question: How to initiate proxy pass after successful auth?

[icsy7867]

I am testing out an application with caddy embedded. And there are a lot of variables at play, so I will do my best to get rid of a lot of that other stuff. Ultimately, I am missing something. Probably from my lack of understanding of the tool. but i would love some assistance!

So I have oauth working! Woo! I get my companies ADFS login, and it successfully goes through. The token has the correct information and everything seems happy, but after I access the page I get this screen

And then after successfully authenticating I see this:

{
        order authenticate before respond
        order authorize before reverse_proxy
        security {
                oauth identity provider generic {
                        realm generic
                        driver generic
                        client_id oauth-client-id
                        client_secret oauth-client-secret
                        scopes openid email profile
                        base_auth_url https://my.company.org/adfs
                        metadata_url https://my.company.org/adfs/.well-known/openid-configuration
                }

                authentication portal myportal {
                        crypto default token lifetime 3600
                        enable identity provider generic
                        cookie domain subdomain.my.company.org

                        transform user {
                                match realm generic
                                action add role authp/user
                        }
                }

                authorization policy mypolicy {
                        set auth url https://{{ .ZrokBindAddress }}/oauth2/generic
                        inject headers with claims
                        allow roles authp/admin authp/user
                }

        }
}
http:// {
    # Bind to the zrok share
    bind {{ .ZrokBindAddress }}
    authenticate with myportal

    # All other traffic goes to localhost:3000
    authorize with mypolicy
    reverse_proxy /* localhost:8080 {
        header_up Host localhost:8080
        header_up X-Real-IP {http.request.header.x-forwarded-for}
    }
}

I should note, that with just this portion, it works fine:

http:// {
    # Bind to the zrok share
    bind {{ .ZrokBindAddress }}

    reverse_proxy /* localhost:8080 {
        header_up Host localhost:8080
        header_up X-Real-IP {http.request.header.x-forwarded-for}
    }
}

[greenpau]

ut after I access the page I get this screen

@icsy7867 , what you see here is the "portal" screen. You should add links there. See https://docs.authcrunch.com/docs/authenticate/user-transforms#add-ui-links

Additionally, see this video to introduce conditional logic "on login." It is a bit advanced for first timers. Try UI links first.

Please ask clarification questions.

[icsy7867]

Ohhh thanks! I will give this a whirl. I think, after diving into some caddy docs, I have it working! But i think I can do this better, I will definitely give you video a look. Thanks!

{
	order authenticate before respond
	# order authorize before reverse_proxy
	security {
		oauth identity provider generic {
			realm generic
			driver generic
			client_id client-id
			client_secret client-secret
			scopes openid email profile
			base_auth_url https://my.company.org/adfs
			metadata_url https://my.company.org/adfs/.well-known/openid-configuration
		}

		authentication portal myportal {
			crypto default token lifetime 3600
			enable identity provider generic
			cookie domain zrok.my.company.org
			ui {
				links {
					"My Identity" "/whoami" icon "las la-user"
					"app" "/app/" icon "las la-user"
				}
			}
			transform user {
				match realm generic
				action add role authp/user
			}
		}

		authorization policy mypolicy {
			set auth url /auth
			inject headers with claims
			allow roles authp/admin authp/user
		}

	}
}
http:// {
    # Bind to the zrok share
    bind {{ .ZrokBindAddress }}
    route /auth* {
	authenticate with myportal
    }
    authenticate with myportal

    # All other traffic goes to localhost:3000
    # authorize with mypolicy
    route /* {
        authorize with mypolicy
        reverse_proxy localhost:8080 {
            header_up Host localhost:8080
	    header_up X-Real-IP {http.request.header.x-forwarded-for}
        }
    }
}