authentik config

[Vylooo]

When I click advanced and place a configuration for authentik, it puts the proxy host offline.

I am unable to get this to work

[Zoey2936]

interesting

[Zoey2936]

what are you pasting there exactly? what do the logs show? etc.?

[Vylooo]

# Increase buffer size for large headers
# This is needed only if you get 'upstream sent too big header while reading response
# header from upstream' error when trying to access an application protected by goauthentik
proxy_buffers 8 16k;
proxy_buffer_size 32k;
port_in_redirect off;

location / {
    # Put your proxy_pass to your application here
    proxy_pass          $forward_scheme://$server:$port;

    # authentik-specific config
    auth_request        /outpost.goauthentik.io/auth/nginx;
    error_page          401 = @goauthentik_proxy_signin;
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;

    # translate headers from the outposts back to the actual upstream
    auth_request_set $authentik_username $upstream_http_x_authentik_username;
    auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
    auth_request_set $authentik_email $upstream_http_x_authentik_email;
    auth_request_set $authentik_name $upstream_http_x_authentik_name;
    auth_request_set $authentik_uid $upstream_http_x_authentik_uid;

    proxy_set_header X-authentik-username $authentik_username;
    proxy_set_header X-authentik-groups $authentik_groups;
    proxy_set_header X-authentik-email $authentik_email;
    proxy_set_header X-authentik-name $authentik_name;
    proxy_set_header X-authentik-uid $authentik_uid;
}

# all requests to /outpost.goauthentik.io must be accessible without authentication
location /outpost.goauthentik.io {
    proxy_pass          https://10.0.3.241:9443/outpost.goauthentik.io;
    # ensure the host of this vserver matches your external URL you've configured
    # in authentik
    proxy_set_header    Host $host;
    proxy_set_header    X-Original-URL $scheme://$http_host$request_uri;
    add_header          Set-Cookie $auth_cookie;
    auth_request_set    $auth_cookie $upstream_http_set_cookie;

    # required for POST requests to work
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
}

# Special location for when the /auth endpoint returns a 401,
# redirect to the /start URL which initiates SSO
location @goauthentik_proxy_signin {
    internal;
    add_header Set-Cookie $auth_cookie;
    return 302 /outpost.goauthentik.io/start?rd=$request_uri;
    # For domain level, use the below error_page to redirect to your authentik server with the full redirect path
    # return 302 https://authentik.company/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
}

Using on Unraid, not sure where the logs are stored.

[davbay1]

Hi! I really appreciate all your hard work. Your comment from above got most of my hosts working. However, I am still running into 2 that are not working and giving me a 500 error. When I try without the advanced config they work fine.

Edit: In case someone needs to see this. It turned out to be user error. Looks like the Authentik worker crashed and wouldn't add new hosts and those 2 hosts were new. I didn't notice it until now, I just restarted it and immediately everything worked.

[davbay1]

So I got all the proxies to work, however I am still having an issue but it's with WebSockets. It doesn't seem to be passing through websocket. Any thoughts on what could be changed in the Authentik config? WSS works fine when not passing through Authentik.

I appreciate any help!

[Zoey2936]

it should work, since:

    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;

is included

[davbay1]

Yeah, based on everything I read, it seems like it should.

The only thing that comes to mind is in Authentik's latest NPM config they added these two changes for WSS. However, whenever I add 1 or both of these changes, the proxy goes offline.

1: This was added to the very top of the config file.

map $http_upgrade $connection_upgrade_keepalive {
default upgrade;
'' '';
}

2: This was a modification to the proxy_set_header portion. Looks like they added a "Keepalive" to the end of the line.

proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade_keepalive;

[Zoey2936]

They just renamed the variable, which makes no sense

[d4rkw1n9]

Hey there

After having things successfully set up last week, it seems some forwarding to Authentik is broken.

This is the advanced config I am using, as per the respective, solved issue #726.

Flow goes like this:

NPMPlus > Authentik > Synology Photos, with the respective regex exceptions for the authentication path in Authentik, in order to bypass authentication on mobile apps. This has worked perfectly fine last week.

But now when trying to log in on the mobile app, I get Error number -2, which probably is not a Synology error code. Instead, it shows up in the NPMPlus logs like this:

Does anyone have an idea what could cause this? Maybe with regards to changes in the recent update?

Deleting the advanced config makes the login work flawlessly, but then ofc without the additional security layer from Authentik.

Thanks in advance.

Best

[Zoey2936]

can you please format the config?

[d4rkw1n9]

can you please format the config?

Yea sorry, I just linked the original, formatted answer, as I am on mobile. It is the exact config I used.

[d4rkw1n9]

This Discussion thread seems to enjoy much popularity :D Probably because nobody sees it.

Still no ideas around? Hmmm..

[Zoey2936]

The -2 error means if I remember correctly, that the file does not exist, but I don't see any breaking errors in the log

[d4rkw1n9]

The -2 error means if I remember correctly, that the file does not exist, but I don't see any breaking errors in the log

Thanks for the feedback. I am out of ideas and suspect that something got messed after enforcing 2FA on Synology side. Yes, when bypassing Authentik completely, it works. But when enabling it, it hangs at the very last step (after entering TOTP of Synology account). So, basically Authentik authentication works, but then somehow after entering Synology TOTP, it is stuck... Very strange.

[d4rkw1n9]

Latest news from my side:

Everything works perfectly fine, if NPMPlus is configured to just forward the request to authentik (i.e. with no custom config) and let authentik handle the proxy stuff. it is quite overkill to use two reverse proxies in the chain, but in order to have the WAF benefits, NPMPlus is still needed.

It's a pity that something seems to be incomplete with the custom config. But still, thanks for this project :)

[saitoh183]

@Zoey2936 I used your answer however i have basic auth configured in Authentik to get auto login with sonarr,radarr and other ARRs and it doesnt pass. i get stopped at login.

[Zoey2936]

But basic auth shows up?

[saitoh183]

yes

[saitoh183]

authentik should pass creds to basic auth and sonarr should go straight in

[Zoey2936]

please try:

port_in_redirect off;
location / {
    include conf.d/include/always.conf;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    include conf.d/include/proxy.conf;

    auth_request /outpost.goauthentik.io/auth/nginx;
    error_page 401 = @goauthentik_proxy_signin;
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    more_set_headers 'Set-Cookie: $auth_cookie';
    auth_request_set $authentik_username $upstream_http_x_authentik_username;
    auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
    auth_request_set $authentik_email $upstream_http_x_authentik_email;
    auth_request_set $authentik_name $upstream_http_x_authentik_name;
    auth_request_set $authentik_uid $upstream_http_x_authentik_uid;
    proxy_set_header X-authentik-username $authentik_username;
    proxy_set_header X-authentik-groups $authentik_groups;
    proxy_set_header X-authentik-email $authentik_email;
    proxy_set_header X-authentik-name $authentik_name;
    proxy_set_header X-authentik-uid $authentik_uid;
    
    # This section should be uncommented when the "Send HTTP Basic authentication" option is enabled in the proxy provider
    #auth_request_set $authentik_auth $upstream_http_authorization;
    #proxy_set_header Authorization $authentik_auth;
}

location /outpost.goauthentik.io {
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    include conf.d/include/proxy-location.conf;
    proxy_pass https://<ip>:9443/outpost.goauthentik.io; # ensure the host of this vserver matches your external URL you've configured in authentik

    proxy_set_header X-Original-URL $scheme://$host$request_uri;
    more_set_headers 'Set-Cookie: $auth_cookie';
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
}

location @goauthentik_proxy_signin {
    internal;
    more_set_headers 'Set-Cookie: $auth_cookie';
    return 302 /outpost.goauthentik.io/start?rd=$request_uri;
}

[saitoh183]

@Zoey2936 Yup that seems to work! thanks! What did you change?

[Zoey2936]

I've added:
auth_request_set $authentik_auth $upstream_http_authorization;
proxy_set_header Authorization $authentik_auth;

[d4rkw1n9]

I've added:
auth_request_set $authentik_auth $upstream_http_authorization;
proxy_set_header Authorization $authentik_auth;

Do you think that works as well for other apps, like immich docker container? Asking, because many (most of the ones I use), don't properly work with the advanced config posted weeks/months ago. Authentik layer works, but then at the original login page, it is stuck. Same behaviour on Synology login page.

I will need to test this adapted version, maybe it fixes the problem I just described.

[Zoey2936]

sorry, no Idea

[pr0927]

This is curious. I was trying to get the proxy authentication to work with Navidrome. Anything I did made the site inaccessible. I saw a lot of threads on the NPM and Authentik Githubs complaining about this with people unable to resolve (for a number of apps). I wonder if there is something funky in the NPM upstream that maybe got fixed here?

This is all speculation - I'm hardly an expert at configuring reverse proxies or SSO stuff, and certainly no coder.

[pr0927]

OK I can get it working with the configuration you provided, but it doesn't pass-through the credentials - takes me to the login page for the app itself after Authentik (in this case, Navidrome).

Not sure if there is a way to pass that through, but I suspect that's on the Authentik side and not on the NPMplus side anyway?

Of note, I did some experimenting, and adding the following section (provided by Authentik in the section where it tells you to add to the advanced tab for various reverse proxies and generates language), does not work:

# Upgrade WebSocket if requested, otherwise use keepalive
map $http_upgrade $connection_upgrade_keepalive {
    default upgrade;
    ''      '';
}

# Increase buffer size for large headers
# This is needed only if you get 'upstream sent too big header while reading response
# header from upstream' error when trying to access an application protected by goauthentik
proxy_buffers 8 16k;
proxy_buffer_size 32k;

When I exclude that section, it works.

Also, I noticed that you said you added the following:

auth_request_set $authentik_auth $upstream_http_authorization;
proxy_set_header Authorization $authentik_auth;

But in the code sample you gave to try (#726 (reply in thread)) - those lines are commented out. So did you just remove the same section I mentioned was causing it to not work (the part mentioning proxy buffers)?

[Zoey2936]

map connection_upgrade and proxy buffer is handeld by NPMplus and crashes if you try to overrite it

[Zoey2936]

Thoose lines I mentioned are commented in my example because they are only needed if the case written in the comment above the commented lines apply

[d4rkw1n9]

@pr0927 ...so, you finally got it working? If yes, what was the config used? (:

[pr0927]

Thoose lines I mentioned are commented in my example because they are only needed if the case written in the comment above the commented lines apply

Oh, OK, I see - and presumably I wouldn't be doing HTTP authentication here...I think.

@pr0927 ...so, you finally got it working? If yes, what was the config used? (:

I only got it working to the point of having Authentik before Navidrome, then still having the Navidrome login screen. I created a discussion here on their Github:

navidrome/navidrome#3352