Feature, , 1 min read
Signing in through an authenticating edge proxy
From 7.13-beta.10, Stroom can sit behind an AWS ALB with Cognito or NGINX with oauth2-proxy, and let the proxy handle sign-in.
Many organisations already put an authenticating proxy in front of their internal applications. The proxy talks to the identity provider, signs the user in, and passes a verified identity through to the application behind it. Until now Stroom insisted on running its own OpenID Connect flow even when a proxy had already done that work. As of 7.13-beta.10 it no longer has to (#5697).
What changed
A new configuration block, security.authentication.edgeAuthentication, tells Stroom that the edge proxy is the OIDC relying party. With it enabled:
- Stroom's own OIDC flow is suppressed, and the UI recognises a user the proxy has already authenticated.
- Logout is edge-aware when the proxy is the relying party.
Two set-ups are documented step by step: an AWS Application Load Balancer with Cognito, and NGINX with oauth2-proxy.
A security change to know about
Once the proxy injects the credential, the browser no longer holds anything Stroom can tie to a session cookie. The CSRF checks were therefore widened to cover requests whose credential came from the proxy. Cross-site browser requests carrying a request token are rejected unless they send X-CSRF: 1.
In practice, in-browser clients that attach their own bearer token must now send X-CSRF: 1 on state-changing requests when edgeAuthentication.enabled is set. Automation that does not run in a browser, and traffic between nodes, are unaffected.
A small extra for Google
The same release adds security.authentication.openId.authenticationRequestExtraParams, for appending provider-specific parameters to the authentication request. The motivating case is Google, which issues no refresh token unless you ask for access_type: offline. Without one, a session cannot outlive its first access token.
Status
7.13 is a beta line, so treat this as a beta feature. The set-up guides are in the Stroom install guide under OpenID edge proxies.
How it works, in detail: Docs: Users, Groups and Permissions
Want this running on your own data? The engineers who built it can help.