在 NGINX 中禁止应用程序的 LDAP 身份验证答案

【问题标题】：suppress the LDAP authentification for an application in NGINX在 NGINX 中禁止应用程序的 LDAP 身份验证
【发布时间】：2020-11-17 21:28:25
【问题描述】：

我应用 NginX 来验证应用程序，例如使用 LDAP (described here) 的 myapp1 和 myapp2。我的配置文件如下所示：

ldap_server myapp1{
    url ldaps://....;
    binddn "CN=user,OU=t accounts,DC=dom,DC=uk";
    binddn_passwd ...;
    group_attribute member;
    group_attribute_is_dn on;
    max_down_retries_count 5;
    satisfy any;
    Require valid-user;
}
ldap_server myapp2{
    url ldaps://....;
    binddn "CN=user,OU=t accounts,DC=dom,DC=uk";
    binddn_passwd ...;
    group_attribute member;
    group_attribute_is_dn on;
    max_down_retries_count 5;
    satisfy any;
    Require valid-user;
}

效果很好。现在，我想抑制 myapp2 的身份验证，换句话说，如果用户在浏览器中为 myapp2 调用url 地址，则不会要求用户身份验证并将直接到达网址，但仅适用于 myapp2。有可能吗？

更新：我发现，nginx.conf还有另一部分，即代理部分：

    location /myapp1/ {
      auth_ldap_servers myapp1;
      proxy_pass http://127.0.0.1:3838/myapp1/;
      proxy_http_version 1.1;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
    }

    location /myapp2/ {
      auth_ldap_servers myapp2;
      proxy_pass http://127.0.0.1:3838/myapp2/;
      proxy_http_version 1.1;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
    }

可能我必须更改location 部分中的某些内容？

【问题讨论】：

尝试从location /myapp2/中删除auth_ldap_servers myapp2;。

标签： nginx ldap nginx-reverse-proxy nginx-config

【解决方案1】：

我终于找到了解决办法。

问题是，tere 是 nginx.conf 开头的附加部分。这些应该集成在第二部分location /myapp/ { ....}。因此来自：

   auth_ldap "please log in with windows login data";
   auth_ldap_servers myapp1;
   auth_ldap_servers myapp2;
#comment:
# the special part for every app
    location /myapp1/ {
      auth_ldap_servers myapp1;
      proxy_pass http://127.0.0.1:3838/myapp1/;
      proxy_http_version 1.1;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
    }

    location /myapp2/ {
      auth_ldap_servers myapp2;
      proxy_pass http://127.0.0.1:3838/myapp2/;
      proxy_http_version 1.1;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
    }

到

    location /myapp1/ {
      auth_ldap "please log in with windows login data";
      auth_ldap_servers myapp1;
      proxy_pass http://127.0.0.1:3838/myapp1/;
      proxy_http_version 1.1;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
    }

    location /myapp2/ {
      auth_ldap "please log in with windows login data";
      auth_ldap_servers myapp2;
      proxy_pass http://127.0.0.1:3838/myapp2/;
      proxy_http_version 1.1;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
    }

【讨论】：