search

thomseddon / traefik-forward-auth

Minimal forward authentication service that provides Google/OpenID oauth based login and authentication for the traefik reverse proxy
MIT License
2.08k stars 398 forks source link

Option to ignore SSL verification for self sign certificate #122

Open shabbirdbz opened 4 years ago

shabbirdbz commented 4 years ago

Feature Request We are running our own OpenID Connect Identity (OIDC) provider dex in our Kubernetes infrastructure. https://github.com/dexidp/dex We route request via Traefik to dex on HTTPS with self-sign certificates.

We use configure traefik-forward-auth for dex with following options

When traefik-forward-auth containers startup, it requests the oidc configuration from https://auth.playground.com/.well-known/openid-configuration

auth.playground.com is set in traefik to route this request to dex.

But, since we used self-signed certificate in traefik, it throws up this error

time="2020-05-11T05:49:49Z" level=fatal msg="Get https://auth.playground.com/.well-known/openid-configuration: x509: certificate is valid for aad6d50dae9d2b29da37bee964e22b33.cfe67ff81ffcf5b893f3519667cd9b6e.traefik.default, not auth.playground.com"

This is again the case when we use a staging environment for Letsencrypt.

Could you please add an option to ignore SSL verification, something like providers.oidc.InsecureSkipVerify or it could be the global option InsecureSkipVerify

SuperSandro2000 commented 4 years ago

or even better add an option to import the CA Bundle that includes your self signed certificates so that not anything is accepted.

thomseddon commented 4 years ago

Yeah this makes sense, we also have #86 open with a view to add custom certs, but an option such as this probably makes sense too

dicksnel commented 3 years ago

An InsecureSkipVerify option would be great for local testing with self-signed certs.

zingmane commented 3 years ago

Is there a workaround for this. I'm trying to set up an example forward auth with a local keycloak instance and self signed certs but I can not get it working

zingmane commented 3 years ago

Found it out by myself. Of course mounting my cert into the container does the trick:

volumes:
  - ../path-to-certs/certs:/etc/ssl/certs:ro
FStefanni commented 3 years ago

Hi,

I am also interested to an "insecureSkipVerify" option. I am using k8s:

I believe that a way to import custom trusted certs bundles (as proposed by some prev comment) could be useful, but does not replace the need of a "insecureSkipVerify" option (e.g.: the traefik auto-generated default cert is not part of a bundle).

Regards

highkay commented 3 years ago

This feature is useful in a intranet when you have not got a valid ca of the idp(keycloak).

sunweiai commented 2 years ago

Found it out by myself. Of course mounting my cert into the container does the trick:

volumes:
  - ../path-to-certs/certs:/etc/ssl/certs:ro

this volumes does not solve my prombles,add the InsecureSkipVerify option also have this error

ToshY commented 1 year ago

I think it's safe to say this isn't going to happen any time soon. Off to oauth2-proxy.

FStefanni commented 1 year ago

Hi,

almost all tools/libs have some options to skip certs verification, so I do not understand why this feature is taking so long: is it not important according to traefik dev team? It could be nice to know their opinion.

Maybe is there someone able/willing to propose a pr?

Regards

monsdar commented 5 months ago

so I do not understand why this feature is taking so long

Be the change you want, this is open source after all.

is it not important according to traefik dev team?

This repo is not part of traefik nor is it maintained by the traefik dev team.