Compile the authentication module with nginx to enable basic auth against LDAP/AD

[cloudfoundry]

Compile the authentication module with nginx to enable basic auth against LDAP/AD

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/119273371

The labels on this github issue will be updated when the story is started.

[flavorjones]

Is there a reason you wouldn't prefer to use a route service to perform authentication instead of building it into the nginx configuration?

http://docs.cloudfoundry.org/services/route-services.html

I think our logic was that basic auth that doesn't require integration with outside services was a reasonable thing to support in the buildpack; but introducing external integrations is, in my opinion, perhaps a function that's better served elsewhere in the system.

A route service would be more easily testable and reusable. Have you considered it as an alternative?

[eddiewebb]

Thanks @flavorjones - I'm circulating that idea with the team, but cursory glance does raise one major concern for us around secrets management.

properties:
 router:
   route_services_secret: YOUR-SECRET-PASSPHRASE

We would need to developers to encrypt that before checking into our CD pipelines, and then decrypt that portion of the manifest as part of the automated push. For dynamic buildpacks we use libraries in the running app to decrypt on the fly with user provided services that stage the appropriate key.

Anyway, I'll see what others on the team think.

[eddiewebb]

Got some education after talking with the team. We are waiting to move to 1.7 but otherwise the route service seems like a viable option. Thanks @flavorjones !