Add support for AWS App Load Balancer frontend as auth reverse proxy. #97

ktpedre · 2025-11-20T22:49:55Z

No description provided.

backend/core/auth.py

+import requests
+import base64
+import json
+import time


Copilot

Pull Request Overview

This PR adds support for AWS Application Load Balancer (ALB) as an authentication reverse proxy by implementing JWT validation for the x-amzn-oidc-data header. This expands the authentication options beyond simple header-based auth to support OIDC-compliant JWT tokens issued by AWS ALB, enabling secure authentication in AWS-hosted deployments.

Key changes:

Added new authentication flow for AWS ALB JWT tokens with signature validation against AWS public keys
Introduced configurable auth header types (email-string vs aws-alb-jwt) via AUTH_USER_HEADER_TYPE
Extended configuration to support AWS-specific settings (expected ALB ARN and region)

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 17 comments.

Show a summary per file

File	Description
docs/02_admin_guide.md	Documents AWS ALB authentication configuration with required environment variables
backend/modules/config/config_manager.py	Adds configuration fields for auth header type, AWS ALB ARN, and AWS region
backend/main.py	Passes new AWS configuration parameters to AuthMiddleware initialization
backend/core/middleware.py	Implements conditional authentication logic based on header type, routing to AWS ALB JWT validation when configured
backend/core/auth.py	Implements `get_user_from_aws_alb_jwt()` function to validate AWS ALB JWTs by fetching public keys and verifying signatures

Comments suppressed due to low confidence (1)

backend/core/auth.py:13

Import of 'time' is not used.

import time

Copilot · 2025-11-20T23:28:17Z

backend/core/auth.py

+import requests
+import base64
+import json
+import time


Unused import. The time module is imported but never used in the function. Remove the import to clean up the code.

Suggested change

import time

Copilot · 2025-11-20T23:28:18Z

backend/core/auth.py

+
+        # Step 3: Get the public key from the regional endpoint
+        url = f'https://public-keys.auth.elb.{aws_region}.amazonaws.com/{kid}'
+        req = requests.get(url)


Missing security: No timeout specified for external HTTP request. The requests.get() call should include a timeout to prevent the authentication from hanging indefinitely if AWS's public key endpoint is slow or unresponsive. Add a timeout parameter, e.g., requests.get(url, timeout=5.0).

Suggested change

req = requests.get(url)

req = requests.get(url, timeout=5.0)

Copilot · 2025-11-20T23:28:18Z

backend/core/auth.py

+
+        # Step 2: Validate the signer matches the expected ALB ARN
+        if received_alb_arn != expected_alb_arn:
+            print(f"Error: Invalid signer ARN. Expected {expected_alb_arn}, got {received_alb_arn}")


Use logger.error() instead of print() for error messages. The codebase uses structured logging throughout (see lines 48, 51 in the existing code), and error messages should be logged using the logger for consistency and proper log aggregation.

Copilot · 2025-11-20T23:28:18Z

backend/core/auth.py

+        print(f"Error: Invalid token - {e}")
+        return None
+    except requests.exceptions.RequestException as e:
+        print(f"Error fetching public key: {e}")


Use logger.error() instead of print() for error messages. This maintains consistency with the error logging patterns used throughout the codebase.

Copilot · 2025-11-20T23:28:18Z

backend/core/auth.py

+        print(f"Error fetching public key: {e}")
+        return None
+    except Exception as e:
+        print(f"An unexpected error occurred: {e}")


Use logger.error() instead of print() for error messages. All error messages should be logged consistently using the logger.

Copilot · 2025-11-20T23:28:20Z

backend/core/auth.py

+
+        # Step 3: Get the public key from the regional endpoint
+        url = f'https://public-keys.auth.elb.{aws_region}.amazonaws.com/{kid}'
+        req = requests.get(url)


Missing error handling for HTTP request failures. The requests.get() call at line 100 should check the response status code before using the text. If the public key fetch fails (e.g., 404, 500), pub_key will contain an error message instead of a valid key, causing JWT validation to fail silently. Add: req.raise_for_status() after line 100 to ensure proper error handling.

Suggested change

req = requests.get(url)

req = requests.get(url)

req.raise_for_status()

Copilot · 2025-11-20T23:28:20Z

backend/core/middleware.py

+                user_email = get_user_from_header(x_auth_header)
            else:
                # Get test user from config
                config_manager = app_factory.get_config_manager()
                user_email = config_manager.app_settings.test_user
            # logger.info(f"Debug mode: using user {user_email}")
        else:


Inconsistent authentication logic in debug mode. In debug mode (lines 93-95), the code uses get_user_from_header() regardless of the auth_header_type setting. This means AWS ALB JWT authentication cannot be tested in debug mode. Consider applying the same authentication type logic in debug mode to allow proper testing, or document that AWS ALB JWT authentication only works in production mode.

Suggested change

user_email = get_user_from_header(x_auth_header)

else:

# Get test user from config

config_manager = app_factory.get_config_manager()

user_email = config_manager.app_settings.test_user

# logger.info(f"Debug mode: using user {user_email}")

else:

if self.auth_header_type == "aws-alb-jwt":

user_email = get_user_from_aws_alb_jwt(x_auth_header, self.auth_aws_expected_alb_arn, self.auth_aws_region)

else:

user_email = get_user_from_header(x_auth_header)

else:

# Get test user from config

config_manager = app_factory.get_config_manager()

user_email = config_manager.app_settings.test_user

# logger.info(f"Debug mode: using user {user_email}")

Copilot · 2025-11-20T23:28:21Z

backend/core/auth.py

+        if email_address:
+            return email_address
+        else:
+            print("Error: 'email' claim not found in JWT payload.")


Use logger.error() instead of print() for error messages. This error logging should be consistent with the existing patterns in this module.

Copilot · 2025-11-20T23:28:21Z

backend/modules/config/config_manager.py

+        default="arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/your-alb-name/...",
+        description="The expected AWS ALB ARN",
+        validation_alias="AUTH_AWS_EXPECTED_ALB_ARN"
+    )
+


The default ARN value appears to be a placeholder and may cause confusion in production. Consider using an empty string as the default or adding validation that warns/errors if the default placeholder value is still in use when auth_header_type is set to aws-alb-jwt. This prevents accidental misconfigurations in production.

Suggested change

default="arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/your-alb-name/...",

description="The expected AWS ALB ARN",

validation_alias="AUTH_AWS_EXPECTED_ALB_ARN"

)

default="",

description="The expected AWS ALB ARN",

validation_alias="AUTH_AWS_EXPECTED_ALB_ARN"

)

def model_post_init(self, __context):

# Validate that if auth_user_header_type is aws-alb-jwt, ARN must be set and not placeholder

if self.auth_user_header_type == "aws-alb-jwt":

placeholder = "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/your-alb-name/..."

if not self.auth_aws_expected_alb_arn or self.auth_aws_expected_alb_arn == placeholder:

raise ValueError(

"auth_aws_expected_alb_arn must be set to a valid AWS ALB ARN when auth_user_header_type is 'aws-alb-jwt'. "

"Current value is empty or a placeholder."

)

Copilot · 2025-11-20T23:28:21Z

backend/core/middleware.py

        debug_mode: bool = False, 
        auth_header_name: str = "X-User-Email",
+        auth_header_type: str = "email-string",
+        auth_aws_expected_alb_arn: str = "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/your-alb-name/...",


The default ARN value in middleware matches the config default, which appears to be a placeholder. Consider using an empty string or None as default in the middleware signature to make it clearer that this value should come from configuration, not hardcoded defaults.

ktpedre added 3 commits November 20, 2025 14:36

WIP: adding support for AWS Application Load Balancer JWT auth

90d742e

fixup code bugs

c85c720

code bug fixup

047ccf7

github-advanced-security bot found potential problems Nov 20, 2025

View reviewed changes

backend/core/auth.py

import requests

import base64

import json

import time

Check notice

Code scanning / CodeQL

Unused import Note

Import of 'time' is not used.

fixup split on none bug

0e9e7e3

garland3 requested a review from Copilot November 20, 2025 23:22

Copilot started reviewing on behalf of garland3 November 20, 2025 23:22 View session

Copilot finished reviewing on behalf of garland3 November 20, 2025 23:25

Copilot AI reviewed Nov 20, 2025

View reviewed changes

garland3 merged commit 0e9e7e3 into sandialabs:main Nov 21, 2025
13 of 15 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add support for AWS App Load Balancer frontend as auth reverse proxy. #97

Add support for AWS App Load Balancer frontend as auth reverse proxy. #97

ktpedre commented Nov 20, 2025

Uh oh!

Check notice

Copilot AI left a comment

Uh oh!

Copilot AI Nov 20, 2025

Uh oh!

Copilot AI Nov 20, 2025

Uh oh!

Copilot AI Nov 20, 2025

Uh oh!

Copilot AI Nov 20, 2025

Uh oh!

Copilot AI Nov 20, 2025

Uh oh!

Copilot AI Nov 20, 2025

Uh oh!

Copilot AI Nov 20, 2025

Uh oh!

Copilot AI Nov 20, 2025

Uh oh!

Copilot AI Nov 20, 2025

Uh oh!

Copilot AI Nov 20, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	req = requests.get(url)
	req = requests.get(url)
	req.raise_for_status()

-        default="arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/your-alb-name/...",
-        description="The expected AWS ALB ARN",
-        validation_alias="AUTH_AWS_EXPECTED_ALB_ARN"
-    )
+        default="",
+        description="The expected AWS ALB ARN",
+        validation_alias="AUTH_AWS_EXPECTED_ALB_ARN"
+    )
+    def model_post_init(self, __context):
+        # Validate that if auth_user_header_type is aws-alb-jwt, ARN must be set and not placeholder
+        if self.auth_user_header_type == "aws-alb-jwt":
+            placeholder = "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/your-alb-name/..."
+            if not self.auth_aws_expected_alb_arn or self.auth_aws_expected_alb_arn == placeholder:
+                raise ValueError(
+                    "auth_aws_expected_alb_arn must be set to a valid AWS ALB ARN when auth_user_header_type is 'aws-alb-jwt'. "
+                    "Current value is empty or a placeholder."
+                )

Add support for AWS App Load Balancer frontend as auth reverse proxy. #97

Add support for AWS App Load Balancer frontend as auth reverse proxy. #97

Conversation

ktpedre commented Nov 20, 2025

Uh oh!

Check notice

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants