Add basic auth to the UI

[nicanordlc]

It would be nice if the basic auth could be enabled per service on the UI. This way we don't have to add docker labels manually for the services.

Here's a hand made example of what I'm trying to say 😅 .

[Plaidmustache]

Or option for authelia for same function. Setting up auth with the proxy is tough

[devdilson]

I believe it would be great if authentication labels could be added automatically to the services and allow Authentik for example.
https://coolify.io/docs/knowledge-base/traefik/protecting-services-with-authentik

[nicanordlc]

Hi @devdilson , now that you mention this doc about authentik I've been setting it up on my infra but I'm having an issue when I try to access a service protected.

Right now I get the internal IP of the server e.g. http://0.0.0.0:9000/application/o/authorize/... instead of 0.0.0.0:9000 it should be the subdomain for the authentik service e.g. authentik.myinfra.com. I followed the documentation and I get this. I don't know if yo have tried it and it works fine for you. I'd appreciate id it you can let me know about your case, maybe it helps me 😅 Thanks

[devdilson]

Hey @nicanordlc I actually have been trying to setup for a while and documented what I did in that documentation.
Did you set the external host as your sso in Authentik ProxyProvider?
Eg: https://sso.mydomain.com/

[nicanordlc]

Yep yep, my dynamic configuration looks like this

http:
  middlewares:
    authentik-auth:
      forwardAuth:
        address: 'https://auth.mydomain.com/outpost.goauthentik.io/auth/traefik'
        trustForwardHeader: true
        authResponseHeaders:
          - X-authentik-username
          - X-authentik-groups
          - X-authentik-entitlements
          - X-authentik-email
          - X-authentik-name
          - X-authentik-uid
          - X-authentik-jwt
          - X-authentik-meta-jwks
          - X-authentik-meta-outpost
          - X-authentik-meta-provider
          - X-authentik-meta-app
          - X-authentik-meta-version

And I'm protecting the service like this:

labels:
      - traefik.http.middlewares.authentik-auth@file

And with these in place I get this blank page:

[devdilson]

Hi @nicanordlc!
I could reproduce and figure out the issue.
In order to solve the problem, you have to go to the outpost in Authentik and then, under "Advance", configure the domain of authentik:

authentik_host: https://sso.mydomain.com

It should be green as in the image.

[nicanordlc]

I got it that way and I created a forward provider at domain level instead of a specific service and now I'm getting this:

But happiness is not yet complete 😢 , just when I enter my credentials I get redirected to a 400 page, like in this screenshot:

I feel I may configure the authentik provider or application not correctly 🤔