outposts/proxy: fix redirect when using forward_auth mode
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
This commit is contained in:
parent
4c3a9e69f2
commit
d296c12d01
|
@ -3,9 +3,9 @@ package application
|
||||||
import (
|
import (
|
||||||
"fmt"
|
"fmt"
|
||||||
"net/http"
|
"net/http"
|
||||||
"net/url"
|
|
||||||
|
|
||||||
"goauthentik.io/api"
|
"goauthentik.io/api"
|
||||||
|
"goauthentik.io/internal/outpost/proxyv2/constants"
|
||||||
"goauthentik.io/internal/utils/web"
|
"goauthentik.io/internal/utils/web"
|
||||||
)
|
)
|
||||||
|
|
||||||
|
@ -34,31 +34,32 @@ func (a *Application) forwardHandleTraefik(rw http.ResponseWriter, r *http.Reque
|
||||||
}
|
}
|
||||||
host := ""
|
host := ""
|
||||||
// Optional suffix, which is appended to the URL
|
// Optional suffix, which is appended to the URL
|
||||||
suffix := ""
|
|
||||||
if *a.proxyConfig.Mode == api.PROXYMODE_FORWARD_SINGLE {
|
if *a.proxyConfig.Mode == api.PROXYMODE_FORWARD_SINGLE {
|
||||||
host = web.GetHost(r)
|
host = web.GetHost(r)
|
||||||
} else if *a.proxyConfig.Mode == api.PROXYMODE_FORWARD_DOMAIN {
|
} else if *a.proxyConfig.Mode == api.PROXYMODE_FORWARD_DOMAIN {
|
||||||
host = a.proxyConfig.ExternalHost
|
host = a.proxyConfig.ExternalHost
|
||||||
// set the ?rd flag to the current URL we have, since we redirect
|
// set the redirect flag to the current URL we have, since we redirect
|
||||||
// to a (possibly) different domain, but we want to be redirected back
|
// to a (possibly) different domain, but we want to be redirected back
|
||||||
// to the application
|
// to the application
|
||||||
v := url.Values{
|
s, _ := a.sessions.Get(r, constants.SeesionName)
|
||||||
// see https://doc.traefik.io/traefik/middlewares/forwardauth/
|
// see https://doc.traefik.io/traefik/middlewares/forwardauth/
|
||||||
// X-Forwarded-Uri is only the path, so we need to build the entire URL
|
// X-Forwarded-Uri is only the path, so we need to build the entire URL
|
||||||
"rd": []string{fmt.Sprintf(
|
s.Values[constants.SessionRedirect] = fmt.Sprintf(
|
||||||
"%s://%s%s",
|
"%s://%s%s",
|
||||||
r.Header.Get("X-Forwarded-Proto"),
|
r.Header.Get("X-Forwarded-Proto"),
|
||||||
r.Header.Get("X-Forwarded-Host"),
|
r.Header.Get("X-Forwarded-Host"),
|
||||||
r.Header.Get("X-Forwarded-Uri"),
|
r.Header.Get("X-Forwarded-Uri"),
|
||||||
)},
|
)
|
||||||
|
err := s.Save(r, rw)
|
||||||
|
if err != nil {
|
||||||
|
a.log.WithError(err).Warning("failed to save session before redirect")
|
||||||
}
|
}
|
||||||
suffix = fmt.Sprintf("?%s", v.Encode())
|
|
||||||
}
|
}
|
||||||
proto := r.Header.Get("X-Forwarded-Proto")
|
proto := r.Header.Get("X-Forwarded-Proto")
|
||||||
if proto != "" {
|
if proto != "" {
|
||||||
proto = proto + ":"
|
proto = proto + ":"
|
||||||
}
|
}
|
||||||
rdFinal := fmt.Sprintf("%s//%s%s%s", proto, host, "/akprox/start", suffix)
|
rdFinal := fmt.Sprintf("%s//%s%s", proto, host, "/akprox/start")
|
||||||
a.log.WithField("url", rdFinal).Debug("Redirecting to login")
|
a.log.WithField("url", rdFinal).Debug("Redirecting to login")
|
||||||
http.Redirect(rw, r, rdFinal, http.StatusTemporaryRedirect)
|
http.Redirect(rw, r, rdFinal, http.StatusTemporaryRedirect)
|
||||||
}
|
}
|
||||||
|
@ -68,6 +69,7 @@ func (a *Application) forwardHandleNginx(rw http.ResponseWriter, r *http.Request
|
||||||
if claims != nil && err == nil {
|
if claims != nil && err == nil {
|
||||||
a.addHeaders(r, claims)
|
a.addHeaders(r, claims)
|
||||||
copyHeadersToResponse(rw, r)
|
copyHeadersToResponse(rw, r)
|
||||||
|
rw.WriteHeader(200)
|
||||||
return
|
return
|
||||||
} else if claims == nil && a.IsAllowlisted(r) {
|
} else if claims == nil && a.IsAllowlisted(r) {
|
||||||
a.log.Trace("path can be accessed without authentication")
|
a.log.Trace("path can be accessed without authentication")
|
||||||
|
|
|
@ -50,5 +50,10 @@ func (a *Application) handleCallback(rw http.ResponseWriter, r *http.Request) {
|
||||||
rw.WriteHeader(400)
|
rw.WriteHeader(400)
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
http.Redirect(rw, r, a.proxyConfig.ExternalHost, http.StatusFound)
|
redirect := a.proxyConfig.ExternalHost
|
||||||
|
redirectR, ok := s.Values[constants.SessionRedirect]
|
||||||
|
if ok {
|
||||||
|
redirect = redirectR.(string)
|
||||||
|
}
|
||||||
|
http.Redirect(rw, r, redirect, http.StatusFound)
|
||||||
}
|
}
|
||||||
|
|
|
@ -4,3 +4,5 @@ const SeesionName = "authentik_proxy"
|
||||||
|
|
||||||
const SessionOAuthState = "oauth_state"
|
const SessionOAuthState = "oauth_state"
|
||||||
const SessionClaims = "claims"
|
const SessionClaims = "claims"
|
||||||
|
|
||||||
|
const SessionRedirect = "redirect"
|
||||||
|
|
Reference in New Issue