# Using Traefik with Authelia as middleware/authenticator, I get no login screen **URL:** \ **Category:** Traefik v2\ **Tags:** docker\ **Created:** [April 11, 2023, 8:59am UTC](https://community.traefik.io/t/using-traefik-with-authelia-as-middleware-authenticator-i-get-no-login-screen/18207 "2023-04-11T08:59:47Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Isegrimm](https://avatars.discourse-cdn.com/v4/letter/i/57b2e6/32.png) [@Isegrimm](https://community.traefik.io/u/Isegrimm)\ **Post date:** [April 11, 2023, 8:59am UTC](https://community.traefik.io/t/using-traefik-with-authelia-as-middleware-authenticator-i-get-no-login-screen/18207/1 "2023-04-11T08:59:47Z")
Hi, I'm not sure if I can ask questions like this here. Please close it if it's inappropiate. **The setup is this:** - One dockerhost, running dockers for Kibana/Elasticsearch, Traefik and Authelia - Configuration is without labels (because I want to use this reverse proxy configuration (when it finally works) for other setups that don't run on dockers) - Two dockerfiles (one for Kibana/Elasticsearch and one for Traefik/Authelia). Kibana is accessible to Traefik on the docker network. I only include the dockerfile for Traefik/Authelia because I don't suspect the accessibilty of Kibana to be an issue, and to keep focus on what I think is the problem (Traefik configuration). **I want the following to happen:** - User opens url [https://dockerhost.company.local:5601/](https://dockerhost.company.local:5601/) - User is presented with a login window of Authelia - After succesful (single-factor) authentication, Kibana appears **What happens:** If I enable the middleware so that Authelia should jump in when I go to [https://dockerhost.company.local:5601/](https://dockerhost.company.local:5601/), I get an 401 unauthorized in the browser. - Log in Traefik: `Remote error ``http://authelia:9091/api/verify``. StatusCode: 401" middlewareName=auth@file middlewareType=ForwardedAuthType` - Log in Authelia: `"Access to ``https://dockerhost.company.local:5601/`` (method GET) is not authorized to user , responding with status code 401" method=GET path=/api/verify remote_ip=10.2.120.251` It makes sense that the user 'anonymous' is not authorized, but I don't get a login prompt to authenticate in the first place. **What I tried for troubleshooting:** - Kibana is accessible through Traefik if I disable the middleware - Authelia works and is able to authenticate if I access it directly I've been trying to get this to work for the last week, but I can't figure out what goes wrong. What am I missing? Anyone know what's wrong in this config? **Dockerfile for Traefik/Authelia:** ```auto version: '3.8' services: traefik: image: traefik container_name: kibana_traefik command: - "--api=true" - "--api.insecure=true" - "--api.dashboard=true" - "--entrypoints.kibana-entrypoint.address=:5601" - "--providers.file.filename=/traefik-config/dynamic.toml" - "--providers.file.watch=true" - "--log.level=DEBUG" ports: - "8080:8080" - "5601:5601" volumes: - "/var/run/docker.sock:/var/run/docker.sock:ro" - ./traefik-config:/traefik-config networks: - ods_dev_bridge_network depends_on: - authelia restart: unless-stopped authelia: container_name: kibana_authelia image: authelia/authelia:latest volumes: - ./authelia-config:/config ports: - "9091:9091" networks: - ods_dev_bridge_network restart: unless-stopped networks: ods_dev_bridge_network: external: true ``` **Authelia configuration.yml** ```auto server.port: 9091 log.level: debug jwt_secret: insecure_secret authentication_backend: ldap: implementation: activedirectory url: ldap://ldapserver.company.local timeout: 5s start_tls: false base_dn: DC=company,DC=local # additional_users_dn: OU=Users,OU=COMPANY users_filter: (&(|({username_attribute}={input})({mail_attribute}={input}))(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!pwdLastSet=0)) username_attribute: sAMAccountName mail_attribute: mail display_name_attribute: displayName groups_filter: (&(member:1.2.840.113556.1.4.1941:={dn})(objectClass=group)(objectCategory=group)) group_name_attribute: cn permit_referrals: false permit_unauthenticated_bind: false user: CN=dockeruser_sa,OU=ServiceAccounts,OU=Users,OU=COMPANY,DC=company,DC=local password: totp: disable: true session: name: authelia_session domain: company.local same_site: lax secret: unsecure_session_secret expiration: 1h inactivity: 5m remember_me_duration: 1M storage: encryption_key: a_very_important_secret local: path: /config/db.sqlite3 access_control: default_policy: one_factor rules: - domain: dockerhost.company.local policy: one_factor notifier: filesystem: filename: /var/lib/authelia/emails.txt ``` **Traefik dynamic.toml:** ```auto [http.routers] [http.routers.kibana] entryPoints = ["kibana-entrypoint"] rule = "Host(`dockerhost.company.local`)" service = "kibana-service" middlewares = ["auth@file"] [http.routers.kibana.tls] [http.services] [http.services.kibana-service] [[http.services.kibana-service.loadBalancer.servers]] url = "http://kibana:5601/" [http.middlewares] [http.middlewares.auth.forwardAuth] address = "http://authelia:9091/api/verify" trustForwardHeader = true authResponseHeaders = ["Remote-User", "Remote-Groups", "Remote-Name", "Remote-Email"] ``` ---
**Author:** ![Isegrimm](https://avatars.discourse-cdn.com/v4/letter/i/57b2e6/32.png) [@Isegrimm](https://community.traefik.io/u/Isegrimm)\ **Post date:** [April 18, 2023, 3:15pm UTC](https://community.traefik.io/t/using-traefik-with-authelia-as-middleware-authenticator-i-get-no-login-screen/18207/2 "2023-04-18T15:15:36Z")
To answer my own question, after help from the guy who maintains Authelia I've been able to figure out what I was missing. The thing that I didn't get was the URL used in the middleware part. First of all it needs an `rd` parameter, but I got stuck on the content of that parameter. Turns out it should refer to itself, like so: address = "[http://authelia:9091/api/verify?rd=https://dockerhost.company.nl:9091/](http://authelia:9091/api/verify?rd=https://dockerhost.company.nl:9091/)" Both URLs point to Authelia, first one is internal, second is external. Because of the external URL, Authelia needs a router+service as well. This is the end result regarding the Traefik dynamic config: ```auto [http.routers] [http.routers.kibana-router] entryPoints = ["kibana-entrypoint"] rule = "Host(`dockerhost.company.local`)" service = "kibana-service" middlewares = "auth" [http.routers.kibana-router.tls] [http.routers.authelia-router] entryPoints = ["authelia-entrypoint"] rule = "Host(`dockerhost.company.local`)" service = "authelia-service" [http.routers.authelia-router.tls] [http.services] [http.services.kibana-service] [[http.services.kibana-service.loadBalancer.servers]] url = "http://kibana:5601/" [http.services.authelia-service] [[http.services.authelia-service.loadBalancer.servers]] url = "http://authelia:9091/" [http.middlewares] [http.middlewares.auth.forwardAuth] address = "http://authelia:9091/api/verify?rd=https://dockerhost.company.local:9091/" trustForwardHeader = true authResponseHeaders = ["Remote-User", "Remote-Groups", "Remote-Name", "Remote-Email"] ``` With this config Traefik calls Authelia for authentication, and after success authentication it returns to the original url and serves Kibana. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\ **Post date:** [April 21, 2023, 3:16pm UTC](https://community.traefik.io/t/using-traefik-with-authelia-as-middleware-authenticator-i-get-no-login-screen/18207/3 "2023-04-21T15:16:21Z")
This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.