Skip to content
Snippets Groups Projects
Select Git revision
  • host01
  • ns4
  • kodi
  • master default
4 results
Blame Permalink
  • nimrod's avatar
    f496744b
    Add a Vouch proxy to all hosts. · f496744b
    nimrod authored 
    Vouch uses the Host header for calculating the JWT but we can't override
that (proxying won't work with an incorrect header). So instead it to
each deployment so we don't have multiple proxies and can override the
Host header.
    f496744b
    History
    Add a Vouch proxy to all hosts.
    nimrod authored 
    Vouch uses the Host header for calculating the JWT but we can't override
that (proxying won't work with an incorrect header). So instead it to
each deployment so we don't have multiple proxies and can override the
Host header.
vouch.conf 1.27 KiB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31 






# send all requests to the `/validate` endpoint for authorization
auth_request    /validate;

location = /validate {
  # forward the /validate request to Vouch Proxy
  proxy_pass                        http://$vouch:9090/validate;
  proxy_http_version                1.1;
  internal;
  include                           snippets/proxy-headers.conf;

  # Vouch Proxy only acts on the request headers
  proxy_pass_request_body           off;
  proxy_set_header Content-Length   "";

  # optionally add X-Vouch-User as returned by Vouch Proxy along with the request
  auth_request_set $auth_resp_x_vouch_user $upstream_http_x_vouch_user;

  # these return values are used by the @error401 call
  auth_request_set                  $auth_resp_jwt $upstream_http_x_vouch_jwt;
  auth_request_set                  $auth_resp_err $upstream_http_x_vouch_err;
  auth_request_set                  $auth_resp_failcount $upstream_http_x_vouch_failcount;
}

# if validate returns `401 not authorized` then forward the request to the error401block
error_page 401 = @error401;

location @error401 {
    # redirect to Vouch Proxy for login
    return 302 https://vouch.shore.co.il/login?url=$scheme://$http_host$request_uri&vouch-failcount=$auth_resp_failcount&X-Vouch-Token=$auth_resp_jwt&error=$auth_resp_err;
}