homelab/traefik
1
0
Fork 0
Code Activity

feat: forwardAuth support LogUserHeader

Browse source
This commit is contained in:
GaleHuang 2024-07-29 20:30:05 +08:00 • committed by GitHub
parent 87db3300d3
commit 957a5f5e73
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
7 changed files with 60 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
pkg/config/dynamic/middlewares.go
View file

@ -241,6 +241,9 @@ type ForwardAuth struct {
AuthRequestHeaders []string `json:"authRequestHeaders,omitempty" toml:"authRequestHeaders,omitempty" yaml:"authRequestHeaders,omitempty" export:"true"`
// AddAuthCookiesToResponse defines the list of cookies to copy from the authentication server response to the response.
AddAuthCookiesToResponse []string `json:"addAuthCookiesToResponse,omitempty" toml:"addAuthCookiesToResponse,omitempty" yaml:"addAuthCookiesToResponse,omitempty" export:"true"`
// HeaderField defines a header field to store the authenticated user.
// More info: https://doc.traefik.io/traefik/v3.0/middlewares/http/forwardauth/#headerfield
HeaderField string `json:"headerField,omitempty" toml:"headerField,omitempty" yaml:"headerField,omitempty" export:"true"`
}
// +k8s:deepcopy-gen=true

12
pkg/middlewares/auth/forward.go
View file

@ -13,6 +13,7 @@ import (
"github.com/traefik/traefik/v3/pkg/config/dynamic"
"github.com/traefik/traefik/v3/pkg/middlewares"
"github.com/traefik/traefik/v3/pkg/middlewares/accesslog"
"github.com/traefik/traefik/v3/pkg/middlewares/connectionheader"
"github.com/traefik/traefik/v3/pkg/middlewares/observability"
"github.com/traefik/traefik/v3/pkg/tracing"
@ -51,6 +52,7 @@ type forwardAuth struct {
trustForwardHeader bool
authRequestHeaders []string
addAuthCookiesToResponse map[string]struct{}
headerField string
}
// NewForward creates a forward auth middleware.
@ -71,6 +73,7 @@ func NewForward(ctx context.Context, next http.Handler, config dynamic.ForwardAu
trustForwardHeader: config.TrustForwardHeader,
authRequestHeaders: config.AuthRequestHeaders,
addAuthCookiesToResponse: addAuthCookiesToResponse,
headerField: config.HeaderField,
}
// Ensure our request client does not follow redirects
@ -174,6 +177,15 @@ func (fa *forwardAuth) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
forwardSpan.End()
}
if fa.headerField != "" {
if elems := forwardResponse.Header[http.CanonicalHeaderKey(fa.headerField)]; len(elems) > 0 {
logData := accesslog.GetLogData(req)
if logData != nil {
logData.Core[accesslog.ClientUsername] = elems[0]
}
}
}
// Pass the forward response's body and selected headers if it
// didn't return a response within the range of [200, 300).
if forwardResponse.StatusCode < http.StatusOK || forwardResponse.StatusCode >= http.StatusMultipleChoices {