public_git
/
nginx-ldap-auth
mirror of https://github.com/nginxinc/nginx-ldap-auth.git
1
0
Fork 1
Code Issues Releases Wiki Activity

Security improvements

This commit is contained in:
Liam Crilly 2022-04-12 10:59:26 +01:00 committed by GitHub
parent 5e5d5b1b86
commit 763f23b297
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 22 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
nginx-ldap-auth.conf
View File

@ -47,6 +47,7 @@ http {
proxy_pass http://127.0.0.1:8888; proxy_pass http://127.0.0.1:8888;
proxy_pass_request_body off; proxy_pass_request_body off;
proxy_pass_request_headers off;
proxy_set_header Content-Length ""; proxy_set_header Content-Length "";
proxy_cache auth_cache; proxy_cache auth_cache;
proxy_cache_valid 200 10m; proxy_cache_valid 200 10m;
@ -78,10 +79,10 @@ http {
proxy_set_header X-Ldap-URL "ldap://example.com"; proxy_set_header X-Ldap-URL "ldap://example.com";
# (Optional) Establish a TLS-enabled LDAP session after binding to the # (Optional) Establish a TLS-enabled LDAP session after binding to the
# LDAP server. Set the value to "true: to enable. # LDAP server.
# This is the 'proper' way to establish encrypted TLS connections, see # This is the 'proper' way to establish encrypted TLS connections, see
# http://www.openldap.org/faq/data/cache/185.html # http://www.openldap.org/faq/data/cache/185.html
proxy_set_header X-Ldap-Starttls ""; # Optional, do not comment #proxy_set_header X-Ldap-Starttls "true";
# (Required) Set the Base DN, by replacing the value enclosed in # (Required) Set the Base DN, by replacing the value enclosed in
# double quotes. # double quotes.
@ -96,30 +97,33 @@ http {
# (Required) The following directives set the cookie name and pass # (Required) The following directives set the cookie name and pass
# it, respectively. They are required for cookie-based # it, respectively. They are required for cookie-based
# authentication. Set to empty value if using HTTP basic # authentication. Comment them out if using HTTP basic
# authentication (do not comment). # authentication.
proxy_set_header X-CookieName "nginxauth"; proxy_set_header X-CookieName "nginxauth";
proxy_set_header Cookie nginxauth=$cookie_nginxauth; proxy_set_header Cookie nginxauth=$cookie_nginxauth;
# (Required if using Microsoft Active Directory as the LDAP server) # (Optional) Uncomment if using HTTP basic authentication
# Set the LDAP template with "(sAMAccountName=%(username)s)" #proxy_set_header Authorization $http_authorization;
proxy_set_header X-Ldap-Template ""; # Optional, do not comment
# (Set to "true" if using Microsoft Active Directory and # (Required if using Microsoft Active Directory as the LDAP server)
# Set the LDAP template by uncommenting the following directive.
#proxy_set_header X-Ldap-Template "(sAMAccountName=%(username)s)";
# (May be required if using Microsoft Active Directory and
# getting "In order to perform this operation a successful bind # getting "In order to perform this operation a successful bind
# must be completed on the connection." errror) # must be completed on the connection." errror)
proxy_set_header X-Ldap-DisableReferrals ""; # Optional, do not comment #proxy_set_header X-Ldap-DisableReferrals "true";
# (Optional) # (Optional if using OpenLDAP as the LDAP server) Set the LDAP
# Set to "(sAMAccountName=%(username)s)" if using Microsoft Active # template by uncommenting the following directive and replacing
# Directory as the LDAP server. # '(cn=%(username)s)' which is the default set in
# Set to "(cn=%(username)s)" if using OpenLDAP as the LDAP server, # nginx-ldap-auth-daemon.py.
# which is the default set in nginx-ldap-auth-daemon.py. #proxy_set_header X-Ldap-Template "(cn=%(username)s)";
proxy_set_header X-Ldap-Template ""; # Optional, do not comment
# (Optional) Set the realm name, e.g. "Restricted", which is the # (Optional) Set the realm name, by uncommenting the following
# default set in nginx-ldap-auth-daemon.py. # directive and replacing 'Restricted' which is the default set
proxy_set_header X-Ldap-Realm ""; # Optional, do not comment # in nginx-ldap-auth-daemon.py.
#proxy_set_header X-Ldap-Realm "Restricted";
} }
} }
} }