HTTP Basic Auth and set-xauthrequest about oauth2_proxy HOT 4 CLOSED

If you use oauth2_proxy in the original proxy mode, instead of the more flexible and complicated auth_request mode, then you can do this with the --pass-basic-auth flag. (The password put in the basic auth to the upstream can be set with the --basic-auth-password flag.)

You can get the username from auth_request but putting it into a basic auth header for the upstream is not easy. You may try to adapt from this part of the example at the bottom of the README:

    # pass information via X-User and X-Email headers to backend,
    # requires running with --set-xauthrequest flag
    auth_request_set $user   $upstream_http_x_auth_request_user;
    auth_request_set $email  $upstream_http_x_auth_request_email;
    proxy_set_header X-User  $user;
    proxy_set_header X-Email $email;

from oauth2_proxy.

Right, only x_auth_request_user and x_auth_request_email work in auth_request mode as oauth2_proxy can only pass header back to nginx, not insert into the stream going to the client. Didn't think of it until you clarified.

I guess this leaves me with 3 options:

1. Modify the backend server to accept a definable HTTP header containing username instead of a basic auth line.
2. Modify oauth2_proxy to pass a header with base64 encoded username to nginx.
3. Figure out if nginx can base64 encode a string, after receiving it from outh2_proxy to add the new header.

from oauth2_proxy.

I guess I need to learn more about HTTP headers. Although my backend application states "Basic Web Authentication" it does not look only for the Authentication header, but also a number of others, such as REMOTE_USER. The information you provided will accomplish what I need by setting the REMOTE_USER header appropriately. I am already doing just that with another backend.

Interestingly enough, I didn't know that the RFC requires REMOTE_USER to be set to the user ID supplied when Basic Authentication is used. RFC 3875 - The Common Gateway Interface (CGI) Version 1.1 section 4.1.11.

I think that answers my question. Thank you so much for the quick and very helpful response!

from oauth2_proxy.

I'm glad you got it working :)

from oauth2_proxy.