WSO2 Identity Server X509 Authentication Behind Proxy - wso2

Question

I'm using WSO2 Identity Server 5.10.
I need to add support for X509 Authentication and I was reading the documentation about the X509 Certificate Authentication here
In order to add the configuration I had to modify the catalina-server.xml.j2 file as suggested here
So done it works but I have a very huge ports commingling.... anyway let's assume it works.
Now I have this issue: I need to deploy WSO2 Identity Server in a K8S cluster. So, basically, I have a nginx ingress controller that will manage all the traffic to the backend.
What I did locally is to put a simple nginx reverse proxy and configure WSO2 Identity Server in order to use this proxy. So in my deployment.toml I did the following
[custom_trasport.x509.properties]
protocols="HTTP/1.1"
port="8443"
maxThreads="200"
scheme="https"
secure=true
SSLEnabled=true
keystoreFile="mykeystore.jks"
keystorePass="pwd"
truststoreFile="myclient_trust.jks"
truststorePass="myclient_trust_pwd"
bindOnInit=false
clientAuth="want"
sslProtocol = "TLS"
proxyPort="443"
[authentication.authenticator.x509_certificate.parameters]
name ="x509CertificateAuthenticator"
enable=true
AuthenticationEndpoint="https://$ref{server.hostname}:8443/x509-certificate-servlet"
username= "CN"
SearchAllUserStores="false"
EnforceSelfRegistration = "false"
SearchAndValidateUserLocalStores = "false"
[transport.https.properties]
proxyPort="443"
In this way when I want to sign-in by using the X509 Certificate Authentication it will ask for my certificate but then, when I choose the certificate, it shows an error because it can't find the certificate in the browser request
Moreover I don't think I should leave AuthenticationEndpoint="https://$ref{server.hostname}:8443/x509-certificate-servlet" because this means that the submit will be done to the 8443 port that is never exposed on internet.
Did anyone solve this issue? Basically the question is: how can I configure the X509 Certificate Authentication behind a proxy (e.g. nginx)?
Any tip is very precious.
Thank you
Angelo

Answer 1

I think I solved the issue I'm facing.
Basically when I have a reverse_proxy (e.g. nginx), the certicate doesn't arrive to the tomcat in the request attribute.
What I did is configure the reverse_proxy to put the certificate as HTTP header without verifying it; I'll verify on the server side.
So now my nginx configuration is:
server {
listen 443;
server_name wso2_iam;
ssl on;
ssl_certificate certificate_full_path.crt;
ssl_certificate_key full_path_to_kwy_no_pwd.key;
ssl_verify_client optional_no_ca;
location /x509-certificate-servlet/ {
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
proxy_read_timeout 5m;
proxy_send_timeout 5m;
proxy_pass https://127.0.0.1:8443/x509-certificate-servlet;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
location / {
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
proxy_read_timeout 5m;
proxy_send_timeout 5m;
proxy_pass https://127.0.0.1:9443/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
error_log /var/log/nginx/wso2-error.log;
access_log /var/log/nginx/wso2-access.log;
}
The ssl_verify_client optional_no_ca; tells nginx to retrieve the certificate but to not validate it.
The proxy_set_header X-SSL-CERT $ssl_client_escaped_cert; instruction tells nginx to put the certificate PEM based in the request header called X-SSL-CERT
Then I modified the org.wso2.carbon.identity.authenticator.x509Certificate.X509CertificateAuthenticator in order to search for the certificate between request headers when it's not found in the http request attribute.
It seems to be working.
Thank you to all
Angelo