Single Authelia Server for Multiple Endpoints #2874

drtech981 · 2022-02-14T14:49:09Z

I have my authelia setup in a docker container behind an NGINx proxy on Server 1.

I can successfully use set $upstream_authelia http://[host_ip]:9091/api/verify; to use authelia to protect endpoints on Server 1.

However, say on Server 2 I have other endpoints I want to protect. If I use
set $upstream_authelia https://authelia.mydomain.com/api/verify;
the redirect fails and I get a 500 error.

How can I use authelia on remote endpoints securely ?

The text was updated successfully, but these errors were encountered:

james-d-elliott · 2022-02-14T15:19:35Z

You need to ensure that the X-Forwarded-* headers are correct. If the proxy handling https://authelia.mydomain.com/api/verify overrides the headers the proxy configured with set $upstream_authelia https://authelia.mydomain.com/api/verify; sets, then it will fail.

The two options are to directly expose the raw port and only allow known proxies to connect, or to add a separate location directive that doesn't override any of these values.

drtech981 · 2022-02-14T18:09:12Z

You mean I should configure the Reverse Proxy on Server1 (hosting the authelia docker container) for X-Forwarded-* headers ?

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;

I guess just need to change the $http_host to https://authelia.mydomain.com?

james-d-elliott · 2022-02-15T05:01:24Z

The issue you're most likely facing with the limited information provided is that when you make a request to https://app1.mydomain.com on server2, and it does the auth_requst to https://authelia.mydomain.com/api/verify, it sets X-Forwarded-* headers which the /api/verify endpoint relies on. But what's occurring is sever1 is changing those headers. For example X-Forwarded-Host is being changed from app1.mydomain.com t authelia.mydomain.com.

You need to ensure that on server1 that endpoint is accessible in a way that doesn't cause this to happen via the proxy_set_header directives. There are multiple ways to solve this which I described some of the ways above.

For example you'd add a location block similar to this:

location /api/verify {
  proxy_pass http://authelia:9091;
}

james-d-elliott · 2022-02-24T22:36:36Z

Did you manage to solve this?

drtech981 · 2022-05-29T17:02:32Z

Extremely sorry, I was busy with my university exams so didn't have the time to handle this.

This is the current setup I have for NGINx that handles Authelia:

location / {
set $upstream_authelia http://10.0.0.252:9091; 
proxy_pass $upstream_authelia;
client_body_buffer_size 128k;

#Timeout if the real server is dead
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;

# Advanced Proxy Config
send_timeout 5m;
proxy_read_timeout 360;
proxy_send_timeout 360;
proxy_connect_timeout 360;

# Basic Proxy Config
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_redirect  http://  $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 64 256k;

set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.0.0.0/8;
set_real_ip_from 192.168.0.0/16;
set_real_ip_from fc00::/7;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
}

From your reply I could discern that I should add the following :

location /api/verify {
set $upstream_authelia http://10.0.0.252:9091; 
proxy_pass $upstream_authelia;
client_body_buffer_size 128k;

proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;

send_timeout 5m;
proxy_read_timeout 360;
proxy_send_timeout 360;
proxy_connect_timeout 360;

proxy_redirect  http://  $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 64 256k;

set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.0.0.0/8;
set_real_ip_from 192.168.0.0/16;
set_real_ip_from fc00::/7;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
}

that is, remove all proxy_set_header directives for location /api/verify ?

james-d-elliott · 2022-05-29T20:00:29Z

Yes that's correct, all of the X-Forwarded-* headers are set during the auth_request, so we don't want to override them.

drtech981 · 2022-05-30T13:46:49Z

When I add the above block to the NGINX server handling Authelia, I can access Authelia and all services running on the same server.

However on a different server, this is the config I have added :

location /authelia {
internal;
set $upstream_authelia https://auth.drtech981.cc/api/verify; 
proxy_pass_request_body off;
proxy_pass $upstream_authelia;    
proxy_set_header Content-Length "";

# Timeout if the real server is dead
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
client_body_buffer_size 128k;
proxy_set_header Host $host;
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr; 
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_redirect  http://  $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 4 32k;

send_timeout 5m;
proxy_read_timeout 240;
proxy_send_timeout 240;
proxy_connect_timeout 240;
}

location / {
set $upstream_app http://10.0.0.148:8006; 
proxy_pass $upstream_app;  #change name of the service
auth_request /authelia;
auth_request_set $target_url https://$http_host$request_uri;
auth_request_set $user $upstream_http_remote_user;
auth_request_set $email $upstream_http_remote_email;
auth_request_set $groups $upstream_http_remote_groups;
proxy_set_header Remote-User $user;
proxy_set_header Remote-Email $email;
proxy_set_header Remote-Groups $groups;

error_page 401 =302 https://auth.drtech981.cc/?rd=$target_url;

client_body_buffer_size 128k;

proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;

send_timeout 5m;
proxy_read_timeout 360;
proxy_send_timeout 360;
proxy_connect_timeout 360;

proxy_set_header Host $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection upgrade;
proxy_set_header Accept-Encoding gzip;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_redirect  http://  $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 64 256k;

set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.0.0.0/8;
set_real_ip_from 192.168.0.0/16;
set_real_ip_from fc00::/7;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
}

I get a 500 error.

If I change set $upstream_authelia http://auth.drtech981.cc:9091/api/verify; to set $upstream_authelia http://auth.drtech981.cc:9091/api/verify;, everything starts working fine. What am I still doing wrong ?

james-d-elliott · 2022-05-30T21:29:59Z

Nothing, it has to be over https. or you need to configure a method for it to communicate over http which is not recommended.

drtech981 · 2022-05-30T21:41:12Z

Sorry, had a typo there
set $upstream_authelia https://auth.drtech981.cc/api/verify; - doesn't work

set $upstream_authelia http://auth.drtech981.cc:9091/api/verify; - works

drtech981 · 2022-05-30T21:47:02Z

Also, as I just checked, set $upstream_authelia http://auth.drtech981.cc/api/verify; ie HTTP handled by NGINX doesn't work either.

So this is only working if I directly expose authelia on port 9091 to the internet, and send auth requests to it.

james-d-elliott · 2022-05-30T23:09:46Z

I would personally try with just the following. Maybe provide some more context on what logs occur on which server.

location /api/verify {
    set $upstream_authelia http://10.0.0.252:9091; 
    proxy_pass $upstream_authelia;
}

drtech981 · 2022-05-31T07:04:28Z

I would personally try with just the following. Maybe provide some more context on what logs occur on which server.
location /api/verify {
    set $upstream_authelia http://10.0.0.252:9091; 
    proxy_pass $upstream_authelia;
}

I cannot use $upstream_authelia to be 10.0.0.252:9091, as the servers are located on different subnets. I need to use the proper FQDN so that NGINX correctly routes the request to the authelia server.

drtech981 · 2022-05-31T07:19:01Z

Logs on Server 2 (not hosting authelia, hosting app to be protected) :

2022/05/31 07:08:08 [error] 883#883: *1298 upstream prematurely closed connection while reading response header from upstream, client: 103.191.2.11, server: zeroui-backup.drtech981.cc, request: "GET / HTTP/2.0", subrequest: "/authelia", upstream: "https://15.70.5.30:443/api/verify", host: "zeroui-backup.drtech981.cc"
2022/05/31 07:08:08 [warn] 883#883: *1298 upstream server temporarily disabled while reading response header from upstream, client: 103.191.2.11, server: zeroui-backup.drtech981.cc, request: "GET / HTTP/2.0", subrequest: "/authelia", upstream: "https://15.70.5.30:443/api/verify", host: "zeroui-backup.drtech981.cc"
2022/05/31 07:08:08 [error] 883#883: *1298 upstream prematurely closed connection while reading response header from upstream, client: 103.191.2.11, server: zeroui-backup.drtech981.cc, request: "GET / HTTP/2.0", subrequest: "/authelia", upstream: "https://[2603:c024:8:9::13]:443/api/verify", host: "zeroui-backup.drtech981.cc"
2022/05/31 07:08:08 [warn] 883#883: *1298 upstream server temporarily disabled while reading response header from upstream, client: 103.191.2.11, server: zeroui-backup.drtech981.cc, request: "GET / HTTP/2.0", subrequest: "/authelia", upstream: "https://[2603:c024:8:9::13]:443/api/verify", host: "zeroui-backup.drtech981.cc"
2022/05/31 07:08:08 [error] 883#883: *1298 auth request unexpected status: 502 while sending to client, client: 103.191.2.11, server: zeroui-backup.drtech981.cc, request: "GET / HTTP/2.0", host: "zeroui-backup.drtech981.cc"

james-d-elliott · 2022-05-31T08:58:35Z

I would personally try with just the following. Maybe provide some more context on what logs occur on which server.
location /api/verify {
    set $upstream_authelia http://10.0.0.252:9091; 
    proxy_pass $upstream_authelia;
}
I cannot use $upstream_authelia to be 10.0.0.252:9091, as the servers are located on different subnets. I need to use the proper FQDN so that NGINX correctly routes the request to the authelia server.

Then this part of your config is wrong:

location / {
set $upstream_authelia http://10.0.0.252:9091; 
proxy_pass $upstream_authelia;
client_body_buffer_size 128k;

#Timeout if the real server is dead
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;

These sections MUST be identical excluding the path i.e. location / vs location /api/verify and the removal of the header parameters. Specifically the proxy_pass is exactly the same. The subnet is not important.

drtech981 · 2022-05-31T09:14:58Z

Okay, now this is the config on Authelia :

location /api/verify {
set $upstream_authelia http://10.0.0.252:9091; 
proxy_pass $upstream_authelia;
}

location / {
set $upstream_authelia http://10.0.0.252:9091; 
proxy_pass $upstream_authelia;
client_body_buffer_size 128k;

#Timeout if the real server is dead
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;

# Advanced Proxy Config
send_timeout 5m;
proxy_read_timeout 360;
proxy_send_timeout 360;
proxy_connect_timeout 360;

# Basic Proxy Config
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_redirect  http://  $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 64 256k;

set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.0.0.0/8;
set_real_ip_from 192.168.0.0/16;
set_real_ip_from fc00::/7;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
}

and this is the config on the end point (On a separate server, located in a different data centre) :

location /authelia {
internal;
set $upstream_authelia https://auth.drtech981.cc/api/verify; 
proxy_pass_request_body off;
proxy_pass $upstream_authelia;
proxy_set_header Content-Length "";

# Timeout if the real server is dead
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
client_body_buffer_size 128k;
proxy_set_header Host $host;
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr; 
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_redirect  http://  $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 4 32k;

send_timeout 5m;
proxy_read_timeout 240;
proxy_send_timeout 240;
proxy_connect_timeout 240;
}

location / {
set $upstream_app http://10.0.0.148:8006; 
proxy_pass $upstream_app;  #change name of the service
auth_request /authelia;
auth_request_set $target_url https://$http_host$request_uri;
auth_request_set $user $upstream_http_remote_user;
auth_request_set $email $upstream_http_remote_email;
auth_request_set $groups $upstream_http_remote_groups;
proxy_set_header Remote-User $user;
proxy_set_header Remote-Email $email;
proxy_set_header Remote-Groups $groups;

error_page 401 =302 https://auth.drtech981.cc/?rd=$target_url;

client_body_buffer_size 128k;

proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;

send_timeout 5m;
proxy_read_timeout 360;
proxy_send_timeout 360;
proxy_connect_timeout 360;

proxy_set_header Host $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection upgrade;
proxy_set_header Accept-Encoding gzip;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_set_header 'Access-Control-Allow-Origin' *;
proxy_redirect  http://  $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 64 256k;

set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.0.0.0/8;
set_real_ip_from 192.168.0.0/16;
set_real_ip_from fc00::/7;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
}

drtech981 · 2022-05-31T09:16:11Z

location /authelia {
internal;
What does internal mean here ?

james-d-elliott · 2022-05-31T09:41:28Z

Internal just means it's only accessible to nginx, not external clients.

drtech981 · 2022-05-31T10:25:30Z

Okay, now this is the config on Authelia :

location /api/verify {
set $upstream_authelia http://10.0.0.252:9091; 
proxy_pass $upstream_authelia;
}

This doesn't work either, I am still getting error 500.

james-d-elliott · 2022-05-31T11:20:34Z

So something changed, we're going to need new logs, there should be nginx errors on either both or one instance. I'd suggest using the examples instead of using your own configs, it makes it easier to debug.

drtech981 · 2022-05-31T12:03:16Z

This is the error log generated on protected endpoint :

2022/05/31 11:59:02 [error] 1079#1079: *3487 upstream prematurely closed connection while reading response header from upstream, client: 103.191.2.117, server: zeroui-backup.drtech981.cc, request: "GET / HTTP/2.0", subrequest: "/authelia", upstream: "https://15.7.6.30:443/api/verify", host: "zeroui-backup.drtech981.cc", referrer: "https://npm-m03.drtech981.cc/"
2022/05/31 11:59:02 [warn] 1079#1079: *3487 upstream server temporarily disabled while reading response header from upstream, client: 103.191.2.117, server: zeroui-backup.drtech981.cc, request: "GET / HTTP/2.0", subrequest: "/authelia", upstream: "https://15.7.6.30:443/api/verify", host: "zeroui-backup.drtech981.cc", referrer: "https://npm-m03.drtech981.cc/"
2022/05/31 11:59:02 [error] 1079#1079: *3487 upstream prematurely closed connection while reading response header from upstream, client: 103.191.2.117, server: zeroui-backup.drtech981.cc, request: "GET / HTTP/2.0", subrequest: "/authelia", upstream: "https://[2603:c024:8:3::13]:443/api/verify", host: "zeroui-backup.drtech981.cc", referrer: "https://npm-m03.drtech981.cc/"
2022/05/31 11:59:02 [warn] 1079#1079: *3487 upstream server temporarily disabled while reading response header from upstream, client: 103.191.2.117, server: zeroui-backup.drtech981.cc, request: "GET / HTTP/2.0", subrequest: "/authelia", upstream: "https://[2603:c024:8:3::13]:443/api/verify", host: "zeroui-backup.drtech981.cc", referrer: "https://npm-m03.drtech981.cc/"
2022/05/31 11:59:02 [error] 1079#1079: *3487 auth request unexpected status: 502 while sending to client, client: 103.191.2.117, server: zeroui-backup.drtech981.cc, request: "GET / HTTP/2.0", host: "zeroui-backup.drtech981.cc", referrer: "https://npm-m03.drtech981.cc/"

NGINX proxying authelia doesn't show any errors at such

What examples should I reference ?

james-d-elliott · 2022-05-31T21:39:01Z

The include-based example: https://www.authelia.com/docs/deployment/supported-proxies/nginx.html

james-d-elliott · 2022-05-31T21:42:30Z

Ahh remove the proxy_set_header Host $host; from the internal endpoint. That's what's causing it. Forgot we have not pushed the change to that yet.

drtech981 · 2022-06-01T05:30:11Z

@james-d-elliott Thanks a ton, man are you awesome !! Everything is working fine now ? As a last step may I ask why proxy_set_header Host $host; was causing all the problems ?

drtech981 · 2022-06-01T05:34:44Z

For anyone stumbling across this, this is my set up with NGINX Proxy Manager :

On the server hosting Authelia :
Head over to advanced and paste the following :


location /api/verify {
set $upstream_authelia http://authelia:9091; 
proxy_pass $upstream_authelia;
}

location / {
set $upstream_authelia http://authelia:9091; 
proxy_pass $upstream_authelia;
client_body_buffer_size 128k;

#Timeout if the real server is dead
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;

# Advanced Proxy Config
send_timeout 5m;
proxy_read_timeout 360;
proxy_send_timeout 360;
proxy_connect_timeout 360;

# Basic Proxy Config
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_redirect  http://  $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 64 256k;

set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.0.0.0/8;
set_real_ip_from 192.168.0.0/16;
set_real_ip_from fc00::/7;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
}

On the endpoint you're trying to protect :

location /authelia {
internal;
set $upstream_authelia https://<FQDN of Authelia>/api/verify; 
proxy_pass_request_body off;
proxy_pass $upstream_authelia;
proxy_set_header Content-Length "";

# Timeout if the real server is dead
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
client_body_buffer_size 128k;
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr; 
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_redirect  http://  $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 4 32k;

send_timeout 5m;
proxy_read_timeout 240;
proxy_send_timeout 240;
proxy_connect_timeout 240;
}
location / {
set $upstream_app http://<upstream app>:8006; 
proxy_pass $upstream_app;  #change name of the service
auth_request /authelia;
auth_request_set $target_url https://$http_host$request_uri;
auth_request_set $user $upstream_http_remote_user;
auth_request_set $email $upstream_http_remote_email;
auth_request_set $groups $upstream_http_remote_groups;
proxy_set_header Remote-User $user;
proxy_set_header Remote-Email $email;
proxy_set_header Remote-Groups $groups;

error_page 401 =302 https://<FQDN of Authelia>/?rd=$target_url;

client_body_buffer_size 128k;

proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;

send_timeout 5m;
proxy_read_timeout 360;
proxy_send_timeout 360;
proxy_connect_timeout 360;

proxy_set_header Host $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection upgrade;
proxy_set_header Accept-Encoding gzip;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_set_header 'Access-Control-Allow-Origin' *;
proxy_redirect  http://  $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 64 256k;

set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.0.0.0/8;
set_real_ip_from 192.168.0.0/16;
set_real_ip_from fc00::/7;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
}

james-d-elliott · 2022-06-01T08:46:44Z

@james-d-elliott Thanks a ton, man are you awesome !! Everything is working fine now ? As a last step may I ask why proxy_set_header Host $host; was causing all the problems ?

Because the auth_request was being sent to a foreign nginx server which wouldn't have that host. The header actually accomplishes nothing in any instance. It is an error in our docs, basically if you're requesting app.example.com, the host header will be set to app.example.com instead of auth.example.com so nginx matches the request incorrectly.

drtech981 · 2022-06-01T10:33:42Z

So that means, proxy_set_header Host changes the name the upstream webserver needs to be accesed by ?

That is, if the upstream server cannot be accessed with 10.0.0.252, this header sets the referencing name to $host ?

olivierlambert · 2023-01-09T10:20:36Z

@drtech981 sorry it's been a while, but I have the exact same issue that you had. In the config you posted in the end, there's still the proxy_set_header Host $host; despite you said it didn't work with it. Can you double check your working config and paste it here? Thank you 👍

kennylouie · 2024-01-22T07:37:48Z

Hi, I am attempting a similar setup. I followed this thread and the configs but I am experiencing the same 500 issues. Is there an example / doc for this type of setup? Thanks

james-d-elliott · 2024-01-25T23:23:01Z

The key element in making sure the /api/verify endpoints and /api/authz/* endpoints do not override the X-Original-* or X-Forwarded-* headers. You can do this in nginx by adding a location for these endpoints which does not include anything other than the proxy_pass directive per the existing examples: https://www.authelia.com/integration/proxies/nginx/#standard-example

The issues section is for discussion of bugs and feature requests, this is neither so I'd suggest opening a discussion instead if this isn't clear enough.

kennylouie · 2024-01-26T06:35:31Z

Hi, just wanted to quickly reply in case someone else is intending to do the same setup. The default setup as documented in the official docs works. I just didn't have SNI configured on the server not with authelia but making a proxied request to the authelia server. I required a proxy_ssl_server_name on; on the endpoints I wanted to protect.

james-d-elliott closed this as completed Mar 1, 2022

james-d-elliott reopened this May 30, 2022

james-d-elliott closed this as completed Jun 1, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Single Authelia Server for Multiple Endpoints #2874

Single Authelia Server for Multiple Endpoints #2874

drtech981 commented Feb 14, 2022

james-d-elliott commented Feb 14, 2022

drtech981 commented Feb 14, 2022

james-d-elliott commented Feb 15, 2022

james-d-elliott commented Feb 24, 2022

drtech981 commented May 29, 2022

james-d-elliott commented May 29, 2022

drtech981 commented May 30, 2022

james-d-elliott commented May 30, 2022

drtech981 commented May 30, 2022

drtech981 commented May 30, 2022

james-d-elliott commented May 30, 2022 •

edited

Loading

drtech981 commented May 31, 2022

drtech981 commented May 31, 2022

james-d-elliott commented May 31, 2022 •

edited

Loading

drtech981 commented May 31, 2022

drtech981 commented May 31, 2022

james-d-elliott commented May 31, 2022

drtech981 commented May 31, 2022

james-d-elliott commented May 31, 2022 •

edited

Loading

drtech981 commented May 31, 2022

james-d-elliott commented May 31, 2022

james-d-elliott commented May 31, 2022

drtech981 commented Jun 1, 2022

drtech981 commented Jun 1, 2022 •

edited

Loading

james-d-elliott commented Jun 1, 2022

drtech981 commented Jun 1, 2022

olivierlambert commented Jan 9, 2023

kennylouie commented Jan 22, 2024

james-d-elliott commented Jan 25, 2024 •

edited

Loading

kennylouie commented Jan 26, 2024 •

edited

Loading

Single Authelia Server for Multiple Endpoints #2874

Single Authelia Server for Multiple Endpoints #2874

Comments

drtech981 commented Feb 14, 2022

james-d-elliott commented Feb 14, 2022

drtech981 commented Feb 14, 2022

james-d-elliott commented Feb 15, 2022

james-d-elliott commented Feb 24, 2022

drtech981 commented May 29, 2022

james-d-elliott commented May 29, 2022

drtech981 commented May 30, 2022

james-d-elliott commented May 30, 2022

drtech981 commented May 30, 2022

drtech981 commented May 30, 2022

james-d-elliott commented May 30, 2022 • edited Loading

drtech981 commented May 31, 2022

drtech981 commented May 31, 2022

james-d-elliott commented May 31, 2022 • edited Loading

drtech981 commented May 31, 2022

drtech981 commented May 31, 2022

james-d-elliott commented May 31, 2022

drtech981 commented May 31, 2022

james-d-elliott commented May 31, 2022 • edited Loading

drtech981 commented May 31, 2022

james-d-elliott commented May 31, 2022

james-d-elliott commented May 31, 2022

drtech981 commented Jun 1, 2022

drtech981 commented Jun 1, 2022 • edited Loading

james-d-elliott commented Jun 1, 2022

drtech981 commented Jun 1, 2022

olivierlambert commented Jan 9, 2023

kennylouie commented Jan 22, 2024

james-d-elliott commented Jan 25, 2024 • edited Loading

kennylouie commented Jan 26, 2024 • edited Loading

james-d-elliott commented May 30, 2022 •

edited

Loading

james-d-elliott commented May 31, 2022 •

edited

Loading

james-d-elliott commented May 31, 2022 •

edited

Loading

drtech981 commented Jun 1, 2022 •

edited

Loading

james-d-elliott commented Jan 25, 2024 •

edited

Loading

kennylouie commented Jan 26, 2024 •

edited

Loading