Keycloak + Traefik and Forward Auth (Proxy Auth) reddit / selfhosted ---------------------------------------------------------------------- fabio_teixei · 2023-12-15 23:53 So, i keep moving forward on my journey choosing an IDP for my services. I have tested Authentik and it works kinda OK, i have some issues with Azure AD authentication. It seems that there is a confirmed bug, but it looks like Authentik has kinda only one person developing it and that can be a problem when we face problems or bugs. Thats the biggest negative of Authentik for me. Now i'm testing Keycloak, i was able to set it up and it seams that is running just fine. The problem is that most of the services that i want to protect does note use any kind of authentication that is suported by Keycloak (\*rr apps, Overseerr, Homarr and etc), like Oauth2, SAML and etc. Authentik supports the "proxy" auth, meaning that you put an forward auth middleware on traefik and it will intercept the trafic and authenticate you before you enter the page. On Authentik that works great, but i did not found any way to do that on Keycloak without using an external middleware on traefik that goes thought anoter container and not drirectly to keycloak like authentik can do. I have in the past used that forward auth container but i always had problems with it, lots of problems, so i dont want to get back to it. Do you know if is there any way to configure Keycloak to act as the forward auth middleware for Traefik like Authentik does so i dont need to use a third container to this usecase? Thanks ---------------------------------------------------------------------- thekrautboy · 2023-12-16 00:02 Look at Authelia if Authentik doesnt work out for you. ---------------------------------------------------------------------- fabio_teixei · 2023-12-16 00:37 It works, except for the Azure AD like I said before everything is working on authentik. The problem is that normally I search the enterprise grade setup, that's why I use Kubernetes over docker, Hyper-v over proxmox and etc. Keycloak is the most enterprise friendly solution of all IDP that I found until now. I want to go forward with keycloak if possible but if is not I will go back to authentik for the moment. Do you know if that's possible (forward auth) with keycloak? ---------------------------------------------------------------------- thekrautboy · 2023-12-16 00:40 I cant make much sense of that, sorry. ---------------------------------------------------------------------- dcagatay · 2023-12-16 02:37 You can use https://oauth2-proxy.github.io/oauth2-proxy/ ---------------------------------------------------------------------- kgotson · 2023-12-16 06:27 I was looking into implementing an idp earlier, if I recall correctly uou can set up Keycloak for forward auth. Did you have a look at this https://wiki.brianturchyn.net/devops/traefik-forwardauth/ ---------------------------------------------------------------------- lazzurs · 2023-12-16 09:05 I’ve used this in the past for what you appear to need. https://github.com/oauth2-proxy/oauth2-proxy ---------------------------------------------------------------------- entrotec · 2023-12-16 11:07 > I have in the past used that forward auth container but i always had problems with it, lots of problems, so i dont want to get back to it. Which forward auth container did you use and what kind of problems were you facing? I've been running a combo of Traefik + Keycloak + [mesosphere/traefik- forward-auth](https://github.com/mesosphere/traefik-forward-auth) for the last 12 months and haven't run into a single issue, it is 100% rock solid. I'm also running the *arr apps behind it. My relevant configuration is as follows: services: traefik-forward-auth: image: mesosphere/traefik-forward-auth container_name: traefik-forward-auth depends_on: - keycloak environment: - TZ=Europe/Berlin - SECRET= - PROVIDER_URI=https://auth./realms/ - CLIENT_ID=forward-auth - CLIENT_SECRET= - COOKIE_DOMAIN= labels: - "traefik.enable=true" - "traefik.http.services.forwardauth.loadbalancer.server.port=4181" - "traefik.http.routers.forwardauth.entrypoints=websecure" - "traefik.http.routers.forwardauth.priority=5000" - "traefik.http.routers.forwardauth.middlewares=traefik- forward-auth" - "traefik.http.middlewares.traefik-forward- auth.forwardauth.address=http://traefik-forward-auth:4181" - "traefik.http.middlewares.traefik-forward- auth.forwardauth.authResponseHeaders=X-Forwarded-User" - "traefik.http.middlewares.traefik-forward- auth.forwardauth.trustForwardHeader=true" In Keycloak I've configured a corresponding openid-connect client with "*" as valid redirect URL. ---------------------------------------------------------------------- ntman1 · 2023-12-16 13:31 LemonLDAP::NG is the coolest and most unknown open source identity management platform out there. LemonLDAP::NG is a free software to provide WebSSO, Access Management and Identity Federation. LemonLDAP::NG is a comprehensive and versatile web Single Sign-On (SSO) solution that allows users to securely access multiple web applications with a single set of credentials. It is an open-source project developed in Perl, designed to provide a reliable and flexible authentication mechanism for organizations of all sizes. [LemonLDAP::NG](https://lemonldap-ng.org/) ---------------------------------------------------------------------- jarlaxle46 · 2023-12-16 15:05 Keycloak has OAuth though? ---------------------------------------------------------------------- fabio_teixei · 2023-12-16 15:08 I think yes, he can be an oauth source ---------------------------------------------------------------------- jarlaxle46 · 2023-12-16 15:13 Hmm. I've worked on this two years ago. But keycloak provides OpenID Connect. Which is a bunch of policies and protocols on top of OAuth2. So yes. It has OAuth2 builtin. https://www.keycloak.org/docs/latest/authorization_services/index.html #_resource_server_create_client When it says openidclient. It's Oauth2 ---------------------------------------------------------------------- menardorama · 2023-12-16 23:22 Did have the same move a month ago. Proxy mode is not supported OTB with keycloak. You can have as said on other post an oauth2 proxy per app but it not very efficient and I don’t think that you can inject http basic auth on the proxies app . Personally I ended up with using this traefik plugin https://plugins.t raefik.io/plugins/64c7b05f60d84b2d7b5ac5a8/keycloakopenid which works great except if you use duo mfa with keycloak. But for now it’s usable ---------------------------------------------------------------------- HappyWolff · 2023-12-17 09:46 Ops idea is to “ask” Traefik for authentication. Traefik is happy with a simple boolean-ish answer (true/false) but then Keycloak needs to be able to provide that answer after authentication is completed. In theory, simple. A few lines of yaml later and like 🥶😳. Then an all- nighter. Then 🥳 ---------------------------------------------------------------------- HappyWolff · 2023-12-17 09:48 Biased? 😁 ---------------------------------------------------------------------- modem7junior · 2023-12-23 23:12 This should hopefully get you started: [https://flatnotes.modem7.com/note/Package-Keycloak- Traefik](https://flatnotes.modem7.com/note/Package-Keycloak-Traefik) Unfortunately I couldn't paste it all here as there is a 1000 character limit.