{"record":{"id":"8545261c247160c6","repo":"netbirdio/netbird","slug":"auth-is-not-supported-for-tls-services","errorCode":null,"errorMessage":"auth is not supported for TLS services","messagePattern":"auth is not supported for TLS services","errorType":"validation","errorClass":null,"httpStatus":400,"severity":"error","filePath":"management/internals/modules/reverseproxy/service/service.go","lineNumber":941,"sourceCode":"\t}\n\tif s.isAuthEnabled() {\n\t\treturn errors.New(\"auth is not supported for TCP/UDP services\")\n\t}\n\tif len(s.Targets) != 1 {\n\t\treturn errors.New(\"TCP/UDP services must have exactly one target\")\n\t}\n\tif s.Mode == ModeUDP && s.Targets[0].ProxyProtocol {\n\t\treturn errors.New(\"proxy_protocol is not supported for UDP services\")\n\t}\n\treturn s.validateL4Target(s.Targets[0])\n}\n\nfunc (s *Service) validateTLSMode() error {\n\tif s.Domain == \"\" {\n\t\treturn errors.New(\"domain is required for TLS services (used for SNI matching)\")\n\t}\n\tif s.isAuthEnabled() {\n\t\treturn errors.New(\"auth is not supported for TLS services\")\n\t}\n\tif s.ListenPort == 0 {\n\t\treturn errors.New(\"listen_port is required for TLS services\")\n\t}\n\tif len(s.Targets) != 1 {\n\t\treturn errors.New(\"TLS services must have exactly one target\")\n\t}\n\treturn s.validateL4Target(s.Targets[0])\n}\n\nfunc (s *Service) validateHTTPTargets() error {\n\tfor i, target := range s.Targets {\n\t\tswitch target.TargetType {\n\t\tcase TargetTypePeer, TargetTypeHost, TargetTypeDomain:\n\t\t\t// Host is normally overwritten by replaceHostByLookup with the\n\t\t\t// resolved peer IP / resource address; operator-supplied values\n\t\t\t// are honored only when DirectUpstream is set. Validate the\n\t\t\t// override here so misconfigured hosts fail fast at API time.","sourceCodeStart":923,"sourceCodeEnd":959,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/management/internals/modules/reverseproxy/service/service.go#L923-L959","documentation":"Returned by validateTLSMode when isAuthEnabled() is true on a tls service. TLS mode is an encrypted byte passthrough keyed by SNI: the proxy never decrypts the stream (no termination on an HTTP layer it controls), so it cannot run password/pin/bearer/header challenges. All four auth types are checked, same as for tcp/udp.","triggerScenarios":"Submitting a tls service with auth.password_auth / pin_auth / bearer_auth enabled or any enabled header_auths entry; converting an HTTPS service that had SSO (bearer auth) into tls passthrough without removing the auth block.","commonSituations":"Wanting 'secure' database TLS forwarding with a login prompt and not realizing auth is an HTTP-mode feature. Template reuse from an authenticated HTTP service. Upgrades where previously ignored auth fields on tls services now fail validation.","solutions":["Remove or disable every auth block on the tls service.","Use mode http with an https target_protocol if you want the proxy to terminate TLS and authenticate users.","Control reachability with NetBird access groups, ACLs, or access_restrictions instead."],"exampleFix":"// before\n{ \"mode\": \"tls\", \"listen_port\": 636,\n  \"auth\": { \"bearer_auth\": { \"enabled\": true, \"distribution_groups\": [\"admins\"] } },\n  \"targets\": [...] }\n\n// after\n{ \"mode\": \"tls\", \"listen_port\": 636, \"targets\": [...] }","handlingStrategy":"validation","validationCode":"func checkTLSNoAuth(mode string, auth AuthConfig) error {\n\tif mode == \"tls\" && anyAuthEnabled(auth) {\n\t\treturn errors.New(\"strip all auth blocks for tls services\")\n\t}\n\treturn nil\n}","typeGuard":"func isTLSAuthClean(mode string, auth AuthConfig) bool {\n\treturn mode != \"tls\" || !anyAuthEnabled(auth)\n}","tryCatchPattern":"if err := svc.Validate(); err != nil {\n\tif strings.Contains(err.Error(), \"auth is not supported for TLS\") {\n\t\treturn respondBadRequest(errors.New(\"use http mode for authenticated access\"))\n\t}\n\treturn respondBadRequest(err)\n}","preventionTips":["Pick mode by whether the proxy must terminate and authenticate: http yes, tls no.","Keep auth config in a mode-conditional section of your templates.","Remember the auth check covers header_auths too, not just the obvious three."],"tags":["netbird","reverse-proxy","validation","tls","auth","l4","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}