Skip to content

Commit f9e08f2

Browse files
ggallardggallard
authored
Merge pull request #8 from Identicum/refactor
Refactor
2 parents 3b9e6d2 + bc338fa commit f9e08f2

51 files changed

Lines changed: 674 additions & 924 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎Dockerfile‎

Lines changed: 31 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,39 @@
1-
FROM openresty/openresty:1.25.3.1-alpine-fat
1+
FROM openresty/openresty:1.25.3.2-alpine-fat
22

3-
RUN luarocks install lua-resty-openidc
4-
RUN luarocks install lua-resty-template
3+
RUN luarocks install lua-resty-http 0.17.2
4+
RUN luarocks install lua-resty-session 4.0.5
5+
RUN luarocks install lua-resty-jwt 0.2.3
6+
RUN luarocks install lua-resty-openidc 1.8.0
7+
RUN luarocks install lua-resty-template 2.0
58

6-
COPY conf/ /usr/local/openresty/nginx/conf/
7-
COPY lua/ /etc/ipax/lua/
9+
COPY conf /var/ipax/conf/
10+
COPY lua /var/ipax/lua/
811
COPY html /var/ipax/html
912
COPY templates /var/ipax/templates
1013

1114
ENV NGINX_LOG_LEVEL=warn \
1215
NGINX_RESOLVER=8.8.8.8 \
13-
SESSION_SECRET="ipax_default_secret" \
14-
SESSION_COOKIE_PERSISTENT=off \
15-
SESSION_COOKIE_LIFETIME=86400 \
16-
SESSION_COOKIE_SAMESITE="Lax" \
1716
OIDC_DISCOVERY="" \
1817
OIDC_SSL_VERIFY="yes" \
1918
OIDC_CLIENT_ID="" \
20-
OIDC_USE_PKCE=false \
19+
OIDC_USE_PKCE="false" \
2120
OIDC_CLIENT_SECRET="" \
2221
OIDC_SCOPE="openid profile" \
2322
OIDC_REDIRECT_URI="/private/redirect_uri" \
24-
OIDC_LOGOUT_URI="/private/logout" \
25-
OIDC_POST_LOGOUT_REDIRECT_URI="/auth" \
23+
OIDC_LOGOUT_PATH="/private/logout" \
24+
OIDC_POST_LOGOUT_REDIRECT_URI="/logoutSuccess.html" \
2625
OIDC_PROMPT="" \
2726
OIDC_ACR_VALUES="" \
27+
SESSION_COOKIE_SAME_SITE="Lax" \
28+
SESSION_COOKIE_SECURE="false" \
29+
SESSION_IDLING_TIMEOUT="86400" \
30+
SESSION_REMEMBER="false" \
31+
SESSION_SECRET="ipax_default_secret" \
32+
IPAX_APP_NAME="ipax" \
33+
IPAX_DISPLAY_NAME="IPAx" \
34+
IPAX_BASE_URL="http://localhost" \
35+
IPAX_MODE="demoapp" \
36+
API_BASE_URL="" \
2837
KC_DELETE_ACCOUNT_ACTION="" \
2938
KC_DELETE_ACCOUNT_LABEL="Delete account" \
3039
KC_UPDATE_EMAIL_ACTION="" \
@@ -33,9 +42,16 @@ ENV NGINX_LOG_LEVEL=warn \
3342
KC_UPDATE_PASSWORD_LABEL="Update password" \
3443
KC_ENROL_BIOMETRICS_ACTION="" \
3544
KC_ENROL_BIOMETRICS_LABEL="Enrol biometrics" \
36-
IPAX_APP_NAME="IPAx" \
37-
API_BASEURL=""
45+
KC_ADD_PASSKEY_ACTION="" \
46+
KC_ADD_PASSKEY_LABEL="Add Passkey" \
47+
LUA_SHARED_DICT_PATH="/var/ipax/conf/lua_shared_dict" \
48+
DEMOAPPS_VARIABLES_CONFIG_PATH="/var/ipax/conf/demoapps" \
49+
DEMOAPPS_CONFIG_PATH="/var/ipax/conf/location_conf.d"
3850

3951
WORKDIR /usr/local/openresty/nginx
4052

41-
CMD ["sh", "-c", "envsubst < conf/nginx.conf.template > conf/nginx.conf && /usr/local/openresty/bin/openresty -g 'daemon off;'"]
53+
# HEALTHCHECK --interval=60s --timeout=1s --start-period=5s --retries=3 CMD [ "curl", "-f", "http://localhost/ipax/health" ]
54+
55+
CMD [ ]
56+
COPY entrypoint.sh /entrypoint.sh
57+
ENTRYPOINT [ "/bin/bash", "/entrypoint.sh" ]

‎README.md‎

Lines changed: 5 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,56 +1,14 @@
11
# IPAx
22
Identity-aware proxy based on NGINX, OpenResty and [lua-resty-openidc](https://github.com/zmartzone/lua-resty-openidc).
33

4-
## IDP
5-
Create an OpenID Connect Client in your IDP using the following information:
6-
- Client Name: IPAx
7-
- Scopes: profile, openid
8-
- Grant Types: authorization_code
9-
- Redirect URIs: Include values like: "https://myapp.identicum.com/private/redirect_uri" (suffix is handled by `lua-resty-openidc`, can be adjusted using the `OIDC_REDIRECT_URI` environment variable)
4+
## Execution mode
5+
IPAx can be used as:
106

11-
## Configuration files
12-
Samples are provided in the [conf.samples](./conf.samples/) folder.
13-
Customize your files and put them into your local `./conf.d/` directory.
7+
### proxy
148

15-
## Run the container
9+
### demoapp (single)
1610

17-
Run the image, mounting a local directory for configuration:
11+
### demoapps (multi)
1812

19-
```sh
20-
docker run -d \
21-
-p 80:80 \
22-
-e OIDC_DISCOVERY="https://idp.identicum.com/.well-known/openid-configuration" \
23-
-e OIDC_CLIENT_ID="my_client_id" \
24-
-e OIDC_CLIENT_SECRET="my_client_secret" \
25-
-e OIDC_SCOPE="openid profile" \
26-
-e OIDC_REDIRECT_URI="/private/redirect_uri" \
27-
-e OIDC_SESSION_SECRET="some_uuid_secret" \
28-
-e OIDC_POST_LOGOUT_REDIRECT_URI="https://myapp.identicum.com/logoutSuccess.html" \
29-
-e OIDC_ACR_VALUES="loa-3" \
30-
-v $(pwd)/conf.d/:/etc/ipax/conf.d/:ro \
31-
ghcr.io/identicum/ipax:latest
32-
```
3313

3414
> To use PKCE, remove `OIDC_CLIENT_SECRET` and add `OIDC_USE_PKCE` with value "true"
35-
36-
## Certificates (optional)
37-
Issue as many certificates as necessary to be used in your reverse proxy.
38-
IPAx supports [wildcard certificates](https://en.wikipedia.org/wiki/Wildcard_certificate) and [SNI](https://en.wikipedia.org/wiki/Server_Name_Indication).
39-
40-
If you want to use HTTPS, add mapping for port 443 and mount volume `./certs/` as /etc/ipax/certs/
41-
42-
### Self-signed certificate
43-
To test using a self-signed certificate, run the following command (replace with your domain):
44-
```sh
45-
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout wildcard_identicum_com.key -out wildcard_identicum_com.cer
46-
```
47-
48-
Country Name (2 letter code) [XX]: `AR`
49-
State or Province Name (full name) []: `CABA`
50-
Locality Name (eg, city) [Default City]: `Buenos Aires`
51-
Organization Name (eg, company) [Default Company Ltd]: `Identicum`
52-
Organizational Unit Name (eg, section) []: ` `
53-
Common Name (eg, your name or your server hostname) []: `*.identicum.com`
54-
Email Address []: `no-reply@identicum.com`
55-
56-
Put the generated certificate files into your local `./certs/` directory.

‎VARIABLES.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Variables
2+
3+
| Environment | nginx variable | lua_resty_openidc variable | Description |
4+
|-------------------------------|-------------------------------|------------------------------------|-------------------------------|
5+
| NGINX_RESOLVER | | | |
6+
| NGINX_LOG_LEVEL | | | |
7+
| OIDC_DISCOVERY | oidc_discovery | oidc_opts.discovery | OIDC discovery URL |
8+
| OIDC_SSL_VERIFY | oidc_ssl_verify | oidc_opts.ssl_verify | |
9+
| OIDC_CLIENT_ID | oidc_client_id | oidc_opts.client_id | |
10+
| OIDC_USE_PKCE | oidc_use_pkce | oidc_opts.use_pkce | |
11+
| OIDC_CLIENT_SECRET | oidc_client_secret | oidc_opts.client_secret | |
12+
| OIDC_SCOPE | oidc_scope | oidc_opts.scope | |
13+
| OIDC_REDIRECT_URI | oidc_redirect_uri | oidc_opts.redirect_uri | |
14+
| OIDC_LOGOUT_PATH | oidc_logout_path | oidc_opts.logout_path | |
15+
| OIDC_POST_LOGOUT_REDIRECT_URI | oidc_post_logout_redirect_uri | oidc_opts.post_logout_redirect_uri | |
16+
| OIDC_PROMPT | oidc_prompt | oidc_opts.prompt | |
17+
| OIDC_ACR_VALUES | oidc_acr_values | oidc_opts.authorization_params | |
18+
| SESSION_COOKIE_SAME_SITE | session_cookie_same_site | session_opts.cookie_same_site | Lax / Strict / None / Default |
19+
| SESSION_COOKIE_SECURE | session_cookie_secure | session_opts.cookie_secure | |
20+
| SESSION_IDLING_TIMEOUT | session_idling_timeout | session_opts.idling_timeout | |
21+
| SESSION_REMEMBER | session_remember | session_opts.remember | |
22+
| SESSION_SECRET | session_secret | session_opts.secret | |
23+
| IPAX_APP_NAME | ipax_app_name | | |
24+
| IPAX_DISPLAY_NAME | ipax_display_name | | |
25+
| IPAX_BASE_URL | ipax_base_url | | |
26+
| API_BASE_URL | api_base_url | | |
27+
| KC_DELETE_ACCOUNT_ACTION | kc_delete_account_action | | |
28+
| KC_DELETE_ACCOUNT_LABEL | | | |
29+
| KC_UPDATE_EMAIL_ACTION | | | |
30+
| KC_UPDATE_EMAIL_LABEL | | | |
31+
| KC_UPDATE_PASSWORD_ACTION | | | |
32+
| KC_UPDATE_PASSWORD_LABEL | | | |
33+
| KC_ENROL_BIOMETRICS_ACTION | | | |
34+
| KC_ENROL_BIOMETRICS_LABEL | | | |
35+
| KC_ADD_PASSKEY_ACTION | kc_add_passkey_action | | |
36+
| KC_ADD_PASSKEY_LABEL | kc_add_passkey_label | | |

‎conf/conf.d/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
/*.conf

‎conf/conf.d/README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Host-based multihoming configuration files
2+
3+
In `proxy` mode, this folder is mounted at execution time. See examples [here](./samples/)
4+
5+
In `demoapps` mode, files in this folder are generated by the [ENTRYPOINT script](../../entrypoint.sh)

conf.samples/_redirect_to_https.conf renamed to conf/conf.d/samples/_redirect_to_https.conf

File renamed without changes.

conf.samples/authN.conf renamed to conf/conf.d/samples/authN.conf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ server {
22
listen 443 ssl;
33
server_name authn.identicum.com;
44

5-
include /etc/ipax/conf.d/wildcard_identicum_com.settings;
5+
include /var/ipax/conf/conf.d/wildcard_identicum_com.settings;
66

77
location / {
88
access_by_lua_block {

conf.samples/authZ.conf renamed to conf/conf.d/samples/authZ.conf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ server {
22
listen 443 ssl;
33
server_name authz.identicum.com;
44

5-
include /etc/ipax/conf.d/wildcard_identicum_com.settings;
5+
include /var/ipax/conf/conf.d/wildcard_identicum_com.settings;
66

77
location / {
88
access_by_lua_block {

conf.samples/headers.conf renamed to conf/conf.d/samples/headers.conf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ server {
22
listen 443 ssl;
33
server_name wtp.identicum.com;
44

5-
include /etc/ipax/conf.d/wildcard_identicum_com.settings;
5+
include /var/ipax/conf/conf.d/wildcard_identicum_com.settings;
66

77
location / {
88
access_by_lua_block {

conf.samples/spa_api.conf renamed to conf/conf.d/samples/spa_api.conf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ server {
22
listen 443 ssl;
33
server_name spa.identicum.com;
44

5-
include /etc/ipax/conf.d/wildcard_identicum_com.settings;
5+
include /var/ipax/conf/conf.d/wildcard_identicum_com.settings;
66

77
location / {
88
access_by_lua_block {
@@ -18,7 +18,7 @@ server {
1818
location /api/ {
1919
set $api_base_url '';
2020
access_by_lua_block {
21-
ngx.var.api_base_url = os.getenv("API_BASEURL");
21+
ngx.var.api_base_url = os.getenv("API_BASE_URL");
2222
ngx.req.set_header("Authorization", "Bearer " .. require("ipax").get_access_token());
2323
}
2424
proxy_pass $api_base_url;

0 commit comments

Comments
 (0)