NGINX - Reverse Proxy With Authentication at 2 Layers
al-nginx at none.at
Thu Mar 2 22:37:24 UTC 2017
Am 01-03-2017 09:57, schrieb zaidahmd:
> ** Problem Background **
> I have an application, say app-A, which is running on a private network
> unreachable by public network. Now a new requirement needs to deliver
> webpages of app-A to external users over public network.
> As a solution to expose app-A, I want to use NGINX as reverse proxy and
> use two layers of authentication as explained below. Kindly advise if i
> moving in the right direction in implementing the secure entry using
> Reference Images attached at the end of email.
> ** Authentication Level 1 ** NGINX Auth Service As a solution to
> app-A, I want to use NGINX as reverse proxy and API gateway for
> users to access the application in internal network. Once NGINX
> authenticates the request it will forward to app-A.
For this you can use
> ** Authentication Level 2 ** App-A performs Authentication After
> receiving request from nginx, app-A will perform its own
> ignoring that the request came pre-authenticated from NGINX. app-A will
> perform the authentication as app-A is to be kept unaware of the new
> reverse proxy and app-A will continue to work as is.
For this you will use
> ** Problem Situation **
> NGINX Authentication service authenticates the request and sets a
> in response so that it can identify the next request coming from the
> client. As app-A also authenticates the request and puts the session-id
> response. The problem here is that one session-id will get overriden by
> Questions/Options in consideration :
> 1. (Image-ref-1) Is there anyway that I can configure NGINX to keep
> the session-ids seperate in the request so that Auth service and app-A
> recognise there own session informations for authenticated client.
you an set the session id to another variable with.
> 2. (image-Ref-2) If both the session info cannot be saved, then can
> configure NGINX to store session-id response of app-A and auth service
> in its memory and only send the session-id of auth service back to
> And when the request comes back with Auth Service's session-id, NGINX
> correlate the session of App-A and forward App-A's session to app-A.
> way the request would get authenticated at both layers.
I assume you can safe the session-id in memcache with.
> 3. Which solution can be performed from the above 2 ?
I think both.
I would prefer the second one because this could save some request on
the auth service.
> 4. Is it good approach to have 2 layers of authentication when
> API gateway is used? If not then what configuration is required in
> app-A to
> not perform authentication for the requests coming from NGINX?
> environment java spring.?
Due to the fact that you haven't told us which auth method the auth
service can offer I suggest to use openid connect to perform a kind of
There is a http://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html
which is part of the n+.
If you don't want to buy n+ you can use the modules which I have
The best way would be to adopt the app-A to be able to handle both
A available session-id, in your case the one from nginx, and no
> ** Links to Images **
> Image-Ref-1 : http://i64.tinypic.com/27zbthj.gif
> Image-Ref-2 : http://i63.tinypic.com/35a2lbp.png
> Posted at Nginx Forum:
> nginx mailing list
> nginx at nginx.org
More information about the nginx