self-hosted/mailcow-dockerized
1
0
Fork 0
mirror of https://github.com/mailcow/mailcow-dockerized.git synced 2024-12-21 01:49:22 +02:00
Code Issues Releases Activity

[Web][Nginx] use nginx to redirect unauthenticated users to /index on SOGo Routes

Browse Source
This commit is contained in:
FreddleSpl0it 2024-12-06 11:52:49 +01:00
parent bbddfc3eab
commit 798ad7dda7
No known key found for this signature in database
GPG Key ID: 00E14E7634F4BEC5
5 changed files with 120 additions and 81 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
data/Dockerfiles/nginx/bootstrap.py
View File

@ -30,7 +30,7 @@ def prepare_template_vars():
'ADDITIONAL_SERVER_NAMES': os.getenv("ADDITIONAL_SERVER_NAMES", "").replace(',', ' '),
'HTTP_PORT': os.getenv("HTTP_PORT", "80"),
'HTTPS_PORT': os.getenv("HTTPS_PORT", "443"),
'SOGOHOST': os.getenv("SOGOHOST", "sogo-mailcow"),
'SOGOHOST': os.getenv("SOGOHOST", os.getenv("IPV4_NETWORK", "172.22.1") + ".248"),
'RSPAMDHOST': os.getenv("RSPAMDHOST", "rspamd-mailcow"),
'PHPFPMHOST': os.getenv("PHPFPMHOST", "php-fpm-mailcow"),
}

6
data/conf/nginx/sites-default.conf.j2
View File

@ -152,6 +152,10 @@ location ^~ /principals {
return 301 /SOGo/dav;
}
location @sogo_401redirect {
return 302 /user;
}
location /sogo-auth-verify {
internal;
proxy_set_header X-Original-URI $request_uri;
@ -192,6 +196,7 @@ location ^~ /SOGo {
auth_request_set $user $upstream_http_x_user;
auth_request_set $auth $upstream_http_x_auth;
auth_request_set $auth_type $upstream_http_x_auth_type;
error_page 401 = @sogo_401redirect;
proxy_set_header x-webobjects-remote-user "$user";
proxy_set_header Authorization "$auth";
proxy_set_header x-webobjects-auth-type "$auth_type";
@ -214,6 +219,7 @@ location ^~ /SOGo {
auth_request_set $user $upstream_http_x_user;
auth_request_set $auth $upstream_http_x_auth;
auth_request_set $auth_type $upstream_http_x_auth_type;
error_page 401 = @sogo_401redirect;
proxy_set_header x-webobjects-remote-user "$user";
proxy_set_header Authorization "$auth";
proxy_set_header x-webobjects-auth-type "$auth_type";

5
data/conf/sogo/custom-sogo.js
View File

@ -1,10 +1,5 @@
// redirect to mailcow login form
document.addEventListener('DOMContentLoaded', function () {
var loginForm = document.forms.namedItem("loginForm");
if (loginForm) {
window.location.href = '/user';
}
angularReady = false;
function observe() {
angularReady = toolbarExists();

184
data/web/sogo-auth.php
View File

@ -1,61 +1,88 @@
<?php
ob_start();
function setAuthHeaders($username, $password) {
$auth = "";
$type = "";
if (!empty($username) && !empty($password)) {
$auth = "Basic " . base64_encode("$username:$password");
$type = "Basic";
}
http_response_code(200);
header("X-User: $username");
header("X-Auth: $auth");
header("X-Auth-Type: $type");
}
$session_var_user_allowed = 'sogo-sso-user-allowed';
$session_var_pass = 'sogo-sso-pass';
$ALLOW_ADMIN_EMAIL_LOGIN = (preg_match(
"/^([yY][eE][sS]|[yY])+$/",
$_ENV["ALLOW_ADMIN_EMAIL_LOGIN"]
));
$session_var_user_allowed = 'sogo-sso-user-allowed';
$session_var_pass = 'sogo-sso-pass';
// validate credentials for basic auth requests
$request = null;
if (isset($_SERVER['PHP_AUTH_USER'])) {
// load prerequisites only when required
require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
$username = $_SERVER['PHP_AUTH_USER'];
$password = $_SERVER['PHP_AUTH_PW'];
$is_eas = false;
$is_dav = false;
$original_uri = isset($_SERVER['HTTP_X_ORIGINAL_URI']) ? $_SERVER['HTTP_X_ORIGINAL_URI'] : '';
if (preg_match('/^(\/SOGo|)\/dav.*/', $original_uri) === 1) {
$is_dav = true;
}
elseif (preg_match('/^(\/SOGo|)\/Microsoft-Server-ActiveSync.*/', $original_uri) === 1) {
$is_eas = true;
}
$login_check = check_login($username, $password, array('dav' => $is_dav, 'eas' => $is_eas));
if ($login_check === 'user') {
header("X-User: $username");
header("X-Auth: Basic ".base64_encode("$username:$password"));
header("X-Auth-Type: Basic");
exit;
} else {
header('HTTP/1.0 401 Unauthorized');
echo 'Invalid login';
exit;
}
$request = "basic-auth";
} elseif (isset($_GET['login'])) {
$request = "admin-login";
} elseif (isset($_SERVER['HTTP_X_ORIGINAL_URI']) &&
strcasecmp(substr($_SERVER['HTTP_X_ORIGINAL_URI'], 0, 6), "/SOGo/") === 0) {
$request = "auth-request";
}
// check permissions and redirect for direct GET ?login=xy requests
elseif (isset($_GET['login'])) {
// load prerequisites only when required
require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
// check if dual_login is active
$is_dual = (!empty($_SESSION["dual-login"]["username"])) ? true : false;
// check permissions (if dual_login is active, deny sso when acl is not given)
$login = html_entity_decode(rawurldecode($_GET["login"]));
if (isset($_SESSION['mailcow_cc_role']) &&
(($_SESSION['acl']['login_as'] == "1" && $ALLOW_ADMIN_EMAIL_LOGIN !== 0) || ($is_dual === false && $login == $_SESSION['mailcow_cc_username']))) {
if (filter_var($login, FILTER_VALIDATE_EMAIL)) {
if (user_get_alias_details($login) !== false) {
// register username in session
switch ($request) {
case "basic-auth":
require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
$username = $_SERVER['PHP_AUTH_USER'];
$password = $_SERVER['PHP_AUTH_PW'];
$is_eas = (preg_match('/^(\/SOGo|)\/Microsoft-Server-ActiveSync.*/', $original_uri) === 1);
$is_dav = (preg_match('/^(\/SOGo|)\/dav.*/', $original_uri) === 1);
$original_uri = isset($_SERVER['HTTP_X_ORIGINAL_URI']) ? $_SERVER['HTTP_X_ORIGINAL_URI'] : '';
$login_check = check_login($username, $password, array('dav' => $is_dav, 'eas' => $is_eas));
if ($login_check === 'user') {
setAuthHeaders($username, $password);
ob_end_flush();
exit;
}
http_response_code(401);
ob_end_flush();
exit;
break;
case "admin-login":
require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
$is_dual = (!empty($_SESSION["dual-login"]["username"])) ? true : false;
$login = html_entity_decode(rawurldecode($_GET["login"]));
if (isset($_SESSION['mailcow_cc_role'])) {
// Check if login is allowed:
// - User has the "login as" ACL
// - Admin email login is enabled in mailcow.conf
// - Dual login is not active
// - The current role is not "user" or dual login role is admin / domainadmin
$is_login_allowed = (
$_SESSION['acl']['login_as'] == "1" &&
$ALLOW_ADMIN_EMAIL_LOGIN !== 0 &&
($_SESSION['mailcow_cc_role'] != "user" || $_SESSION['dual-login']['role'] == "admin" || $_SESSION['dual-login']['role'] == "domainadmin")
);
if ($is_login_allowed) {
// set dual login session
$_SESSION[$session_var_user_allowed][] = $login;
// set dual login
if ($_SESSION['acl']['login_as'] == "1" && $ALLOW_ADMIN_EMAIL_LOGIN !== 0 && $is_dual === false && $_SESSION['mailcow_cc_role'] != "user"){
if (!$is_dual) {
$_SESSION["dual-login"]["username"] = $_SESSION['mailcow_cc_username'];
$_SESSION["dual-login"]["role"] = $_SESSION['mailcow_cc_role'];
$_SESSION['mailcow_cc_username'] = $login;
$_SESSION['mailcow_cc_role'] = "user";
}
$_SESSION['mailcow_cc_username'] = $login;
$_SESSION['mailcow_cc_role'] = "user";
// update sasl logs
$service = ($app_passwd_data['eas'] === true) ? 'EAS' : 'DAV';
$stmt = $pdo->prepare("REPLACE INTO sasl_log (`service`, `app_password`, `username`, `real_rip`) VALUES ('SSO', 0, :username, :remote_addr)");
@ -63,45 +90,56 @@ elseif (isset($_GET['login'])) {
':username' => $login,
':remote_addr' => ($_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR'])
));
// redirect to sogo (sogo will get the correct credentials via nginx auth_request
http_response_code(200);
header("Location: /SOGo/so/{$login}");
ob_end_flush();
exit;
}
}
}
header("Location: /");
exit;
}
// only check for admin-login on sogo GUI requests
elseif (isset($_SERVER['HTTP_X_ORIGINAL_URI']) && strcasecmp(substr($_SERVER['HTTP_X_ORIGINAL_URI'], 0, 9), "/SOGo/so/") === 0) {
// this is an nginx auth_request call, we check for existing sogo-sso session variables
session_start();
// extract email address from "/SOGo/so/user@domain/xy"
$url_parts = explode("/", $_SERVER['HTTP_X_ORIGINAL_URI']);
$email_list = array(
$url_parts[3], // Requested mailbox
http_response_code(401);
header("Location: /");
ob_end_flush();
exit;
break;
case "auth-request":
session_start();
$email_list = array(
($_SESSION['mailcow_cc_username'] ?? ''), // Current user
($_SESSION["dual-login"]["username"] ?? ''), // Dual login user
);
foreach($email_list as $email) {
// check if this email is in session allowed list
if (
);
$url_parts = explode("/", $_SERVER['HTTP_X_ORIGINAL_URI']);
if (count($url_parts) >= 4) {
array_push($email_list, $url_parts[3]); // Requested user
}
foreach($email_list as $email) {
// check if this email is in session allowed list
if (
!empty($email) &&
filter_var($email, FILTER_VALIDATE_EMAIL) &&
is_array($_SESSION[$session_var_user_allowed]) &&
in_array($email, $_SESSION[$session_var_user_allowed])
) {
$username = $email;
$password = file_get_contents("/etc/sogo-sso/sogo-sso.pass");
header("X-User: $username");
header("X-Auth: Basic ".base64_encode("$username:$password"));
header("X-Auth-Type: Basic");
exit;
) {
$password = file_get_contents("/etc/sogo-sso/sogo-sso.pass");
setAuthHeaders($email, $password);
ob_end_flush();
exit;
}
}
}
http_response_code(401);
ob_end_flush();
exit;
break;
default:
setAuthHeaders("", "");
ob_end_flush();
exit;
break;
}
// if username is empty, SOGo will use the normal login methods / login form
header("X-User: ");
header("X-Auth: ");
header("X-Auth-Type: ");

4
data/web/templates/user/tab-user-auth.twig
View File

@ -20,11 +20,11 @@
{{ lang.user.open_webmail_sso }} <i class="bi bi-arrow-right"></i>
</button>
{% elseif dual_login %}
<a target="_blank" href="/sogo-auth.php?login={{ mailcow_cc_username }}" role="button" class="btn btn-primary btn-lg btn-block btn-xs-lg w-100">
<a href="/sogo-auth.php?login={{ mailcow_cc_username }}" role="button" class="btn btn-primary btn-lg btn-block btn-xs-lg w-100">
{{ lang.user.open_webmail_sso }} <i class="bi bi-arrow-right"></i>
</a>
{% else %}
<a target="_blank" href="/SOGo/so" role="button" class="btn btn-primary btn-lg btn-block btn-xs-lg w-100">
<a href="/SOGo/so" role="button" class="btn btn-primary btn-lg btn-block btn-xs-lg w-100">
{{ lang.user.open_webmail_sso }} <i class="bi bi-arrow-right"></i>
</a>
{% endif %}