Adding basic authentication doesn't work

Traefik Traefik v2 (latest)
,
1

I can access my grafana dashboard when basic authentication is not setup in traefik, but when I add basic authentication then I can enter properly enter my basic authentication user name and password but once done it doesn't navigate to my grafana dashboard instead I am getting a blank screen.

Output of traefik version : ( What version of Traefik are you using? )

Version: 2.1.3
Codename: cantal
Go version: go1.13.6
Built: 2020-01-21T17:30:29Z
OS/Arch: linux/amd64

Here below the relevant part of my docker-compose.yml file (I have masked my LAN/WAN hostname):

 traefik:
    image: traefik
    container_name: "traefik"
    command:
      - "--log.level=DEBUG"
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      #- "--entrypoints.nodered.address=:1880"
      #- "--entrypoints.grafana.address=:3000"
      - "--certificatesresolvers.mytlschallenge.acme.tlschallenge=true"
      #  # - "--certificatesresolvers.mytlschallenge.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
      - "--certificatesresolvers.mytlschallenge.acme.email=janXXXXX@gmail.com"
      - "--certificatesresolvers.mytlschallenge.acme.storage=/letsencrypt/acme.json"
    ports:
      # The HTTP port
      - "80:80"
      - "443:443"
      #- "1880:1880"
      #- "3000:3000"
      # The Web UI (enabled by --api.insecure=true)
      - "8080:8080"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./letsencrypt:/letsencrypt"
  ...
  grafana:
    build: grafana 
    #ports:
    #  - "3000:3000"
    depends_on:
       - influxdb
    restart: always
    labels:
      - "traefik.enable=true"
    # HTTP (LAN) connection
      - "traefik.http.routers.grafana_lan.rule=Host(`MYLANHOSTNAME`) && PathPrefix(`/grafana`)"
      - "traefik.http.routers.grafana_lan.entrypoints=web"
      # Tell Traefik to use the port grafana to connect to `my-container`
      - traefik.http.services.grafana.loadbalancer.server.port=3000
    # HTTPS (WAN) connection
      - "traefik.http.routers.grafana_wan.rule=Host(`MYWANHOSTNAME/`) && PathPrefix(`/grafana`)"
      - "traefik.http.routers.grafana_wan.entrypoints=websecure"
      - "traefik.http.routers.grafana_wan.tls.certresolver=mytlschallenge"
      # middlewares
      - "traefik.http.routers.grafana_lan.middlewares=grafana_auth,strip_grafana_prefix"
      - "traefik.http.routers.grafana_wan.middlewares=grafana_auth,strip_grafana_prefix"
      # To create user:password pair, it's possible to use this command:
      # echo $(htpasswd -nb user password) | sed -e s/\\$/\\$\\$/g
      - "traefik.http.middlewares.grafana_auth.basicauth.users=jan:$$a....GVRIyw7up/"
      - "traefik.http.middlewares.strip_grafana_prefix.stripprefix.prefixes=/grafana"
      - "traefik.http.middlewares.strip_grafana_prefix.stripprefix.forceslash=false"
    environment:
      - GF_SERVER_ROOT_URL=https://MYWANHOSTNAME/grafana
      - GF_SERVER_DOMAIN=MYWANHOSTNAME/
3

Hello,

The basic auth works as expected but you have to remove auth header to avoid conflict with grafana auth.

https://docs.traefik.io/v2.1/middlewares/basicauth/#removeheader

version: "3.7"

services:
  traefik:
    image: traefik:v2.1.3
    command:
      - --log.level=INFO
      - --api.insecure=true
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
    ports:
      - 80:80
      - 443:443
      # The Web UI (enabled by --api.insecure=true)
      - 8080:8080
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt

  grafana:
    image: grafana/grafana:6.6.0 
    labels:
      traefik.enable: true

      # HTTP (LAN) connection
      traefik.http.routers.grafana_lan.rule: Host(`lan.localhost`) && PathPrefix(`/grafana`)
      traefik.http.routers.grafana_lan.entrypoints: web
      traefik.http.routers.grafana_lan.middlewares: grafana_auth,strip_grafana_prefix
      
      # HTTPS (WAN) connection
      # traefik.http.routers.grafana_wan.rule: Host(`wan.localhost`) && PathPrefix(`/grafana`)
      # traefik.http.routers.grafana_wan.entrypoints: websecure
      # traefik.http.routers.grafana_wan.tls: true
      # traefik.http.routers.grafana_wan.middlewares: grafana_auth,strip_grafana_prefix
      
      # Tell Traefik to use the port grafana to connect to `my-container`
      traefik.http.services.grafana.loadbalancer.server.port: 3000
      
      # middlewares
      traefik.http.middlewares.grafana_auth.basicauth.users: user:$$apr1$$q8eZFHjF$$Fvmkk//V6Btlaf2i/ju5n/ # user/password
      traefik.http.middlewares.grafana_auth.basicauth.removeheader: true
      traefik.http.middlewares.strip_grafana_prefix.stripprefix.prefixes: /grafana

    environment:
    - GF_SERVER_ROOT_URL=http://lan.localhost/grafana
1 Like
4

Thansk a lot !!

Adding the following line indeed fixed the problem:

- "traefik.http.middlewares.grafana_auth.basicauth.removeheader=true"