# Browzer with authentik **URL:** \ **Category:** BrowZer\ **Created:** [June 24, 2024, 8:48am UTC](https://openziti.discourse.group/t/browzer-with-authentik/2769 "2024-06-24T08:48:29Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![marvkis](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/marvkis/32/723_2.png) [@marvkis](https://openziti.discourse.group/u/marvkis)\ **Post date:** [June 24, 2024, 8:48am UTC](https://openziti.discourse.group/t/browzer-with-authentik/2769/1 "2024-06-24T08:48:29Z")
Hi there, I am currently trying to get browzer to work in our infrastructure. We are using [Authentik](https://goauthentik.io/) as IDP. I installed the browzer-bootstrapper and started some initial testing. It seems I have initial things up - browzer is reachable, I also have an OriginTrail token but I only see the 'browzer' logo startup / splash screen. On the javascript console I see messages indicating that there is a CORS problem when communicating with the IDP: > Access to fetch at '[https://auth](https://auth).[redacted]/application/o/browzer-test-1/.well-known/openid-configuration' from origin '[https://test1.external](https://test1.external).[redacted]' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled. Is there a working / validated setup with Authentik? Any hints how to proceed? Thanks & Bye, Chris ---
**Author:** ![marvkis](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/marvkis/32/723_2.png) [@marvkis](https://openziti.discourse.group/u/marvkis)\ **Post date:** [July 2, 2024, 9:14pm UTC](https://openziti.discourse.group/t/browzer-with-authentik/2769/2 "2024-07-02T21:14:14Z")
Hi. I found the problem - it was just a typo in the ' Redirect URI' - authentik also uses this to validate the CORS request. I'm able to authentikate with browZer now. Bye, Chris ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [July 2, 2024, 9:16pm UTC](https://openziti.discourse.group/t/browzer-with-authentik/2769/3 "2024-07-02T21:16:12Z")
I'm so sorry I lost track of this issue and forgot to follow up! ☹ my bad. I'm glad you got through it though! ---
**Author:** ![marvkis](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/marvkis/32/723_2.png) [@marvkis](https://openziti.discourse.group/u/marvkis)\ **Post date:** [July 2, 2024, 9:30pm UTC](https://openziti.discourse.group/t/browzer-with-authentik/2769/4 "2024-07-02T21:30:40Z")
No problem... I'm making my way through setting it up in a kubernetes environment. Right now I'm struggling with getting the wildcard certificates into the router. Does it also work with the alt\_server\_certs section? [Conventions | OpenZiti](https://openziti.io/docs/reference/configuration/conventions#identity) ---
**Author:** ![marvkis](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/marvkis/32/723_2.png) [@marvkis](https://openziti.discourse.group/u/marvkis)\ **Post date:** [July 2, 2024, 9:37pm UTC](https://openziti.discourse.group/t/browzer-with-authentik/2769/5 "2024-07-02T21:37:43Z")
Hmm. it seems to honor the configuration ```auto [77563.616] INFO transport/v2/wss.Listen: ws.Config{ writeTimeout 10000000000 readTimeout 5000000000 idleTimeout 120000000000 pongTimeout 60000000000 pingInterval 54000000000 handshakeTimeout 10000000000 readBufferSize 4096 writeBufferSize 4096 enableCompression true serverCert /etc/ziti/config/core-router.server.chain.cert key /etc/ziti/config/core-router.key server_key alt_server_certs[%!d(MISSING)].serverCert /etc/ziti/wss-cert/tls.crt alt_server_certs[%!d(MISSING)].server_key /etc/ziti/wss-cert/tls.key } ``` but when I try to acces the websocket url it presents it's router identity and not the let's encrypt wildcard cert from the alt\_server\_certs files... ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [July 2, 2024, 9:40pm UTC](https://openziti.discourse.group/t/browzer-with-authentik/2769/6 "2024-07-02T21:40:51Z")
As you discovered, yes it does work with alt\_server\_certs. One thing that's not always obvious is that the alt\_server\_cert **must not** have an overlapping SANS as your non-LE cert. Meaning, if you setup your OpenZiti overlay's self-signed certs using "[my.controller.com](http://my.controller.com)", you **must not** make a LE cert valid for "[my.controller.com](http://my.controller.com)". Doing so makes the SNI unreliable and often fails. Does that help? Could that be the problem? ---
**Author:** ![marvkis](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/marvkis/32/723_2.png) [@marvkis](https://openziti.discourse.group/u/marvkis)\ **Post date:** [July 2, 2024, 9:43pm UTC](https://openziti.discourse.group/t/browzer-with-authentik/2769/7 "2024-07-02T21:43:48Z")
> [@TheLumberjack](#): > > ne thing that's not always obvious is that the alt\_server\_cert **must not** have an overlapping SANS as your non-LE cert yes... that might be a pointer: ```auto edge: csr: sans: dns: - localhost - edge.kis.sdn.xxx - wss.external.xxx. #<-- this is my wss url... - transport.kis.sdn.xxx ip: - 127.0.0.1 ``` thanks, will double check that! ---
**Author:** ![marvkis](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/marvkis/32/723_2.png) [@marvkis](https://openziti.discourse.group/u/marvkis)\ **Post date:** [July 2, 2024, 9:59pm UTC](https://openziti.discourse.group/t/browzer-with-authentik/2769/8 "2024-07-02T21:59:56Z")
Cool. Things start to work 😉 ![Bildschirmfoto 2024-07-02 um 23.57.32](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/1/122eb11bd41044f1113b9bc301acab3144ea8a36.jpeg)