Icingaweb2: External Backend HTTP with OpenID Connect ENV: OIDC_CLAIM_upn before REMOTE_USER

[josy1024]

Is your feature request related to a problem? Please describe.

OpenID Connect (AzureAD) Integration als External Backend

Describe the solution you'd like

I want to login via Apache with mod_auth_openidc

Describe alternatives you've considered

Remote_User Looks like this:
REMOTE_USER="[email protected]/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/"
maybe i can use Apache Rewriteing ENV variables?!?
how to fill REMOTE_USER with OIDC_CLAIM_upn?

want to use custom config in authentication.ini variable for user.
eg remoteuserenv='OIDC_CLAIM_upn' (defaults to: 'REMOTE_USER', 'REDIRECT_REMOTE_USER')

Additional context

\icingaweb2\library\Icinga\Authentication\User\ExternalBackend.php
change
public static $remoteUserEnvvars = array('REMOTE_USER', 'REDIRECT_REMOTE_USER');
to:
public static $remoteUserEnvvars = array('OIDC_CLAIM_upn', 'REMOTE_USER', 'REDIRECT_REMOTE_USER');

[nilmerg]

Hi,

I'm not sure what you're trying to achieve. What does the envvar OIDC_CLAIM_upn contain what REMOTE_USER doesn't?

[Al2Klimov]

He'd like to specify a custom env var for his ext authn backend because it provides better values than the classic ones.

[josy1024]

yes i have plenty of ENV variables starting with OIDC_CLAIM_*

REMOTE_USER ist way "too" unreadable and does not function.
REMOTE_USER="[email protected]/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/"

changeing the $remoteUserEnvvars line works for me so far.

examples:
OIDC_CLAIM_* (Prefix)

OIDC_CLAIM_name="family given display
OIDC_CLAIM_unique_name="[email protected]"
OIDC_CLAIM_upn="[email protected]"
OIDC_CLAIM_aio=
OIDC_CLAIM_amr="pwd,wia,mfa"
OIDC_CLAIM_aud=
OIDC_CLAIM_exp=
OIDC_CLAIM_family_name="family"
OIDC_CLAIM_given_name="given"
OIDC_CLAIM_iat=
OIDC_CLAIM_ipaddr="xx.xx.xx.x"
OIDC_CLAIM_iss="https://sts.windows.net/xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx/"
OIDC_CLAIM_nbf=
OIDC_CLAIM_nonce=
OIDC_CLAIM_oid=
OIDC_CLAIM_onprem_sid="S-1-5-21-xxxxx"
OIDC_CLAIM_rh=
OIDC_CLAIM_sub=
OIDC_CLAIM_tid=
OIDC_CLAIM_uti=
OIDC_CLAIM_ver="1.0"
OIDC_access_token=
REMOTE_USER="[email protected]/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/"

[Al2Klimov]

@josy1024 AFAIK modules can provide authn backends, so their run.php runs before authn. You could try to set OIDC_CLAIM_upn=REMOTE_USER in your module's run.php.

[nilmerg]

I don't think this has to be supported in Icinga Web 2. There seems to exist the possibility to choose which claim is put into REMOTE_USER by the module. (https://github.com/zmartzone/mod_auth_openidc/issues/360)

Please try this instead. I'll close here in the meantime. If you do not succeed, please re-open and explain what you've tried that didn't work.

[josy1024]

OIDCRemoteUserClaim upn
this simple apache config line changes the content of REMOTE_USER var to OIDC_CLAIM_upn!
THANKS!

[willfurnell]

@josy1024 I'm looking into using AzureAD for auth for icingaweb2 and came accross this issue. Are you letting any user in, or are you able to filter based on group claims in Icinga like you'd do via LDAP or on premise AD, and if so, how do you do it? Thanks!

[josy1024]

@willfurnell

my icinga installation at one time authenticated against ldap so my users already hav an account and i've added them to authorisation roles and groups on icinga level.

simple variant: allow every user on tenant level.
basically you can add the upn name as users manually to the icinga permissionsgroup, the other users can login and get an "empty" portal. (no Group/Role permissions)
authentication = LDAP/AZURE
authorisation = ICINGA ROLES AND GROUPS

if you need AAD groups:
you could also follow grafana's https://grafana.com/docs/grafana/latest/auth/azuread/ for wrapping group memberships at AZURE APP-Registration Manifest.

(only tried this for grafana, not for icinga)

details...

allowed_groups = 8bab1c86-8fba-33e5-2089-1d1c80ec267d
You’ll need to ensure that you’ve enabled group attributes in your Azure AD Application Registration manifest file (Azure Portal -> Azure Active Directory -> Application Registrations -> Select Application -> Manifest)

"groupMembershipClaims": "ApplicationGroup, SecurityGroup"
The allowed_domains option limits access to the users belonging to the specific domains. Domains should be separated by space or comma.

allowed_domains = mycompany.com mycompany.org

would be nice to hear if you try it!