Authelia: Always being redirected to default_redirection_url

[JulienSambre]

Hi,

I have the exact same problem that #1291 , with very similar haproxy configuration. The user has closed his issue, don't know why, but after several hours I don't know what is going on.

I have made other tests : without the param default_redirection_url set in config file, I have a red message "There was an issue fetching the current user state", due to a 404 error when the JS query Original-URL/api/state, which obviously don't have such path.

I have ckecked headers, I have the Refer header is there, with a good value.

Finally, if I refresh the page with a good old F5, I access my protected final backend without any problem, because I have the right Authelia cookie afterall.

The only problematic part is the redirect part.

Any idea?

[nightah]

Based on the error @JulienSambre sounds to me like you may be setting an incorrect header or something in haproxy.

Can you please share your full haproxy configuration and we can assess.

[ntimo]

Hello,
below is are parts of my HAProxy config. Using the redirect that is configured now it works flawless. But when I replace the redirect line with this I am always getting redirected to the default domain
use_backend authelia.example.com if protected-frontends !{ var(txn.auth_response_successful) -m bool }
config:

global
  lua-load /usr/local/share/lua/5.3/haproxy-lua-http.lua
  lua-load /usr/local/share/lua/5.3/auth-request.lua

frontend           graylog.example.com
  mode             http
  bind             10.50.0.2:80 transparent alpn h2,http/1.1
  bind             10.50.0.2:443 transparent ssl crt-list /etc/haproxy/certs.crt_list alpn h2,http/1.1
  option                    http-keep-alive
#  option                    forwardfor
  acl https ssl_fc
  http-request set-var(req.scheme) str(https) if { ssl_fc }
  http-request set-var(req.scheme) str(http) if !{ ssl_fc }
  http-request set-var(req.questionmark) str(?) if { query -m found }
  http-request set-header X-Real-IP %[src]
  http-request set-header X-Forwarded-For %[src]
  http-request set-header X-Forwarded-Proto %[var(req.scheme)]
  http-request set-header X-Forwarded-Host %[req.hdr(Host)]
  http-request add-header X-Forwarded-Port %[dst_port]
  http-request set-header X-Forwarded-Uri %[path]%[var(req.questionmark)]%[query]
  # Ensure SSO headers can't be set from external
  http-request del-header Remote-User
  http-request del-header Remote-Groups
  acl graylog.example.com hdr(host) -i graylog.example.com
  acl graylog.example.com_443 hdr(host) -i graylog.example.com:443
  acl graylog.example.com_80 hdr(host) -i graylog.example.com:80
  acl protected-frontends hdr(host) -m reg -i ^(.*)\.example\.com
  http-request lua.auth-request authelia.example.com /api/verify if protected-frontends
  http-request redirect location https://authelia.example.com/?rd=%[var(req.scheme)]://%[base] if protected-frontends !{ var(txn.auth_response_successful) -m bool }
  redirect scheme https code 301 if !{ ssl_fc }
  use_backend graylog.example.com if graylog.example.com
  use_backend graylog.example.com if graylog.example.com_443
  use_backend graylog.example.com if graylog.example.com_80

Thanks for you help.

[nightah]

@ntimo in your case based on the snippet and the configuration you have provided this will cause issues because your auth portal also fits in the acl for protected-frontends because of the regex ^(.*)\.example\.com.

Only protected frontends should be part of that regex, excluding the Authelia portal itself, per step 1 in the configuration docs.

[JulienSambre]

Hi!

@ntimo Hey! Thank you very much for your example, I tried several config, the last one was :

http-request redirect code 301 location %[var(req.scheme)]://%[base]?rd=%[var(req.scheme)]://%[base] if protected-frontends !{ var(txn.auth_response_successful) -m bool } { path / } !{ query -m found }
use_backend authelia if protected-frontends !{ var(txn.auth_response_successful) -m bool }

It was working, but was having some flaws (when token timeout for example).

Your redirect is much better than mine and now all problems are gone :). I was trying to not have a domain redirect for my users not realizing the magic behind. But I prefer a working solution than a clunky one :).

Thanks again!

@nightah Hi! I find out that the example in the doc here was not working (https://www.authelia.com/docs/deployment/supported-proxies/haproxy.html)

I found out that was because of :

• After being authenticated by authelia, the JS f authelia make several request but the use_backend authelia if protected-frontends !{ var(txn.auth_response_successful) -m bool } redirect the http call (to /state) to the real protected site which cause 404 error because the protected site has obviously not /state resource
• The purpose of the haproxy config seems to keep the domain name of the protected web site and do not redirect to the authelia URL/domain name. But the haproxy config does not work as is
• I have disabled default redirect URL in Authelia config
• As for the nginx config, authelia + haproxy need ?rd=[Protected_site_URL] when calling authelia backend in order to make the proper redirect after successful auth phase

With a config very similar to @nightah I succeed to make things work.

I have other questions, but I will create other issues for that :).

[ntimo]

@ntimo in your case based on the snippet and the configuration you have provided this will cause issues because your auth portal also fits in the acl for protected-frontends because of the regex ^(.*)\.example\.com.

Only protected frontends should be part of that regex, excluding the Authelia portal itself, per step 1 in the configuration docs.

I just changed my config to use this kind of regex (graylog)\.example\.com but the result stays the same. I am still redirected to the default site after authenticating.

[nightah]

Thanks for your feedback @ntimo I just went back and manually tested the HAProxy configuration and like both of you I seem to have run into the same issue.

Seems our integration tests still work but that could be completely unrelated, I'll update the examples to include the redirection parameter for now and look to see why it's not constructing this from the X-Forwarded-* headers too.

[nightah]

Also it's worth mentioning that you need to slightly modify your redirect to ensure that the path/URI is also picked up, it should look something like this:

http-request redirect location https://authelia.example.com/?rd=%[var(req.scheme)]://%[base]%[var(req.questionmark)]%[query] if protected-frontends !{ var(txn.auth_response_successful) -m bool }

[ntimo]

@nightah Thanks, I had the query parameter not included in my config by choice :) Thanks a lot, I am looking forward to a fix for this issue. Because I think that not having the redirect would be the most elegant solution.

[sorano]

Thanks alot for the workaround @nightah

@ntimo I'm using this regexp to match everything except authelia in acl protected-frontends

hdr(host) -m reg -i ^(?!auth.example.com)

[nightah]

I am looking forward to a fix for this issue. Because I think that not having the redirect would be the most elegant solution.

The redirect is required and is achieved in the implementations in varying different ways.
Right now this example matches the nginx implementation, I tried playing around a little bit to get this working like the Traefik implementation (constructing the ?rd= parameter on the fly) but I ran into issue with HAProxy and redirects.

I don't know HAProxy all that well so if any of you are up to it here's what needs to change in the example for Authelia construct the redirection URL and redirect accordingly:

http-request lua.auth-request be_auth_request /api/verify?rd=https%3A//login.example.com:8080 if protected-frontends

Where login.example.com:8080 is replaced with your external hostname for your Authelia portal.

The issue I had with the above configuration was that HAProxy's redirect seemed to ignore the 302 that Authelia attempts to issue with the properly constructed URL.