Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Support]: 401 Authorization Required even finished authentication #2626

Open
someonewating opened this issue May 1, 2024 · 1 comment
Open

Comments

@someonewating
Copy link

someonewating commented May 1, 2024

OAuth2-Proxy Version

latest

Provider

azure

Current Behaviour of your Problem

Expectation: The uri '/oauth2/auth' should response 202
Issue: The URI '/oauth2/auth' is responding 401 even I finished authentication and observed cookie stored.

Configuration details or additional information

I can see my browser is storing cookie, but I don't understand why the '/oauth2/auth' always responds 401.

My oauth2 proxy configuration:

email_domains = ["*"]  # Adjust this to restrict to specific email domains, if necessary

http_address="0.0.0.0:4180"
provider = "oidc"
client_id = "**********"
client_secret = "**********"
oidc_issuer_url = "https://login.microsoftonline.com/********/v2.0"
redirect_url = "https://dns.janej.xyz:180/oauth2/callback"
reverse_proxy=true

cookie_secret = "********"  # Generate a random string
cookie_secure = true  # Set to true if using https
cookie_domains = '***'
whitelist_domains="***"

My nginx configuration:

server {
        listen [::]:180 ssl;
        server_name ***;
        ssl_certificate /etc/nginx/ssl/dns/fullchain1.pem;
        ssl_certificate_key /etc/nginx/ssl/dns/privkey1.pem;

        location / {
            auth_request /oauth2/auth;
            # error_page 401 = /oauth2/start;

            # pass information via X-User and X-Email headers to backend,
            # requires running with --set-xauthrequest flag
            auth_request_set $user   $upstream_http_x_auth_request_user;
            auth_request_set $email  $upstream_http_x_auth_request_email;
            proxy_set_header X-User  $user;
            proxy_set_header X-Email $email;

            proxy_buffers 8 16k;
            proxy_buffer_size   16k;  # Adjust the size as needed

            proxy_pass http://192.168.5.254:880/;
        }

        location = /oauth2/auth {
            proxy_pass http://oauth2_proxy_test:4180;
            proxy_set_header Host             $host;
            proxy_set_header X-Real-IP        $remote_addr;
            proxy_set_header X-Forwarded-Uri  $request_uri;
            # nginx auth_request includes headers but not body
            proxy_set_header Content-Length   "";
            proxy_pass_request_body           off;
        }
        location /oauth2/ {
            proxy_pass       http://oauth2_proxy_test:4180;
            proxy_set_header Host                    $host;
            proxy_set_header X-Real-IP               $remote_addr;
            proxy_set_header X-Auth-Request-Redirect $request_uri;
            # or, if you are handling multiple domains:
            # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
        }
        
        location = /oauth2/callback {
            proxy_pass http://192.168.5.254:880/;
            proxy_set_header Host $host;
            proxy_pass_request_body off;
            proxy_set_header Content-Length "";
        }

Thank you so much for any kind of help!

Steps To Reproduce

Access https://[domain name]/oauth2/auth, received 401 Authorization Required.

@someonewating
Copy link
Author

Also if I access oauth2/sign_out, the result is Unauthorized as well.
But from the developer console, I can see the cookie _oauth2_proxy_csrf with content inside it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant