Bonjour,
Voici comment mettre votre application en MFA avec Azure via OAuth2 Proxy.
Installer les dépendances :
yum install -y nginx wget
systemctl enable --now nginx
Télécharger OAuth2 Proxy :
wget https://github.com/oauth2-proxy/oauth2-proxy/releases/download/v7.4.0/oauth2-proxy-v7.4.0.linux-amd64.tar.gz
Installer OAuth2 Proxy :
tar -xvf oauth2-proxy-v7.4.0.linux-amd64.tar.gz
cd oauth2-proxy-v7.4.0.linux-amd64
mkdir -p /opt/oauth2
groupadd -r oauth2
useradd -r -g oauth2 -d /opt/oauth2 -s /sbin/nologin oauth2
cp oauth2-proxy /opt/oauth2
chown -R oauth2: /opt/oauth2
chmod +x /opt/oauth2/oauth2-proxy
Configurer OAuth2 Proxy :
nano /opt/oauth2/run.sh
#!/bin/bash
#https://my.app.com/oauth2/callback
#Generate Cookie
#dd if=/dev/urandom bs=32 count=1 status=none | base64 -w 0 | tr -- '+/' '-_'; echo
#cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1 | base64
SECRET="YOUR SECRET"
ID="YOUR ID"
TENANT="YOUR TENANT"
run_oauth(){
./oauth2-proxy \
--http-address="0.0.0.0:4180" \
--email-domain="app.com" \
--upstream=http://127.0.0.1:8080/ \
--cookie-secret="U1dEck1kTWxsOERCYzY0ZAo=" \
--cookie-secure=true \
--provider=azure \
--client-id="${ID}" \
--client-secret="${SECRET}" \
--azure-tenant="${TENANT}" \
--oidc-issuer-url=https://login.microsoftonline.com/"${TENANT}"/v2.0
}
run_oauth
chmod +x /opt/oauth2/run.sh
Configurer OAuth2 Proxy Service :
nano /etc/systemd/system/oauth2-proxy.service
[Unit]
Description=oauth2-proxy
After=network.target
[Service]
WorkingDirectory=/opt/oauth2/
User=oauth2
Group=oauth2
Type=simple
UMask=000
ExecStart=/opt/oauth2/run.sh
RestartSec=120
Restart=always
[Install]
WantedBy=multi-user.target
systemctl enable --now oauth2-proxy
Configurer Nginx :
nano /etc/nginx/conf.d/my.app.com.conf
Exemple :
location / {
proxy_pass https://my.app.com/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
more_clear_input_headers 'Accept-Encoding';
# Include Block IP.
allow all;
# Upload Size.
client_max_body_size 30m;
# Log to Rsyslog.
access_log /var/log/nginx/my.app.com-access.log;
error_log /var/log/nginx/my.app.com-error.log;
access_log syslog:server=10.10.0.1:514,facility=local7,tag=nginx,severity=info;
error_log syslog:server=10.10.0.1:514,facility=local7,tag=nginx,severity=error;
# Force usage of https
if ($scheme = http) {
rewrite ^ https://$server_name$request_uri? permanent;
}
}
Vers :
location / {
auth_request /oauth2/auth;
error_page 401 = /oauth2/sign_in;
proxy_pass https://my.app.com/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
# Include Block IP.
allow all;
# Upload Size.
client_max_body_size 30m;
# Log to Rsyslog.
access_log /var/log/nginx/my.app.com-access.log;
error_log /var/log/nginx/my.app.com-error.log;
access_log syslog:server=10.10.0.1:514,facility=local7,tag=nginx,severity=info;
error_log syslog:server=10.10.0.1:514,facility=local7,tag=nginx,severity=error;
# Force usage of https
if ($scheme = http) {
rewrite ^ https://$server_name$request_uri? permanent;
}
}
location /oauth2/ {
proxy_pass http://127.0.0.1:4180;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_set_header X-Auth-Request-Redirect $request_uri;
proxy_busy_buffers_size 512k;
proxy_buffers 4 512k;
proxy_buffer_size 256k;
# or, if you are handling multiple domains:
# proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
}
location = /oauth2/auth {
proxy_pass http://127.0.0.1:4180;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
# nginx auth_request includes headers but not body
proxy_set_header Content-Length "";
proxy_pass_request_body off;
}
systemctl reload nginx
Voilà vous avez sécurisé une application via le MFA d'Azure