I'm using TinyAuth for forwardauth but the service I'm trying to use consistently is saying the headers are not set (and I can verify, they're not there.)
Traefik: in static config
entryPoints:
web:
address: ':80'
transport:
respondingTimeouts:
readTimeout: 600s
idleTimeout: 600s
writeTimeout: 600s
http:
redirections:
entryPoint:
to: websecure
scheme: https
websecure:
address: ':443'
http:
tls:
certResolver: letsencrypt
domains:
- main: domain.tld
sans:
- '*.domain.tld'
forwardedHeaders:
trustedIPs:
- [TinyAuth IP]
in dynamic config:
tinyauth-auth:
forwardAuth:
address: "http://[TinyAuth IP]:3000/api/auth/traefik"
trustForwardHeader: true
authResponseHeaders:
- Remote-User
- Remote-Groups
- Remote-Name
- Remote-Email
This is set as a middleware in the app I'm trying to use.
in tinyauth:
TINYAUTH_APPURL=https://tinyapp.domain.tld/
TINYAUTH_AUTH_TRUSTEDPROXIES=[Traefik IP]
TINYAUTH_APPS_APP_CONFIG_DOMAIN='app.domain.tld'
TINYAUTH_APPS_APP_RESPONSE_HEADERS='Remote-User,Remote-Email,Remote-Group,Remote-Name,X-Remote-Name,X-Remote-User,X-Remote-Group,X-Remote-Email,Forwarded-Host,Forwarded-URI'
(I kept adding response headers hoping something would change)
PocketID is set as an OAuth provider and seems to be working fine, but I can provide further detail if needed.
Curiously, I tried changing the address in the traefik config to "https://tinyauth.domain.tld/" and the headers came through properly, but the redirect went to https://tinyauth.domain.tld/api/auth/traefik.
I think this is actually my issue but they never posted their solution.
If you point Traefik’s forwardAuth at the internal service (e.g. http://:3000/api/auth/traefik), TinyAuth doesn’t see the correct X-Forwarded-* headers or original host, so it won’t return the auth headers properly.
if you switch to using the public URL instead, the headers should start working — but only once using the full endpoint:
https://tinyauth.domain.tld/api/auth/traefik
Not just the root URL.
That way:
Also worth double-checking that your header names match exactly (e.g. Remote-Groups vs Remote-Group).
So in short: don’t call TinyAuth directly by IP, go through the domain + correct path.
So that's what I did in that bottom section--I should have been more clear, I used the full path and not just https://tinyauth.domain.tld/. The redirect was broken.
Additionally, when I was trying to figure this out, I came across this bug report, where the author specifically says not to do that.
I assume this is easy but I have no experience with forwardauth. Thanks so much for your help.
And good catch on that groups/group issue.