I am a bit lost as to how you use authentik to do single sign on.
I can connect things that have external access quite easily using the reverse proxy provider that’s built into authentik. I am struggling with how I would connect things that are on a docker network and can’t be accessed directly. Normally with nginx proxy manager I would put it on the same network, but I don’t think this is correct for authentik. Am I supposed to create a docker outpost?
Other people are using authentik + nginx proxy manager and I am a bit lost why they are doing that.
You must log in or register to comment.
They serve two different purposes. You can have one, both or neither. Sorry if you already know all this below but thought it might be good to explain in detail.
NPM is a proxy provider so passes subdomains to the right service (e.g. service1.url.com passes to service 1 at IP x.x.x.x on port 5050). This allows you to only open one port to NPM but access other services through subdomains. I have NPM in front of myexternal apps so I can access each through a subdomain (e.g. service1.url.com). You could also use it for accessing internally if you setup your internal DNS to pass (e.g. service1.internal) to the IP address and port of your service, and set NPM only to allow access from internal IPs.
Authentik provides single sign on so instead of having different usernames and passwords for every user on every service, you have one set of users and it manages the passwords.
There are at a high level two levels of using it.
Some services have proper SSO integration so you setup Authentik to replace it’s own login system. For instance, with Nextcloud you are going to the Nextcloud homepage but it then goes out to Authentik to do the login process and once passed, Authentik will tell Nextcloud user B has successfully logged in, I vouch for them and here are their details. You can do this for internal and external access. Obviously with Nextcloud you need to login either through it’s own login system or via SSO so even if I go directly to the internal IP and port (and therefore don’t need NPM to access it), I still need Authentik to login so it knows it’s me and not my partner trying to access her account
Some services don’t have SSO integration or have no login required. For instance, I have Stirling PDF which doesn’t need user details or login. However, you don’t want to just allow anyone to access so I have setup NPM to use Authentik as a proxy pass. If I go to stirlingpdf.url.com then it sends me to Authentik to login. You can only ever get to the Stirling app if you successfully log in. You can also set Authentik so that only certain users or groups of users can access certain apps but that’s more than I need.
It does take some effort to get SSO working correctly for each service and it’s only really worth it if you do have multiple users or services that need logins.
You don’t want just NPM unless you trust the service to have a secure login.
Others will probably say, you shouldn’t have anything facing externally. You can setup Tailscale or Wireguard tunnels so you always appear to be on the local network. That way, you don’t need NPM to be open externally. However you might still want it so you can type the address service1.internal instead of 192.168.1.1:8063 each time. You probably also want Authentik to make the login shared.
In terms of network access to get them working, NPM needs to be able to access Authentik internally on your network. You could either put them on the same shared Docker network or in my case, they are both on the same server so share an internal IP. I have opened the individual ports on Docker so they can access each other internally just like I can access both from my laptop. If I’m accessing away from home, I have my domain pointing my home external network ID, port 443 open on my router pointing to my home server with NPM. NPM then “talks” to Authentik through the home network so I login through that but I don’t have to open the Authentik port externally.
In my case, in the NPM settings, instead of using the docker created network for Authentik (like 172.3.1.1 or something that might change), I use the internal IP of the machine (like 192.168.1.1:4443 {if 4443 is the Authentik port}). I also have an NPM entry auth.url.com that points to Authentik which some apps need instead of the internal address. It took some playing around to get it right but once you do, it’s essentially copy and paste for new services.
What do you do with apps that don’t support an auth proxy? Login twice?
Either try to work out how to pass headers through to get around the service login or give up and find another app. On some services, the service auto logs onto one account so anybody who gets through Authentik sees the same stuff which is fine. I definitely don’t have two levels of login!
I should say I use Plex’s and vaultwarden’s own login systems.
I use it in two different ways. If I am using OIDC (e.g. Audiobookshelf), then I will only use Authentik. If I need to use a proxy outpost and pass those credentials to the server (e.g. Navidrome), then I need to use NPM to do that.
