nginx-openid-connect / nginx-oidc-core Goto Github PK
View Code? Open in Web Editor NEWReference implementation of OpenID Connect integration for NGINX Plus
License: BSD 2-Clause "Simplified" License
Reference implementation of OpenID Connect integration for NGINX Plus
License: BSD 2-Clause "Simplified" License
Background:
auth_request
directive could handle 200 response from NJS module in the past. (I haven't checked the N+ version.) However, It returns only 401 although NJS returns 200.AC:
auth_request
directive return 401
from the 200
response of NJS.auth_request
.auth_request
with NJS or enhance new way of session management.AC:
auth_jwt
directives as IdP userinfo
endpoint handles access_token
validation.Background
AC
Misc.
$enable_zone_sync
keyval_zone zone=oidc_id_tokens:1M state=/etc/nginx/aux/oidc_id_tokens.json timeout=1h sync;
keyval_zone zone=oidc_access_tokens:1M state=/etc/nginx/aux/oidc_access_tokens.json timeout=1h sync;
keyval_zone zone=oidc_refresh_tokens:1M state=/etc/nginx/aux/oidc_refresh_tokens.json timeout=8h sync;
keyval_zone zone=oidc_pkce:128K timeout=90s sync;
keyval_zone zone=oidc_nonce_hash:128K timeout=90s sync;
keyval_zone zone=oidc_token_query_params:128K timeout=90s sync;
AC:
auth_jwt
directives before sending it to proxy serverIssues:
The following IdPs are working with Dev Portal and NGINX Plus for the /userinfo
endpoint.
But, the /userinfo
endpoint isn't working with Ping Identity
.
Root Cause:
Server Name Indication (SNI)
is an extension for the TLS protocol (formerly known as the SSL protocol), which is used in HTTPS.PingIdentity
checks the hostname so that proxy_ssl_server_name on
must be added before proxy_pass $oidc_userinfo_endpoint
.AC:
proxy_ssl_server_name
.
location = /userinfo {
:
proxy_ssl_server_name on; # For SNI to the IdP
proxy_set_header Authorization "Bearer $access_token";
proxy_pass $oidc_userinfo_endpoint;
:
}
IDP | NGINX Plus | ACM/Dev Portal |
---|---|---|
Amazon Cognito | ||
Auth0 | ||
Azure AD | ||
Keycloak | ||
Okta | ||
OneLogin | ||
Ping Identity |
Reporter: Rajesh Bavanantham
Issue
https://dev-745930.oktapreview.com/oauth2/aus10bz495vMInDqO0h8/v1/logout?post_logout_redirect_uri=http://developers.nginx.comhttp://developers.nginx.com/&id_token_hint=
AC:
Background:
aud
claim in the request of IdP authorization endpoint. - Auth0 returns empty payload in the access token from the token endpoint.AC:
groups
and sub-groups
.aud
claims in the request of IdP authorization endpoint.NGINX Plus OIDC RP needs to support PKCE for Azure AD.
AC:
Background:
HTTPS
for setting up redirected URIs.AC:
Background:
AC:
$session_validation_enable
is set to 1
.Issue:
Most of IdPs' $oidc_jwt_keyfile
endpoint works for access token validation. But Azure AD doesn't work as the following message:
[info] 87#87: *500 JWT RS validation failed kid:"2ZQpJ3UpbjAYXYGaXEJl8lV0TOI" (SSL: error:04091068:rsa routines:int_rsa_verify:bad signature), client: 172.18.0.1, server: nginx.azure.test, request: "GET /v1/api/example HTTP/1.1", host: "nginx.azure.test:15000"
To solve the #1
, we can add "[CLIENT_ID]/.default"
in authorization endpoint of Azure AD.
However, the access token doesn't work for userinfo
endpoint as a Bearer in the header of API request although the validation works.
{"error":{"code":"InvalidAuthenticationToken","message":"Access token validation failure. Invalid audience.","innerError":
{"date":"2022-10-15T07:13:25","request-id":"xxxx-xxx-xxx-xxx-xxxx","client-request-id":"xxxx-xxx-xxx-xxx-xxxx"}}}
To successfully get 200 response from the /userinfo
endpoint, we either can remove the scope in the authorization endpoint or find to solve invalid audience.
References:
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.