Authelia: Automatic Redirection Not Working After Login on Traefik2

[benyanke]

_This is a followup on issue #1332_

As mentioned in the above issue, post-login redirection is not working properly after login.

Full docker-compose proof of concept attached. Also running at app1.authelia-1322.yanke.io (please check this soon though, as I have it on a dedicated VPS I'd like to clean up shortly).

proof-of-concept.tar.gz

Note that after logging in with example/password, you are redirected to $authelia/authenticated, instead of back to the app.

[nightah]

Thanks for providing this @benyanke.

Could you try changing line 69 of your docker-compose.yaml as follows and test again please?

From: - 'traefik.http.middlewares.auth.forwardauth.address=https://login.authelia-1322.yanke.io/api/verify?rd=https://login.authelia-1322.yanke.io/'

To: - 'traefik.http.middlewares.auth.forwardauth.address=http://authelia:9091/api/verify?rd=https://login.authelia-1322.yanke.io/'

[benyanke]

Sure, I can try later today.

Is it a requirement to use the internal network? I was hoping to be able to use this across clusters where the other consumers wouldn't have internal docker level access like that.

[benyanke]

That config change resolved it (try the app above to confirm). As in the comment above, is there any workaround for using the out-of-docker networking for these checks, while still supporting this redirect?

[nightah]

You would need to expose Authelia at the host level instead of using in docker networks and point your forwardauth to said IP address or internal dns hostname.

Traefik's forwardauth needs to speak directly to Authelia as opposed to a brokered termination through the reverse proxy (itself).

[benyanke]

Hm, interesting. Do you have any more details on why that is?

Other than manually specifying the header, is there any known workarounds?

[nightah]

I'm speaking purely from experience here.

I haven't personally tried your use case where a separate instance of Traefik or another reverse proxy is utilising a reverse proxied instance of Authelia as the forward auth source, presumably this SHOULD work.
The specific instance where I saw this was an issue was if it was the same instance of Traefik self-terminating.

I'd suggest you try your use case and see if it works, it might actually work.

[benyanke]

Ok. Fair enough. As I dive in further with this, I may revisit this issue with more questions, or open more specific issues. In any case, thanks for the brainstorming and answering questions.