Reverse Proxy / Session Cookie Validation

[bendercodes]

Great module and thank you for creating this! Was wondering about RP mode (Authorization code) in a setup such as the below:

            User
             | 
IdP -> Reverse Proxy -> Service A

where reverse proxy is proxying to multiple services (either user requests or other services)

Any guidance or pointers on what I'm missing is greatly appreciated as it's my first time working with oidc.

I can see a session cookie is set after successful login.

• How does Service A validate the JWT embedded in the session cookie passed by the proxy? In the past, one strategy I'd use is for the reverse proxy is by signing the JWT with its private key, add it to a cookie and the service would validate against the proxy's public jwk endpoint (RS256). Is it possible for the openidc module to sign the JWT with a specified private key before creating the session cookie (asymmetric since I cannot trust other clients will keep a key safe)?

• How can an endpoint accept access tokens passed via header while maintaining the user redirect pattern? (For example, for hitting a given endpoint using curl or postman after retrieving a token from the IdP) - e.g. for E2E tests or scripts

# Location can either be a user who will be redirected or an agent with a valid token in the header
<Location /serviceA >
  Require valid-user
</Location>

Thank you!

[zandbelt]

a. the proxy is supposed to be a trusted entity in front of Service A which means that the network link between the two should be secured or private
b. see https://github.com/zmartzone/mod_auth_openidc/wiki/Single-Page-Applications#allowing-both-oauth-20-and-openid-connect

[bendercodes]

Thanks Hans for the guidance.

Re: a, wouldn't the service at least need to read the cookie and validate the session is not expired? The legacy setup checks if the cookie is not expired and the cookie is baked by that specific reverse proxy (i.e. cookies from a proxy in the dev environment don't work on the prod environment). In this case, the legacy is also doing SSL termination (e.g.: user <-SSL-> proxy <-> service).

Does the JWT include the REMOTE_USER and is there a way to embed that value into the JWT?

[zandbelt]

the module validates the session on behalf of the service and will block the request if it is no longer valid; no additional check is required assuming the network link between the two is secure