netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

www/nginx: advanced authentication: allow to use an own auth server, cleanup config (#1087)

Browse Source 
* www/nginx: advanced authentication: allow to use an auth server, cleanup config

closes #1078

* www/nginx: restore empty line
This commit is contained in:
Fabian Franz BSc
2018-12-23 18:04:17 +01:00
committed by GitHub
parent d69f1a29f7
commit fd48304ea4
4 changed files with 23 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
+6
View File
@@ -131,6 +131,12 @@
<style>selectpicker</style>
<help>If you select an IP ACL, the client can only access this service if it fulfills this requirement.</help>
</field>
<field>
<id>httpserver.advanced_acl_server</id>
<label>Advanced ACL Authentication Backend</label>
<type>dropdown</type>
<help>Choose a backend for advanced authentication. If you don't have one, configure it under System -> Access -> Servers. If nothing is configured, the local database is used.</help>
</field>
<field>
<id>httpserver.satisfy</id>
<label>Satisfy</label>
www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
+5
View File
@@ -690,6 +690,11 @@
<Required>N</Required>
<multiple>N</multiple>
</ip_acl>
<advanced_acl_server type="AuthenticationServerField">
<Required>N</Required>
<multiple>N</multiple>
<default>Local Database</default>
</advanced_acl_server>
<satisfy type="OptionField">
<OptionValues>
<any>Any</any>
www/nginx/src/opnsense/scripts/nginx/ngx_auth.php
+8 -2
View File
@@ -45,13 +45,19 @@ function password_auth_test($username, $password, $auth_server)
function password_auth($auth_server = 'Local Database')
{
if (!isset($_SERVER['PHP_AUTH_PW']) || !isset($_SERVER['PHP_AUTH_PW'])) {
if (!isset($_SERVER['PHP_AUTH_PW']) || !isset($_SERVER['PHP_AUTH_USER'])) {
return false;
}
return password_auth_test($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW'], $auth_server);
}
if (password_auth()) {
if (empty($_SERVER['AUTH_SERVER'])) {
$auth_server = 'Local Database';
} else {
$auth_server = $_SERVER['AUTH_SERVER'];
}
if (password_auth($auth_server)) {
header("HTTP/1.1 200 OK");
} else {
header("HTTP/1.1 401 Authorization Required");
www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf
+4 -7
View File
@@ -184,13 +184,7 @@ server {
fastcgi_param TLS-Cipher $ssl_cipher;
fastcgi_param TLS-Protocol $ssl_protocol;
fastcgi_param TLS-SNI-Host $ssl_server_name;
{% if helpers._template_in_data['__uuid__'] is defined %}
{% for uuid in helpers._template_in_data['__uuid__'] %}
{% if helpers._template_in_data['__uuid__'][uuid] == server %}
fastcgi_param SERVER-UUID "{{ uuid }}";
{% endif %}
{% endfor %}
{% endif %}
fastcgi_param SERVER-UUID "{{ server['@uuid'] }}";
fastcgi_intercept_errors on;
fastcgi_pass unix:/var/run/php-webgui.socket;
}
@@ -205,6 +199,9 @@ server {
fastcgi_param Original-HOST $host;
fastcgi_param SERVER-UUID "{{ server['@uuid'] }}";
fastcgi_param SCRIPT_FILENAME /usr/local/opnsense/scripts/nginx/ngx_auth.php;
{% if server.advanced_acl_server is defined and server.advanced_acl_server != '' %}
fastcgi_param AUTH_SERVER "{{ server.advanced_acl_server.replace("\\", "\\\\").replace("$", "\\$").replace("\"", "\\\"") }}";
{% endif %}
fastcgi_intercept_errors on;
include fastcgi_params;
}