auth_request, HTTP 401 and missing header WWW-Authenticate

[Pavel Kolla]

Hello

I've got an issue more challenging than i can come up with an answer for -

I am trying to use nginx to power authentication & validation of some client-
server business web application. Using ngx_postgress for DB connectivity it
seems possible and i have following config functional on logic level: http://
dpaste.com/hold/374783/

The issue I am puzzled with is most likely relevant to auth_request and
presents itself in missing "WWW-Authenticate" header in 401 response returned
to client in order to initiate authentication challenge. Not only auth_request
does not send this header to clientside, it is also not possible to use
add_header directive to manually insert it (also auth_request is ignoring if
statements in same context block next to it, so it does not seem feasible to
trap only the situation when client failed to pass cridentials with
"Authenticate:" header even if add_header would be possible)

This is another illustration of same issue:

$ curl -I http://pkolla:88/t1/
HTTP/1.1 200 OK
Server: nginx/0.8.54
Date: Tue, 01 Feb 2011 14:15:31 GMT
Content-Type: application/octet-stream
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
WWW-Authenticate: pkolla

$ curl -I http://pkolla:88/t2/
HTTP/1.1 401 Unauthorized
Server: nginx/0.8.54
Date: Tue, 01 Feb 2011 14:15:34 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 195
Connection: keep-alive
Keep-Alive: timeout=20



Where config looks like:

location /t1/
{
set $app test1;
add_header "WWW-Authenticate" $host;
echo "test1";
}

location /t2/
{
set $app test2;
add_header "WWW-Authenticate" $host;
return 401;
echo "test2";
}

I can see from source code for auth_request that it should produce "WWW-
Authenticate" headers, however it never does for me... would really appreciate
any suggestions helping me to resolve this.
Thanks in advance.

[Piotr Sikora]

Hi,

Post by Pavel Kolla
I can see from source code for auth_request that it should produce "WWW-
Authenticate" headers, however it never does for me... would really appreciate
any suggestions helping me to resolve this.

You're mistaken. The code you're looking at only passes down this header if
upstream produces it (and ngx_postgres doesn't do that).

Try using ngx_headers_more module [1], I'm pretty sure it can add headers to
error responses.

[1] https://github.com/agentzh/headers-more-nginx-module

Best regards,
Piotr Sikora < piotr.sikora-***@public.gmane.org >

[Maxim Dounin]

Hello!

On Tue, Feb 01, 2011 at 03:09:07PM +0000, Pavel Kolla wrote:

[...]

Post by Pavel Kolla
I can see from source code for auth_request that it should produce "WWW-
Authenticate" headers, however it never does for me... would really appreciate
any suggestions helping me to resolve this.
Thanks in advance.

Auth request module shouldn't produce WWW-Authenticate header by
itself. Instead, you should return WWW-Authenticate header with 401 reply
from your auth backend, auth_request will pass it to client.

This is explicitly documented, see here:

http://mdounin.ru/hg/ngx_http_auth_request_module/file/a29d74804ff1/README#l7

(and this is the only way how it may work, as auth request
module doesn't know anything about authentication mechanism
used)

It may not be trivial to add such header within nginx itself
though, as add_header a) doesn't work on subrequests and b)
doesn't work on 401 replies.

Maxim Dounin

[agentzh]

Post by Maxim Dounin
It may not be trivial to add such header within nginx itself
though, as add_header a) doesn't work on subrequests and b)
doesn't work on 401 replies.

And that's why I created the ngx_headers_more module more than a year ago ;)

Cheers,
-agentzh