SAML authenication in Openresty

user_1347872 0
Viewed 60

I am able to do SAML based authentication for a single URL of the application. IDP login is redirected and login is successful. But unable to generalize for all API.

But when I try to add auth_reqeust and generalize for all APIs I am getting "auth request unexpected status: 302 while sending to client, client" error

server {
        listen 0.0.0.0:8443 default ssl; 
        ...........
        ..........
        auth_request /saml;
      

        location /saml{
                proxy_pass http://172.19.167.213:9180/simplesaml/saml2/idp/SSOService.php?spentityid=https://172.19.167.213/;

        }
        location /enrollment/saml/callback {
                proxy_pass http://localhost:8093/saml/callback;
                return 302 https://172.19.167.213/;
        }
        
}

I have my IDP running on http://172.19.167.213:9180/simplesaml

Home page for protected application:- https://172.19.167.213/;

Error details from logs:-

2022/07/18 07:15:28 [error] 3511#3511: *12 auth request unexpected status: 302 while sending to client, client: 172.19.160.1, server: , request: "GET / HTTP/1.1", host: "172.19.167.213", referrer: "http://172.19.167.213:9180/"
2022/07/18 07:15:28 [error] 3511#3511: *12 auth request unexpected status: 302 while sending to client, client: 172.19.160.1, server: , request: "GET / HTTP/1.1", host: "172.19.167.213", referrer: "http://172.19.167.213:9180/"
172.19.160.1 - - [18/Jul/2022:07:15:28 +0000] "GET / HTTP/1.1" 500 576 "http://172.19.167.213:9180/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"
openresty nginx saml
1 Answers

According to [1], auth_request cannot handle redirects:

If the subrequest returns a 2xx response code, the access is allowed. If it returns 401 or 403, the access is denied with the corresponding error code. Any other response code returned by the subrequest is considered an error.

You therefore need to handle the redirects differently, perhaps [2] can help here.

Alternatively: aaybe Openresty would help with your project. It adds Lua support to nginx. There are already some community SAML implementations available [3][4]. If they don't work, you probably have to implement your own.

[1] http://nginx.org/en/docs/http/ngx_http_auth_request_module.html

[2] https://developers.shopware.com/blog/2015/03/02/sso-with-nginx-authrequest-module/

[3] https://github.com/nicoster/ngxlua-saml-sp

[4] https://github.com/hnakamur/nginx-lua-saml-service-provider

user_70090680
Related