From d78a7905d754cf1d4343ea266ef93f39fcc37df3 Mon Sep 17 00:00:00 2001
From: Hendrik Richert <github@richert.li>
Date: Thu, 31 Aug 2023 20:28:03 +0200
Subject: [PATCH] Allow frontend to use http proxy (#8691)

Co-authored-by: Hendrik Richert <hendrik.richert@swisscom.com>
Co-authored-by: RyanHolstien <RyanHolstien@users.noreply.github.com>
---
 docker/datahub-frontend/start.sh              | 16 +++++
 docs-website/sidebars.js                      |  1 +
 .../guides/sso/configure-oidc-behind-proxy.md | 64 +++++++++++++++++++
 3 files changed, 81 insertions(+)
 create mode 100644 docs/authentication/guides/sso/configure-oidc-behind-proxy.md

diff --git a/docker/datahub-frontend/start.sh b/docker/datahub-frontend/start.sh
index a1548670309b53..9dc1514144bb1a 100755
--- a/docker/datahub-frontend/start.sh
+++ b/docker/datahub-frontend/start.sh
@@ -26,6 +26,21 @@ if [[ ! -z ${SSL_TRUSTSTORE_PASSWORD:-} ]]; then
   TRUSTSTORE_PASSWORD="-Djavax.net.ssl.trustStorePassword=$SSL_TRUSTSTORE_PASSWORD"
 fi
 
+HTTP_PROXY=""
+if [[ ! -z ${HTTP_PROXY_HOST:-} ]] && [[ ! -z ${HTTP_PROXY_PORT:-} ]]; then
+  HTTP_PROXY="-Dhttp.proxyHost=$HTTP_PROXY_HOST -Dhttp.proxyPort=$HTTP_PROXY_PORT"
+fi
+
+HTTPS_PROXY=""
+if [[ ! -z ${HTTPS_PROXY_HOST:-} ]] && [[ ! -z ${HTTPS_PROXY_PORT:-} ]]; then
+  HTTPS_PROXY="-Dhttps.proxyHost=$HTTPS_PROXY_HOST -Dhttps.proxyPort=$HTTPS_PROXY_PORT"
+fi
+
+NO_PROXY=""
+if [[ ! -z ${HTTP_NON_PROXY_HOSTS:-} ]]; then
+  NO_PROXY="-Dhttp.nonProxyHosts='$HTTP_NON_PROXY_HOSTS'"
+fi
+
 # make sure there is no whitespace at the beginning and the end of 
 # this string
 export JAVA_OPTS="-Xms512m \
@@ -37,6 +52,7 @@ export JAVA_OPTS="-Xms512m \
    -Dlogback.debug=false \
    ${PROMETHEUS_AGENT:-} ${OTEL_AGENT:-} \
    ${TRUSTSTORE_FILE:-} ${TRUSTSTORE_TYPE:-} ${TRUSTSTORE_PASSWORD:-} \
+   ${HTTP_PROXY:-} ${HTTPS_PROXY:-} ${NO_PROXY:-} \
    -Dpidfile.path=/dev/null"
 
 exec ./datahub-frontend/bin/datahub-frontend
diff --git a/docs-website/sidebars.js b/docs-website/sidebars.js
index 64433a2615f342..fcf82b786a1b95 100644
--- a/docs-website/sidebars.js
+++ b/docs-website/sidebars.js
@@ -168,6 +168,7 @@ module.exports = {
                     "docs/authentication/guides/sso/configure-oidc-react-google",
                     "docs/authentication/guides/sso/configure-oidc-react-okta",
                     "docs/authentication/guides/sso/configure-oidc-react-azure",
+                    "docs/authentication/guides/sso/configure-oidc-behind-proxy",
                   ],
                 },
               ],
diff --git a/docs/authentication/guides/sso/configure-oidc-behind-proxy.md b/docs/authentication/guides/sso/configure-oidc-behind-proxy.md
new file mode 100644
index 00000000000000..c998816e047359
--- /dev/null
+++ b/docs/authentication/guides/sso/configure-oidc-behind-proxy.md
@@ -0,0 +1,64 @@
+# Configuring Frontend to use a Proxy when communicating with SSO Provider
+*Authored on 22/08/2023*
+
+The `datahub-frontend-react` server can be configured to use an http proxy when retrieving the openid-configuration. 
+This can be needed if your infrastructure is locked down and disallows connectivity by default, using proxies for fine-grained egress control. 
+
+## Configure http proxy and non proxy hosts
+
+To do this, you will need to pass a set of environment variables to the datahub-frontend-react container (e.g. in the `docker-compose.yml` file or your kubernetes manifest).
+
+```
+HTTP_PROXY_HOST=host of your http proxy
+HTTP_PROXY_PORT=port of your http proxy
+HTTPS_PROXY_HOST=host of your http(s) proxy used for https connections (often the same as the http proxy)
+HTTPS_PROXY_PORT=port of your http(s) proxy used for https connections (often the same as the http proxy)
+HTTP_NON_PROXY_HOSTS=localhost|datahub-gms (or any other hosts that you would like to bypass the proxy for, delimited by pipe)
+```
+
+## Optional: provide custom truststore
+If your upstream proxy performs SSL termination to inspect traffic, this will result in different (self-signed) certificates for HTTPS connections. 
+The default truststore used in the `datahub-frontend-react` docker image will not trust these kinds of connections.
+To address this, you can copy or mount your own truststore (provided by the proxy or network administrators) into the docker container.
+
+Depending on your setup, you have a few options to achieve this:
+
+### Make truststore available in the frontend
+
+#### Option a) Build frontend docker image with your own truststore included
+
+To build a custom image for your frontend, with the certificates built-in, you can use the official frontend image as a base, then copy in your required files.
+
+Example Dockerfile:
+
+```dockerfile
+FROM linkedin/datahub-frontend-react:<version>
+COPY /truststore-directory /certificates
+```
+
+Building this Dockerfile will result in your own custom docker image on your local machine. 
+You will then be able to tag it, publish it to your own registry, etc. 
+
+#### Option b) Mount truststore from your host machine using a docker volume
+
+Adapt your docker-compose.yml to include a new volume mount in the `datahub-frontend-react` container
+
+```docker
+  datahub-frontend-react:
+    # ...
+    volumes:
+      # ...
+      - /truststore-directory:/certificates
+```
+
+### Reference new truststore 
+
+Add the following environment values to the `datahub-frontend-react` container:
+
+```
+SSL_TRUSTSTORE_FILE=path/to/truststore.jks (e.g. /certificates)
+SSL_TRUSTSTORE_TYPE=jks
+SSL_TRUSTSTORE_PASSWORD=MyTruststorePassword
+```
+
+Once these steps are done, your frontend container will use the new truststore when validating SSL/HTTPS connections.