ForwardAuth with traefik 2 results in ERR_TOO_MANY_REDIRECTS

Support
1

What happened?

I receive the error code ERR_TOO_MANY_REDIRECTS in chrome when I try to access the whoami service in traefik that utilizes forwardAuth in pomerium using the forwardAuth middleware in traefik.

Screenshot 2022-12-16 at 16.59.26
Screenshot 2022-12-16 at 16.59.262288×1210 103 KB

What did you expect to happen?

I expected to access the server after authentication through Azure AD.

How’d it happen?

The following registry has been created to easily reproduce the error GitHub - elben10/traefik-pomerium

What’s your environment like?

  • Pomerium version 20.0 (Latest docker image: pomerium/pomerium:latest)
  • Server Operating System/Architecture/Cloud: Docker Desktop (20.10.16) on OsX (Darwin Kernel Version 21.6.0)

What’s your config.yaml?

authenticate_service_url: https://pomerium.dev.localhost
forward_auth_url: http://pomerium
insecure_server: true
address: :80

##################################################################################
# Identity provider settings : https://www.pomerium.com/docs/identity-providers/ #
# The keys required in this section vary depending on your IdP. See the          #
# appropriate docs for your IdP to configure Pomerium accordingly.               #
##################################################################################
idp_provider: azure

# Generate 256 bit random keys  e.g. `head -c32 /dev/urandom | base64`
cookie_secret: V2JBZk0zWGtsL29UcFUvWjVDWWQ2UHExNXJ0b2VhcDI=

# https://pomerium.com/reference/#routes
routes:
  - from: https://whoami.dev.localhost
    to: https://whoami.dev.localhost
    policy:
      - allow:
          or:
            - domain:
                is: gmail.com
    pass_identity_headers: true

What did you see in the logs?

Logs truncated due to maximum number of characters

{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium.dev.localhost","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"481351f7-8d9d-4b15-aa1e-adebca10ac0b","duration":3.181954,"size":880,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:22Z","message":"http-request"}
{"level":"info","type":"type.googleapis.com/session.Session","id":"93dcd7ff-5b7d-4932-8ecd-5c12d250e9ae","time":"2022-12-16T15:58:22Z","message":"get"}
{"level":"info","type":"type.googleapis.com/session.Session","id":"93dcd7ff-5b7d-4932-8ecd-5c12d250e9ae","time":"2022-12-16T15:58:22Z","message":"get"}
{"level":"info","type":"type.googleapis.com/session.Session","id":"93dcd7ff-5b7d-4932-8ecd-5c12d250e9ae","time":"2022-12-16T15:58:22Z","message":"get"}
{"level":"info","type":"type.googleapis.com/session.Session","id":"93dcd7ff-5b7d-4932-8ecd-5c12d250e9ae","time":"2022-12-16T15:58:22Z","message":"get"}
{"level":"info","type":"type.googleapis.com/session.Session","id":"93dcd7ff-5b7d-4932-8ecd-5c12d250e9ae","time":"2022-12-16T15:58:22Z","message":"get"}
{"level":"info","type":"type.googleapis.com/session.Session","id":"93dcd7ff-5b7d-4932-8ecd-5c12d250e9ae","time":"2022-12-16T15:58:22Z","message":"get"}
{"level":"info","type":"type.googleapis.com/session.Session","id":"93dcd7ff-5b7d-4932-8ecd-5c12d250e9ae","time":"2022-12-16T15:58:22Z","message":"get"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium.dev.localhost","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"609d5270-36bb-4c92-adb3-ce0c681a4622","duration":13.634181,"size":879,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:23Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium.dev.localhost","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"55adc72e-f19e-4e94-99ae-a8c9f7ddc022","duration":4.260657,"size":879,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:23Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium.dev.localhost","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"e2826b68-fdd2-4d69-94c5-ccc5e6091c2d","duration":3.588002,"size":880,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:23Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium.dev.localhost","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"fb3363a9-8db2-490d-958a-fc982100ffbc","duration":4.069832,"size":875,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:23Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium.dev.localhost","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"40e84963-8472-4d49-b436-f2cafcaf3627","duration":3.701875,"size":880,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:23Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium.dev.localhost","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"31a4d691-ae0f-4842-8399-ee404a3385d7","duration":4.905606,"size":880,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:23Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium.dev.localhost","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"fbac04a4-06a6-454a-8afe-a8625343699a","duration":3.491373,"size":878,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:23Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"1cb7033c-b09a-4532-8d3d-34a8e182678e","duration":1.048918,"size":188,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:23Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"aab21aac-fec5-4176-af91-c7706f75f511","duration":1.192749,"size":51,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:23Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"feacf7c3-8cca-459d-9711-1c2952b9c33a","duration":0.953611,"size":188,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:23Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"c883ac36-187e-4f04-9127-49129ef2d82c","duration":0.867834,"size":51,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:23Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"67ca39bf-9cc3-442e-9103-3566d8e72771","duration":0.937712,"size":188,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:23Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"24b1eb6c-524e-4cfd-9f92-c33cb9947a6e","duration":1.115964,"size":51,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:23Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"81b0cf2b-ca17-41d2-86eb-db8aaccd755c","duration":0.818076,"size":188,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:23Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"e7d89272-83b8-4da7-91e8-509ae9c26295","duration":0.844521,"size":51,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:23Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"7fe83f8e-3d99-46c1-b6b2-28ebe6099805","duration":0.961945,"size":188,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:23Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"6d5d8c53-293d-4582-be3b-1c2bb36f7996","duration":0.801746,"size":51,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:23Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"4288060d-e3fc-43ee-9825-bc9bc3730eb7","duration":0.913384,"size":188,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:23Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"989e229b-6d6e-4b57-adc9-977294198281","duration":0.80942,"size":51,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:23Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"86f4e49b-da2a-478f-9e69-2305c10d8d9b","duration":0.958693,"size":188,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:23Z","message":"http-request"}
{"level":"info","type":"type.googleapis.com/session.Session","id":"93dcd7ff-5b7d-4932-8ecd-5c12d250e9ae","time":"2022-12-16T15:58:27Z","message":"get"}
{"level":"info","type":"type.googleapis.com/session.Session","id":"93dcd7ff-5b7d-4932-8ecd-5c12d250e9ae","time":"2022-12-16T15:58:27Z","message":"get"}
{"level":"info","type":"type.googleapis.com/session.Session","id":"93dcd7ff-5b7d-4932-8ecd-5c12d250e9ae","time":"2022-12-16T15:58:28Z","message":"get"}
{"level":"info","type":"type.googleapis.com/session.Session","id":"93dcd7ff-5b7d-4932-8ecd-5c12d250e9ae","time":"2022-12-16T15:58:28Z","message":"get"}
{"level":"info","type":"type.googleapis.com/session.Session","id":"93dcd7ff-5b7d-4932-8ecd-5c12d250e9ae","time":"2022-12-16T15:58:28Z","message":"get"}
{"level":"info","type":"type.googleapis.com/session.Session","id":"93dcd7ff-5b7d-4932-8ecd-5c12d250e9ae","time":"2022-12-16T15:58:28Z","message":"get"}
{"level":"info","type":"type.googleapis.com/session.Session","id":"93dcd7ff-5b7d-4932-8ecd-5c12d250e9ae","time":"2022-12-16T15:58:28Z","message":"get"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium.dev.localhost","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"465df0ae-d94d-4a7d-80a3-14d79a2bb65c","duration":7.061148,"size":879,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:28Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium.dev.localhost","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"423b7399-3e89-4375-9cca-c056959db6c4","duration":5.381836,"size":879,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:28Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium.dev.localhost","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"a5d853b3-2c26-46a1-b46c-7221b466b343","duration":4.623627,"size":880,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:28Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium.dev.localhost","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"8333a0e0-d28f-4a6a-8963-ecfe1a21c16d","duration":10.874927,"size":879,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:28Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium.dev.localhost","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"ac7edbed-5506-4388-b3d3-1d3e424031f5","duration":8.192578,"size":880,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:28Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium.dev.localhost","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"e30baa49-552f-4dd8-bbba-b30c4c29c04a","duration":4.071724,"size":875,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:28Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium.dev.localhost","path":"/.pomerium/sign_in","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"4e721c00-f7dd-446a-a4ca-ee71867f820c","duration":4.245411,"size":878,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:28Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"c26d8ca7-4e7a-4930-91fc-a6182621ce76","duration":1.281981,"size":51,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:28Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"188f6322-b54c-419e-970e-d030a069df9b","duration":2.690235,"size":188,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:28Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"07249f66-5ec9-47ff-a1c8-5d25540cca9e","duration":1.241088,"size":51,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:28Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"9abc863e-760d-4bd4-a63f-509a9cdf5c34","duration":1.328788,"size":183,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:28Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"852e9060-db3b-4e95-b16b-772a89fbe7e9","duration":2.257217,"size":51,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:28Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"dd96c9b3-1459-4dfd-a629-a3d10e6c2b43","duration":2.31163,"size":183,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:28Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"1fe00511-12e7-4234-89a7-4a2577775607","duration":1.792169,"size":51,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:28Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"2583fa00-0944-43ef-969e-8e326cc10d29","duration":3.131758,"size":183,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:28Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"43781d3a-3e3a-4866-adc3-6a8d3ba8217d","duration":1.79526,"size":51,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:28Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"f0a9b0a7-6553-4bd2-afc0-f78ec4c97790","duration":1.257596,"size":183,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:28Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"9ad47553-2fa5-400a-b78a-ea4cc758aaa4","duration":0.872613,"size":51,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:28Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"2d0f8ecd-348e-4d0b-bbd2-e20246a4d7c0","duration":1.033224,"size":183,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:28Z","message":"http-request"}
{"level":"info","service":"envoy","upstream-cluster":"pomerium-control-plane-http","method":"GET","authority":"pomerium","path":"/","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","referer":"","forwarded-for":"192.168.32.1,192.168.32.4","request-id":"1be329ca-1304-461f-9a28-1c01145e8b78","duration":1.437523,"size":51,"response-code":302,"response-code-details":"via_upstream","time":"2022-12-16T15:58:28Z","message":"http-request"}

Additional context

No further context

2

Forward Auth is not recommended as it’s very complicated to debug and requires intimate understanding of the request flow between Pomerium and 3rd party load balancer.

Pomerium is built on Envoy that is a first class load balancer / reverse proxy.
Is there a specific feature you use in Traefik that Pomerium is missing?

3

Thanks for clarifying. I think it would make sense to provide a full example that works. In this link the pomerium configuration is missing or document that it is a very advanced feature not intended to be used by most use cases (Forward Auth (Deprecated) | Pomerium).

Regarding some missing features from traefik. I find the configuration through docker labels very intuitive (Traefik Docker Documentation - Traefik) and the more basic look of 403, 404 errors and some way to specify custom error pages like the error middleware in traefik (Traefik Errors Documentation - Traefik)

4