{"id":22733818,"url":"https://github.com/angelogalav/nginx-opa-authz","last_synced_at":"2026-04-24T16:40:01.526Z","repository":{"id":156186743,"uuid":"481181868","full_name":"AngeloGalav/NGINX-OPA-Authz","owner":"AngeloGalav","description":"Proof of concept for using OpenPolicyAgent as an authorization layer.","archived":false,"fork":false,"pushed_at":"2023-01-05T15:34:23.000Z","size":205,"stargazers_count":2,"open_issues_count":0,"forks_count":1,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-03-30T02:11:28.514Z","etag":null,"topics":["authorization","nginx","openpolicyagent","policy","rego"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/AngeloGalav.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-04-13T11:06:09.000Z","updated_at":"2024-10-18T14:49:15.000Z","dependencies_parsed_at":null,"dependency_job_id":"484e1577-90ab-4a73-96dc-f95a6999e15e","html_url":"https://github.com/AngeloGalav/NGINX-OPA-Authz","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/AngeloGalav/NGINX-OPA-Authz","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AngeloGalav%2FNGINX-OPA-Authz","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AngeloGalav%2FNGINX-OPA-Authz/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AngeloGalav%2FNGINX-OPA-Authz/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AngeloGalav%2FNGINX-OPA-Authz/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/AngeloGalav","download_url":"https://codeload.github.com/AngeloGalav/NGINX-OPA-Authz/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AngeloGalav%2FNGINX-OPA-Authz/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32231602,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-24T13:21:15.438Z","status":"ssl_error","status_checked_at":"2026-04-24T13:21:15.005Z","response_time":64,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authorization","nginx","openpolicyagent","policy","rego"],"created_at":"2024-12-10T20:16:19.228Z","updated_at":"2026-04-24T16:40:01.504Z","avatar_url":"https://github.com/AngeloGalav.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Using OPA as an auth server with NGINX\nProof of concept for using OpenPolicyAgent as an _Authorization_ server.\nThis configuration uses NGINX as both the service server and reverse proxy, and uses NGINX's `auth_request` directive in order to pass the authorization request to OPA.\n\nIncludes SSL support using dummy certs from INFN CNAF.\n\nYou can find another implementation of the proposed PoC using a sidecar [here](https://github.com/AngeloGalav/NGINX-OPA-Authz/tree/sidecar_version).\n\n## Architecture\nThis scheme follows a simple user request using our system\n\n```\n                      |\n                      |                       +------------------+\n                      |                       |                  |\n                      |                       |  OPA Authz       |\n                      |             +---------+  Server          |\n                      |             |         |                  |\n                      |             | +-------+                  |\n              +-------+----+        | |       +------------------+\n              |            |   2    | |\n     1        |  Reverse   +--------+ |\n-------------\u003e|  Proxy     |          |3\n              |            +----------+\n\u003c-------------+            |\n      6       |            +--------------------+\n              +--------+---+         4          |\n                       |  ^                     |\n                       |  |                     v\n                       |  |                    +----------------+\n                       |  |        5           |                |\n                       |  +--------------------+  Service       |\n                       |                       |  Server        |\n                       |                       |                |\n                       |                       +----------------+\n                       |\n                       |\n```\n\n1. The user makes a request through the frontend/debug_requester. **BEWARE**: the user must already be authenticated.  \n2. NGINX reverse proxy processes the request, and sends it to OPA\n3. OPA makes a decision using its rules and data, and sends it to the Reverse Proxy\n4. NGINX then receives the data coming from OPA and processes it:\n* If `allow != true`, then NGINX forbids the request to continue further, and sends code 403 to the requesting user.\n* Else, if `allow == true`, NGINX forwards the request to the Service Server. \n5. (and 6) If the Service Server returns a response, it goes through the Reverse Proxy and gets returned to the server. \n\n## How to use\n\nBefore you start using this infrastructure, you'll need to add the `servicecnaf.test.example` host into `/etc/hosts` of your PC: \n```\n127.0.0.1  localhost servicecnaf.test.example\n``` \n\nRight after that, you can use the following commands in order to start the Docker containers\n```bash\nsudo docker-compose up\n```\nYou can access the frontend of this project (and test it) by connecting to `https://servicecnaf.test.example:8081/` with a web browser.\n\nA bash tester is also available, but it's incomplete (_you can always make the curls to the reverse-proxy yourself though_). You can check it out in the `debug_requester` folder.\nThe `debug_requester` can be used by using this command: \n```\n./debug_requester/requester_test.sh [role] [operation]\n```\n\nHere's an example of the `debug_requester` of a working debug requester: \n```\n./debug_requester/requester_test.sh banned submit\n```\n\nAs of right now, the available roles and operations used for testing can be found in the json file at the location `opa/data.json`.\nThe best way to test the JWT functionality is to use the provided frontend. \n\n## SSL Disclaimer\nSince the service uses dummy certificates made for testing, your browser may tell you that a certificate may be invalid/the CA cannot be trusted. \nThis is normal and caused by the igi-ca certificates which are, in fact, made for testing purposes only. \n\n## Some useful resources\n- [auth_request explanation](https://redbyte.eu/en/blog/using-the-nginx-auth-request-module/)\n- [Similar Github repository](https://github.com/summerwind/opa-nginx-rbac)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fangelogalav%2Fnginx-opa-authz","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fangelogalav%2Fnginx-opa-authz","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fangelogalav%2Fnginx-opa-authz/lists"}