HA-Proxy Ingress: *.cluster.local is not under the protected domain about authelia

[glime-ai]

Please note this response was created using generative AI leveraging previously available information from the repository. This information may be helpful however it is our strong recommendation that you carefully consider the information before blindly applying it.

---

Based on the error message you provided, it seems that Authelia is rejecting the request because the target URL https://authelia.authelia.svc.cluster.local/api/verify is not recognized as being under the protected domain example.de. This is a common issue when internal service URLs do not match the external domain names that Authelia is configured to protect.

To resolve this issue, you have a couple of options:

1. Use External Domain Name: As you discovered, using the external domain name (https://auth.example.de/api/verify) works because it matches the protected domain. However, you mentioned that you do not want the traffic to route over the internet. This approach ensures that the domain name matches but might not meet your network traffic requirements.

2. Modify Authelia's Configuration: You can adjust Authelia's configuration to recognize the internal service URL as a valid target. This involves adding the internal domain (authelia.authelia.svc.cluster.local) to the list of domains that Authelia considers to be protected. You would need to update the domain configuration in Authelia to include this internal domain.

3. Network Configuration: Another approach could be to adjust your network configuration so that requests to https://auth.example.de are internally routed to https://authelia.authelia.svc.cluster.local without leaving your internal network. This might involve internal DNS configurations or specific routing rules that keep the traffic within your internal network.

4. SSL/TLS Configuration: Ensure that SSL/TLS is properly configured for internal communications if not already done. This ensures that even internal communications are secure and might help in resolving some of the issues related to secure URLs.

Given your requirements and setup, modifying Authelia's configuration to recognize the internal service URL or adjusting the network configuration to route internal traffic properly without going over the internet might be the most suitable solutions.

This comment was generated by Glime.

[james-d-elliott]

See the headers required (which must be set from the original request) for this authorization mechanism: https://www.authelia.com/reference/guides/proxy-authorization/#legacy

This will need either a configuration fix or a fix from haproxy-ingress.

[james-d-elliott]

Looks like something they support configuring via the headers option at their end: jcmoraisjr/haproxy-ingress#926

I've also updated the previously posted example to reflect this for the 4.38 forward auth endpoint: #2411 (comment)

[james-d-elliott]

Converting to a discussion, this clearly isn't a bug on our end looking at the headers they set.