Hi.

Am 01-03-2017 09:57, schrieb zaidahmd:
> ** Problem Background **
> I have an application, say app-A, which is running on a private network
> unreachable by public network. Now a new requirement needs to deliver
> the
> webpages of app-A to external users over public network.
>
> As a solution to expose app-A, I want to use NGINX as reverse proxy and
> will
> use two layers of authentication as explained below. Kindly advise if i
> am
> moving in the right direction in implementing the secure entry using
> NGINX.
>
> Reference Images attached at the end of email.
>
> ** Authentication Level 1 ** NGINX Auth Service As a solution to
> expose
> app-A, I want to use NGINX as reverse proxy and API gateway for
> External
> users to access the application in internal network. Once NGINX
> authenticates the request it will forward to app-A.

For this you can use
http://nginx.org/en/docs/http/ngx_http_auth_request_module.html

> ** Authentication Level 2 ** App-A performs Authentication After
> receiving request from nginx, app-A will perform its own
> authentication,
> ignoring that the request came pre-authenticated from NGINX. app-A will
> perform the authentication as app-A is to be kept unaware of the new
> NGINX
> reverse proxy and app-A will continue to work as is.

For this you will use
http://nginx.org/en/docs/http/ngx_http_upstream_module.html

> ** Problem Situation **
> NGINX Authentication service authenticates the request and sets a
> session-id
> in response so that it can identify the next request coming from the
> same
> client. As app-A also authenticates the request and puts the session-id
> in
> response. The problem here is that one session-id will get overriden by
> the
> other.
>
> Questions/Options in consideration :
>
> 1. (Image-ref-1) Is there anyway that I can configure NGINX to keep
> both
> the session-ids seperate in the request so that Auth service and app-A
> can
> recognise there own session informations for authenticated client.

you an set the session id to another variable with.
http://nginx.org/en/docs/http/ngx_http_auth_request_module.html#auth_request_set

> 2. (image-Ref-2) If both the session info cannot be saved, then can
> we
> configure NGINX to store session-id response of app-A and auth service
> both
> in its memory and only send the session-id of auth service back to
> client.
> And when the request comes back with Auth Service's session-id, NGINX
> should
> correlate the session of App-A and forward App-A's session to app-A.
> This
> way the request would get authenticated at both layers.

I assume you can safe the session-id in memcache with.
http://nginx.org/en/docs/http/ngx_http_memcached_module.html

> 3. Which solution can be performed from the above 2 ?

I think both.
I would prefer the second one because this could save some request on
the auth service.

> 4. Is it good approach to have 2 layers of authentication when
> NGINX's
> API gateway is used? If not then what configuration is required in
> app-A to
> not perform authentication for the requests coming from NGINX?
> Application
> environment java spring.?

Due to the fact that you haven't told us which auth method the auth
service can offer I suggest to use openid connect to perform a kind of
SSO.

There is a http://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html
which is part of the n+.

If you don't want to buy n+ you can use the modules which I have
mentioned above.

The best way would be to adopt the app-A to be able to handle both
situations.
A available session-id, in your case the one from nginx, and no
session-id.

> ** Links to Images **
> Image-Ref-1 : http://i64.tinypic.com/27zbthj.gif
> Image-Ref-2 : http://i63.tinypic.com/35a2lbp.png
>
> Posted at Nginx Forum:
> https://forum.nginx.org/read.php?2,272674,272674#msg-272674
>
> _______________________________________________
> nginx mailing list
> nginx@nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx