-
Notifications
You must be signed in to change notification settings - Fork 0
/
couper.hcl
134 lines (124 loc) · 4.83 KB
/
couper.hcl
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
server "oidc-gate" {
// actual application
endpoint "/**" {
access_control = ["AccessToken"]
proxy {
websockets = true
set_request_headers = {
cookie = request.headers.cookie
authorization = request.headers.authorization
}
backend {
origin = env.BACKEND_ORIGIN
hostname = env.BACKEND_HOSTNAME != "" ? env.BACKEND_HOSTNAME : request.host
connect_timeout = env.BACKEND_CONNECT_TIMEOUT
ttfb_timeout = env.BACKEND_TTFB_TIMEOUT
timeout = env.BACKEND_TIMEOUT
disable_certificate_validation = env.BACKEND_DISABLE_CERTIFICATE_VALIDATION == "true"
}
}
add_response_headers = {
cache-control = "private"
}
}
// OIDC start login
endpoint "/_couper/oidc/start" {
response {
status = 303
headers = {
cache-control = "no-cache,no-store"
location = "${oauth2_authorization_url("oidc")}&state=${url_encode(relative_url(request.query.url[0]))}"
set-cookie = "${env.VERIFIER_COOKIE_NAME}=${oauth2_verifier()};HttpOnly;Secure;Path=/_couper/oidc/callback"
}
}
}
// OIDC login callback
endpoint "/_couper/oidc/callback" {
access_control = ["oidc"]
response {
status = env.ALLOWED_EMAIL_DOMAINS == "" || contains(split(",", env.ALLOWED_EMAIL_DOMAINS), split("@", default(request.context.oidc.id_token_claims.email, "@"))[1]) ? 303 : 403
headers = {
cache-control = "no-cache,no-store"
set-cookie = [
"${env.TOKEN_COOKIE_NAME}=${env.ALLOWED_EMAIL_DOMAINS == "" || contains(split(",", env.ALLOWED_EMAIL_DOMAINS), split("@", default(request.context.oidc.id_token_claims.email, "@"))[1]) ? jwt_sign("AccessToken", {}) : ""};HttpOnly;Secure;Path=/",
"${env.VERIFIER_COOKIE_NAME}=;HttpOnly;Secure;Path=/_couper/oidc/callback;Max-Age=0"
]
content-type = env.ALLOWED_EMAIL_DOMAINS == "" || contains(split(",", env.ALLOWED_EMAIL_DOMAINS), split("@", default(request.context.oidc.id_token_claims.email, "@"))[1]) ? "text/html" : ""
location = env.ALLOWED_EMAIL_DOMAINS == "" || contains(split(",", env.ALLOWED_EMAIL_DOMAINS), split("@", default(request.context.oidc.id_token_claims.email, "@"))[1]) ? relative_url(request.query.state[0]) : ""
}
body = env.ALLOWED_EMAIL_DOMAINS == "" || contains(split(",", env.ALLOWED_EMAIL_DOMAINS), split("@", default(request.context.oidc.id_token_claims.email, "@"))[1]) ? "" : <<-EOF
<!DOCTYPE html><html><head>
<title>access control error</title>
</head><body><h1>access control error</h1>
<p>Authentication powered by <a href="https://github.com/coupergateway/couper-oidc-gateway" target="_blank">Couper OIDC Gateway</a></p>
</body></html>
EOF
}
}
}
definitions {
oidc "oidc" {
configuration_url = env.OIDC_CONFIGURATION_URL
client_id = env.OIDC_CLIENT_ID
client_secret = env.OIDC_CLIENT_SECRET
redirect_uri = "/_couper/oidc/callback"
verifier_value = request.cookies[env.VERIFIER_COOKIE_NAME]
scope = env.ALLOWED_EMAIL_DOMAINS == "" ? "" : "email"
error_handler {
set_response_headers = {
cache-control = "no-cache,no-store"
set-cookie = [
"${env.TOKEN_COOKIE_NAME}=;HttpOnly;Secure;Path=/",
"${env.VERIFIER_COOKIE_NAME}=;HttpOnly;Secure;Path=/_couper/oidc/callback;Max-Age=0"
]
}
}
}
jwt "AccessToken" {
signature_algorithm = "HS256"
key = env.TOKEN_SECRET
signing_ttl = env.TOKEN_TTL
cookie = env.TOKEN_COOKIE_NAME
error_handler {
response {
status = 403
headers = {
cache-control = "no-cache,no-store"
content-type = "text/html"
}
body = <<-EOB
<!DOCTYPE html><html><head>
<script>location.href = "/_couper/oidc/start?url=${url_encode(relative_url(request.url))}"</script>
<meta http-equiv="refresh" content="0;url=/_couper/oidc/start?url=${url_encode(relative_url(request.url))}">
</head><body><h1>Authentication required</h1>
<p><a href="/_couper/oidc/start?url=${url_encode(relative_url(request.url))}">Proceed to login</a></p>
<p>Authentication powered by <a href="https://github.com/coupergateway/couper-oidc-gateway" target="_blank">Couper OIDC Gateway</a></p>
</body></html>
EOB
}
}
}
}
settings {
accept_forwarded_url = ["proto", "host"]
request_id_accept_from_header = "ingress-request-id"
}
defaults {
environment_variables = {
OIDC_CLIENT_ID = ""
OIDC_CLIENT_SECRET = ""
OIDC_CONFIGURATION_URL = ""
TOKEN_SECRET = "asdf"
TOKEN_TTL = "1h"
TOKEN_COOKIE_NAME = "_couper_access_token"
VERIFIER_COOKIE_NAME = "_couper_authvv"
BACKEND_ORIGIN = ""
BACKEND_HOSTNAME = ""
BACKEND_CONNECT_TIMEOUT = "10s"
BACKEND_TTFB_TIMEOUT = "60s"
BACKEND_TIMEOUT = "300s"
BACKEND_DISABLE_CERTIFICATE_VALIDATION = "false"
ALLOWED_EMAIL_DOMAINS = ""
COUPER_SECURE_COOKIES="" # override in test
}
}