11.2、Nginx反向代理集成（IDS7）

Nginx集成文件中需要按照新的nginx配置框架来存放，一般/opt/ids_nginx_config/vhosts_conf中存放casp_http.conf主文件，其他业务应用的文件存放在app_conf和app_upstream文件夹中

app_upstream路径：/opt/ids_nginx_config/vhosts_conf/app_location/qljfw_upstream.conf

nginx配置文件：

upstream qljfw_server { sticky; server host:port; server host:port; } log_format qljfw_server '$http_host $remote_addr [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_time $upstream_response_time';

app_location路径：/opt/ids_nginx_config/vhosts_conf/app_location/qljfw_location.conf

nginx配置文件：

###########允许跨域访问域名开始 map $http_origin $allow_origin { ##这里添加可信域名 ~^https?://(.*\.)?wisedu.com(:\d+)?$ $http_origin; default ""; } ############允许跨域访问域名结束 location /qljfwapp { charset utf-8; default_type text/plain; set $pgt_need 0; set $self_logout '1'; set $cookie_self_domain 1; access_by_lua_file /opt/ids_nginx_config/lua/mod_cas.lua; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass http://qljfw_server; ############允许跨域访问域名开始 add_header Access-Control-Allow-Origin $allow_origin; add_header Access-Control-Allow-Credentials true; ############允许跨域访问域名结束 } location ~ /qljfwapp/.*\.(js|css|gif|jpg|jpeg|png|css|js|ico|xml|zip)$ { charset utf-8; default_type text/plain; set $pgt_need 0; set $cookie_self_domain 1; set $self_logout 1; access_by_lua_file /opt/ids_nginx_config/lua/mod_cas_anonymous.lua; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header REMOTE-HOST $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass http://qljfw_server; } location ~* /qljfwapp/sys/emapcomponent/file{ default_type text/plain; access_by_lua_file /opt/ids_nginx_config/lua/mod_cas_anonymous.lua; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass http://qljfw_server; }

【重要】注意修改casp_http.conf，追加在配置文件中末尾处

################################################## ## IDS配置 ################################################## location = /proxytgt { default_type text/plain; content_by_lua_file /opt/ids_nginx_config/lua/tgtProxy.lua; } location = /env { default_type text/plain; content_by_lua_file /opt/ids_nginx_config/lua/env.lua; } location /proxywithport/ { internal; rewrite ^/proxywithport/(http|https)/([^/]+)/(\d+)/(.*) /$4 break; proxy_pass $1://$2:$3; } location /proxy/ { internal; rewrite ^/proxy/(http|https)/([^/]+)/(.*) /$3 break; proxy_pass $1://$2; }

注意：修改完Nginx文件，需要，重新加载一下Nginx文件。

nginx重载命令：service nginx reload

如IDS7 集成中仍遇到问题，请参考以下文档：

请至钉钉文档查看附件《CIAP-常见问题复盘（六）.pptx》

适用身份认证代理

Nginx集成文件中需要按照新的nginx配置框架来存放，一般/opt/pal_nginx_config/vhosts_conf中存放casp_http.conf主文件，其他业务应用的文件存放在app_conf和app_upstream文件夹中。

app_upstream路径：/opt/pal_nginx_config/vhosts_conf/app_upstream

app_upstream存放业务应用upstream及log_format头文件，每个server一个.conf文件，公共服务存放在app_upstream文件夹中名称一般为:qljfw_upstream.conf,文件内容如图所示：

nginx配置文件：

upstream qljfw_server { sticky; server host:port; server host:port; } log_format qljfw_server '$http_host $remote_addr [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_time $upstream_response_time';

app_location路径：/opt/pal_nginx_config/vhosts_conf/app_location

app_location存放业务应用location文件，每个server中location的.conf，公共服务存放在app_location文件夹中名称一般为:qljfw_location.conf,文件内容如图所示：

nginx配置文件：

location /qljfwapp { charset utf-8; default_type text/plain; set $pgt_need 0; set $self_logout '1'; set $cookie_self_domain 1; access_by_lua_file /opt/pal_nginx_config/lua/auth_proxy.lua; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass http://qljfw_server; } location ~ /qljfwapp/.*\.(js|css|gif|jpg|jpeg|png|css|js|ico|xml|zip)$ { charset utf-8; default_type text/plain; set $pgt_need 0; set $cookie_self_domain 1; set $self_logout 1; access_by_lua_file /opt/pal_nginx_config/lua/auth_anonymous.lua; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header REMOTE-HOST $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass http://qljfw_server; } location ~* /qljfwapp/sys/emapcomponent/file{ default_type text/plain; access_by_lua_file /opt/pal_nginx_config/lua/auth_anonymous.lua; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass http://qljfw_server; }

注意：修改完Nginx文件，需要service nginx reload，重新加载一下Nginx文件。

11、身份认证集成对接