12-14 20:30 Some bug with reddid codding box, i dont know why i cant edit the post to fix that. I'm trying to post the yaml here on the comments but is not working ---------------------------------------------------------------------- fabio_teixei · 2023-12-14 20:34 Middleware: apiVersion: traefik.io/v1alpha1 kind: Middleware metadata:     name: authentik     namespace: auth spec:     forwardAuth:         address: https://authentik.domain.com/outpost.goauthentik.io/auth/traefik         trustForwardHeader: true         authResponseHeaders:             - X-authentik-username             - X-authentik-groups             - X-authentik-email             - X-authentik-name             - X-authentik-uid             - X-authentik-jwt             - X-authentik-meta-jwks             - X-authentik-meta-outpost             - X-authentik-meta-provider             - X-authentik-meta-app             - X-authentik-meta-version Autentik Ingress: apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata:   name: authentik-ingress   namespace: auth spec:   entryPoints:     #- web     - websecure   routes:     - match: Host(`authentik.domain.com`)       kind: Rule       middlewares:       - name: traefik-redirectscheme         namespace: traefik       services:         - name: authentik           port: 80     tls:     secretName: auth-tls Bazarr Ingress: apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata:   name: bazarr-ingress   namespace: media spec:   entryPoints:     - websecure   routes:     - match: Host(`bazarr.domain.com`)       kind: Rule       middlewares:       - name: traefik-redirectscheme         namespace: traefik       - name: authentik           namespace: auth       services:         - name: bazarr           port: 6767       tls:     secretName: media-tls ---------------------------------------------------------------------- lilolalu · 2023-12-14 20:48 So what happens if you click on the app on the dashboard, can you access it or not? I haven't configured forward auth, but OIDC for nextcloud and there it's similar. You go to nextcloud and are asked to login to authentik. If you log in there, you will be forwarded to the dashboard. Only that when you click on nextcloud now, you are logged in. Since it's an SSO portal, you are not authenticating for one specific app but all apps that you have access to via authentik. ---------------------------------------------------------------------- fabio_teixei · 2023-12-14 20:51 It's an domain wide app, it's not an individual app. It is suposed to redirect me to the App itself and not to the dashboard. If yours is redirecting to the Dashboard is something wrong with your config as well. Because it is an SSO portal yes, but also an IDP for apps. ---------------------------------------------------------------------- lilolalu · 2023-12-14 20:52 I don't think that's how it works. Can you access the app when you click on the app there or not? ---------------------------------------------------------------------- fabio_teixei · 2023-12-14 20:54 No because is not an real app, it's an domain wide app for domain wide provider. Theres no were to put an URL for the app on an Domain wide app. ---------------------------------------------------------------------- lilolalu · 2023-12-14 20:57 I have no idea what you are talking about. Authentik sets a token to signal that user X has the right to access app Y now. This is checked by traefik, since the app has no mechanism to ask authentik itself (like OIDC) nonetheless, the auth flow is the same. Only that the permission to access the app is not checked by the app itself but by traefik using forward auth. ---------------------------------------------------------------------- lilolalu · 2023-12-14 21:05 Did you see this already? https://github.com/goauthentik/authentik/issues/1997 ---------------------------------------------------------------------- fabio_teixei · 2023-12-14 21:06 See this guide: [brokenscripts/authentik\_traefik: Authentik behind Traefik (github.com)](https://github.com/brokenscripts/authentik_traef ik?tab=readme-ov-file#applications--providers) Or this video: [(4) Replace Authelia With Authentik Web Proxies And OAuth2 - YouTube](https://www.youtube.com/watch?v=1bTSOdYiIOQ&t=333s) Or even this one: [(4) Authentik - Application Setup | Nginx Proxy Manager | (Docker/Compose) - YouTube](https://www.youtube.com/watch?v=Nh1qiqCYDt4) You will see what i'm talking about.[](https://www.youtube.com/watch?v=1bTSOdYiIOQ&t=333s) We have two ways of configuring forward auth with Authentik, Domain Level and Single App level. I'm trying to use Domain Level. On Domain Level we dont use an individual app but a whole domain where the cookie is able to auth to, so any URL under that domain that uses authentik middleware will be accesible after you authenticate the first time. Bazarr itself does not use authentication so it does not need to retrive any kind of auth token from authentik. With forward auth traefik will intercept the trafic before goes to the app, redirects to authentik for authentication and after that, authentik is suposed to redirect you to the app back, but in my case is redirecting to authentik dashboard ---------------------------------------------------------------------- lilolalu · 2023-12-14 21:17 I still don't quite get what the problem is, because the redirect to the dashboard after successful login makes sense for me. For me, the starting point for a user wishing to log into any services they are allowed to use would always be auth.example.com ... Sure, they can start with cloud.example.com or bazaar.example.com if they fancy that, but obviously they will be redirected to the authentik login page, if they haven't logged in before. If they automatically get redirected back to cloud.n0ne.de after authentication - if that was their entry point to the server, or if they are presented with all the services (regardless if apps or domain wide) they have access to now, is a matter of taste and UX, or not? In the GitHub link I posted you people are discussing the redirect you want, personally I think it makes sense to have the extra click on the service you want to access on the dashboard, to understand that you can use all those services you see now. Btw entering your credentials on auth.example.com, ignoring the dashboard and opening another tab with cloud.example.com obviously also should (but also does) work. ---------------------------------------------------------------------- fabio_teixei · 2023-12-14 21:21 So i found the issue, so now, when i enter [bazarr.domain.com](http://bazarr.domain.com), the request is forwarded to [authentik.domain.com](http://authentik.domain.com), i log in and after that i'm being directed to [bazzar.domain.com](http://bazzar.domain.com) as expected. The issue is that on the middleware i need to specify the internal kubernets name for the service instead of the fqdn of the authentik, i dont know why. ---------------------------------------------------------------------- lilolalu · 2023-12-14 21:23 Ah good, you found the solution. Like I said. For me the redirect to the dashboard is actually a good thing, because it can act like an internal "homepage". Personally I think the entry point to a system using SSO would always be the auth page. ---------------------------------------------------------------------- fabio_teixei · 2023-12-14 21:26 So, i have foud the problem. I dont know if this is exclusif to Kubernets but on my case the middleware shoud point to the internal kubernetes name of the service and not the fqdn used by authentik. So here is my middleware with the fix: apiVersion: traefik.io/v1alpha1 kind: Middleware metadata:     name: authentik     namespace: auth spec:     forwardAuth:         address: http://authentik.auth/outpost.goauthentik.io/auth/traefik         trustForwardHeader: true         authResponseHeaders:             - X-authentik-username             - X-authentik-groups             - X-authentik-email             - X-authentik-name             - X-authentik-uid             - X-authentik-jwt             - X-authentik-meta-jwks             - X-authentik-meta-outpost             - X-authentik-meta-provider             - X-authentik-meta-app             - X-authentik-meta-version Where authentik is the name of the service published on Kubernetes and auth is the namespace, so the url needs to be [http://authentik.auth/o utpost.goauthentik.io/auth/traefik](http://authentik.auth/outpost.goau thentik.io/auth/traefik) in this case i use http instead of https because internaly i dont have any certificats on authentik, only on the traefik. But when you access on your browser you will always see the public URL of authentik, never the internal kubernetes one. ---------------------------------------------------------------------- fabio_teixei · 2023-12-14 21:28 yeah, i got that for you thats good but is not the usecase that i'm using authentik for. My dashboard is on Homarr, my users will use homarr to access the services, i dont want to expose authentik to anyone. ---------------------------------------------------------------------- lilolalu · 2023-12-14 21:36 Well If all users are supposed to have access to all apps at the same permission levels, that makes sense. I think just for forward auth with one set of credentials, authentik is a bit overkill to be honest. For me the ability to manage groups, permissions, 2fa requirements etc is the REAL advantage of unified central user management in something like traefik, authelia or keycloak.