NginxProxyManager / NginxProxyManager/nginx-proxy-manager

How to pass the JWT Token for web authentication after v2.13.1?

Open
#4,852 9 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

stale
Dominant language
TypeScript
Stars
34.2k
Forks
3.9k
Avg merge
21h 12m
Merged PRs (30d)
20

Description

Since there is no OIDC/SSO Authentication yet, I use Authentik Proxy Authentication to sign into NPM Web UI.

In Authentik group Attributes I added

nginx_username: admin@domain.tld
nginx_password: changeme

Attributes can be also added to individual users. The Property Mapping Expression must be adjusted accordingly.

Then created a Property Mappings for NginX to obtain the JWT Token from NPM API:
Name: NginX Token
Scope Name: ak_proxy
Expression:

import json
from urllib.parse import urlencode
from urllib.request import Request, urlopen

if request.user.username == "":
  return {"ak_proxy": {"user_attributes": {"additionalHeaders": {"X-Nginx-Token": "null"}}}}
else:
  nginxuser = request.user.group_attributes().get("nginx_username", "")
  nginxpass = request.user.group_attributes().get("nginx_password", "")

base_url = "http://nginx:81"
end_point = "/api/tokens"
json_data = {'identity': nginxuser,'secret': nginxpass}
postdata = json.dumps(json_data).encode()
headers = {"Content-Type": "application/json; charset=UTF-8"}
try:
  httprequest = Request(base_url + end_point, data=postdata, method="POST", headers=headers)
  with urlopen(httprequest) as response:
    responddata = json.loads(response.read().decode())
  return {"ak_proxy": {"user_attributes": {"additionalHeaders": {"X-Nginx-Token": responddata['token']}}}}
except: return {"ak_proxy": {"user_attributes": {"additionalHeaders": {"X-Nginx-Token": "null"}}}}

Create Authentik Application and Proxy Provider for NPM. Make sure to add the application to Authentik Outpost. Add NginX Token to Selected Scopes.

In NPM Proxy Host, I had this configuration:

proxy_buffers 8 16k;
proxy_buffer_size 32k;
port_in_redirect off;

location = /login {
  return 301 /;
}

location / {
    proxy_pass          $forward_scheme://$server:$port;
    auth_request     /outpost.goauthentik.io/auth/nginx;
    error_page       401 = @goauthentik_proxy_signin;
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header       Set-Cookie $auth_cookie;

    auth_request_set $authentik_auth $upstream_http_x_nginx_token;
    proxy_set_header Authorization "Bearer ${authentik_auth}";
    proxy_pass_header Authorization;
}

location /outpost.goauthentik.io {
    proxy_pass              https://authentik-server:9443/outpost.goauthentik.io;
    proxy_set_header        Host $host;
    proxy_set_header        X-Original-URL $scheme://$http_host$request_uri;
    add_header              Set-Cookie $auth_cookie;
    auth_request_set        $auth_cookie $upstream_http_set_cookie;
    proxy_pass_request_body off;
    proxy_set_header        Content-Length "";
}

location @goauthentik_proxy_signin {
    internal;
    add_header Set-Cookie $auth_cookie;
    return 302 /outpost.goauthentik.io/start?rd=$request_uri;
}

This part fetches the JWT Token from Authentik Scope and passes it as a header:

    auth_request_set $authentik_auth $upstream_http_x_nginx_token;
    proxy_set_header Authorization "Bearer ${authentik_auth}";
    proxy_pass_header Authorization;

Up to v2.13.1 this worked smoothly. I would like to know if it is still possible to use JWT Token to authenticate into the WebUI.
I am not using NPM in production settings or publicly exposed, but I am constantly experimenting with it for learning purposes.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No repository files or tests are named. Start by tracing the Web UI authentication and API token handling, then compare behavior before and after v2.13.1 using the JWT and Authorization-header configuration described here. Done means establishing whether JWT authentication remains supported and documenting the compatible configuration or the specific regression.

Written by the indexing model from the issue text.

Assessment

Tech stack
nginx, typescript
Domain
authentication, backend, web-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.