Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 3477ec7

Browse files
authored
Construct redirect URIs when behind proxy (#24)
1 parent ef968cc commit 3477ec7

File tree

4 files changed

+18
-4
lines changed

4 files changed

+18
-4
lines changed

‎README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,9 @@ $ cd nginx-openid-connect
8181
$ docker run -d -p 8010:8010 -v $PWD:/etc/nginx/conf.d nginx-plus nginx -g 'daemon off; load_module modules/ngx_http_js_module.so;'
8282
```
8383

84+
### Running behind another proxy or load balancer
85+
When NGINX Plus is deployed behind another proxy, the original protocol and port number are not available. NGINX Plus needs this information to construct the URIs it passes to the IdP and for redirects. By default NGINX Plus looks for the X-Forwarded-Proto and X-Forwarded-Port request headers to construct these URIs.
86+
8487
## Configuring your IdP
8588

8689
* Create an OpenID Connect client to represent your NGINX Plus instance
@@ -104,6 +107,7 @@ Manual configuration involves reviewing the following files so that they match y
104107
* Modify all of the `map...$oidc_` blocks to match your IdP configuration
105108
* Modify the URI defined in `map...$oidc_logout_redirect` to specify an unprotected resource to be displayed after requesting the `/logout` location
106109
* Set a unique value for `$oidc_hmac_key` to ensure nonce values are unpredictable
110+
* If NGINX Plus is deployed behind another proxy or load balancer, modify the `map...$redirect_base` and `map...$proto` blocks to define how to obtain the original protocol and port number.
107111

108112
* **frontend.conf** - this is the reverse proxy configuration
109113
* Modify the upstream group to match your backend site or app

‎openid_connect.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ function auth(r) {
3535
r.headersOut['Set-Cookie'] = [
3636
"auth_redir=" + r.variables.request_uri + "; " + r.variables.oidc_cookie_flags,
3737
"auth_nonce=" + noncePlain + "; " + r.variables.oidc_cookie_flags ];
38-
r.return(302, r.variables.oidc_authz_endpoint + "?response_type=code&scope=" + r.variables.oidc_scopes + "&client_id=" + r.variables.oidc_client + "&state=0&redirect_uri="+ r.variables.scheme+"://"+r.variables.host+":"+r.variables.server_port + r.variables.redir_location + "&nonce=" + nonceHash);
38+
r.return(302, r.variables.oidc_authz_endpoint + "?response_type=code&scope=" + r.variables.oidc_scopes + "&client_id=" + r.variables.oidc_client + "&state=0&redirect_uri="+ r.variables.redirect_base + r.variables.redir_location + "&nonce=" + nonceHash);
3939
return;
4040
}
4141

@@ -177,7 +177,7 @@ function codeExchange(r) {
177177
r.log("OIDC success, creating session " + r.variables.request_id);
178178
r.variables.new_session = tokenset.id_token; // Create key-value store entry
179179
r.headersOut["Set-Cookie"] = "auth_token=" + r.variables.request_id + "; " + r.variables.oidc_cookie_flags;
180-
r.return(302, r.variables.cookie_auth_redir);
180+
r.return(302, r.variables.redirect_base+r.variables.cookie_auth_redir);
181181
}
182182
);
183183
} catch (e) {

‎openid_connect.server_conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
internal;
3939
proxy_ssl_server_name on; # For SNI to the IdP
4040
proxy_set_header Content-Type "application/x-www-form-urlencoded";
41-
proxy_set_body "grant_type=authorization_code&code=$arg_code&client_id=$oidc_client&client_secret=$oidc_client_secret&redirect_uri=$scheme://$host:$server_port$redir_location";
41+
proxy_set_body "grant_type=authorization_code&code=$arg_code&client_id=$oidc_client&client_secret=$oidc_client_secret&redirect_uri=$redirect_base$redir_location";
4242
proxy_method POST;
4343
proxy_pass $oidc_token_endpoint;
4444
}

‎openid_connect_configuration.conf‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,21 @@ map $host $oidc_hmac_key {
3939
default "ChangeMe";
4040
}
4141

42-
map $scheme $oidc_cookie_flags {
42+
map $proto $oidc_cookie_flags {
4343
http "Path=/; SameSite=lax;"; # For HTTP/plaintext testing
4444
https "Path=/; SameSite=lax; HttpOnly; Secure;"; # Production recommendation
4545
}
4646

47+
map $http_x_forwarded_port $redirect_base {
48+
"" $proto://$host:$server_port;
49+
default $proto://$host:$http_x_forwarded_port;
50+
}
51+
52+
map $http_x_forwarded_proto $proto {
53+
"" $scheme;
54+
default $http_x_forwarded_proto;
55+
}
56+
4757
# ADVANCED CONFIGURATION BELOW THIS LINE
4858
# Additional advanced configuration (server context) in openid_connect.server_conf
4959

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /