diff --git a/shinyproxy/nginx.default.conf.j2 b/shinyproxy/nginx.default.conf.j2 index 0ed431d..3f6a56a 100644 --- a/shinyproxy/nginx.default.conf.j2 +++ b/shinyproxy/nginx.default.conf.j2 @@ -36,18 +36,22 @@ server { js_content pep.enforce; } -# location /gcube_user_info { -# internal; -# gunzip on; -# proxy_method GET; -# proxy_http_version 1.1; -# proxy_set_header gcube-token "$auth_token"; -# proxy_pass https://api.d4science.org/rest/2/people/profile; -# -# proxy_cache social_cache; -# proxy_cache_key $auth_token; -# } - + location /jwt_verify_request { + internal; + gunzip on; + proxy_method POST; + proxy_http_version 1.1; + proxy_set_header Authorization {{ keycloak_auth_credentials_prod }}; + proxy_set_header Content-Type "application/x-www-form-urlencoded"; + proxy_pass https://{{ keycloak_auth_server }}/auth/realms/d4science/protocol/openid-connect/token/introspect; + proxy_cache token_responses; # Enable caching + proxy_cache_key $source_auth; # Cache for each source authentication + proxy_cache_lock on; # Duplicate tokens must wait + proxy_cache_valid 200 10s; # How long to use each response + proxy_ignore_headers Cache-Control Expires Set-Cookie; + } + + location /_backend { internal; proxy_read_timeout 300;