SSO authentik behind traefik

[EpicKau]

I read the SSO docs for authelia and adopted it for authentik but nothing happens.
I get the normal authentik login page but after that the default homechart login prompt appears.
The conf I use:
HOMECHART_app_proxyAddress: 172.23.0.3 (internal docker IP of traefik)
HOMECHART_app_proxyHeaderEmail: X-authentik-email
HOMECHART_app_proxyHeaderName: X-authentik-name

Am I missing something?

[thequailman]

Hey can you share your architecture a bit more? You hit Authentik and it proxies directly to Homechart, right? Any other proxies in the mix? How is Authentik configured to proxy to Homechart?

[thequailman]

Should be good to go

[EpicKau]

Here we go, I hope I dont steal all your time 😁
{
"headers": {
"Accept": [
"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8"
],
"Accept-Encoding": [
"gzip, deflate, br"
],
"Accept-Language": [
"de,en-US;q=0.7,en;q=0.3"
],
"Cookie": [
"authentik_proxy_gfvSwvlc=NOAYN35RR7HRBMPU77UCP5XYHNITL5ZYMCA3XMY4IHKNMZHOK5NU6YQBIWWBENXOFFMT25GV5C6Z7JZHBYV6ZLDDWZ3XJJK6MRS4YOA"
],
"Dnt": [
"1"
],
"Sec-Fetch-Dest": [
"document"
],
"Sec-Fetch-Mode": [
"navigate"
],
"Sec-Fetch-Site": [
"none"
],
"Sec-Fetch-User": [
"?1"
],
"Te": [
"trailers"
],
"Upgrade-Insecure-Requests": [
"1"
],
"User-Agent": [
"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0"
],
"X-Authentik-Email": [
"@p.de"
],
"X-Authentik-Groups": [
"authentik Admins"
],
"X-Authentik-Jwt": [
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2F1dGgubG9jYWxhcmVhLnNwYWNlL2FwcGxpY2F0aW9uL28vaG9tZWNoYXJ0LyIsInN1YiI6IjIyZDQ4MzUzYmMwMmJjYTg4ZTMwOGIyOTQxZjhmYTdmZDMwZDY5NmQwMmFmYWRkNTg0MDdlZDI4NjE3Y2I3MmEiLCJhdWQiOiJnZnZTd3ZsY1FuTEVMb2lGSlBONVpEVFBjT0U4Z3h3OGtpaFNvZldQIiwiZXhwIjoxNzEyODU1NDkyLCJpYXQiOjE3MTI3NjkwOTIsImF1dGhfdGltZSI6MTcxMjc2OTA4OCwiYWNyIjoiZ29hdXRoZW50aWsuaW8vcHJvdmlkZXJzL29hdXRoMi9kZWZhdWx0Iiwic2lkIjoiZTJmMDI3NTFlM2NmOTE0MmFiMmNhMzljYzdmMzczZjU0ZTYwMGExYWIzM2UyMDJiYWQxNWJjYjVlMDM5NDZjMCIsImFrX3Byb3h5Ijp7InVzZXJfYXR0cmlidXRlcyI6eyJzZXR0aW5ncyI6eyJsb2NhbGUiOiIifX0sImlzX3N1cGVydXNlciI6dHJ1ZX0sImVtYWlsIjoia2F1ZGV2QHBvc3Rlby5kZSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJuYW1lIjoiQWxleCIsImdpdmVuX25hbWUiOiJBbGV4IiwicHJlZmVycmVkX3VzZXJuYW1lIjoiYWthZG1pbiIsIm5pY2tuYW1lIjoiYWthZG1pbiIsImdyb3VwcyI6WyJhdXRoZW50aWsgQWRtaW5zIl0sImF6cCI6ImdmdlN3dmxjUW5MRUxvaUZKUE41WkRUUGNPRThneHc4a2loU29mV1AiLCJ1aWQiOiJiY2FIbW9UWVpIZWJFM2FhSENJOHNJVWpWekp5YjFGU1d2ZlpVSmxDIn0.4UyYi6O53C51gJ9Na8O6xTW42GpOuxXE3WkPU92RTeU"
],
"X-Authentik-Meta-App": [
"homechart"
],
"X-Authentik-Meta-Jwks": [
"https://auth.TLD/application/o/homechart/jwks/"
],
"X-Authentik-Meta-Outpost": [
"authentik Embedded Outpost"
],
"X-Authentik-Meta-Provider": [
"Provider for Homechart"
],
"X-Authentik-Meta-Version": [
"goauthentik.io/outpost/2024.2.2"
],
"X-Authentik-Name": [
"Kau"
],
"X-Authentik-Uid": [
"22d48353bc02bca88e308b2941f8fa7fd30d696d02afadd58407ed28617cb72a"
],
"X-Authentik-Username": [
"testuser"
],
"X-Forwarded-For": [
"192.168.2.40"
],
"X-Forwarded-Host": [
"homechart.TLD"
],
"X-Forwarded-Port": [
"443"
],
"X-Forwarded-Proto": [
"https"
],
"X-Forwarded-Server": [
"cac2684b7676"
],
"X-Real-Ip": [
"192.168.2.40"
]
},
"remoteAddr": "172.23.0.3:58318"
}

[thequailman]

Looks like setting HOMECHART_app_proxyAddress=172.23.0.3 should be the right value. I'm not sure why this isn't working to be honest. I'll try setting something like this up later this week.

[thequailman]

Try pulling down the latest container and trying again.

[EpicKau]

works like a charm! THANKS.
What was the problem?

[thequailman]

Looks like last release "fixed" an error that happened every signin. The error response was actually OK, it's what triggers the SSO sequence with tools like Authelia/Authentik. Sorry about the runaround!