![r/selfhosted icon](data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" width="256" height="256"><rect fill-opacity="0"/></svg>){kind=small}
SWAG(NGINX) & Authentik OAuth2
Hey all,
I have been using SWAG and Authentik to secure my server's applications for external access and it's been working well. I wanted to make some quality-of-life tweaks by adding OIDC. I previously had Authentik setup with each application provider set to Forward Auth Proxy (Single Application) and routed it through Authentik's outpost. This works as intended. When I switch the provider to OAuth2 for OIDC, the logs show 404 errors. If I test locally and replace my subdomain entries in Authentik with my local IP and application ports, OIDC works perfectly. I assume the issue would be related to SWAG's authentik-location.conf referring to the outpost for auth requests and the OAuth2 providers not being an option in the outpost within Authentik. I don't know enough to properly troubleshoot beyond this point without some direction from my betters. If anyone has suggestions or ideas, I'd appreciate it!
**UPDATE**
I did some more aimless troubleshooting and figured out I can't have forward auth enabled in the NGINX proxy-confs. I removed that and this is now working as intended. I would certainly prefer to have the subdomain locked behind authentication, but I'm not sure if it's possible to have both forward auth as a middleman to prevent unauthorized access to the subdomain AND to have OIDC setup for authentication at the application level. I would still love any insight on this aspect from my betters, but I'm reluctantly content with my current solution.
Comments Section
Did you ever figure this out? I’ve been pulling my hair out trying to use forward auth and OIDC. I can make them work independently but they don’t work together.
Unfortunately, I got confirmation that it's one or the other, but not both. I decided this was good enough since OIDC redirects to Authentik, which will force authentication or bar entry. It's less than ideal, but good enough I suppose.