goauthentik / goauthentik/authentik
Improve troubleshooting steps and logging for Forward Auth proxy
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 659
Description
### Do you see an area that can be clarified or expanded, a technical inaccuracy, or a broken link?
I've been stuck trying to configure a application with "Forward auth (single application)" with the internal outpost for several hours now, without any success. All requests are bounced with 404 Not Found from Authentik.
I keep finding conflicting information on how to configure this, most GH issues specify that the documentation on this is wrong, but with different details on what parts.
However, my main issue is the lack of troubleshooting options. I found https://docs.goauthentik.io/troubleshooting/forward_auth/ which mentions the following:
> To check this, run curl -v https://app.company/outpost.goauthentik.io/ping. A correct setup should return a HTTP/2 204 status code.
However, even this returns 404 in my case, even pointed right at the local Authentik endpoint, and logs does not mention anything, even with trace.
```
curl -v http://localhost:9000/outpost.goauthentik.io/ping
* Host localhost:9000 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
* Trying [::1]:9000...
* Connected to localhost (::1) port 9000
> GET /outpost.goauthentik.io/ping HTTP/1.1
> Host: localhost:9000
> User-Agent: curl/8.5.0
> Accept: */*
>
< HTTP/1.1 404 Not Found
< Content-Type: text/plain; charset=utf-8
< X-Content-Type-Options: nosniff
< Date: Fri, 27 Feb 2026 15:35:14 GMT
< Content-Length: 19
<
404 page not found
* Connection #0 to host localhost left intact
```
Logs on this:
```
server-1 | {"cidr":"172.16.0.0/12","event":"Using remote IP from proxy protocol","level":"trace","remoteAddr":"172.19.0.1","timestamp":"2026-02-27T15:35:59Z"}
```
I believe more documentation, or better logging is strongly needed here, as there are too many issues, blogposts, etc on this topic, each with their own "magic fix". (where unfortunately none of them have worked for me)
- https://www.tekonline.com.au/protect-webtop-behind-nginx-proxy-manager-with-authentik-forward-auth/
- https://github.com/goauthentik/authentik/issues/9122
- https://github.com/goauthentik/authentik/issues/10577
- https://github.com/goauthentik/authentik/discussions/18155
- https://github.com/goauthentik/authentik/discussions/10576
- https://github.com/goauthentik/authentik/discussions/10548
- https://github.com/goauthentik/authentik/issues/4207
- https://github.com/goauthentik/authentik/issues/20317
- https://github.com/goauthentik/authentik/issues/12930
- https://github.com/goauthentik/authentik/issues/19839
- https://github.com/goauthentik/authentik/issues/18367
- https://github.com/goauthentik/authentik/issues/13504
- https://github.com/goauthentik/authentik/issues/2180
- https://github.com/goauthentik/authentik/issues/20458
- https://github.com/goauthentik/authentik/issues/8956
- https://github.com/goauthentik/authentik/issues/19839
### Link
https://docs.goauthentik.io/troubleshooting/forward_auth/
### Solution
It would be nice to have a endpoint, similar to the /ping one to use for testing. As of now I cannot find any way to confirm whether my issue is with my Nginx configuration, the Application/Provider configuration, the outpost, or with Authentik itself. I find no error or even trace messages, and all endpoints under /outpost.goauthentik.io/ returns 404.
### Additional context
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.