# Authentication failure with OAuth to Traefik dashboard **URL:** \ **Category:** Traefik v2\ **Tags:** docker\ **Created:** [September 27, 2020, 1:47am UTC](https://community.traefik.io/t/authentication-failure-with-oauth-to-traefik-dashboard/7910 "2020-09-27T01:47:44Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![wetling](https://avatars.discourse-cdn.com/v4/letter/w/f9ae1b/32.png) [@wetling](https://community.traefik.io/u/wetling)\ **Post date:** [September 27, 2020, 1:47am UTC](https://community.traefik.io/t/authentication-failure-with-oauth-to-traefik-dashboard/7910/1 "2020-09-27T01:47:44Z")
I am trying to get Traefik setup in a Docker and am having a heck of a time. Following [this guide](https://www.smarthomebeginner.com/traefik-2-docker-tutorial/) and using Cloudflare (DNS only to [trafeik.mydomain.com](https://trafeik.mydomain.com)), to connect, I am getting "This site can't be reached [oauth.mydomain.com](https://oauth.mydomain.com)'s server IP address could not be found". ```auto wget https://traefik.mydomain.com/dashboard` `--2020-09-26 19:19:38-- https://traefik.mydomain.com/dashboard` `Resolving traefik.mydomain.com (traefik.mydomain.com)... ` `Connecting to traefik.mydomain.com (traefik.mydomain.com)||:443... connected.` `HTTP request sent, awaiting response... 307 Temporary Redirect` `Location: https://accounts.google.com/o/oauth2/auth?client_id=6597174190-33npvgec044jtcrj4scmfgt561.apps.googleusercontent.com&prompt=select_account&redirect_uri=https%3A%2F%2Foauth.mydomain.com%2F_oauth&response_type=code&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.profile+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email&state=fc4c85a1e11f4914247d1e7c95b031%3Agoogle%3Ahttps%3A%2F%2Ftraefik.mydomain.com%2Fdashboard [following]` `--2020-09-26 19:19:38-- https://accounts.google.com/o/oauth2/auth?client_id=6597114190-33npkhvge44jtcrj4scmuafgt561.apps.googleusercontent.com&prompt=select_account&redirect_uri=https%3A%2F%2Foauth.mydomain.com%2F_oauth&response_type=code&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.profile+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email&state=fc4c85a1e11f4914247d1e7c94a5b031%3Agoogle%3Ahttps%3A%2F%2Ftraefik.mydomain.com%2Fdashboard` `Resolving accounts.google.com (accounts.google.com)... 172.217.1.205, 2607:f8b0:400f:805::200d` `Connecting to accounts.google.com (accounts.google.com)|172.217.1.205|:443... connected.` `HTTP request sent, awaiting response... 302 Moved Temporarily` `Location: https://accounts.google.com/AccountChooser?oauth=1&continue=https%3A%2F%2Faccounts.google.com%2Fsignin%2Foauth%2Flegacy%2Fconsent%3Fauthuser%3Dunknown%26part%3DAJi8hAPSHE1cMVuaeTQ61pcXpMEfDhbxN02IAjg5jH0GYWG7yCVc5EC9ug_kuK3j7hUBGCiY_q_SGL-0xSPDtiliIthwpmOTvP_MV5upFvDdYTpTTlraXSxx_7f8vhJteA8UjJoKSqgeUvFWns_BdFn8z73XALchawMrWA1vVl0xJYpUYHUXxD3K0zl4TbcgpVOljSfZM0vkQAHwTm54OjNiw51GTMCJAwiGwh_ANodLXY1n07UrO6-AgJ1pEeRksrlKs-O2W2Az1Fj4QWMej3OJ8HiHfRVlBt8c8zStbROoFMIce9ldHm5FF-l54b3xQcBp4xLi6ABqcrciv_Y0TAFuuwwotfgqrl1_uMHfyX9KJogk_gntcEiG2489OMNwFinOVAPUCg1Z-gn-ps7g_oBl4MB-FzsIiVpfyy_qRD7SMyhvnVe4Bj-%26as%3DS-2012888342%253A160116957872%23 [following]` `--2020-09-26 19:19:38-- https://accounts.google.com/AccountChooser?oauth=1&continue=https%3A%2F%2Faccounts.google.com%2Fsignin%2Foauth%2Flegacy%2Fconsent%3Fauthuser%3Dunknown%26part%3DAJi8hAPSk6oHE1cMVRfegIuaeTQ61pcXpMEfD2FXah02IAjg5GYWG7yCVc5EC9ug_kuK3j7hUBGCiY_q_SGL-0xSPDtiliIthwpmOTvP_MV5upFvDdYTpTTSxx_7f8vhJteA8UjJoKSqgeUvFWns_BdFn8z73XALchawMrWA1vVXbAl0xJYpUYHUXzl4TbcgpVOljSfZM0vkQAHwTmhD54OjNiw51GTMCJAwiGwh_ANodLXY1n07UrO6-AgJ1pEeRksrlKs-O2W2Az1Fj4QWMej3OJ8HiHfRVlBt8c8zStbROoFMIce9ldHm5FF-l54b3xQcBpABqcrciv_Y0TAFuuwwotfgqrl1_uMHfyX9KJogk_gntcEiG2489OMNwFAPUCg1Z-gn-ps7g_oBl4MB-FzsIiVpfyy_qRDBteJ7SMyhvnVe4Bj-%26as%3DS-2012888342%253A1601169578900872%23` `Reusing existing connection to accounts.google.com:443.` `HTTP request sent, awaiting response... 302 Moved Temporarily` `Location: https://accounts.google.com/ServiceLogin?continue=https%3A%2F%2Faccounts.google.com%2Fsignin%2Foauth%2Flegacy%2Fconsent%3Fauthuser%3Dunknown%26part%3DAJi8hAPSkE1cMVRIuaeTQ61ppMEfD2FXahbxN02IAjg5jH0GYWG7yCVc5EC9ug_kuK3j7hUBGCiY_q_SGL-0xSPDtiliIthwpmOTvP_MV5upFvDdYTpTTlraXSxx_7f8vhJteA8UjJoKSqgs_BdFn8z73XALchawMrWA1vVXbAl0xJYpUYHUXxD3K0zl4TbcgpVOljSfZM0vkQAHwTmhD54OjNiw51GTMCJAwiGwh_ANodLXY1n07UrO6-AgJ1pEeRksrlKs-O2W2Az1Fj4QWMej3OJ8HiHBt8c8zStbROoFMIce9ldHm5FF-l54b3xQcBp4xLi6ABqcrciv_Y0TAFuuwwotfgqrl1_uMHfyX9KJntcEiG2489OMNwFinOVAPUCg1Z-gn-ps7g_oBl4MB-FzsIiVpfyy_qRDBteJ7SMyhvnVe4Bj-%26as%3DS-2012888342%253A1601178900872%23&sacu=1&oauth=1&rip=1 [following]` `--2020-09-26 19:19:39-- https://accounts.google.com/ServiceLogin?continue=https%3A%2F%2Faccounts.google.com%2Fsignin%2Foauth%2Flegacy%2Fconsent%3Fauthuser%3Dunknown%26part%3DAJi8hAPSk6ogIuaeTQ61pcXpMEfD2FXahbxN02IAjg5jH0GYWG7yCVc5EC9ug_kuK3j7hUBGCiY_q_SGL-0xSPDtiliIthwpmOTvP_MV5upFvDdYTpTTlraXSxx_7f8vhJteA8UjJoKSqgeUvFWns_BdFn8z73XALchawMrWA1vVXbAl0xJYpUYHUXxD3K0zl4jSfZM0vkQAHwTmhD54OjNiw51GTMCJAwiGwh_ANodLXY1n07UrO6-AgJ1pEeRksrlKs-O2W2Az1Fj4QWMej3OVlBt8c8zStbROoFMIce9ldHm5FF-l54b3xQcBp4xLi6ABqcrciv_Y0TAFuuwwotfgqrl1_uKJogk_gntcEiG2489OMNwFinOVAPUCg1Z-gn-ps7g_oBl4MB-FzsIiVpfyy_qRDBteJ7SMyhvnVe4Bj-%26as%3DS-2012888342%253A1601169578900872%23&sacu=1&oauth=1&rip=1` `Reusing existing connection to accounts.google.com:443.` `HTTP request sent, awaiting response... 200 OK` `Length: unspecified [text/html]` `Saving to: ‘dashboard.1’` `` `dashboard.1 [<=>] 58.82K --.-KB/s in 0.03s ` `` `2020-09-26 19:19:39 (1.64 MB/s) - ‘dashboard.1’ saved [60236] ``` The Docker log says: > level=debug msg="Remote error [http://oauth:4181](http://oauth:4181). StatusCode: 307" middlewareType=ForwardedAuthType middlewareName=middlewares-oauth@file This is my docker-compose.yml file: ```auto version: "3.3" ########################### NETWORKS networks: t2_proxy: external: name: t2_proxy default: driver: bridge ########################### SERVICES services: # All services / apps go below this line # Traefik 2 - Reverse Proxy traefik: container_name: traefik image: traefik:chevrotin # the chevrotin tag refers to v2.2.x but introduced a breaking change in 2.2.2 restart: unless-stopped command: # CLI arguments - --global.checkNewVersion=true - --global.sendAnonymousUsage=false - --entryPoints.http.address=:80 - --entryPoints.https.address=:443 # Allow these IPs to set the X-Forwarded-* headers - Cloudflare IPs: https://www.cloudflare.com/ips/ - --entrypoints.https.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/12,172.64.0.0/13,131.0.72.0/22 - --entryPoints.traefik.address=:8080 - --api=true # - --api.insecure=true # - --serversTransport.insecureSkipVerify=true - --log=true - --log.level=DEBUG # (Default: error) DEBUG, INFO, WARN, ERROR, FATAL, PANIC - --accessLog=true - --accessLog.filePath=/traefik.log - --accessLog.bufferingSize=100 # Configuring a buffer of 100 lines - --accessLog.filters.statusCodes=400-499 - --providers.docker=true - --providers.docker.endpoint=unix:///var/run/docker.sock - --providers.docker.defaultrule=Host(`{{ index .Labels "com.docker.compose.service" }}.$DOMAINNAME`) - --providers.docker.exposedByDefault=false - --providers.docker.network=t2_proxy - --providers.docker.swarmMode=false - --providers.file.directory=/rules # Load dynamic configuration from one or more .toml or .yml files in a directory. # - --providers.file.filename=/path/to/file # Load dynamic configuration from a file. - --providers.file.watch=true # Only works on top level files in the rules folder # - --certificatesResolvers.dns-cloudflare.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory # LetsEncrypt Staging Server - uncomment when testing - --certificatesResolvers.dns-cloudflare.acme.email=$CLOUDFLARE_EMAIL - --certificatesResolvers.dns-cloudflare.acme.storage=/acme.json - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.provider=cloudflare - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.resolvers=1.1.1.1:53,1.0.0.1:53 # networks: # t2_proxy: # ipv4_address: 192.168.90.254 # You can specify a static IP networks: - t2_proxy security_opt: - no-new-privileges:true ports: - target: 80 published: 80 protocol: tcp mode: host - target: 443 published: 443 protocol: tcp mode: host - target: 8080 published: 8080 protocol: tcp mode: host volumes: - $DOCKERDIR/traefik2/rules:/rules - /var/run/docker.sock:/var/run/docker.sock:ro - $DOCKERDIR/traefik2/acme/acme.json:/acme.json # cert location - you must touch this file and change permissions to 600 - $DOCKERDIR/traefik2/traefik.log:/traefik.log # for fail2ban - make sure to touch file before starting container - $DOCKERDIR/shared:/shared environment: - CF_API_EMAIL=$CLOUDFLARE_EMAIL - CF_API_KEY=$CLOUDFLARE_API_KEY labels: - "traefik.enable=true" # HTTP-to-HTTPS Redirect - "traefik.http.routers.http-catchall.entrypoints=http" - "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)" - "traefik.http.routers.http-catchall.middlewares=redirect-to-https" - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https" # HTTP Routers - "traefik.http.routers.traefik-rtr.entrypoints=https" - "traefik.http.routers.traefik-rtr.rule=Host(`traefik.$DOMAINNAME`)" - "traefik.http.routers.traefik-rtr.tls=true" # - "traefik.http.routers.traefik-rtr.tls.certResolver=dns-cloudflare" # Comment out this line after first run of traefik to force the use of wildcard certs - "traefik.http.routers.traefik-rtr.tls.domains[0].main=$DOMAINNAME" - "traefik.http.routers.traefik-rtr.tls.domains[0].sans=*.$DOMAINNAME" # - "traefik.http.routers.traefik-rtr.tls.domains[1].main=$SECONDDOMAINNAME" # Pulls main cert for second domain # - "traefik.http.routers.traefik-rtr.tls.domains[1].sans=*.$SECONDDOMAINNAME" # Pulls wildcard cert for second domain ## Services - API - "traefik.http.routers.traefik-rtr.service=api@internal" ## Middlewares - "traefik.http.routers.traefik-rtr.middlewares=chain-oauth@file" # Google OAuth - Single Sign On using OAuth 2.0 oauth: container_name: oauth image: thomseddon/traefik-forward-auth:latest restart: unless-stopped networks: - t2_proxy security_opt: - no-new-privileges:true environment: - CLIENT_ID=$GOOGLE_CLIENT_ID - CLIENT_SECRET=$GOOGLE_CLIENT_SECRET - SECRET=$OAUTH_SECRET - COOKIE_DOMAIN=$DOMAINNAME - INSECURE_COOKIE=false - AUTH_HOST=oauth.$DOMAINNAME - URL_PATH=/_oauth - WHITELIST=$MY_EMAIL - LOG_LEVEL=debug - LOG_FORMAT=text - LIFETIME=2592000 # 30 days - DEFAULT_ACTION=auth - DEFAULT_PROVIDER=google labels: - "traefik.enable=true" ## HTTP Routers - "traefik.http.routers.oauth-rtr.entrypoints=https" - "traefik.http.routers.oauth-rtr.rule=Host(`oauth.$DOMAINNAME`)" - "traefik.http.routers.oauth-rtr.tls=true" ## HTTP Services - "traefik.http.routers.oauth-rtr.service=oauth-svc" - "traefik.http.services.oauth-svc.loadbalancer.server.port=4181" ## Middlewares - "traefik.http.routers.oauth-rtr.middlewares=chain-oauth@file" ``` Finally, the end of my middlewares.toml file looks like this: ```auto [http.middlewares.middlewares-oauth] [http.middlewares.middlewares-oauth.forwardAuth] address = "http://oauth:4181" # Make sure you have the OAuth service in docker-compose.yml trustForwardHeader = true authResponseHeaders = ["X-Forwarded-User"] ``` I searched around and checked everything I found already suggested but no luck. Seems like it's gotta be something small though. ---
**Author:** ![wetling](https://avatars.discourse-cdn.com/v4/letter/w/f9ae1b/32.png) [@wetling](https://community.traefik.io/u/wetling)\ **Post date:** [September 27, 2020, 9:25pm UTC](https://community.traefik.io/t/authentication-failure-with-oauth-to-traefik-dashboard/7910/2 "2020-09-27T21:25:37Z")
In Cloudflare, I changed [oauth.mydomain.com](https://oauth.mydomain.com/) from "Proxied" to "DNS Only" and now I am no longer getting redirected. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\ **Post date:** [September 30, 2020, 9:25pm UTC](https://community.traefik.io/t/authentication-failure-with-oauth-to-traefik-dashboard/7910/3 "2020-09-30T21:25:40Z")
This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.