othmane/ohif-viewer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use JWT auth (don't need to hit auth server) to verify for /pacs/ dicom-web

Browse Source
This commit is contained in:
dannyrb 2019-05-08 13:07:20 -04:00
parent 1803188033
commit 7a4fb95e10
1 changed files with 52 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

77
docker/OpenResty-Orthanc-Keycloak/config/nginx.conf
View File

@ -70,47 +70,74 @@ http {
server_tokens off; # Hides server version num server_tokens off; # Hides server version num
# [PROTECTED] Reverse Proxy for `orthanc` # [PROTECTED] Reverse Proxy for `orthanc` admin
# #
location /pacs/ { location /pacs-admin/ {
# Sample configurations:
# https://github.com/zmartzone/lua-resty-openidc#sample-configuration-for-google-signin
# https://gist.github.com/alhafoudh/e87392ee60cf14bb33962847f5a84b24
# https://www.jerney.io/secure-apis-kong-keycloak-1/
access_by_lua_block { access_by_lua_block {
local opts = { local opts = {
redirect_uri = "http://127.0.0.1/callback", redirect_uri = "http://127.0.0.1/callback",
discovery = "http://127.0.0.1/auth/realms/master/.well-known/openid-configuration", discovery = "http://127.0.0.1/auth/realms/master/.well-known/openid-configuration",
client_id = "pacs", client_id = "pacs",
client_secret = "cd2b3a3c-a6c6-4a37-a15d-b2e5598735b6" client_secret = "a726f5b1-5abd-42c9-b7b1-53a1a17d2ad2",
# accept_none_alg = true, ssl_verify = "no",
# ssl_verify = "no", redirect_uri_scheme = "http"
# redirect_uri_scheme = "http",
# logout_path = "/logout",
# redirect_after_logout_uri = "http://localhost:8080/auth/realms/internal/protocol/openid-connect/logout",
# edirect_after_logout_with_id_token_hint = false,
# session_contents = {id_token=true}
} }
# Call introspect for OAuth 2.0 Bearer Access Token validation -- call authenticate for OpenID Connect user authentication
local res, err = require("resty.openidc").authenticate(opts) local res, err = require("resty.openidc").authenticate(opts)
-- check session, but do not redirect to auth if not already logged in
-- local res, err = require("resty.openidc").authenticate(opts, nil, "pass")
if err then if err then
# Helpful for debugging errors: ngx.print(err)
# ngx.print(err) ngx.status = 200
# ngx.log(ngx.ERR, err)
ngx.status = 403
ngx.say(err) ngx.say(err)
ngx.exit(ngx.HTTP_FORBIDDEN) ngx.exit(ngx.HTTP_INTERNAL_SERVER_ERROR)
end end
ngx.req.set_header("X-User", res.id_token.sub) ngx.req.set_header("X-USER", res.id_token.sub)
} }
proxy_set_header X-Real-IP $remote_addr; proxy_http_version 1.1;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
expires 0;
add_header Cache-Control private;
proxy_pass http://orthanc:8042/;
}
# [PROTECTED] Reverse Proxy for `orthanc` APIs (including DICOMWeb)
#
location /pacs/ {
access_by_lua_block {
local opts = {
discovery = "http://127.0.0.1/auth/realms/master/.well-known/openid-configuration",
}
-- call bearer_jwt_verify for OAuth 2.0 JWT validation
local res, err = require("resty.openidc").bearer_jwt_verify(opts)
if err or not res then
ngx.status = 403
ngx.say(err and err or "no access_token provided")
ngx.exit(ngx.HTTP_FORBIDDEN)
end
}
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# proxy_set_header Upgrade $http_upgrade;
# proxy_set_header Connection "upgrade";
expires 0; expires 0;
add_header Cache-Control private; add_header Cache-Control private;