Can't make simple app authentication working behinf NGINX

[EHRETic]

Hi there,

I need some help trying to protect a simple app with Authentik.
I can't get my head around the outpost, external host and requisites to protect the app.

Authentik is already working fine with a few apps that I host in my home lab. All use OIDC.

Some important information in my environement

• I use auth.mydomain.com for authentik
• I use myapp.domain.com for the app
• All my containers have fixed IPs in a dedicated macvlan subnet
• NGINX can access this dedicated VLAN

I just can't figure out what should be configured and where, those are my main questions/issues:

• So far, I understood I need an Outpost, but should this outpost also be available outside on domain.com ?
• I did try to create a dedicated outpost on this macvlan network. It worked, but I don't know how to assign a fixed IP on it like I would do in a docker compose file.
• The NGINX server, here I really don't know what to modify ot configure it properly. I'm completely lost between my app container IP, the outpost IP, the external host, etc...

Precisely:

• what to in main proxy_pass, the outpost or the app?
• what to put in proxy_pass in /outpost.goauthentik.io ? An external domain or internal IP?
• what to put in outpost advanced settings?

# Upgrade WebSocket if requested, otherwise use keepalive
map $http_upgrade $connection_upgrade_keepalive {
    default upgrade;
    ''      '';
}

server {
    # SSL and VHost configuration
    listen                  443 ssl http2;
    server_name             _;

    ssl_certificate         /etc/ssl/certs/ssl-cert-snakeoil.pem;
    ssl_certificate_key     /etc/ssl/private/ssl-cert-snakeoil.key;

    # Increase buffer size for large headers
    # This is needed only if you get 'upstream sent too big header while reading response
    # header from upstream' error when trying to access an application protected by goauthentik
    proxy_buffers 8 16k;
    proxy_buffer_size 32k;

    location / {
        # Put your proxy_pass to your application here, and all the other statements you'll need
        # proxy_pass http://localhost:5000;
        # proxy_set_header Host $host;
        # proxy_set_header ...
        # Support for websocket
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade_keepalive;

        ##############################
        # authentik-specific config
        ##############################
        auth_request     /outpost.goauthentik.io/auth/nginx;
        error_page       401 = @goauthentik_proxy_signin;
        auth_request_set $auth_cookie $upstream_http_set_cookie;
        add_header       Set-Cookie $auth_cookie;

        # translate headers from the outposts back to the actual upstream
        auth_request_set $authentik_username $upstream_http_x_authentik_username;
        auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
        auth_request_set $authentik_email $upstream_http_x_authentik_email;
        auth_request_set $authentik_name $upstream_http_x_authentik_name;
        auth_request_set $authentik_uid $upstream_http_x_authentik_uid;

        proxy_set_header X-authentik-username $authentik_username;
        proxy_set_header X-authentik-groups $authentik_groups;
        proxy_set_header X-authentik-email $authentik_email;
        proxy_set_header X-authentik-name $authentik_name;
        proxy_set_header X-authentik-uid $authentik_uid;
    }

    # all requests to /outpost.goauthentik.io must be accessible without authentication
    location /outpost.goauthentik.io {
        proxy_pass              http://outpost.company:9000/outpost.goauthentik.io;
        # ensure the host of this vserver matches your external URL you've configured
        # in authentik
        proxy_set_header        Host $host;
        proxy_set_header        X-Original-URL $scheme://$http_host$request_uri;
        add_header              Set-Cookie $auth_cookie;
        auth_request_set        $auth_cookie $upstream_http_set_cookie;
        proxy_pass_request_body off;
        proxy_set_header        Content-Length "";
    }

    # Special location for when the /auth endpoint returns a 401,
    # redirect to the /start URL which initiates SSO
    location @goauthentik_proxy_signin {
        internal;
        add_header Set-Cookie $auth_cookie;
        return 302 /outpost.goauthentik.io/start?rd=$request_uri;
        # For domain level, use the below error_page to redirect to your authentik server with the full redirect path
        # return 302 https://authentik.company/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
    }
}

Well, thanks to anybody that could help me configuring this! 😉👌

[capdeveloping]

Hi @EHRETic,

you mean setup basic authentification with authentik?
If so you can watch this video: https://www.youtube.com/watch?v=OBJa2G3Ef7o
I saw this in another issue comments, it helped me a little bit.

Mine setup is authentik has its on docker network. My app is in another network and my nginx uses host network to reach all services. So the nginx needs to reach all services not the client asks for. Client just need access to nginx.

Also import at basic auth is the configuration inside authentik, the video will help to configure it. :)

For your nginx config this is mine which works:

server {
      listen 443 ssl;
  
      server_name app.company.com;
      ssl_certificate /etc/letsencrypt/live/app.company.com/fullchain.pem;
      ssl_certificate_key /etc/letsencrypt/live/app.company.com/privkey.pem;
  
      ssl_session_timeout 10m;
      ssl_session_cache builtin:1000  shared:SSL:10m;
      ssl_protocols TLSv1.2 TLSv1.3;
      ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
      ssl_prefer_server_ciphers off;
  
  
      ssl_session_tickets  off;
      ssl_stapling  on;
      ssl_stapling_verify  on;
  
      location / {
          proxy_pass http://127.0.0.1:7878;
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
  
          proxy_set_header Connection "upgrade";
          proxy_set_header Upgrade $http_upgrade;
          proxy_http_version 1.1;
  
          ##############################
          # authentik-specific config
          ##############################
          auth_request     /outpost.goauthentik.io/auth/nginx;
          error_page       401 = @goauthentik_proxy_signin;
          auth_request_set $auth_cookie $upstream_http_set_cookie;
          add_header       Set-Cookie $auth_cookie;
  
          # translate headers from the outposts back to the actual upstream
          auth_request_set $authentik_username $upstream_http_x_authentik_username;
          auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
          auth_request_set $authentik_email $upstream_http_x_authentik_email;
          auth_request_set $authentik_name $upstream_http_x_authentik_name;
          auth_request_set $authentik_uid $upstream_http_x_authentik_uid;
          auth_request_set $authentik_auth $upstream_http_authorization;
  
          proxy_set_header X-authentik-username $authentik_username;
          proxy_set_header X-authentik-groups $authentik_groups;
          proxy_set_header X-authentik-email $authentik_email;
          proxy_set_header X-authentik-name $authentik_name;
          proxy_set_header X-authentik-uid $authentik_uid;
          proxy_set_header Authorization $authentik_auth;
      }
  
      # all requests to /outpost.goauthentik.io must be accessible without authentication
      location /outpost.goauthentik.io {
          proxy_pass              https://127.0.0.1:9444/outpost.goauthentik.io;
          # ensure the host of this vserver matches your external URL you've configured
          # in authentik
          proxy_set_header        Host $host;
          proxy_set_header        X-Original-URL $scheme://$http_host$request_uri;
          add_header              Set-Cookie $auth_cookie;
          auth_request_set        $auth_cookie $upstream_http_set_cookie;
          proxy_pass_request_body off;
          proxy_set_header        Content-Length "";
      }
  
      # Special location for when the /auth endpoint returns a 401,
      # redirect to the /start URL which initiates SSO
      location @goauthentik_proxy_signin {
          internal;
          add_header Set-Cookie $auth_cookie;
          return 302 /outpost.goauthentik.io/start?rd=$request_uri;
      }
  }

Maybe this will help if you still need it. :)