From 71554ef148fbc4e8f4fe57e7d367fd5de61a2b30 Mon Sep 17 00:00:00 2001 From: Volodymyr Yakusevych Date: Mon, 21 Sep 2026 16:15:33 +0200 Subject: [PATCH] config: forward the auth_check identity headers upstream --- conf/locations/opensearch.loc | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/conf/locations/opensearch.loc b/conf/locations/opensearch.loc index 2009c6b8..0e842e19 100644 --- a/conf/locations/opensearch.loc +++ b/conf/locations/opensearch.loc @@ -1,6 +1,7 @@ # Authorizes Dashboards against openIMIS rights, not merely a valid session. # 200 right held, 403 right missing, 401 no session -> login. + # The 200 also carries X-Auth-User / X-Auth-Rights, copied upstream below. location = /check_opensearch/ { internal; proxy_pass http://${backend}/${REACT_APP_API_URL}/opensearch_reports/auth_check; @@ -13,6 +14,12 @@ location /opensearch/ { auth_request /check_opensearch/; + # Identity from the 200, forwarded below. A backend that does not + # set them leaves these empty, and nginx then omits the header + # entirely rather than sending a blank one - so this gate can land + # before the backend that fills it does. + auth_request_set $auth_user $upstream_http_x_auth_user; + auth_request_set $auth_rights $upstream_http_x_auth_rights; # auth_request can only deny; 403 passes through unchanged. error_page 401 = @openimis_login; @@ -22,6 +29,13 @@ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-Host $server_name; + # The cluster's proxy authenticator reads these two under whatever + # names its roles_header/user_header are set to, and files the codes + # as backend roles. Dashboards relays a header onwards only if it is + # listed in opensearch.requestHeadersAllowlist, which these are not + # yet - so for now they stop there. + proxy_set_header x-proxy-user $auth_user; + proxy_set_header x-proxy-rights $auth_rights; proxy_set_header Authorization "Basic ${OPENSEARCH_BASIC_TOKEN}"; }