public_git
/
nginx-ldap-auth
mirror of https://github.com/nginxinc/nginx-ldap-auth.git
1
0
Fork 1
Code Issues Releases Wiki Activity

Security improvements

This commit is contained in:
Liam Crilly 2022-04-12 10:58:56 +01:00 committed by GitHub
parent 3df1b7a9ea
commit 5e5d5b1b86
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 25 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
README.md
View File

@ -90,6 +90,9 @@ http {
location = /auth-proxy { location = /auth-proxy {
proxy_pass http://<strong>127.0.0.1</strong>:8888; proxy_pass http://<strong>127.0.0.1</strong>:8888;
proxy_pass_request_body off;
proxy_pass_request_headers off;
proxy_set_header Content-Length "";
proxy_cache <strong>auth_cache</strong>; # Must match the name in the proxy_cache_path directive above proxy_cache <strong>auth_cache</strong>; # Must match the name in the proxy_cache_path directive above
proxy_cache_valid 200 <strong>10m</strong>; proxy_cache_valid 200 <strong>10m</strong>;
@ -112,7 +115,7 @@ http {
} }
</pre> </pre>
If the authentication server runs Active Directory rather than OpenLDAP, set the following directive as shown: If the authentication server runs Active Directory rather than OpenLDAP, uncomment the following directive as shown:
``` ```
proxy_set_header X-Ldap-Template "(sAMAccountName=%(username)s)"; proxy_set_header X-Ldap-Template "(sAMAccountName=%(username)s)";
``` ```
@ -121,53 +124,52 @@ In addition, the **X-Ldap-Template** header can be used to create complex LDAP s
Suppose, your web resource should only be available for users from `group1` group. Suppose, your web resource should only be available for users from `group1` group.
In such a case you can define `X-Ldap-Template` template as follows: In such a case you can define `X-Ldap-Template` template as follows:
```nginx ```
proxy_set_header X-Ldap-Template "(&(cn=%(username)s)(memberOf=cn=group1,cn=Users,dc=example,dc=com))"; proxy_set_header X-Ldap-Template "(&(cn=%(username)s)(memberOf=cn=group1,cn=Users,dc=example,dc=com))";
``` ```
The search filters can be combined from less complex filters using boolean operations and can be rather complex. The search filters can be combined from less complex filters using boolean operations and can be rather complex.
The reference implementation uses cookie-based authentication. If you are using HTTP basic authentication instead, set the following directives to have an empty value, as shown: The reference implementation uses cookie-based authentication. If you are using HTTP basic authentication instead, comment out the following directives, and enable the Authorization header as shown:
```nginx <pre>
proxy_set_header X-CookieName ""; <strong>#</strong>proxy_set_header X-CookieName "nginxauth";
proxy_set_header Cookie ""; <strong>#</strong>proxy_set_header Cookie nginxauth=$cookie_nginxauth;
``` <strong>proxy_set_header Authorization $http_authorization;</strong>
</pre>
## Customization ## Customization
### Caching ### Caching
The **nginx-ldap-auth.conf** file enables caching of both data and credentials. To disable caching, comment out the four `proxy_cache*` directives as shown: The **nginx-ldap-auth.conf** file enables caching of both data and credentials. To disable caching, comment out the four `proxy_cache*` directives as shown:
```nginx <pre>
http { http {
... ...
#proxy_cache_path cache/ keys_zone=auth_cache:10m; <strong>#</strong>proxy_cache_path cache/ keys_zone=auth_cache:10m;
... ...
server { server {
... ...
location = /auth-proxy { location = /auth-proxy {
#proxy_cache auth_cache; <strong>#</strong>proxy_cache auth_cache;
# note that cookie is added to cache key # note that cookie is added to cache key
#proxy_cache_key "$http_authorization$cookie_nginxauth"; <strong>#</strong>proxy_cache_key "$http_authorization$cookie_nginxauth";
#proxy_cache_valid 200 10m; <strong>#</strong>proxy_cache_valid 200 10m;
} }
} }
} }
``` </pre>
### Optional LDAP Parameters ### Optional LDAP Parameters
If you want to change the value for the `template` parameter that the ldap-auth daemon passes to the OpenLDAP server by default, set the following directive as shown, and change the value: If you want to change the value for the `template` parameter that the ldap-auth daemon passes to the OpenLDAP server by default, uncomment the following directive as shown, and change the value:
```nginx <pre>
proxy_set_header X-Ldap-Template "(cn=%(username)s)"; proxy_set_header X-Ldap-Template "<strong>(cn=%(username)s)</strong>";
``` </pre>
If you want to change the realm name from the default value (**Restricted**), set the following directive: If you want to change the realm name from the default value (**Restricted**), uncomment and change the following directive:
```nginx <pre>
proxy_set_header X-Ldap-Realm "Restricted"; proxy_set_header X-Ldap-Realm "<strong>Restricted</strong>";
``` </pre>
> **Note:** All LDAP parameters must have a value, even optional ones. Use the empty string (`""`) for unused parameters (do not comment).
### Authentication Server ### Authentication Server