Traefik ForwardAuth with subpath

[ftc2]

can someone please share an example cofiguration with authentik + traefik doing forward auth (single application mode in authentik) on an application hosted on a subpath e.g. foo.example.com/myApp?

i'm trying to host multiple apps on one domain (/myApp, /myOtherApp, and so on).

here is my broken config. that's cool if you're able to see the problem with mine, but an example config of something else would probably also be OK.

note that i am not using TLS anywhere backend. TLS only happens later at cloudflare's edge.

my authentik server is available in docker backend as http://authentik:9000 or frontend as https://auth.example.com)

in traefik, i have this middleware defined in a file:

middlewares:
  authentik:
    forwardauth:
      address: http://authentik:9000/outpost.goauthentik.io/auth/traefik
      trustForwardHeader: true
      authResponseHeaders:
        - X-authentik-username
        - X-authentik-groups
        - X-authentik-email
        - X-authentik-name
        - X-authentik-uid
        - X-authentik-jwt
        - X-authentik-meta-jwks
        - X-authentik-meta-outpost
        - X-authentik-meta-provider
        - X-authentik-meta-app
        - X-authentik-meta-version

on authentik server's container, i have these labels set in docker compose:

labels:
  - "traefik.enable=true"
  - "traefik.http.routers.authentik.entryPoints=http"
  - "traefik.http.services.authentik.loadbalancer.server.port=9000"
  - "traefik.http.routers.authentik.rule=Host(`auth.example.com`) || (Host(`traefik.example.com`) && PathPrefix(`/outpost.goauthentik.io/`)) || (Host(`foo.example.com`) && PathPrefix(`/whoami-subpath/outpost.goauthentik.io/`))"

^ that last routing rule has three parts OR'd together:

• authentik dash: Host(auth.example.com)
• auth to traefik dash: Host(traefik.example.com) && PathPrefix(/outpost.goauthentik.io/)
• auth to this subpath demo: Host(foo.example.com) && PathPrefix(/whoami-subpath/outpost.goauthentik.io/)

demo service available internally at http://whoami-subpath and externally at https://foo.example.com/whoami-subpath (docker compose):

whoami-subpath:
    image: traefik/whoami
    container_name: whoami-subpath
    networks:
      - traefik
    labels:
    - "traefik.enable=true"
    - "traefik.http.routers.whoami-subpath.entryPoints=http"
    - "traefik.http.routers.whoami-subpath.rule=Host(`foo.example.com`) && PathPrefix(`/whoami-subpath`)"
    - "traefik.http.routers.whoami-subpath.middlewares=authentik@file"

in authentik's dash, i have the demo service configured like this:

Application:
Name: whoami-subpath
Slug: whoami-subpath
Provider: whoami-subpath
Policy: any

Provider:
Name: whoami-subpath
Authorization flow: default-provider-authorization-implicit-consent
Forward auth (single application):
External host: https://foo.example.com/whoami-subpath

Outpost:
Type: proxy
authentik Embedded Outpost
traefik dash (traefik dash)
whoami-subpath (whoami-subpath)

when i visit https://foo.example.com/whoami-subpath, authentik gives me this error:

Redirect URI Error

The request fails due to a missing, invalid, or mismatching redirection URI (redirect_uri).

when i try this with curl (curl -Lv https://foo.example.com/whoami-subpath):

https://auth.example.com/application/o/authorize/?client_id=Yu9BYY7ztGh1DExc4sy9HiGTaAX41Ps0blAxtTym&redirect_uri=https://foo.example.com/whoami-subpath/outpost.goauthentik.io/callback?X-authentik-auth-callback=true&response_type=code&scope=openid+profile+ak_proxy+email&state=oiqJpOQA_W3tZFvfSVjW78t3iQsozvGKVxVTlHhEN-4

so it looks like redirect_uri = https://foo.example.com/whoami-subpath/outpost.goauthentik.io/callback?X-authentik-auth-callback=true

thanks

---

• authentik version: 2023.5.3
• Deployment: docker-compose

[theAlevan]

Any answer to this?

[ftc2]

good god. i tried to do this again, hit the same problem, googled it, and ended up here at my own issue that i forgot all about.

slack-jawed, i think i found the solution just by dumb luck: try adding a trailing slash to your external url in your authentik provider. 🤦 🤦 🤦

[crazyelectron-io]

I am having a similar issue with URL's containing a path prefix like my.domain.tld/app. Adding a trailing '/' in the Authentic configuration did not solve it; I still get a 503. The IngressRoute:

      apiVersion: traefik.io/v1alpha1
      kind: IngressRoute
      metadata:
        name: app-external
        annotations:
          kubernetes.io/ingress.class: traefik-external
      spec:
        entryPoints:
          - websecure
        routes:
          - kind: Rule
            match: "Host(`my.${SECRET_DOMAIN_0}`) && PathPrefix(`/app`)"
            middlewares:
              - name: authentik
                namespace: authentication-system
            priority: 10
            services:
              - name: app-svc
                port: 80
          - kind: Rule
            match: "Host(`my.${SECRET_DOMAIN_0}`) && PathPrefix(`/app/outpost.goauthentik.io/`)"
            priority: 15
            services:
              - name: ak-outpost-authentik-embedded-outpost
                port: 9000
        tls: {}

The Middleware:

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
    name: authentik
spec:
    forwardAuth:
        address: http://ak-outpost-authentik-embedded-outpost.authentication-system.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
        trustForwardHeader: true
        authResponseHeaders:
            - X-authentik-username
            - X-authentik-groups
            - X-authentik-entitlements
            - X-authentik-email
            - X-authentik-name
            - X-authentik-uid
            - X-authentik-jwt
            - X-authentik-meta-jwks
            - X-authentik-meta-outpost
            - X-authentik-meta-provider
            - X-authentik-meta-app
            - X-authentik-meta-version

kubectl get svc -n authentication-system:

NAME                                    TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                      AGE
ak-outpost-authentik-embedded-outpost   ClusterIP   10.43.207.27    <none>        9000/TCP,9300/TCP,9443/TCP   29h
  ...