ID-card authentication on NGINX server

ID-card authentication on NGINX server Introduction We decided to use nginx as our webserver because of its simplicity and high speed. Due to the lack of an nginx setup guide, we had to solve a problem with authentication with the ID-card. That’s how a blog post explaining how to set up authentication with the ID card on an nginx web server has been created. Our guidelines are based on the official Apache web server guide.

Authentication Process Nginx server task is to request PIN1 from the user and send the user certificate to a backend application. The backend application is responsible the certificate validity check (expired, stolen, lost), before the user logs in.

Note An nginx server only allows for the domain based request of the user certificates. Here is an nginx ticket that reports the lack of location based support: https://trac.nginx.org/nginx/ticket/400

Our setup and workflow 1. We set up the subdomain id.rakendus.ee on nginx. 2. Before forwarding the /idlogin POST request, nginx asks the user for PIN1 and adds the user certificate to the request. 3. The backend application validates the certificate and sends to the frontend application the 'X-AUTH-TOKEN' token, which is afterwards used for user authentication.

Subdomain configuration server { listen 443; server_name id.rakendus.ee; ssl on; ssl_certificate /certs/id.rakendus.ee.crt; ssl_certificate_key /certs/id.rakendus.ee.key; ssl_client_certificate /certs/id.crt; ssl_verify_client on; ssl_session_cache off; ssl_verify_depth 2; #Enabled ciphers ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384"; ssl_prefer_server_ciphers on; location /idlogin { expires -1; proxy_pass http://localhost:23213; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header SSL_CLIENT_VERIFY $ssl_client_verify; proxy_set_header SSL_CLIENT_CERT $ssl_client_cert; add_header 'Access-Control-Allow-Origin' 'https://www.rakendus.ee'; add_header 'Access-Control-Allow-Methods' 'POST, OPTIONS'; add_header 'Access-Control-Allow-Headers' 'X-AUTH-TOKEN'; add_header 'Access-Control-Expose-Headers' 'X-AUTH-TOKEN'; add_header 'Access-Control-Max-Age' 1;

} } 2015-10-16 Iglu OÜ