Skip to content

OIDC behind https proxy #4017

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Conversation

maciejmaciejko-gid
Copy link
Contributor

@maciejmaciejko-gid maciejmaciejko-gid commented Feb 25, 2025

What changes were proposed in this pull request?

This feature allows using Hue with OIDC, deployed behind https proxy (e.g. on kubernetes, exposed by HttpRoute - which provides SSL). Redirect URL, passed during OIDC autentication has to match with the one registered in application. The problem is that Hue builds dynamically redirect url, using request's protocol (http instead of https), because it doesn't know about proxy. Note that OIDC backend doesn't take into account reverse proxy configuration.

Using OIDC_AUTH_REQUEST_EXTRA_PARAMS it's possible to override token_paylod with correct URL. The same mechanism is used in mozilla_django_oidc, but the parameter wasn't passed from Hue settings, which is fixed by this PR.

Configuration may look like:
'{"redirect_uri" : "https://host/oidc/callback/"}'

How was this patch tested?

  • Simple map update, verified e2e with whole OIDC setup.

@Harshg999
Copy link
Collaborator

Thanks @maciejmaciejko-gid for contributing!
@ranade1 @wing2fly @amitsrivastava - Can someone take a look?

Copy link

⚠️ No unit test files modified. Please ensure that changes are properly tested. ⚠️

Copy link

github-actions bot commented Mar 17, 2025

Copy link

github-actions bot commented Mar 27, 2025

⚠️ No test files modified. Please ensure that changes are properly tested. ⚠️

@maciejmaciejko-gid
Copy link
Contributor Author

@ranade1 @wing2fly @amitsrivastava Could you take a look?

Copy link
Collaborator

@wing2fly wing2fly left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks

Copy link
Collaborator

@amitsrivastava amitsrivastava left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Thanks @maciejmaciejko-gid for your contribution.

@Harshg999 Harshg999 enabled auto-merge (squash) April 4, 2025 06:04
@Harshg999 Harshg999 merged commit 73252e5 into cloudera:master Apr 4, 2025
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants