goauthentik / goauthentik/authentik

Improve troubleshooting steps and logging for Forward Auth proxy

Open
#20,631 1 comment 4 reactions 0 assignees View on GitHub
bug bug/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
659

Description

### Do you see an area that can be clarified or expanded, a technical inaccuracy, or a broken link?

I've been stuck trying to configure a application with "Forward auth (single application)" with the internal outpost for several hours now, without any success. All requests are bounced with 404 Not Found from Authentik.

I keep finding conflicting information on how to configure this, most GH issues specify that the documentation on this is wrong, but with different details on what parts.

However, my main issue is the lack of troubleshooting options. I found https://docs.goauthentik.io/troubleshooting/forward_auth/ which mentions the following:

> To check this, run curl -v https://app.company/outpost.goauthentik.io/ping. A correct setup should return a HTTP/2 204 status code.

However, even this returns 404 in my case, even pointed right at the local Authentik endpoint, and logs does not mention anything, even with trace.

```
curl -v http://localhost:9000/outpost.goauthentik.io/ping
* Host localhost:9000 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
* Trying [::1]:9000...
* Connected to localhost (::1) port 9000
> GET /outpost.goauthentik.io/ping HTTP/1.1
> Host: localhost:9000
> User-Agent: curl/8.5.0
> Accept: */*
>
< HTTP/1.1 404 Not Found
< Content-Type: text/plain; charset=utf-8
< X-Content-Type-Options: nosniff
< Date: Fri, 27 Feb 2026 15:35:14 GMT
< Content-Length: 19
<
404 page not found
* Connection #0 to host localhost left intact
```

Logs on this:
```
server-1 | {"cidr":"172.16.0.0/12","event":"Using remote IP from proxy protocol","level":"trace","remoteAddr":"172.19.0.1","timestamp":"2026-02-27T15:35:59Z"}
```

I believe more documentation, or better logging is strongly needed here, as there are too many issues, blogposts, etc on this topic, each with their own "magic fix". (where unfortunately none of them have worked for me)
- https://www.tekonline.com.au/protect-webtop-behind-nginx-proxy-manager-with-authentik-forward-auth/
- https://github.com/goauthentik/authentik/issues/9122
- https://github.com/goauthentik/authentik/issues/10577
- https://github.com/goauthentik/authentik/discussions/18155
- https://github.com/goauthentik/authentik/discussions/10576
- https://github.com/goauthentik/authentik/discussions/10548
- https://github.com/goauthentik/authentik/issues/4207
- https://github.com/goauthentik/authentik/issues/20317
- https://github.com/goauthentik/authentik/issues/12930
- https://github.com/goauthentik/authentik/issues/19839
- https://github.com/goauthentik/authentik/issues/18367
- https://github.com/goauthentik/authentik/issues/13504
- https://github.com/goauthentik/authentik/issues/2180
- https://github.com/goauthentik/authentik/issues/20458
- https://github.com/goauthentik/authentik/issues/8956
- https://github.com/goauthentik/authentik/issues/19839

### Link

https://docs.goauthentik.io/troubleshooting/forward_auth/

### Solution

It would be nice to have a endpoint, similar to the /ping one to use for testing. As of now I cannot find any way to confirm whether my issue is with my Nginx configuration, the Application/Provider configuration, the outpost, or with Authentik itself. I find no error or even trace messages, and all endpoints under /outpost.goauthentik.io/ returns 404.

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.