outposts/proxy: fix redirect when using forward_auth mode

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
This commit is contained in:
Jens Langhammer 2021-09-09 10:56:20 +02:00
parent 4c3a9e69f2
commit d296c12d01
3 changed files with 24 additions and 15 deletions

View File

@ -3,9 +3,9 @@ package application
import ( import (
"fmt" "fmt"
"net/http" "net/http"
"net/url"
"goauthentik.io/api" "goauthentik.io/api"
"goauthentik.io/internal/outpost/proxyv2/constants"
"goauthentik.io/internal/utils/web" "goauthentik.io/internal/utils/web"
) )
@ -34,31 +34,32 @@ func (a *Application) forwardHandleTraefik(rw http.ResponseWriter, r *http.Reque
} }
host := "" host := ""
// Optional suffix, which is appended to the URL // Optional suffix, which is appended to the URL
suffix := ""
if *a.proxyConfig.Mode == api.PROXYMODE_FORWARD_SINGLE { if *a.proxyConfig.Mode == api.PROXYMODE_FORWARD_SINGLE {
host = web.GetHost(r) host = web.GetHost(r)
} else if *a.proxyConfig.Mode == api.PROXYMODE_FORWARD_DOMAIN { } else if *a.proxyConfig.Mode == api.PROXYMODE_FORWARD_DOMAIN {
host = a.proxyConfig.ExternalHost host = a.proxyConfig.ExternalHost
// set the ?rd flag to the current URL we have, since we redirect // set the redirect flag to the current URL we have, since we redirect
// to a (possibly) different domain, but we want to be redirected back // to a (possibly) different domain, but we want to be redirected back
// to the application // to the application
v := url.Values{ s, _ := a.sessions.Get(r, constants.SeesionName)
// see https://doc.traefik.io/traefik/middlewares/forwardauth/ // see https://doc.traefik.io/traefik/middlewares/forwardauth/
// X-Forwarded-Uri is only the path, so we need to build the entire URL // X-Forwarded-Uri is only the path, so we need to build the entire URL
"rd": []string{fmt.Sprintf( s.Values[constants.SessionRedirect] = fmt.Sprintf(
"%s://%s%s", "%s://%s%s",
r.Header.Get("X-Forwarded-Proto"), r.Header.Get("X-Forwarded-Proto"),
r.Header.Get("X-Forwarded-Host"), r.Header.Get("X-Forwarded-Host"),
r.Header.Get("X-Forwarded-Uri"), r.Header.Get("X-Forwarded-Uri"),
)}, )
err := s.Save(r, rw)
if err != nil {
a.log.WithError(err).Warning("failed to save session before redirect")
} }
suffix = fmt.Sprintf("?%s", v.Encode())
} }
proto := r.Header.Get("X-Forwarded-Proto") proto := r.Header.Get("X-Forwarded-Proto")
if proto != "" { if proto != "" {
proto = proto + ":" proto = proto + ":"
} }
rdFinal := fmt.Sprintf("%s//%s%s%s", proto, host, "/akprox/start", suffix) rdFinal := fmt.Sprintf("%s//%s%s", proto, host, "/akprox/start")
a.log.WithField("url", rdFinal).Debug("Redirecting to login") a.log.WithField("url", rdFinal).Debug("Redirecting to login")
http.Redirect(rw, r, rdFinal, http.StatusTemporaryRedirect) http.Redirect(rw, r, rdFinal, http.StatusTemporaryRedirect)
} }
@ -68,6 +69,7 @@ func (a *Application) forwardHandleNginx(rw http.ResponseWriter, r *http.Request
if claims != nil && err == nil { if claims != nil && err == nil {
a.addHeaders(r, claims) a.addHeaders(r, claims)
copyHeadersToResponse(rw, r) copyHeadersToResponse(rw, r)
rw.WriteHeader(200)
return return
} else if claims == nil && a.IsAllowlisted(r) { } else if claims == nil && a.IsAllowlisted(r) {
a.log.Trace("path can be accessed without authentication") a.log.Trace("path can be accessed without authentication")

View File

@ -50,5 +50,10 @@ func (a *Application) handleCallback(rw http.ResponseWriter, r *http.Request) {
rw.WriteHeader(400) rw.WriteHeader(400)
return return
} }
http.Redirect(rw, r, a.proxyConfig.ExternalHost, http.StatusFound) redirect := a.proxyConfig.ExternalHost
redirectR, ok := s.Values[constants.SessionRedirect]
if ok {
redirect = redirectR.(string)
}
http.Redirect(rw, r, redirect, http.StatusFound)
} }

View File

@ -4,3 +4,5 @@ const SeesionName = "authentik_proxy"
const SessionOAuthState = "oauth_state" const SessionOAuthState = "oauth_state"
const SessionClaims = "claims" const SessionClaims = "claims"
const SessionRedirect = "redirect"