Skip to content
This repository was archived by the owner on Mar 10, 2024. It is now read-only.

Commit 43ab8d5

Browse files
fitzyjoefitzyjoe
authored
Merge branch 'master' into jwt-37
2 parents b4e68b9 + ae57c6b commit 43ab8d5

File tree

7 files changed

+202
-103
lines changed

7 files changed

+202
-103
lines changed

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
1+
.idea
12
ngx_http_auth_jwt_module.so

‎Dockerfile

Lines changed: 79 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,9 @@ ENV LD_LIBRARY_PATH=/usr/local/lib
88

99
RUN yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm && \
1010
yum -y update && \
11-
yum -y groupinstall 'Development Tools' && \
12-
yum -y install pcre-devel pcre zlib-devel openssl-devel wget cmake check-devel check && \
13-
yum -y install nginx-$NGINX_VERSION
11+
yum -y groupinstall 'Development Tools' && \
12+
yum -y install pcre-devel pcre zlib-devel openssl-devel wget cmake check-devel check && \
13+
yum -y install nginx-$NGINX_VERSION
1414

1515
# for compiling for rh-nginx110
1616
# yum -y install libxml2 libxslt libxml2-devel libxslt-devel gd gd-devel perl-ExtUtils-Embed
@@ -24,40 +24,26 @@ WORKDIR /root/dl
2424
# build jansson
2525
ARG JANSSON_VERSION=2.10
2626
RUN wget https://github.com/akheron/jansson/archive/v$JANSSON_VERSION.zip && \
27-
unzip v$JANSSON_VERSION.zip && \
28-
rm v$JANSSON_VERSION.zip && \
29-
ln -sf jansson-$JANSSON_VERSION jansson && \
30-
cd /root/dl/jansson && \
31-
cmake . -DJANSSON_BUILD_SHARED_LIBS=1 -DJANSSON_BUILD_DOCS=OFF && \
32-
make && \
33-
make check && \
34-
make install
27+
unzip v$JANSSON_VERSION.zip && \
28+
rm v$JANSSON_VERSION.zip && \
29+
ln -sf jansson-$JANSSON_VERSION jansson && \
30+
cd /root/dl/jansson && \
31+
cmake . -DJANSSON_BUILD_SHARED_LIBS=1 -DJANSSON_BUILD_DOCS=OFF && \
32+
make && \
33+
make check && \
34+
make install
3535

3636
# build libjwt
3737
ARG LIBJWT_VERSION=1.9.0
3838
RUN wget https://github.com/benmcollins/libjwt/archive/v$LIBJWT_VERSION.zip && \
39-
unzip v$LIBJWT_VERSION.zip && \
40-
rm v$LIBJWT_VERSION.zip && \
41-
ln -sf libjwt-$LIBJWT_VERSION libjwt && \
42-
cd /root/dl/libjwt && \
43-
autoreconf -i && \
44-
./configure JANSSON_CFLAGS=/usr/local/include JANSSON_LIBS=/usr/local/lib && \
45-
make all && \
46-
make install
47-
48-
# get our JWT module
49-
# change this to get a specific version?
50-
#ARG TESLA_REPO_NAME=ngx-http-auth-jwt-module
51-
# ARG TESLA_REPO_URL_PREFIX=joefitz/
52-
# ARG TESLA_REPO_FILE_PREFIX=joefitz-
53-
# ARG TESLA_REPO_FILENAME=validate-authorization-header
54-
#ARG TESLA_REPO_URL_PREFIX=
55-
#ARG TESLA_REPO_FILE_PREFIX=
56-
#ARG TESLA_REPO_FILENAME=master
57-
#ADD https://github.com/TeslaGov/$TESLA_REPO_NAME/archive/${TESLA_REPO_URL_PREFIX}${TESLA_REPO_FILENAME}.zip .
58-
#RUN unzip ${TESLA_REPO_FILENAME}.zip && \
59-
# rm ${TESLA_REPO_FILENAME}.zip && \
60-
# ln -sf ${TESLA_REPO_NAME}-${TESLA_REPO_FILE_PREFIX}${TESLA_REPO_FILENAME} ${TESLA_REPO_NAME}
39+
unzip v$LIBJWT_VERSION.zip && \
40+
rm v$LIBJWT_VERSION.zip && \
41+
ln -sf libjwt-$LIBJWT_VERSION libjwt && \
42+
cd /root/dl/libjwt && \
43+
autoreconf -i && \
44+
./configure JANSSON_CFLAGS=/usr/local/include JANSSON_LIBS=/usr/local/lib && \
45+
make all && \
46+
make install
6147

6248
ADD . /root/dl/ngx-http-auth-jwt-module
6349

@@ -76,24 +62,73 @@ ADD . /root/dl/ngx-http-auth-jwt-module
7662
# ./configure --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=gnu99' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E'
7763
#
7864
#RUN wget http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz && \
79-
# tar -xzf nginx-$NGINX_VERSION.tar.gz && \
80-
# rm nginx-$NGINX_VERSION.tar.gz && \
81-
# ln -sf nginx-$NGINX_VERSION nginx && \
82-
# cd /root/dl/nginx && \
65+
# tar -xzf nginx-$NGINX_VERSION.tar.gz && \
66+
# rm nginx-$NGINX_VERSION.tar.gz && \
67+
# ln -sf nginx-$NGINX_VERSION nginx && \
68+
# cd /root/dl/nginx && \
8369
# ./configure --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=gnu99' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E' && \
84-
# make modules && \
85-
# cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/.
70+
# make modules && \
71+
# cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/.
8672

8773
# ARG CACHEBUST=1
8874

8975
RUN wget http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz && \
90-
tar -xzf nginx-$NGINX_VERSION.tar.gz && \
91-
rm nginx-$NGINX_VERSION.tar.gz && \
92-
ln -sf nginx-$NGINX_VERSION nginx && \
76+
tar -xzf nginx-$NGINX_VERSION.tar.gz && \
77+
rm nginx-$NGINX_VERSION.tar.gz && \
78+
ln -sf nginx-$NGINX_VERSION nginx && \
9379
cd /root/dl/nginx && \
94-
./configure --add-dynamic-module=../ngx-http-auth-jwt-module --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=gnu99' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E' && \
80+
./configure \
81+
--add-dynamic-module=../ngx-http-auth-jwt-module \
82+
--prefix=/usr/share/nginx \
83+
--sbin-path=/usr/sbin/nginx \
84+
--modules-path=/usr/lib64/nginx/modules \
85+
--conf-path=/etc/nginx/nginx.conf \
86+
--error-log-path=/var/log/nginx/error.log \
87+
--http-log-path=/var/log/nginx/access.log \
88+
--http-client-body-temp-path=/var/lib/nginx/tmp/client_body \
89+
--http-proxy-temp-path=/var/lib/nginx/tmp/proxy \
90+
--http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi \
91+
--http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi \
92+
--http-scgi-temp-path=/var/lib/nginx/tmp/scgi \
93+
--pid-path=/run/nginx.pid \
94+
--lock-path=/run/lock/subsys/nginx \
95+
--user=nginx \
96+
--group=nginx \
97+
--with-file-aio \
98+
--with-ipv6 \
99+
--with-http_ssl_module \
100+
--with-http_v2_module \
101+
--with-http_realip_module \
102+
--with-http_addition_module \
103+
--with-http_xslt_module=dynamic \
104+
--with-http_image_filter_module=dynamic \
105+
--with-http_geoip_module=dynamic \
106+
--with-http_sub_module \
107+
--with-http_dav_module \
108+
--with-http_flv_module \
109+
--with-http_mp4_module \
110+
--with-http_gunzip_module \
111+
--with-http_gzip_static_module \
112+
--with-http_random_index_module \
113+
--with-http_secure_link_module \
114+
--with-http_degradation_module \
115+
--with-http_slice_module \
116+
--with-http_stub_status_module \
117+
--with-http_perl_module=dynamic \
118+
--with-mail=dynamic \
119+
--with-mail_ssl_module \
120+
--with-pcre \
121+
--with-pcre-jit \
122+
--with-stream=dynamic \
123+
--with-stream_ssl_module \
124+
--with-google_perftools_module \
125+
--with-debug \
126+
--with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -std=gnu99' \
127+
--with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E' && \
95128
make modules && \
96-
cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/.
129+
cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /usr/lib64/nginx/modules/. && \
130+
mkdir /build && \
131+
cp /root/dl/nginx/objs/ngx_http_auth_jwt_module.so /build.
97132

98133
# Get nginx ready to run
99134
COPY resources/nginx.conf /etc/nginx/nginx.conf

‎Dockerfile-test

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
FROM alpine:3.7
2+
RUN apk add --no-cache bash curl
3+
COPY test.sh .
4+
CMD ["./test.sh"]

‎Makefile

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
SHELL += -eu
2+
3+
BLUE := \033[0;34m
4+
GREEN := \033[0;32m
5+
RED := \033[0;31m
6+
NC := \033[0m
7+
8+
DOCKER_ORG_NAME = teslagov
9+
DOCKER_IMAGE_NAME = jwt-nginx
10+
11+
.PHONY: all
12+
all:
13+
@$(MAKE) build-nginx
14+
@$(MAKE) build-test-runner
15+
@$(MAKE) start-nginx
16+
@$(MAKE) test
17+
18+
.PHONY: build-nginx
19+
build-nginx:
20+
@echo "${BLUE} Building...${NC}"
21+
@docker image build -t $(DOCKER_ORG_NAME)/$(DOCKER_IMAGE_NAME) . ; \
22+
if [ $$? -ne 0 ] ; \
23+
then echo "${RED} Build failed :(${NC}" ; \
24+
else echo "${GREEN}✓ Successfully built NGINX module ${NC}" ; fi
25+
26+
.PHONY: rebuild-nginx
27+
rebuild-nginx:
28+
@echo "${BLUE} Rebuilding...${NC}"
29+
@docker image build -t $(DOCKER_ORG_NAME)/$(DOCKER_IMAGE_NAME) . --no-cache ; \
30+
if [ $$? -ne 0 ] ; \
31+
then echo "${RED} Build failed :(${NC}" ; \
32+
else echo "${GREEN}✓ Successfully rebuilt NGINX module ${NC}" ; fi
33+
34+
.PHONY: stop-nginx
35+
stop-nginx:
36+
docker stop $(shell docker inspect --format="{{.Id}}" "$(DOCKER_IMAGE_NAME)-cont") ||:
37+
38+
.PHONY: start-nginx
39+
start-nginx:
40+
docker run --rm --name "$(DOCKER_IMAGE_NAME)-cont" -d -p 8000:8000 $(DOCKER_ORG_NAME)/$(DOCKER_IMAGE_NAME)
41+
docker cp $(DOCKER_IMAGE_NAME)-cont:/usr/lib64/nginx/modules/ngx_http_auth_jwt_module.so .
42+
43+
.PHONY: build-test-runner
44+
build-test-runner:
45+
docker image build -f Dockerfile-test -t $(DOCKER_ORG_NAME)/jwt-nginx-test-runner .
46+
47+
.PHONY: frebuild-test-runner
48+
rebuild-test-runner:
49+
docker image build -f Dockerfile-test -t $(DOCKER_ORG_NAME)/jwt-nginx-test-runner . --no-cache
50+
51+
.PHONY: test
52+
test:
53+
docker run --rm $(DOCKER_ORG_NAME)/jwt-nginx-test-runner

‎README.md

Lines changed: 47 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,43 @@
11
# Intro
22
This is an NGINX module to check for a valid JWT and proxy to an upstream server or redirect to a login page.
33

4-
# Build Requirements
4+
## Building and testing
5+
To build the Docker image, start NGINX, and run our Bash test against it, run
6+
```bash
7+
make
8+
```
9+
10+
When you make a change to the module, run `make rebuild-nginx`.
11+
12+
When you make a change to `test.sh`, run `make rebuild-test-runner`.
13+
14+
| Command | Description |
15+
| -------------------------- |:-------------------------------------------:|
16+
| `make build-nginx` | Builds the NGINX image |
17+
| `make rebuild-nginx` | Re-builds the NGINX image |
18+
| `make build-test-runner` | Builds the image that will run `test.sh` |
19+
| `make rebuild-test-runner` | Re-builds the image that will run `test.sh` |
20+
| `make start-nginx` | Starts the NGINX container |
21+
| `make stop-nginx` | Stops the NGINX container |
22+
| `make test` | Runs `test.sh` against the NGINX container |
23+
24+
You can re-run tests as many times as you like while NGINX is up.
25+
When you're done running tests, make sure to stop the NGINX container.
26+
27+
The Dockerfile builds all of the dependencies as well as the module,
28+
downloads a binary version of NGINX, and runs the module as a dynamic module.
29+
30+
Tests get executed in containers. This project is 100% Docker-ized.
31+
32+
## Dependencies
533
This module depends on the [JWT C Library](https://github.com/benmcollins/libjwt)
634

7-
Transitively, that library depends on a JSON Parser called [Jansson](https://github.com/akheron/jansson) as well as the OpenSSL library.
35+
Transitively, that library depends on a JSON Parser called
36+
[Jansson](https://github.com/akheron/jansson) as well as the OpenSSL library.
837

9-
# NGINX Directives
10-
This module requires several new nginx.conf directives, which can be specified in on the `main` `server` or `___location` level.
38+
## NGINX Directives
39+
This module requires several new `nginx.conf` directives,
40+
which can be specified in on the `main` `server` or `___location` level.
1141

1242
```
1343
auth_jwt_key "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF";
@@ -16,7 +46,10 @@ auth_jwt_algorithm HS256; # or RS256
1646
auth_jwt_validate_email on; # or off
1747
```
1848

19-
So, a typical use would be to specify the key on the main level and then only turn on the locations that you want to secure (not the login page). Unauthorized requests are given 401 "Unauthorized" responses, you can redirect them with the nginx's `error_page` directive.
49+
So, a typical use would be to specify the key on the main level and then only
50+
turn on the locations that you want to secure (not the login page). Unauthorized
51+
requests are given 401 "Unauthorized" responses, you can redirect them with the
52+
nginx's `error_page` directive.
2053

2154
```
2255
___location @login_redirect {
@@ -34,13 +67,16 @@ ___location /secure-___location/ {
3467
auth_jwt_validation_type AUTHORIZATION;
3568
auth_jwt_validation_type COOKIE=rampartjwt;
3669
```
37-
By default the authorization header is used to provide a JWT for validation. However, you may use the `auth_jwt_validation_type` configuration to specify the name of a cookie that provides the JWT.
70+
By default the authorization header is used to provide a JWT for validation.
71+
However, you may use the `auth_jwt_validation_type` configuration to specify the name of a cookie that provides the JWT.
3872

3973

4074

41-
The default algorithm is 'HS256', for symmetric key validation. Also supported is 'RS256', for RSA 256-bit public key validation.
75+
The default algorithm is 'HS256', for symmetric key validation.
76+
Also supported is 'RS256', for RSA 256-bit public key validation.
4277

43-
If using "auth_jwt_algorithm RS256;", then the 'auth_jwt_key' field must be set to your public key. That is the public key, rather than a PEM certificate. I.e.:
78+
If using "auth_jwt_algorithm RS256;", then the 'auth_jwt_key' field must be set to your public key.
79+
That is the public key, rather than a PEM certificate. I.e.:
4480

4581
```
4682
auth_jwt_key "-----BEGIN PUBLIC KEY-----
@@ -54,16 +90,10 @@ oQIDAQAB
5490
-----END PUBLIC KEY-----";
5591
```
5692

57-
58-
59-
By default, the module will attempt to validate the email address field of the JWT, then set the x-email header of the session, and will log an error if it isn't found. To disable this behavior, for instance if you are using a different user identifier property such as 'sub', set:
93+
By default, the module will attempt to validate the email address field of the JWT, then set the x-email header of the
94+
session, and will log an error if it isn't found. To disable this behavior, for instance if you are using a different
95+
user identifier property such as 'sub', set:
6096

6197
```
6298
auth_jwt_validate_email off;
6399
```
64-
65-
66-
67-
The Dockerfile builds all of the dependencies as well as the module, downloads a binary version of nginx, and runs the module as a dynamic module.
68-
69-
Have a look at build.sh, which creates the docker image and container and executes some test requests to illustrate that some pages are secured by the module and requre a valid JWT.

‎build.sh

Lines changed: 0 additions & 17 deletions
This file was deleted.

0 commit comments

Comments
 (0)