Skipper: Question: Open Id Connect Cookie Domain

[Pindar]

Hi everyone. Thank you for working on and providing skipper!

I'm currently about to setup the pretty new Open Id Connect feature of skipper. The issue is that the hostname is used for setting the cookie-domain, see https://github.com/zalando/skipper/blob/master/filters/auth/oidc.go#L345 . Since my skipper sits behind another proxy this is no valid option in my case.
Is there some configuration option I miss where I can override this or do I need to fork because of that? For example I think about having a flag on startup to overwrite would be great.
What do you think?

[arjunrn]

How would you deduce the original host from the proxied request? If that can be done then I think adding a flag would be worth the effort. If you mean adding a flag with a single host as override that would be not a useful addition because that would restrict the OIDC filter to use used only on a single domain.

[szuecs]

@Pindar you could use the workaround and change the Host header, before the OpenID Connect filter: https://opensource.zalando.com/skipper/reference/filters/#setrequestheader

Example:

• example.org points to proxy
• intern.org points to skipper
• proxy will map requests to example.org to intern.org proxy calls

This should work:

r: Host("intern.org") -> setRequestHeader("Host", "example.org") -> oauthOIDCAnyClaims(...) -> <some backend>

[Pindar]

Thank you for this quick help!

@szuecs I was already thinking about that workaround and tried it on localhost, but the generated cookie was still set to localhost instead of example.com. Not sure what I did wrong.

Path("/auth/provider/callback")
  -> setRequestHeader("Host", "example.org")
  -> oauthOidcAnyClaims(…)
  -> "http://mybackend/";

@arjunrn a flag via X-Origin-Host header or something would be helpful but this would be basically the same as the suggested setRequestHeader workaround. I'd love to get it working but right now it's either not possible or I'm doing something wrong.

[szuecs]

@arjunrn what do you think about, looking up the Hostname, from the Host header, if available in https://github.com/zalando/skipper/blob/master/filters/auth/oidc.go#L350 ?
Like this the workaround with setRequestHeader would work.

[Pindar]

thank you @szuecs! I tried your approach and it works.