OIDC - Portainer+Authelia+Traefik on Docker reddit / selfhosted ---------------------------------------------------------------------- charmstrong70 · 2023-12-28 12:04 Pulling my hair out for a couple of days now (yes, I know how to spend Christmas) and was hoping somebody may have some ideas. Trying to sort out my Docker containers. Traefik works. Authelia + Traefik works. OAuth, not so much. Everything looks good from the Authelia side: `time="2023-12-28T11:52:54Z" level=debug msg="Authorization Request with id '8ba747fc-8e0f-4d07-b0e2-6bf13506a05e' on client with id 'portainer' is being processed" method=GET path=/api/oidc/authorization remote_ip=`[`192.168.1.163`](https://192.168.1.163) `time="2023-12-28T11:52:54Z" level=debug msg="Authorization Request with id '8ba747fc-8e0f-4d07-b0e2-6bf13506a05e' on client with id 'portainer' using consent mode 'explicit' authentication level 'two_factor' is sufficient for client level 'two_factor'" method=GET path=/api/oidc/authorization remote_ip=`[`192.168.1.163`](https://192.168.1.163) `time="2023-12-28T11:52:54Z" level=debug msg="Authorization Request with id '8ba747fc-8e0f-4d07-b0e2-6bf13506a05e' on client with id 'portainer' using consent mode 'explicit' proceeding to generate a new consent session" method=GET path=/api/oidc/authorization remote_ip=`[`192.168.1.163`](https://192.168.1.163) `time="2023-12-28T11:52:54Z" level=debug msg="Authorization Request with id '8ba747fc-8e0f-4d07-b0e2-6bf13506a05e' on client with id 'portainer' using consent mode 'explicit' is being redirected to '`[`h ttps://authelia.example.com/consent?id=00c06038-02de-47a1-9ee6- d908607482c8`](https://authelia.chrisarmstrong.uk/consent?id=00c06038- 02de-47a1-9ee6-d908607482c8)`'" method=GET path=/api/oidc/authorization remote_ip=`[`192.168.1.163`](https://192.168.1.163) `time="2023-12-28T11:52:55Z" level=debug msg="Authorization Request with id 'f4f5d264-a3d8-4ec9-8c54-57b334259dc4' on client with id 'portainer' is being processed" method=GET path=/api/oidc/authorization remote_ip=`[`192.168.1.163`](https://192.168.1.163) `time="2023-12-28T11:52:55Z" level=debug msg="Check authorization of subject username=USER groups=admins,devs,users ip=`[`192.168.1.163`](https://192.168.1.163) `and object` [`https://portainer.example.com/?code=authelia_ac_6SWDyHzEZN-cm6dXa3NE 9SD2AZ1rnmn1H0WS_FO5YGU.Hr2Xl1x2ob0xOlDUNgIgelQMJagSBUuuNRuLSl8QoyU&sc ope=openid+profile+groups+email&state=1dfb5774-b153-4631-a159- 6053cb1215a4`](https://portainer.chrisarmstrong.uk/?code=authelia_ac_6 SWDyHzEZN-cm6dXa3NE9SD2AZ1rnmn1H0WS_FO5YGU.Hr2Xl1x2ob0xOlDUNgIgelQMJag SBUuuNRuLSl8QoyU&scope=openid+profile+groups+email&state=1dfb5774- b153-4631-a159-6053cb1215a4) `(method GET)."` `time="2023-12-28T11:52:55Z" level=debug msg="Authorization Request with id 'f4f5d264-a3d8-4ec9-8c54-57b334259dc4' on client with id 'portainer' was successfully processed, proceeding to build Authorization Response" method=GET path=/api/oidc/authorization remote_ip=`[`192.168.1.163`](https://192.168.1.163) However, Portainer doesn't seem like it can "see" the Authelia container. All are on the same Traefik proxy network: `2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG oauth/oauth.go:34 > 2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG oauth/oauth.go:34 > failed retrieving oauth token | 2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG oauth/oauth.go:34 > 2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG oauth/oauth.go:34 > failed retrieving oauth token | error="Post \"`[`https://authelia.example.com /api/oidc/token\`](https://authelia.chrisarmstrong.uk/api/oidc/token\) `": dial tcp: lookup` [`authelia.chrisarmstrong.uk`](https://authelia.chrisarmstrong.uk) `on` [`127.0.0.11:53`](https://127.0.0.11:53)`: no such host"` `2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG auth/authenticate_oauth.go:76 > 2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG auth/authenticate_oauth.go:76 > OAuth authentication error | 2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG auth/authenticate_oauth.go:76 > 2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG auth/authenticate_oauth.go:76 > OAuth authentication error | error="Post \"`[`https://authelia.example.com/api/oidc/token\`](https: //authelia.chrisarmstrong.uk/api/oidc/token\)`": dial tcp: lookup` [`authelia`](https://authelia.chrisarmstrong.uk)`.example.com on` [`127.0.0.11:53`](https://127.0.0.11:53)`: no such host"` `2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG security/bouncer.go:401 > 2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG security/bouncer.go:401 > HTTP error | 2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG security/bouncer.go:401 > 2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG security/bouncer.go:401 > HTTP error | error=Unauthorized 2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG security/bouncer.go:401 > 2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG security/bouncer.go:401 > HTTP error | 2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG security/bouncer.go:401 > 2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG security/bouncer.go:401 > HTTP error | error=Unauthorized msg="Unable to authenticate through OAuth" 2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG security/bouncer.go:401 > 2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG security/bouncer.go:401 > HTTP error | 2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG security/bouncer.go:401 > 2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG security/bouncer.go:401 > HTTP error | error=Unauthorized 2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG security/bouncer.go:401 > 2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG security/bouncer.go:401 > HTTP error | 2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG security/bouncer.go:401 > 2023/12/28 11:52AM 2023/12/28 11:52AM DBG 2023/12/28 11:52AM 2023/12/28 11:52AM DBG security/bouncer.go:401 > HTTP error | error=Unauthorized msg="Unable to authenticate through OAuth" status_code=500` `2023/12/28 11:56AM 2023/12/28 11:56AM ERR 2023/12/28 11:56AM 2023/12/28 11:56AM ERR client/client.go:92 > 2023/12/28 11:56AM 2023/12/28 11:56AM ERR 2023/12/28 11:56AM 2023/12/28 11:56AM ERR client/client.go:92 > unexpected status code | 2023/12/28 11:56AM 2023/12/28 11:56AM ERR 2023/12/28 11:56AM 2023/12/28 11:56AM ERR client/client.go:92 > 2023/12/28 11:56AM 2023/12/28 11:56AM ERR 2023/12/28 11:56AM 2023/12/28 11:56AM ERR client/client.go:92 > unexpected status code | status_code=403` Any (and I mean any) suggestions would be appreciated. ---------------------------------------------------------------------- lilolalu · 2023-12-28 13:19 dial tcp: lookup authelia.example.com on 127.0.0.11:53: no such host" ---------------------------------------------------------------------- charmstrong70 · 2023-12-28 14:25 >dial tcp: lookup authelia.example.com on 127.0.0.11:53: no such host" yeah, that's why I said: >However, Portainer doesn't seem like it can "see" the Authelia container. All are on the same Traefik proxy network: If I take off the OAuth, it successfully authenticates from Authelia but I guess that's just between Traefik and Authelia. All three are on the same docker network so, am out of ideas. ---------------------------------------------------------------------- lilolalu · 2023-12-28 14:28 Are you using the service name as the "address" in portainer or the IP? Because the internal docker ip's are dynamically assigned. Where does portainer get the DNS 127.0.0.11 (port 53 is DNS) from? ---------------------------------------------------------------------- lilolalu · 2023-12-28 14:53 Maybe check out this: https://stackoverflow.com/questions/64007727/docker-compose-internal- dns-server-127-0-0-11-connection-refused ---------------------------------------------------------------------- charmstrong70 · 2023-12-28 17:38 Thanks for having a look and I appreciate you replying. Can't see much in there unfortunately (I can't seem to connect to the portainer shell to confirm 100%). ---------------------------------------------------------------------- lilolalu · 2023-12-28 17:52 You could use the tool mentioned here, but it seems a bit too much work: [https://github.com/portainer/portainer/issues/2707](https://github.co m/portainer/portainer/issues/2707) but generally speaking, the docker "internal" DNS on [127.0.0.11:53](https://127.0.0.11:53) is not reachable from inside your portainer container. In the stackoverflow post they mentioned that this was caused by a pihole dns occupying port 53... so i would look into what DNS the containers are seeing, you could do that from your authelia or traefik docker, since they are in the same network as the portainer container, right? ---------------------------------------------------------------------- newbutler · 2023-12-28 19:24 this is clearly an dns issue, post your whole config