Add basic auth support for web backend #677

SantoDE · 2016-09-14T19:21:58Z

Hey there,

this PR enables traefik to protect the web backend per basic auth. All you need to do, is at these lines to your traefik.toml

[web.auth.basic] users = ["traefik:$apr1$8EvWcwpO$RaRFXvDJk6LGQ5tM04RRd0"]

so it looks like:

[web]
address = ":8000"
    [web.auth.basic]
    users = ["traefik:$apr1$8EvWcwpO$RaRFXvDJk6LGQ5tM04RRd0"]

Feedback welcome! :)

SantoDE · 2016-09-15T05:59:02Z

Needs a proper rebase. I failed while trying to get this up. Maybe @emilevauge or @jangie can help me get this up properly :)

SantoDE · 2016-09-15T14:30:14Z

Rebase done. All good from my side now. Waiting for you :)

SantoDE · 2016-09-15T17:22:32Z

Rebased again

emilevauge · 2016-09-16T10:12:04Z

Fixes #296

emilevauge

Hi @SantoDE, thanks for your contribution :)

I have 2 comments. Could you add more explanations to the documentation you have already done in traefik.sample.toml, and add a digest section? You can copy paste (with adaptation) docs from entrypoints authentication:

# To enable basic auth on an entrypoint
# with 2 user/pass: test:test and test2:test2
# Passwords can be encoded in MD5, SHA1 and BCrypt: you can use htpasswd to generate those ones
# [entryPoints]
#   [entryPoints.http]
#   address = ":80"
#   [entryPoints.http.auth.basic]
#   users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/", "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"]
#
# To enable digest auth on an entrypoint
# with 2 user/realm/pass: test:traefik:test and test2:traefik:test2
# You can use htdigest to generate those ones
# [entryPoints]
#   [entryPoints.http]
#   address = ":80"
#   [entryPoints.http.auth.basic]
#   users = ["test:traefik:a2688e031edb4be6a3797f3882655c05 ", "test2:traefik:518845800f9e2bfb1f1f740ec24f074e"]

Could you also add a section in the documentation web site: https://github.com/containous/traefik/blob/master/docs/toml.md ?

Thanks :)

SantoDE · 2016-09-16T10:37:20Z

Hey @emilevauge ,

thanks for your Feedback. I implemented the requested changes. Hope all is good!

emilevauge

One last fix!

emilevauge · 2016-09-16T10:39:09Z

docs/toml.md

@@ -411,6 +411,18 @@ address = ":8080"
 #
 # Optional
 # ReadOnly = false
+#
+# To enable basic auth on an entrypoint


~~on an entrypoint~~ -> on the webui

emilevauge · 2016-09-16T10:40:23Z

docs/toml.md

+# Passwords can be encoded in MD5, SHA1 and BCrypt: you can use htpasswd to generate those ones
+#   [web.auth.basic] 
+#     users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/", "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"]
+# To enable digest auth on an entrypoint


~~on an entrypoint~~ -> on the webui

emilevauge · 2016-09-16T10:40:30Z

traefik.sample.toml

@@ -221,6 +221,17 @@
 # Optional
 # ReadOnly = false

+# To enable basic auth on an entrypoint


~~on an entrypoint~~ -> on the webui

emilevauge · 2016-09-16T10:40:40Z

traefik.sample.toml

+# Passwords can be encoded in MD5, SHA1 and BCrypt: you can use htpasswd to generate those ones
+#   [web.auth.basic] 
+#     users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/", "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"]
+# To enable digest auth on an entrypoint


~~on an entrypoint~~ -> on the webui

SantoDE · 2016-09-16T12:02:21Z

done and rebased to squash the changes :) @emilevauge

emilevauge

ping @containous/traefik

cocap10

Custom parser missing ?

cocap10 · 2016-09-18T20:46:22Z

web.go

@@ -28,6 +30,7 @@ type WebProvider struct {
 	KeyFile  string `description:"SSL certificate"`
 	ReadOnly bool   `description:"Enable read only API"`
 	server   *Server
+	Auth     *types.Auth `description:"Auth Crendetials for Web Point"`


Maybe an issue with the StructTag here.
A flag will be created because of the description StructTag.
But I think a custom parser is missing on type.Auth

And Træfik will probably run into an error if the flag --web.auth is called.

Maybe we should remove the StructTag and assuming that TOML file is the only way to use this feat ?
WDYT @emilevauge ?

Looks like I missed that. I guess, removing it and assume TOML file is the only way is fine. Thanks for pointing that out!

However, let's wait for @emilevauge :)

@cocap10 great catch !
Indeed, it sounds OK to assume that TOML will be used to configure authentication users.
Let's remove the struct tag for now :)

done and rebased @emilevauge @cocap10 . Thanks for your Feedback 👍 :)

implemented requested changes fix docs remove struct tag

errm · 2016-09-19T14:20:52Z

On the face of it this looks good to me.

I am slightly wary of the fact that we now have code to handle basic auth in 2 places.

Not sure if we could DRY this up a bit, or even if that is desirable....

emilevauge · 2016-09-19T14:35:59Z

I am slightly wary of the fact that we now have code to handle basic auth in 2 places.

As the authentication mechanism takes place in middlewares/authenticator.go, I think we can live with that for now :)

holms · 2017-09-06T15:19:47Z

How this can be done from docker-compose? There's no way in swarm you can mount files locally, unless making your own Dockerfile.

ldez · 2017-09-06T15:39:55Z

@holms https://docs.traefik.io/configuration/backends/docker/#labels-can-be-used-on-containers-to-override-default-behaviour

holms · 2017-09-06T15:41:34Z

You can set labels on traefik container too? I thought this works only for other services.

SantoDE · 2017-09-06T15:54:12Z

@holms I guess best way is to mount a traefik.toml inside a volume to your traefik container and set the configuration in that toml

holms · 2017-09-06T15:55:57Z

And how can you do this in swarm mode? It's not allowed to mount anything from host? Because container can be scheduled to go for another node.. only data volumes can be used in swarm

gentunian · 2017-11-17T14:59:54Z

@holms you should restrict with constraints where should traefik be placed. Something like:

deploy:
  placement:
    constraints: [node.role == manager]

raarts · 2018-01-15T12:48:29Z

@holms, now there's docker configs, or you can use the local-persist driver as a global service, maybe in combination with placement constraints.

SantoDE force-pushed the master branch from 919744b to 2758a73 Compare September 15, 2016 13:24

SantoDE force-pushed the master branch from 2758a73 to 7d265fe Compare September 15, 2016 17:22

emilevauge requested changes Sep 16, 2016

View reviewed changes

emilevauge added contributor/waiting-for-corrections status/3-docs-review labels Sep 16, 2016

emilevauge requested changes Sep 16, 2016

View reviewed changes

SantoDE force-pushed the master branch from c8c2788 to a1e15ff Compare September 16, 2016 12:01

emilevauge approved these changes Sep 16, 2016

View reviewed changes

emilevauge removed the contributor/waiting-for-corrections label Sep 16, 2016

cocap10 reviewed Sep 18, 2016

View reviewed changes

add basic auth support

d5a15d6

implemented requested changes fix docs remove struct tag

SantoDE force-pushed the master branch from a1e15ff to d5a15d6 Compare September 19, 2016 07:41

emilevauge merged commit 710fc56 into traefik:master Sep 19, 2016

ldez added status/3-needs-merge and removed status/3-docs-review labels Apr 29, 2017

emilevauge mentioned this pull request May 10, 2017

Authentication for web dashboard #296

Closed

ldez added the area/authentication label May 12, 2017

ldez removed the status/3-needs-merge label Sep 6, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add basic auth support for web backend #677

Add basic auth support for web backend #677

SantoDE commented Sep 14, 2016 •

edited by ldez

Loading

SantoDE commented Sep 15, 2016

SantoDE commented Sep 15, 2016

SantoDE commented Sep 15, 2016

emilevauge commented Sep 16, 2016

emilevauge left a comment

SantoDE commented Sep 16, 2016

emilevauge left a comment

emilevauge Sep 16, 2016 •

edited

Loading

emilevauge Sep 16, 2016

emilevauge Sep 16, 2016

emilevauge Sep 16, 2016

SantoDE commented Sep 16, 2016 •

edited

Loading

emilevauge left a comment

cocap10 left a comment

cocap10 Sep 18, 2016 •

edited

Loading

SantoDE Sep 18, 2016

emilevauge Sep 19, 2016

SantoDE Sep 19, 2016

errm commented Sep 19, 2016

emilevauge commented Sep 19, 2016 •

edited

Loading

holms commented Sep 6, 2017

ldez commented Sep 6, 2017

holms commented Sep 6, 2017 via email •

edited by ldez

Loading

SantoDE commented Sep 6, 2017

holms commented Sep 6, 2017 via email •

edited by ldez

Loading

gentunian commented Nov 17, 2017 •

edited

Loading

raarts commented Jan 15, 2018

Add basic auth support for web backend #677

Add basic auth support for web backend #677

Conversation

SantoDE commented Sep 14, 2016 • edited by ldez Loading

SantoDE commented Sep 15, 2016

SantoDE commented Sep 15, 2016

SantoDE commented Sep 15, 2016

emilevauge commented Sep 16, 2016

emilevauge left a comment

Choose a reason for hiding this comment

SantoDE commented Sep 16, 2016

emilevauge left a comment

Choose a reason for hiding this comment

emilevauge Sep 16, 2016 • edited Loading

Choose a reason for hiding this comment

emilevauge Sep 16, 2016

Choose a reason for hiding this comment

emilevauge Sep 16, 2016

Choose a reason for hiding this comment

emilevauge Sep 16, 2016

Choose a reason for hiding this comment

SantoDE commented Sep 16, 2016 • edited Loading

emilevauge left a comment

Choose a reason for hiding this comment

cocap10 left a comment

Choose a reason for hiding this comment

cocap10 Sep 18, 2016 • edited Loading

Choose a reason for hiding this comment

SantoDE Sep 18, 2016

Choose a reason for hiding this comment

emilevauge Sep 19, 2016

Choose a reason for hiding this comment

SantoDE Sep 19, 2016

Choose a reason for hiding this comment

errm commented Sep 19, 2016

emilevauge commented Sep 19, 2016 • edited Loading

holms commented Sep 6, 2017

ldez commented Sep 6, 2017

holms commented Sep 6, 2017 via email • edited by ldez Loading

SantoDE commented Sep 6, 2017

holms commented Sep 6, 2017 via email • edited by ldez Loading

gentunian commented Nov 17, 2017 • edited Loading

raarts commented Jan 15, 2018

SantoDE commented Sep 14, 2016 •

edited by ldez

Loading

emilevauge Sep 16, 2016 •

edited

Loading

SantoDE commented Sep 16, 2016 •

edited

Loading

cocap10 Sep 18, 2016 •

edited

Loading

emilevauge commented Sep 19, 2016 •

edited

Loading

holms commented Sep 6, 2017 via email •

edited by ldez

Loading

holms commented Sep 6, 2017 via email •

edited by ldez

Loading

gentunian commented Nov 17, 2017 •

edited

Loading