How to use my SSO system? #1553

New Issue

MrUnknownDE · 2026-04-05T19:34:18+02:00

MrUnknownDE commented

2026-04-05 19:34:18 +02:00

Originally created by @Rihan9 on 4/30/2025

Hi all,
I'd like to use my authalia installation on the other side of the tunnel, but I don't know how.

I setted up the middleware in this way:

{
  "address": "https://public.authelia.url.com/api/authz/forward-auth",
  "authResponseHeaders": [
    "Remote-User",
    "Remote-Groups",
    "Remote-Name",
    "Remote-Email"
  ],
  "trustForwardHeader": true
}

but the X-Forwarded headers got removed by traefik/badger/something so I can't really use it (francly, I prefer that endpoint can't be used from the public url)

I even tried this:

{
  "address": "http://authelia:9001/api/authz/forward-auth",
  "authResponseHeaders": [
    "Remote-User",
    "Remote-Groups",
    "Remote-Name",
    "Remote-Email"
  ],
  "trustForwardHeader": true
}

where authelia is the name of my docker container in the local machine, but the address http://authelia:9001 seems unreachable (I guess it cannot resolve the hostname).

Is there a way to do this?

Maybe a custom rule on traefik just to create a unguarded endpoint? Like "if the incoming traffic is from the local machine, and the urls is "authelia.alternative.url" then go to service-xxx mainteining the X-Forwarded headers"? Can I ask some help to made something like this, if possible?
I will not host authelia on my VPS.
I can not use the Pangolin Authentication system. My entire network system is mode so if the WAN connection is down, the server will be reachable and working without any issue (my smart home will collapse otherwise). Locally I have a dns rewritting and a caddy reverse proxy configurated and most of my services use SSO. Pangolin doesn't have a way to works like a SSO server and even if pangolin should one day have it,It may not be used locally.

*Originally created by @Rihan9 on 4/30/2025* Hi all, I'd like to use my authalia installation on the other side of the tunnel, but I don't know how. I setted up the middleware in this way: ``` { "address": "https://public.authelia.url.com/api/authz/forward-auth", "authResponseHeaders": [ "Remote-User", "Remote-Groups", "Remote-Name", "Remote-Email" ], "trustForwardHeader": true } ``` but the X-Forwarded headers got removed by traefik/badger/something so I can't really use it (francly, I prefer that endpoint can't be used from the public url) I even tried this: ``` { "address": "http://authelia:9001/api/authz/forward-auth", "authResponseHeaders": [ "Remote-User", "Remote-Groups", "Remote-Name", "Remote-Email" ], "trustForwardHeader": true } ``` where authelia is the name of my docker container in the local machine, but the address http://authelia:9001 seems unreachable (I guess it cannot resolve the hostname). Is there a way to do this? - Maybe a custom rule on traefik just to create a unguarded endpoint? Like "if the incoming traffic is from the local machine, and the urls is "authelia.alternative.url" then go to service-xxx mainteining the X-Forwarded headers"? Can I ask some help to made something like this, if possible? - I will not host authelia on my VPS. - I can not use the Pangolin Authentication system. My entire network system is mode so if the WAN connection is down, the server will be reachable and working without any issue (my smart home will collapse otherwise). Locally I have a dns rewritting and a caddy reverse proxy configurated and most of my services use SSO. Pangolin doesn't have a way to works like a SSO server and even if pangolin should one day have it,It may not be used locally.

MrUnknownDE closed this issue

2026-04-05 19:34:18 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1553