Redirect does not work #1

quotengrote · 2023-04-21T10:26:51Z

Hi,

the redirect back after a successfull login does not work.

Error:

time="2023-04-21T12:21:29+02:00" level=debug msg="Remote error https://auth.mgrote.net. StatusCode: 307" middlewareType=ForwardedAuthType middlewareName=nforwardauth@docker
time="2023-04-21T12:22:57+02:00" level=debug msg="Remote error https://auth.mgrote.net. StatusCode: 307" middlewareName=nforwardauth@docker middlewareType=ForwardedAuthType

following traefik configuration:

version: '3'
services:
######## traefik ########
  traefik:
    container_name: "traefik"
    image: traefik:latest
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/etc/traefik/traefik.yml
      - ./file-provider.yml:/etc/traefik/file-provider.yml
      - acme_data:/etc/traefik/acme
    networks:
      - traefik
    ports:
      - "80:80" # HTTP
      - "8081:8080" # Web-GUI
      - "443:443" # HTTPS
      - "2222:2222" # SSH
    environment:
      TZ: Europe/Berlin
    labels:
      com.centurylinklabs.watchtower.enable: true
######## error-pages ########
# https://github.com/tarampampam/error-pages/wiki/Traefik-(docker-compose)
  error-pages:
    container_name: "traefik-error-pages"
    image: tarampampam/error-pages:2
    environment:
      TEMPLATE_NAME: ghost
    labels:
      com.centurylinklabs.watchtower.enable: true

      traefik.enable: true
      # use as "fallback" for any NON-registered services (with priority below normal)
      traefik.http.routers.error-pages-router.rule: HostRegexp(`{host:.+}`)
      traefik.http.routers.error-pages-router.priority: 10
      # should say that all of your services work on https
      traefik.http.routers.error-pages-router.entrypoints: entry_https
      traefik.http.routers.error-pages-router.middlewares: error-pages-middleware
      # "errors" middleware settings
      traefik.http.middlewares.error-pages-middleware.errors.status: 400-599
      traefik.http.middlewares.error-pages-middleware.errors.service: error-pages-service
      traefik.http.middlewares.error-pages-middleware.errors.query: /{status}.html
      # define service properties
      traefik.http.services.error-pages-service.loadbalancer.server.port: 8080
    depends_on:
      - traefik
    networks:
      - traefik

######## nforwardauth ########
# https://github.com/NOSDuco/nforwardauth
  nforwardauth:
    container_name: "traefik-nforwardauth"
    image: nosduco/nforwardauth:v1
    depends_on:
      - traefik
    networks:
      - traefik
    volumes:
      - ./passwd:/passwd:ro # Mount local passwd file at /passwd as ready only
    environment:
      TOKEN_SECRET: {{ lookup('keepass', 'traefik-nforwardauth-token-secret', 'password') }} # Secret to use when signing auth token
      AUTH_HOST: auth.mgrote.net
      COOKIE_DOMAIN: mgrote.net # Set domain for the cookies. This value will allow cookie and auth on *.yourdomain.com (including base domain)
      PORT: 3000 # Set specific port to listen on
    labels:
      com.centurylinklabs.watchtower.enable: true
      traefik.enable: true
      traefik.http.routers.nforwardauth.rule: Host(`auth.mgrote.net`)
      traefik.http.middlewares.nforwardauth.forwardauth.address: https://auth.mgrote.net
      traefik.http.services.nforwardauth.loadbalancer.server.port: 3000
      traefik.http.routers.nforwardauth.tls: true
      traefik.http.routers.nforwardauth.tls.certresolver: resolver_letsencrypt
      traefik.http.routers.nforwardauth.entrypoints: entry_https


######## Networks ########
networks:
  traefik:
    external: true

######## Volumes ########
volumes:
  acme_data:

and app

oci-registry-ui:
    restart: always
    # url: registry.mgrote.net/ui/index.html
    image: joxit/docker-registry-ui:latest
    container_name: oci-registry-ui
    environment:
      DELETE_IMAGES: true
      SINGLE_REGISTRY: true
      NGINX_PROXY_PASS_URL: http://oci-registry:5000
    networks:
      - traefik
      - intern
    labels:
      traefik.http.routers.registry-ui.rule: Host(`registry.mgrote.net`)&&PathPrefix(`/ui`) # mache unter /ui erreichbar, damit wird demPfad dieser Prefix hinzugefügt, die Anwendung "hört" dort abrer nicht
      traefik.http.routers.registry-ui.middlewares: registry-ui-strip-prefix,error-pages-middleware,nforwardauth  # also entferne den Prefix danach wieder
      traefik.http.middlewares.registry-ui-strip-prefix.stripprefix.prefixes: /ui # hier ist die Middleware definiert
      traefik.enable: true
      traefik.http.routers.registry-ui.tls: true
      traefik.http.routers.registry-ui.tls.certresolver: resolver_letsencrypt
      traefik.http.routers.registry-ui.entrypoints: entry_https
      traefik.http.services.registry-ui.loadbalancer.server.port: 80

      com.centurylinklabs.watchtower.depends-on: oci-registry-redis,oci-registry
      com.centurylinklabs.watchtower.enable: true


######## Networks ########
networks:
  traefik:
    external: true
  intern:

The text was updated successfully, but these errors were encountered:

quotengrote · 2023-04-21T10:51:25Z

Ok, now it redirects correctly.

But when visiting registry.mgrote.net/ui/index.html i get redirected to nforwardauth, after successfully login in i will get redirect to registry.mgrote.net/index.html (missing /ui/)

nosduco · 2023-04-21T20:46:33Z

Thanks for the very useful information along with the problem.

I'm looking into this now...

I think the issue might be because nforwardauth is getting the stripped URL

traefik.http.middlewares.registry-ui-strip-prefix.stripprefix.prefixes: /ui

due to this configuration.

I will reproduce this issue locally and then see what I can do.

Might have to add additional configuration to support this.

nosduco · 2023-04-21T21:08:22Z

@quotengrote When you try to access the app and are referred to nforwardauth can you paste me the URL bar? (there should be a query parameter named r that shows what it should be referred to. I am curious to see if that is correct or not)

quotengrote · 2023-04-24T16:36:07Z

Hi,
i can't reproduce it atm because after filling out the login information and clicking "submit" nothing¹ happens. Is there a way to enable "debug" output?

by nothing i mean no redirect, no changed url, no warnings or errors in the browser console, only in traefik logs i see this: time="2023-04-24T18:33:51+02:00" level=debug msg="Remote error https://auth.mgrote.net. StatusCode: 307" middlewareType=ForwardedAuthType middlewareName=nforwardauth@docker and "You have successfully logged in." appears.² ↩
this is reproducible for another container and url. ↩

quotengrote · 2023-04-24T18:04:28Z

Ok, now i got it working again:

app:

version: '3.3'
services:
[...]
  oci-registry-ui:
    restart: always
    # url: registry.mgrote.net/ui/index.html
    image: joxit/docker-registry-ui:latest
    container_name: oci-registry-ui
    environment:
      DELETE_IMAGES: true
      SINGLE_REGISTRY: true
      NGINX_PROXY_PASS_URL: http://oci-registry:5000
    networks:
      - traefik
      - intern
    labels:
      traefik.http.routers.registry-ui.rule: Host(`registry.mgrote.net`)&&PathPrefix(`/ui`) # mache unter /ui erreichbar, damit wird demPfad dieser Prefix hinzugefügt, die Anwendung "hört" dort abrer nicht
      traefik.http.routers.registry-ui.middlewares: registry-ui-strip-prefix,error-pages-middleware,registry-ipwhitelist,nforwardauth # also entferne den Prefix danach wieder
      traefik.http.middlewares.registry-ui-strip-prefix.stripprefix.prefixes: /ui # hier ist die Middleware definiert
      traefik.enable: true
      traefik.http.routers.registry-ui.tls: true
      traefik.http.routers.registry-ui.tls.certresolver: resolver_letsencrypt
      traefik.http.routers.registry-ui.entrypoints: entry_https
      traefik.http.services.registry-ui.loadbalancer.server.port: 80

      com.centurylinklabs.watchtower.depends-on: oci-registry-redis,oci-registry
      com.centurylinklabs.watchtower.enable: true


######## Networks ########
networks:
  traefik:
    external: true
  intern:

traefik:

version: '3'
services:
######## traefik ########
  traefik:
    container_name: "traefik"
    image: traefik:2.9
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/etc/traefik/traefik.yml
      - ./file-provider.yml:/etc/traefik/file-provider.yml
      - acme_data:/etc/traefik/acme
    networks:
      - traefik
    ports:
      - "80:80" # HTTP
      - "8081:8080" # Web-GUI
      - "443:443" # HTTPS
      - "2222:2222" # SSH
    environment:
      TZ: Europe/Berlin
    labels:
      com.centurylinklabs.watchtower.enable: true

######## error-pages ########
# https://github.com/tarampampam/error-pages/wiki/Traefik-(docker-compose)
  error-pages:
    container_name: "traefik-error-pages"
    image: tarampampam/error-pages:2
    environment:
      TEMPLATE_NAME: ghost
    labels:
      com.centurylinklabs.watchtower.depends-on: traefik
      com.centurylinklabs.watchtower.enable: true

      traefik.enable: true
      # use as "fallback" for any NON-registered services (with priority below normal)
      traefik.http.routers.error-pages-router.rule: HostRegexp(`{host:.+}`)
      traefik.http.routers.error-pages-router.priority: 10
      # should say that all of your services work on https
      traefik.http.routers.error-pages-router.entrypoints: entry_https
      traefik.http.routers.error-pages-router.middlewares: error-pages-middleware
      # "errors" middleware settings
      traefik.http.middlewares.error-pages-middleware.errors.status: 400-599
      traefik.http.middlewares.error-pages-middleware.errors.service: error-pages-service
      traefik.http.middlewares.error-pages-middleware.errors.query: /{status}.html
      # define service properties
      traefik.http.services.error-pages-service.loadbalancer.server.port: 8080
    depends_on:
      - traefik
    networks:
      - traefik

######## nforwardauth ########
# https://github.com/NOSDuco/nforwardauth
  nforwardauth:
    container_name: "traefik-nforwardauth"
    image: nosduco/nforwardauth:v1
    depends_on:
      - traefik
    networks:
      - traefik
    volumes:
      - ./passwd:/passwd:ro # Mount local passwd file at /passwd as ready only
    environment:
      TOKEN_SECRET: {{ lookup('keepass', 'traefik-nforwardauth-token-secret', 'password') }} # Secret to use when signing auth token
      AUTH_HOST: auth.mgrote.net
      #COOKIE_DOMAIN: mgrote.net # Set domain for the cookies. This value will allow cookie and auth on *.yourdomain.com (including base domain)
      PORT: 3000 # Set specific port to listen on
    labels:
      com.centurylinklabs.watchtower.depends-on: traefik
      com.centurylinklabs.watchtower.enable: true

      traefik.enable: true
      traefik.http.routers.nforwardauth.rule: Host(`auth.mgrote.net`)

      traefik.http.middlewares.nforwardauth.forwardauth.address: http://nforwardauth:3000

      traefik.http.services.nforwardauth.loadbalancer.server.port: 3000
      traefik.http.routers.nforwardauth.tls: true
      traefik.http.routers.nforwardauth.tls.certresolver: resolver_letsencrypt
      traefik.http.routers.nforwardauth.entrypoints: entry_https

    #  traefik.http.routers.nforwardauth.middlewares: error-pages-middleware


######## Networks ########
networks:
  traefik:
    external: true

######## Volumes ########
volumes:
  acme_data:

@quotengrote When you try to access the app and are referred to nforwardauth can you paste me the URL bar? (there should be a query parameter named r that shows what it should be referred to. I am curious to see if that is correct or not)

--> https://auth.mgrote.net/login?r=https://registry.mgrote.net/

If i append the/ui/ before logging in the redirect points to the correct url.

nosduco · 2023-04-24T21:20:47Z

@quotengrote When you go to https://registry.mgrote.net after you are logged in does the accessed site redirect to you the /ui? Is it potentially due to the / in the end of https://auth.mgrote.net/login?r=https://registry.mgrote.net/?

nforwardauth doesn't change the Traefik URLs or anything, it just gets the referral URI from the URL but if path exists it may be added a / at the end which could be confusing the registry container. I can try editing the package to not append a / if there is no path found.

quotengrote · 2023-04-25T08:21:36Z

After login:

https://registry.mgrote.net/ui does not work
https://registry.mgrote.net/ui/ does work

but the redirect goes always to https://auth.mgrote.net/login?r=https://registry.mgrote.net/

quotengrote · 2023-05-25T09:00:53Z

Hi, any news on this?

quotengrote · 2023-11-13T11:05:53Z

up

nosduco added the question Further information is requested label Aug 7, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Redirect does not work #1

Redirect does not work #1

quotengrote commented Apr 21, 2023

quotengrote commented Apr 21, 2023

nosduco commented Apr 21, 2023

nosduco commented Apr 21, 2023

quotengrote commented Apr 24, 2023 •

edited

Loading

quotengrote commented Apr 24, 2023 •

edited

Loading

nosduco commented Apr 24, 2023

quotengrote commented Apr 25, 2023

quotengrote commented May 25, 2023

quotengrote commented Nov 13, 2023

Redirect does not work #1

Redirect does not work #1

Comments

quotengrote commented Apr 21, 2023

and app

quotengrote commented Apr 21, 2023

nosduco commented Apr 21, 2023

nosduco commented Apr 21, 2023

quotengrote commented Apr 24, 2023 • edited Loading

Footnotes

quotengrote commented Apr 24, 2023 • edited Loading

app:

traefik:

nosduco commented Apr 24, 2023

quotengrote commented Apr 25, 2023

quotengrote commented May 25, 2023

quotengrote commented Nov 13, 2023

quotengrote commented Apr 24, 2023 •

edited

Loading

quotengrote commented Apr 24, 2023 •

edited

Loading