I would like to authenticate HTTP and HTTPS clients using an external
script
through Nginx.
All the authentication scripts are already made and I will modify them
in any
way necessary to work with Nginx. The scripts query completely custom
database
servers and XML based authenticators so an external script is needed to
work,
for example, with the current implementation of Apache.
Basically, I am looking for similar functionality of mod_authnz_external
from
Apache in Nginx. Google Code Archive - Long-term storage for Google Code Project Hosting.
For example, when the client connects to a certain “location” specified
in the
nginx.conf, the Nginx server should ask them for their username and
password
using the standard pop-up box; just like when auth_basic is used. But,
instead
of checking a local file Nginx supplies the username and password to an
external script. The external script will authenticate the user/pass
pair and
give a proper response back to Nginx to allow or deny. As long as the
HTTP
client is connected Nginx will know they are authenticated just like
auth_basic.
At this point I was hoping for some opinions if I am on the right track
to get
Nginx do what I need.
From what I could find, the “auth_http” directive looks like a
possibility,
but I wonder if it only works with POP3 and IMAP clients. Nginx will
connect
to a remote http server with the username and pass in the headers. I
take those
headers into my script and return with a OK or Invalid header response.
I can
write a small HTTP deamon responder to be my authenticator if
“auth_http” is
the right method.
Any other suggestions, ideas or opinions are very welcome. If anyone
needs more
information or if a point was unclear, I would be happy to respond to
the list
with more information. When I get external authentication working with
Nginx I
would be happy to share the complete setup with the list.