authentik config

[Vylooo]

When I click advanced and place a configuration for authentik, it puts the proxy host offline.

I am unable to get this to work

[Zoey2936]

interesting

[Zoey2936]

what are you pasting there exactly? what do the logs show? etc.?

[Vylooo]

# Increase buffer size for large headers
# This is needed only if you get 'upstream sent too big header while reading response
# header from upstream' error when trying to access an application protected by goauthentik
proxy_buffers 8 16k;
proxy_buffer_size 32k;
port_in_redirect off;

location / {
    # Put your proxy_pass to your application here
    proxy_pass          $forward_scheme://$server:$port;

    # authentik-specific config
    auth_request        /outpost.goauthentik.io/auth/nginx;
    error_page          401 = @goauthentik_proxy_signin;
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;

    # translate headers from the outposts back to the actual upstream
    auth_request_set $authentik_username $upstream_http_x_authentik_username;
    auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
    auth_request_set $authentik_email $upstream_http_x_authentik_email;
    auth_request_set $authentik_name $upstream_http_x_authentik_name;
    auth_request_set $authentik_uid $upstream_http_x_authentik_uid;

    proxy_set_header X-authentik-username $authentik_username;
    proxy_set_header X-authentik-groups $authentik_groups;
    proxy_set_header X-authentik-email $authentik_email;
    proxy_set_header X-authentik-name $authentik_name;
    proxy_set_header X-authentik-uid $authentik_uid;
}

# all requests to /outpost.goauthentik.io must be accessible without authentication
location /outpost.goauthentik.io {
    proxy_pass          https://10.0.3.241:9443/outpost.goauthentik.io;
    # ensure the host of this vserver matches your external URL you've configured
    # in authentik
    proxy_set_header    Host $host;
    proxy_set_header    X-Original-URL $scheme://$http_host$request_uri;
    add_header          Set-Cookie $auth_cookie;
    auth_request_set    $auth_cookie $upstream_http_set_cookie;

    # required for POST requests to work
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
}

# Special location for when the /auth endpoint returns a 401,
# redirect to the /start URL which initiates SSO
location @goauthentik_proxy_signin {
    internal;
    add_header Set-Cookie $auth_cookie;
    return 302 /outpost.goauthentik.io/start?rd=$request_uri;
    # For domain level, use the below error_page to redirect to your authentik server with the full redirect path
    # return 302 https://authentik.company/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
}

Using on Unraid, not sure where the logs are stored.

[Vylooo]

https://geekscircuit.com/set-up-authentik-sso-with-nginx-proxy-manager/

[Vylooo]

[Vylooo]

Essentially it wont take anything in the advanced tab of proxy host.

[Zoey2936]

I've pasted:

port_in_redirect off;
location / {
    include conf.d/include/always.conf;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    include conf.d/include/proxy.conf;

    auth_request /outpost.goauthentik.io/auth/nginx;
    error_page 401 = @goauthentik_proxy_signin;
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    more_set_headers 'Set-Cookie: $auth_cookie';
    auth_request_set $authentik_username $upstream_http_x_authentik_username;
    auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
    auth_request_set $authentik_email $upstream_http_x_authentik_email;
    auth_request_set $authentik_name $upstream_http_x_authentik_name;
    auth_request_set $authentik_uid $upstream_http_x_authentik_uid;
    proxy_set_header X-authentik-username $authentik_username;
    proxy_set_header X-authentik-groups $authentik_groups;
    proxy_set_header X-authentik-email $authentik_email;
    proxy_set_header X-authentik-name $authentik_name;
    proxy_set_header X-authentik-uid $authentik_uid;
}

location /outpost.goauthentik.io {
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    include conf.d/include/proxy-location.conf;
    proxy_pass https://<ip>:9443/outpost.goauthentik.io; # ensure the host of this vserver matches your external URL you've configured in authentik

    proxy_set_header X-Original-URL $scheme://$host$request_uri;
    more_set_headers 'Set-Cookie: $auth_cookie';
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
}

location @goauthentik_proxy_signin {
    internal;
    more_set_headers 'Set-Cookie: $auth_cookie';
    return 302 /outpost.goauthentik.io/start?rd=$request_uri;
}

in my advanced tab and it worked

[Vylooo]

I guess its super temperamental about #

[Zoey2936]

it didn't worked because it did changes in proxy buffering, which conflicted with NPMplus nginx.conf - I've also improved the configuration to better work with NPMplus

[Zoey2936]

does it work now for you?

[Vylooo]

It works great thank you!

[d4rkw1n9]

Hey there

After having things successfully set up last week, it seems some forwarding to Authentik is broken.

This is the advanced config I am using, as per the respective, solved issue #726.

Flow goes like this:

NPMPlus > Authentik > Synology Photos, with the respective regex exceptions for the authentication path in Authentik, in order to bypass authentication on mobile apps. This has worked perfectly fine last week.

But now when trying to log in on the mobile app, I get Error number -2, which probably is not a Synology error code. Instead, it shows up in the NPMPlus logs like this:

Does anyone have an idea what could cause this? Maybe with regards to changes in the recent update?

Deleting the advanced config makes the login work flawlessly, but then ofc without the additional security layer from Authentik.

Thanks in advance.

Best

[Zoey2936]

can you please format the config?

[d4rkw1n9]

can you please format the config?

Yea sorry, I just linked the original, formatted answer, as I am on mobile. It is the exact config I used.

[d4rkw1n9]

This Discussion thread seems to enjoy much popularity :D Probably because nobody sees it.

Still no ideas around? Hmmm..

[Zoey2936]

The -2 error means if I remember correctly, that the file does not exist, but I don't see any breaking errors in the log

[d4rkw1n9]

The -2 error means if I remember correctly, that the file does not exist, but I don't see any breaking errors in the log

Thanks for the feedback. I am out of ideas and suspect that something got messed after enforcing 2FA on Synology side. Yes, when bypassing Authentik completely, it works. But when enabling it, it hangs at the very last step (after entering TOTP of Synology account). So, basically Authentik authentication works, but then somehow after entering Synology TOTP, it is stuck... Very strange.

[d4rkw1n9]

Latest news from my side:

Everything works perfectly fine, if NPMPlus is configured to just forward the request to authentik (i.e. with no custom config) and let authentik handle the proxy stuff. it is quite overkill to use two reverse proxies in the chain, but in order to have the WAF benefits, NPMPlus is still needed.

It's a pity that something seems to be incomplete with the custom config. But still, thanks for this project :)