Custom proxy configuration

Review the requirements for a custom authentication proxy used with the request header identity provider. Meeting these requirements prevents header spoofing and ensures OAuth authorization flows work correctly.

Using the mod_auth_gssapi module is a popular way, but not required, to configure the Apache authentication proxy by using the request header identity provider. Other proxies can easily be used if the following requirements are met:

  • Blocks the X-Remote-User header from client requests to prevent spoofing.

  • Enforces client certificate authentication in the RequestHeaderIdentityProvider configuration.

  • Requires the X-Csrf-Token header be set for all authentication requests by using the challenge flow.

  • Ensures only the /oauth/authorize endpoint and subpaths of that endpoint are proxied. Redirects must be rewritten to allow the backend server to send the client to the correct location.

  • Requires the proxy URL for https://<namespace_route>/oauth/authorize to end with /authorize with no trailing slash.

  • Ensures subpaths of the proxy authorize URL forward to matching subpaths under https://<namespace_route>/oauth/authorize.

Note

The https://<namespace_route> address is the route to the OAuth server and can be obtained by running oc get route -n openshift-authentication.

← Previous: Example Apache authentication configuration using request header | ↑ Up: Identity providers in Red Hat OpenShift Container Platform | ⌂ Home: Red Hat OpenShift Container Platform | Next: Configuring Apache authentication using the request header →