archiecobbs/mod-authn-otp

use mod-authn-otp with aws ALB

cleonte opened this issue · 8 comments

cleonte commented

Hi,

i would like to use mod otp with AWS ALB (aplication load balancer), but i can't since i see in the logs the ip of the load balacner instead of the ip of the client, any workaround for this?

Cheers

tessus commented

This is a very good question, since it also applies to reverse proxy setups.
I am also interested in the answer. ;-)

archiecobbs commented

I'm not sure I'm understanding the problem... you say:

i see in the logs the ip of the load balacner instead of the ip of the client

How does this prevent you from using the module?

cleonte commented

the thing is, my config works like this

for people with some ip we asked them for otp and for people with trusted ip we don't ask for OTP,

and since in apache we will see only load balancer ip we can't distinguish between real people and the load balancer

Cheers

tessus commented

@cleonte in this case you have to add X-Forward* headers on the load balancer...

cleonte commented

and i ca use it on the otp module?

archiecobbs commented

The X-Forwarded-For header is likely already being added by the load balancer. Check your AWS docs.

@cleonte I'm pretty sure you can configure Apache to only apply OTP authentication if the X-Forwarded-For header doesn't match some regular expression.

cleonte commented

thank you for your help, will try to see if i can use that