mirror of
https://github.com/netbirdio/netbird.git
synced 2026-04-18 00:06:38 +00:00
07e59b2708
- Rewrite Host header to backend target (configurable via pass_host_header per mapping) - Strip and set X-Forwarded-For/X-Real-IP from direct connection (trust boundary) - Set X-Forwarded-Host and X-Forwarded-Proto headers - Strip nb_session cookie and session_token query param before forwarding - Add --forwarded-proto flag (auto/http/https) for proto detection - Fix OIDC redirect hardcoded https scheme - Add pass_host_header to proto, API, and management model
65 lines
1.5 KiB
Go
65 lines
1.5 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/url"
|
|
|
|
"google.golang.org/grpc"
|
|
|
|
"github.com/netbirdio/netbird/proxy/auth"
|
|
"github.com/netbirdio/netbird/shared/management/proto"
|
|
)
|
|
|
|
type urlGenerator interface {
|
|
GetOIDCURL(context.Context, *proto.GetOIDCURLRequest, ...grpc.CallOption) (*proto.GetOIDCURLResponse, error)
|
|
}
|
|
|
|
type OIDC struct {
|
|
id string
|
|
accountId string
|
|
forwardedProto string
|
|
client urlGenerator
|
|
}
|
|
|
|
// NewOIDC creates a new OIDC authentication scheme
|
|
func NewOIDC(client urlGenerator, id, accountId, forwardedProto string) OIDC {
|
|
return OIDC{
|
|
id: id,
|
|
accountId: accountId,
|
|
forwardedProto: forwardedProto,
|
|
client: client,
|
|
}
|
|
}
|
|
|
|
func (OIDC) Type() auth.Method {
|
|
return auth.MethodOIDC
|
|
}
|
|
|
|
func (o OIDC) Authenticate(r *http.Request) (string, string) {
|
|
// Check for the session_token query param (from OIDC redirects).
|
|
// The management server passes the token in the URL because it cannot set
|
|
// cookies for the proxy's domain (cookies are domain-scoped per RFC 6265).
|
|
if token := r.URL.Query().Get("session_token"); token != "" {
|
|
return token, ""
|
|
}
|
|
|
|
redirectURL := &url.URL{
|
|
Scheme: auth.ResolveProto(o.forwardedProto, r.TLS),
|
|
Host: r.Host,
|
|
Path: r.URL.Path,
|
|
}
|
|
|
|
res, err := o.client.GetOIDCURL(r.Context(), &proto.GetOIDCURLRequest{
|
|
Id: o.id,
|
|
AccountId: o.accountId,
|
|
RedirectUrl: redirectURL.String(),
|
|
})
|
|
if err != nil {
|
|
// TODO: log
|
|
return "", ""
|
|
}
|
|
|
|
return "", res.GetUrl()
|
|
}
|