add host config to solve the issuer not match problem when oidc server behind a revers proxy

README.md

@@ -82,6 +82,7 @@ You also need to set the `KONG_PLUGINS` environment variable
 | `config.bearer_only` | no | false | Only introspect tokens without redirecting |
 | `config.realm` | kong | false | Realm used in WWW-Authenticate response header |
 | `config.logout_path` | /logout | false | Absolute path used to logout from the OIDC RP |
+| `host` | no | false | host when request oidc server |
 
 ### Enabling
 

kong-oidc-1.1.0-0.rockspec

@@ -22,7 +22,7 @@ description = {
     license = "Apache 2.0"
 }
 dependencies = {
-    "lua-resty-openidc ~> 1.6.1-1"
+    "lua-resty-openidc ~> 1.7.2-1"
 }
 build = {
     type = "builtin",

kong/plugins/oidc/schema.lua

@@ -18,6 +18,7 @@ return {
     recovery_page_path = { type = "string" },
     logout_path = { type = "string", required = false, default = '/logout' },
     redirect_after_logout_uri = { type = "string", required = false, default = '/' },
-    filters = { type = "string" }
+    filters = { type = "string" },
+    host ={ type = "string", required = false}
   }
 }

kong/plugins/oidc/utils.lua

@@ -40,6 +40,16 @@ function M.get_redirect_uri_path(ngx)
 end
 
 function M.get_options(config, ngx)
+  local function add_host(req)
+    local host= config.host
+    if host then
+      local h = req.headers or {}
+      h['host'] = host
+      req.headers = h
+    end
+    return req
+  end
+
   return {
     client_id = config.client_id,
     client_secret = config.client_secret,
@@ -58,6 +68,7 @@ function M.get_options(config, ngx)
     filters = parseFilters(config.filters),
     logout_path = config.logout_path,
     redirect_after_logout_uri = config.redirect_after_logout_uri,
+    http_request_decorator= add_host,
   }
 end
 
@@ -96,4 +107,4 @@ function M.has_bearer_access_token()
   return false
 end
 
-return M
+return M