12

I am trying to setup nginx as a reverse rpoxy server in front off several IIS web servers who are authenticating using Basic authentication.

(note - this is not the same as nginx providing the auth using a password file - it should just be marshelling everythnig between the browser/server)

Its working kind off - but getting repeatedly prompted for auth by every single resource (image/css etc) on a page.

upstream my_iis_server {
      server 192.168.1.10;
}

server {
    listen       1.1.1.1:80;
    server_name  www.example.com;  

    ## send request back to my iis server ##
    location / {
     proxy_pass  http://my_iis_server;
     proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
     proxy_http_version      1.1;
     proxy_set_header        Connection "";
     proxy_pass_header       Authorization;     
     proxy_redirect off;
     proxy_buffering off;
     proxy_set_header        Host            $host;
     proxy_set_header        X-Real-IP       $remote_addr;
     proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
   }
}

3 Answers 3

8

This exact situation took me forever to figure out, but OSS is like that I guess. This post is a year old so maybe the original poster figured it out, or gave up?

Anyway, the problem for me at least was caused by a few things:

  1. IIS expects the realm string to be the same as what it sent to Nginx, but if your Nginx server_name is listening on a different address than the upstream then the server side WWW-Authenticate is not going to be what IIS was expecting and ignore it.
  2. The builtin header module doesn't clear the other WWW-Authenticate headers, particularly the problematic WWW-Authenticate: Negotiate. Using the headers-more module clears the old headers, and adds whatever you tell it to.

After this, I was able to finally push Sharepoint 2010 through Nginx.

Thanks stackoverflow.

server {
    listen 80;
    server_name your.site.com;

    location / {
            proxy_http_version      1.1;
            proxy_pass_request_headers on;
            proxy_set_header        Host            $host;
            proxy_set_header        X-Real-IP       $remote_addr;
            proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;

            #proxy_pass_header      Authorization; //This didnt work for me
            more_set_input_headers  'Authorization: $http_authorization';

            proxy_set_header  Accept-Encoding  "";

            proxy_pass              https://sharepoint/;
            proxy_redirect          default;
            #This is what worked for me, but you need the headers-more mod
            more_set_headers        -s 401 'WWW-Authenticate: Basic realm="intranet.example.com"';
    }
}
7
  • 1
    The original poster did indeed give up and instead tried Microsofts IIS Application Request Routing (ARR) which did handle Basic and NTML auth without any problems, but caused some very strange problems with some of SharePoint 2013's Minimal Download Strategy (MDS) that I never got to the bottom off.
    – Ryan
    Commented Nov 1, 2013 at 12:19
  • Maybe this could be helpful: serverfault.com/questions/230749/…
    – czerasz
    Commented Oct 10, 2014 at 10:26
  • @matt Hi I need to pass sth like username:password instead of realm="etc" will this still work?
    – Jonathan
    Commented Aug 22, 2016 at 22:14
  • more_set_input_headers more_set_headers what are those? Commented Mar 17, 2018 at 18:31
  • @deathangel908 they are directives from headers-more module (github.com/openresty/headers-more-nginx-module) which can be compiled with nginx to add more functionalities.
    – joaumg
    Commented Dec 13, 2019 at 13:49
0

I had these same symptoms with nginx/1.10.3. I have a service secured under basic authentication, and nginx as a reverse proxy between the clients and the server. The requirement was that nginx would passthrough the authorization.

First request to the server did pass through the Authorization header. Second request simply blocked this header, which meant the client was only able to make one request per session.

This was somehow related to cookies. If I cleared the browser cookies, then the cycle repeated. The client was able to authenticate but just for the first request. Closing the browser had the same effect.

The solution for me was to change the upstream server from https to http, using:

proxy_pass http://$upstream;

instead of:

proxy_pass https://$upstream;
0

I think this can be done much simpler than in the accepted answer.

    location /anki/ {
        proxy_pass       http://192.168.1.10:8140/;
        # some extra header which are not relevant for the solution but often required by the backend
        proxy_set_header  Host             $host;
        proxy_set_header  X-Real-IP        $remote_addr;
        proxy_set_header  X-Forwarded-For  $proxy_add_x_forwarded_for;

        # forward authentication:
        auth_basic off;
        proxy_set_header Authorization  $http_authorization;
        proxy_pass_request_headers      on;
    }

Summary:

  • Authentication is done by the backend
  • The frontend (nginx) doesn't know anything about the users nor passwords
  • Relevant are only the last 2 or 3 lines

The auth_basic off is not always necessary in my eyes, but if you have your root path protected using auth_basic* commands, you need to switch it off for the suburl.

For the OP situation, this could be enough:

    location / {
        proxy_pass              https://sharepoint/;
        proxy_set_header        Host            $host;
        proxy_set_header        X-Real-IP       $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Authorization  $http_authorization;
        proxy_pass_request_headers      on;
    }

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.