In apache before proxy I want to add an authentication header for aws signature.
So basically it should add the following headers
x-amz-date : date
Authorization : AWS access_key:aws_signature
This aws signature will require a program to get generated.
What possible options we can use to link apache2 to add this auth headers?
If the values are not dynamic, and the Apache config doesn't care about these headers on input, you can just use RequestHeader:
RequestHeader set x-amz-date date early
RequestHeader set Authorization "AWS access_key:aws_signature" early
If either value is dynamic, use "expr=..." as the value value to pull the dynamic bits you need.
Related
I'm trying to configure a valid redirectUri for all of my swagger clients, It cost me a lot of work, cause I have to configure a redirectUri for local environment and one redirectUri for each environment.
I try to add something like * / * or http://* and this is not working.
Any Idea?
Thanks
in #identityserver4 you can add many redirect URLs but domain name and subdomain will be used and port will be ignored:
https://for.example.com
https://for.example.com:888
https://for.example.com:999
are the same.
On configured AKS there is docker container with application that is using AAD authentication.
Based on this article there is also configured ingress. API is working well.
When I add to Azure Active Directory application registration reply URL with https prefix I receive error "The reply url specified in the request does not match the reply urls configured for the application". And I see that in browser address line redirect_uri is starting with http.
When I add reply URL that is starting with http, then I receive "Exception: Correlation failed".
What I have tried: Add to ingress.yaml setting ingress.kubernetes.io/force-ssl-redirect: "true"
May be there is some way to force ingress run https instead of http, or there might be some AAD redirect configuration? Any ideas?
UPDATE 2: Probably http redirect is because of ADAL.
PS: Was able to find similar topic without an answer
UPDATE3:
I have decided not to use nginx as ingress. Instead I am using now Load balancer. Soon it would be possible to use Azure Application Gateway Ingress Controller
Have you tried this?
By default the controller redirects HTTP clients to the HTTPS port 443 using a 308 Permanent Redirect response if TLS is enabled for that Ingress.
This can be disabled globally using ssl-redirect: "false" in the NGINX config map, or per-Ingress with the nginx.ingress.kubernetes.io/ssl-redirect: "false" annotation in the particular resource.
More information on this on the Ingress documentation link.
You have to make a decision whether to use HTTPS or not. If this is just the start of a development cycle, start without it and get auth to work - but implement HTTPS as soon as possible.
AAD supports both http and https, but of course, the reply urls must be added to the application registration respectively.
As #mihail-stancescu says, ssl-redirect must be set to false, if you choose not to use HTTPS. In addition to this, you also have to ensure that your app does not make the redirect from HTTP to HTTPS.
Using curl with -L -k and -v options will give you a lot of information on what is actually happening with your requests.
When the http/https thing is solved, you have to remove any rewrite annotations you have in your ingress. (e.g. ingress.kubernetes.io/rewrite-target: / should be removed).
Now, if your ingress path to the service in question is e.g. /myservice, then the reply-url should also have that part of the path added ([host]/myservice/signin-oidc) - both in the AAD application registration and in the configuration of your app. (The path in the config should not contain the host)
If you are using https, then you must also have a proper certificate. You can use the free LetsEncrypt (https://letsencrypt.org/) in conjunction with KubeLego (https://github.com/jetstack/kube-lego), where you can find some nice examples on how to implement it.
I am currently confused about how angular's (jquery) preflight OPTIONS call is "selected" or chosen to perform before a request.
I have a normal RESTful api call (api.domain.co)
I have created a host entry 127.0.0.1 local.domain.co in my hosts file /etc/hosts.
I've created self-signed certificate:
http://www.akadia.com/services/ssh_test_certificate.html
I've configured the certs in my mac as trusted:
http://abetobing.com/blog/port-forwarding-mac-os-yosemite-81.html
I've configured my Yosemite Port Forwarding Rules:
http://abetobing.com/blog/port-forwarding-mac-os-yosemite-81.html
I understand that from the browser's perspective (Chrome):
I have an angular app being loaded from https://local.domain.co with a trusted certificate that has a call to https://api.domain.co/user everything looks green with the cert, and I still get a preflight OPTIONS call to my api.domain.co server which is a node resitfy server with CORS support
Everything is Working... BUT
I want to get rid of the OPTIONS preflight Any pointers?
unfortunately subdomain still affected by preflight rule so if you want to remove OPTIONS you can either using jsonp or have the same subdomain for both the site & api.
You can't use localhost. I had to create an entry in my host file to associate 127.0.0.1 to an arbitrary name like mackbook. Then it should work for you.
I'm using Wamp as my local server while I test my Angular app.
I am using $resource to get some api data from my server but I'm getting a message
XMLHttpRequest cannot load http://myproj.herokuapp.com/api/projects?name=demo.
No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost' is therefore not allowed access. The response had HTTP status code 401.
I've searched far and wide on the web but I cannot find a working way to get around this.
Any new fresh ideas? Has anyone overcome this issue?
how to allow ACCESS-CONTROL-ALLOW-ORIGIN aka cross-domain on wampserver
This author got it right.
"You have to enable the headers module first, like so :
click on the wamp icon in your systray
go to Apache > Apache modules
check the option 'headers_module'
And then include this in your apache config:
Header set Access-Control-Allow-Origin: *
(in httpd.conf or in the configuration of your vhost)
(Instead of the * you can also specify a specific domain)"
Then bring up your browser, and use localhost/filename to access your files.
I would like to use Squid as a proxy for a Google App Engine based application (as we need to have a static outgoing ip, and GAE does not support that).
Also, I want to keep using urlfetch, so as not to do too much changes in the existing code.
The solution I want to implement is to install a Squid proxy, and direct all the urlfetch requests to this proxy by using the proxy url in the fetch request, and add some custom http header that will contain the final destination url.
Then, I want to configure Squid to take this custom header parameter from the request, and use it as the request url.
How do I configure this last part on Squid ?
(There may be many different urls, so configuring a separate port for each destination url is not an option).