添加Traefik后出现401未授权登录问题求助

项目中新增Traefik后，基于SPNEGO、Kerberos和LDAP的单点登录（SSO）流程出现401未授权错误，但直接调用认证服务时认证流程仍可正常工作。

登录服务接收到的请求头参数 #

host<=>serverB:7012
user-agent<=>Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
accept<=>application/json, text/plain, */*
accept-encoding<=>gzip, deflate, br
accept-language<=>fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7,ar;q=0.6
cache-control<=>no-cache
expires<=>Sat, 01 Jan 2000 00:00:00 GMT
origin<=>https://serverA:8780
pragma<=>no-cache
referer<=>https://serverA:8780/
sec-ch-ua<=>"Not.A/Brand";v="8", "Chromium";v="114", "Google Chrome";v="114"
sec-ch-ua-mobile<=>?0
sec-ch-ua-platform<=>"Windows"
sec-fetch-dest<=>empty
sec-fetch-mode<=>cors
sec-fetch-site<=>cross-site
x-b3-flags<=>0
x-b3-parentspanid<=>5b4839cd01e98d27
x-b3-sampled<=>true
x-b3-spanid<=>1e2966464c9de98d
x-b3-traceid<=>5ebea177a90c149f985d142fd4065369
x-forwarded-for<=>10.19.48.61
x-forwarded-host<=>serverB:7012
x-forwarded-port<=>7012
x-forwarded-proto<=>https
x-forwarded-server<=>serverB
x-real-ip<=>x.x.x.x // clientHostIp

Chrome中捕获的请求与响应信息 #

响应头 #

Access-Control-Allow-Credentials:true
Access-Control-Allow-Origin:https://serverA:8780
Access-Control-Expose-Headers:Content-type, Authorization
Cache-Control:no-cache, no-store, max-age=0, must-revalidate
Content-Length:150
Content-Type:application/json;charset=UTF-8
Date:Tue, 18 Jul 2023 12:04:08 GMT
Expires:0
Pragma:no-cache
Strict-Transport-Security:max-age=31536000 ; includeSubDomains
Vary:Access-Control-Request-Headers
Vary:Access-Control-Request-Method
Vary:Origin
Www-Authenticate:Negotiate
X-Content-Type-Options:nosniff
X-Frame-Options:DENY
X-Xss-Protection:1; mode=block

请求头 #

:Authority:serverB:7012
:Method:GET
:Path:/Auth/security/login
:Scheme:https
Accept:application/json, text/plain, */*
Accept-Encoding:gzip, deflate, br
Accept-Language:fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7,ar;q=0.6
Cache-Control:no-cache
Expires:Sat, 01 Jan 2000 00:00:00 GMT
Origin:https://serverA:8780
Pragma:no-cache
Referer:https://serverA:8780/
Sec-Ch-Ua:"Not.A/Brand";v="8", "Chromium";v="114", "Google Chrome";v="114"
Sec-Ch-Ua-Mobile:?0
Sec-Ch-Ua-Platform:"Windows"
Sec-Fetch-Dest:empty
Sec-Fetch-Mode:cors
Sec-Fetch-Site:cross-site
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36

Traefik TOML配置文件 #

logLevel = "DEBUG"

[traefikLog]
  filePath = "/xxx/binaries/traefik/logs/traefik.log" 

[accessLog]
  filePath = "/xxx/binaries/traefik/logs/access.log"

defaultEntryPoints = ["http"]


[entryPoints]
  [entryPoints.http]
    address = ":7012"
    [entryPoints.http.tls]
      [[entryPoints.http.tls.certificates]]
      certFile = "path-to-crt-file/traefik.crt"
      keyFile = "path-to-key-file/traefik.key"
  [entryPoints.admin]
    address = "serverB:8081"
    [entryPoints.admin.auth]
     [entryPoints.admin.auth.basic]
       users = ["admin:{SHA}0y9IVHbX4ddz5zd4z5I="]
  [entryPoints.ping]
    address = "serverB:8082"

[api]
  entrypoint="admin"
  [api.statistics]
    RecentErrors = 10
[ping]
  entryPoint = "ping"

[consulCatalog]
  endpoint = "xx.xx.xx.xx:8500"
  watch = true
  prefix = "traefik" 

[tracing]
  backend = "zipkin"
  serviceName = "traefik"
  [tracing.zipkin]
    httpEndpoint = "http://server:9411/api/v1/spans"
    debug = false

Auth服务日志中的错误信息 #

>>> KDCRep: init() encoding tag is 126 req type is 11
>>>KRBError:
     sTime is Mon Jul 17 17:29:45 CEST 2023 1689607785000
     suSec is 379445
     error code is 25
     error Message is 需要额外预认证
     sname is krbtgt/xxx@xx
     eData provided.
     msgType is 30
>>>Pre-Authentication Data:
     PA-DATA type = 11
     PA-ETYPE-INFO etype = 23, salt = 

>>>Pre-Authentication Data:
     PA-DATA type = 19
     PA-ETYPE-INFO2 etype = 23, salt = null, s2kparams = null

>>>Pre-Authentication Data:
     PA-DATA type = 2
     PA-ENC-TIMESTAMP
>>>Pre-Authentication Data:
     PA-DATA type = 16

>>>Pre-Authentication Data:
     PA-DATA type = 15

请问我应该使用forwardAuth，还是Traefik配置存在问题？感谢您的帮助！

内容的提问来源于stack exchange，提问作者M-BNCH