我有 Nginx 服務器向 Apache 服務器發送受保護內容的請求，Apache 又轉發到 Azure ADFS，使用 Apache mod_auth_openidc 進行 Azure ADFS 身份驗證。
雖然下面作業正常：
Apache:443/ourapp -> Apache:6000 -> Azure ADFS -> Apache:6000 -> Apache:443/ourapp
但是一旦在下面的設定中引入了 nginx，瀏覽器中的錯誤就會彈出“在繼續請求中找不到非空標頭（se_custid/ein）”
Nginx:443/ourapp -> Apache:6000-> Azure ADFS -> Apache:6000 -> Nginx:443/ourapp
阿帕奇配置：
<Location /ourapp>
AuthType openid-connect
Require valid-user
</Location>
LoadModule auth_openidc_module modules/mod_auth_openidc.so
OIDCProviderMetadataURL https://login.microsoftonline.com/XXXX_XXX-xxx-XXXXXX/v2.0/.well-known/openid-configuration
OIDCClientID XXXXXXXXXXXXXXX
OIDCClientSecret XXXXXXXXXX
OIDCRedirectURI https://forever-authcheck.tire1network.com:6000/ourapp
OIDCCryptoPassphrase XXXXXXXXXXXX
OIDCScope "openid email profile"
#OIDCRemoteUserClaim email
OIDCProviderAuthorizationEndpoint https://login.microsoftonline.com/XXXX_XXX-xxx-XXXXXX/oauth2/v2.0/authorize
OIDCProviderTokenEndpoint https://login.microsoftonline.com/XXXX_XXX-xxx-XXXXXX/oauth2/v2.0/token
#OIDCPKCEMethod S256
OIDCPassIDTokenAs claims
OIDCCookiePath /
OIDCCookieDomain forever-authcheck.tire1network.com
OIDCCookie APP-OIDC-SESSION
OIDCCookieHTTPOnly On
OIDCSessionInactivityTimeout 600
OIDCSessionMaxDuration 36006
<VirtualHost *:6000>
ProxyPreserveHost On
ErrorLog /var/log/httpd/voidcerror.log
LogLevel debug
ServerName forever-authcheck.tire1network.com
Header always set Access-Control-Allow-Origin "*"
Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS, DELETE, PUT"
Header always set Access-Control-Max-Age "1000"
Header always set Access-Control-Allow-Headers "x-requested-with, Content-Type, origin, authorization, accept, client-security-token"
ProxyPreserveHost On
Header set ein %{OIDC_CLAIM_EIN}e
ProxyPass /ourapp/ forever-authcheck.tire1network.com/in/
ProxyPassReverse /ourapp/ forever-authcheck.tire1network.com/in/
ProxyPreserveHost On
ServerName forever-authcheck.tire1network.com
SSLEngine on
SSLCertificateFile "/etc/pki/outcert/Certificate.pem"
SSLCertificateKeyFile "/etc/pki/outcert/CertificateKey.pem"
SSLCertificateChainFile "/etc/pki/outcert/CertificateChain.p12"
</VirtualHost>
Nginx 配置：
nginx:80
location /ourapp/ {
proxy_ssl_server_name on;
proxy_pass https://forever-authcheck.tire1network.com:6000;
proxy_set_header se-journey "direct";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Host $remote_addr;
proxy_redirect default;
proxy_ssl_certificate /etc/pki/outcert/Certificate.pem;
proxy_ssl_certificate_key /etc/pki/outcert/CertificateKey.pem;
proxy_ssl_verify off;
}
問題：如何將正確的標頭從 apache 轉發到 nginx
我認為需要轉發到 nginx 的有趣標題 apache 是“{OIDC_CLAIM_EIN}”
uj5u.com熱心網友回復：
好吧，圍繞理解做了一些調整，部署了另一個臨時設定來理解挖掘更多日志。
這里是目前的理解 User Request -> Nginx:443/ourapp -> Apache:6000-> Azure ADFS -> Azure Returns URL to browser -> Browser Requests 回傳的 URL
通過仔細查看日志，很清楚發生了什么，More over this one 幫助它更了解它
在調整 ngnix 以發送帶有埠和正確主機的正確標頭后，
proxy_set_header X-Forwarded-Port "443";
proxy_set_header X-Forwarded-Host "forever-authcheck.tire1network.com";
這導致 apache 和 mod_auth_openidc 為 original_url 設定了正確的 cookie。
現在重定向作業正常，宣告到達 NGINX 和我們的應用程式。
轉載請註明出處，本文鏈接：https://www.uj5u.com/caozuo/472208.html