0

I'm looking to lock down my internet exposed web services to only authorized people using some sort of SSO/Captive Portal/Basic auth.

From a client perspective, I want them to be able to browse to any of my sub domains and be redirected to a single authentication page where they can enter username and password, then be redirected back to the actual web service. The idea is to just verify its someone that should have access before the traffic gets to the backend server.

Requirements:

  • Self-hosted (no cloud solutions)
  • Requires no client side software
  • Supports NGINX Reverse proxy with TLS Passthrough topology (multiple sub-domains, same TLD, routed based on SNI)
  • After Authentication, clients browse directly to the site (meaning the TLS session is fully uninterrupted from the client browser to the backend server post auth)
  • Ability to exempt IPs/Networks (internal network traffic) from auth process.

I am having a hard time finding solutions that fit this description online, especially since I am using TLS passthrough on the proxy, which complicates things.

Can anyone help me find something that fits my requirements?

6
  • Why not simple basic authentication? It's build-in, every web server supports it and pretty much universally understood by browsers. Not the nicest UI, but good enough from a security POV. And while traffic reaches the target server, it still doesn't runs the web application itself, so the extra load should be minimal.
    – Alejandro
    Nov 23 '21 at 20:08
  • The big problem I have is that with TLS passthrough, I can't filter on source IP with basic auth. Cant get rid of TLS passthrough (other domains are SNI routing through this proxy), and I don't want to have auth for internal network users.
    – ehammer
    Nov 23 '21 at 20:45
  • How long is the list of authorized users? Nov 24 '21 at 12:13
  • Around 10 right now. I'm not attached to a separate credential for each user. Originally I just planned to use one set of user+pass with basic auth as a blanket verification (not anymore since basic auth doesn't work for this) I think what I am looking for is more like a captcha with a bit more security (since any real person could complete the captcha).
    – ehammer
    Nov 24 '21 at 13:19
  • Set user side certificates (and appropriate config in proxy/web site). But this will involve side channel for provide certificates. And it is not good solution if you have more than 15-20 users.... Nov 24 '21 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.