菜单

11.1、Nginx反向代理集成（IDS6）

11.1、Nginx反向代理集成（IDS6）

适用IDS6

Nginx集成文件中需要按照新的nginx配置框架来存放，一般/opt/ids_nginx_config/vhosts_conf中存放amp.conf主文件，其他业务应用的文件存放在app_conf和app_upstream文件夹中

app_upstream路径：/opt/ids_nginx_config/vhosts_conf/app_location/qljfw_upstream.conf

nginx配置文件

upstream qljfw_server {

sticky;

server host:port;

}

log_format qljfw_server '$http_host $remote_addr [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_time $upstream_response_time';

app_location路径：/opt/ids_nginx_config/vhosts_conf/app_location/qljfw_location.conf

nginx配置文件

############允许跨域访问域名开始

map $http_origin $allow_origin {

##这里添加可信域名

~^https?://(.*\.)?wisedu.com(:\d+)?$ $http_origin;

default "";

}

############允许跨域访问域名结束

location /qljfwapp {

charset utf-8;

default_type text/plain;

set $pgt_need 0;

set $self_logout '1';

set $cookie_self_domain 1;

access_by_lua_file /opt/ids_nginx_config/lua/mod_cas.lua;

proxy_set_header X-Forwarded-Proto $scheme;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_pass http://qljfw_server;

############允许跨域访问域名开始

add_header Access-Control-Allow-Origin $allow_origin;

add_header Access-Control-Allow-Credentials true;

############允许跨域访问域名结束

}

location ~ /qljfwapp/.*\.(js|css|gif|jpg|jpeg|png|css|js|ico|xml|zip)$ {

charset utf-8;

default_type text/plain;

set $pgt_need 0;

set $cookie_self_domain 1;

set $self_logout 1;

access_by_lua_file /opt/ids_nginx_config/lua/mod_cas_anonymous.lua;

proxy_set_header X-Forwarded-Proto $scheme;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header REMOTE-HOST $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_pass http://qljfw_server;

}

location ~* /qljfwapp/sys/emapcomponent/file{

default_type text/plain;

access_by_lua_file /opt/ids_nginx_config/lua/mod_cas_anonymous.lua;

proxy_set_header X-Forwarded-Proto $scheme;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_pass http://qljfw_server;

}

注意：修改完Nginx文件，需要，重新加载一下Nginx文件。

nginx重载命令

service nginx reload

适用身份认证代理

Nginx集成文件中需要按照新的nginx配置框架来存放，一般/opt/pal_nginx_config/vhosts_conf中存放amp.conf主文件，其他业务应用的文件存放在app_conf和app_upstream文件夹中。

app_upstream路径：/opt/pal_nginx_config/vhosts_conf/app_upstream

app_upstream存放业务应用upstream及log_format头文件，每个server一个.conf文件，公共服务存放在app_upstream文件夹中名称一般为:qljfw_upstream.conf,文件内容如图所示：

nginx配置文件

upstream qljfw_server {

sticky;

server host:port;

}

log_format qljfw_server '$http_host $remote_addr [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_time $upstream_response_time';

app_location路径：/opt/pal_nginx_config/vhosts_conf/app_location

app_location存放业务应用location文件，每个server中location的.conf，公共服务存放在app_location文件夹中名称一般为:qljfw_location.conf,文件内容如图所示：

nginx配置文件

location /qljfwapp {

charset utf-8;

default_type text/plain;

set $pgt_need 0;

set $self_logout '1';

set $cookie_self_domain 1;

access_by_lua_file /opt/pal_nginx_config/lua/auth_proxy.lua;

proxy_set_header X-Forwarded-Proto $scheme;

proxy_set_header Host $host;