8

I'm using traefik as a reverse proxy. I want to set OAuth2 authentication for a entry point. In the document, I found the Forward Authentication which I think may be useful for this. But the document is just too simple

This configuration will first forward the request to http://authserver.com/auth.

If the response code is 2XX, access is granted and the original request is performed. Otherwise, the response from the authentication server is returned.

I've no idea how can I achieve authentication OAuth2 within a forwarding? I've tried oauth2_proxy but didn't find a solution.
In this issue/comment guybrush provided a solution. But that, in fact, was a double reverse proxys.

Community
  • 1
  • 1
kehao
  • 496
  • 2
  • 5
  • 13

2 Answers2

15

I've recently built an app for this: https://github.com/thomseddon/traefik-forward-auth

It uses Forward Authentication, as you mentioned, and uses Google OAuth to authenticate users.

There's an example Docker Compose setup here: https://github.com/thomseddon/traefik-forward-auth/blob/master/examples/docker-compose.yml. See the traefik.toml file to see how Traefik is configured to point at the app.

Let me know if it is helpful!

ultrafez
  • 543
  • 6
  • 19
Thom Seddon
  • 1,485
  • 2
  • 15
  • 25
4

Instead of trying to make Traefik support your case, let Traefik do what it does best and instead use Keycloak Gatekeeper for authentication (and potentially authorization).

This would change your setup from 

Client -- Traefik -- Service

to 

Client -- Traefik -- Gatekeeper -- Service

This means that both Traefik and Gatekeeper act as reverse proxy.

It's incredibly simple to model complex auth setups with this approach. One potential drawback is however the additional RP layer, so for high performance setups this may not be an ideal solution.

Note that Gatekeeper can work with any OIDC compatible IdP, so you don't have to run Keycloak to use it.

theDmi
  • 17,546
  • 6
  • 71
  • 138
  • 7
    This sounds like a great idea, but where is the documentation? Examples? How does this work with multiple services? – ricochet1k Apr 12 '19 at 13:38
  • 1
    Hi @ricochet1k, did you find any good documentation for above. I tried it but stuck with error: "no session found in request, redirecting for authorization","error":"authentication session not found"" – NumeroUno Mar 28 '20 at 12:10
  • 1
    Just a heads-up: "Keycloak Gatekeeper has moved to the [Louketo Proxy](https://github.com/louketo/louketo-proxy) project." - the image on docker hub is severely outdated, they moved to quay.io. – petrtvaruzek Aug 09 '20 at 15:53