-
Notifications
You must be signed in to change notification settings - Fork 394
OIDC behind https proxy #4017
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
OIDC behind https proxy #4017
Conversation
Thanks @maciejmaciejko-gid for contributing! |
|
|
@ranade1 @wing2fly @amitsrivastava Could you take a look? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM.
Thanks @maciejmaciejko-gid for your contribution.
What changes were proposed in this pull request?
This feature allows using Hue with OIDC, deployed behind https proxy (e.g. on kubernetes, exposed by HttpRoute - which provides SSL). Redirect URL, passed during OIDC autentication has to match with the one registered in application. The problem is that Hue builds dynamically redirect url, using request's protocol (http instead of https), because it doesn't know about proxy. Note that OIDC backend doesn't take into account reverse proxy configuration.
Using OIDC_AUTH_REQUEST_EXTRA_PARAMS it's possible to override token_paylod with correct URL. The same mechanism is used in mozilla_django_oidc, but the parameter wasn't passed from Hue settings, which is fixed by this PR.
Configuration may look like:
'{"redirect_uri" : "https://host/oidc/callback/"}'
How was this patch tested?