在 AWS 中国区对 Amazon Elasticsearch Kibana 进行身份认证的解决方案

sudo yum update -y# 在yum中添加nginx官网yum源sudo rpm -Uvh http://nginx.org/packages/centos/7/noarch/RPMS/nginx-release-centos-7-0.el7.ngx.noarch.rpmsudo yum install -y nginxsudo systemctl start nginxsudo systemctl status nginx

user  nginx;worker_processes  1;error_log  /var/log/nginx/error.log warn;pid        /var/run/nginx.pid;events {    worker_connections  1024;}http {    include       /etc/nginx/mime.types;    default_type  application/octet-stream;    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '                      '$status $body_bytes_sent "$http_referer" '                      '"$http_user_agent" "$http_x_forwarded_for"';    access_log  /var/log/nginx/access.log  main;    sendfile            on;    tcp_nopush          on;    tcp_nodelay         on;    keepalive_timeout   65;    types_hash_max_size 2048;    # Load modular configuration files from the /etc/nginx/conf.d directory.    include /etc/nginx/conf.d/*.conf;    index   index.html index.htm;}

server {    listen 80;    server_name {EC2_publicDNS};    auth_basic "Kibana Auth";    auth_basic_user_file /etc/nginx/.httpd_secret;    rewrite ^/$ http://{EC2_publicDNS}/_plugin/kibana redirect;
    location /_plugin/kibana {        # Forward requests to Kibana        proxy_pass {ES_Kibana_url};
        # Update cookie domain and path        proxy_cookie_domain {ES_Kibana_url} {EC2_publicDNS};        proxy_cookie_path / /_plugin/kibana/;        proxy_set_header Authorization "";        # Response buffer settings        proxy_buffer_size 128k;        proxy_buffers 4 256k;        proxy_busy_buffers_size 256k;    }}

sudo systemctl restart nginx

{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "AWS": "*"      },      "Action": "es:*",      "Resource": "arn:aws:es:ap-northeast-1:{AWS-账号}:domain/beckydomain/*",      "Condition": {        "IpAddress": {          "aws:SourceIp": [            "EC2_pulicIP": {ec2-public-ip}          ]        }      }    }  ]}

# 安装httpdsudo yum install -y httpd-tools# 用httpd工具生成kibana-admin访问sudo htpasswd -c /etc/nginx/.httpd_secret kibana-admin

# 下载依赖yum -y install gcc gcc-c++ autoconf automake make zlib zlib-devel openssl openssl-devel pcre pcre-devel libxslt-devel redhat-rpm-config gd-devel perl-devel perl-ExtUtils-Embed geoip-devel gperftools-devel# 下载源代码./configure --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fPIC' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -pie' --with-http_auth_request_module# 编译安装makemake install

server {  listen 80 default_server;  server_name {kibana.stats.beckyhome.cn};
  # Any request to this server will first be sent to this URL  auth_request /vouch-validate;
  location = /vouch-validate {    # This address is where Vouch will be listening on    proxy_pass http://127.0.0.1:9090/validate;    proxy_pass_request_body off; # no need to send the POST body
    proxy_set_header Content-Length "";    proxy_set_header X-Real-IP $remote_addr;    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;    proxy_set_header X-Forwarded-Proto $scheme;
    # these return values are passed to the @error401 call    auth_request_set $auth_resp_jwt $upstream_http_x_vouch_jwt;    auth_request_set $auth_resp_err $upstream_http_x_vouch_err;    auth_request_set $auth_resp_failcount $upstream_http_x_vouch_failcount;  }
  error_page 401 = @error401;
  # If the user is not logged in, redirect them to Vouch's login URL  location @error401 {    return 302 http://{kibana.login.beckyhome.cn}/login?url=http://$http_host$request_uri&vouch-failcount=$auth_resp_failcount&X-Vouch-Token=$auth_resp_jwt&error=$auth_resp_err;  }
  rewrite ^/$ http://{kibana.stats.beckyhome.cn}/_plugin/kibana redirect;
  location /_plugin/kibana {        # Forward requests to Kibana        proxy_pass {ES_Kibana_url};
        # Update cookie domain and path        proxy_cookie_domain {ES_Kibana_url} {kibana.stats.beckyhome.cn};        proxy_cookie_path / /_plugin/kibana/;        proxy_set_header Authorization "";        # Response buffer settings        proxy_buffer_size 128k;        proxy_buffers 4 256k;        proxy_busy_buffers_size 256k;    }
}

server {  listen 80;  server_name {kibana.login.beckyhome.cn};
  # Proxy to your Vouch instance  location / {    proxy_set_header  Host  {kibana.login.beckyhome.cn};    proxy_pass        http://127.0.0.1:9090;  }}

sudo systemctl restart nginx

# 安装go和gitcd ~# vouch的所有操作都在root下进行sudo -syum install golangyum install gitgit clone https://github.com/vouch/vouch-proxy.git

# vouch config
vouch:  logLevel: info  testing: false
  listen: 0.0.0.0  port: 9090  allowAllUsers: true
  jwt:    secret: your_random_string    issuer: Vouch    maxAge: 240    compress: true
  cookie:    name: VouchCookie    domain: {beckyhome.cn}    secure: false    httpOnly: true    maxAge: 0
  session:    name: VouchSession    key: you_random_key
  headers:    jwt: X-Vouch-Token    querystring: access_token    redirect: X-Vouch-Requested-URI
# OAuth Provider:OpenID Connect Oktaoauth:  provider: oidc  client_id: {client_id}  client_secret: {client_secret}  auth_url: https://{yourOktaDomain}/oauth2/default/v1/authorize  token_url: https://{yourOktaDomain}/oauth2/default/v1/token  user_info_url: https://{yourOktaDomain}/oauth2/default/v1/userinfo  scopes:    - openid    - email  # Set the callback URL to the domain that Vouch is running on  callback_url: http://{kibana.login.beckyhome.cn}/auth

回到vouch-proxy文件夹下，编译和运行vouch（root下）。

./do.sh goget./do.sh build./vouch-proxy

https fetch failed: Get https://golang.org/x/text/...  timeouthttps fetch failed: Get https://golang.org/x/sys/..  timeouthttps fetch failed: Get https://golang.org/x/oauth2/..  timeouthttps fetch failed: Get https://golang.org/x/net/..  timeouthttps fetch failed: Get https://cloud.google.com/go/compute/metadata/..  timeout

# 查看go安装的位置GOPATHgo envexport GOPATH=/root/goecho $GOPATH# 手动添加文件夹golang.orgmkdir -p $GOPATH/src/golang.org/x cd $GOPATH/src/golang.org/xgit clone https://github.com/golang/text.gitgit clone https://github.com/golang/sys.gitgit clone https://github.com/golang/oauth2.gitgit clone https://github.com/golang/net.git# 手动添加文件夹cloud.google.commkdir -p $GOPATH/src/cloud.google.com/go cd $GOPATH/src/cloud.google.com/gogit clone https://github.com/googleapis/google-cloud-go.git# 移动文件夹compute到指定位置mv $GOPATH/src/cloud.google.com/go/google-cloud-go/compute $GOPATH/src/cloud.google.com/go/compute

# 安装nginx-plus-module-njs模块sudo yum install nginx-plus-module-njs
# 创建一个nginx-openid-connect GitHub存储库的克隆git clone https://github.com/nginxinc/nginx-openid-connect
# 复制文件到nginx的配置中cp frontend.conf /etc/nginx/conf.d/frontednss.confcp openid_connect.js /etc/nginx/conf.d/openid_connect.jscp openid_connect.server_conf /etc/nginx/conf.d/openid_connect.server_conf
# 从Okta配置获取授权端点，令牌端点和JSON Web密钥（JWK）文件的URL$ curl https：// <用户名> -admin.okta.com/.well-known/openid-configuration | python -m json.tool

set $oidc_authz_endpoint – authorization_endpointset $oidc_token_endpoint – token_endpointset $oidc_client – {client_id}set $oidc_client_secret – {client_secret}set $oidc_token_type – id_token

                                                                            | Nginx plus作为代理，以Okta为Idp做OIDC认证      

                                                                              | Nginx plus需付费，并且此方案只适用于OIDC 认证