Pomerium: Forward auth redirect loop using pomerium 0.5.2 and nginx ingress 0.26.2

[sim1]

What happened?

Redirect loop upon accessing a pomerium forward-auth ingress host once logged in

What did you expect to happen?

Access the underlying service

How'd it happen?

1. Browse to the host
2. Log in
3. Redirect loop instead of accessing the underlying service
   

   What's your environment like?

• Pomerium version (retrieve with pomerium --version or /ping endpoint): 0.5.2
• Server Operating System/Architecture/Cloud: Kubernetes

Pomerium deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: pomerium
spec:
  replicas: 2
  template:
    spec:
      containers:
      - args:
        - -config
        - /etc/pomerium/config.yaml
        env:
        - name: FORWARD_AUTH_URL
          value: https://fwdauth.simone.sh/
        - name: ADMINISTRATORS
          value: [email protected]
        - name: SERVICES
          value: all
        - name: POMERIUM_DEBUG
          value: "true"
        - name: AUTHENTICATE_SERVICE_URL
          value: https://authenticate.simone.sh
        - name: IDP_PROVIDER
          value: google
        - name: INSECURE_SERVER
          value: "TRUE"
        - name: COOKIE_SECRET
          valueFrom:
            secretKeyRef:
              key: cookie-secret
              name: pomerium
        - name: SHARED_SECRET
          valueFrom:
            secretKeyRef:
              key: shared-secret
              name: pomerium
        - name: IDP_CLIENT_ID
          valueFrom:
            secretKeyRef:
              key: idp-client-id
              name: pomerium
        - name: IDP_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              key: idp-client-secret
              name: pomerium
        image: pomerium/pomerium:v0.5.2
        imagePullPolicy: Always
[...]

Ingress kubernetes resource

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: <service-name>
  annotations:
    nginx.ingress.kubernetes.io/auth-url: "https://fwdauth.simone.sh/verify?uri=$scheme://$host$request_uri"
    nginx.ingress.kubernetes.io/auth-signin: "https://fwdauth.simone.sh?uri=$scheme://$host$request_uri"
spec:
  tls:
    [...]
  rules:
    - host: <service-name>.simone.sh
      http:
        paths:
        [...]

What's your config.yaml?

```config.yaml
- from: https://.simone.sh
to: http://service.namespace:8080
allowed_users:
- [email protected]

## What did you see in the logs?

```logs
4:02PM ERR http-error error="401 Unauthorized: internal/sessions: session is not found: internal/sessions: session is not found" X-Forwarded-For=["10.0.0.1"] X-Forwarded-Host=["fwdauth.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Original-Method=["GET"] X-Original-Url=["https://<service-name>.simone.sh/"] X-Real-Ip=["10.0.0.1"] X-Sent-From=["nginx-ingress-controller"] http-code=401 http-message="internal/sessions: session is not found" ip=10.42.0.241 req_id=2fdb1892-6221-eb19-8cff-fc59334eaab7 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM DBG http-request X-Forwarded-For=["10.0.0.1"] X-Forwarded-Host=["fwdauth.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Original-Method=["GET"] X-Original-Url=["https://<service-name>.simone.sh/"] X-Real-Ip=["10.0.0.1"] X-Sent-From=["nginx-ingress-controller"] duration=0.71325 email= group= host=fwdauth.simone.sh ip=10.42.0.241 method=GET path=/verify?uri=https://<service-name>.simone.sh/ req_id=2fdb1892-6221-eb19-8cff-fc59334eaab7 service=all size=8131 status=401 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM DBG http-request X-Forwarded-For=["<redacted-ip>"] X-Forwarded-Host=["fwdauth.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Real-Ip=["<redacted-ip>"] duration=0.233952 email= group= host=fwdauth.simone.sh ip=10.42.0.241 method=GET path=/?uri=https://<service-name>.simone.sh/&rd=https://<service-name>.simone.sh%2F req_id=d6a80e1b-7451-a0d6-ead2-c464df1d8468 service=all size=359 status=302 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM DBG http-request X-Forwarded-For=["<redacted-ip>"] X-Forwarded-Host=["authenticate.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Real-Ip=["<redacted-ip>"] duration=0.872089 email= group= host=authenticate.simone.sh ip=10.42.0.241 method=GET path=/.pomerium/sign_in?pomerium_callback_uri=https%3A%2F%2F<service-name>.simone.sh%2F&pomerium_expiry=1577635642&pomerium_forward_auth=fwdauth.simone.sh&pomerium_issued=1577635342&pomerium_redirect_uri=https%3A%2F%2F<service-name>.simone.sh%2F&pomerium_signature=fiii2PWkoI1SQhg3bMg1gSiKlBSC3mEqvbn904bbnN4%3D req_id=7d28cc01-e59c-1310-88ab-f3dc61112b56 service=all size=1256 status=302 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM DBG http-request X-Forwarded-For=["10.0.0.1"] X-Forwarded-Host=["fwdauth.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Original-Method=["GET"] X-Original-Url=["https://<service-name>.simone.sh/?pomerium_expiry=1577635642\u0026pomerium_issued=1577635342\u0026pomerium_redirect_uri=https%3A%2F%2F<service-name>.simone.sh%2F\u0026pomerium_session_encrypted=<redacted>\u0026pomerium_signature=KFGAnxnLzcAEe3XmuRAc0oXBWHyB8-IMI_7Gsa1hAX8%3D"] X-Real-Ip=["10.0.0.1"] X-Sent-From=["nginx-ingress-controller"] duration=0.166975 email= group= host=fwdauth.simone.sh ip=10.42.0.241 method=GET path=/verify?uri=https://<service-name>.simone.sh/?pomerium_expiry=1577635642&pomerium_issued=1577635342&pomerium_redirect_uri=https%3A%2F%2F<service-name>.simone.sh%2F&pomerium_session_encrypted=<redacted> req_id=7864c065-0271-fd9a-ca47-ab2369f89d78 service=all size=0 status=401 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM DBG http-request X-Forwarded-For=["<redacted-ip>"] X-Forwarded-Host=["fwdauth.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Real-Ip=["<redacted-ip>"] duration=0.209346 email= group= host=fwdauth.simone.sh ip=10.42.0.241 method=GET path=/?uri=https://<service-name>.simone.sh/?pomerium_expiry=1577635642&pomerium_issued=1577635342&pomerium_redirect_uri=https%3A%2F%2F<service-name>.simone.sh%2F&pomerium_session_encrypted=<redacted>&rd=https://<service-name>.simone.sh%2F%3Fpomerium_expiry%3D1577635642%26pomerium_issued%3D1577635342%26pomerium_redirect_uri%3Dhttps%253A%252F%252F<service-name>.simone.sh%252F%26pomerium_session_encrypted=<redacted> req_id=6f270863-89c3-31ae-fa0f-32a8434d0a7e service=all size=0 status=302 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM ERR http-error error="401 Unauthorized: internal/sessions: session is not found: internal/sessions: session is not found" X-Forwarded-For=["10.0.0.1"] X-Forwarded-Host=["fwdauth.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Original-Method=["GET"] X-Original-Url=["https://<service-name>.simone.sh/"] X-Real-Ip=["10.0.0.1"] X-Sent-From=["nginx-ingress-controller"] http-code=401 http-message="internal/sessions: session is not found" ip=10.42.0.241 req_id=4a739dec-25e8-195b-2e06-91926b5180f8 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM DBG http-request X-Forwarded-For=["10.0.0.1"] X-Forwarded-Host=["fwdauth.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Original-Method=["GET"] X-Original-Url=["https://<service-name>.simone.sh/"] X-Real-Ip=["10.0.0.1"] X-Sent-From=["nginx-ingress-controller"] duration=0.605639 email= group= host=fwdauth.simone.sh ip=10.42.0.241 method=GET path=/verify?uri=https://<service-name>.simone.sh/ req_id=4a739dec-25e8-195b-2e06-91926b5180f8 service=all size=8131 status=401 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM DBG http-request X-Forwarded-For=["<redacted-ip>"] X-Forwarded-Host=["fwdauth.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Real-Ip=["<redacted-ip>"] duration=0.118434 email= group= host=fwdauth.simone.sh ip=10.42.0.241 method=GET path=/?uri=https://<service-name>.simone.sh/&rd=https://<service-name>.simone.sh%2F req_id=483e4b54-4b44-0d76-27f9-b65e6120615f service=all size=359 status=302 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM DBG http-request X-Forwarded-For=["<redacted-ip>"] X-Forwarded-Host=["authenticate.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Real-Ip=["<redacted-ip>"] duration=0.819192 email= group= host=authenticate.simone.sh ip=10.42.0.241 method=GET path=/.pomerium/sign_in?pomerium_callback_uri=https%3A%2F%2F<service-name>.simone.sh%2F&pomerium_expiry=1577635642&pomerium_forward_auth=fwdauth.simone.sh&pomerium_issued=1577635342&pomerium_redirect_uri=https%3A%2F%2F<service-name>.simone.sh%2F&pomerium_signature=fiii2PWkoI1SQhg3bMg1gSiKlBSC3mEqvbn904bbnN4%3D req_id=50b2ecf2-c4f8-c72a-b08c-337e354068c3 service=all size=1256 status=302 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM DBG http-request X-Forwarded-For=["10.0.0.1"] X-Forwarded-Host=["fwdauth.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Original-Method=["GET"] X-Original-Url=["https://<service-name>.simone.sh/?pomerium_expiry=1577635642\u0026pomerium_issued=1577635342\u0026pomerium_redirect_uri=https%3A%2F%2F<service-name>.simone.sh%2F\u0026pomerium_session_encrypted=<redacted>\u0026pomerium_signature=ahz4ts8THnfaS4zUb-gjMDK4p1Px0oJqX3_sNS3MWU0%3D"] X-Real-Ip=["10.0.0.1"] X-Sent-From=["nginx-ingress-controller"] duration=0.165711 email= group= host=fwdauth.simone.sh ip=10.42.0.241 method=GET path=/verify?uri=https://<service-name>.simone.sh/?pomerium_expiry=1577635642&pomerium_issued=1577635342&pomerium_redirect_uri=https%3A%2F%2F<service-name>.simone.sh%2F&pomerium_session_encrypted=<redacted>&pomerium_signature=ahz4ts8THnfaS4zUb-gjMDK4p1Px0oJqX3_sNS3MWU0%3D req_id=5780fbf0-7b22-296f-ae78-a94d72c5e79b service=all size=0 status=401 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM DBG http-request X-Forwarded-For=["<redacted-ip>"] X-Forwarded-Host=["fwdauth.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Real-Ip=["<redacted-ip>"] duration=0.384245 email= group= host=fwdauth.simone.sh ip=10.42.0.241 method=GET path=/?uri=https://<service-name>.simone.sh/?pomerium_expiry=1577635642&pomerium_issued=1577635342&pomerium_redirect_uri=https%3A%2F%2F<service-name>.simone.sh%2F&pomerium_session_encrypted=<redacted>&pomerium_signature=ahz4ts8THnfaS4zUb-gjMDK4p1Px0oJqX3_sNS3MWU0%3D&rd=https://<service-name>.simone.sh%2F%3Fpomerium_expiry%3D1577635642%26pomerium_issued%3D1577635342%26pomerium_redirect_uri%3Dhttps%253A%252F%252F<service-name>.simone.sh%252F%26pomerium_session_encrypted=<redacted> req_id=4e5705cb-4878-ba26-19d4-2b5bc6bba7b8 service=all size=0 status=302 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM ERR http-error error="401 Unauthorized: internal/sessions: session is not found: internal/sessions: session is not found" X-Forwarded-For=["10.0.0.1"] X-Forwarded-Host=["fwdauth.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Original-Method=["GET"] X-Original-Url=["https://<service-name>.simone.sh/"] X-Real-Ip=["10.0.0.1"] X-Sent-From=["nginx-ingress-controller"] http-code=401 http-message="internal/sessions: session is not found" ip=10.42.0.241 req_id=287789a0-d65c-236a-b230-81db3348fde9 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM DBG http-request X-Forwarded-For=["10.0.0.1"] X-Forwarded-Host=["fwdauth.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Original-Method=["GET"] X-Original-Url=["https://<service-name>.simone.sh/"] X-Real-Ip=["10.0.0.1"] X-Sent-From=["nginx-ingress-controller"] duration=0.621004 email= group= host=fwdauth.simone.sh ip=10.42.0.241 method=GET path=/verify?uri=https://<service-name>.simone.sh/ req_id=287789a0-d65c-236a-b230-81db3348fde9 service=all size=8131 status=401 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM DBG http-request X-Forwarded-For=["<redacted-ip>"] X-Forwarded-Host=["fwdauth.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Real-Ip=["<redacted-ip>"] duration=0.127457 email= group= host=fwdauth.simone.sh ip=10.42.0.241 method=GET path=/?uri=https://<service-name>.simone.sh/&rd=https://<service-name>.simone.sh%2F req_id=cf7971c5-a19f-8f8b-89e0-4cc6f912d24e service=all size=359 status=302 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM DBG http-request X-Forwarded-For=["<redacted-ip>"] X-Forwarded-Host=["authenticate.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Real-Ip=["<redacted-ip>"] duration=0.666208 email= group= host=authenticate.simone.sh ip=10.42.0.241 method=GET path=/.pomerium/sign_in?pomerium_callback_uri=https%3A%2F%2F<service-name>.simone.sh%2F&pomerium_expiry=1577635643&pomerium_forward_auth=fwdauth.simone.sh&pomerium_issued=1577635343&pomerium_redirect_uri=https%3A%2F%2F<service-name>.simone.sh%2F&pomerium_signature=Zl1pQIdwpeC6Y7gW2J7q9hn6OgwE8yYn3dD_hvQZpXc%3D req_id=603709dd-b26c-4364-cc2c-1837a225d8aa service=all size=1256 status=302 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM DBG http-request X-Forwarded-For=["10.0.0.1"] X-Forwarded-Host=["fwdauth.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Original-Method=["GET"] X-Original-Url=["https://<service-name>.simone.sh/?pomerium_expiry=1577635643\u0026pomerium_issued=1577635343\u0026pomerium_redirect_uri=https%3A%2F%2F<service-name>.simone.sh%2F\u0026pomerium_session_encrypted=<redacted>\u0026pomerium_signature=gb1NBKdwxEsDwkYmLvZpfg9B1PyaN8EhBMp0sTY1GeA%3D"] X-Real-Ip=["10.0.0.1"] X-Sent-From=["nginx-ingress-controller"] duration=0.17797 email= group= host=fwdauth.simone.sh ip=10.42.0.241 method=GET path=/verify?uri=https://<service-name>.simone.sh/?pomerium_expiry=1577635643&pomerium_issued=1577635343&pomerium_redirect_uri=https%3A%2F%2F<service-name>.simone.sh%2F&pomerium_session_encrypted=<redacted>&pomerium_signature=gb1NBKdwxEsDwkYmLvZpfg9B1PyaN8EhBMp0sTY1GeA%3D req_id=06b08349-a2fc-b9af-1309-8301e7248276 service=all size=0 status=401 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM DBG http-request X-Forwarded-For=["<redacted-ip>"] X-Forwarded-Host=["fwdauth.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Real-Ip=["<redacted-ip>"] duration=0.473187 email= group= host=fwdauth.simone.sh ip=10.42.0.241 method=GET path=/?uri=https://<service-name>.simone.sh/?pomerium_expiry=1577635643&pomerium_issued=1577635343&pomerium_redirect_uri=https%3A%2F%2F<service-name>.simone.sh%2F&pomerium_session_encrypted=<redacted>&pomerium_signature=gb1NBKdwxEsDwkYmLvZpfg9B1PyaN8EhBMp0sTY1GeA%3D&rd=https://<service-name>.simone.sh%2F%3Fpomerium_expiry%3D1577635643%26pomerium_issued%3D1577635343%26pomerium_redirect_uri%3Dhttps%253A%252F%252F<service-name>.simone.sh%252F%26pomerium_session_encrypted=<redacted> req_id=41922f2a-2279-f34f-06bd-c2ecf91f59b2 service=all size=0 status=302 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM ERR http-error error="401 Unauthorized: internal/sessions: session is not found: internal/sessions: session is not found" X-Forwarded-For=["10.0.0.1"] X-Forwarded-Host=["fwdauth.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Original-Method=["GET"] X-Original-Url=["https://<service-name>.simone.sh/"] X-Real-Ip=["10.0.0.1"] X-Sent-From=["nginx-ingress-controller"] http-code=401 http-message="internal/sessions: session is not found" ip=10.42.0.241 req_id=8f437894-63f8-a21e-1d85-d4388e6bddaf user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM DBG http-request X-Forwarded-For=["10.0.0.1"] X-Forwarded-Host=["fwdauth.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Original-Method=["GET"] X-Original-Url=["https://<service-name>.simone.sh/"] X-Real-Ip=["10.0.0.1"] X-Sent-From=["nginx-ingress-controller"] duration=0.714099 email= group= host=fwdauth.simone.sh ip=10.42.0.241 method=GET path=/verify?uri=https://<service-name>.simone.sh/ req_id=8f437894-63f8-a21e-1d85-d4388e6bddaf service=all size=8131 status=401 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM DBG http-request X-Forwarded-For=["<redacted-ip>"] X-Forwarded-Host=["fwdauth.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Real-Ip=["<redacted-ip>"] duration=0.316343 email= group= host=fwdauth.simone.sh ip=10.42.0.241 method=GET path=/?uri=https://<service-name>.simone.sh/&rd=https://<service-name>.simone.sh%2F req_id=6fb73168-3ddd-40a0-e531-9894cd08cfa5 service=all size=359 status=302 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM DBG http-request X-Forwarded-For=["<redacted-ip>"] X-Forwarded-Host=["authenticate.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Real-Ip=["<redacted-ip>"] duration=0.610147 email= group= host=authenticate.simone.sh ip=10.42.0.241 method=GET path=/.pomerium/sign_in?pomerium_callback_uri=https%3A%2F%2F<service-name>.simone.sh%2F&pomerium_expiry=1577635643&pomerium_forward_auth=fwdauth.simone.sh&pomerium_issued=1577635343&pomerium_redirect_uri=https%3A%2F%2F<service-name>.simone.sh%2F&pomerium_signature=Zl1pQIdwpeC6Y7gW2J7q9hn6OgwE8yYn3dD_hvQZpXc%3D req_id=f79f3a6c-9b3d-6a08-3ba0-ccde939e46f1 service=all size=1256 status=302 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM DBG http-request X-Forwarded-For=["10.0.0.1"] X-Forwarded-Host=["fwdauth.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Original-Method=["GET"] X-Original-Url=["https://<service-name>.simone.sh/?pomerium_expiry=1577635643\u0026pomerium_issued=1577635343\u0026pomerium_redirect_uri=https%3A%2F%2F<service-name>.simone.sh%2F\u0026pomerium_session_encrypted=<redacted>\u0026pomerium_signature=U96FKOU7-2bN465Qj8sh9vC7t_Vj2K8zFeoCIcx831o%3D"] X-Real-Ip=["10.0.0.1"] X-Sent-From=["nginx-ingress-controller"] duration=0.165149 email= group= host=fwdauth.simone.sh ip=10.42.0.241 method=GET path=/verify?uri=https://<service-name>.simone.sh/?pomerium_expiry=1577635643&pomerium_issued=1577635343&pomerium_redirect_uri=https%3A%2F%2F<service-name>.simone.sh%2F&pomerium_session_encrypted=<redacted>&pomerium_signature=U96FKOU7-2bN465Qj8sh9vC7t_Vj2K8zFeoCIcx831o%3D req_id=113e1665-420d-0504-fd1f-1ceb4054abfa service=all size=0 status=401 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
4:02PM DBG http-request X-Forwarded-For=["<redacted-ip>"] X-Forwarded-Host=["fwdauth.simone.sh"] X-Forwarded-Port=["443"] X-Forwarded-Proto=["https"] X-Real-Ip=["<redacted-ip>"] duration=0.272935 email= group= host=fwdauth.simone.sh ip=10.42.0.241 method=GET path=/?uri=https://<service-name>.simone.sh/?pomerium_expiry=1577635643&pomerium_issued=1577635343&pomerium_redirect_uri=https%3A%2F%2F<service-name>.simone.sh%2F&pomerium_session_encrypted=<redacted>&pomerium_signature=U96FKOU7-2bN465Qj8sh9vC7t_Vj2K8zFeoCIcx831o%3D&rd=https://<service-name>.simone.sh%2F%3Fpomerium_expiry%3D1577635643%26pomerium_issued%3D1577635343%26pomerium_redirect_uri%3Dhttps%253A%252F%252F<service-name>.simone.sh%252F%26pomerium_session_encrypted=<redacted> req_id=e7d24a59-de9d-4b9e-fbf1-fe6a4af5946f service=all size=0 status=302 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"

Additional context

Happens on master tag too.

[marcotuna]

Indeed I am facing the same problem with Traefik v2.1. I reverted to pomerium version v5.0 and the loop does not happen however I am facing another issue, maybe is not an issue at all, I am getting this output however is not redirecting to the final page.
Access to xx.domain.com is allowed.

[desimone]

For me, my issue was needing to pass forwarded headers. I'm unsure of why there was a regression, but this works with v0.5.2 and master for me. It's possible there was a change on the traefik side. Unsure if this is the issue on the nginx side however.

  traefik:
    image: traefik:v2.1
    command:
....
+      - "--entryPoints.websecure.forwardedHeaders.insecure"
...

@marcotuna let me know if that helps.

Here's a complete example: https://github.com/pomerium/examples/tree/master/traefik

[desimone]

@chauffer does enabling proxy-add-original-uri-header help?

Seems this has changed recently with https://github.com/kubernetes/ingress-nginx/pull/4604

[sim1]

@desimone changing that setting does not solve it

[marcotuna]

@desimone indeed, adding forwardedHeaders.insecure solves this problem on Traefik v2.1 (and probably the others versions too)

[travisgroth]

@chauffer - I'm pretty sure https://github.com/kubernetes/ingress-nginx/pull/4859 broke this in 0.26.2. 0.26.1 appears to work as expected.

I'm not sure if https://github.com/kubernetes/ingress-nginx/pull/4872 fixes our exact problem or not yet.

[sim1]

@travisgroth You are right, I can get it working by running nginx-ingress 0.26.1.

[desimone]

Great investigative work @travisgroth !

[travisgroth]

FWIW I was able to patch in the change from https://github.com/kubernetes/ingress-nginx/pull/4872 to my live config on 0.26.2 and it works.