WSO2 Identity Server X509 Authentication Behind Proxy

user_1852714 0
Viewed 438

I'm using WSO2 Identity Server 5.10. I need to add support for X509 Authentication and I was reading the documentation about the X509 Certificate Authentication here In order to add the configuration I had to modify the catalina-server.xml.j2 file as suggested here

So done it works but I have a very huge ports commingling.... anyway let's assume it works.

Now I have this issue: I need to deploy WSO2 Identity Server in a K8S cluster. So, basically, I have a nginx ingress controller that will manage all the traffic to the backend.

What I did locally is to put a simple nginx reverse proxy and configure WSO2 Identity Server in order to use this proxy. So in my deployment.toml I did the following

[custom_trasport.x509.properties]
protocols="HTTP/1.1"
port="8443"
maxThreads="200"
scheme="https"
secure=true
SSLEnabled=true
keystoreFile="mykeystore.jks"
keystorePass="pwd"
truststoreFile="myclient_trust.jks"
truststorePass="myclient_trust_pwd"
bindOnInit=false
clientAuth="want"
sslProtocol = "TLS"
proxyPort="443"


[authentication.authenticator.x509_certificate.parameters]
name ="x509CertificateAuthenticator"
enable=true
AuthenticationEndpoint="https://$ref{server.hostname}:8443/x509-certificate-servlet"
username= "CN"
SearchAllUserStores="false"
EnforceSelfRegistration = "false"
SearchAndValidateUserLocalStores = "false"


[transport.https.properties]
proxyPort="443"

In this way when I want to sign-in by using the X509 Certificate Authentication it will ask for my certificate but then, when I choose the certificate, it shows an error because it can't find the certificate in the browser request

Moreover I don't think I should leave AuthenticationEndpoint="https://$ref{server.hostname}:8443/x509-certificate-servlet" because this means that the submit will be done to the 8443 port that is never exposed on internet.

Did anyone solve this issue? Basically the question is: how can I configure the X509 Certificate Authentication behind a proxy (e.g. nginx)?

Any tip is very precious.

Thank you

Angelo

wso2-identity-server wso2
1 Answers

I think I solved the issue I'm facing.

Basically when I have a reverse_proxy (e.g. nginx), the certicate doesn't arrive to the tomcat in the request attribute.

What I did is configure the reverse_proxy to put the certificate as HTTP header without verifying it; I'll verify on the server side.

So now my nginx configuration is:

server {
        listen 443;
        server_name wso2_iam;
        ssl on;
        ssl_certificate certificate_full_path.crt;
        ssl_certificate_key full_path_to_kwy_no_pwd.key;
        ssl_verify_client optional_no_ca;

       
        location /x509-certificate-servlet/ {
                   proxy_set_header X-Forwarded-Host $host;
                   proxy_set_header X-Forwarded-Server $host;
                   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                   proxy_set_header Host $http_host;
                   proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
                   proxy_read_timeout 5m;
                   proxy_send_timeout 5m;
                   proxy_pass https://127.0.0.1:8443/x509-certificate-servlet;

                   proxy_http_version 1.1;
                   proxy_set_header Upgrade $http_upgrade;
                   proxy_set_header Connection "upgrade";
        }
        location / {
                   proxy_set_header X-Forwarded-Host $host;
                   proxy_set_header X-Forwarded-Server $host;
                   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                   proxy_set_header Host $http_host;
                   proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
                   proxy_read_timeout 5m;
                   proxy_send_timeout 5m;
                   proxy_pass https://127.0.0.1:9443/;

                   proxy_http_version 1.1;
                   proxy_set_header Upgrade $http_upgrade;
                   proxy_set_header Connection "upgrade";
            }
        error_log  /var/log/nginx/wso2-error.log;
        access_log  /var/log/nginx/wso2-access.log;
}

The ssl_verify_client optional_no_ca; tells nginx to retrieve the certificate but to not validate it.

The proxy_set_header X-SSL-CERT $ssl_client_escaped_cert; instruction tells nginx to put the certificate PEM based in the request header called X-SSL-CERT

Then I modified the org.wso2.carbon.identity.authenticator.x509Certificate.X509CertificateAuthenticator in order to search for the certificate between request headers when it's not found in the http request attribute.

It seems to be working.

Thank you to all

Angelo

user_18527140
Related