Nginx authenticate iframe

I am running a django app on a server and i am running grafana on a different server with nginx as a reverse proxy (grafana and nginx are on the same server).

I can manage to redirect an incoming URL and authenticate it via my backend, but I still get redirected to the grafana login screen, even when my django app sends a 200 response

My setup:

1. I am having a grafana server running under https with a nginx proxy. The nginx-setup

server {
    server_name  grafana.myserver.com;
     
    location / {
        proxy_set_header Host $host;
        proxy_pass           http://localhost:3000/;
        proxy_set_header X-Real-IP $remote_addr;
    }

    location ~ ^/iframe(.*)$ {
      auth_request /iframe-auth;
      set $iframe_url http://localhost:3000$1$is_args$args;
        proxy_pass $iframe_url;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Authorization $http_authorization;
    }

    location = /iframe-auth {
        internal;
        proxy_pass https://blub.de/auth/check/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Original-URI $request_uri;
    }

}

In the above I am using the nginx auth module to redirect the incoming URL from the iframe the my django backend server. Here I do the authentication which works fine. I tested this by printing out the URL and I am authenticating the user and I am returning a 200 response if authenticated.

Ok cool. I expected now that my iframe would show on my website. But no, it does not. Instead I get a redirect to the grafana login screen.

Can nginx even do what I want?

My grafana.ini config is standard, I did not change much, but I set the auth.proxy to enabled:

#################################### Auth Proxy ##########################
[auth.proxy]
enabled = true
;header_name = X-WEBAUTH-USER
;header_property = username
auto_sign_up = true
;sync_ttl = 60
;whitelist = XXX, XXX
;headers = Email:X-User-Email, Name:X-User-Name
# Non-ASCII strings in header values are encoded using quoted-printable encoding
;headers_encoded = false
# Read the auth proxy docs for details on what the setting below enables
;enable_login_token = false

Any help is appreciated. Thanks in advance

I read in the "Grafana documentation / Set up / Configure security / Configure authentication / Auth proxy"

# HTTP Header name that will contain the username or email
header_name = X-WEBAUTH-USER

In other words, for Grafana's auth proxy feature to work, it expects to see a specific header with the username in it. That header is defined by the header_name in the grafana.ini file.

But in your case, that header_name is commented out in your grafana.ini file. Also, there is no setting for header_name in your Nginx configuration. So, it is likely Grafana does not know where to look for the username... which makes it redirect to the login screen.

Try and add header_name back to the grafana.ini and set it to something like X-WEBAUTH-USER or any header name of your choice. See "Single sign-on authentication on Django and Grafana" as an illustration.

Then, in your Nginx configuration (in the /iframe location block), you need to set this header with proxy_set_header and pass it along to Grafana. Your Django app should return this header after a successful authentication, and Nginx should pick it up and pass it along.

server {
    server_name  grafana.myserver.com;
     
    location / {
        proxy_set_header Host $host;
        proxy_pass           http://localhost:3000/;
        proxy_set_header X-Real-IP $remote_addr;
    }

    location ~ ^/iframe(.*)$ {
      auth_request /iframe-auth;
      set $iframe_url http://localhost:3000$1$is_args$args;
        proxy_pass $iframe_url;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Authorization $http_authorization;
        proxy_set_header X-WEBAUTH-USER $http_x_webauth_user;
    }

    location = /iframe-auth {
        internal;
        proxy_pass https://blub.de/auth/check/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Original-URI $request_uri;
    }

}

You should replace X-WEBAUTH-USER and $http_x_webauth_user with the actual header name and value from the authenticated request if they are different.

The proxy_set_header X-WEBAUTH-USER $http_x_webauth_user; line tells Nginx to take the X-WEBAUTH-USER header from the incoming request and pass it along to Grafana.

Make sure that your Django app returns this header with the username after a successful authentication.
See for instance the Django view also mentioned in "Single sign-on authentication on Django and Grafana" (already mentioned above).