Has anyone experienced an issue with forward auth that affects access to the dashboard specifically?
I'm running Traefik v2.0.7 in docker swarm and have successfully implemented a single forward auth middleware declaration via docker labels that I am using successfully to protect several endpoints (e.g. prometheus, spark). The forward auth is to keycloak via a traefik-fwd-auth container.
However, I am unable to successfully protect the Traefik dashboard itself in this way. The behaviour is odd. If I have logged in to one of my other protected resources, and therefore have appropriate cookies set, then I can view the dashboard as expected. This is good.
However, if I start in a fresh session and visit the dashboard directly I see a forever refreshing page where instead the expected behaviour as per other protected resources is the keycloak login page. See image below.
If I examine the logs of the traefik-fwd-auth container I see the log events that I would expect to produce a login page, ie. the same exact messages I see when I hit the other protected containers when they produce login page:
level=debug msg="Set CSRF cookie and redirecting to oidc login" SourceIP=10.255.0.5
level=debug msg="uri.Path was %s/dashboard/service-worker.js" SourceIP=10.255.0.5
level=debug msg="fw.Path was %s/_oauth" SourceIP=10.255.0.5
My theory is that this is a bug somehow related to the special 'magic' treatment of the dashboard, ie. declaring the service as api@internal. Anyone experienced this and have a workaround?
