public_git
/
nginx-ldap-auth
mirror of https://github.com/nginxinc/nginx-ldap-auth.git
1
0
Fork 1
Code Issues Releases Wiki Activity

Security improvements

This commit is contained in:
Liam Crilly 2022-04-12 00:33:29 +01:00 committed by GitHub
parent b60024a970
commit d364261db8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 23 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
README.md
View File

@ -112,7 +112,7 @@ http {
} }
</pre> </pre>
If the authentication server runs Active Directory rather than OpenLDAP, uncomment the following directive as shown: If the authentication server runs Active Directory rather than OpenLDAP, set the following directive as shown:
``` ```
proxy_set_header X-Ldap-Template "(sAMAccountName=%(username)s)"; proxy_set_header X-Ldap-Template "(sAMAccountName=%(username)s)";
``` ```
@ -121,51 +121,53 @@ In addition, the **X-Ldap-Template** header can be used to create complex LDAP s
Suppose, your web resource should only be available for users from `group1` group. Suppose, your web resource should only be available for users from `group1` group.
In such a case you can define `X-Ldap-Template` template as follows: In such a case you can define `X-Ldap-Template` template as follows:
``` ```nginx
proxy_set_header X-Ldap-Template "(&(cn=%(username)s)(memberOf=cn=group1,cn=Users,dc=example,dc=com))"; proxy_set_header X-Ldap-Template "(&(cn=%(username)s)(memberOf=cn=group1,cn=Users,dc=example,dc=com))";
``` ```
The search filters can be combined from less complex filters using boolean operations and can be rather complex. The search filters can be combined from less complex filters using boolean operations and can be rather complex.
The reference implementation uses cookie-based authentication. If you are using HTTP basic authentication instead, comment out the following directives as shown: The reference implementation uses cookie-based authentication. If you are using HTTP basic authentication instead, set the following directives to have an empty value, as shown:
<pre> ```nginx
<strong>#</strong>proxy_set_header X-CookieName "nginxauth"; proxy_set_header X-CookieName "";
<strong>#</strong>proxy_set_header Cookie nginxauth=$cookie_nginxauth; proxy_set_header Cookie "";
</pre> ```
## Customization ## Customization
### Caching ### Caching
The **nginx-ldap-auth.conf** file enables caching of both data and credentials. To disable caching, comment out the four `proxy_cache*` directives as shown: The **nginx-ldap-auth.conf** file enables caching of both data and credentials. To disable caching, comment out the four `proxy_cache*` directives as shown:
<pre> ```nginx
http { http {
... ...
<strong>#</strong>proxy_cache_path cache/ keys_zone=auth_cache:10m; #proxy_cache_path cache/ keys_zone=auth_cache:10m;
... ...
server { server {
... ...
location = /auth-proxy { location = /auth-proxy {
<strong>#</strong>proxy_cache auth_cache; #proxy_cache auth_cache;
# note that cookie is added to cache key # note that cookie is added to cache key
<strong>#</strong>proxy_cache_key "$http_authorization$cookie_nginxauth"; #proxy_cache_key "$http_authorization$cookie_nginxauth";
<strong>#</strong>proxy_cache_valid 200 10m; #proxy_cache_valid 200 10m;
} }
} }
} }
</pre> ```
### Optional LDAP Parameters ### Optional LDAP Parameters
If you want to change the value for the `template` parameter that the ldap-auth daemon passes to the OpenLDAP server by default, uncomment the following directive as shown, and change the value: If you want to change the value for the `template` parameter that the ldap-auth daemon passes to the OpenLDAP server by default, set the following directive as shown, and change the value:
<pre> ```nginx
proxy_set_header X-Ldap-Template "<strong>(cn=%(username)s)</strong>"; proxy_set_header X-Ldap-Template "(cn=%(username)s)";
</pre> ```
If you want to change the realm name from the default value (**Restricted**), uncomment and change the following directive: If you want to change the realm name from the default value (**Restricted**), set the following directive:
<pre> ```nginx
proxy_set_header X-Ldap-Realm "<strong>Restricted</strong>"; proxy_set_header X-Ldap-Realm "Restricted";
</pre> ```
> **Note:** All LDAP parameters must have a value, even optional ones. Use the empty string (`""`) for unused parameters (do not comment).
### Authentication Server ### Authentication Server