luzifer/nginx-sso
1
0
Fork 0
mirror of https://github.com/Luzifer/nginx-sso.git synced 2024-11-09 09:50:01 +00:00
Code Issues Releases Wiki Activity

Add a check for 'Set-Cookie' header - this won't be present with anonymous access, add more detail to frontend usage comment.

Mike Beattie 2020-08-10 17:25:42 +12:00
parent d02793fe75
commit 34f0ee4af6
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
Using-nginx-sso-with-haproxy-and-SPOE.md

@ -63,7 +63,8 @@ def check_sso_auth(args):
r = requests.get(auth_url, headers=headers)
if r.status_code == 200:
authed = True
spoa.set_var_str("cookie", spoa.scope_txn, r.headers['Set-Cookie'])
if 'Set-Cookie' in r.headers:
spoa.set_var_str("cookie", spoa.scope_txn, r.headers['Set-Cookie'])
spoa.set_var_boolean("auth", spoa.scope_txn, authed)
return
@ -79,7 +80,7 @@ Configuration of nginx-sso is beyond the scope of this short howto - there's not
The following contains the absolute basics, you should ensure that the rest of the configuration is fleshed out how you need it for your environment. It covers the configuration for SPOE, and how to deal with the redirects to nginx-sso for the login form. It also doesn't have any SSL configuration, that's left up to you.
Note that the filter being applied can be placed in the frontend, but you cannot selectively apply it based on the `Host: ` header (to not apply it to the nginx-sso login domain name or path), so take care if you need to do this. The python script would need a small addition made to not bother asking nginx-sso for auth if the `Host:` header is the login domain for example.
Note that the filter being applied can be placed in the frontend, but to selectively apply it based on the `Host: ` header takes a little care (to not apply it to the nginx-sso login domain name or path). You'll need to create an acl in the `spoa-server.spoe.conf` file, and then check that acl on the `event` line with an haproxy condition (`unless` or `if`). You will also need to change the event to be `on-frontend-http-request`.
#### haproxy.conf
```