NGINX - Reverse Proxy With Authentication at 2 Layers

Aleksandar Lazic al-nginx at
Thu Mar 2 22:37:24 UTC 2017


Am 01-03-2017 09:57, schrieb zaidahmd:
> ** Problem Background  **
> I have an application, say app-A, which is running on a private network
> unreachable by public network. Now a new requirement needs to deliver 
> the
> webpages of app-A to external users over public network.
> As a solution to expose app-A, I want to use NGINX as reverse proxy and 
> will
> use two layers of authentication as explained below. Kindly advise if i 
> am
> moving in the right direction in implementing the secure entry using 
> Reference Images attached at the end of email.
> ** Authentication Level 1 **    NGINX Auth Service As a solution to 
> expose
> app-A, I want to use NGINX as reverse proxy and API gateway for 
> External
> users to access the application in internal network. Once NGINX
> authenticates the request it will forward to app-A.

For this you can use

> ** Authentication Level 2 **    App-A performs Authentication After
> receiving request from nginx, app-A will perform its own 
> authentication,
> ignoring that the request came pre-authenticated from NGINX. app-A will
> perform the authentication as app-A is to be kept unaware of the new 
> reverse proxy and app-A will continue to work as is.

For this you will use

> ** Problem Situation **
> NGINX Authentication service authenticates the request and sets a 
> session-id
> in response so that it can identify the next request coming from the 
> same
> client. As app-A also authenticates the request and puts the session-id 
> in
> response. The problem here is that one session-id will get overriden by 
> the
> other.
> Questions/Options in consideration :
> 1.  (Image-ref-1) Is there anyway that I can configure NGINX to keep 
> both
> the session-ids seperate in the request so that Auth service and app-A 
> can
> recognise there own session informations for authenticated client.

you an set the session id to another variable with.

> 2.   (image-Ref-2) If both the session info cannot be saved, then can 
> we
> configure NGINX to store session-id response of app-A and auth service 
> both
> in its memory and only send the session-id of auth service back to 
> client.
> And when the request comes back with Auth Service's session-id, NGINX 
> should
> correlate the session of App-A and forward App-A's session to app-A. 
> This
> way the request would get authenticated at both layers.

I assume you can safe the session-id in memcache with.

> 3.    Which solution can be performed from the above 2 ?

I think both.
I would prefer the second one because this could save some request on 
the auth service.

> 4.    Is it good approach to have 2 layers of authentication when 
> API gateway is used? If not then what configuration is required in 
> app-A to
> not perform authentication for the requests coming from NGINX? 
> Application
> environment java spring.?

Due to the fact that you haven't told us which auth method the auth 
service can offer I suggest to use openid connect to perform a kind of 

There is a 
which is part of the n+.

If you don't want to buy n+ you can use the modules which I have 
mentioned above.

The best way would be to adopt the app-A to be able to handle both 
A available session-id, in your case the one from nginx, and no 

> ** Links to Images **
> Image-Ref-1 :
> Image-Ref-2 :
> Posted at Nginx Forum:
> _______________________________________________
> nginx mailing list
> nginx at

More information about the nginx mailing list