Integrating Traefik with Oathkeeper #899
Answered
by
dduzgun-security
dduzgun-security
asked this question in
Q&A
-
|
Hi all 👋 , I am having difficulties connecting Oathkeeper decisional API to Traefik using the Traefik configuration (docker-compose.yml)traefik:
image: "traefik:2.5"
hostname: "traefik"
command:
[
"--log.level=INFO",
"--accesslog",
"--api.insecure=true",
"--providers.docker=true",
"--providers.docker.exposedbydefault=false",
"--entrypoints.web.address=:443",
"--certificatesresolvers.myresolver.acme.tlschallenge=true",
"[email protected]",
"--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
]
ports:
- "443:443"
- "8080:8080"
volumes:
- "../config/letsencrypt:/letsencrypt"
- "/var/run/docker.sock:/var/run/docker.sock:ro"
labels:
- "traefik.enable=true"
- "traefik.http.routers.traefik.rule=Host(`${TRAEFIK_HOST:-traefik.local}`)"
# Needs to be explicit due to multiple port exposure by the image
- traefik.http.services.traefik.loadbalancer.server.port=8080
- "traefik.http.middlewares.traefik-forward-auth.forwardauth.address=https://auth.local/oathkeeper"
- "traefik.http.middlewares.traefik-forward-auth.forwardauth.authResponseHeaders=X-Forwarded-User"
- "traefik.http.middlewares.traefik-forward-auth.forwardauth.trustForwardHeader=true"
restart: "${EXTERNAL_SERVICES_RESTART_POLICY:-always}"Oathkeeper configuration (docker-compose.yml)oathkeeper:
image: oryd/oathkeeper:v0.38.15-alpine
depends_on:
- kratos
- hydra
command:
serve proxy -c "/etc/config/oathkeeper/oathkeeper.yml"
environment:
- LOG_LEVEL=debug
volumes:
-
type: bind
source: ${PWD}/../config/ory/oathkeeper
target: /etc/config/oathkeeper
ports:
# - "4455" # Proxy port
- "4456" # API port
restart: on-failure
labels:
- "traefik.enable=true"
- "traefik.http.routers.oathkeeper.rule=(Host(`auth.local`) && PathPrefix(`/oathkeeper`))"
- "traefik.http.middlewares.oathkeeper-stripprefix.stripprefix.prefixes=/oathkeeper"
- "traefik.http.routers.oathkeeper.middlewares=oathkeeper-stripprefix@docker"
- "traefik.http.services.oathkeeper.loadbalancer.server.port=4456"
- "traefik.http.routers.oathkeeper.tls.certresolver=myresolver"Oathkeeper configuration (oathkeeper.yml)serve:
proxy:
port: 4455 # run the proxy at port 4455
api:
port: 4456 # run the api at port 4456
access_rules:
matching_strategy: regexp
repositories:
- file:///etc/config/oathkeeper/access-rules.json
errors:
fallback:
- json
handlers:
json:
enabled: true
config:
verbose: true
redirect:
enabled: true
config:
to: https://auth.local/login
when:
-
error:
- unauthorized
- forbidden
request:
header:
accept:
- text/html
- application/json
mutators:
header:
enabled: true
config:
headers:
X-Forwarded-User: "{{ print .Subject }}"
noop:
enabled: true
id_token:
enabled: true
config:
issuer_url: https://auth.local/oathkeeper
jwks_url: file:///etc/config/oathkeeper/jwks.json
claims: |
{
"session": {{ .Extra | toJson }}
}
authorizers:
allow:
enabled: true
deny:
enabled: true
authenticators:
anonymous:
enabled: true
config:
subject: guest
noop:
enabled: true
cookie_session:
enabled: true
config:
check_session_url: https://auth.local/kratos/sessions/whoami
preserve_path: true
extra_from: "@this"
subject_from: "identity.id"
only:
- ory_kratos_sessionAccess rules (access-rules.json)[
{
"id": "ory:kratos:public",
"match": {
"url": "https://auth.local/kratos/<.*>",
"methods": [
"GET",
"POST",
"PUT",
"PATCH",
"DELETE"
]
},
"authenticators": [
{
"handler": "noop"
}
],
"authorizer": {
"handler": "allow"
},
"mutators": [
{
"handler": "noop"
}
]
},
{
"id": "ory:authry:anonymous",
"match": {
"url": "https://auth.local/<error<.*>|settings<.*>|recovery<.*>|verify<.*>|login<.*>|register<.*>>",
"methods": [
"GET",
"POST",
"PUT",
"PATCH",
"DELETE"
]
},
"authenticators": [
{
"handler": "noop"
}
],
"authorizer": {
"handler": "allow"
},
"mutators": [
{
"handler": "noop"
}
]
},
{
"id": "ory:authry:protected",
"match": {
"url": "https://auth.local/<debug|dashboard|settings|profile|robots.txt>",
"methods": [
"GET",
"POST",
"PUT",
"PATCH",
"DELETE"
]
},
"authenticators": [
{
"handler": "cookie_session"
}
],
"authorizer": {
"handler": "allow"
},
"mutators": [
{
"handler": "header"
}
]
}
]I am thinking that the issue is between Traefik and Oathkeeper but it can be my conf too. Thanks |
Beta Was this translation helpful? Give feedback.
Answered by
dduzgun-security
Feb 14, 2022
Replies: 2 comments 6 replies
-
|
Sorry to hear you're having trouble! It's been a while but there was a thread on Traefik here: #263 Do you have any error logs you could share that could point towards what's going wrong? |
Beta Was this translation helpful? Give feedback.
6 replies
-
|
I have hit the same wall here. How would I use the next gen branch as a docker container? |
Beta Was this translation helpful? Give feedback.
-
|
@designermonkey In the docker-compose file, you can specify to build the Dockerfile of the oathkeeper:
image: oathkeeper-next-gen-branch
build: https://raw.githubusercontent.com/ory/oathkeeper/next-gen/Dockerfile
# ... |
Beta Was this translation helpful? Give feedback.
-
|
Great I'll give that a go, thanks. |
Beta Was this translation helpful? Give feedback.
-
|
Error logs from traefik |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
This merge solves it : #904 |
Beta Was this translation helpful? Give feedback.
0 replies
Answer selected by
dduzgun-security
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
This merge solves it : #904