【NGINX】如何仅仅使用OpenResty接入OIDC认证

local openidc = require("resty.openidc")

local function in_has_role(id_token, required_role)
    if not id_token or not id_token.roles then
        return false
    end

    for _, role in ipairs(id_token.roles) do
        if role == required_role then
            return true
        end
    end

    return false
end

local opts = {
    discovery = ngx.var.oidc_discovery,
    client_id = ngx.var.oidc_client_id,
    client_secret = ngx.var.oidc_client_secret,
    redirect_uri = ngx.var.oidc_redirect_uri,
    scope = "openid email profile roles",

    session = {
        cookie = {
            name = ngx.var.oidc_cookie_name or "oidc",
            path = "/",
            secure = true,
            httponly = true,
            samesite = "Lax",
        }
    },

    session_contents = { id_token = true, user = true },
}

local res, err = openidc.authenticate(opts)

if err then
    ngx.status = ngx.HTTP_INTERNAL_SERVER_ERROR
    ngx.say(err)
    ngx.exit(ngx.HTTP_INTERNAL_SERVER_ERROR)
end

local required_role = ngx.var.oidc_required_role 
if required_role then
    local ok = in_has_role(res.id_token, required_role)
    if not ok then
        return ngx.redirect(
            "https://logto.cszj.wang/404?error=insufficient_permission"
        )
    end
end

-- 统一透传用户信息（可选）
if res and res.user then
    ngx.req.set_header("X-User-Sub", res.user.sub or "")
    ngx.req.set_header("X-User-Email", res.user.email or "")
end

return res