@@ -424,12 +424,46 @@ server {
424424 auth_request_set $auth_cookie $upstream_http_set_cookie;
425425 add_header Set-Cookie $auth_cookie;
426426
427+ # if you enabled --set-authorization and your cookies are split into multiple parts,
428+ # you also need to extract the additional cookies, because $upstream_http_set_cookie
429+ # only contains the first Set-Cookie header from the auth_request.
430+ auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;
431+
432+ # Extract the Cookie attributes from the first Set-Cookie header and append them
433+ # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
434+ if ($auth_cookie ~* "(; .*)") {
435+ set $auth_cookie_name_0 $auth_cookie;
436+ set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
437+ }
438+
439+ # Send both Set-Cookie headers now if there was a second part
440+ if ($auth_cookie_name_upstream_1) {
441+ add_header Set-Cookie $auth_cookie_name_0;
442+ add_header Set-Cookie $auth_cookie_name_1;
443+ }
444+
427445 proxy_pass http://backend/;
428446 # or "root /path/to/site;" or "fastcgi_pass ..." etc
429447 }
430448}
431449```
432450
451+If you use ingress-nginx in Kubernetes (which includes the Lua module), you also can use the following configuration snippet for your Ingress:
452+
453+```yaml
454+nginx.ingress.kubernetes.io/auth-response-headers: Authorization
455+nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$request_uri
456+nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
457+nginx.ingress.kubernetes.io/configuration-snippet: |
458+ auth_request_set $name_upstream_1 $upstream_cookie_name_1;
459+
460+ access_by_lua_block {
461+ if ngx.var.name_upstream_1 ~= "" then
462+ ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")
463+ end
464+ }
465+```
466+
433467## Contributing
434468
435469Please see our [Contributing](CONTRIBUTING.md) guidelines.