outposts/proxyv2 (#1365)

* outposts/proxyv2: initial commit Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> add rs256 Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> more stuff Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> add forward auth an sign_out Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> match cookie name Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> re-add support for rs256 for backwards compat Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> add error handler Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> ensure unique user-agent is used Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> set cookie duration based on id_token expiry Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> build proxy v2 Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> add ssl Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> add basic auth and custom header support Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> add application cert loading Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> implement whitelist Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> add redis Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> migrate embedded outpost to v2 Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> remove old proxy Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> providers/proxy: make token expiration configurable Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> add metrics Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> fix tests Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * providers/proxy: only allow one redirect URI Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * fix docker build for proxy Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * remove default port offset Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * add AUTHENTIK_HOST_BROWSER Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * tests: fix e2e/integration tests not using proper tags Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * remove references of old port Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * fix user_attributes not being loaded correctly Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * cleanup dependencies Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * cleanup Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
2021-09-08 20:04:56 +02:00
parent 27508dd1f0
commit 3c1b70c355
75 changed files with 1368 additions and 1665 deletions
--- a/internal/outpost/proxyv2/application/mode_forward.go
+++ b/internal/outpost/proxyv2/application/mode_forward.go
@ -0,0 +1,77 @@
+package application
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+
+	"goauthentik.io/api"
+	"goauthentik.io/internal/utils/web"
+)
+
+func (a *Application) configureForward() error {
+	a.mux.HandleFunc("/akprox/auth", func(rw http.ResponseWriter, r *http.Request) {
+		if _, ok := r.URL.Query()["traefik"]; ok {
+			a.forwardHandleTraefik(rw, r)
+			return
+		}
+		a.forwardHandleNginx(rw, r)
+	})
+	a.mux.HandleFunc("/akprox/auth/traefik", a.forwardHandleTraefik)
+	a.mux.HandleFunc("/akprox/auth/nginx", a.forwardHandleNginx)
+	return nil
+}
+
+func (a *Application) forwardHandleTraefik(rw http.ResponseWriter, r *http.Request) {
+	claims, err := a.getClaims(r)
+	if claims != nil && err == nil {
+		a.addHeaders(r, claims)
+		copyHeadersToResponse(rw, r)
+		return
+	} else if claims == nil && a.IsAllowlisted(r) {
+		a.log.Trace("path can be accessed without authentication")
+		return
+	}
+	host := ""
+	// Optional suffix, which is appended to the URL
+	suffix := ""
+	if *a.proxyConfig.Mode == api.PROXYMODE_FORWARD_SINGLE {
+		host = web.GetHost(r)
+	} else if *a.proxyConfig.Mode == api.PROXYMODE_FORWARD_DOMAIN {
+		host = a.proxyConfig.ExternalHost
+		// set the ?rd flag to the current URL we have, since we redirect
+		// to a (possibly) different domain, but we want to be redirected back
+		// to the application
+		v := url.Values{
+			// see https://doc.traefik.io/traefik/middlewares/forwardauth/
+			// X-Forwarded-Uri is only the path, so we need to build the entire URL
+			"rd": []string{fmt.Sprintf(
+				"%s://%s%s",
+				r.Header.Get("X-Forwarded-Proto"),
+				r.Header.Get("X-Forwarded-Host"),
+				r.Header.Get("X-Forwarded-Uri"),
+			)},
+		}
+		suffix = fmt.Sprintf("?%s", v.Encode())
+	}
+	proto := r.Header.Get("X-Forwarded-Proto")
+	if proto != "" {
+		proto = proto + ":"
+	}
+	rdFinal := fmt.Sprintf("%s//%s%s%s", proto, host, "/akprox/start", suffix)
+	a.log.WithField("url", rdFinal).Debug("Redirecting to login")
+	http.Redirect(rw, r, rdFinal, http.StatusTemporaryRedirect)
+}
+
+func (a *Application) forwardHandleNginx(rw http.ResponseWriter, r *http.Request) {
+	claims, err := a.getClaims(r)
+	if claims != nil && err == nil {
+		a.addHeaders(r, claims)
+		copyHeadersToResponse(rw, r)
+		return
+	} else if claims == nil && a.IsAllowlisted(r) {
+		a.log.Trace("path can be accessed without authentication")
+		return
+	}
+	http.Error(rw, "unauthorized request", http.StatusUnauthorized)
+}