# Traefik v2.x force forwardauth for all

**URL:** <https://community.traefik.io/t/traefik-v2-x-force-forwardauth-for-all/15468>\
**Category:** Traefik v2\
**Tags:** kubernetes-ingress\
**Created:** [August 17, 2022, 12:34pm UTC](https://community.traefik.io/t/traefik-v2-x-force-forwardauth-for-all/15468 "2022-08-17T12:34:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![demigo](https://avatars.discourse-cdn.com/v4/letter/d/a3d4f5/32.png) [@demigo](https://community.traefik.io/u/demigo)\
**Post date:** [August 17, 2022, 12:34pm UTC](https://community.traefik.io/t/traefik-v2-x-force-forwardauth-for-all/15468/1 "2022-08-17T12:34:18Z")

</div>

Hi  
I used to work with traefik 1.x and succeded to route every request to my authenticator service by adding a setting to the configmap (see bellow my cm of v1.0)  
Now , I am on traefik 2.x and I want to force the traefik controller to route every request to my authenticator service but didn't found a way.  
I tried to add a middleware where the traefik is running but without a succeed

Can anyone elaborate - on what I need to config in my traefik v2.0 so the forwardauth will work for my running services?

Thx

```auto

apiVersion: v1
data:
  traefik.toml: |
    # traefik.toml
    logLevel = "info"
    defaultEntryPoints = ["http","https"]
    [entryPoints]
      [entryPoints.http]
      address = ":80"
      compress = true
        [entryPoints.http.auth.forward]
        address = "http://my-url-to-the-service"
        trustForwardHeader = true
        [entryPoints.http.redirect]
          regex = "^http://(.*)"
          replacement = "https://$1"
      [entryPoints.https]
      address = ":443"
      compress = true
        [entryPoints.https.auth.forward]
        address = "http://my-url-to-the-service"
        trustForwardHeader = true
        [entryPoints.https.tls]
          minVersion = "VersionTLS12"
          [[entryPoints.https.tls.certificates]]
          CertFile = "/ssl/tls.crt"
          KeyFile = "/ssl/tls.key"
      [entryPoints.prometheus]
      address = ":9100"
    [ping]
    entryPoint = "http"
    [kubernetes]
      [kubernetes.ingressEndpoint]
      publishedService = "kube-system/traefik"
    [traefikLog]
      format = "json"
    [metrics]
      [metrics.prometheus]
        entryPoint = "prometheus"

kind: ConfigMap
metadata:
   labels:
    app: traefik
    app.kubernetes.io/managed-by: Helm
    chart: traefik-1.81.0
    heritage: Helm
    release: traefik
  managedFields:
  - apiVersion: v
  name: traefik
  namespace: kube-system
  resourceVersion: "1910"
  selfLink: /api/v1/namespaces/kube-system/configmaps/traefik

```

---

<div class="post-metadata">

**Author:** ![kevinpollet](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/kevinpollet/32/1755_2.png) [@kevinpollet](https://community.traefik.io/u/kevinpollet)\
**Post date:** [August 19, 2022, 8:48am UTC](https://community.traefik.io/t/traefik-v2-x-force-forwardauth-for-all/15468/2 "2022-08-19T08:48:51Z")

</div>

Hello @demigo,

Thanks for your interest in Traefik,

To route every request to an authentication service (with the forward auth middleware) you can leverage EntryPoints middlewares as explained in the [documentation](https://doc.traefik.io/traefik/routing/entrypoints/#middlewares). Those middlewares will be prepended to the list of middlewares of each router attached to the EntryPoint.

This means that even if a router does not configure the forward auth middleware it will be applied by default.

Hope this helps!

---

<div class="post-metadata">

**Author:** ![demigo](https://avatars.discourse-cdn.com/v4/letter/d/a3d4f5/32.png) [@demigo](https://community.traefik.io/u/demigo)\
**Post date:** [August 21, 2022, 12:20pm UTC](https://community.traefik.io/t/traefik-v2-x-force-forwardauth-for-all/15468/3 "2022-08-21T12:20:38Z")

</div>

Hi  
Thx for your answer, I succeeded in sending my request to the auth service by creating a forwardauth middleware and add an annotation to my ingress or use it in ingressroutes.

I guess there is a better way as you explained regarding entrypoints so I will not need to edit every ingress but I don't understand where in my traefik (Kubernetes) do I need to to set it ?

Can you point me to the correct resource ? to just give an example ?

Thx

---

<div class="post-metadata">

**Author:** ![kevinpollet](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/kevinpollet/32/1755_2.png) [@kevinpollet](https://community.traefik.io/u/kevinpollet)\
**Post date:** [September 12, 2022, 7:57am UTC](https://community.traefik.io/t/traefik-v2-x-force-forwardauth-for-all/15468/4 "2022-09-12T07:57:27Z")

</div>

Hello @demigo,

Sorry for the late answer,

> I guess there is a better way as you explained regarding entrypoints so I will not need to edit every ingress but I don't understand where in my traefik (Kubernetes) do I need to to set it ?

The middleware configuration needs to be done in the static configuration as explained in the following [documentation](https://doc.traefik.io/traefik/routing/entrypoints/#middlewares).

In Kubernetes, this can be done in the deployment arguments or in the configmap containing the static configuration. If you are using the Traefik Helm chart this should be done through the [additionalArguments](https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml#L253) config option.

Hope this helps!