Need help with traefik-oidc-auth + pocket-id + healthchecks

[ovizii]

Btw. awesome plugin, I have managed to protect a few apps without their own authentication and am now attempting to get SSO kinda working via headers.

So first of all, traefik-oidc-auth + pocket-id are working fine and so is healthecks on its own. I need some hand-holding with the headers :-)

So healthchecks docs: https://healthchecks.io/docs/self_hosted_configuration/#REMOTE_USER_HEADER state:

When REMOTE_USER_HEADER is set, Healthchecks will:

in views that require authentication, look up the request header specified in REMOTE_USER_HEADER
assume the header contains the user's email address
automatically log in the user with a matching email address
automatically create a user account if it does not exist
disable the default authentication methods (login link to email, password)
The header name in REMOTE_USER_HEADER must be specified in upper-case, with any dashes replaced with underscores, and prefixed with HTTP_. For example, if your authentication proxy sets a X-Authenticated-User request header, you should set REMOTE_USER_HEADER=HTTP_X_AUTHENTICATED_USER.

So in the docker-compose.yml file of healthchecks I specified: REMOTE_USER_HEADER=HTTP_X_Forwarded_Email

Then I tried adding the right header configuration via traefik-oidc-auth. Like this:

http:
  middlewares:
    users-auth:
      plugin:
        traefik-oidc-auth:
          LogLevel: DEBUG
          Secret: "secret1"
          Provider:
            Url: "https://auth.domain.tld/"
            ClientId: "secret2"
            ClientSecret: "secret3"
            UsePkce: true
            TokenValidation: "IdToken" # Specifies which token or method should be used to validate the authentication cookie. Can be either AccessToken, IdToken or Introspection.
          Scopes: ["openid", "profile", "email", "groups"]
          Headers:
            - Name: "X-Forwarded-Email"
              Value: "{{`{{ .claims.email }}`}}"

What happens is that if I visit my healthchecks instance, I get asked to sign in via pocket-id and still end up on the login page of healthchecks.

Any hints for me please?

EDIT:

Figured it out. It was as simple as using ALL CAPS as instructed :-( I am leaving this here in case someone else googles the same thing. Feel free to use this as an example if you find it useful.

REMOTE_USER_HEADER=HTTP_X_FORWARDED_EMAIL
and
- Name: "X-FORWARDED-EMAIL"
needed to be in CAPS

Btw. I was inspired by this thread: #55 and this one pocket-id/pocket-id#228

[sevensolutions]

I didnt know healthchecks.io but this is a very cool thing with this REMOTE_USER_HEADER.
Glad that you were able to solve it by youtself.
Thx for sharing ❤️

[ovizii]

Of course, no problem. I mean I wrote all that long text and when I double-checked before submitting I read this. facepalm

The header name in REMOTE_USER_HEADER must be specified in upper-case, with any dashes replaced with underscores, and prefixed with HTTP_.

[ovizii]

Oh, I need to add a follow-up question you can maybe help with. I realized this, when I was trying to put another app behind traefik-oidc-auth + pocket-id using headers. => https://github.com/janeczku/calibre-web/wiki/Setup-Reverse-Proxy

I realized that logging in works fine but when logging out of an app, one is still logged in at the IDP, in my case pocket-id.

That link, has a sample solution to also log out simultaneously from your IDP, but their example is centred on authelia.

Do you have any idea how one could do that with pocket-id? IF not, I will ask the same question on pocket-id's project page.

Sample for authelia:

http:
  routers:
    calibre:
      service: calibre-web-calibre@docker
      rule: "Host(`library.domain`)"
      tls:
        certResolver: "yourCertResolver"
        domains:
          - main: "domain"
          - sans: "library.domain"
      middlewares:
        - authelia
        - calibre-logout
        
middlewares:
    calibre-logout:
      redirectRegex:
        regex: "https://library.domain/login"
        replacement: "https://auth.domain/logout?rd=https%3A%2F%2Flibrary.domain%2F&rm=GET"

[sevensolutions]

How do you log out? From PocketID's user interface or using the /logout-endpoint of the middleware?
Because i've fixed a bug today which made the logout not working when using PocketID.
#91

Version 0.8.0 should fix that.

[ovizii]

Sorry, I dropped the ball on this one. It was my mistake. I put calbre-web behind forward auth, so the logout I was referring to was the logout of calibre-web. I guess I need to redirect that one to Pocket ID's logout page: https://idp.domain.tld/api/oidc/end-session to solve my problem.

Anyway, logging out of calibre-web just works, and points to Pocket ID's logout page on its own, apparently. Logout works but another login, does not redirect back to calibre-web.

Anyway, that is not something out of scope here.