Simplest way to use openid as authentication for static content

Question

I have a private website used as an intranet site for workers from around the world who have accounts with my Google Apps domain (example.com). They currently use OpenId to log in to various collaborative tools, so I want to use this for my site too.

1. I want to protect the static content on my private members-only website with OpenID login (rather than, say, basic HTTP auth), which Google Apps provides.

2. I know that anyone can be an OpenID provider, so I want to restrict it to one domain name, specifically my Google Apps domain.

At the moment my static content is served via Nginx. I would prefer a simple Nginx module that would handle this with only a bit of setup.

If I have to get my hands dirty, I don't mind setting up a basic Python (say Django) or Java server to handle this, but I don't want to use PHP or Ruby.

Cosmos

Take a look at this NGiNX blog post: nginx.com/blog/validating-oauth-2-0-access-tokens-nginx – Cornet

Answer 1

Depending on the volume of content, why not put it up on the Google App Engine?

There are restrictions on the amount of stuff you can put up statically (you can serve from DB though), and the number of changes per day.

If your content is small enough and doesn't change too frequently (100 times a day I believe is the max) this might address your authentication problems and simplify your life a fair bit!

Ably

Is your intention that GAE has built-in openid support? How simple is that to set up. – Cosmos

Hmm for a corporate site (which this is) I'm not sure I'm comfortable with using app engine for this and it. The site is very simple (static pages) so it would be nice to have a simple open-id or oauth-based authentication – Cosmos

Answer 2

For lighttpd, there is https://lighttpd-external-auth.chmd.fr.

I believe it could be ported for the nginx lua scripting interface without major difficulties.

Downall

Hi, the link is not functional anymore (it goes to the personal site but does not show the script I am looking for). I found the script (not maintained anymore) at github.com/chmduquesne/lighttpd-external-auth – Gervais

Answer 3

If you want to use Google as IDP with open ID connect you can follow Google guidelines for the same here. I am using NGINX Plus with Auth0 as IDP but that needs a paid NGINX subscription, see details here. If you want to use this with Open Source version you can check this.

I have not used this open-source version so will advise you to check for all security concerns before using it.

Scottscotti