# HTTPS ReverseProxy + Basic authentification

**URL:** <https://discourse.haproxy.org/t/https-reverseproxy-basic-authentification/1656>\
**Category:** Help!\
**Created:** [October 10, 2017, 2:28pm UTC](https://discourse.haproxy.org/t/https-reverseproxy-basic-authentification/1656 "2017-10-10T14:28:03Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![anon58004075](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@anon58004075](https://discourse.haproxy.org/u/anon58004075)\
**Post date:** [October 10, 2017, 2:28pm UTC](https://discourse.haproxy.org/t/https-reverseproxy-basic-authentification/1656/1 "2017-10-10T14:28:03Z")

</div>

Hello there.  
I’m using HaProxy reverse proxy with https for a few months now.  
Here is my conf :

* * *

global  
log /dev/log local0  
log /dev/log local1 notice  
chroot /var/lib/haproxy  
stats socket /run/haproxy/admin.sock mode 660 level admin  
stats timeout 30s  
user haproxy  
group haproxy  
daemon

```
ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
ssl-default-bind-options no-sslv3

```

defaults  
log global  
mode http  
option httplog  
option dontlognull  
timeout connect 5000  
timeout client 50000  
timeout server 50000  
option forwardfor except 127.0.0.0/8  
errorfile 400 /etc/haproxy/errors/400.http  
errorfile 403 /etc/haproxy/errors/403.http  
errorfile 408 /etc/haproxy/errors/408.http  
errorfile 500 /etc/haproxy/errors/500.http  
errorfile 502 /etc/haproxy/errors/502.http  
errorfile 503 /etc/haproxy/errors/503.http  
errorfile 504 /etc/haproxy/errors/504.http

############################################   
frontend port80-redirect  
mode http  
bind 192.168.10.5:80  
redirect scheme https  
############################################  
frontend port443-relay  
bind 192.168.10.5:443  
mode tcp  
tcp-request inspect-delay 5s  
tcp-request content accept if { req\_ssl\_hello\_type 1 }  
use\_backend backendgogs if { req\_ssl\_sni -i mydomain1 }  
use\_backend backendmulticraft if { req\_ssl\_sni -i mydomain2 }  
use\_backend backendwigo if { req\_ssl\_sni -i mydomain3 }  
default\_backend backendgogs  
############################################  
backend backendgogs  
mode tcp  
server vm-git ip1:443 maxconn 32

backend backendmulticraft  
mode tcp  
server vm-multicraft ip2:443 maxconn 32

backend backendwigo  
mode tcp  
server vm-wigo ip3:443 maxconn 32

* * *

Here is my question :  
One of my web interface (mydomain3, the last backend) does not have an authentification system.  
As I know it is possible to have an basic authentification with HaProxy, but i’m not sure about how it works.  
I tried to add an userlist :

userlist Admins  
group AdminGroup users admin  
user admin password 1d4cdafaac5871387085b898f4ff81be

And then add this to the backend :

acl AuthOkay\_UsersAuth http\_auth(Admins)  
http-request auth realm Admins if !AuthOkay\_Admins

But HaProxy fail to start, so I guess something is wrong.

If someone could enlight me, I would be grateful 🙂

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [October 10, 2017, 3:29pm UTC](https://discourse.haproxy.org/t/https-reverseproxy-basic-authentification/1656/2 "2017-10-10T15:29:15Z")

</div>

When haproxy fails to starts it returns error message with the exact reason why it cannot start. I strongly suggest you read those 😉

It will probably tell you that the ACL AuthOkay\_Admins doesn’t exist:

```
acl AuthOkay_UsersAuth http_auth(Admins)
http-request auth realm Admins if !AuthOkay_Admins

```

The ACL you define is called AuthOkay\_UsersAuth, not AuthOkay\_Admins.

Also, quick tip: instead of using if with negation (if !), just use unless:

> acl AuthOkay\_UsersAuth http\_auth(Admins)  
> http-request auth realm Admins unless AuthOkay\_UsersAuth

---

<div class="post-metadata">

**Author:** ![anon58004075](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@anon58004075](https://discourse.haproxy.org/u/anon58004075)\
**Post date:** [October 10, 2017, 4:15pm UTC](https://discourse.haproxy.org/t/https-reverseproxy-basic-authentification/1656/3 "2017-10-10T16:15:10Z")

</div>

Eh ! Have to say that I went lazy on that one :b

Indeed, after edited to

acl AuthOkay\_UsersAuth http\_auth(Admins)  
http-request auth realm Admins unless AuthOkay\_UsersAuth

Haproxy restart well.

But I still dont have any basic authentification showing up, am I missing something ?

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [October 10, 2017, 5:32pm UTC](https://discourse.haproxy.org/t/https-reverseproxy-basic-authentification/1656/4 "2017-10-10T17:32:28Z")

</div>

I can see what’s wrong. Your just using haproxy as a TCP proxy, and passing encrypted TLS traffic transparently to the backend.

So there is no way for haproxy to even see the http transactions, let alone protect the backend with HTTP Authentication.

You either terminate SSL and HTTP on haproxy, or you have to configure this on your backend.

---

<div class="post-metadata">

**Author:** ![anon58004075](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@anon58004075](https://discourse.haproxy.org/u/anon58004075)\
**Post date:** [October 10, 2017, 5:56pm UTC](https://discourse.haproxy.org/t/https-reverseproxy-basic-authentification/1656/5 "2017-10-10T17:56:57Z")

</div>

Yes, that’s what I thought.

I wont setup SSL on the haproxy machine.  
When you say configure it on your backend, are you talking about something like install a haproxy on the backend ?

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [October 10, 2017, 7:40pm UTC](https://discourse.haproxy.org/t/https-reverseproxy-basic-authentification/1656/6 "2017-10-10T19:40:32Z")

</div>

No, i mean the actual application, like Apache or nginx.

Of course you can insert another layer of haproxy as well, but you still have to terminate SSL on that haproxy instance then.

---

<div class="post-metadata">

**Author:** ![anon58004075](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@anon58004075](https://discourse.haproxy.org/u/anon58004075)\
**Post date:** [October 11, 2017, 6:57am UTC](https://discourse.haproxy.org/t/https-reverseproxy-basic-authentification/1656/7 "2017-10-11T06:57:43Z")

</div>

Ok, I got it. Thanks for your explanations.