Does Nginx support LDAP authentication?
nginx doesn't do LDAP: you have to use xsendfile
with a 3rd party script you create to handle LDAP authentication
http://wiki.nginx.org/NginxXSendfile
There is an unofficial LDAP module for nginx : nginx-auth-ldap.
There is a 3rd party module nginx-auth-ldap
that you can use. I have not tried it yet, but I may update my answer later.
using nginx X-accel
The documentation for X-accel
just explains that a page may use a header to have nginx serve a file (rather than PHP
or django
or ruby
or name-your-not-as-efficient-as-nginx-stack-here).
e.g. workflow:
- user visits
/download.php?path=/data/file1.txt
, download.php
returnsWWW-Authenticate
+401 Unauthorized
,- user's browser shows the authentication form and retries,
- user visits
/download.php?path=/data/file1.txt
but nownginx
has the credentials, nginx
may pass$remote_user
and$http_authorization
tofastcgi
script,download.php
does the authentication and decides whether to return403 Forbidden
or set the headerX-Accel-Redirect
header.
setting nginx internal
location
While you can use X-Accel
to serve static assets, the use case here is we want the requests to be authenticated, which is why we use internal
.
location /protected/data/ {
internal;
alias /path/to/data/files/;
}
setting up the download script
Here we go:
location /download.php$ {
fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME /scripts/download.php;
fastcgi_param PHP_AUTH_USER $remote_user;
fastcgi_param PHP_AUTH_PW $http_authorization;
include fastcgi_params;
}
please note: the PHP script uses PHP_AUTH_USER
and PHP_AUTH_PW
, which is captured by nginx
, so in order to use them in the PHP script, we need to give to provide them explicitly.
cooking up an ldap authentication in PHP
For my use case, I installed php-fpm
and php-ldap
on my system.
Here is a decent authenticate function:
function authenticate() {
// I'm watching you.
error_log("authreq: " . $_SERVER['REMOTE_ADDR']);
// mark that we're seeing the login box.
$_SESSION['AUTH'] = 1;
// browser shows login box
Header("WWW-Authenticate: Basic realm=LDAP credentials.");
Header("HTTP/1.0 401 Unauthorized");
die('Unauthorized.');
}
Here is a decent code path for forbidden access:
function forbidden() {
error_log("forbidden: " . $_SERVER['REMOTE_ADDR'] . ', user: ' . $_SERVER['PHP_AUTH_USER']);
// avoid brute force attacks
sleep(rand(0, 3));
// re-display login form
session_destroy();
// don't give too much info (e.g. user does not exist / password is wrong)
Header("HTTP/1.0 403 Forbidden");
// yes I did put the same message.
die('Unauthorized.');
}
And for the meat of the LDAP authentication:
function ldap_auth() {
$ldap_server = 'ldap://ldap.example.com/';
$ldap_domain = 'dc=example,dc=com';
$ldap_userbase = 'ou=Users,' . $ldap_domain;
$ldap_user = 'uid=' . $_SERVER['PHP_AUTH_USER'] . ',' . $ldap_userbase;
$ldap_pass = $_SERVER['PHP_AUTH_PW'];
// connect to ldap server
$ldapconn = ldap_connect($ldap_server)
or die("Could not connect to LDAP server.");
ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3) ;
if ($ldapconn) {
// try to bind/authenticate against ldap
$ldapbind = @ldap_bind($ldapconn, $ldap_user, $ldap_pass) || forbidden();
// "LDAP bind successful...";
error_log("success: " . $_SERVER['REMOTE_ADDR'] . ', user: ' . $_SERVER['PHP_AUTH_USER']);
}
ldap_close($ldapconn);
}
Here you have the main body of the script which uses the request uri.
if (@$_SESSION['AUTH'] != 1) {
authenticate();
}
if (empty($_SERVER['PHP_AUTH_USER'])) {
authenticate();
}
// check credentials on each access
ldap_auth();
// Get requested file name
// you can use the query string or a parameter
// or the full request uri if you like.
$path = $_GET["path"];
error_log("serving: " . $_SERVER['REMOTE_ADDR'] . ', user: ' . $_SERVER['PHP_AUTH_USER'] . ', path: ' . $path);
header("Content-Type: ", true);
header("X-Accel-Redirect: /protected" . $path);
semi-transparent file browsing
I also published this as a gist:
location /protected/data/ {
internal;
autoindex on;
alias /path/to/data/files/;
}
location /data/ {
fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME /scripts/auth.php;
fastcgi_param PHP_AUTH_USER $remote_user;
fastcgi_param PHP_AUTH_PW $http_authorization;
include fastcgi_params;
}
and pretty much the same PHP script except the body:
// Get requested file name
$path = $_SERVER["REQUEST_URI"];
error_log("serving: " . $_SERVER['REMOTE_ADDR'] . ', user: ' . $_SERVER['PHP_AUTH_USER'] . ', path: ' . $path);
header("Content-Type: ", true);
header("X-Accel-Redirect: /protected" . $path);