From d906a89ad153f7fa21d73e5982a0ab427208c539 Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Wed, 8 Apr 2020 10:35:29 -0400 Subject: [PATCH 1/3] Continued auth improvements --- salt/common/nginx/nginx.conf.so-eval | 4 ++-- salt/common/nginx/nginx.conf.so-master | 4 ++-- salt/common/nginx/nginx.conf.so-mastersearch | 4 ++-- salt/soc/files/kratos/schema.json | 12 ++++++++++++ 4 files changed, 18 insertions(+), 6 deletions(-) diff --git a/salt/common/nginx/nginx.conf.so-eval b/salt/common/nginx/nginx.conf.so-eval index 19ddf0c5f..8e27bcce3 100644 --- a/salt/common/nginx/nginx.conf.so-eval +++ b/salt/common/nginx/nginx.conf.so-eval @@ -132,9 +132,9 @@ http { proxy_set_header Connection "Upgrade"; } - location /auth/ { + location ~ ^/auth/.*?(whoami|login|logout) { rewrite /auth/(.*) /$1 break; - proxy_pass http://{{ masterip }}:4433/; + proxy_pass http://{{ masterip }}:4433; proxy_read_timeout 90; proxy_connect_timeout 90; proxy_set_header Host $host; diff --git a/salt/common/nginx/nginx.conf.so-master b/salt/common/nginx/nginx.conf.so-master index 19ddf0c5f..8e27bcce3 100644 --- a/salt/common/nginx/nginx.conf.so-master +++ b/salt/common/nginx/nginx.conf.so-master @@ -132,9 +132,9 @@ http { proxy_set_header Connection "Upgrade"; } - location /auth/ { + location ~ ^/auth/.*?(whoami|login|logout) { rewrite /auth/(.*) /$1 break; - proxy_pass http://{{ masterip }}:4433/; + proxy_pass http://{{ masterip }}:4433; proxy_read_timeout 90; proxy_connect_timeout 90; proxy_set_header Host $host; diff --git a/salt/common/nginx/nginx.conf.so-mastersearch b/salt/common/nginx/nginx.conf.so-mastersearch index 19ddf0c5f..8e27bcce3 100644 --- a/salt/common/nginx/nginx.conf.so-mastersearch +++ b/salt/common/nginx/nginx.conf.so-mastersearch @@ -132,9 +132,9 @@ http { proxy_set_header Connection "Upgrade"; } - location /auth/ { + location ~ ^/auth/.*?(whoami|login|logout) { rewrite /auth/(.*) /$1 break; - proxy_pass http://{{ masterip }}:4433/; + proxy_pass http://{{ masterip }}:4433; proxy_read_timeout 90; proxy_connect_timeout 90; proxy_set_header Host $host; diff --git a/salt/soc/files/kratos/schema.json b/salt/soc/files/kratos/schema.json index 28e630a8f..4e0d7ac02 100644 --- a/salt/soc/files/kratos/schema.json +++ b/salt/soc/files/kratos/schema.json @@ -18,6 +18,18 @@ "verification": { "via": "email" } + }, + "firstName": { + "type": "string", + "title": "First Name" + }, + "lastName": { + "type": "string", + "title": "Last Name" + }, + "role": { + "type": "string", + "title": "Role" } } }, From 7a7fcce1e1678d7d887c50d051b6e5d1db1c7d5b Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Wed, 8 Apr 2020 12:39:37 -0400 Subject: [PATCH 2/3] Added config changes needed for new admin pages in SOC --- salt/soc/files/kratos/schema.json | 24 ++++++++++++------------ salt/soc/files/soc/soc.json | 3 +++ 2 files changed, 15 insertions(+), 12 deletions(-) diff --git a/salt/soc/files/kratos/schema.json b/salt/soc/files/kratos/schema.json index 4e0d7ac02..a22a9fef6 100644 --- a/salt/soc/files/kratos/schema.json +++ b/salt/soc/files/kratos/schema.json @@ -18,19 +18,19 @@ "verification": { "via": "email" } - }, - "firstName": { - "type": "string", - "title": "First Name" - }, - "lastName": { - "type": "string", - "title": "Last Name" - }, - "role": { - "type": "string", - "title": "Role" } + }, + "firstName": { + "type": "string", + "title": "First Name" + }, + "lastName": { + "type": "string", + "title": "Last Name" + }, + "role": { + "type": "string", + "title": "Role" } }, "required": [ diff --git a/salt/soc/files/soc/soc.json b/salt/soc/files/soc/soc.json index f69a66117..af739a3ef 100644 --- a/salt/soc/files/soc/soc.json +++ b/salt/soc/files/soc/soc.json @@ -11,6 +11,9 @@ "filedatastore": { "jobDir": "jobs" }, + "kratos": { + "hostUrl": "http://{{ MASTERIP }}:4434/" + }, "securityonion": { "elasticsearchHost": "http://{{ MASTERIP }}:9200", "elasticsearchUsername": "", From bb470be4e6828f80360bbe20e1530903f2f32117 Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Thu, 9 Apr 2020 17:37:03 -0400 Subject: [PATCH 3/3] support auto redirect on login --- salt/common/nginx/nginx.conf.so-eval | 2 +- salt/common/nginx/nginx.conf.so-master | 2 +- salt/common/nginx/nginx.conf.so-mastersearch | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/salt/common/nginx/nginx.conf.so-eval b/salt/common/nginx/nginx.conf.so-eval index 8e27bcce3..4c01f7a6d 100644 --- a/salt/common/nginx/nginx.conf.so-eval +++ b/salt/common/nginx/nginx.conf.so-eval @@ -288,7 +288,7 @@ http { error_page 401 = @error401; location @error401 { - add_header Set-Cookie "NSREDIRECT=http://{{ masterip }}$request_uri;Domain={{ masterip }};Path=/;Max-Age=60000"; + add_header Set-Cookie "AUTH_REDIRECT=$request_uri;Max-Age=14400"; return 302 /auth/self-service/browser/flows/login; } diff --git a/salt/common/nginx/nginx.conf.so-master b/salt/common/nginx/nginx.conf.so-master index 8e27bcce3..698f0c35f 100644 --- a/salt/common/nginx/nginx.conf.so-master +++ b/salt/common/nginx/nginx.conf.so-master @@ -288,7 +288,7 @@ http { error_page 401 = @error401; location @error401 { - add_header Set-Cookie "NSREDIRECT=http://{{ masterip }}$request_uri;Domain={{ masterip }};Path=/;Max-Age=60000"; + add_header Set-Cookie "AUTH_REDIRECT=$request_uri;Path=/;Max-Age=14400"; return 302 /auth/self-service/browser/flows/login; } diff --git a/salt/common/nginx/nginx.conf.so-mastersearch b/salt/common/nginx/nginx.conf.so-mastersearch index 8e27bcce3..698f0c35f 100644 --- a/salt/common/nginx/nginx.conf.so-mastersearch +++ b/salt/common/nginx/nginx.conf.so-mastersearch @@ -288,7 +288,7 @@ http { error_page 401 = @error401; location @error401 { - add_header Set-Cookie "NSREDIRECT=http://{{ masterip }}$request_uri;Domain={{ masterip }};Path=/;Max-Age=60000"; + add_header Set-Cookie "AUTH_REDIRECT=$request_uri;Path=/;Max-Age=14400"; return 302 /auth/self-service/browser/flows/login; }