<p>I have been trying for days and countless hours to make this thing work with Traefik, however not matter what I have tried nothing has been working so far.</p>
<p>I have tried first with Nginx ingress controller and managed to make it work, so I am sure that my provider (Cognito) and the oauth2-proxy pod is working correctly.</p>
<p>So, I am using an EKS 1.20 cluster and we have Traefik installed via helm chart</p>
<pre><code>replicas: 1

rbac:
  enabled: true

accessLogs:
  enabled: false

service:
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: nlb
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: &quot;my-certs&quot;
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: &quot;443&quot;

externalTrafficPolicy: Local

ssl:
  enabled: true
  enforced: true
  upstream: true
</code></pre>
<pre><code>helm upgrade -i traefik traefik/traefik -f traefik-values.yaml
</code></pre>
<p>This is the config of my oauth proxy, which works with Nginx.
In the Oauth-proxy there is no mention about Traefik so I guess this should work as well:</p>
<pre><code>config:
  clientID: &quot;xxxxx&quot;
  clientSecret: &quot;xxxxxx&quot;
  cookieSecret: &quot;xxxx&quot;
  configFile: |-
    email_domains = [ &quot;*&quot; ]
    upstreams = [ &quot;file:///dev/null&quot; ]

extraArgs:
  oidc-issuer-url: &quot;https://cognito-idp.&lt;region&gt;.amazonaws.com/&lt;pool_id&gt;&quot;
  oidc-jwks-url: &quot;https://cognito-idp.&lt;region&gt;.amazonaws.com/&lt;pool_id&gt;/.well-known/jwks.json&quot;
  provider: oidc
  provider-display-name: &quot;Cognito SSO&quot;
  cookie-secure: false
  cookie-name: &quot;_oauth2_proxy&quot;
  skip-provider-button: true
  scope: openid
  reverse-proxy: true
  real-client-ip-header: X-Forwarded-For
  whitelist-domain: mycompany.com
  cookie-domain: mycompany.com
  set-authorization-header: true
  
</code></pre>
<p>Those is the configuration suggested from their documentation transformed to Kubernetes: <a href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/overview#configuring-for-use-with-the-traefik-v2-forwardauth-middleware" rel="nofollow noreferrer">https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/overview#configuring-for-use-with-the-traefik-v2-forwardauth-middleware</a></p>
<pre><code>---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: auth-headers
spec:
  headers:
    sslRedirect: true
    stsSeconds: 315360000
    browserXssFilter: true
    contentTypeNosniff: true
    forceSTSHeader: true
    stsIncludeSubdomains: true
    stsPreload: true
    frameDeny: true

---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: oauth-auth
spec:
  forwardAuth:
    address: https://mycompany.com/oauth2/auth
    trustForwardHeader: true

---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: oauth-errors
spec:
  errors:
    status:
      - &quot;401-403&quot;
    service:
      name: oauth2-proxy
      port: 80
    query: &quot;/oauth2/sign_in&quot;

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: oauth2-proxy
spec:
  entryPoints:
    - websecure
  routes:
    - match: &quot;Host(`mycompany.com`) &amp;&amp; PathPrefix(`/oauth2/`)&quot;
      kind: Rule
      services:
        - kind: Service
          name: oauth2-proxy
          port: 80
      middlewares:
        - name: auth-headers

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: linkerd-dashboard-ingress
  annotations:
    kubernetes.io/ingress.class: traefik
spec:
  entryPoints:
    - websecure
  routes:
    - match: &quot;Host(`mycompany.com`)&quot;
      kind: Rule
      services:
        - name: nginx-service
          kind: Service
          port: 8080
      priority: 1
      middlewares:
        - name: oauth-auth
        - name: oauth-errors

</code></pre>
<p>With this configuration now it will get redirected, however it goes in loop and I have <code>ERR_TOO_MANY_REDIRECTS</code></p>
<p>If I follow with curl it will go in loop:</p>
<pre><code>HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=utf-8
Location: https://mycompany.com/oauth2/auth
Date: Wed, 08 Sep 2021 10:12:04 GMT
Content-Length: 84

HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=utf-8
Location: https://mycompany.com/oauth2/auth
Date: Wed, 08 Sep 2021 10:12:04 GMT
Content-Length: 84

...
</code></pre>

Matteo
<p>I have solved by simply not using oauth2-proxy which clearly does not work with Traefik, instead I have found this other project: <a href="https://github.com/thomseddon/traefik-forward-auth" rel="nofollow noreferrer">https://github.com/thomseddon/traefik-forward-auth</a></p>
<p>A bit more simple and it works.</p>
