Compare commits
4 Commits
0.5
...
5c2ae98afb
| Author | SHA1 | Date | |
|---|---|---|---|
| 5c2ae98afb | |||
| 018b74e140 | |||
| 55413d20c5 | |||
| ba6b6f277a |
50
README.md
50
README.md
@ -1,5 +1,5 @@
|
|||||||
# lucidAuth
|
# lucidAuth [](#) [ ](#)
|
||||||
[](#) [ ](#)
|
> *Respect* the unexpected, mitigate your risks
|
||||||
|
|
||||||
Forward Authentication for use with proxies (caddy, nginx, traefik, etc)
|
Forward Authentication for use with proxies (caddy, nginx, traefik, etc)
|
||||||
|
|
||||||
@ -14,15 +14,47 @@ Forward Authentication for use with proxies (caddy, nginx, traefik, etc)
|
|||||||
|
|
||||||
- #### in Traefik
|
- #### in Traefik
|
||||||
Add the following lines (change to reflect your existing configuration):
|
Add the following lines (change to reflect your existing configuration):
|
||||||
|
##### 1.7
|
||||||
```
|
```
|
||||||
[frontends.server1]
|
[frontends.server1]
|
||||||
entrypoints = ["https"]
|
entrypoints = ["https"]
|
||||||
backend = "server1"
|
backend = "server1"
|
||||||
[frontends.server1.auth.forward]
|
[frontends.server1.auth.forward]
|
||||||
address = "https://<fqdn>/lucidAuth.validateRequest.php"
|
address = "https://<fqdn>/lucidAuth.validateRequest.php"
|
||||||
[frontends.server1.routes]
|
[frontends.server1.routes]
|
||||||
[frontends.server1.routes.ext]
|
[frontends.server1.routes.ext]
|
||||||
rule = "Host:<fqdn>"
|
rule = "Host:<fqdn>"
|
||||||
|
```
|
||||||
|
##### 2.0
|
||||||
|
Either whitelist IP's which should be trusted to send `HTTP_X-Forwarded-*` headers, ór enable insecure-mode in your static configuration:
|
||||||
|
```
|
||||||
|
entryPoints:
|
||||||
|
https:
|
||||||
|
address: :443
|
||||||
|
forwardedHeaders:
|
||||||
|
trustedIPs:
|
||||||
|
- "127.0.0.1/32"
|
||||||
|
- "192.168.1.0/24"
|
||||||
|
# insecure: true
|
||||||
|
```
|
||||||
|
Define a middleware that tells Traefik to forward requests for authentication in your dynamic file provider:
|
||||||
|
```
|
||||||
|
https:
|
||||||
|
middlewares:
|
||||||
|
ldap-authentication:
|
||||||
|
forwardAuth:
|
||||||
|
address: "https://<fqdn>/lucidAuth.validateRequest.php"
|
||||||
|
trustForwardHeader: true
|
||||||
|
```
|
||||||
|
And finally add the new middleware to your service (different methods; this depends on your configuration):
|
||||||
|
```
|
||||||
|
# as a label (when using Docker provider)
|
||||||
|
traefik.http.routers.router1.middlewares: "ldap-authentication@file"
|
||||||
|
# as yaml (when using file provider)
|
||||||
|
routers:
|
||||||
|
router1:
|
||||||
|
middlewares:
|
||||||
|
- "ldap-authentication"
|
||||||
```
|
```
|
||||||
|
|
||||||
- #### Important!
|
- #### Important!
|
||||||
|
|||||||
@ -15,6 +15,8 @@ $pageLayout['full'] = <<<'FULL'
|
|||||||
<link href="misc/style.button.css" rel="stylesheet" />
|
<link href="misc/style.button.css" rel="stylesheet" />
|
||||||
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.js"></script>
|
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.js"></script>
|
||||||
<script src="misc/script.translation.js"></script>
|
<script src="misc/script.translation.js"></script>
|
||||||
|
<script src="https://unpkg.com/nprogress@0.2.0/nprogress.js"></script>
|
||||||
|
<link href="https://unpkg.com/nprogress@0.2.0/nprogress.css" rel="stylesheet" />
|
||||||
</head>
|
</head>
|
||||||
<body>
|
<body>
|
||||||
<div id="horizon">
|
<div id="horizon">
|
||||||
|
|||||||
@ -1,27 +0,0 @@
|
|||||||
<?php
|
|
||||||
|
|
||||||
// Basic example of PHP script to handle with jQuery-Tabledit plug-in.
|
|
||||||
// Note that is just an example. Should take precautions such as filtering the input data.
|
|
||||||
|
|
||||||
header('Content-Type: application/json');
|
|
||||||
|
|
||||||
$input = filter_input_array(INPUT_POST);
|
|
||||||
|
|
||||||
$mysqli = new mysqli('localhost', 'user', 'password', 'database');
|
|
||||||
|
|
||||||
if (mysqli_connect_errno()) {
|
|
||||||
echo json_encode(array('mysqli' => 'Failed to connect to MySQL: ' . mysqli_connect_error()));
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
if ($input['action'] === 'edit') {
|
|
||||||
$mysqli->query("UPDATE users SET username='" . $input['username'] . "', email='" . $input['email'] . "', avatar='" . $input['avatar'] . "' WHERE id='" . $input['id'] . "'");
|
|
||||||
} else if ($input['action'] === 'delete') {
|
|
||||||
$mysqli->query("UPDATE users SET deleted=1 WHERE id='" . $input['id'] . "'");
|
|
||||||
} else if ($input['action'] === 'restore') {
|
|
||||||
$mysqli->query("UPDATE users SET deleted=0 WHERE id='" . $input['id'] . "'");
|
|
||||||
}
|
|
||||||
|
|
||||||
mysqli_close($mysqli);
|
|
||||||
|
|
||||||
echo json_encode($input);
|
|
||||||
@ -40,25 +40,27 @@ $(document).ready(function(){
|
|||||||
xhrFields: {
|
xhrFields: {
|
||||||
withCredentials: true,
|
withCredentials: true,
|
||||||
},
|
},
|
||||||
|
timeout: 750,
|
||||||
|
// origin domain should be exempted from timeout
|
||||||
|
// (because origin domain can/will be different from current domain --due to traefik design).
|
||||||
data: {
|
data: {
|
||||||
ref: btoa(JSON.stringify({
|
ref: btoa(JSON.stringify({
|
||||||
action: 'login',
|
action: 'login',
|
||||||
token: data.SecureToken
|
token: data.SecureToken
|
||||||
}))
|
}))
|
||||||
}
|
}
|
||||||
|
}).done(function() {
|
||||||
|
NProgress.inc(1 / XHR.length);
|
||||||
}));
|
}));
|
||||||
});
|
});
|
||||||
$.when.apply($, XHR).then(function(){
|
$.when.apply($, XHR).then(function(){
|
||||||
$.each(arguments, function(_index, _arg) {
|
$.each(arguments, function(_index, _arg) {
|
||||||
// Show progress somehow (maybe something like https://minicss.org/v2/progress)
|
// Finished cross-domain logins (either succesfully or through timeout)
|
||||||
|
NProgress.done();
|
||||||
|
window.location.replace(data.Location);
|
||||||
});
|
});
|
||||||
});
|
});
|
||||||
}
|
}
|
||||||
// Finished (either succesfully or through timeout) cross-domain logins
|
|
||||||
// redirect once all finished loading or timeout after $X ms
|
|
||||||
// origin domain should be exempted from timeout
|
|
||||||
// (because origin domain can/will be different from current domain --due to traefik design).
|
|
||||||
//window.location.replace(data.Location);
|
|
||||||
}, 2250);
|
}, 2250);
|
||||||
} else {
|
} else {
|
||||||
$('#btnlogin').css({
|
$('#btnlogin').css({
|
||||||
|
|||||||
Reference in New Issue
Block a user