"One Time" authentication (+reverse proxy, pam, radius)

Server NGINX
1

Hello,

I want to create a “reverse” proxy. I want users of the reverse proxy
to authenticate to a radius server. I accomplished this by:

nginx.conf:
server {
listen 443 ssl;
server_name x.y.com;
ssl_certificate /usr/local/etc/ssl/x.y.com.chain.crt;
ssl_certificate_key /usr/local/etc/ssl/x.y.com.key;
location / {
auth_pam “Secure Zone”;
auth_pam_service_name “nginx”;
proxy_pass http://x.y.local;
}
}

pam.d/nginx:
auth required pam_radius.so

This works… except the RADIUS password is actually a “one time
password”. It appears the web client retransmits the
previously-accepted username/password for each proxied page. This
will not work when using OTP (one time passwords).

Can anyone suggest a way to achieve:

  1. reverse proxy

  2. the reverse-proxy authenticates the user (ideally using RADIUS or
    PAM)

  3. the authentication is “cached” and not re-submitted for each page
    visited

I imagine the only way to do this is to perform “authentication” in
the “application layer” using some kind of custom CGI and cookies.

Thank you,

Chris

2

On Sat, Dec 20, 2014 at 3:46 PM, Chris S.
[email protected] wrote:

  1. the reverse-proxy authenticates the user (ideally using RADIUS or PAM)

  2. the authentication is “cached” and not re-submitted for each page visited

A followup:

I accomplished this using apache 2.4 and mod_auth_xradius

Chris