Proposal: Add info about SERVER_USEFORWARDHEADERS to SSO guide

[clocklear]

Is your proposal related to a problem?

I recently set up kafka-ui with MSK in ECS on AWS with the intent of using SSO with Auth0 to secure the application. I am terminating SSL on the load balancer; connections between the load balancer and the kafka-ui container are HTTP. Following the SSO guide, I set up only the environment variables that were relevant to SSO:

AUTH_ENABLED=true
SECURITY_BASIC_ENABLED=true
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_CLIENTID=uhvaPKIHU4ZF8Ne4B6PGvF0hWW6OcUSB
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_CLIENTSECRET=YXfRjmodifiedTujnkVr7zuW9ECCAK4TcnCio-i
SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_AUTH0_ISSUER_URI=https://dev-a63ggcut.auth0.com/

However, what I observed is that the redirect URI that was formed by the application and passed to Auth0 used the HTTP scheme instead of HTTPS, ostensibly because the connection between the LB and the app is non-TLS.

Describe the solution you'd like

After digging through a few articles online (and deducing that Spring Security is being used to facilitate authN/Z), I found that there is a Spring setting that must be enabled in my particular configuration that causes Spring to use the X-Forwarded-For headers to determine the originating scheme in order to form the correct redirect URI to pass to Auth0. By setting SERVER_USEFORWARDHEADERS to true, the application now properly handles my SSO authentication with Auth0. I propose that the SSO guide be augmented in such a way to call out the scenario in which SSL is terminated prior to the application (such as on a load balancer), the app may need to be configured to respect the X-Forwarded-For headers (which is apparently not the default).

(tl;dr -- the docs for SSO should suggest setting SERVER_USEFORWARDHEADERS to true when TLS is terminated by a proxy.)

Describe alternatives you've considered

None.

Additional context

More info can be found in this SO answer: https://stackoverflow.com/a/40879393

[Haarolean]

Hi, thank you for the feedback (and contribution). We'll reflect the changes in the documentation soon.

[Haarolean]

Thanks once again, done.

[clocklear]

Thanks @Haarolean . I hate to be a PITA, but a few days ago I attempted to deploy the latest build of master and this guidance was no longer working for me. Digging deeper, it appears as if the server.use-forward-headers option was deprecated in Spring Boot 2.2 (and my guess is that kafka-ui has recently updated to a version of Spring Boot that finally has removed the setting).

The guidance from that project now is to use server.forward-headers-strategy=native, which would be setting SERVER_FORWARDHEADERSSTRATEGY=native in this project.

See https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-2.2-Release-Notes#deprecations-in-spring-boot-22.

[Haarolean]

@clocklear hey, yeah, we've updated boot some time ago. Thanks for this information, I'll update the docs.