我有一个私人网站，用作来自世界各地拥有我的 Google Apps 域 (example.com) 帐户的员工的 Intranet 站点。他们目前使用 OpenId 登录各种协作工具，因此我也想将其用于我的网站。
-
我想通过 Google Apps 提供的 OpenID 登录（而不是基本 HTTP 身份验证）来保护我的仅限会员的私人网站上的静态内容。
我想
-
我知道任何人都可以成为 OpenID 提供商，因此我想将其限制为一个域名，特别是我的 Google Apps 域。
目前我的静态内容是通过 Nginx 提供的。我更喜欢一个简单的 Nginx 模块，只需进行一些设置即可处理此问题。
如果我必须亲自动手，我不介意设置一个基本的 Python（例如 Django）或 Java 服务器来处理这个问题，但我不想使用 PHP 或 Ruby。
I have a private website used as an intranet site for workers from around the world who have accounts with my Google Apps domain (example.com). They currently use OpenId to log in to various collaborative tools, so I want to use this for my site too.
-
I want to protect the static content on my private members-only website with OpenID login (rather than, say, basic HTTP auth), which Google Apps provides.
-
I know that anyone can be an OpenID provider, so I want to restrict it to one domain name, specifically my Google Apps domain.
At the moment my static content is served via Nginx. I would prefer a simple Nginx module that would handle this with only a bit of setup.
If I have to get my hands dirty, I don't mind setting up a basic Python (say Django) or Java server to handle this, but I don't want to use PHP or Ruby.
发布评论
评论（3）
根据内容量，为什么不将其放在 Google App Engine 上呢？
您可以静态放置的内容数量（尽管您可以从数据库提供服务）以及每天的更改数量受到限制。
如果您的内容足够小并且更改不太频繁（我认为每天最多 100 次），这可能会解决您的身份验证问题并稍微简化您的生活！
Depending on the volume of content, why not put it up on the Google App Engine?
There are restrictions on the amount of stuff you can put up statically (you can serve from DB though), and the number of changes per day.
If your content is small enough and doesn't change too frequently (100 times a day I believe is the max) this might address your authentication problems and simplify your life a fair bit!
对于lighttpd，有https://lighttpd-external-auth.chmd.fr。
我相信它可以毫无困难地移植到 nginx lua 脚本接口。
For lighttpd, there is https://lighttpd-external-auth.chmd.fr.
I believe it could be ported for the nginx lua scripting interface without major difficulties.
如果您想使用 Google 作为具有开放 ID 连接的 IDP，您可以按照 Google 指南进行相同的操作 这里。如果您想在开源版本中使用它，您可以检查这个。
我没有使用过这个开源版本，因此建议您在使用它之前检查所有安全问题。
If you want to use Google as IDP with open ID connect you can follow Google guidelines for the same here. I am using NGINX Plus with Auth0 as IDP but that needs a paid NGINX subscription, see details here. If you want to use this with Open Source version you can check this.
I have not used this open-source version so will advise you to check for all security concerns before using it.