Configure proxy authentication for the dashboard

Configure the dashboard to read the signed-in user from the headers that your authenticating reverse proxy sets.

Prerequisites

A reverse proxy (OAuth2 Proxy, Authelia or similar) in front of the dashboard that authenticates users and forwards their identity in HTTP headers.
The dashboard reachable only through that proxy. In proxy mode the dashboard trusts the headers without checking where they came from, so a client that reaches the dashboard directly can set them.
Familiarity with choosing a dashboard mode.
A Redis for sessions, named in redis.default or dashboard.session.redis. The dashboard and management-api share it, and the chart refuses proxy mode without one.

Steps

Set the mode and map the proxy’s headers to dashboard fields. Set only the headers that differ from the defaults (X-Forwarded-User, X-Forwarded-Email, X-Forwarded-Groups, X-Forwarded-Preferred-Username).

dashboard:
  auth:
    mode: proxy
    roleMapping:
      adminGroups: [omnia-admins, platform-admins]
      editorGroups: [omnia-editors, developers]
  proxy:
    headerUser: X-Forwarded-User
    headerEmail: X-Forwarded-Email
    headerGroups: X-Forwarded-Groups          # comma-separated
    headerDisplayName: X-Forwarded-Preferred-Username

The user header is required. The others are optional. A user in no mapped group gets the viewer role, and a user in both an admin and an editor group gets admin.

Configure the proxy to forward the headers. With OAuth2 Proxy behind the NGINX ingress controller, the annotations below forward X-Auth-Request-* headers, so name those headers in the dashboard values:

# dashboard Ingress annotations (illustrative host names)
nginx.ingress.kubernetes.io/auth-url: "http://oauth2-proxy.auth.svc.cluster.local/oauth2/auth"
nginx.ingress.kubernetes.io/auth-signin: "https://dashboard.example.com/oauth2/start?rd=$escaped_request_uri"
nginx.ingress.kubernetes.io/auth-response-headers: "X-Auth-Request-User,X-Auth-Request-Email,X-Auth-Request-Groups"

dashboard:
  proxy:
    headerUser: X-Auth-Request-User
    headerEmail: X-Auth-Request-Email
    headerGroups: X-Auth-Request-Groups

With Authelia behind Traefik, list Remote-User, Remote-Email and Remote-Groups in the forwardAuth middleware’s authResponseHeaders, then set:

dashboard:
  proxy:
    headerUser: Remote-User
    headerEmail: Remote-Email
    headerGroups: Remote-Groups

Apply the values.

helm upgrade --install omnia oci://ghcr.io/altairalabs/charts/omnia \
  --devel --namespace omnia-system -f values.yaml

Verify

Open https://dashboard.example.com/api/auth/session through the proxy. It returns {"authenticated":true}.
Open https://dashboard.example.com/ in the same browser. The dashboard loads.

Troubleshooting

The request reached the dashboard with neither the user header nor a session cookie, so the dashboard sent it to /login, which sends proxy mode back to /. Confirm the proxy forwards the header named in dashboard.proxy.headerUser on every request, as in the next section. The session cookie carries Secure in production, so the browser stores and sends it only over HTTPS.

The dashboard does not recognise the user

Confirm the proxy forwards the user header on the request that reaches the dashboard.
Confirm the header names in dashboard.proxy.* match the proxy’s (header names are case-insensitive).
Check that no intermediate proxy strips the headers. curl -v through the proxy shows what arrives.

The user has the wrong role

Confirm the groups header is present and comma-separated.
Confirm the group names match dashboard.auth.roleMapping.*Groups exactly.