Skip to content

Instantly share code, notes, and snippets.

@javabrett

javabrett/README.md

Last active March 12, 2023 20:54
Show Gist options
  • Save javabrett/86e1365fd648165575a75d531b525e98 to your computer and use it in GitHub Desktop.
Save javabrett/86e1365fd648165575a75d531b525e98 to your computer and use it in GitHub Desktop.
Download ZIP
nginx proxy config to convert all POSTs to GETs, forward to 169.254.169.254:80, add header Metadata=true
Raw
README.md

This nginx.conf can be used to convert an OAuth2 / OIDC client_credentials POST request (e.g. from am application) into the form required by Azure Managed Identities tokenss issued by the Azure Instance Metadata Service (IMDS).

IMDS presents a non-standard interface for OAuth - namely:

  • It only accepts HTTP GETs, not POSTs as is required for client_credentials.
  • It doesn't require the normal HTTP BASIC credentials presented, but these are safely ignored.
  • It requires a static HTTP request header Metadata=true.

This config proxies these requests, makes the above changes and forwards to local IMDS on 169.254.169.254:80.

Raw
nginx.conf
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log debug;
pid /var/run/nginx.pid;
events {
worker_connections 16;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
keepalive_timeout 65;
upstream metadata {
server 169.254.169.254:80;
}
server {
listen 80;
location / {
proxy_pass http://metadata;
proxy_method GET;
proxy_set_header Metadata true;
proxy_set_body "";
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment