# Authorization per Sitemap via Reverse Proxy and Custom Router **URL:** \ **Category:** Solutions\ **Tags:** authentication, reverseproxy, authorization\ **Created:** [December 23, 2018, 1:49pm UTC](https://community.openhab.org/t/authorization-per-sitemap-via-reverse-proxy-and-custom-router/60848 "2018-12-23T13:49:44Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![milford](https://community.openhab.org/user_avatar/community.openhab.org/milford/32/24628_2.png) [@milford](https://community.openhab.org/u/milford)\ **Post date:** [December 23, 2018, 1:49pm UTC](https://community.openhab.org/t/authorization-per-sitemap-via-reverse-proxy-and-custom-router/60848/1 "2018-12-23T13:49:44Z")
Hello everyone, I’d like to share my [open-source solution to authorization per sitemap for multiple users in openHAB2](https://github.com/hendrikmaus/openhab-auth-router). My concept was developed with the [sidecar pattern](https://www.oreilly.com/library/view/designing-distributed-systems/9781491983638/ch02.html) in mind and assuming that the traffic towards openHAB2 is controlled by a layer 4 proxy, e.g. [nginx](https://www.nginx.com/) or [envoy proxy](https://www.envoyproxy.io/). The [openhab-auth-router](https://github.com/hendrikmaus/openhab-auth-router) inspects a header, set by the proxy in front of openHAB, containing the authenticated user and applies its configured rules on the traffic. The router itself does not do authentication, only authorization. Typical use case description: You run openHAB2 behind nginx with HTTP basic authentication enabled. Now you want to decide, which of the created users can access the sitemaps in openHAB. So you have nginx covering authentication and can now use [openhab-auth-router](https://github.com/hendrikmaus/openhab-auth-router) as an authorization sidecar to your openHAB2 instance. It intercepts the traffic and applies a given set of rules. This can be achieved simply by telling nginx to route all requests to the auth-router instead of openHAB directly. The router comes as pre-compiled binary for multiple architectures and as docker image. I created guides on how to deploy using vanilla binary, vanilla binary managed by systemd, docker, docker managed by systemd and Kubernetes. All of these can be found in the project [README.md](https://github.com/hendrikmaus/openhab-auth-router). The readme also comes with a guide on how to integrate the router into a running setup. First as pure passthrough, then with an applied ruleset. Furthermore, you can try the router outside of a running setup entirely, by using the [docker based examples](https://github.com/hendrikmaus/openhab-auth-router/tree/master/examples), which are also handy if you’d like to contribute to the golang source. I have been running the v0.0.1-alpha in production for a couple of weeks now and haven’t had any incidents yet. My setup runs on Kubernetes. ---
**Author:** ![Dim](https://community.openhab.org/user_avatar/community.openhab.org/dim/32/4568_2.png) [@Dim](https://community.openhab.org/u/Dim)\ **Post date:** [December 24, 2018, 4:44am UTC](https://community.openhab.org/t/authorization-per-sitemap-via-reverse-proxy-and-custom-router/60848/2 "2018-12-24T04:44:13Z")
> [@milford](#): > > This can be achieved simply by telling nginx to route all requests to the auth-router instead of openHAB directly. nice setup (and documentation)! Check also: [Introduce Basic Auth on HTTP server · Issue #791 · openhab/openhab-distro · GitHub](https://github.com/openhab/openhab-distro/issues/791) ---
**Author:** ![milford](https://community.openhab.org/user_avatar/community.openhab.org/milford/32/24628_2.png) [@milford](https://community.openhab.org/u/milford)\ **Post date:** [December 24, 2018, 9:59am UTC](https://community.openhab.org/t/authorization-per-sitemap-via-reverse-proxy-and-custom-router/60848/3 "2018-12-24T09:59:41Z")
Thank you, I am also looking forward to the native implementation. ---
**Author:** ![rlkoshak](https://community.openhab.org/user_avatar/community.openhab.org/rlkoshak/32/75251_2.png) [@rlkoshak](https://community.openhab.org/u/rlkoshak)\ **Post date:** [December 25, 2018, 2:22am UTC](https://community.openhab.org/t/authorization-per-sitemap-via-reverse-proxy-and-custom-router/60848/4 "2018-12-25T02:22:50Z")
I’ve always said this was theoretically possible but never had time to figure it out on my own. Thanks for posting! Great writeup! ---
**Author:** ![p0llux](https://community.openhab.org/letter_avatar_proxy/v4/letter/p/919ad9/32.png) [@p0llux](https://community.openhab.org/u/p0llux)\ **Post date:** [January 3, 2019, 8:43am UTC](https://community.openhab.org/t/authorization-per-sitemap-via-reverse-proxy-and-custom-router/60848/5 "2019-01-03T08:43:34Z")
Hi, do you have apache configuration? ---
**Author:** ![milford](https://community.openhab.org/user_avatar/community.openhab.org/milford/32/24628_2.png) [@milford](https://community.openhab.org/u/milford)\ **Post date:** [January 3, 2019, 1:17pm UTC](https://community.openhab.org/t/authorization-per-sitemap-via-reverse-proxy-and-custom-router/60848/6 "2019-01-03T13:17:28Z")
I do not provide an example Apache config; contributions are most welcome though. ---
**Author:** ![svensven](https://community.openhab.org/user_avatar/community.openhab.org/svensven/32/37146_2.png) [@svensven](https://community.openhab.org/u/svensven)\ **Post date:** [May 5, 2019, 12:49pm UTC](https://community.openhab.org/t/authorization-per-sitemap-via-reverse-proxy-and-custom-router/60848/7 "2019-05-05T12:49:08Z")
This Apache config worked for me: ```auto ProxyPass / http://ip_of_your_device:9090/ ProxyPassReverse / http://ip_of_your_device:9090/ AuthType Basic AuthName "OpenHab2 Restricted" AuthUserFile /etc/apache2/.htpasswd Require valid-user RequestHeader set X-Forwarded-Username expr=%{REMOTE_USER} ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined ``` ---
**Author:** ![milford](https://community.openhab.org/user_avatar/community.openhab.org/milford/32/24628_2.png) [@milford](https://community.openhab.org/u/milford)\ **Post date:** [May 5, 2019, 3:24pm UTC](https://community.openhab.org/t/authorization-per-sitemap-via-reverse-proxy-and-custom-router/60848/8 "2019-05-05T15:24:09Z")
Thanks, I will add it to the project on GitHub as well. ---
**Author:** ![svensven](https://community.openhab.org/user_avatar/community.openhab.org/svensven/32/37146_2.png) [@svensven](https://community.openhab.org/u/svensven)\ **Post date:** [February 18, 2020, 1:47pm UTC](https://community.openhab.org/t/authorization-per-sitemap-via-reverse-proxy-and-custom-router/60848/9 "2020-02-18T13:47:57Z")
Sadly, the router does not work anymore for me since openHAB 2.5 (every user can access everything). Can anyone verify? Do you have plans to update the program? ---
**Author:** ![milford](https://community.openhab.org/user_avatar/community.openhab.org/milford/32/24628_2.png) [@milford](https://community.openhab.org/u/milford)\ **Post date:** [February 18, 2020, 7:10pm UTC](https://community.openhab.org/t/authorization-per-sitemap-via-reverse-proxy-and-custom-router/60848/10 "2020-02-18T19:10:12Z")
Hey, thanks for reaching out. I did not update to 2.5 myself yet, but I will work on the tool to support it. ---
**Author:** ![milford](https://community.openhab.org/user_avatar/community.openhab.org/milford/32/24628_2.png) [@milford](https://community.openhab.org/u/milford)\ **Post date:** [February 18, 2020, 7:28pm UTC](https://community.openhab.org/t/authorization-per-sitemap-via-reverse-proxy-and-custom-router/60848/11 "2020-02-18T19:28:13Z")
I filed an issue for myself [Access limits are not enforced in front of OpenHAB 2.5.x · Issue #8 · hendrikmaus/openhab-auth-router · GitHub](https://github.com/hendrikmaus/openhab-auth-router/issues/8) Feel free to add any additional information you might have. ---
**Author:** ![svensven](https://community.openhab.org/user_avatar/community.openhab.org/svensven/32/37146_2.png) [@svensven](https://community.openhab.org/u/svensven)\ **Post date:** [February 20, 2020, 12:08pm UTC](https://community.openhab.org/t/authorization-per-sitemap-via-reverse-proxy-and-custom-router/60848/12 "2020-02-20T12:08:15Z")
That’s nice to hear. Thanks a lot for your work! Unfortunately, I cannot give more details than that users with restricted access get redirected to the standard " Welcome to openHAB 2" screen after login (where they can access anything). ---
**Author:** ![milford](https://community.openhab.org/user_avatar/community.openhab.org/milford/32/24628_2.png) [@milford](https://community.openhab.org/u/milford)\ **Post date:** [February 20, 2020, 8:49pm UTC](https://community.openhab.org/t/authorization-per-sitemap-via-reverse-proxy-and-custom-router/60848/13 "2020-02-20T20:49:50Z")
Unfortunately, I was not able to reproduce any issues with openHAB 2.5 and openhab-auth-router:0.0.1-alpha. The current tip of the master branch has updated examples to play with on your end. There is going to be a maintenance release anyway, updating to golang 1.13.8. To further investigate your problem now: - turn it off and on again \> re-check - ensure that `passthrough` in the config is set to `false` - ensure that your proxy (nginx?) is passing the traffic through the openhab-auth-router and not directly to openHAB - please post your command used to start openhab-auth-router - please post your full config for openhab-auth-router I realize that it currently is rather useless to enable debug logging, so I reckon I’ll add some more useful logs. Then we can update your setup and get more insight on what might be wrong. ---
**Author:** ![milford](https://community.openhab.org/user_avatar/community.openhab.org/milford/32/24628_2.png) [@milford](https://community.openhab.org/u/milford)\ **Post date:** [March 22, 2020, 2:38pm UTC](https://community.openhab.org/t/authorization-per-sitemap-via-reverse-proxy-and-custom-router/60848/14 "2020-03-22T14:38:20Z")
Working on the said maintenance release, I started covering the application with test cases and found a bug which might explain what you described, @svensven. When a known user comes in and the request URI is set to `""` (empty string) instead of `"/"`, it passed right through the proxy. Will release the fix soon. ---
**Author:** ![milford](https://community.openhab.org/user_avatar/community.openhab.org/milford/32/24628_2.png) [@milford](https://community.openhab.org/u/milford)\ **Post date:** [April 19, 2020, 11:26am UTC](https://community.openhab.org/t/authorization-per-sitemap-via-reverse-proxy-and-custom-router/60848/15 "2020-04-19T11:26:46Z")
Took me a little while longer, but here is the promised release: [Release v0.1.0-alpha · hendrikmaus/openhab-auth-router · GitHub](https://github.com/hendrikmaus/openhab-auth-router/releases/tag/v0.1.0-alpha) You can now use `-log-level debug` to get structured and helpful log output in order to narrow down issues. Please note: I detected that the app has a memory leak which may cause issues. The issue is tracked in [Metrics show an indicator for a memory leak · Issue #12 · hendrikmaus/openhab-auth-router · GitHub](https://github.com/hendrikmaus/openhab-auth-router/issues/12) ---
**Author:** ![svensven](https://community.openhab.org/user_avatar/community.openhab.org/svensven/32/37146_2.png) [@svensven](https://community.openhab.org/u/svensven)\ **Post date:** [April 23, 2020, 3:16pm UTC](https://community.openhab.org/t/authorization-per-sitemap-via-reverse-proxy-and-custom-router/60848/16 "2020-04-23T15:16:49Z")
Thank you for the update! Sorry, I saw your answer from February just now. I will download the new version and test again.