Fix comment

Author: lcrilly

frontend.conf

@@ -33,7 +33,7 @@ server {
     subrequest_output_buffer_size 32k; # To fit a complete tokenset response
 
     set $oidc_jwt_keyfile     /etc/nginx/my_idp_jwk.json; # URL when using 'auth_jwt_key_request'
-    set $oidc_logout_redirect "/_logout"; Where to send browser after requesting /logout location
+    set $oidc_logout_redirect "/_logout"; # Where to send browser after requesting /logout location
     set $oidc_authz_endpoint  "http://127.0.0.1:8080/auth/realms/master/protocol/openid-connect/auth";
     set $oidc_token_endpoint  "http://127.0.0.1:8080/auth/realms/master/protocol/openid-connect/token";
     set $oidc_client          "my-client-id";

frontend.conf~

@@ -0,0 +1,63 @@
+# This is the backend application we are protecting with OpenID Connect
+upstream my_backend {
+    zone my_backend 64k;
+    server 10.0.0.1:80;
+}
+
+# Custom log format to include the 'sub' claim in the REMOTE_USER field
+log_format main_jwt '$remote_addr - $jwt_claim_sub [$time_local] "$request" $status '
+                    '$body_bytes_sent "$http_referer" "$http_user_agent" "$http_x_forwarded_for"';
+
+# JavaScript code for OpenID Connect
+js_include conf.d/openid_connect.js;
+js_set $requestid_hash hashRequestId;
+
+keyval_zone zone=opaque_sessions:1M state=conf.d/opaque_sessions.json timeout=1h; # CHANGE timeout to JWT/exp validity period
+keyval_zone zone=refresh_tokens:1M  state=conf.d/refresh_tokens.json  timeout=8h; # CHANGE timeout to refresh validity period
+
+keyval $cookie_auth_token $session_jwt zone=opaque_sessions;  # Exchange cookie for JWT
+keyval $cookie_auth_token $refresh_token zone=refresh_tokens; # Exchange cookie for refresh token
+keyval $request_id $new_session zone=opaque_sessions; # For initial session creation
+keyval $request_id $new_refresh zone=refresh_tokens;  # "
+
+# JWK Set will be fetched from $oidc_jwks_uri and cached here - ensure writable by nginx user
+proxy_cache_path /var/cache/nginx/jwk levels=1 keys_zone=jwk:64k max_size=1m;
+
+# The frontend server - reverse proxy with OpenID Connect authentication
+#
+server {
+    include conf.d/openid_connect.server_conf; # Authorization code flow and Relying Party processing
+
+    # OpenID Connect Provider (IdP) configuration
+    resolver 8.8.8.8; # For DNS lookup of IdP endpoints;
+    subrequest_output_buffer_size 32k; # To fit a complete tokenset response
+
+    set $oidc_jwt_keyfile     /etc/nginx/my_idp_jwk.json; # URL when using 'auth_jwt_key_request'
+    set $oidc_logout_redirect "/_logout"; Where to send browser after requesting /logout location
+    set $oidc_authz_endpoint  "http://127.0.0.1:8080/auth/realms/master/protocol/openid-connect/auth";
+    set $oidc_token_endpoint  "http://127.0.0.1:8080/auth/realms/master/protocol/openid-connect/token";
+    set $oidc_client          "my-client-id";
+    set $oidc_client_secret   "my-client-secret";
+    set $oidc_hmac_key        "ChangeMe"; # This should be unique for every NGINX instance/cluster
+
+    listen 8010; # Use SSL/TLS in production
+    
+    location / {
+        # This site is protected with OpenID Connect
+        auth_jwt "" token=$session_jwt;
+        auth_jwt_key_file $oidc_jwt_keyfile; # Enable when using filename
+        #auth_jwt_key_request /_jwks_uri; # Enable when using URL
+
+        # Absent/invalid OpenID Connect token will (re)start auth process (including refresh)
+        error_page 401 @oidc_auth;
+
+        # Successfuly authenticated users are proxied to the backend,
+        # with 'sub' claim passed as HTTP header
+        proxy_set_header username $jwt_claim_sub;
+        proxy_pass http://my_backend; # The backend site/app
+        
+        access_log /var/log/nginx/access.log main_jwt;
+    }
+}
+
+# vim: syntax=nginx