nginx.conf

log_format narra '$remote_addr - $narra_user [$time_local] "$request" '
                 '$status $body_bytes_sent "$http_referer" '
                 '"$http_user_agent" "$http_x_forwarded_for"';

server {
  listen                        80 default_server;

  server_name                   localhost;

  access_log                    /dev/stdout narra;

  # front page
  location / {
    root                        /usr/share/nginx/html;
    index                       index.html index.htm;
  }

  error_page                    401 = /err401;
  error_page                    403 = /403.html;

  # Restricted resource
  location /private {
    auth_request                /auth;
    auth_request_set            $narra_user $upstream_http_x_username;

    if_modified_since           off;
    etag                        off;
    expires                     -1;
    add_header                  Last-Modified "";
    add_header                  'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
    root                        /usr/share/nginx/html;
    index                       index.html index.htm;
  }

  # Handle auth_request
  location = /auth {
    internal;
    proxy_pass                  http://narra.dev.lan;
    proxy_pass_request_body     off;
    proxy_pass_request_headers  on;
    proxy_set_header            Content-Length "";
  }

  # Handle Not Authorized
  location /err401 {
    internal;
    proxy_pass                  http://narra.dev.lan/401/;
    proxy_intercept_errors      on;
    proxy_pass_request_body     off;
    proxy_set_header            Content-Length "";
    proxy_set_header            X-Forwarded-Proto $scheme;
    proxy_set_header            X-Forwarded-Host $host;
    proxy_set_header            X-Forwarded-Uri $request_uri;
  }

  # Handle redirect from Authorization Server
  location /login {
    proxy_pass                  http://narra.dev.lan;
    proxy_cache                 off;
    proxy_redirect              off;
    proxy_buffering             off;
    proxy_pass_header           Set-Cookie;
    proxy_intercept_errors      on;
  }


  # Handle logout - remove session cookie
  location = /logout {
    add_header Set-Cookie       "narra_token=;Path=/;Expires=Wed, 10 Aug 2016 00:10:10 GMT";
    return     302              $scheme://$host/;
  }
}