public_git
/
nginx-ldap-auth
mirror of https://github.com/nginxinc/nginx-ldap-auth.git
1
0
Fork 1
Code Issues Releases Wiki Activity

Update nginx-ldap-auth.conf 

Further refinements to comments about 'server' block and 'proxy_set_header' directives.
This commit is contained in:
tmauro-nginx 2015-05-12 18:54:45 -07:00
parent 4129f7b7c7
commit 835b20ba4c
1 changed files with 16 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
nginx-ldap-auth.conf
View File

@ -5,7 +5,7 @@ events { }
http { http {
proxy_cache_path cache/ keys_zone=auth_cache:10m; proxy_cache_path cache/ keys_zone=auth_cache:10m;
# The back-end daemon listens on port 9000 as configured # The back-end daemon listens on port 9000 as implemented
# in backend-sample-app.py. # in backend-sample-app.py.
# Change the IP address if the daemon is not running on the # Change the IP address if the daemon is not running on the
# same host as NGINX/NGINX Plus. # same host as NGINX/NGINX Plus.
@ -13,6 +13,8 @@ http {
server 127.0.0.1:9000; server 127.0.0.1:9000;
} }
# NGINX/NGINX Plus listen on port 8081 for requests that require
# authentication. Change the port number as appropriate.
server { server {
listen 127.0.0.1:8081; listen 127.0.0.1:8081;
server_name localhost; server_name localhost;
@ -38,8 +40,8 @@ http {
location = /auth-proxy { location = /auth-proxy {
internal; internal;
# The ldap-auth daemon listens on port 8888, as configured # The ldap-auth daemon listens on port 8888, as set
# in the nginx-ldap-auth.py. # in nginx-ldap-auth-daemon.py.
# Change the IP address if the daemon is not running on # Change the IP address if the daemon is not running on
# the same host as NGINX/NGINX Plus. # the same host as NGINX/NGINX Plus.
proxy_pass http://127.0.0.1:8888; proxy_pass http://127.0.0.1:8888;
@ -52,12 +54,12 @@ http {
# The following directive adds the cookie to the cache key # The following directive adds the cookie to the cache key
proxy_cache_key "$http_authorization$cookie_nginxauth"; proxy_cache_key "$http_authorization$cookie_nginxauth";
# In the reference implementation, the ldap-auth daemon communicates # As implemented in nginx-ldap-auth-daemon.py, the ldap-auth daemon
# with an OpenLDAP server, passing in the following parameters # communicates with an OpenLDAP server, passing in the following
# to specify which user account to authenticate. To eliminate the # parameters to specify which user account to authenticate. To
# need to modify the Python code, this file contains # eliminate the need to modify the Python code, this file contains
# 'proxy_set_header' directives that correspond to the parameters. # 'proxy_set_header' directives that set the values of the
# Set or change them as instructed in the comments. # parameters. Set or change them as instructed in the comments.
# #
# Parameter Proxy header # Parameter Proxy header
# ----------- ---------------- # ----------- ----------------
@ -70,7 +72,7 @@ http {
# url X-Ldap-URL # url X-Ldap-URL
# (Required) Set the URL and port for connecting to the LDAP server, # (Required) Set the URL and port for connecting to the LDAP server,
# by replacing 'example.com' and '636' with the appropriate values. # by replacing 'example.com' and '636'.
proxy_set_header X-Ldap-URL "ldaps://example.com:636"; proxy_set_header X-Ldap-URL "ldaps://example.com:636";
# (Required) Set the Base DN, by replacing the value enclosed in # (Required) Set the Base DN, by replacing the value enclosed in
@ -97,12 +99,13 @@ http {
# (Optional if using OpenLDAP as the LDAP server) Set the LDAP # (Optional if using OpenLDAP as the LDAP server) Set the LDAP
# template by uncommenting the following directive and replacing # template by uncommenting the following directive and replacing
# '(cn=%(username)s)' (the default set in the Python script): # '(cn=%(username)s)' which is the default set in
# nginx-ldap-auth-daemon.py.
#proxy_set_header X-Ldap-Template "(cn=%(username)s)"; #proxy_set_header X-Ldap-Template "(cn=%(username)s)";
# (Optional) Set the realm name, by uncommenting the following # (Optional) Set the realm name, by uncommenting the following
# directive and replacing 'Restricted' (the default set by the # directive and replacing 'Restricted' which is the default set
# Python script). # in nginx-ldap-auth-daemon.py.
#proxy_set_header X-Ldap-Realm "Restricted"; #proxy_set_header X-Ldap-Realm "Restricted";
} }
} }