traefik/docs/content/middlewares/basicauth.md

131 lines
3.3 KiB
Markdown
Raw Normal View History

# BasicAuth
Adding Basic Authentication
{: .subtitle }
![BasicAuth](../assets/img/middleware/basicauth.png)
The BasicAuth middleware is a quick way to restrict access to your services to known users.
## Configuration Examples
2019-03-29 11:34:05 +00:00
```yaml tab="Docker"
# Declaring the user list
#
# Note: all dollar signs in the hash need to be doubled for escaping.
# To create user:password pair, it's possible to use this command:
# echo $(htpasswd -nb user password) | sed -e s/\\$/\\$\\$/g
2019-03-29 11:34:05 +00:00
labels:
- "traefik.http.middlewares.test-auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"
2019-04-03 12:32:04 +00:00
```
```yaml tab="Kubernetes"
# Declaring the user list
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: test-auth
spec:
basicAuth:
users:
- test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/
- test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0
2019-03-29 11:34:05 +00:00
```
```json tab="Marathon"
"labels": {
"traefik.http.middlewares.test-auth.basicauth.users": "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"
}
```
2019-04-08 15:14:08 +00:00
```yaml tab="Rancher"
# Declaring the user list
labels:
- "traefik.http.middlewares.test-auth.basicauth.users=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"
```
2019-03-29 11:34:05 +00:00
```toml tab="File"
# Declaring the user list
[http.middlewares]
2019-07-01 09:30:05 +00:00
[http.middlewares.test-auth.basicAuth]
2019-04-03 12:32:04 +00:00
users = [
"test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/",
"test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",
]
2019-03-29 11:34:05 +00:00
```
## Configuration Options
### General
Passwords must be encoded using MD5, SHA1, or BCrypt.
!!! tip
2019-07-01 09:30:05 +00:00
Use `htpasswd` to generate the passwords.
2019-04-03 12:32:04 +00:00
### `users`
The `users` option is an array of authorized users. Each user will be declared using the `name:encoded-password` format.
!!! Note
If both `users` and `usersFile` are provided, the two are merged. The content of `usersFile` has precedence over `users`.
2019-04-03 12:32:04 +00:00
### `usersFile`
The `usersFile` option is the path to an external file that contains the authorized users for the middleware.
The file content is a list of `name:encoded-password`.
??? example "A file containing test/test and test2/test2"
2019-04-24 15:44:04 +00:00
```txt
test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/
test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0
```
!!! Note
If both `users` and `usersFile` are provided, the two are merged. The content of `usersFile` has precedence over `users`.
2019-04-03 12:32:04 +00:00
### `realm`
You can customize the realm for the authentication with the `realm` option. The default value is `traefik`.
2019-04-03 12:32:04 +00:00
### `headerField`
You can customize the header field for the authenticated user using the `headerField`option.
2019-04-03 12:32:04 +00:00
```yaml tab="Docker"
labels:
- "traefik.http.middlewares.my-auth.basicauth.headerField=X-WebAuth-User"
```
2019-04-03 12:32:04 +00:00
```yaml tab="Kubernetes"
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: my-auth
spec:
basicAuth:
# ...
headerField: X-WebAuth-User
```
2019-04-24 15:44:04 +00:00
```json tab="Marathon"
"labels": {
"traefik.http.middlewares.my-auth.basicauth.headerField": "X-WebAuth-User"
}
```
2019-04-03 12:32:04 +00:00
```toml tab="File"
2019-07-01 09:30:05 +00:00
[http.middlewares.my-auth.basicAuth]
2019-04-03 12:32:04 +00:00
# ...
headerField = "X-WebAuth-User"
```
2019-04-03 12:32:04 +00:00
### `removeHeader`
Set the `removeHeader` option to `true` to remove the authorization header before forwarding the request to your service. (Default value is `false`.)