microsoft / SPID-and-Digital-Identity-Enabler

This repo contains the SPIDProxy code and several ADFS/Azure B2C related scripts and assets. SPIDProxy allows to communicate with SPID, CIE and eIDAS. The repo also contains a web app enabling CNS authentication through ADFS and AAD B2C.
MIT License
27 stars 12 forks source link

Add support to reverse proxies #2

Closed fume closed 2 years ago

fume commented 2 years ago

We actually generate the AssertionConsumerServiceUrl using the HTTP Request host. This won't work in scenarios where reverse proxies are used, since the request host will be different from the "public" host that users can reach.

We basically need to change the following line https://github.com/microsoft/SPID-and-Digital-Identity-Enabler/blob/63ef10fe45b82566d90d4fc0101f0a254603be5d/WebApps/Proxy/Microsoft.SPID.Proxy/Services/Implementations/SAMLService.cs#L32-L36

We could use the x-forwarded-host header (https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer?view=aspnetcore-6.0) or, eventually, just put the right host in config.

fume commented 2 years ago

I just noticed that the ForwardedHeadersMiddleware can be enabled as simply as setting the env variable ASPNETCORE_FORWARDEDHEADERS_ENABLED to true (ForwardedHeaderStartupFilter). Doing so, the default values for the ForwardedHeadersOptions are going to be used except for the overridden options in the (ForwardedHeadersOptionsSetup). Basically, only the x-forwarded-proto and x-forwarded-for headers are going to be used, which is not enough for us since we also need x-forwarded-host.

I see two options here:

fume commented 2 years ago

I have an implementation proposal on the support-reverse-proxies branch.

In Program.cs https://github.com/microsoft/SPID-and-Digital-Identity-Enabler/blob/16796aab0017613f310c20af311a17506d336d3b/WebApps/Proxy/Microsoft.SPID.Proxy/Program.cs#L13-L16 Where ConfigureForwardedHeadersOptions() is https://github.com/microsoft/SPID-and-Digital-Identity-Enabler/blob/16796aab0017613f310c20af311a17506d336d3b/WebApps/Proxy/Microsoft.SPID.Proxy/Program.cs#L78-L111

Then in the appsettings we can define the ForwardedHeaders section and set all the required options. The ForwardedHeaders are defaulted to All (Which means X-Forwarded-For | X-Forwarded-Proto | X-Forwarded-Host) https://github.com/microsoft/SPID-and-Digital-Identity-Enabler/blob/16796aab0017613f310c20af311a17506d336d3b/WebApps/Proxy/Microsoft.SPID.Proxy/appsettings.json#L161-L163

@MarcoZama , @tommasodotNET , @PaoloCastAway , any thoughts?