f01bc20d44
* api: allow API requests as managed outpost's account when using secret_key Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * root: load secret key from env Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * outposts: make listener IP configurable Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * outpost/proxy: run outpost in background and pass requests conditionally Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * outpost: unify branding to embedded Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * web/admin: fix embedded outpost not being editable Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * web: fix mismatched host detection Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * tests/e2e: fix LDAP test not including user for embedded outpost Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * tests/e2e: fix user matching Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * api: add tests for secret_key auth Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * root: load environment variables using github.com/Netflix/go-env Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
59 lines
1.6 KiB
Go
59 lines
1.6 KiB
Go
package web
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"net/http/httputil"
|
|
"net/url"
|
|
|
|
"goauthentik.io/internal/utils/web"
|
|
)
|
|
|
|
func (ws *WebServer) configureProxy() {
|
|
// Reverse proxy to the application server
|
|
u, _ := url.Parse("http://localhost:8000")
|
|
director := func(req *http.Request) {
|
|
req.URL.Scheme = u.Scheme
|
|
req.URL.Host = u.Host
|
|
if _, ok := req.Header["User-Agent"]; !ok {
|
|
// explicitly disable User-Agent so it's not set to default value
|
|
req.Header.Set("User-Agent", "")
|
|
}
|
|
if req.TLS != nil {
|
|
req.Header.Set("X-Forwarded-Proto", "https")
|
|
}
|
|
}
|
|
rp := &httputil.ReverseProxy{Director: director}
|
|
rp.ErrorHandler = ws.proxyErrorHandler
|
|
rp.ModifyResponse = ws.proxyModifyResponse
|
|
ws.m.PathPrefix("/akprox").HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
|
|
if ws.ProxyServer != nil {
|
|
ws.ProxyServer.Handler(rw, r)
|
|
return
|
|
}
|
|
ws.proxyErrorHandler(rw, r, fmt.Errorf("proxy not running"))
|
|
})
|
|
ws.m.PathPrefix("/").HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
|
|
host := web.GetHost(r)
|
|
if ws.ProxyServer != nil {
|
|
if _, ok := ws.ProxyServer.Handlers[host]; ok {
|
|
ws.log.WithField("host", host).Trace("routing to proxy outpost")
|
|
ws.ProxyServer.Handler(rw, r)
|
|
return
|
|
}
|
|
}
|
|
ws.log.WithField("host", host).Trace("routing to application server")
|
|
rp.ServeHTTP(rw, r)
|
|
})
|
|
}
|
|
|
|
func (ws *WebServer) proxyErrorHandler(rw http.ResponseWriter, req *http.Request, err error) {
|
|
ws.log.WithError(err).Warning("proxy error")
|
|
rw.WriteHeader(http.StatusBadGateway)
|
|
}
|
|
|
|
func (ws *WebServer) proxyModifyResponse(r *http.Response) error {
|
|
r.Header.Set("server", "authentik")
|
|
return nil
|
|
}
|