nginxinc / nginx-openid-connect

Reference implementation of OpenID Connect integration for NGINX Plus
https://www.nginx.com/products/nginx/
Other
196 stars 92 forks source link

Added callback URLs for code exchange and logout #83

Open pankajupadhyay29 opened 1 year ago

pankajupadhyay29 commented 1 year ago

Problem: Could not provide dynamic code exchange URL, custom session start after code exchanges and session end during logout. Background:

To use NGINX as an API Gateway for various products we need to add context information with a callback URL for the product which needs a dynamic URL for code exchange based on the product settings Similarly, we need a callback for products

Description:

route443 commented 12 months ago

Hello @pankajupadhyay29,

  1. Regarding the after_codexch_redir variable, we already have PR #74, which introduces a new oidc_landing_page variable:

    map $host $oidc_landing_page {
    # Where to send browser after successful login. If empty, redirects User 
    # Agent to $request_uri.
    default "";
    #www.example.com $redirect_base;
    }

    This name better reflects the meaning of this variable.

  2. Regarding the redir_location variable, it appears that your use case is quite specific. While I understand the flexibility you are aiming for, altering the default configuration for all users may not be the most appropriate course of action. + It's worth noting that you already have the capability to customize redir_location from "/_codexch" to any URL you desire. Therefore, I'm not sure if it's necessary to make this change in the default configuration for all users.

  3. Regarding the initial_logout_redir variable, your proposed change seems redundant and could introduce unnecessary confusion. The existing oidc_logout_redirect serves a similar purpose, and if initial_logout_redir is defined, oidc_logout_redirect would essentially be ignored. This raises the question: what prevents you from using oidc_logout_redirect in place of initial_logout_redir? Furthermore, after redirecting the user via oidc_logout_redirect, you can easily send them to a custom location where you can implement any additional logic, such as a njs-based handler, if the standard functionality lacking.