Allow ACL Token to be provided by a Reverse Proxy

[legege]

Proposal

It would be useful to allow a Reverse Proxy to set the Nomad ACL Token via the header X-Nomad-Token.

Use-cases

Allowing a Reverse Proxy to inject this ACL Token can help to implement some login flow with 3rd party SSO. Consul does support that today.

The idea is also mentioned in this comment (issue #6054).

Attempted Solutions

• With current version (1.0 or 1.1 beta), when you configure the Reverse Proxy to inject this header, most of the UI features work: jobs listing, servers/clients listing, etc. But some features are not working properly (e.g. the "Run job" button is greyed out).
• With the new One-Time Token feature introduced in 1.1, it would probably be easy to implement such feature, as there is already a UI flow to get a token and start using it in the UI. We simply need the UI to be aware that a token is provided.

References

• Configure NGINX Reverse Proxy for Nomad's Web UI

[tgross]

Thanks for opening this issue @legege! I've assigned this to @backspace so that once we review that PR we can determine whether that really closes out the issue described here.

[legege]

@tgross Anything I can do to help the discussion here for PR #10563?

[tgross]

Sorry @legege, we're in the middle of onboarding some folks onto the UI side of the team and that's creating a bit of delay there. I've changed the reviewer and pulled in one of our product security folks for review as well.

[tfeyereisen-exactsciences]

We use enterprise versions of Nomad, Vault, Consul and Terraform. Currently Nomad is the only product that doesnt support SSO. Our current Nomad authentication method is based on AWS credentials and reading from the Nomad secrets engine in Vault to obtain a short lived token. We have 100s of developers that we'd like to onboard to Nomad across some 15+ Nomad namespaces. In the end, we gain very little adoption from engineering teams because it's simply too inconvenient to navigate the authenticate workflow. We want our developers in Nomad, but we have to make it easy. This also goes for our operations teams. They should be comfortable getting into Nomad to potentially do first pass troubleshooting, restarting failed jobs, etc. It's hard to fathom integrating a product into an enterprise these days without SSO. We view Nomad as an enterprise product and need SSO to successfully integrate.

[josegonzalez]

Looks like #10563 potentially fixes this issue (though native integration with Okta would be great).

[lgfa29]

You are right @josegonzalez, this particular issue was fixed in #10563, so I am going to close this as fixed 🙂

@tfeyereisen-exactsciences SSO support is part of a larger discussion, so I created #10999 for us to track it. Feel free to 👍 and add any additional comments you may have.

[josegonzalez]

@legege do you happen to have an nginx conf or some similar thing that implements the auth reverse proxy flow for reference?

[github-actions]

I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.