13. Nginx + OIDC

Note

Servidor web con authenticación externa

Instalación desde repositorios de Github

wget -c https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.9.0
tar xvfz oauth2-proxy-v7.9.0.linux-amd64.tar.gz
cp oauth2-proxy /usr/local/bin

Fichero de configuracion /etc/oauth2-proxy.cfg

provider = "oidc"
client_id = "nginx-access"
client_secret = "l3Gd40pFVIXAh2YewzFy4w6NflaqxVDX"
redirect_url = "https://dtremino.ddns.net/oauth2/callback"
oidc_issuer_url = "https://keycloak.dominio.com:8443/realms/TFG-ACCESS"
cookie_secret = "Zmu6Ise1FMoi4q6rsNO6TBOIvmFngzVJvoEHziIWRvA=" # head -c 32 /dev/urandom | base64 -w 0
email_domains = [ "*" ]
http_address = "0.0.0.0:4180"

Servicio /etc/systemd/system/oauth2-proxy.service

[Unit]
Description=OAuth2 Proxy
After=network.target
[Service]
ExecStart=/usr/local/bin/oauth2-proxy --config /etc/oauth2-proxy.cfg
Restart=on-failure
[Install]
WantedBy=multi-user.target

Fichero de configuracion /etc/nginx/nginx.conf

server {
    listen 443 ssl http2;
    server_name  dominio.com;

    root /opt/html;
    index tfg.html;

    access_log  /var/log/nginx/access_dominio.log  custom;
    error_log   /var/log/nginx/error_dominio.log;

    ssl_dhparam             /etc/letsencrypt/ssl-dhparams.pem;
    ssl_certificate         /etc/letsencrypt/live/dominio.com/fullchain.pem;
    ssl_certificate_key     /etc/letsencrypt/live/dominio.com/privkey.pem;

    location ^~ /oauth2/ {
        proxy_pass       http://127.0.0.1:4180;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Scheme $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    location /emisor/ {
          include /etc/nginx/default.d/oauth2-protect.conf;
          proxy_pass http://10.10.1.25:8081/emisor/;
    }
}

Fichero de configuracion /etc/nginx/default.d/oauth2-protect.conf

auth_request /oauth2/auth;
error_page 401 = /oauth2/start;

# Cabeceras opcionales que tu backend puede usar
auth_request_set $user        $upstream_http_x_auth_request_user;
auth_request_set $email       $upstream_http_x_auth_request_email;
auth_request_set $access_token $upstream_http_x_auth_request_access_token;

proxy_set_header X-User         $user;
proxy_set_header X-Email        $email;
proxy_set_header Authorization  "Bearer $access_token";