mirror of
https://github.com/mailcow/mailcow-dockerized.git
synced 2024-12-21 01:49:22 +02:00
[Web][Nginx] use nginx to redirect unauthenticated users to /index on SOGo Routes
This commit is contained in:
parent
bbddfc3eab
commit
798ad7dda7
@ -30,7 +30,7 @@ def prepare_template_vars():
|
||||
'ADDITIONAL_SERVER_NAMES': os.getenv("ADDITIONAL_SERVER_NAMES", "").replace(',', ' '),
|
||||
'HTTP_PORT': os.getenv("HTTP_PORT", "80"),
|
||||
'HTTPS_PORT': os.getenv("HTTPS_PORT", "443"),
|
||||
'SOGOHOST': os.getenv("SOGOHOST", "sogo-mailcow"),
|
||||
'SOGOHOST': os.getenv("SOGOHOST", os.getenv("IPV4_NETWORK", "172.22.1") + ".248"),
|
||||
'RSPAMDHOST': os.getenv("RSPAMDHOST", "rspamd-mailcow"),
|
||||
'PHPFPMHOST': os.getenv("PHPFPMHOST", "php-fpm-mailcow"),
|
||||
}
|
||||
|
@ -152,6 +152,10 @@ location ^~ /principals {
|
||||
return 301 /SOGo/dav;
|
||||
}
|
||||
|
||||
location @sogo_401redirect {
|
||||
return 302 /user;
|
||||
}
|
||||
|
||||
location /sogo-auth-verify {
|
||||
internal;
|
||||
proxy_set_header X-Original-URI $request_uri;
|
||||
@ -192,6 +196,7 @@ location ^~ /SOGo {
|
||||
auth_request_set $user $upstream_http_x_user;
|
||||
auth_request_set $auth $upstream_http_x_auth;
|
||||
auth_request_set $auth_type $upstream_http_x_auth_type;
|
||||
error_page 401 = @sogo_401redirect;
|
||||
proxy_set_header x-webobjects-remote-user "$user";
|
||||
proxy_set_header Authorization "$auth";
|
||||
proxy_set_header x-webobjects-auth-type "$auth_type";
|
||||
@ -214,6 +219,7 @@ location ^~ /SOGo {
|
||||
auth_request_set $user $upstream_http_x_user;
|
||||
auth_request_set $auth $upstream_http_x_auth;
|
||||
auth_request_set $auth_type $upstream_http_x_auth_type;
|
||||
error_page 401 = @sogo_401redirect;
|
||||
proxy_set_header x-webobjects-remote-user "$user";
|
||||
proxy_set_header Authorization "$auth";
|
||||
proxy_set_header x-webobjects-auth-type "$auth_type";
|
||||
|
@ -1,10 +1,5 @@
|
||||
// redirect to mailcow login form
|
||||
document.addEventListener('DOMContentLoaded', function () {
|
||||
var loginForm = document.forms.namedItem("loginForm");
|
||||
if (loginForm) {
|
||||
window.location.href = '/user';
|
||||
}
|
||||
|
||||
angularReady = false;
|
||||
function observe() {
|
||||
angularReady = toolbarExists();
|
||||
|
@ -1,61 +1,88 @@
|
||||
<?php
|
||||
|
||||
ob_start();
|
||||
|
||||
function setAuthHeaders($username, $password) {
|
||||
$auth = "";
|
||||
$type = "";
|
||||
if (!empty($username) && !empty($password)) {
|
||||
$auth = "Basic " . base64_encode("$username:$password");
|
||||
$type = "Basic";
|
||||
}
|
||||
|
||||
http_response_code(200);
|
||||
header("X-User: $username");
|
||||
header("X-Auth: $auth");
|
||||
header("X-Auth-Type: $type");
|
||||
}
|
||||
|
||||
$session_var_user_allowed = 'sogo-sso-user-allowed';
|
||||
$session_var_pass = 'sogo-sso-pass';
|
||||
|
||||
$ALLOW_ADMIN_EMAIL_LOGIN = (preg_match(
|
||||
"/^([yY][eE][sS]|[yY])+$/",
|
||||
$_ENV["ALLOW_ADMIN_EMAIL_LOGIN"]
|
||||
));
|
||||
|
||||
$session_var_user_allowed = 'sogo-sso-user-allowed';
|
||||
$session_var_pass = 'sogo-sso-pass';
|
||||
|
||||
// validate credentials for basic auth requests
|
||||
$request = null;
|
||||
if (isset($_SERVER['PHP_AUTH_USER'])) {
|
||||
// load prerequisites only when required
|
||||
$request = "basic-auth";
|
||||
} elseif (isset($_GET['login'])) {
|
||||
$request = "admin-login";
|
||||
} elseif (isset($_SERVER['HTTP_X_ORIGINAL_URI']) &&
|
||||
strcasecmp(substr($_SERVER['HTTP_X_ORIGINAL_URI'], 0, 6), "/SOGo/") === 0) {
|
||||
$request = "auth-request";
|
||||
}
|
||||
|
||||
|
||||
switch ($request) {
|
||||
case "basic-auth":
|
||||
require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
|
||||
|
||||
$username = $_SERVER['PHP_AUTH_USER'];
|
||||
$password = $_SERVER['PHP_AUTH_PW'];
|
||||
$is_eas = false;
|
||||
$is_dav = false;
|
||||
$is_eas = (preg_match('/^(\/SOGo|)\/Microsoft-Server-ActiveSync.*/', $original_uri) === 1);
|
||||
$is_dav = (preg_match('/^(\/SOGo|)\/dav.*/', $original_uri) === 1);
|
||||
$original_uri = isset($_SERVER['HTTP_X_ORIGINAL_URI']) ? $_SERVER['HTTP_X_ORIGINAL_URI'] : '';
|
||||
if (preg_match('/^(\/SOGo|)\/dav.*/', $original_uri) === 1) {
|
||||
$is_dav = true;
|
||||
}
|
||||
elseif (preg_match('/^(\/SOGo|)\/Microsoft-Server-ActiveSync.*/', $original_uri) === 1) {
|
||||
$is_eas = true;
|
||||
}
|
||||
|
||||
$login_check = check_login($username, $password, array('dav' => $is_dav, 'eas' => $is_eas));
|
||||
if ($login_check === 'user') {
|
||||
header("X-User: $username");
|
||||
header("X-Auth: Basic ".base64_encode("$username:$password"));
|
||||
header("X-Auth-Type: Basic");
|
||||
exit;
|
||||
} else {
|
||||
header('HTTP/1.0 401 Unauthorized');
|
||||
echo 'Invalid login';
|
||||
setAuthHeaders($username, $password);
|
||||
ob_end_flush();
|
||||
exit;
|
||||
}
|
||||
}
|
||||
// check permissions and redirect for direct GET ?login=xy requests
|
||||
elseif (isset($_GET['login'])) {
|
||||
// load prerequisites only when required
|
||||
|
||||
http_response_code(401);
|
||||
ob_end_flush();
|
||||
exit;
|
||||
break;
|
||||
case "admin-login":
|
||||
require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
|
||||
// check if dual_login is active
|
||||
|
||||
$is_dual = (!empty($_SESSION["dual-login"]["username"])) ? true : false;
|
||||
// check permissions (if dual_login is active, deny sso when acl is not given)
|
||||
$login = html_entity_decode(rawurldecode($_GET["login"]));
|
||||
if (isset($_SESSION['mailcow_cc_role']) &&
|
||||
(($_SESSION['acl']['login_as'] == "1" && $ALLOW_ADMIN_EMAIL_LOGIN !== 0) || ($is_dual === false && $login == $_SESSION['mailcow_cc_username']))) {
|
||||
if (filter_var($login, FILTER_VALIDATE_EMAIL)) {
|
||||
if (user_get_alias_details($login) !== false) {
|
||||
// register username in session
|
||||
|
||||
if (isset($_SESSION['mailcow_cc_role'])) {
|
||||
// Check if login is allowed:
|
||||
// - User has the "login as" ACL
|
||||
// - Admin email login is enabled in mailcow.conf
|
||||
// - Dual login is not active
|
||||
// - The current role is not "user" or dual login role is admin / domainadmin
|
||||
$is_login_allowed = (
|
||||
$_SESSION['acl']['login_as'] == "1" &&
|
||||
$ALLOW_ADMIN_EMAIL_LOGIN !== 0 &&
|
||||
($_SESSION['mailcow_cc_role'] != "user" || $_SESSION['dual-login']['role'] == "admin" || $_SESSION['dual-login']['role'] == "domainadmin")
|
||||
);
|
||||
if ($is_login_allowed) {
|
||||
// set dual login session
|
||||
$_SESSION[$session_var_user_allowed][] = $login;
|
||||
// set dual login
|
||||
if ($_SESSION['acl']['login_as'] == "1" && $ALLOW_ADMIN_EMAIL_LOGIN !== 0 && $is_dual === false && $_SESSION['mailcow_cc_role'] != "user"){
|
||||
if (!$is_dual) {
|
||||
$_SESSION["dual-login"]["username"] = $_SESSION['mailcow_cc_username'];
|
||||
$_SESSION["dual-login"]["role"] = $_SESSION['mailcow_cc_role'];
|
||||
}
|
||||
$_SESSION['mailcow_cc_username'] = $login;
|
||||
$_SESSION['mailcow_cc_role'] = "user";
|
||||
}
|
||||
|
||||
// update sasl logs
|
||||
$service = ($app_passwd_data['eas'] === true) ? 'EAS' : 'DAV';
|
||||
$stmt = $pdo->prepare("REPLACE INTO sasl_log (`service`, `app_password`, `username`, `real_rip`) VALUES ('SSO', 0, :username, :remote_addr)");
|
||||
@ -63,26 +90,33 @@ elseif (isset($_GET['login'])) {
|
||||
':username' => $login,
|
||||
':remote_addr' => ($_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR'])
|
||||
));
|
||||
|
||||
// redirect to sogo (sogo will get the correct credentials via nginx auth_request
|
||||
http_response_code(200);
|
||||
header("Location: /SOGo/so/{$login}");
|
||||
ob_end_flush();
|
||||
exit;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
http_response_code(401);
|
||||
header("Location: /");
|
||||
ob_end_flush();
|
||||
exit;
|
||||
}
|
||||
// only check for admin-login on sogo GUI requests
|
||||
elseif (isset($_SERVER['HTTP_X_ORIGINAL_URI']) && strcasecmp(substr($_SERVER['HTTP_X_ORIGINAL_URI'], 0, 9), "/SOGo/so/") === 0) {
|
||||
// this is an nginx auth_request call, we check for existing sogo-sso session variables
|
||||
break;
|
||||
case "auth-request":
|
||||
session_start();
|
||||
// extract email address from "/SOGo/so/user@domain/xy"
|
||||
$url_parts = explode("/", $_SERVER['HTTP_X_ORIGINAL_URI']);
|
||||
|
||||
$email_list = array(
|
||||
$url_parts[3], // Requested mailbox
|
||||
($_SESSION['mailcow_cc_username'] ?? ''), // Current user
|
||||
($_SESSION["dual-login"]["username"] ?? ''), // Dual login user
|
||||
);
|
||||
|
||||
$url_parts = explode("/", $_SERVER['HTTP_X_ORIGINAL_URI']);
|
||||
if (count($url_parts) >= 4) {
|
||||
array_push($email_list, $url_parts[3]); // Requested user
|
||||
}
|
||||
|
||||
foreach($email_list as $email) {
|
||||
// check if this email is in session allowed list
|
||||
if (
|
||||
@ -91,17 +125,21 @@ elseif (isset($_SERVER['HTTP_X_ORIGINAL_URI']) && strcasecmp(substr($_SERVER['HT
|
||||
is_array($_SESSION[$session_var_user_allowed]) &&
|
||||
in_array($email, $_SESSION[$session_var_user_allowed])
|
||||
) {
|
||||
$username = $email;
|
||||
$password = file_get_contents("/etc/sogo-sso/sogo-sso.pass");
|
||||
header("X-User: $username");
|
||||
header("X-Auth: Basic ".base64_encode("$username:$password"));
|
||||
header("X-Auth-Type: Basic");
|
||||
setAuthHeaders($email, $password);
|
||||
ob_end_flush();
|
||||
exit;
|
||||
}
|
||||
}
|
||||
|
||||
http_response_code(401);
|
||||
ob_end_flush();
|
||||
exit;
|
||||
break;
|
||||
default:
|
||||
setAuthHeaders("", "");
|
||||
ob_end_flush();
|
||||
exit;
|
||||
break;
|
||||
}
|
||||
|
||||
// if username is empty, SOGo will use the normal login methods / login form
|
||||
header("X-User: ");
|
||||
header("X-Auth: ");
|
||||
header("X-Auth-Type: ");
|
||||
|
@ -20,11 +20,11 @@
|
||||
{{ lang.user.open_webmail_sso }} <i class="bi bi-arrow-right"></i>
|
||||
</button>
|
||||
{% elseif dual_login %}
|
||||
<a target="_blank" href="/sogo-auth.php?login={{ mailcow_cc_username }}" role="button" class="btn btn-primary btn-lg btn-block btn-xs-lg w-100">
|
||||
<a href="/sogo-auth.php?login={{ mailcow_cc_username }}" role="button" class="btn btn-primary btn-lg btn-block btn-xs-lg w-100">
|
||||
{{ lang.user.open_webmail_sso }} <i class="bi bi-arrow-right"></i>
|
||||
</a>
|
||||
{% else %}
|
||||
<a target="_blank" href="/SOGo/so" role="button" class="btn btn-primary btn-lg btn-block btn-xs-lg w-100">
|
||||
<a href="/SOGo/so" role="button" class="btn btn-primary btn-lg btn-block btn-xs-lg w-100">
|
||||
{{ lang.user.open_webmail_sso }} <i class="bi bi-arrow-right"></i>
|
||||
</a>
|
||||
{% endif %}
|
||||
|
Loading…
Reference in New Issue
Block a user