Search code examples
traefikdigest-authentication

Traefik: Cannot login to service with digest authentication

I am trying to use Traefik to reverse proxy to a service that uses digest authentication.

When I access the service directly by its port after exposing it in the docker-compose it works fine but when I access it through Traefik the login pop up keeps appearing because a 401 is returned.

I also had a look at the Traefik middleware but I think it is only to add digest authentication and not to be used with services that already have it.

How do I have to configure Traefik to resolve this?

Working docker-compose:

version: "3"

services:
  service:
    image: service:tag
    cap_add:
      - NET_ADMIN
    ports:
      - "8082:8082/tcp"

docker-compose to be used with traefik:

version: "3"

networks:
  web:
    external: true
  internal:
    external: false

services:
  service:
    image: service:tag
    cap_add:
      - NET_ADMIN
    labels:
      - traefik.api.frontend.rule=Host:domain.com
      - traefik.docker.network=web
      - traefik.port=8082
    networks:
      - internal
      - web
    ports:
      - "1194:1194/udp"

and the traefik.toml:

logLevel = "DEBUG"

defaultEntryPoints = ["http"]

[entryPoints]
  [entryPoints.dashboard]
    address = ":8080"
    [entryPoints.dashboard.auth]
      [entryPoints.dashboard.auth.basic]
        users = ["user:hash"]

  [entryPoints.http]
    address = ":80"

[api]
entrypoint="dashboard"

[docker]
domain = "domain.com"
watch = true
network = "web"

I start traefik like this:

docker run -d -v /var/run/docker.sock:/var/run/docker.sock -v $PWD/traefik.toml:/traefik.toml -p 80:80 -l traefik.frontend.rule=Host:monitor.domain.com -l traefik.port=8080 --network web --name traefik traefik:1.7.2-alpine

and then the service with:

docker-compose up

Everything works fine except the authentication.

Solution

  • This seems to be a bug in Traefik: https://github.com/containous/traefik/issues/4281