self-hosted/mailcow-dockerized
1
0
Fork 0
mirror of https://github.com/mailcow/mailcow-dockerized.git synced 2024-12-23 02:04:46 +02:00
Code Issues Releases Activity

[Web][Nginx] use nginx to redirect unauthenticated users to /index on SOGo Routes

Browse Source
This commit is contained in:
FreddleSpl0it 2024-12-06 11:52:49 +01:00
parent bbddfc3eab
commit 798ad7dda7
No known key found for this signature in database
GPG Key ID: 00E14E7634F4BEC5
5 changed files with 120 additions and 81 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
data/Dockerfiles/nginx/bootstrap.py
View File

@ -30,7 +30,7 @@ def prepare_template_vars():
'ADDITIONAL_SERVER_NAMES': os.getenv("ADDITIONAL_SERVER_NAMES", "").replace(',', ' '), 'ADDITIONAL_SERVER_NAMES': os.getenv("ADDITIONAL_SERVER_NAMES", "").replace(',', ' '),
'HTTP_PORT': os.getenv("HTTP_PORT", "80"), 'HTTP_PORT': os.getenv("HTTP_PORT", "80"),
'HTTPS_PORT': os.getenv("HTTPS_PORT", "443"), 'HTTPS_PORT': os.getenv("HTTPS_PORT", "443"),
'SOGOHOST': os.getenv("SOGOHOST", "sogo-mailcow"), 'SOGOHOST': os.getenv("SOGOHOST", os.getenv("IPV4_NETWORK", "172.22.1") + ".248"),
'RSPAMDHOST': os.getenv("RSPAMDHOST", "rspamd-mailcow"), 'RSPAMDHOST': os.getenv("RSPAMDHOST", "rspamd-mailcow"),
'PHPFPMHOST': os.getenv("PHPFPMHOST", "php-fpm-mailcow"), 'PHPFPMHOST': os.getenv("PHPFPMHOST", "php-fpm-mailcow"),
} }

6
data/conf/nginx/sites-default.conf.j2
View File

@ -152,6 +152,10 @@ location ^~ /principals {
return 301 /SOGo/dav; return 301 /SOGo/dav;
} }
location @sogo_401redirect {
return 302 /user;
}
location /sogo-auth-verify { location /sogo-auth-verify {
internal; internal;
proxy_set_header X-Original-URI $request_uri; proxy_set_header X-Original-URI $request_uri;
@ -192,6 +196,7 @@ location ^~ /SOGo {
auth_request_set $user $upstream_http_x_user; auth_request_set $user $upstream_http_x_user;
auth_request_set $auth $upstream_http_x_auth; auth_request_set $auth $upstream_http_x_auth;
auth_request_set $auth_type $upstream_http_x_auth_type; auth_request_set $auth_type $upstream_http_x_auth_type;
error_page 401 = @sogo_401redirect;
proxy_set_header x-webobjects-remote-user "$user"; proxy_set_header x-webobjects-remote-user "$user";
proxy_set_header Authorization "$auth"; proxy_set_header Authorization "$auth";
proxy_set_header x-webobjects-auth-type "$auth_type"; proxy_set_header x-webobjects-auth-type "$auth_type";
@ -214,6 +219,7 @@ location ^~ /SOGo {
auth_request_set $user $upstream_http_x_user; auth_request_set $user $upstream_http_x_user;
auth_request_set $auth $upstream_http_x_auth; auth_request_set $auth $upstream_http_x_auth;
auth_request_set $auth_type $upstream_http_x_auth_type; auth_request_set $auth_type $upstream_http_x_auth_type;
error_page 401 = @sogo_401redirect;
proxy_set_header x-webobjects-remote-user "$user"; proxy_set_header x-webobjects-remote-user "$user";
proxy_set_header Authorization "$auth"; proxy_set_header Authorization "$auth";
proxy_set_header x-webobjects-auth-type "$auth_type"; proxy_set_header x-webobjects-auth-type "$auth_type";

5
data/conf/sogo/custom-sogo.js
View File

@ -1,10 +1,5 @@
// redirect to mailcow login form // redirect to mailcow login form
document.addEventListener('DOMContentLoaded', function () { document.addEventListener('DOMContentLoaded', function () {
var loginForm = document.forms.namedItem("loginForm");
if (loginForm) {
window.location.href = '/user';
}
angularReady = false; angularReady = false;
function observe() { function observe() {
angularReady = toolbarExists(); angularReady = toolbarExists();

184
data/web/sogo-auth.php
View File

@ -1,61 +1,88 @@
<?php <?php
ob_start();
function setAuthHeaders($username, $password) {
$auth = "";
$type = "";
if (!empty($username) && !empty($password)) {
$auth = "Basic " . base64_encode("$username:$password");
$type = "Basic";
}
http_response_code(200);
header("X-User: $username");
header("X-Auth: $auth");
header("X-Auth-Type: $type");
}
$session_var_user_allowed = 'sogo-sso-user-allowed';
$session_var_pass = 'sogo-sso-pass';
$ALLOW_ADMIN_EMAIL_LOGIN = (preg_match( $ALLOW_ADMIN_EMAIL_LOGIN = (preg_match(
"/^([yY][eE][sS]|[yY])+$/", "/^([yY][eE][sS]|[yY])+$/",
$_ENV["ALLOW_ADMIN_EMAIL_LOGIN"] $_ENV["ALLOW_ADMIN_EMAIL_LOGIN"]
)); ));
$session_var_user_allowed = 'sogo-sso-user-allowed'; $request = null;
$session_var_pass = 'sogo-sso-pass';
// validate credentials for basic auth requests
if (isset($_SERVER['PHP_AUTH_USER'])) { if (isset($_SERVER['PHP_AUTH_USER'])) {
// load prerequisites only when required $request = "basic-auth";
require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php'; } elseif (isset($_GET['login'])) {
$username = $_SERVER['PHP_AUTH_USER']; $request = "admin-login";
$password = $_SERVER['PHP_AUTH_PW']; } elseif (isset($_SERVER['HTTP_X_ORIGINAL_URI']) &&
$is_eas = false; strcasecmp(substr($_SERVER['HTTP_X_ORIGINAL_URI'], 0, 6), "/SOGo/") === 0) {
$is_dav = false; $request = "auth-request";
$original_uri = isset($_SERVER['HTTP_X_ORIGINAL_URI']) ? $_SERVER['HTTP_X_ORIGINAL_URI'] : '';
if (preg_match('/^(\/SOGo|)\/dav.*/', $original_uri) === 1) {
$is_dav = true;
}
elseif (preg_match('/^(\/SOGo|)\/Microsoft-Server-ActiveSync.*/', $original_uri) === 1) {
$is_eas = true;
}
$login_check = check_login($username, $password, array('dav' => $is_dav, 'eas' => $is_eas));
if ($login_check === 'user') {
header("X-User: $username");
header("X-Auth: Basic ".base64_encode("$username:$password"));
header("X-Auth-Type: Basic");
exit;
} else {
header('HTTP/1.0 401 Unauthorized');
echo 'Invalid login';
exit;
}
} }
// check permissions and redirect for direct GET ?login=xy requests
elseif (isset($_GET['login'])) {
// load prerequisites only when required switch ($request) {
require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php'; case "basic-auth":
// check if dual_login is active require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
$is_dual = (!empty($_SESSION["dual-login"]["username"])) ? true : false;
// check permissions (if dual_login is active, deny sso when acl is not given) $username = $_SERVER['PHP_AUTH_USER'];
$login = html_entity_decode(rawurldecode($_GET["login"])); $password = $_SERVER['PHP_AUTH_PW'];
if (isset($_SESSION['mailcow_cc_role']) && $is_eas = (preg_match('/^(\/SOGo|)\/Microsoft-Server-ActiveSync.*/', $original_uri) === 1);
(($_SESSION['acl']['login_as'] == "1" && $ALLOW_ADMIN_EMAIL_LOGIN !== 0) || ($is_dual === false && $login == $_SESSION['mailcow_cc_username']))) { $is_dav = (preg_match('/^(\/SOGo|)\/dav.*/', $original_uri) === 1);
if (filter_var($login, FILTER_VALIDATE_EMAIL)) { $original_uri = isset($_SERVER['HTTP_X_ORIGINAL_URI']) ? $_SERVER['HTTP_X_ORIGINAL_URI'] : '';
if (user_get_alias_details($login) !== false) {
// register username in session $login_check = check_login($username, $password, array('dav' => $is_dav, 'eas' => $is_eas));
if ($login_check === 'user') {
setAuthHeaders($username, $password);
ob_end_flush();
exit;
}
http_response_code(401);
ob_end_flush();
exit;
break;
case "admin-login":
require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
$is_dual = (!empty($_SESSION["dual-login"]["username"])) ? true : false;
$login = html_entity_decode(rawurldecode($_GET["login"]));
if (isset($_SESSION['mailcow_cc_role'])) {
// Check if login is allowed:
// - User has the "login as" ACL
// - Admin email login is enabled in mailcow.conf
// - Dual login is not active
// - The current role is not "user" or dual login role is admin / domainadmin
$is_login_allowed = (
$_SESSION['acl']['login_as'] == "1" &&
$ALLOW_ADMIN_EMAIL_LOGIN !== 0 &&
($_SESSION['mailcow_cc_role'] != "user" || $_SESSION['dual-login']['role'] == "admin" || $_SESSION['dual-login']['role'] == "domainadmin")
);
if ($is_login_allowed) {
// set dual login session
$_SESSION[$session_var_user_allowed][] = $login; $_SESSION[$session_var_user_allowed][] = $login;
// set dual login if (!$is_dual) {
if ($_SESSION['acl']['login_as'] == "1" && $ALLOW_ADMIN_EMAIL_LOGIN !== 0 && $is_dual === false && $_SESSION['mailcow_cc_role'] != "user"){
$_SESSION["dual-login"]["username"] = $_SESSION['mailcow_cc_username']; $_SESSION["dual-login"]["username"] = $_SESSION['mailcow_cc_username'];
$_SESSION["dual-login"]["role"] = $_SESSION['mailcow_cc_role']; $_SESSION["dual-login"]["role"] = $_SESSION['mailcow_cc_role'];
$_SESSION['mailcow_cc_username'] = $login;
$_SESSION['mailcow_cc_role'] = "user";
} }
$_SESSION['mailcow_cc_username'] = $login;
$_SESSION['mailcow_cc_role'] = "user";
// update sasl logs // update sasl logs
$service = ($app_passwd_data['eas'] === true) ? 'EAS' : 'DAV'; $service = ($app_passwd_data['eas'] === true) ? 'EAS' : 'DAV';
$stmt = $pdo->prepare("REPLACE INTO sasl_log (`service`, `app_password`, `username`, `real_rip`) VALUES ('SSO', 0, :username, :remote_addr)"); $stmt = $pdo->prepare("REPLACE INTO sasl_log (`service`, `app_password`, `username`, `real_rip`) VALUES ('SSO', 0, :username, :remote_addr)");
@ -63,45 +90,56 @@ elseif (isset($_GET['login'])) {
':username' => $login, ':username' => $login,
':remote_addr' => ($_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR']) ':remote_addr' => ($_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR'])
)); ));
// redirect to sogo (sogo will get the correct credentials via nginx auth_request // redirect to sogo (sogo will get the correct credentials via nginx auth_request
http_response_code(200);
header("Location: /SOGo/so/{$login}"); header("Location: /SOGo/so/{$login}");
ob_end_flush();
exit; exit;
} }
} }
}
header("Location: /"); http_response_code(401);
exit; header("Location: /");
} ob_end_flush();
// only check for admin-login on sogo GUI requests exit;
elseif (isset($_SERVER['HTTP_X_ORIGINAL_URI']) && strcasecmp(substr($_SERVER['HTTP_X_ORIGINAL_URI'], 0, 9), "/SOGo/so/") === 0) { break;
// this is an nginx auth_request call, we check for existing sogo-sso session variables case "auth-request":
session_start(); session_start();
// extract email address from "/SOGo/so/user@domain/xy"
$url_parts = explode("/", $_SERVER['HTTP_X_ORIGINAL_URI']); $email_list = array(
$email_list = array(
$url_parts[3], // Requested mailbox
($_SESSION['mailcow_cc_username'] ?? ''), // Current user ($_SESSION['mailcow_cc_username'] ?? ''), // Current user
($_SESSION["dual-login"]["username"] ?? ''), // Dual login user ($_SESSION["dual-login"]["username"] ?? ''), // Dual login user
); );
foreach($email_list as $email) {
// check if this email is in session allowed list $url_parts = explode("/", $_SERVER['HTTP_X_ORIGINAL_URI']);
if ( if (count($url_parts) >= 4) {
array_push($email_list, $url_parts[3]); // Requested user
}
foreach($email_list as $email) {
// check if this email is in session allowed list
if (
!empty($email) && !empty($email) &&
filter_var($email, FILTER_VALIDATE_EMAIL) && filter_var($email, FILTER_VALIDATE_EMAIL) &&
is_array($_SESSION[$session_var_user_allowed]) && is_array($_SESSION[$session_var_user_allowed]) &&
in_array($email, $_SESSION[$session_var_user_allowed]) in_array($email, $_SESSION[$session_var_user_allowed])
) { ) {
$username = $email; $password = file_get_contents("/etc/sogo-sso/sogo-sso.pass");
$password = file_get_contents("/etc/sogo-sso/sogo-sso.pass"); setAuthHeaders($email, $password);
header("X-User: $username"); ob_end_flush();
header("X-Auth: Basic ".base64_encode("$username:$password")); exit;
header("X-Auth-Type: Basic"); }
exit;
} }
}
http_response_code(401);
ob_end_flush();
exit;
break;
default:
setAuthHeaders("", "");
ob_end_flush();
exit;
break;
} }
// if username is empty, SOGo will use the normal login methods / login form
header("X-User: ");
header("X-Auth: ");
header("X-Auth-Type: ");

4
data/web/templates/user/tab-user-auth.twig
View File

@ -20,11 +20,11 @@
{{ lang.user.open_webmail_sso }} <i class="bi bi-arrow-right"></i> {{ lang.user.open_webmail_sso }} <i class="bi bi-arrow-right"></i>
</button> </button>
{% elseif dual_login %} {% elseif dual_login %}
<a target="_blank" href="/sogo-auth.php?login={{ mailcow_cc_username }}" role="button" class="btn btn-primary btn-lg btn-block btn-xs-lg w-100"> <a href="/sogo-auth.php?login={{ mailcow_cc_username }}" role="button" class="btn btn-primary btn-lg btn-block btn-xs-lg w-100">
{{ lang.user.open_webmail_sso }} <i class="bi bi-arrow-right"></i> {{ lang.user.open_webmail_sso }} <i class="bi bi-arrow-right"></i>
</a> </a>
{% else %} {% else %}
<a target="_blank" href="/SOGo/so" role="button" class="btn btn-primary btn-lg btn-block btn-xs-lg w-100"> <a href="/SOGo/so" role="button" class="btn btn-primary btn-lg btn-block btn-xs-lg w-100">
{{ lang.user.open_webmail_sso }} <i class="bi bi-arrow-right"></i> {{ lang.user.open_webmail_sso }} <i class="bi bi-arrow-right"></i>
</a> </a>
{% endif %} {% endif %}