Closed jasperroel closed 4 years ago
My compose file, in case that helps at all:
version: "3.6"
services:
grafana:
image: grafana/grafana
restart: on-failure
networks:
- traefik-proxy
labels:
traefik.enable: true
traefik.hostname: grafana
traefik.http.routers.grafana.middlewares: secured@file
traefik.http.routers.grafana.tls: true
traefik.http.routers.grafana.tls.certResolver: letsencrypt-digitalocean
traefik.http.routers.grafana.entrypoints: https
env_file: env
volumes:
- type: volume
source: grafana-storage
target: /var/lib/grafana
networks:
traefik-proxy:
external: true
volumes:
grafana-storage:
unfortunately its not possible right now to disable right now, but I could easily add a configuration option to disable adding the header. Right now the token is always added for the authenticated user.
Do you use version 2.0-rc1 of forwardauth?
Yes, using image: dniel/forwardauth:2.0-rc1
for the middleware.
An option would be great. Would that be per container or for everything (I'm okay with either - I don't use the header currently).
probably something per application I think.
or maybe, in your Traefik configuration for forwardauth authentication you have something like https://docs.traefik.io/middlewares/forwardauth/#authresponseheaders
Something like this for the File provider maybe, the authResponseHeaders
field is the headers that will be forwarded after authentication by Traefik. If you remove that Authorization from authResponseHeaders that header I think Traefik will ignore it.
http:
middlewares:
test-auth:
forwardAuth:
address: "https://example.com/auth"
authResponseHeaders:
- "Authorization"
Ah yeah, that already works indeed. I forgot about that part of the config!
So, I now have:
middlewares:
forward-auth:
forwardAuth:
address: http://traefik-forward-auth:8080/authorize
trustForwardHeader: true
authResponseHeaders:
# - authorization
- x-forwardauth-nickname
- x-forwardauth-family-name
- x-forwardauth-given-name
- x-forwardauth-name
- x-forwardauth-sub
- x-forwardauth-email
That works.
Thanks for that suggestion!
perfect, glad to hear. :+1: close this issue if you are satisfied with the solution.
I'm trying to run the Grafana container behind the new 2.0 middleware, but as soon as I enable that, Grafana throws the following error:
{"message":"Invalid API key"}
I assume that is because forward-auth adds the
Authorization
header going to Grafana.Grafana seems to interpret this as a way to authenticate against it with an API key, which fails (because the Header created with forward-auth has nothing to do with Grafana.
This seems to be similar to issues like this: https://github.com/containous/traefik/issues/6528
Is there a way to stop the forward-auth middleware from forwarding the Authorization header to the container?