1. The problem I’m having:
I want to use Caddy to reverse proxy my Authentik instance, an oauth2proxy instance and my App. I don’t want to use Authentik Outpost, i am using Authentik OAuth2/OpenID provider.
I need the Authorization JWT header set by Authentik to be passed through to the app.
If i put [caddy] → [oauth2proxy] > [My App] inline this works ok using oauth2proxy upstream configuration, Caddy just passes everything through as does oauth2proxy which ensures the Authorization header is set.
But i dont really want this configuration. I would prefer [caddy] > [My App] so i have tried to use the long form of the forward_auth configuration (as documented here forward_auth (Caddyfile directive) — Caddy Documentation) but i can’t get it to work. I’m expecting to be able to get it to work like nginx auth_request module, essentially doing a sub request to oauth2proxy (with oauth2proxy just acting like an auth server and not proxying anything) which responds with 200 or 401 if authenticated or not based on the presence of a cookie header.
The reverse_proxy for httpbin isn’t actually making the subrequest to check the http://oauth2-proxy-httpbin:4180/oauth2/auth to get a response 200/400 response, its just sending the request directly to httpbin (which gives 404 for the /oauth2/auth path anyway) , any ideas why not or if there is a better way of achieving this?
2. Error messages and/or full log output:
3. Caddy version:
2.7.6
4. How I installed and ran Caddy:
docker image
a. System environment:
linux
b. Command:
n/a
c. Service/unit/compose file:
Docker
d. My complete Caddy config:
auth.domain.tld {
reverse_proxy authentik-server-1:9000 {
import trusted_proxy_list
}
import proxy_log
}
httpbin.domain.tld {
handle /oauth2/* {
reverse_proxy http://oauth2-proxy-httpbin:4180 {
import trusted_proxy_list
}
}
handle {
reverse_proxy http://httpbin:8080 {
method GET
rewrite http://oauth2-proxy-httpbin:4180/oauth2/auth
header_up X-Forwarded-Method {method}
header_up X-Forwarded-Uri {uri}
header_up Cookie _oauth2_proxy_0={http.request.cookie._oauth2_proxy_0};_oauth2_proxy_1={http.request.cookie._oauth2_proxy_1};_oauth2_proxy_1
@good status 2xx
handle_response @good {
request_header rp.header.Remote-User {http.reverse_proxy.header.X-Authentik-Username}
request_header rp.header.Remote-Email {http.reverse_proxy.header.X-Authentik-Email}
}
@bad status 4xx
handle_response @bad {
redir https://httpbin.domain.tld/oauth2/start
}
import trusted_proxy_list
}
}
import proxy_log
}