Skip to content

Error 400 on Forward Auth (domain level) via Outpost #10848

@mmospanenko

Description

@mmospanenko

Describe the bug
I created Forward Auth (domain level) and provider (using wizard), but it works only with Embedded Outpost correctly.
With Proxies, it returns 400 (in logs wrong session).
But App Level Forward Auth works correctly with external (proxy) Outposts, issue only with Domain level.

I have some multiple servers in my network, each server has Outpost (ghcr.io/goauthentik/proxy), all behind Traefik.

To Reproduce
Steps to reproduce the behavior:

  1. deploy Authentic on one server and Proxy on another behind Traefik
  2. configure Domain level Forward Auth for external outpost
  3. try to log in using domain catch middleware
  4. see error (400)

Expected behavior
I expect that external outpost will work similar to embedded one.

Screenshots
not ui

Logs

{"event":"mismatched session ID", ...
{"event":"invalid state","level":"warning","logger":"authentik.outpost.proxyv2.application","name":"Provider for ...
{"event":"/outpost.goauthentik.io/callback?X-authentik-auth-callback=true&code=...","host":"auth....","level":"info","logger":"authentik.outpost.proxyv2.application","method":"GET","name":"Provider for ...","remote":"10....","runtime":"4.956","scheme":"http","size":0,"status":400,"timestamp":"2024-08-10T11:59:38Z","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"}   

Version and Deployment (please complete the following information):

  • authentik version: 2024.6.3
  • proxy: 2024.6.3
  • Deployment: docker-compose, traefik

Additional context
Add any other context about the problem here.

Metadata

Metadata

Assignees

Labels

bugSomething isn't workingstatus/reviewingthanks for opening, we're taking a look

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions