f6a8b3d568
* Corrected typo and added Note about port number if using Istio/Kubernetes @BeryJu I was reading [this article](https://prevue.ch/news/2022-10-11-istio-authentik/) about a fellow setting up authentik, using Istio and Kubernetes. I wanted to somehow add a heads up about the port number, but I am not confident that I got it right. Is it only if there are custom decisions being made that the port number has to be for the cluster? Signed-off-by: Tana M Berry <tanamarieberry@yahoo.com> * Update website/docs/providers/proxy/forward_auth.mdx Signed-off-by: Jens L. <jens@beryju.org> * fix lint error Signed-off-by: Jens Langhammer <jens@goauthentik.io> --------- Signed-off-by: Tana M Berry <tanamarieberry@yahoo.com> Signed-off-by: Jens L. <jens@beryju.org> Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Jens L <jens.langhammer@beryju.org> Co-authored-by: Jens Langhammer <jens@goauthentik.io>
157 lines
3.8 KiB
Plaintext
157 lines
3.8 KiB
Plaintext
---
|
|
title: Forward auth
|
|
---
|
|
|
|
import Tabs from "@theme/Tabs";
|
|
import TabItem from "@theme/TabItem";
|
|
|
|
Using forward auth uses your existing reverse proxy to do the proxying, and only uses the
|
|
authentik outpost to check authentication and authorization.
|
|
|
|
To use forward auth instead of proxying, you have to change a couple of settings.
|
|
In the Proxy Provider, make sure to use one of the Forward auth modes.
|
|
|
|
## Single application
|
|
|
|
Single application mode works for a single application hosted on its dedicated subdomain. This
|
|
has the advantage that you can still do per-application access policies in authentik.
|
|
|
|
## Domain level
|
|
|
|
To use forward auth instead of proxying, you have to change a couple of settings.
|
|
In the Proxy Provider, make sure to use the _Forward auth (domain level)_ mode.
|
|
|
|
This mode differs from the _Forward auth (single application)_ mode in the following points:
|
|
|
|
- You don't have to configure an application in authentik for each domain
|
|
- Users don't have to authorize multiple times
|
|
|
|
There are however also some downsides, mainly the fact that you **can't** restrict individual
|
|
applications to different users.
|
|
|
|
The only configuration difference between single application and domain level is the host you specify.
|
|
|
|
For single application, you'd use the domain which the application is running on, and only /outpost.goauthentik.io
|
|
is redirected to the outpost.
|
|
|
|
For domain level, you'd use the same domain as authentik.
|
|
|
|
:::info
|
|
_example-outpost_ is used as a placeholder for the outpost name.
|
|
_authentik.company_ is used as a placeholder for the authentik install.
|
|
_app.company_ is used as a placeholder for the external domain for the application.
|
|
_outpost.company_ is used as a placeholder for the outpost. When using the embedded outpost, this can be the same as _authentik.company_
|
|
:::
|
|
|
|
## Nginx
|
|
|
|
<Tabs
|
|
defaultValue="standalone-nginx"
|
|
values={[
|
|
{label: 'Standalone nginx', value: 'standalone-nginx'},
|
|
{label: 'Ingress', value: 'ingress'},
|
|
{label: 'Nginx Proxy Manager', value: 'proxy-manager'},
|
|
]}>
|
|
<TabItem value="standalone-nginx">
|
|
|
|
import NginxStandalone from "./_nginx_standalone.md";
|
|
|
|
<NginxStandalone />
|
|
|
|
</TabItem>
|
|
<TabItem value="ingress">
|
|
|
|
import NginxIngress from "./_nginx_ingress.md";
|
|
|
|
<NginxIngress />
|
|
|
|
</TabItem>
|
|
<TabItem value="proxy-manager">
|
|
|
|
import NginxProxyManager from "./_nginx_proxy_manager.md";
|
|
|
|
<NginxProxyManager />
|
|
|
|
</TabItem>
|
|
</Tabs>
|
|
|
|
## Traefik
|
|
|
|
<Tabs
|
|
defaultValue="standalone-traefik"
|
|
values={[
|
|
{label: 'Standalone traefik', value: 'standalone-traefik'},
|
|
{label: 'docker-compose', value: 'docker-compose'},
|
|
{label: 'Ingress', value: 'ingress'},
|
|
]}>
|
|
<TabItem value="standalone-traefik">
|
|
|
|
import TraefikStandalone from "./_traefik_standalone.md";
|
|
|
|
<TraefikStandalone />
|
|
|
|
</TabItem>
|
|
<TabItem value="docker-compose">
|
|
|
|
import TraefikCompose from "./_traefik_compose.md";
|
|
|
|
<TraefikCompose />
|
|
|
|
</TabItem>
|
|
<TabItem value="ingress">
|
|
|
|
import TraefikIngress from "./_traefik_ingress.md";
|
|
|
|
<TraefikIngress />
|
|
|
|
</TabItem>
|
|
</Tabs>
|
|
|
|
## Envoy (Istio)
|
|
|
|
:::info
|
|
Requires authentik 2022.6
|
|
:::
|
|
|
|
:::info
|
|
Support for this is still in preview, please report bugs on [GitHub](https://github.com/goauthentik/authentik/issues).
|
|
:::
|
|
|
|
:::info
|
|
If you are using Istio and Kubernetes, use the port number that is exposed for your cluster.
|
|
:::
|
|
|
|
<Tabs
|
|
defaultValue="envoy-istio"
|
|
values={[
|
|
{label: 'Envoy (Istio)', value: 'envoy-istio'},
|
|
]}>
|
|
<TabItem value="envoy-istio">
|
|
|
|
import EnvoyIstio from "./_envoy_istio.md";
|
|
|
|
<EnvoyIstio />
|
|
|
|
</TabItem>
|
|
</Tabs>
|
|
|
|
## Caddy
|
|
|
|
:::info
|
|
Requires authentik 2022.8
|
|
:::
|
|
|
|
<Tabs
|
|
defaultValue="caddy-standalone"
|
|
values={[
|
|
{label: 'Caddy (standalone)', value: 'caddy-standalone'},
|
|
]}>
|
|
<TabItem value="caddy-standalone">
|
|
|
|
import CaddyStandalone from "./_caddy_standalone.md";
|
|
|
|
<CaddyStandalone />
|
|
|
|
</TabItem>
|
|
</Tabs>
|