[Google Oauth2 Sign-In] User impersonation alternative using OAuth2 Proxy

Elastic Stack Kibana
2

  • Create NGINX configuration folders:

          # mkdir /opt/nginx/conf/conf.d
      # mkdir /opt/nginx/conf/sites-available/
      # mkdir /opt/nginx/conf/sites-enabled/

  • Update the NGINX configuration file (/opt/nginx/conf/nginx.conf)

          user  nobody;
      worker_processes  1;
      error_log  logs/error.log;
      error_log  logs/error.log  notice;
      error_log  logs/error.log  info;
      pid        logs/nginx.pid;
      events {
         worker_connections  1024;
      }

         http {
              include       mime.types;
              default_type  application/octet-stream;
              access_log  logs/access.log  main;
              sendfile        on;
              #tcp_nopush     on;
              #keepalive_timeout  0;
              keepalive_timeout  65;
              gzip  on;
              include /opt/nginx/conf/conf.d/*.conf;
              include /opt/nginx/conf/sites-enabled/*;
          }

  • Create the NGINX proxy configuration file (/opt/nginx/conf/sites-available/oauth2_proxy):

          server {
              listen 80;
              server_name kibana.example.com;

              # redirect http->https while we're at it
              rewrite ^ https://$server_name$request_uri? permanent;
          }
          server {
              listen 127.0.0.1:8080;
              server_name localhost;

              location / {
                  # The location of the Kibana server
                  proxy_pass https://kibana.example.com:8443/;

                  # Create the base64 encoded authentication string
      
                  set $auth_string  "${remote_user}:<SuperSecuredSecretPassword>";
                  set_encode_base64 $encoded_string $auth_string;

                  proxy_set_header Authorization "Basic $encoded_string";

                  # Simple rewrite to get us back to oauth2_proxy 's login page if someone uses Kibana's Logout             button.
                  rewrite /login https://kibana.example.com/oauth2/sign_in redirect;
              }

  • Create a symlink of the file /opt/nginx/conf/sites-available/oauth2_proxy in the folder /opt/nginx/conf/sites-enabled

  • Enable the NGINX service

         # systemctl enable nginx

  • Start the NGINX service

          # systemctl start nginx
  1. Create the Kibana usernames identicals to the ones from the email addresses:

  • Connect to Kibana server using the address https://kibana.example.com:8443 with a superuser account and create the users as in the following example:

      # for the email address (hosted on Google) user.name@example.com, create the kibana user user.name with the password <SuperSecuredSecretPassword> (the same as in the nginx configuration file)
  # use the same password for all the other users you will create