title: Setting up authentication/authorization using Traefik ForwardAuth
body: <p>I'm using Docker to setup some services and Traefik 2 acts as a reverse proxy for these services.
  So far I was using Basic Auth to protect the access to the services, but I'm trying to get rid of the user/pass prompt.</p>
  <p>Looking at the Traefik's documentation, I found the &quot;<strong>ForwardAuth</strong>&quot; middleware which seems fine. I'm planning to use it to replace Basic Auth, but a full implementation example is not provided as an example, and I'm having a hard time trying to set it up.</p>
  <p>So far, thanks to Traefik forward-auth, I'm successfully calling a specific URL on a remote server in charge of the authentication (this server is developped with Spring Boot by myself). I understand that if the authentication server answers 200, it means &quot;authentication success&quot; while another code means &quot;authentication failure&quot;.
  Yet, I'm currently unable to write the authentication code on the remote server as I don't know how to check if I must return 200 or something else. Especially I don't know how to communicate information between Traefik and the authentication server.</p>
  <p>Basically, the problems I have are:</p>
  <ol>
  <li>I can't ask the user for his/her username/password using Traefik</li>
  <li>When the authentication server receives the request from Traefik, it has no way to define that the source request was a previously authenticated user</li>
  </ol>
  <p>The following picture shows most of my concerns:</p>
  <p><a href="https://i.stack.imgur.com/eDwLg.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/eDwLg.png" alt="My questions about forward-auth" /></a></p>
  <p>What I'd like to achieve is the following behavior:</p>
  <ol>
  <li>The user tries to access to the Docker services without entering any username/password</li>
  <li>Traefik determines that the user is not authenticated, thanks to forward-auth it asks the authentication server for authentication</li>
  <li>The authentication server determines that the user is not authenticated, the user is redirected to the login page</li>
  <li>The user enters his/her username/password on the authentication server</li>
  <li>The user is redirected to the Docker services</li>
  <li>Traefik determines that the user is authenticated</li>
  </ol>
  <p>So far, I can successfully achieve step 1 to 5, but I don't know how to achieve step 6.</p>
  <p>Is this the right way to use ForwardAuth?
  If it is, are there some headers I must use to transfer the auth information? If not, is it possible to achieve what I want using ForwardAuth?</p>