Nginx reverse proxy using auth_request module and external authentication API - error 404

Question

I am trying to configure nginx as a reverse proxy to protect another server (kibana) using an external authentication API.

This is the url that should log me into kibana dashboard - http://127.0.0.1/kibana_proxy?username=my.user&password=test67

Once the authentication done (i.e. https status 200), nginx is throwing a 404 error. But the error log has this -

2018/10/18 13:33:52 [error] 10718#0: *19 open() "/usr/share/nginx/html/app/kibana" failed (2: No such file or directory), client: 127.0.0.1, server: _, request: "GET /app/kibana HTTP/1.1", host: "127.0.0.1", referrer: "http://127.0.0.1/kibana_proxy/?username=my.user&password=test67"

This is my nginx conf file -

server {
    listen *:80;
    server_name _;

    location = /auth {
        set $query '';
        if ($request_uri ~* "[^\?]+\?(.*)$") {
            set $query $1;
        }
        proxy_pass http://127.0.0.1:8080/auth?$query;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
    }

    location /kibana_proxy/ {
        proxy_pass http://127.0.0.1:5601/;
        auth_request /auth;
    }

    error_page 404 /404.html;
    location = /40x.html {

    }

    error_page 500 502 503 504 /50x.html;
    location = /50x.html {

    }
}

Arghya Saha · Answer 1 · 2018-10-23T07:53:49.780

2

Whenever you are using Restricting Access with HTTP Basic Authentication then you should use the following url pattern to access the restricted url

http://username:password@example.com/

It is not possible to pass username and password via query parameters in standard HTTP auth.

Update:

I feel your nginx settings needs some update. You should rewrite the url to remove the /kibana_proxy/:

location /kibana_proxy/
{
     rewrite ^/kibana_proxy/(.*) /$1 break;
     proxy_pass http://localhost:5200;
     proxy_http_version 1.1;
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection 'upgrade';
     proxy_set_header Host $host;
     proxy_set_header X-Forwarded-For $remote_addr;
     proxy_set_header  X-Real-IP  $remote_addr;
     proxy_cache_bypass $http_upgrade;
}

edited Oct 23 '18 at 07:53

answered Oct 22 '18 at 19:35

Arghya Saha

5,599
4
26
48

But this is not Basic Auth (I am not using .htpasswd lookup), The authentication is done at an external webapp - `http://127.0.0.1:8080/auth` and the authentication works but the proxy_pass to `http://127.0.0.1:5601/` isn't working. – Mahesh H Viraktamath Oct 23 '18 at 07:32
1

@MaheshHViraktamath Sorry I have updated the answer. Can you try rewriting the url, I feel the nginx settings is causing the problem? – Arghya Saha Oct 23 '18 at 07:56
I had tried this rewriting I guess, but tried it again now. I got - `2018/10/23 14:22:30 [error] 26509#0: *5 open() "/usr/share/nginx/html/app/kibana" failed (2: No such file or directory), client: 127.0.0.1, server: _, request: "GET /app/kibana HTTP/1.1", host: "localhost", referrer: "http://localhost/kibana_proxy/?username=abcd&password=123456"` – Mahesh H Viraktamath Oct 23 '18 at 08:54

score 1 · Answer 2 · answered Oct 29 '18 at 05:37

For those seeking answer - here's the nginx server conf that solved the issue for me -

server {
  listen *:80;
  server_name 127.0.0.1;

  location = /auth {
      set $query '';
      if ($request_uri ~* "[^\?]+\?(.*)$") {
         set $query $1;
      }
      # add_header X-debug-message "Parameters being passed $is_args$args" always;
      proxy_pass http://127.0.0.1:8080/auth?$query;
  }

  location /kibana/ {
     rewrite ^/kibana/(.*) /$1 break;
     proxy_pass http://127.0.0.1:5601;
     proxy_http_version 1.1;
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection 'upgrade';
     proxy_set_header Host $host;
     proxy_set_header X-Forwarded-For $remote_addr;
     proxy_set_header  X-Real-IP  $remote_addr;
     proxy_cache_bypass $http_upgrade;
     auth_request /auth;
  }

  location ~ (/app/|/app/kibana|/bundles/|/kibana4|/status|/plugins|/ui/|/api/|/monitoring/|/elasticsearch/) {
     proxy_pass http://127.0.0.1:5601;
     proxy_http_version 1.1;
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection "upgrade";
     proxy_set_header Host $host;
     rewrite /kibana4/(.*)$ /$1 break;
  }

  error_page 404 /404.html;
    location = /40x.html {
  }

  error_page 500 502 503 504 /50x.html;
    location = /50x.html {
  }
}

Hi, I tried implementing something like this but my validation URL is getting called multiple times, Did you run into a similar issue? — Apoorv Singh, Oct 06 '21 at 14:28

Nginx reverse proxy using auth_request module and external authentication API - error 404

2 Answers2