# Assertion Headers Through Traefik

**URL:** <https://discuss.pomerium.com/t/assertion-headers-through-traefik/28>\
**Category:** Support\
**Created:** [October 26, 2021, 3:01pm UTC](https://discuss.pomerium.com/t/assertion-headers-through-traefik/28 "2021-10-26T15:01:58Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![alex](https://yyz1.discourse-cdn.com/flex031/user_avatar/discuss.pomerium.com/alex/32/9_2.png) [@alex](https://discuss.pomerium.com/u/alex)\
**Post date:** [October 26, 2021, 3:01pm UTC](https://discuss.pomerium.com/t/assertion-headers-through-traefik/28/1 "2021-10-26T15:01:58Z")

</div>

[quote]  
[**View in #support on Slack**](https://pomerium-io.slack.com/archives/CK92MUAES)

![Romain_Guichard](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/128803ea00bde22c868323342f34b6972d92110b.png) **@Romain\_Guichard:** Hi folks ! Once authenticated with my IDP and redirected to my application, I can’t see any `X-Pomerium-Jwt-Assertion` in my headers. Is there something that need to be done ?

![Caleb_Doxsey](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/2ae298c09a39e80b418afe69971e1bf8296942ad.jpeg) **@Caleb\_Doxsey:** Do you have `pass_identity_headers` on? [https://www.pomerium.io/reference/#pass-identity-headers](https://www.pomerium.io/reference/#pass-identity-headers)

> Settings | Pomerium

![Romain_Guichard](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/128803ea00bde22c868323342f34b6972d92110b.png) **@Romain\_Guichard:** I do  
In my `policy` block right ?

![Bobby](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/97462393dac5eeeadebf8c969950d50b90ae6792.jpeg) **@Bobby:** @Romain\_Guichard – What’s your (redacted) configuration look like? Do you have any other proxies involved.

![Romain_Guichard](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/128803ea00bde22c868323342f34b6972d92110b.png) **@Romain\_Guichard:** Just my ingress controller (traefik)

```auto
pomerium:
  config:
    extraOpts:
      jwt_claims_headers:
        X-Corp-email: email
        X-Corp-groups: groups
        X-Corp-user: user
    sharedSecret: <path:oi-secrets/data/kube-shared-nonprod/pomerium-auth-external#sharedSecret>
    cookieSecret: <path:oi-secrets/data/kube-shared-nonprod/pomerium-auth-external#cookieSecret>
    rootDomain: <http://tld.com|tld.com>
    policy:
      - from: <https://app.tld.com>
        to: <http://app.svc.cluster.local>
        allowed_domains:
          - <http://tld.com|tld.com>
        pass_identity_headers: true
        preserve_host_header: true

```

(this is the helm chart value used)

![Bobby](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/97462393dac5eeeadebf8c969950d50b90ae6792.jpeg) **@Bobby:** Is pomerium being run in forward auth mode?

![Romain_Guichard](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/128803ea00bde22c868323342f34b6972d92110b.png) **@Romain\_Guichard:** yes it is

![Bobby](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/97462393dac5eeeadebf8c969950d50b90ae6792.jpeg) **@Bobby:** Any pomerium headers you want to add to the request headers would also need to be added to your Traefik config using `forwardauth.authResponseHeaders`  
. You may also need to set `forwardedheaders.insecure` .

• [https://doc.traefik.io/traefik/v2.0/middlewares/forwardauth/#authresponseheaders](https://doc.traefik.io/traefik/v2.0/middlewares/forwardauth/#authresponseheaders)  
• [https://www.pomerium.io/reference/#traefik-docker-compose](https://www.pomerium.io/reference/#traefik-docker-compose)  
@Romain\_Guichard – LMK if that does the trick! 🙂

![Romain_Guichard](https://canada1.discourse-cdn.com/flex031/uploads/pomerium/original/1X/128803ea00bde22c868323342f34b6972d92110b.png) **@Romain\_Guichard:** Hi @Bobby, just tested it, it doesn’t do the trick 😞

```auto
apiVersion: <http://traefik.containo.us/v1alpha1|traefik.containo.us/v1alpha1>
kind: Middleware
metadata:
  name: internal-auth
  namespace: pomerium-external
spec:
  forwardAuth:
    address: <https://pomerium-proxy.pomerium-external>
    authResponseHeaders:
    - X-Pomerium-Authenticated-User-Email
    - x-pomerium-authenticated-user-id
    - x-pomerium-authenticated-user-groups
    - x-pomerium-jwt-assertion
    tls:
      insecureSkipVerify: true
    trustForwardHeader: true

```

---

<div class="post-metadata">

**Author:** ![alex](https://yyz1.discourse-cdn.com/flex031/user_avatar/discuss.pomerium.com/alex/32/9_2.png) [@alex](https://discuss.pomerium.com/u/alex)\
**Post date:** [November 1, 2021, 12:59pm UTC](https://discuss.pomerium.com/t/assertion-headers-through-traefik/28/2 "2021-11-01T12:59:22Z")

</div>

Discussion on this issue continued [in slack](https://pomerium-io.slack.com/archives/CK92MUAES/p1634911910003100) and [on Github](https://github.com/pomerium/pomerium/issues/2723). The issue turned out to be with [our docs](https://pomerium.com/enterprise/reference/configure.html#jwt-claim-headers) having an outdated section, which we’ll [fix shortly](https://github.com/pomerium/pomerium/issues/2728).

The outdated section shows example JWT claim headers in the form `x-pomerium-authenticated-user-{email|user-id|groups}`, but the format is actually `x-pomerium-claim-{email|user-id|groups}`.