Issue
I have a service that returns:
WWW-Authenticate: Negotiate, Basic realm="TM1"
Since this doesn't work with libcurl, I'm trying to use nginx to modify those headers like so:
WWW-Authenticate: Negotiate
WWW-Authenticate: Basic realm="TM1"
My failed attempt #1:
http {
proxy_intercept_errors on;
server {
listen 10103;
server_name localhost;
location / {
proxy_pass https://tm1server:10103;
proxy_intercept_errors on;
proxy_hide_header WWW-Authenticate;
add_header "Status is" "${status}" always;
if ($status = 401) {
add_header WWW-Authenticate 'Basic realm="TM1"' always;
add_header WWW-Authenticate 'Negotiate' always;
}
}
}
}
Test:
$ curl -sv http://localhost:10103/api/v1/Configuration
* Trying 127.0.0.1:10103...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 10103 (#0)
> GET /api/v1/Configuration HTTP/1.1
> Host: localhost:10103
> User-Agent: curl/7.68.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 401 Unauthorized
< Server: nginx/1.18.0
< Date: Tue, 09 Jun 2020 14:09:14 GMT
< Content-Type: text/plain
< Content-Length: 0
< Connection: keep-alive
< OData-Version: 4.0
< Set-Cookie: TM1SessionId=rc6xBs4_ZtKRTA3IyIBRIA; Path=/api/; HttpOnly; Secure
< Status is: 401
<
* Connection #0 to host localhost left intact
Why doesn't if ($status = 401)
work?
My failed attempt #2 (since If is Evil anyways):
http {
proxy_intercept_errors on;
server {
listen 10103;
server_name localhost;
location / {
proxy_pass https://tm1server:10103;
proxy_intercept_errors on;
proxy_hide_header WWW-Authenticate;
error_page 401 = @401;
}
location @401 {
proxy_hide_header WWW-Authenticate;
# Preferably, only set those available in $http_www_authenticate
add_header WWW-Authenticate 'Basic realm="TM1"' always;
add_header WWW-Authenticate 'Negotiate' always;
return 401 "Authentication required";
}
}
}
Test:
$ curl -sv http://localhost:10103/api/v1/Configuration
Authentication required* Trying 127.0.0.1:10103...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 10103 (#0)
> GET /api/v1/Configuration HTTP/1.1
> Host: localhost:10103
> User-Agent: curl/7.68.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 401 Unauthorized
< Server: nginx/1.18.0
< Date: Tue, 09 Jun 2020 14:10:16 GMT
< Content-Type: text/plain
< Content-Length: 23
< Connection: keep-alive
< WWW-Authenticate: Negotiate, Basic realm="TM1"
< WWW-Authenticate: Basic realm="TM1"
< WWW-Authenticate: Negotiate
<
{ [23 bytes data]
* Connection #0 to host localhost left intact
Why doesn't proxy_hide_header
work? (regardless of where I set it)
Or is the a better way?
Solution
The answer to your first question can be found under the if-is-evil link you provided (see the first location
block from example config on that page). I don't have an answer to your second question (non-working proxy_hide_header
in this case surprises me too), but since the upstream header became hidden with the first config, you can try this one:
http {
map $status $auth1 {
401 'Basic realm="TM1"';
}
map $status $auth2 {
401 'Negotiate';
}
server {
listen 10103;
server_name localhost;
location / {
proxy_pass https://tm1server:10103;
proxy_intercept_errors on;
proxy_hide_header WWW-Authenticate;
add_header WWW-Authenticate $auth1 always;
add_header WWW-Authenticate $auth2 always;
}
}
}
Answered By - Ivan Shatsky Answer Checked By - Terry (PHPFixing Volunteer)
0 Comments:
Post a Comment
Note: Only a member of this blog may post a comment.