Basic authentication method

[synologyy]

Hi is it possible to integrate Basic auth Login for respurces? I Needed to Access my json log files securely without pangolins sso

[miloschwartz]

What do you mean by Basic auth? You could disable SSO on the specific resource if you want.

[FunDeckHermit]

Basic Auth is the browser prompt popup that asks for a username and password. Most Reverse Proxies are able to inject these username/passwords using headers. Some applications use Basic Auth to bypass the login screen.

Traefik Basic Auth

[krfdoc]

Can you just use Pangolin's built-in "Password Protection" Authentication method? Sorry if I'm misunderstanding

[aa-ko]

@miloschwartz I believe @synologyy has the same problem I am facing right now:

There should be some form of authentication in front of the website I am hosting and this works fine if I just enable protection in Pangolin. Any user can log in with PIN code, password or via Pangolin SSO.

But I may have some resources that additionally expose an API I need to access from outside of Pangolin. If the application in question does not implement authentication, I cannot disable Pangolin protection, because that would directly expose my API endpoint to the internet.
But now, this endpoint is not reachable from an application that just sends a plain HTTP request, because I have no way of embedding authentication information in the request to bypass Pangolin protection.

So ideally, I'd have multiple forms of authentication available: Pangolin for Login in a browser and manually passing basic auth headers when accessing a REST API.

Do you think this might be possible to implement with Traefik middlewares? I'd give it a shot, so I can finally enable Pangolin SSO for all my services :)

[PacketThrowr]

@krfdoc

What I believe they are saying (and what I am looking for) is that the backend server is password protected with a browser pop up. Is there a way with pangolin to insert the basic auth into the request?

Right now the flow is: I get the Pangolin login page > Login > Redirected to the backed apps page, that displays a browser pop up that has be login to the backend application with its local credentials > Allowed into the application.

With allowing basic auth to be passed with
Authorization: Basic XXXXXXXXXX
We can bypass the double login and only rely on pangolin while keeping the application protected from traffic not passing through pangolin (direct connection on the local LAN)

Please let me know if this helped.

[webash]

This is what I want. I thought the Header Auth option did this, but that's only for auth to/through Pangolin before the downstream app. I want to inject HTTP Basic Auth credentials to the downstream app

[webash]

Doh; one can do this by simply crafting the Authorization header and plugging it into Custom headers in Additional proxy settings against the resource. This works for me for now. Better would be each individual having credentials saved (per resource?) on their profile to inject, but it isn't an issue for this use case of mine.

[wieluk]

Basic Auth in Traefik is just a middleware, so if Pangolin let us assign custom middlewares per service, it would solve a lot of issues ...

[aamsur-933]

If your webservice behind pangoilin uses basic auth method, usually we can just write inline the user and password before the url to access the webservice/app.

example:
- username: iamhandsome
- pass: simpl3password
- url: http://exampleweb.com:3000

you can access the web using url: http://iamhandsome:simpl3password@exampleweb.com:3000

so you have to define the resouse like so:
- method: http
- ip/hostname: iamhandsome:simpl3password@exampleweb.com
- port: 3000

but our pangolin cannot handle it, the form will show error Validation error: Invalid input at "ip". @krfdoc @miloschwartz

[webash]

Clever - that would be a good way to get around it if it worked!

[webash]

This works: https://github.com/orgs/fosrl/discussions/226#discussioncomment-15081041

[jln-brtn]

I've submitted pull request #1522 to implement this feature. Please feel free to give me any feedback.

[LaurenceJJones]

Closing discussion as this was implemented by @jln-brtn !