I am setting up the following environment:
User
|
Nginx
|
Oauth2 <---> Keycloak
|
Grafana
This is the nginx configuration (following the example here):
server {
listen 443 ssl default_server;
# listen [::]:443 ssl default_server;
ssl_certificate /etc/nginx/ssl/nginx_vas_cz.crt;
ssl_certificate_key /etc/nginx/ssl/nginx_vas_cz.key;
root /var/www/html;
# Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html;
server_name _;
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
}
location /grafana/ {
auth_request /oauth2/auth;
error_page 401 = /oauth2/sign_in;
# pass information about the user to the backend
# requires oauth2-proxy to run with --set-xauthrequest flag
auth_request_set $user $upstream_http_x_auth_request_user;
auth_request_set $email $upstream_http_x_auth_request_email;
auth_request_set $name $upstream_http_x_auth_request_preferred_username;
proxy_set_header X-Username $user;
proxy_set_header X-Email $email;
proxy_set_header X-Name $name;
proxy_pass http://grafana.vas.cz:3000/;
}
location /oauth2/ {
proxy_pass http://oauth.vas.cz:4180;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_set_header X-Auth-Request-Redirect $request_uri;
}
location = /oauth2/auth {
proxy_pass http://oauth.vas.cz:4180;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
# nginx auth_request includes headers but not body
proxy_set_header Content-Length "";
proxy_pass_request_body off;
}
}
When I access https://nginx.vas.cz/grafana/, I get redirected to Keycloak login page, perform the login and then sent to Grafana, but without login.
If I change proxy_set_header X-Username $user; to proxy_set_header X-Username "<new user>"; (in other words I force the login user), the user gets created in Grafana with the following profile:
- Name =
<my email>
- Email =
<my email>
- Username =
<new user>
which tells me that everything is correctly configured (or I will not be able to login).
According to your documentation, the --set-xauthorequest option should enable the following headers: X-Auth-Request-User, X-Auth-Request-Email and X-Auth-Request-Preferred-Username, so apparently the X-Auth-Request-User is not resolved.
This is the authentication result I get in the oauth2-proxy log:
[2020/07/17 14:10:45] [requests.go:26] 200 GET http://keycloak.vas.cz:8080/auth/realms/tutorial01/protocol/openid-connect/userinfo {"sub":"f4bb8645-f16f-4237-a9e4-58dea9e046f7","email_verified":false,"name":"<name surname>","groups":["/admin"],"preferred_username":"<username>","given_name":"<name>","family_name":"<surname>","email":"<email>"}
192.168.56.5:57446 - <email> [2020/07/17 14:10:45] [AuthSuccess] Authenticated via OAuth2: %!s(PANIC=String method: runtime error: invalid memory address or nil pointer dereference)
[2020/07/17 14:10:45] [cookies.go:48] Warning: request host "nginx.vas.cz" did not match any of the specific cookie domains of ""
Keycloak is returning all the expected information from the user.
So, I tried a different test:
proxy_set_header X-Username "newuser";
proxy_set_header X-User-Email "email";
proxy_set_header X-User-Name "name";
and again the user gets created with
- Name = "name"
- Email = "email"
- Username = "newuser"
Putting together the two tests:
$upstream_http_x_auth_request_email = <email in KC> OK
$upstream_http_x_auth_request_preferred_username = <email in KC>, which is wrong. Note how the "preferred_username" in KC reply is the "", not the email.
$upstream_http_x_auth_request_user is resolved to <email in KC> too. To verify this, I made the following test:
proxy_set_header X-Username "new_user";
proxy_set_header X-User-Email $email;
proxy_set_header X-User-Name $user;
and I got the user created with "Name" = "<email>".
This is my configuration for oauth2:
./oauth2/oauth2-proxy --provider=keycloak --client-id=oauth2 --client-secret=<secret> --login-url="http://keycloak.vas.cz:8080/auth/realms/tutorial01/protocol/openid-connect/auth" --redeem-url="http://keycloak.vas.cz:8080/auth/realms/tutorial01/protocol/openid-connect/token" --validate-url="http://keycloak.vas.cz:8080/auth/realms/tutorial01/protocol/openid-connect/userinfo" --keycloak-group=/admin --email-domain=* --cookie-secret=<secret> --http-address="http://192.168.56.8:4180" --scope=openid --set-xauthrequest=true
Expected Behavior
$upstream_http_x_auth_request_email = <email in KC> OK
$upstream_http_x_auth_request_preferred_username = <preferred username in KC> i.e. the shortname uid
$upstream_http_x_auth_request_user = <name surname> i.e. the "name" filed in KC response.
Current Behavior
Everything is apparently mapped to the user's email
Update: apparently, after further investigation, it seems that $upstream_http_x_auth_request_preferred_username and $upstream_http_x_auth_request_user are not returned at all.
Possible Solution
Steps to Reproduce (for bugs)
The above should be enough. Let me know if you need something more.
Context
I'm setting authentication behind a authorization proxy.
Your Environment
- Version used:
oauth2-proxy v6.0.0 (built with go1.14.2)
bug help wanted Stale
![[Question] Cookie Expiration Behaviour](https://avatars.githubusercontent.com/u/3692969?v=4)
63 May 8, 2022
1.5k May 4, 2022
1 Mar 31, 2022
24 Apr 6, 2022
0 Jan 5, 2022
372 May 15, 2022
4 Jan 31, 2022
0 Jan 30, 2022
196 Nov 17, 2021
5 Mar 7, 2022
1 Nov 11, 2021
365 May 7, 2022
3.6k May 6, 2022
1 Mar 11, 2022
3 Mar 21, 2022
30 Apr 29, 2022
1.9k May 6, 2022
8 Apr 25, 2022