I am trying to use remote authentication using a reverse proxy that authenticates users and set X-AUTH-USERNAME header.
I am already quite far with the setup, but there seems to be somekind of a ‘deep’ internal issue.
Current setup
Opennebula 6.6
Sunstone (no firedge)
Debian 11
Steps to reproduce:
Setup a Opennebula instance with a reverse proxy in front of the sunstone-gui, that will pass X-AUTH-USERNAME header (the dashes will be converted to lowercase automatically and HTTP will be added in the front).
In /etc/one/sunstone-server.conf set :auth: remote
Create a new user:
oneuser create testuser testuser --driver public
NB! password needs to match the username and it needs to be plain text.
Current results:
Currently the header is set and do_auth method in RemoteCloudAuth.rb returns the username correctly.
But the backend returns a 500.
Expected results:
Backend should auth the user, because everything is done according to docs.
I have also found out from /usr/lib/one/sunstone/sunstone-server.rb , that Authorization header is required even if should be while using remote auth as only x-auth-username header is used.
OK I figured something out. But I need some help with what to do.
The problem was Webauthn and HTTP_AUTHORIZATION header.
I dont want to use Webauthn, but for some reason it tried to get a 2FA code or whatever.
I modified the ruby file /usr/lib/one/sunstone/sunstone-server.rb
begin
require "SunstoneWebAuthn"
webauthn_avail = true
rescue LoadError
webauthn_avail = false
end
require "SunstoneWebAuthn"
I modified the ruby file /etc/one/sunstone-server.conf
# Under webauthn I added conf option
:webauthn_avail: false
Now I could enable/disable it via conf option.
It turns out webauthn was enabled and with the remote driver it wants to get a 2fa token even though I dont have it enabled and it returned 403 to the CloudAuth method as env .
I guess some deeper insepction needs to be done, how to make the remote bypass webauthn or fix the implementation.
The HTTP_AUTHORIZATION header seems to bork something.
This block from 567-589 needs to be DISABLED if auth type is remote. Because the only requirement currently for remote auth passtrhough is REMOTE_USER header or HTTP_X_AUTH_USERNAME.
Also this code is different in CE edition of opennebula 6.6 that comes from bullseye repo.
Currently I got it to work and I get the correct user when logging in.
I copied the code from previous post. The current master branch code for sunstone-server.rb L567 until the end of the block and replaced it with the one that comes from bullseye repo.
In my Reverse-proxy that does the authentication, the headers are set as following:
# Ansible managed
-- Set logging to INFO
local openidc = require("resty.openidc")
openidc.set_logging(nil, { DEBUG = ngx.INFO })
local opts = {
redirect_uri = "REDACTED/redirect_uri",
discovery = "REDACTED/.well-known/openid-configuration",
client_id = "REDACTED",
client_secret = "REDACTED",
introspection_endpoint_auth_method = "client_secret_basic",
redirect_uri_scheme = "https",
logout_path = "/logout",
redirect_after_logout_uri = "REDACTED",
redirect_after_logout_with_id_token_hint = true,
renew_access_token_on_expiry = true,
revoke_tokens_on_logout = true,
session_contents = {id_token=true}
}
-- call introspect for OAuth 2.0 Bearer Access Token validation
local res, err = openidc.authenticate(opts)
if err then
ngx.status = 403
ngx.say(err)
ngx.log(ngx.ERR, err)
ngx.exit(ngx.HTTP_FORBIDDEN)
end
ngx.req.set_header("X-AUTH-USERNAME", res.id_token.preferred_username)
ngx.req.set_header("Authorization", "Basic " .. res.id_token.preferred_username)
ngx.req.set_header("X-USER", res.id_token.sub)
The most important parts are the headers X-AUTH-USERNAME for REMOTE authenticaton method and the Authorization “Basic” for the ruby code that does matching for http_authorization.
I also have webauthn_avail = false as previously mentioned.
not sure where the problem is, but in our tests and in several other users, there is no need to comment or move code to make this work. Leaving this here for reference in case others find it useful.
I had this issue again. Documenting a little better this time
I modified the ruby file /usr/lib/one/sunstone/sunstone-server.rb
Removed:
# removed
begin
require "SunstoneWebAuthn"
webauthn_avail = true
rescue LoadError
webauthn_avail = false
end
# added
require "SunstoneWebAuthn"
#removed
$conf[:webauthn_avail] = webauthn_avail
# we can now set webauthn_avail via conf option, not automagically.
I would like to add a “me too”. While migrating my master node from CentOS 8 stream to AlmaLinux 9, I also migrated from 6.6.0 to 6.6.1.1, and Sunstone refused to start with the above error. Removing the “.downcase” call from index.erb fixed this. Should I create a github issue?