-
-
Save sbogomolov/708eba479c61b0bc0ada18aad5b2c544 to your computer and use it in GitHub Desktop.
| from authentik.sources.plex.models import UserPlexSourceConnection | |
| import json | |
| connection = UserPlexSourceConnection.objects.filter(user=request.user).first() | |
| if not connection: | |
| ak_logger.info("Overseer: No Plex connection found") | |
| return {} | |
| base_url = "http://overseerr.apps:5055" | |
| end_point = "/api/v1/auth/plex" | |
| headers = { | |
| "Content-Type": "application/json", | |
| } | |
| data = { | |
| "authToken": connection.plex_token | |
| } | |
| response = requests.post(base_url + end_point, headers=headers, data=json.dumps(data)) | |
| if response.status_code == 200: | |
| sid_value = response.cookies.get("connect.sid") | |
| cookie_obj = f"connect.sid={sid_value}" | |
| ak_logger.info("Overseer: Successfully authenticated with Plex token") | |
| return { | |
| "ak_proxy": { | |
| "user_attributes": { | |
| "additionalHeaders": { | |
| "Cookie": cookie_obj | |
| } | |
| } | |
| } | |
| } | |
| else: | |
| ak_logger.error(f"Overseer: The request failed with: {response.text}") | |
| return {} |
I’ve seen this issue when Plex token was outdated. What helped in my case was removing Plex integration for the authentik user, then adding it again (which required me to login via Plex SSO again). This refreshed the token. Then I had to thoroughly clear my browser’s cache. After that - things started working again.
Token is correct. The cookie is not getting to Overseerr. You mentioned you use Traefik... Do you have any special header configs to allow cookies to be set?
I do not think I have anything related to that in my Traefik config. Only this is somewhat related:
allowCrossNamespace: trueHere is my authentik middleware (allowed headers are configured here):
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: authentik
namespace: authentik
labels:
app.kubernetes.io/name: authentik
spec:
forwardAuth:
address: http://authentik-server.authentik/outpost.goauthentik.io/auth/traefik
trustForwardHeader: true
authResponseHeaders:
- X-authentik-username
- X-authentik-groups
- X-authentik-email
- X-authentik-name
- X-authentik-uid
- X-authentik-jwt
- X-authentik-meta-jwks
- X-authentik-meta-outpost
- X-authentik-meta-provider
- X-authentik-meta-app
- X-authentik-meta-version
- X-Plex-Token
- Authorization
- CookieHere is the Overseerr’s ingress route:
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: overseerr
namespace: apps
annotations:
kubernetes.io/ingress.class: ingress-public
labels:
app.kubernetes.io/name: overseerr
spec:
entryPoints:
- websecure
routes:
- kind: Rule
match: Host(`overseerr.domain.tld`)
middlewares:
- name: authentik
namespace: authentik
services:
- name: overseerr
port: http
- kind: Rule
match: Host(`overseerr.domain.tld`) && PathPrefix(`/outpost.goauthentik.io/`)
services:
- name: authentik-server
namespace: authentik
port: http
nativeLB: true
PERFECT. I have it working now.
Mine was missing - Cookie on the headers. THANK YOU
Nice, I’m glad it works for you @lmaced0!
Found that having this setting enabled will break this; fyi. Disabling Enable CSRF Protection allowed setup to work for me.
Thanks for the fyi @mil1i.
Have you modified the
base_urlin the script to match your Overseerr URL? When you test your custom scope mapping (third icon in the Actions column), do you get something like this?{ "ak_proxy": { "user_attributes": { "additionalHeaders": { "Cookie": "connect.sid=<token>" } } } }
Hi there! I've created the Source connection for Plex and I've created the mapping but I don't get that same output when I test it with a user who has an email address that's used in my Plex account.
Does the username AND email need to match? Other than this part I'm asking for I don't see what could be wrong to be honest, so I am a little lost. I don't get any error, nothing. Just a reply saying the test was successfully sent.
@imightbelosthere you need to explicitly link authentik account to Plex account.
When logged in to authentik, go to settings (cogwheel in the top right), then Connected Services. You should see Plex there. You can click Connect and log in with the Plex account that will be associated with the currently logged in authentik user.
When logged in to authentik, go to settings (cogwheel in the top right), then Connected Services. You should see Plex there. You can click Connect and log in with the Plex account that will be associated with the currently logged in authentik user.
Thank you so much for that! :) Makes much more sense and I can now see the output that is expected!
@imightbelosthere I’m glad it worked for you :)
Well... sort'a worked... I'm having the same situation as others which is the fact that I get to the overseerr page and it prompts me for the login instead of SSO'ing using the connected service.
On my overseerr.yml file I have the following:
Then on the Proxy Provider I have:
What am I doing wrong here?
Do you have that custom scope selected?
custom scope... ??? Pardon my ignorance... Where exactly?
You should’ve created a custom scope mapping (code in the first post). Then you need to use this custom scope mapping in your proxy provider. You should see it in the right list Selected Scopes.
You should’ve created a custom scope mapping (code in the first post). Then you need to use this custom scope mapping in your proxy provider. You should see it in the right list
Selected Scopes.
🤦 That's just it... I've created the Scope Mapping as a Plex Source Mapping!
I have it now on the Proxy Provider, still I land on the login page... hmmmm...
Try incognito tab. If it works there - clear browsing history.
Try incognito tab. If it works there - clear browsing history.
Damn... Right on the money! It works perfectly now! Thanks!!!! :)
You’re most welcome.
Ok. I'm an idiot. Instead of pointing to Overseerr internally I was using its external URL which obviously wouldn't work since Authentik is in the way. I'm getting a token now.
However, even after adding the custom scope mapping and linking it to the Provider, I'm landing on Overseerr's login page. I see Scope Mapping is the right option from the conversation above.