Traefik OIDC setup

I recently worked on a project where we needed to secure our application by requiring users to authenticate against an Identity Provider before accessing it.

To avoid adding extra components to our stack, I looked for a solution that would integrate easily with our existing Traefik Proxy setup. I came across the Traefik OIDC plugin which supports a wide range of Identity Providers, including Google, Azure, Auth0, Okta, Keycloak, Cognito, GitLab, and GitHub, making it perfect for our use case.

To install the plugin, add the following lines to your static Traefik configuration:

experimental:
  plugins:
    traefikoidc:
      moduleName: github.com/lukaszraczylo/traefikoidc
      version: v1.0.29

In your dynamic Traefik configuration, add the plugin configuration for the traefikoidc middleware that will be referenced later in your application Traefik configuration. In case of Entra ID as Identity Provider, configure your TenantId, ClientId, Client Secret, and the session encryption key accordingly:

http:
  middlewares:
    entra-oidc:
      plugin:
        traefikoidc:
          providerURL: "https://login.microsoftonline.com/<TENANT_ID>/v2.0"
          clientID: ""
          clientSecret: ""
          sessionEncryptionKey: ""
          callbackURL: "/oauth2/callback"
          logoutURL: "/oauth2/logout"
          postLogoutRedirectURI: "/"
          forceHTTPS: true
          sessionMaxAge: 28800

Now, in your application configuration for Traefik, add the label referencing the entra-oidc@file middleware defined above and Traefik will handle the whole authentication flow for you:

traefik.http.routers.my-app.middlewares=entra-oidc@file

The whole Docker service definition looks like this:

services:
  my-app:
    image: traefik/whoami
    expose:
      - "80"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.my-app.rule=Host(`foo.bar`)"
      - "traefik.http.routers.my-app.entrypoints=websecure"
      - "traefik.http.routers.my-app.tls=true"
      - "traefik.http.routers.my-app.tls.certresolver=letsencrypt"
      - "traefik.http.routers.my-app.middlewares=entra-oidc@file"
      - "traefik.http.services.my-app.loadbalancer.server.port=80"

Using the Traefik OIDC plugin made perfect sense for us. It was easy to integrate, supports a variety of Identity Providers, and allows us to still rely on Traefik for all routing rules. This solution efficiently secures our application without adding unnecessary complexity to our stack.