I am unable to troubleshoot why basic auth does not work in my experimental setup. I am planning to use traefik with docker swarm and so far I have a few problems. This post is about understanding how to troubleshoot why the basic authentication fails. Notice i checked several other posts and also online on IRC with some other peeps, while the only suspect is the hash I am indeed using the apache encoding as documented and still keeps failing
My docker compose
version: '3'
services:
traefik:
image: traefik:v2.3
ports:
# The HTTP port
- "80:80"
# The Web UI (enabled by --api.insecure=true)
# - "8080:8080"
- "443:443"
command:
- "--log.level=DEBUG"
- "--global.sendAnonymousUsage=true"
# Docker swarm configuration
- "--providers.docker"
- "--providers.docker.endpoint=unix:///var/run/docker.sock"
- "--providers.docker.swarmMode=true"
- "--providers.docker.exposedbydefault=false"
- "--providers.docker.network=public"
# Configure entrypoint
- "--entrypoints.websecure.address=:443"
- "--entrypoints.web.address=:80"
# SSL configuration
- "--certificatesresolvers.letsencryptresolver.acme.httpchallenge=true"
- "--certificatesresolvers.letsencryptresolver.acme.httpchallenge.entrypoint=web"
- "--certificatesresolvers.letsencryptresolver.acme.email=${LETS_ENCRYPT_EMAIL}"
- "--certificatesresolvers.letsencryptresolver.acme.storage=/letsencrypt/acme.json"
# Global HTTP -> HTTPS
- "--entrypoints.web.http.redirections.entryPoint.to=websecure"
- "--entrypoints.web.http.redirections.entryPoint.scheme=https"
# Enable dashboard/api
- "--api.dashboard=true"
- "--api.debug=true"
- "--api.insecure=false"
volumes:
# To persist certificates
- traefik-certificates:/letsencrypt
# So that Traefik can listen to the Docker events
- /var/run/docker.sock:/var/run/docker.sock:ro
networks:
- public
deploy:
placement:
constraints:
- node.role == manager
labels:
- "traefik.enable=true"
- "traefik.http.services.traefik.loadbalancer.server.port=888" # required by swarm but not used.
- "traefik.http.routers.traefik.rule=Host(`${TRAEFIK_URL}`) "
- "traefik.http.routers.traefik.entrypoints=websecure"
- "traefik.http.routers.traefik.tls.certresolver=letsencryptresolver"
- "traefik.http.routers.traefik.service=api@internal"
- "traefik.http.routers.traefik.middlewares=traefik-auth"
- "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_BASIC_AUTH_USERS}"
volumes:
traefik-certificates:
networks:
public:
external: true
How i initialise the service
LETS_ENCRYPT_EMAIL=awesomeEmail@bizmate.biz TRAEFIK_URL="traefik202101.amazingDomain.space" TRAEFIK_BASIC_AUTH_USERS="admin:$$apr1$$kfY9ggNB$$DMuIKOae8f6VBU36bMCyW0" DOCKER_HOST=ssh://swarm202101.amazingDomain.space docker stack deploy traefik -c traefik.yml
Creating service traefik_traefik
How i generate the hash, as you can see simple admin and password used, these are the literal values
echo $(htpasswd -nb admin password) | sed -e s/\\$/\\$\\$/g
admin:$$apr1$$kfY9ggNB$$DMuIKOae8f6VBU36bMCyW0
Now what i see when i open the traefik domain
If i open traefik domain i get
somehow the prompt is served by a non SSL page.
Then if i try to authenticate with admin and password i get
traefik_traefik.1.oook13dgppd6@amazigApp-infra-swarm-manager-0 | time="2021-02-02T09:54:31Z" level=debug msg="Authentication failed" middlewareName=traefik-auth@docker middlewareType=BasicAuth
traefik_traefik.1.oook13dgppd6@amazigApp-infra-swarm-manager-0 | time="2021-02-02T09:54:34Z" level=debug msg="Authentication failed" middlewareType=BasicAuth middlewareName=traefik-auth@docker
I can also see lets encrypt acme works and the basic auth is setup as such
traefik_traefik.1.oook13dgppd6@amazigApp-swarm-manager-0 | time="2021-02-02T09:57:30Z" level=debug msg="Configuration received from provider docker: {\"http\":{\"routers\":{\"traefik\":{\"entryPoints\":[\"websecure\"],\"middlewares\":[\"traefik-auth\"],\"service\":\"api@internal\",\"rule\":\"Host(`traefik202101.awesomedomain.space`) \",\"tls\":{\"certResolver\":\"letsencryptresolver\"}}},\"services\":{\"traefik\":{\"loadBalancer\":{\"servers\":[{\"url\":\"http://10.0.1.3:888\"}],\"passHostHeader\":true}}},\"middlewares\":{\"traefik-auth\":{\"basicAuth\":{\"users\":[\"admin:31235apr131235kfY9ggNB31235DMuIKOae8f6VBU36bMCyW0\"]}}}},\"tcp\":{},\"udp\":{}}" providerName=docker
traefik_traefik.1.oook13dgppd6@amazigApp-infra-swarm-manager-0 | time="2021-02-02T09:57:30Z" level=info msg="Skipping same configuration" providerName=docker
In the above i see the dollar sign shows as 31235 .... in other tests it also showed in logs as another set of numbers. But really i cannot figure out what is wrong. When i enter the user and password i get to the 401 error page and this is successfully served with SSL
I do not have anything special in between like other proxies and or other solutions that would strip and modify information/headers etc.
Any suggestions?
The full log from the service can be seen here Dropbox - traefik.logs - Simplify your life
