aproxy
is a reverse proxy that includes authentication. It is designed to protect the resources that you want to expose, but only allow some one has you permission to access.
Backend config:
Role List:
Authority config:
cd $GOPATH/src
git clone https://github.com/shunfei/aproxy.git
cd aproxy
sh ./install.sh
Go to releases page download the tar file.
tar xzvf aproxy-v0.1-xxxx-xxx-xx.tar.gz
cd aproxy-v0.1-xxxx-xxx-xx
cp conf/aproxy.toml.example conf/aproxy.toml
Before running, your need set up MongoDB and Redis (MongoDB for config storage, Redis for session storage),
and change the config in conf/aproxy.toml
.
./bin/aproxy -c conf/aproxy.toml
By now there is no users in the database, so let me add a user:
./bin/adduser -c conf/aproxy.toml -action adduser -email yourname@gmail.com -pwd passwordxxx
And the user added above do not have admin permission, so let me set it to admin.
./bin/adduser -c conf/aproxy.toml -action setadmin -email yourname@gmail.com -adminlevel 99
And now you can visit http://127.0.0.1:8098/-_-aproxy-_-/
and config your aproxy.
conf/aproxy.toml
Assuming that the resources required authorized all are the domain of pri.domain.com
's subdomain,
Aproxy nginx server configuration should look like:
server {
listen 80;
server_name pri.domain.com *.pri.domain.com;
location / {
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# pass to aproxy
proxy_pass http://127.0.0.1:8098;
}
}
And then set the WildCard DNS Record *.pri.domain.com
to this nginx server.
Assume that we have the following domain:
- pri.domain.com
- hadoop.pri.domain.com
- druid.pri.domain.com
- aerospike.pri.domain.com
Then we can set the login domain to pri.domain.com
, to ensure that the sub-domain of pri.domain.com
( for example hadoop.pri.domain.com
) can get the session cookies after login.
So we change conf/aproxy.toml
to set the domain:
loginHost = "http://pri.domain.com"
[session]
domain = "pri.domain.com"
Aproxy's authority is base on email, so if your company's account system has email field, can be integration.
To integration with aproxy, just need implement the interface of aproxy/module/auth/UserStorager
.
type UserStorager interface {
Login(email, pwd string) (*User, error)
GetByEmail(email string) (*User, error)
GetAll() ([]User, error)
// add new user.
// user.Pwd field has encrypted.
Insert(user User) error
Update(id string, user User) error
}
If you don't need manage the user in aproxy, you can just implement the Login(email, pwd string) (*User, error)
func.
After implement the aproxy/module/auth/UserStorager
interface, we need change the code in aproxy/bin/main.go
:
//file: aproxy/bin/main.go
delete this line:
//auth.SetUserStorageToMongo()
add this code, to register your own UserStorager to aproxy
auth.SetUserStorage(&yourUserStorage{})