PagerDuty alerter support for authenticated proxy?

[sauravnz]

Hello
We are using ElastAlert2 with the PagerDuty alerter, and this has been working for us through an unauthenticated proxy.

Our organization has now made authenticated outbound proxy usage mandatory, so we need PagerDuty notifications to go through a proxy that requires username/password authentication.

From the documentation and what I could find in the PagerDuty alerter config, I only see support for:

pagerduty_proxy: http://proxy.example.com:port

but I do not see a documented option for proxy username/password for PagerDuty.

My questions are:

• Is there already a supported way to use an authenticated proxy with the PagerDuty alerter?

• Can credentials be passed in the proxy URL itself, for example:
  pagerduty_proxy: "http://username:password@proxy.example.com:port"
  I tried this approach, but I was not able to get it working in our environment.

• If this is not currently supported, would maintainers be open to a PR to add first-class support for authenticated proxy configuration for PagerDuty?

If needed, I’m happy to work on a PR once I understand whether there is already a preferred approach for implementing this.

Thanks.

[jertel]

Yes, basic authentication is supported with the existing proxy parameter, using the URL syntax you mentioned. If it's not working you should investigate whether it's not working because of an auth failure, and confirm via proxy logs that it received the credentials as expected.

I suggest also checking whether the proxy is a standard or socks proxy and also that you're using the correct protocol identifier for your proxy. Read through how Python handles proxies here: https://requests.readthedocs.io/en/latest/user/advanced/#proxies

We're open to PRs but I'm not sure what else you would implement that isn't already supported.

[sauravnz]

Thanks for the clarification.

I’ve tested using the http://username:password@host:port format with the pagerduty_proxy setting, but it doesn’t appear to work in our environment. I’ll dig further into proxy logs to confirm whether credentials are being passed correctly or if the failure is happening earlier in the request flow.

Thankyou for maintaining ElastAlert2, it’s been a really solid tool for us and we rely on it quite a bit. Much Appreciated.

[sauravnz]

I did some further investigation and confirmed that our proxy is not using Basic authentication, but instead relies on NTLM. That explains why the current configuration was not working, since NTLM differs significantly from Basic auth.

When testing with curl, authentication works using NTLM-specific flags, for example:
curl --proxy-ntlm --proxy-user DOMAIN\\user:password ...

Based on this, it appears that ElastAlert currently does not support NTLM authentication for proxies.
I came across the Python library requests-ntlm, which could potentially be used to add this capability.

I’m happy to explore contributing a PR if this is something the project would accept.

[jertel]

Yes, please follow the CONTRIBUTION guidelines.