Ce site est optimisé pour être consulté depuis un navigateur moderne dans lequel JavaScript est activé.

Installer OAuth2 Proxy

liberodark

Bonjour,

Voici comment mettre votre application en MFA avec Azure via OAuth2 Proxy.

Installer les dépendances :

yum install -y nginx wget
systemctl enable --now nginx

Télécharger OAuth2 Proxy :

wget https://github.com/oauth2-proxy/oauth2-proxy/releases/download/v7.4.0/oauth2-proxy-v7.4.0.linux-amd64.tar.gz

Installer OAuth2 Proxy :

tar -xvf oauth2-proxy-v7.4.0.linux-amd64.tar.gz
cd oauth2-proxy-v7.4.0.linux-amd64
mkdir -p /opt/oauth2
groupadd -r oauth2
useradd -r -g oauth2 -d /opt/oauth2 -s /sbin/nologin oauth2
cp oauth2-proxy /opt/oauth2
chown -R oauth2: /opt/oauth2
chmod +x /opt/oauth2/oauth2-proxy

Configurer OAuth2 Proxy :

nano /opt/oauth2/run.sh

#!/bin/bash

#https://my.app.com/oauth2/callback
#Generate Cookie
#dd if=/dev/urandom bs=32 count=1 status=none | base64 -w 0 | tr -- '+/' '-_'; echo
#cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1 | base64

SECRET="YOUR SECRET"
ID="YOUR ID"
TENANT="YOUR TENANT"

run_oauth(){
./oauth2-proxy \
    --http-address="0.0.0.0:4180" \
    --email-domain="app.com" \
    --upstream=http://127.0.0.1:8080/ \
    --cookie-secret="U1dEck1kTWxsOERCYzY0ZAo=" \
    --cookie-secure=true \
    --provider=azure \
    --client-id="${ID}" \
    --client-secret="${SECRET}" \
    --azure-tenant="${TENANT}" \
    --oidc-issuer-url=https://login.microsoftonline.com/"${TENANT}"/v2.0
}

run_oauth

chmod +x /opt/oauth2/run.sh

Configurer OAuth2 Proxy Service :

nano /etc/systemd/system/oauth2-proxy.service

[Unit]
Description=oauth2-proxy
After=network.target

[Service]
WorkingDirectory=/opt/oauth2/
User=oauth2
Group=oauth2
Type=simple
UMask=000
ExecStart=/opt/oauth2/run.sh
RestartSec=120
Restart=always

[Install]
WantedBy=multi-user.target

systemctl enable --now oauth2-proxy

Configurer Nginx :

nano /etc/nginx/conf.d/my.app.com.conf

Exemple :

location / {
  proxy_pass        https://my.app.com/;
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";

  more_clear_input_headers 'Accept-Encoding';

  # Include Block IP.
  allow all;

  # Upload Size.
  client_max_body_size 30m;

  # Log to Rsyslog.
  access_log /var/log/nginx/my.app.com-access.log;
  error_log /var/log/nginx/my.app.com-error.log;
  access_log syslog:server=10.10.0.1:514,facility=local7,tag=nginx,severity=info;
  error_log syslog:server=10.10.0.1:514,facility=local7,tag=nginx,severity=error;

  # Force usage of https
  if ($scheme = http) {
             rewrite ^ https://$server_name$request_uri? permanent;
  }
}

Vers :

location / {
  auth_request /oauth2/auth;
  error_page 401 = /oauth2/sign_in;
  proxy_pass https://my.app.com/;
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";

  # Include Block IP.
  allow all;

  # Upload Size.
  client_max_body_size 30m;

  # Log to Rsyslog.
  access_log /var/log/nginx/my.app.com-access.log;
  error_log /var/log/nginx/my.app.com-error.log;
  access_log syslog:server=10.10.0.1:514,facility=local7,tag=nginx,severity=info;
  error_log syslog:server=10.10.0.1:514,facility=local7,tag=nginx,severity=error;

  # Force usage of https
  if ($scheme = http) {
             rewrite ^ https://$server_name$request_uri? permanent;
  }
}

location /oauth2/ {
  proxy_pass       http://127.0.0.1:4180;
  proxy_set_header Host                    $host;
  proxy_set_header X-Real-IP               $remote_addr;
  proxy_set_header X-Scheme                $scheme;
  proxy_set_header X-Auth-Request-Redirect $request_uri;
  proxy_busy_buffers_size   512k;
  proxy_buffers   4 512k;
  proxy_buffer_size   256k;
  # or, if you are handling multiple domains:
  # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
}

location = /oauth2/auth {
  proxy_pass       http://127.0.0.1:4180;
  proxy_set_header Host             $host;
  proxy_set_header X-Real-IP        $remote_addr;
  proxy_set_header X-Scheme         $scheme;
 # nginx auth_request includes headers but not body
  proxy_set_header Content-Length   "";
  proxy_pass_request_body           off;
}

systemctl reload nginx

Voilà vous avez sécurisé une application via le MFA d'Azure