Code Monkey home page Code Monkey logo

Comments (6)

ploxiln avatar ploxiln commented on June 1, 2024

Most arbitrary headers are passed through. Content-Length is handled specially by the Go http client which is used by the Go reverse proxy. Here's the relevant bit:
https://golang.org/src/net/http/transfer.go#L260

For a GET request, Content-Length: 0 is implied, and it considers it not needed.

from oauth2-proxy.

artyomtkachenko avatar artyomtkachenko commented on June 1, 2024

I am facing exactly the same issue with Kibana. @Ghazgkull have you found any workaround for it?
--skip-auth-regex trick works fine for me, but I am looking for something more secure.

from oauth2-proxy.

Ghazgkull avatar Ghazgkull commented on June 1, 2024

@artyomtkachenko Yeah, since it sounds like oauth2_proxy isn't usable as an actual proxy, I've gone the route of setting up a simple nginx deployment/service/configmap which I use as the proxy in front of Kibana. oauth2_proxy is then configured only to perform authentication for the nginx service using the auth-request module as explained in the README.md of this repo.

It's working fine and now I'm just going through the process of figuring out how to package the pieces for reuse. I'm currently consuming oauth2_proxy via the stable helm chart. So I'm thinking I might be able to package everything up as a new chart which consumes the oauth2_proxy chart as a dependency (sub chart).

I'll post back here if I'm able to get such a thing packaged up. Totally new to helm though, so...

from oauth2-proxy.

Ghazgkull avatar Ghazgkull commented on June 1, 2024

@artyomtkachenko In case it helps, here's where I'm at with my nginx.yaml. Notice that a couple parts are hard-coded to my setup currently. I'm running Kibana behind an istio gateway under the /logs route, which is why you'll see that path segment in the URLs. And the hostnames are specific to my k8s service names:

---
apiVersion: v1
kind: Service
metadata:
  name: nginx-auth-proxy
  labels:
    app: nginx-auth-proxy
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: http
      protocol: TCP
      name: http
  selector:
    app: nginx-auth-proxy

---
apiVersion: apps/v1beta2
kind: Deployment
metadata:
  name: nginx-auth-proxy
  labels:
    app: nginx-auth-proxy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx-auth-proxy
  template:
    metadata:
      labels:
        app: nginx-auth-proxy
    spec:
      containers:
        - name: nginx-auth-proxy
          image: nginx
          imagePullPolicy: IfNotPresent
          volumeMounts:
            - name: auth-proxy-config
              mountPath: /etc/nginx/conf.d/default.conf
              subPath: auth-proxy.conf
          ports:
            - containerPort: 80
              name: http
              protocol: TCP
      volumes:
        - name: auth-proxy-config
          configMap:
            name: nginx-auth-proxy-config

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-auth-proxy-config
data:
  auth-proxy.conf: |
    server {
      listen 80 default_server;
      server_name _;
      error_log /dev/stdout debug;
      access_log /dev/stdout;

      location /logs/oauth2 {
        proxy_pass       http://oauth2-proxy;
        proxy_set_header Host                    $host;
        proxy_set_header X-Real-IP               $remote_addr;
        proxy_set_header X-Scheme                $scheme;
        proxy_set_header X-Auth-Request-Redirect $request_uri;
      }
      location = /logs/oauth2/auth {
        proxy_pass       http://oauth2-proxy;
        proxy_set_header Host             $host;
        proxy_set_header X-Real-IP        $remote_addr;
        proxy_set_header X-Scheme         $scheme;
        # nginx auth_request includes headers but not body
        proxy_set_header Content-Length   "";
        proxy_pass_request_body           off;
      }

      location /logs {
        auth_request /logs/oauth2/auth;
        error_page 401 = /logs/oauth2/sign_in;

        # pass information via X-User and X-Email headers to backend,
        # requires running with --set-xauthrequest flag
        auth_request_set $user   $upstream_http_x_auth_request_user;
        auth_request_set $email  $upstream_http_x_auth_request_email;
        proxy_set_header X-User  $user;
        proxy_set_header X-Email $email;

        # if you enabled --cookie-refresh, this is needed for it to work with auth_request
        auth_request_set $auth_cookie $upstream_http_set_cookie;
        add_header Set-Cookie $auth_cookie;

        proxy_pass http://kibana:443;
      }
    }

from oauth2-proxy.

artyomtkachenko avatar artyomtkachenko commented on June 1, 2024

Thank you very much for sharing your thoughts @Ghazgkull .
I am planning to go the same way. I also found this blog post , where it was solved with an ingress object, but it is a bit different to the Istio approach.

from oauth2-proxy.

github-actions avatar github-actions commented on June 1, 2024

This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.

from oauth2-proxy.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.