|
| 1 | +# -----------------------------------------------------------------------------# |
| 2 | +# # |
| 3 | +# Sample Reverse Proxy Configuration: Frontend Site, Backend App # |
| 4 | +# (for Open ID Connect workflow) # |
| 5 | +# # |
| 6 | +# -----------------------------------------------------------------------------# |
| 7 | + |
| 8 | +# -----------------------------------------------------------------------------# |
| 9 | +# # |
| 10 | +# 1. Basic Example: Landing page starts OIDC workflow w/o login/logout button. # |
| 11 | +# # |
| 12 | +# -----------------------------------------------------------------------------# |
| 13 | + |
1 | 14 | # This is the backend application we are protecting with OpenID Connect |
2 | 15 | upstream my_backend { |
3 | 16 | zone my_backend 64k; |
@@ -33,4 +46,106 @@ server { |
33 | 46 | } |
34 | 47 | } |
35 | 48 |
|
| 49 | +# -----------------------------------------------------------------------------# |
| 50 | +# # |
| 51 | +# 2. Advanced Example: Landing page, login/logout button to handle OIDC kflow # |
| 52 | +# # |
| 53 | +# - Landing page shows 'login' button # |
| 54 | +# - 'login' button calls `/login` endpoint to start OIDC flow by validating |
| 55 | +# 'id_token' w/ IdP's JWK. # |
| 56 | +# - Landing page calls `/userinfo` to show user info using 'access_token`. # |
| 57 | +# - 'logout' button to be finished OIDC session by IdP. # |
| 58 | +# - API authorization by validating `access_token` w/ IdP's JWK # |
| 59 | +# # |
| 60 | +# -----------------------------------------------------------------------------# |
| 61 | + |
| 62 | +# |
| 63 | +# Upstream server for proxing to the frontend site. |
| 64 | +# - Example of a bundle frontend app to locally test NGINX Plus OIDC workflow. |
| 65 | +# https://github.com/nginx-openid-connect/nginx-oidc-examples/blob/main/001-oidc-local-test/docker/build-context/nginx/sample/proxy_server_frontend.conf |
| 66 | +# This link is subject to change. |
| 67 | +# - Modify this configuration to match your frontend site. |
| 68 | +# |
| 69 | +upstream my_frontend_site { |
| 70 | + zone my_frontend_site 64k; |
| 71 | + server 127.0.0.1:9091; |
| 72 | +} |
| 73 | + |
| 74 | +# |
| 75 | +# Upstream sample for proxing to the backend API server. |
| 76 | +# - Example of a bundle backend app to locally test an API using access token. |
| 77 | +# + https://github.com/nginx-openid-connect/nginx-oidc-examples/blob/main/001-oidc-local-test/docker/build-context/nginx/sample/proxy_server_backend.conf |
| 78 | +# This link is subject to change. |
| 79 | +# - Modify this configuration to match your backend app. |
| 80 | +# |
| 81 | +upstream my_backend_app { |
| 82 | + zone my_backend_app 64k; |
| 83 | + server 127.0.0.1:9092; |
| 84 | +} |
| 85 | + |
| 86 | +# |
| 87 | +# Sample Frontend-site & backend-api-server for the OIDC workflow. |
| 88 | +# |
| 89 | +server { |
| 90 | + # Enable when debugging is needed. |
| 91 | + error_log /var/log/nginx/error.log debug; # Reduce severity level as required |
| 92 | + access_log /var/log/nginx/access.log main; |
| 93 | + |
| 94 | + # Replace the following server name with your host name. |
| 95 | + # |
| 96 | + # [Example: if you want to locally test OIDC in your laptop] |
| 97 | + # - Add '127.0.0.1 nginx.oidc.test` in your `/etc/hosts'. |
| 98 | + # - Use the command like 'make start'. |
| 99 | + # - Type 'https://nginx.oidc.test' in your browser. |
| 100 | + # - You will see the sample landing page and 'Sign In' button. |
| 101 | + # |
| 102 | + listen 8020; # Use SSL/TLS in production |
| 103 | + server_name nginx.oidc.test; |
| 104 | + |
| 105 | + # Replace the following files with your certificate. |
| 106 | + ssl_certificate /etc/ssl/nginx/nginx-repo.crt; |
| 107 | + ssl_certificate_key /etc/ssl/nginx/nginx-repo.key; |
| 108 | + |
| 109 | + # OIDC workflow |
| 110 | + include conf.d/openid_connect.server_conf; |
| 111 | + |
| 112 | + # |
| 113 | + # Frontend example: |
| 114 | + # |
| 115 | + # - Default landing page: no need OIDC workflow to show 'Sign In' button. |
| 116 | + # - The site is protected with OpenID Connect(OIDC) by calling the API |
| 117 | + # endpoint of `/login` when users click 'login' button. |
| 118 | + # |
| 119 | + location / { |
| 120 | + proxy_pass http://my_frontend_site; |
| 121 | + access_log /var/log/nginx/access.log main_jwt; |
| 122 | + } |
| 123 | + |
| 124 | + # |
| 125 | + # Backend API example to interact with proxied backend service: |
| 126 | + # |
| 127 | + # - This API resource is protected by access token which is received by IdP |
| 128 | + # after successful signing-in among the frontend site, NGINX Plus and IdP. |
| 129 | + # |
| 130 | + # - To ensure that client requests access the API securely, access token is |
| 131 | + # used for API authorization. |
| 132 | + # + Most of IdP generate an access token for API authorization of IdP's |
| 133 | + # endpoints (like /userinfo) as well as customer's endpoints. |
| 134 | + # + But Azure AD generate two types of access token for API authorization |
| 135 | + # of Microsoft graph API endpoints and customers' endpoints. |
| 136 | + # + Therefore, we recommend that you use $session_jwt for Azure AD and |
| 137 | + # $access_token for most of IdPs such as Cognito, Auth0, Keycloak, Okta, |
| 138 | + # OneLogin, Ping Identity, etc as for now. |
| 139 | + # |
| 140 | + location /v1/api/example { |
| 141 | + auth_jwt "" token=$access_token; # Use $session_jwt for Azure AD |
| 142 | + auth_jwt_key_request /_jwks_uri; # Enable when using URL |
| 143 | + #auth_jwt_key_file $oidc_jwt_keyfile; # Enable when using filename |
| 144 | + |
| 145 | + proxy_set_header Authorization "Bearer $access_token"; |
| 146 | + proxy_pass http://my_backend_app; |
| 147 | + access_log /var/log/nginx/access.log main_jwt; |
| 148 | + } |
| 149 | +} |
| 150 | + |
36 | 151 | # vim: syntax=nginx |
0 commit comments