My task is to configure Kerberos authentication on nginx. The backend is django. The idea is that when a request is made to api, nginx should perform kerberos authentication. But in case the user is not in the domain, then a redirect to the /auth
authorization page must occur, so that the user can authenticate under an account that is registered in django CMS.
Authentication of domain users is successful. But there is a problem with non-domain users. When you open a site page that makes an api call, a basic authentication window appears. I use the auth_gss_allow_basic_fallback off
directive, but this does not help.
How can I disable this and configure redirection to /auth
?
My configuration file (I do not specify settings such as gzip, headers, etc.):
server {
listen 80;
server_name srv-01.example.com;
proxy_set_header remote-user $remote_user;
location / {
root /opt/site/;
try_files $uri $uri/ /index.html;
}
location /adminpanel {
proxy_pass http://192.168.1.4:4567;
}
location /api {
proxy_pass http://192.168.1.4:4567;
auth_gss on;
auth_gss_realm EXAMPLE.COM;
auth_gss_keytab /etc/krb5.keytab;
auth_gss_service_name HTTP/srv-01.example.com;
auth_gss_allow_basic_fallback off;
}}
Thanks for the help!