-
-
Notifications
You must be signed in to change notification settings - Fork 746
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Allow st2web proxy auth mode to work in HA environments #6041
Conversation
6089322
to
9b9d37b
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Great stuff, thanks a lot @floatingstatic for the contribution!
Are there any Unit Tests that you could add to support this PR?
@armab good call. Added a unit test to cover this. Looks like there is already a test case that would cover lack of header and no remote user env var. Let me know if you think we need any other cases. |
Theres one test that failed unrelated to my change: https://github.com/StackStorm/st2/actions/runs/6604759729/job/17939241233?pr=6041 Perhaps something flaky with that particular test? It seems it passed everywhere else. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM. Thanks for the fix!
It appears that proxy auth mode only works with
REMOTE_USER
set as a cgi environment variable. This does not appear to work for those of us using the HA helm chart. I saw #5766 but it does not appear this has been fixed or addressed yet.I had previously worked around this by modifying st2auth with a custom standalone auth module that always returns true without inspecting the username but it seems it would be beneficial to the wider community to get this working with the built-in proxy mode in st2auth. My use case is to continue to use Google IAP (identity aware proxy) in GKE which can forward remote user info to st2web (nginx) without having to roll patched version of st2auth and st2web to support this.