Redirect does not work

[quotengrote]

Hi,

the redirect back after a successfull login does not work.

Error:

time="2023-04-21T12:21:29+02:00" level=debug msg="Remote error https://auth.mgrote.net. StatusCode: 307" middlewareType=ForwardedAuthType middlewareName=nforwardauth@docker
time="2023-04-21T12:22:57+02:00" level=debug msg="Remote error https://auth.mgrote.net. StatusCode: 307" middlewareName=nforwardauth@docker middlewareType=ForwardedAuthType

following traefik configuration:

version: '3'
services:
######## traefik ########
  traefik:
    container_name: "traefik"
    image: traefik:latest
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/etc/traefik/traefik.yml
      - ./file-provider.yml:/etc/traefik/file-provider.yml
      - acme_data:/etc/traefik/acme
    networks:
      - traefik
    ports:
      - "80:80" # HTTP
      - "8081:8080" # Web-GUI
      - "443:443" # HTTPS
      - "2222:2222" # SSH
    environment:
      TZ: Europe/Berlin
    labels:
      com.centurylinklabs.watchtower.enable: true
######## error-pages ########
# https://github.com/tarampampam/error-pages/wiki/Traefik-(docker-compose)
  error-pages:
    container_name: "traefik-error-pages"
    image: tarampampam/error-pages:2
    environment:
      TEMPLATE_NAME: ghost
    labels:
      com.centurylinklabs.watchtower.enable: true

      traefik.enable: true
      # use as "fallback" for any NON-registered services (with priority below normal)
      traefik.http.routers.error-pages-router.rule: HostRegexp(`{host:.+}`)
      traefik.http.routers.error-pages-router.priority: 10
      # should say that all of your services work on https
      traefik.http.routers.error-pages-router.entrypoints: entry_https
      traefik.http.routers.error-pages-router.middlewares: error-pages-middleware
      # "errors" middleware settings
      traefik.http.middlewares.error-pages-middleware.errors.status: 400-599
      traefik.http.middlewares.error-pages-middleware.errors.service: error-pages-service
      traefik.http.middlewares.error-pages-middleware.errors.query: /{status}.html
      # define service properties
      traefik.http.services.error-pages-service.loadbalancer.server.port: 8080
    depends_on:
      - traefik
    networks:
      - traefik

######## nforwardauth ########
# https://github.com/NOSDuco/nforwardauth
  nforwardauth:
    container_name: "traefik-nforwardauth"
    image: nosduco/nforwardauth:v1
    depends_on:
      - traefik
    networks:
      - traefik
    volumes:
      - ./passwd:/passwd:ro # Mount local passwd file at /passwd as ready only
    environment:
      TOKEN_SECRET: {{ lookup('keepass', 'traefik-nforwardauth-token-secret', 'password') }} # Secret to use when signing auth token
      AUTH_HOST: auth.mgrote.net
      COOKIE_DOMAIN: mgrote.net # Set domain for the cookies. This value will allow cookie and auth on *.yourdomain.com (including base domain)
      PORT: 3000 # Set specific port to listen on
    labels:
      com.centurylinklabs.watchtower.enable: true
      traefik.enable: true
      traefik.http.routers.nforwardauth.rule: Host(`auth.mgrote.net`)
      traefik.http.middlewares.nforwardauth.forwardauth.address: https://auth.mgrote.net
      traefik.http.services.nforwardauth.loadbalancer.server.port: 3000
      traefik.http.routers.nforwardauth.tls: true
      traefik.http.routers.nforwardauth.tls.certresolver: resolver_letsencrypt
      traefik.http.routers.nforwardauth.entrypoints: entry_https


######## Networks ########
networks:
  traefik:
    external: true

######## Volumes ########
volumes:
  acme_data:

and app

oci-registry-ui:
    restart: always
    # url: registry.mgrote.net/ui/index.html
    image: joxit/docker-registry-ui:latest
    container_name: oci-registry-ui
    environment:
      DELETE_IMAGES: true
      SINGLE_REGISTRY: true
      NGINX_PROXY_PASS_URL: http://oci-registry:5000
    networks:
      - traefik
      - intern
    labels:
      traefik.http.routers.registry-ui.rule: Host(`registry.mgrote.net`)&&PathPrefix(`/ui`) # mache unter /ui erreichbar, damit wird demPfad dieser Prefix hinzugefügt, die Anwendung "hört" dort abrer nicht
      traefik.http.routers.registry-ui.middlewares: registry-ui-strip-prefix,error-pages-middleware,nforwardauth  # also entferne den Prefix danach wieder
      traefik.http.middlewares.registry-ui-strip-prefix.stripprefix.prefixes: /ui # hier ist die Middleware definiert
      traefik.enable: true
      traefik.http.routers.registry-ui.tls: true
      traefik.http.routers.registry-ui.tls.certresolver: resolver_letsencrypt
      traefik.http.routers.registry-ui.entrypoints: entry_https
      traefik.http.services.registry-ui.loadbalancer.server.port: 80

      com.centurylinklabs.watchtower.depends-on: oci-registry-redis,oci-registry
      com.centurylinklabs.watchtower.enable: true


######## Networks ########
networks:
  traefik:
    external: true
  intern:

[quotengrote]

Ok, now it redirects correctly.

But when visiting registry.mgrote.net/ui/index.html i get redirected to nforwardauth, after successfully login in i will get redirect to registry.mgrote.net/index.html (missing /ui/)

[nosduco]

Thanks for the very useful information along with the problem.

I'm looking into this now...

I think the issue might be because nforwardauth is getting the stripped URL

traefik.http.middlewares.registry-ui-strip-prefix.stripprefix.prefixes: /ui

due to this configuration.

I will reproduce this issue locally and then see what I can do.

Might have to add additional configuration to support this.

[nosduco]

@quotengrote When you try to access the app and are referred to nforwardauth can you paste me the URL bar? (there should be a query parameter named r that shows what it should be referred to. I am curious to see if that is correct or not)

[quotengrote]

Hi,

i can't reproduce it atm because after filling out the login information and clicking "submit" nothing¹ happens. Is there a way to enable "debug" output?

Footnotes

1. by nothing i mean no redirect, no changed url, no warnings or errors in the browser console, only in traefik logs i see this: time="2023-04-24T18:33:51+02:00" level=debug msg="Remote error https://auth.mgrote.net. StatusCode: 307" middlewareType=ForwardedAuthType middlewareName=nforwardauth@docker and "You have successfully logged in." appears.² ↩

2. this is reproducible for another container and url. ↩

[quotengrote]

Ok, now i got it working again:

app:

version: '3.3'
services:
[...]
  oci-registry-ui:
    restart: always
    # url: registry.mgrote.net/ui/index.html
    image: joxit/docker-registry-ui:latest
    container_name: oci-registry-ui
    environment:
      DELETE_IMAGES: true
      SINGLE_REGISTRY: true
      NGINX_PROXY_PASS_URL: http://oci-registry:5000
    networks:
      - traefik
      - intern
    labels:
      traefik.http.routers.registry-ui.rule: Host(`registry.mgrote.net`)&&PathPrefix(`/ui`) # mache unter /ui erreichbar, damit wird demPfad dieser Prefix hinzugefügt, die Anwendung "hört" dort abrer nicht
      traefik.http.routers.registry-ui.middlewares: registry-ui-strip-prefix,error-pages-middleware,registry-ipwhitelist,nforwardauth # also entferne den Prefix danach wieder
      traefik.http.middlewares.registry-ui-strip-prefix.stripprefix.prefixes: /ui # hier ist die Middleware definiert
      traefik.enable: true
      traefik.http.routers.registry-ui.tls: true
      traefik.http.routers.registry-ui.tls.certresolver: resolver_letsencrypt
      traefik.http.routers.registry-ui.entrypoints: entry_https
      traefik.http.services.registry-ui.loadbalancer.server.port: 80

      com.centurylinklabs.watchtower.depends-on: oci-registry-redis,oci-registry
      com.centurylinklabs.watchtower.enable: true


######## Networks ########
networks:
  traefik:
    external: true
  intern:

traefik:

version: '3'
services:
######## traefik ########
  traefik:
    container_name: "traefik"
    image: traefik:2.9
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/etc/traefik/traefik.yml
      - ./file-provider.yml:/etc/traefik/file-provider.yml
      - acme_data:/etc/traefik/acme
    networks:
      - traefik
    ports:
      - "80:80" # HTTP
      - "8081:8080" # Web-GUI
      - "443:443" # HTTPS
      - "2222:2222" # SSH
    environment:
      TZ: Europe/Berlin
    labels:
      com.centurylinklabs.watchtower.enable: true

######## error-pages ########
# https://github.com/tarampampam/error-pages/wiki/Traefik-(docker-compose)
  error-pages:
    container_name: "traefik-error-pages"
    image: tarampampam/error-pages:2
    environment:
      TEMPLATE_NAME: ghost
    labels:
      com.centurylinklabs.watchtower.depends-on: traefik
      com.centurylinklabs.watchtower.enable: true

      traefik.enable: true
      # use as "fallback" for any NON-registered services (with priority below normal)
      traefik.http.routers.error-pages-router.rule: HostRegexp(`{host:.+}`)
      traefik.http.routers.error-pages-router.priority: 10
      # should say that all of your services work on https
      traefik.http.routers.error-pages-router.entrypoints: entry_https
      traefik.http.routers.error-pages-router.middlewares: error-pages-middleware
      # "errors" middleware settings
      traefik.http.middlewares.error-pages-middleware.errors.status: 400-599
      traefik.http.middlewares.error-pages-middleware.errors.service: error-pages-service
      traefik.http.middlewares.error-pages-middleware.errors.query: /{status}.html
      # define service properties
      traefik.http.services.error-pages-service.loadbalancer.server.port: 8080
    depends_on:
      - traefik
    networks:
      - traefik

######## nforwardauth ########
# https://github.com/NOSDuco/nforwardauth
  nforwardauth:
    container_name: "traefik-nforwardauth"
    image: nosduco/nforwardauth:v1
    depends_on:
      - traefik
    networks:
      - traefik
    volumes:
      - ./passwd:/passwd:ro # Mount local passwd file at /passwd as ready only
    environment:
      TOKEN_SECRET: {{ lookup('keepass', 'traefik-nforwardauth-token-secret', 'password') }} # Secret to use when signing auth token
      AUTH_HOST: auth.mgrote.net
      #COOKIE_DOMAIN: mgrote.net # Set domain for the cookies. This value will allow cookie and auth on *.yourdomain.com (including base domain)
      PORT: 3000 # Set specific port to listen on
    labels:
      com.centurylinklabs.watchtower.depends-on: traefik
      com.centurylinklabs.watchtower.enable: true

      traefik.enable: true
      traefik.http.routers.nforwardauth.rule: Host(`auth.mgrote.net`)

      traefik.http.middlewares.nforwardauth.forwardauth.address: http://nforwardauth:3000

      traefik.http.services.nforwardauth.loadbalancer.server.port: 3000
      traefik.http.routers.nforwardauth.tls: true
      traefik.http.routers.nforwardauth.tls.certresolver: resolver_letsencrypt
      traefik.http.routers.nforwardauth.entrypoints: entry_https

    #  traefik.http.routers.nforwardauth.middlewares: error-pages-middleware


######## Networks ########
networks:
  traefik:
    external: true

######## Volumes ########
volumes:
  acme_data:

@quotengrote When you try to access the app and are referred to nforwardauth can you paste me the URL bar? (there should be a query parameter named r that shows what it should be referred to. I am curious to see if that is correct or not)

--> https://auth.mgrote.net/login?r=https://registry.mgrote.net/

If i append the/ui/ before logging in the redirect points to the correct url.

[nosduco]

@quotengrote When you go to https://registry.mgrote.net after you are logged in does the accessed site redirect to you the /ui? Is it potentially due to the / in the end of https://auth.mgrote.net/login?r=https://registry.mgrote.net/?

nforwardauth doesn't change the Traefik URLs or anything, it just gets the referral URI from the URL but if path exists it may be added a / at the end which could be confusing the registry container. I can try editing the package to not append a / if there is no path found.

[quotengrote]

After login:

• https://registry.mgrote.net/ui does not work
• https://registry.mgrote.net/ui/ does work

but the redirect goes always to https://auth.mgrote.net/login?r=https://registry.mgrote.net/

[quotengrote]

Hi, any news on this?

[quotengrote]

up