Skip to content

Commit 1bb73b0

Browse files
CinnamalsCinnamals
committed
Fix tests failing due to added newlines for proxy_ssl settings
1 parent 34a1746 commit 1bb73b0

23 files changed

+163
-0
lines changed

‎ood-portal-generator/spec/fixtures/ood-portal.conf.all‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,9 @@ Listen 8080
8989
SSLCertificateFile "/etc/pki/tls/certs/www.example.com.crt"
9090
SSLCertificateKeyFile "/etc/pki/tls/private/www.example.com.key"
9191

92+
# Enable SSL Proxying
93+
SSLProxyEngine On
94+
9295
# Lua configuration
9396
#
9497
LuaRoot "/some/other/mod_ood_proxy/lib"
@@ -222,6 +225,100 @@ Listen 8080
222225
LuaHookFixups node_proxy.lua node_proxy_handler
223226
</LocationMatch>
224227

228+
# Reverse proxy SSL traffic to backend webserver through IP sockets:
229+
#
230+
# https://test.server.name:8080/configured-secure-node/HOST/PORT/index.html
231+
# #=> http://HOST:PORT/configured-secure-node/HOST/PORT/index.html
232+
#
233+
<LocationMatch "^/configured-secure-node/(?<host>[\w.-]+\.site\.edu)/(?<port>\d+)">
234+
SetEnv OOD_SECURE_UPSTREAM 1
235+
236+
AuthType openid-connect
237+
Require valid-user
238+
239+
240+
RequestHeader edit* Cookie "mod_auth_openidc_session_\d+=[^;]+;" ""
241+
RequestHeader edit* Cookie "mod_auth_openidc_session=[^;]+;" ""
242+
RequestHeader unset Authorization
243+
RequestHeader unset OIDC_CLAIM_sub
244+
RequestHeader unset OIDC_CLAIM_preferred_username
245+
RequestHeader unset OIDC_CLAIM_given_name
246+
RequestHeader unset OIDC_CLAIM_zoneinfo
247+
RequestHeader unset OIDC_CLAIM_locale
248+
RequestHeader unset OIDC_CLAIM_email
249+
RequestHeader unset OIDC_CLAIM_email_verified
250+
RequestHeader unset OIDC_CLAIM_iss
251+
RequestHeader unset OIDC_CLAIM_nonce
252+
RequestHeader unset OIDC_CLAIM_aud
253+
RequestHeader unset OIDC_CLAIM_acr
254+
RequestHeader unset OIDC_CLAIM_azp
255+
RequestHeader unset OIDC_CLAIM_auth_time
256+
RequestHeader unset OIDC_CLAIM_exp
257+
RequestHeader unset OIDC_CLAIM_iat
258+
RequestHeader unset OIDC_CLAIM_jti
259+
RequestHeader unset OIDC_access_token
260+
RequestHeader unset OIDC_access_token_expires
261+
262+
# ProxyPassReverse implementation
263+
Header edit Location "^[^/]+//[^/]+" ""
264+
265+
# ProxyPassReverseCookieDomain implementation
266+
Header edit* Set-Cookie ";\s*(?i)Domain[^;]*" ""
267+
268+
# ProxyPassReverseCookiePath implementation
269+
Header edit* Set-Cookie ";\s*(?i)Path[^;]*" ""
270+
Header edit Set-Cookie "^([^;]+)" "$1; Path=/configured-secure-node/%{MATCH_HOST}e/%{MATCH_PORT}e"
271+
272+
LuaHookFixups node_proxy.lua node_proxy_handler
273+
</LocationMatch>
274+
275+
# Reverse "relative" proxy SSL traffic to backend webserver through IP sockets:
276+
#
277+
# https://test.server.name:8080/configured-secure-rnode/HOST/PORT/index.html
278+
# #=> http://HOST:PORT/index.html
279+
#
280+
<LocationMatch "^/configured-secure-rnode/(?<host>[\w.-]+\.site\.edu)/(?<port>\d+)(?<uri>/.*|)">
281+
SetEnv OOD_SECURE_UPSTREAM 1
282+
283+
AuthType openid-connect
284+
Require valid-user
285+
286+
287+
RequestHeader edit* Cookie "mod_auth_openidc_session_\d+=[^;]+;" ""
288+
RequestHeader edit* Cookie "mod_auth_openidc_session=[^;]+;" ""
289+
RequestHeader unset Authorization
290+
RequestHeader unset OIDC_CLAIM_sub
291+
RequestHeader unset OIDC_CLAIM_preferred_username
292+
RequestHeader unset OIDC_CLAIM_given_name
293+
RequestHeader unset OIDC_CLAIM_zoneinfo
294+
RequestHeader unset OIDC_CLAIM_locale
295+
RequestHeader unset OIDC_CLAIM_email
296+
RequestHeader unset OIDC_CLAIM_email_verified
297+
RequestHeader unset OIDC_CLAIM_iss
298+
RequestHeader unset OIDC_CLAIM_nonce
299+
RequestHeader unset OIDC_CLAIM_aud
300+
RequestHeader unset OIDC_CLAIM_acr
301+
RequestHeader unset OIDC_CLAIM_azp
302+
RequestHeader unset OIDC_CLAIM_auth_time
303+
RequestHeader unset OIDC_CLAIM_exp
304+
RequestHeader unset OIDC_CLAIM_iat
305+
RequestHeader unset OIDC_CLAIM_jti
306+
RequestHeader unset OIDC_access_token
307+
RequestHeader unset OIDC_access_token_expires
308+
309+
# ProxyPassReverse implementation
310+
Header edit Location "^([^/]+//[^/]+)|(?=/)|^([\./]{1,}(?<!/))" "/configured-secure-rnode/%{MATCH_HOST}e/%{MATCH_PORT}e"
311+
312+
# ProxyPassReverseCookieDomain implementation
313+
Header edit* Set-Cookie ";\s*(?i)Domain[^;]*" ""
314+
315+
# ProxyPassReverseCookiePath implementation
316+
Header edit* Set-Cookie ";\s*(?i)Path[^;]*" ""
317+
Header edit Set-Cookie "^([^;]+)" "$1; Path=/configured-secure-rnode/%{MATCH_HOST}e/%{MATCH_PORT}e"
318+
319+
LuaHookFixups node_proxy.lua node_proxy_handler
320+
</LocationMatch>
321+
225322
# Reverse proxy traffic to backend PUNs through Unix domain sockets:
226323
#
227324
# https://test.server.name:8080/my_pun_apps/dev/app/simulations/1

‎ood-portal-generator/spec/fixtures/ood-portal.conf.dex‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@
6060

6161
Header always set Content-Security-Policy "frame-ancestors http://example.com;"
6262

63+
6364
# OIDC configuration
6465
#
6566
OIDCProviderMetadataURL http://example.com/dex/.well-known/openid-configuration
@@ -118,6 +119,8 @@
118119

119120

120121

122+
123+
121124
# Reverse proxy traffic to backend PUNs through Unix domain sockets:
122125
#
123126
# http://localhost:80/pun/dev/app/simulations/1

‎ood-portal-generator/spec/fixtures/ood-portal.conf.dex-full‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@
8080
SSLCertificateKeyFile /etc/pki/tls/private/example.com.key
8181
SSLCertificateChainFile /etc/pki/tls/certs/example.com-interm.crt
8282

83+
8384
# OIDC configuration
8485
#
8586
OIDCProviderMetadataURL https://example.com/dex/.well-known/openid-configuration
@@ -138,6 +139,8 @@
138139

139140

140141

142+
143+
141144
# Reverse proxy traffic to backend PUNs through Unix domain sockets:
142145
#
143146
# https://example.com:443/pun/dev/app/simulations/1

‎ood-portal-generator/spec/fixtures/ood-portal.conf.dex-ldap‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@
8080
SSLCertificateKeyFile /etc/pki/tls/private/example.com.key
8181
SSLCertificateChainFile /etc/pki/tls/certs/example.com-interm.crt
8282

83+
8384
# OIDC configuration
8485
#
8586
OIDCProviderMetadataURL https://example.com/dex/.well-known/openid-configuration
@@ -138,6 +139,8 @@
138139

139140

140141

142+
143+
141144
# Reverse proxy traffic to backend PUNs through Unix domain sockets:
142145
#
143146
# https://example.com:443/pun/dev/app/simulations/1

‎ood-portal-generator/spec/fixtures/ood-portal.conf.dex-no-proxy‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@
7979
SSLCertificateKeyFile /etc/pki/tls/private/example.com.key
8080
SSLCertificateChainFile /etc/pki/tls/certs/example.com-interm.crt
8181

82+
8283
# OIDC configuration
8384
#
8485
OIDCProviderMetadataURL https://example.com:5554/.well-known/openid-configuration
@@ -131,6 +132,8 @@
131132

132133

133134

135+
136+
134137
# Reverse proxy traffic to backend PUNs through Unix domain sockets:
135138
#
136139
# https://example.com:443/pun/dev/app/simulations/1

‎ood-portal-generator/spec/fixtures/ood-portal.conf.maint_with_ips‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@
6161

6262
Header always set Content-Security-Policy "frame-ancestors http://example.com;"
6363

64+
6465
# Lua configuration
6566
#
6667
LuaRoot "/opt/ood/mod_ood_proxy/lib"
@@ -99,6 +100,8 @@
99100

100101

101102

103+
104+
102105
# Reverse proxy traffic to backend PUNs through Unix domain sockets:
103106
#
104107
# http://localhost:80/pun/dev/app/simulations/1

‎ood-portal-generator/spec/fixtures/ood-portal.conf.nomaint‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@
4848

4949
Header always set Content-Security-Policy "frame-ancestors http://example.com;"
5050

51+
5152
# Lua configuration
5253
#
5354
LuaRoot "/opt/ood/mod_ood_proxy/lib"
@@ -86,6 +87,8 @@
8687

8788

8889

90+
91+
8992
# Reverse proxy traffic to backend PUNs through Unix domain sockets:
9093
#
9194
# http://localhost:80/pun/dev/app/simulations/1

‎ood-portal-generator/spec/fixtures/ood-portal.conf.oidc‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@
6363

6464
Header always set Content-Security-Policy "frame-ancestors http://ondemand.example.com;"
6565

66+
6667
# OIDC configuration
6768
#
6869
OIDCProviderMetadataURL https://idp.example.com/auth/realms/osc/.well-known/openid-configuration
@@ -119,6 +120,8 @@
119120

120121

121122

123+
124+
122125
# Reverse proxy traffic to backend PUNs through Unix domain sockets:
123126
#
124127
# http://ondemand.example.com:80/pun/dev/app/simulations/1

‎ood-portal-generator/spec/fixtures/ood-portal.conf.oidc-ssl‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@
7979
SSLCertificateKeyFile /etc/pki/tls/private/ondemand.example.com.key
8080
SSLCertificateChainFile /etc/pki/tls/certs/ondemand.example.com-interm.crt
8181

82+
8283
# OIDC configuration
8384
#
8485
OIDCProviderMetadataURL https://idp.example.com/auth/realms/osc/.well-known/openid-configuration
@@ -135,6 +136,8 @@
135136

136137

137138

139+
140+
138141
# Reverse proxy traffic to backend PUNs through Unix domain sockets:
139142
#
140143
# https://ondemand.example.com:443/pun/dev/app/simulations/1

‎ood-portal-generator/spec/fixtures/ood-portal.dex-full.proxy.conf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@
8080
SSLCertificateKeyFile /etc/pki/tls/private/example.com.key
8181
SSLCertificateChainFile /etc/pki/tls/certs/example.com-interm.crt
8282

83+
8384
# OIDC configuration
8485
#
8586
OIDCProviderMetadataURL https://example-proxy.com/dex/.well-known/openid-configuration
@@ -138,6 +139,8 @@
138139

139140

140141

142+
143+
141144
# Reverse proxy traffic to backend PUNs through Unix domain sockets:
142145
#
143146
# https://example.com:443/pun/dev/app/simulations/1

0 commit comments

Comments
 (0)