在 AWS 中国区对 Amazon Elasticsearch Kibana 进行身份认证的解决方案

sudo yum update -y
# 在yum中添加nginx官网yum源
sudo rpm -Uvh http://nginx.org/packages/centos/7/noarch/RPMS/nginx-release-centos-7-0.el7.ngx.noarch.rpm
sudo yum install -y nginx
sudo systemctl start nginx
sudo systemctl status nginx

user  nginx;
worker_processes  1;
error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;
events {
    worker_connections  1024;
}
http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx/access.log  main;
    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;
    # Load modular configuration files from the /etc/nginx/conf.d directory.
    include /etc/nginx/conf.d/*.conf;
    index   index.html index.htm;
}

server {
    listen 80;
    server_name {EC2_publicDNS};
    auth_basic "Kibana Auth";
    auth_basic_user_file /etc/nginx/.httpd_secret;
    rewrite ^/$ http://{EC2_publicDNS}/_plugin/kibana redirect;

    location /_plugin/kibana {
        # Forward requests to Kibana
        proxy_pass {ES_Kibana_url};

        # Update cookie domain and path
        proxy_cookie_domain {ES_Kibana_url} {EC2_publicDNS};
        proxy_cookie_path / /_plugin/kibana/;
        proxy_set_header Authorization "";
        # Response buffer settings
        proxy_buffer_size 128k;
        proxy_buffers 4 256k;
        proxy_busy_buffers_size 256k;
    }
}

sudo systemctl restart nginx

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "es:*",
      "Resource": "arn:aws:es:ap-northeast-1:{AWS-账号}:domain/beckydomain/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "EC2_pulicIP": {ec2-public-ip}
          ]
        }
      }
    }
  ]
}

# 安装httpd
sudo yum install -y httpd-tools
# 用httpd工具生成kibana-admin访问
sudo htpasswd -c /etc/nginx/.httpd_secret kibana-admin

# 下载依赖
yum -y install gcc gcc-c++ autoconf automake make zlib zlib-devel openssl openssl-devel pcre pcre-devel libxslt-devel redhat-rpm-config gd-devel perl-devel perl-ExtUtils-Embed geoip-devel gperftools-devel
# 下载源代码
./configure --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fPIC' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -pie' --with-http_auth_request_module
# 编译安装
make
make install

server {
  listen 80 default_server;
  server_name {kibana.stats.beckyhome.cn};

  # Any request to this server will first be sent to this URL
  auth_request /vouch-validate;
  
  location = /vouch-validate {
    # This address is where Vouch will be listening on
    proxy_pass http://127.0.0.1:9090/validate;
    proxy_pass_request_body off; # no need to send the POST body
  
    proxy_set_header Content-Length "";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  
    # these return values are passed to the @error401 call
    auth_request_set $auth_resp_jwt $upstream_http_x_vouch_jwt;
    auth_request_set $auth_resp_err $upstream_http_x_vouch_err;
    auth_request_set $auth_resp_failcount $upstream_http_x_vouch_failcount;
  }
  
  error_page 401 = @error401;
  
  # If the user is not logged in, redirect them to Vouch's login URL
  location @error401 {
    return 302 http://{kibana.login.beckyhome.cn}/login?url=http://$http_host$request_uri&vouch-failcount=$auth_resp_failcount&X-Vouch-Token=$auth_resp_jwt&error=$auth_resp_err;
  }

  rewrite ^/$ http://{kibana.stats.beckyhome.cn}/_plugin/kibana redirect;

  location /_plugin/kibana {
        # Forward requests to Kibana
        proxy_pass {ES_Kibana_url};

        # Update cookie domain and path
        proxy_cookie_domain {ES_Kibana_url} {kibana.stats.beckyhome.cn};
        proxy_cookie_path / /_plugin/kibana/;
        proxy_set_header Authorization "";
        # Response buffer settings
        proxy_buffer_size 128k;
        proxy_buffers 4 256k;
        proxy_busy_buffers_size 256k;
    }

}

server {
  listen 80;
  server_name {kibana.login.beckyhome.cn};

  # Proxy to your Vouch instance
  location / {
    proxy_set_header  Host  {kibana.login.beckyhome.cn};
    proxy_pass        http://127.0.0.1:9090;
  }
}

sudo systemctl restart nginx

# 安装go和git
cd ~
# vouch的所有操作都在root下进行
sudo -s
yum install golang
yum install git
git clone https://github.com/vouch/vouch-proxy.git

https fetch failed: Get https://golang.org/x/text/...  timeout
https fetch failed: Get https://golang.org/x/sys/..  timeout
https fetch failed: Get https://golang.org/x/oauth2/..  timeout
https fetch failed: Get https://golang.org/x/net/..  timeout
https fetch failed: Get https://cloud.google.com/go/compute/metadata/..  timeout

# 查看go安装的位置GOPATH
go env
export GOPATH=/root/go
echo $GOPATH
# 手动添加文件夹golang.org
mkdir -p $GOPATH/src/golang.org/x 
cd $GOPATH/src/golang.org/x
git clone https://github.com/golang/text.git
git clone https://github.com/golang/sys.git
git clone https://github.com/golang/oauth2.git
git clone https://github.com/golang/net.git
# 手动添加文件夹cloud.google.com
mkdir -p $GOPATH/src/cloud.google.com/go 
cd $GOPATH/src/cloud.google.com/go
git clone https://github.com/googleapis/google-cloud-go.git
# 移动文件夹compute到指定位置
mv $GOPATH/src/cloud.google.com/go/google-cloud-go/compute $GOPATH/src/cloud.google.com/go/compute

# 安装nginx-plus-module-njs模块
sudo yum install nginx-plus-module-njs

# 创建一个nginx-openid-connect GitHub存储库的克隆
git clone https://github.com/nginxinc/nginx-openid-connect

# 复制文件到nginx的配置中
cp frontend.conf /etc/nginx/conf.d/frontednss.conf
cp openid_connect.js /etc/nginx/conf.d/openid_connect.js
cp openid_connect.server_conf /etc/nginx/conf.d/openid_connect.server_conf

# 从Okta配置获取授权端点，令牌端点和JSON Web密钥（JWK）文件的URL
$ curl https：// <用户名> -admin.okta.com/.well-known/openid-configuration | python -m json.tool

set $oidc_authz_endpoint – authorization_endpoint
set $oidc_token_endpoint – token_endpoint
set $oidc_client – {client_id}
set $oidc_client_secret – {client_secret}
set $oidc_token_type – id_token