<titledata-react-helmet="true">OAuth Provider Configuration | OAuth2 Proxy</title><metadata-react-helmet="true"name="twitter:card"content="summary_large_image"><metadata-react-helmet="true"property="og:url"content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/oauth_provider"><metadata-react-helmet="true"name="docusaurus_locale"content="en"><metadata-react-helmet="true"name="docusaurus_version"content="current"><metadata-react-helmet="true"name="docusaurus_tag"content="docs-default-current"><metadata-react-helmet="true"property="og:title"content="OAuth Provider Configuration | OAuth2 Proxy"><metadata-react-helmet="true"name="description"content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><metadata-react-helmet="true"property="og:description"content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><linkdata-react-helmet="true"rel="icon"href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><linkdata-react-helmet="true"rel="canonical"href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/oauth_provider"><linkdata-react-helmet="true"rel="alternate"href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/oauth_provider"hreflang="en"><linkdata-react-helmet="true"rel="alternate"href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/oauth_provider"hreflang="x-default"><linkrel="stylesheet"href="/oauth2-proxy/assets/css/styles.19258e03.css">
and the user will be checked against all the provided groups.</li><li>Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the <code>google-service-account-json</code> flag.</li><li>Restart oauth2-proxy.</li></ol><p>Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour ).</p><h3class="anchor anchorWithStickyNavbar_mojV"id="azure-auth-provider">Azure Auth Provider<aclass="hash-link"href="#azure-auth-provider"title="Direct link to heading"></a></h3><ol><li>Add an application: go to <ahref="https://portal.azure.com"target="_blank"rel="noopener noreferrer">https://portal.azure.com</a>, choose <strong>"Azure Active Directory"</strong> in the left menu, select <strong>"App registrations"</strong> and then click on <strong>"New app registration"</strong>.</li><li>Pick a name and choose <strong>"Webapp / API"</strong> as application type. Use <code>https://internal.yourcompany.com</code> as Sign-on URL. Click <strong>"Create"</strong>.</li><li>On the <strong>"Settings"</strong> / <strong>"Properties"</strong> page of the app, pick a logo and select <strong>"Multi-tenanted"</strong> if you want to allow users from multiple organizations to access your app. Note down the application ID. Click <strong>"Save"</strong>.</li><li>On the <strong>"Settings"</strong> / <strong>"Required Permissions"</strong> page of the app, click on <strong>"Windows Azure Active Directory"</strong> and then on <strong>"Access the directory as the signed in user"</strong>. Hit <strong>"Save"</strong> and then then on <strong>"Grant permissions"</strong> (you might need another admin to do this).</li><li>On the <strong>"Settings"</strong> / <strong>"Reply URLs"</strong> page of the app, add <code>https://internal.yourcompanycom/oauth2/callback</code> for each host that you want to protect by the oauth2 proxy. Click <strong>"Save"</strong>.</li><li>On the <strong>"Settings"</strong> / <strong>"Keys"</strong> page of the app, add a new key and note down the value after hitting <strong>"Save"</strong>.</li><li>Configure the proxy with</li></ol><divclass="codeBlockContainer_I0IT theme-code-block"><divclass="codeBlockContent_wNvx"><pretabindex="0"class="prism-code language-text codeBlock_jd64 thin-scrollbar"style="color:#bfc7d5;background-color:#292d3e"><codeclass="codeBlockLines_mRuA"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --provider=azure</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --client-id=<application ID from step 3></span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --client-secret=<value from step 6></span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --oidc-issuer-url=https://sts.windows.net/{tenant-id}/</span><br></span></code></pre><buttontype="button"aria-label="Copy code to clipboard"class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the <ahref="/oauth2-proxy/docs/next/configuration/session_storage#redis-storage">redis session storage</a> should resolve this.</p><h3class="anchor anchorWithStickyNavbar_mojV"id="adfs-auth-provider">ADFS Auth Provider<aclass="hash-link"href="#adfs-auth-provider"title="Direct link to heading"></a></h3><ol><li>Open the ADFS administration console on your Windows Server and add a new Application Group</li><li>Provide a name for the integration, select Server Application from the Standalone applications
flags can be used to specify which groups to limit access to.</p><p>If these are unset but a <code>groups</code> mapper is set up above in step (3), the provider will still
populate the <code>X-Forwarded-Groups</code> header to your upstream server with the <code>groups</code> data in the
Keycloak userinfo endpoint response.</p><p>The group management in keycloak is using a tree. If you create a group named admin in keycloak
you should define the 'keycloak-group' value to /admin.</p><h3class="anchor anchorWithStickyNavbar_mojV"id="keycloak-oidc-auth-provider">Keycloak OIDC Auth Provider<aclass="hash-link"href="#keycloak-oidc-auth-provider"title="Direct link to heading"></a></h3><ol><li>Create new client in your Keycloak realm with <strong>Access Type</strong>'confidental', <strong>Client protocol</strong>'openid-connect' and <strong>Valid Redirect URIs</strong>'<ahref="https://internal.yourcompany.com/oauth2/callback'"target="_blank"rel="noopener noreferrer">https://internal.yourcompany.com/oauth2/callback'</a></li><li>Take note of the Secret in the credential tab of the client</li><li>Create a mapper with <strong>Mapper Type</strong>'Group Membership' and <strong>Token Claim Name</strong>'groups'.</li><li>Create a mapper with <strong>Mapper Type</strong>'Audience' and <strong>Included Client Audience</strong> and <strong>Included Custom Audience</strong> set to your client name.</li></ol><p>Make sure you set the following to the appropriate url:</p><divclass="codeBlockContainer_I0IT theme-code-block"><divclass="codeBlockContent_wNvx"><pretabindex="0"class="prism-code language-text codeBlock_jd64 thin-scrollbar"style="color:#bfc7d5;background-color:#292d3e"><codeclass="codeBlockLines_mRuA"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --provider=keycloak-oidc</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --client-id=<your client's id></span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --client-secret=<your client's secret></span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --redirect-url=https://myapp.com/oauth2/callback</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --oidc-issuer-url=https://<keycloak host>/auth/realms/<your realm></span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --allowed-role=<realm role name> // Optional, required realm role</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --allowed-role=<client id>:<client role name> // Optional, required client role</span><br></span></code></pre><buttontype="button"aria-label="Copy code to clipboard"class="copyButton_wuS7 clean-btn">Copy</button></div></div><h3class="anchor anchorWithStickyNavbar_mojV"id="gitlab-auth-provider">GitLab Auth Provider<aclass="hash-link"href="#gitlab-auth-provider"title="Direct link to heading"></a></h3><p>This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see <ahref="https://github.com/oauth2-proxy/oauth2-proxy/issues/994"target="_blank"rel="noopener noreferrer">994</a>).</p><p>Whether you are using GitLab.com or self-hosting GitLab, follow <ahref="https://docs.gitlab.com/ce/integration/oauth_provider.html"target="_blank"rel="noopener noreferrer">these steps to add an application</a>. Make sure to enable at least the <code>openid</code>, <code>profile</code> and <code>email</code> scopes, and set the redirect url to your application url e.g. <ahref="https://myapp.com/oauth2/callback"target="_blank"rel="noopener noreferrer">https://myapp.com/oauth2/callback</a>.</p><p>If you need projects filtering, add the extra <code>read_api</code> scope to your application.</p><p>The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow <ahref="/oauth2-proxy/docs/next/configuration/overview#generating-a-cookie-secret">these steps</a></p><divclass="codeBlockContainer_I0IT theme-code-block"><divclass="codeBlockContent_wNvx"><pretabindex="0"class="prism-code language-text codeBlock_jd64 thin-scrollbar"style="color:#bfc7d5;background-color:#292d3e"><codeclass="codeBlock
The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below.</p><h4class="anchor anchorWithStickyNavbar_mojV"id="dex">Dex<aclass="hash-link"href="#dex"title="Direct link to heading"></a></h4><p>To configure the OIDC provider for Dex, perform the following steps:</p><ol><li><p>Download Dex:</p><divclass="codeBlockContainer_I0IT theme-code-block"><divclass="codeBlockContent_wNvx"><pretabindex="0"class="prism-code language-text codeBlock_jd64 thin-scrollbar"style="color:#bfc7d5;background-color:#292d3e"><codeclass="codeBlockLines_mRuA"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">go get github.com/dexidp/dex</span><br></span></code></pre><buttontype="button"aria-label="Copy code to clipboard"class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>See the <ahref="https://dexidp.io/docs/getting-started/"target="_blank"rel="noopener noreferrer">getting started guide</a> for more details.</p></li><li><p>Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the <code>staticClients</code> section of <code>examples/config-dev.yaml</code>:</p><divclass="codeBlockContainer_I0IT theme-code-block"><divclass="codeBlockContent_wNvx"><pretabindex="0"class="prism-code language-text codeBlock_jd64 thin-scrollbar"style="color:#bfc7d5;background-color:#292d3e"><codeclass="codeBlockLines_mRuA"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">- id: oauth2-proxy</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">redirectURIs:</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">- 'http://127.0.0.1:4180/oauth2/callback'</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">name: 'oauth2-proxy'</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">secret: proxy</span><br></span></code></pre><buttontype="button"aria-label="Copy code to clipboard"class="copyButton_wuS7 clean-btn">Copy</button></div></div></li><li><p>Launch Dex: from <code>$GOPATH/github.com/dexidp/dex</code>, run:</p><divclass="codeBlockContainer_I0IT theme-code-block"><divclass="codeBlockContent_wNvx"><pretabindex="0"class="prism-code language-text codeBlock_jd64 thin-scrollbar"style="color:#bfc7d5;background-color:#292d3e"><codeclass="codeBlockLines_mRuA"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">bin/dex serve examples/config-dev.yaml</span><br></span></code></pre><buttontype="button"aria-label="Copy code to clipboard"class="copyButton_wuS7 clean-btn">Copy</button></div></div></li><li><p>In a second terminal, run the oauth2-proxy with the following args:</p><divclass="codeBlockContainer_I0IT theme-code-block"><divclass="codeBlockContent_wNvx"><pretabindex="0"class="prism-code language-text codeBlock_jd64 thin-scrollbar"style="color:#bfc7d5;background-color:#292d3e"><codeclass="codeBlockLines_mRuA"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-provider oidc</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-provider-display-name "My OIDC Provider"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-client-id oauth2-proxy</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-client-secret proxy</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-redirect-url http://127.0.0.1:4180/oauth2/callback</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-oidc-issuer-url http://127.0.0.1:5556/dex</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-cookie-secure=false</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-cookie-secret=secret</span><br></span
you may wish to configure an authorization server for each application. Otherwise, the provided <code>default</code> will work.</li></ol><ul><li>Navigate to <strong>Security</strong> then select <strong>API</strong></li><li>Click <strong>Add Authorization Server</strong>, if this option is not available you may require an additional license for a custom authorization server.</li><li>Fill out the <strong>Name</strong> with something to describe the application you are protecting. e.g. 'Example App'.</li><li>For <strong>Audience</strong>, pick the URL of the application you wish to protect: <ahref="https://example.corp.com"target="_blank"rel="noopener noreferrer">https://example.corp.com</a></li><li>Fill out a <strong>Description</strong></li><li>Add any <strong>Access Policies</strong> you wish to configure to limit application access.</li><li>The default settings will work for other options.
<ahref="https://developer.okta.com/docs/guides/customize-authz-server/overview/"target="_blank"rel="noopener noreferrer">See Okta documentation for more information on Authorization Servers</a></li></ul><olstart="3"><li>Navigate to <strong>Applications</strong> then select <strong>Add Application</strong>.</li></ol><ul><li>Select <strong>Web</strong> for the <strong>Platform</strong> setting.</li><li>Select <strong>OpenID Connect</strong> and click <strong>Create</strong></li><li>Pick an <strong>Application Name</strong> such as <code>Example App</code>.</li><li>Set the <strong>Login redirect URI</strong> to <code>https://example.corp.com</code>.</li><li>Under <strong>General</strong> set the <strong>Allowed grant types</strong> to <code>Authorization Code</code> and <code>Refresh Token</code>.</li><li>Leave the rest as default, taking note of the <code>Client ID</code> and <code>Client Secret</code>.</li><li>Under <strong>Assignments</strong> select the users or groups you wish to access your application.</li></ul><olstart="4"><li><p>Create a configuration file like the following:</p><divclass="codeBlockContainer_I0IT theme-code-block"><divclass="codeBlockContent_wNvx"><pretabindex="0"class="prism-code language-text codeBlock_jd64 thin-scrollbar"style="color:#bfc7d5;background-color:#292d3e"><codeclass="codeBlockLines_mRuA"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">provider = "oidc"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">redirect_url = "https://example.corp.com/oauth2/callback"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">oidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">upstreams = [</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">"https://example.corp.com"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">]</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">email_domains = [</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">"corp.com"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">]</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">client_id = "XXXXX"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">client_secret = "YYYYY"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">pass_access_token = true</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">cookie_secret = "ZZZZZ"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">skip_provider_button = true</span><br></span></code></pre><buttontype="button"aria-label="Copy code to clipboard"class="copyButton_wuS7 clean-btn">Copy</button></div></div></li></ol><p>The <code>oidc_issuer_url</code> is based on URL from your <strong>Authorization Server</strong>'s <strong>Issuer</strong> field in step 2, or simply <ahref="https://corp.okta.com"target="_blank"rel="noopener noreferrer">https://corp.okta.com</a> .
Generate a unique <code>cookie_secret</code> to encrypt the cookie.</p><p>Then you can start the oauth2-proxy with <code>./oauth2-proxy --config /etc/example.cfg</code></p><h4class="anchor anchorWithStickyNavbar_mojV"id="okta---localhost">Okta - localhost<aclass="hash-link"href="#okta---localhost"title="Direct link to heading"></a></h4><ol><li>Signup for developer account: <ahref="https://developer.okta.com/signup/"target="_blank"rel="noopener noreferrer">https://developer.okta.com/signup/</a></li><li>Create New <code>Web</code> Application: https://${your-okta-domain}/dev/console/apps/new</li><li>Example Application Settings for localhost:<ul><li><strong>Name:</strong> My Web App</li><li><strong>Base URIs:</strong> http://localhost:4180/</li><li><strong>Login redirect URIs:</strong> http://localhost:4180/oauth2/callback</li><li><strong>Logout redirect URIs:</strong> http://localhost:4180/</li><li><strong>Group assignments:</strong><code>Everyone</code></li><li><strong>Grant type allowed:</strong><code>Authorization Code</code> and <code>Refresh Token</code></li></ul></li><li>Make note of the <code>Client ID</code> and <code>Client secret</code>, they are needed in a future step</li><li>Make note of the <strong>default</strong> Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as</li><li>Example config file <code>/etc/localhost.cfg</code><divclass="codeBlockContainer_I0IT theme-code-block"><divclass="codeBlockContent_wNvx"><pretabindex="0"class="prism-code language-text codeBlock_jd64 thin-scrollbar"style="color:#bfc7d5;background-color:#292d3e"><codeclass="codeBlockLines_mRuA"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">provider = "oidc"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">redirect_url = "http://localhost:4180/oauth2/callback"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">oidc_issuer_url = "https://${your-okta-domain}/oauth2/default"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">upstreams = [</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">"http://0.0.0.0:8080"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">]</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">email_domains = [</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">"*"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">]</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">client_id = "XXX"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">client_secret = "YYY"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">pass_access_token = true</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">cookie_secret = "ZZZ"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">cookie_secure = false</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">skip_provider_button = true</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"># Note: use the following for testing within a container</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"># http_address = "0.0.0.0:4180"</span><br></span></code></pre><buttontype="button"aria-label="Copy code to clipboard"class="copyButton_wuS7 clean-btn">Copy</button></div></div></li><li>Then you can start the oauth2-proxy with <code>./oauth2-proxy --config /etc/localhost.cfg</code></li></ol><h3class="anchor anchorWithStickyNavbar_mojV"id="logingov-provider">login.gov Provider<aclass="hash-link"href="#logingov-provider"title="Dir
If you are a US Government agency, you can contact the login.gov team through the contact information
that you can find on <ahref="https://login.gov/developers/"target="_blank"rel="noopener noreferrer">https://login.gov/developers/</a> and work with them to understand how to get login.gov
accounts for integration/test and production access.</p><p>A developer guide is available here: <ahref="https://developers.login.gov/"target="_blank"rel="noopener noreferrer">https://developers.login.gov/</a>, though this proxy handles everything
but the data you need to create to register your application in the login.gov dashboard.</p><p>As a demo, we will assume that you are running your application that you want to secure locally on
http://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that
you have an agency integration account for testing.</p><p>First, register your application in the dashboard. The important bits are:</p><ul><li>Identity protocol: make this <code>Openid connect</code></li><li>Issuer: do what they say for OpenID Connect. We will refer to this string as <code>${LOGINGOV_ISSUER}</code>.</li><li>Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.
A quick way to do this is <code>openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'</code>,
The contents of the <code>key.pem</code> shall be referred to as <code>${OAUTH2_PROXY_JWT_KEY}</code>.</li><li>Return to App URL: Make this be <code>http://localhost:4180/</code></li><li>Redirect URIs: Make this be <code>http://localhost:4180/oauth2/callback</code>.</li><li>Attribute Bundle: Make sure that email is selected.</li></ul><p>Now start the proxy up with the following options:</p><divclass="codeBlockContainer_I0IT theme-code-block"><divclass="codeBlockContent_wNvx"><pretabindex="0"class="prism-code language-text codeBlock_jd64 thin-scrollbar"style="color:#bfc7d5;background-color:#292d3e"><codeclass="codeBlockLines_mRuA"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">./oauth2-proxy -provider login.gov \</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -client-id=${LOGINGOV_ISSUER} \</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -redirect-url=http://localhost:4180/oauth2/callback \</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -cookie-secure=false \</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -email-domain=gsa.gov \</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -upstream=http://localhost:3000/ \</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -cookie-secret=somerandomstring12341234567890AB \</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -cookie-domain=localhost \</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -skip-provider-button=true \</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -jwt-key="${OAUTH2_PROXY_JWT_KEY}"</span><br></span></code></pre><buttontype="button"aria-label="Copy code to clipboard"class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>You can also set all these options with environment variables, for use in cloud/docker environments.
One tricky thing that you may encounter is that some cloud environments will pass in environment
variables in a docker env-file, which does not allow multiline variables like a PEM file.
If you encounter this, then you can create a <code>jwt_signing_key.pem</code> file in the top level
directory of the repo which contains the key in PEM format and then do your docker build.
The docker build process will copy that file into your image which you can then access by
setting the <code>OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem</code>
environment variable, or by setting <code>--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem</code> on the commandline.</p><p>Once it is running, you should be able to go to <code>http://localhost:4180/</code> in your browser,
get authenticated by the login.gov integration server, and then get proxied on to your
application running on <code>http://localhost:3000/</code>. In a real deployment, you would secure
your application with a firewall or something so that it was only accessible from the
proxy, and you would use real hostnames everywhere.</p><h4class="anchor anchorWithStickyNavbar_mojV"id="skip-oidc-discovery">Skip OIDC discovery<aclass="hash-link"href="#skip-oidc-discovery"title="Direct link to heading"></a></h4><p>Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata.</p><p>In this case, you can set the <code>--skip-oidc-discovery</code> option, and supply those required endpoints manually:</p><divclass="codeBlockContainer_I0IT theme-code-block"><divclass="codeBlockContent_wNvx"><pretabindex="0"class="prism-code language-text codeBlock_jd64 thin-scrollbar"style="color:#bfc7d5;background-color:#292d3e"><codeclass="codeBlockLines_mRuA"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -provider oidc</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -client-id oauth2-proxy</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -client-secret proxy</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -redirect-url http://127.0.0.1:4180/oauth2/callback</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -oidc-issuer-url http://127.0.0.1:5556</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -skip-oidc-discovery</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -login-url http://127.0.0.1:5556/authorize</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -redeem-url http://127.0.0.1:5556/token</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -oidc-jwks-url http://127.0.0.1:5556/keys</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -cookie-secure=false</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -email-domain example.com</span><br></span></code></pre><buttontype="button"aria-label="Copy code to clipboard"class="copyButton_wuS7 clean-btn">Copy</button></div></div><h3class="anchor anchorWithStickyNavbar_mojV"id="nextcloud-provider">Nextcloud Provider<aclass="hash-link"href="#nextcloud-provider"title="Direct link to heading"></a></h3><p>The Nextcloud provider allows you to authenticate against users in your
Nextcloud instance.</p><p>When you are using the Nextcloud provider, you must specify the urls via
configuration, environment variable, or command line argument. Depending
on whether your Nextcloud instance is using pretty urls your urls may be of the
form <code>/index.php/apps/oauth2/*</code> or <code>/apps/oauth2/*</code>.</p><p>Refer to the <ahref="https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"target="_blank"rel="noopener noreferrer">OAuth2
documentation</a>
to setup the client id and client secret. Your "Redirection URI" will be
<code>https://internalapp.yourcompany.com/oauth2/callback</code>.</p><divclass="codeBlockContainer_I0IT theme-code-block"><divclass="codeBlockContent_wNvx"><pretabindex="0"class="prism-code language-text codeBlock_jd64 thin-scrollbar"style="color:#bfc7d5;background-color:#292d3e"><codeclass="codeBlockLines_mRuA"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -provider nextcloud</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -client-id <from nextcloud admin></span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -client-secret <from nextcloud admin></span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -login-url="<your nextcloud url>/index.php/apps/oauth2/authorize"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -redeem-url="<your nextcloud url>/index.php/apps/oauth2/api/v1/token"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> -validate-url="<your nextcloud url>/ocs/v2.php/cloud/user?format=json"</span><br></span></code></pre><buttontype="button"aria-label="Copy code to clipboard"class="copyButton_wuS7 clean-btn">Copy</button></div></div><p>Note: in <em>all</em> cases the validate-url will <em>not</em> have the <code>index.php</code>.</p><h3class="anchor anchorWithStickyNavbar_mojV"id="digitalocean-auth-provider">DigitalOcean Auth Provider<aclass="hash-link"href="#digitalocean-auth-provider"title="Direct link to heading"></a></h3><ol><li><ahref="https://cloud.digitalocean.com/account/api/applications"target="_blank"rel="noopener noreferrer">Create a new OAuth application</a><ul><li>You can fill in the name, homepage, and description however you wish.</li><li>In the "Application callback URL" field, enter: <code>https://oauth-proxy/oauth2/callback</code>, substituting <code>oauth2-proxy</code> with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL.</li></ul></li><li>Note the Client ID and Client Secret.</li></ol><p>To use the provider, pass the following options:</p><divclass="codeBlockContainer_I0IT theme-code-block"><divclass="codeBlockContent_wNvx"><pretabindex="0"class="prism-code language-text codeBlock_jd64 thin-scrollbar"style="color:#bfc7d5;background-color:#292d3e"><codeclass="codeBlockLines_mRuA"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --provider=digitalocean</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --client-id=<Client ID></span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --client-secret=<Client Secret></span><br></span></code></pre><buttontype="button"aria-label="Copy code to clipboard"class="copyButton_wuS7 clean-btn">Copy</button></div></div><p> Alternatively, set the equivalent options in the config file. The redirect URL defaults to <code>https://<requested host header>/oauth2/callback</code>. If you need to change it, you can use the <code>--redirect-url</code> command-line option.</p><h3class="anchor anchorWithStickyNavbar_mojV"id="bitbucket-auth-provider">Bitbucket Auth Provider<aclass="hash-link"href="#bitbucket-auth-provider"title="Direct link to heading"></a></h3><ol><li><ahref="https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"target="_blank"rel="noopener noreferrer">Add a new OAuth consumer</a><ul><li>In "Callback URL" use <code>https://<oauth2-proxy>/oauth2/callback</code>, substituting <code><oauth2-proxy></code> with the actual hostname that oauth2-proxy is running on.</li><li>In Permissions section select:<ul><li>Account -> Email</li><li>Team membership -> Read</li><li>Repositories -> Read</li></ul></li></ul></li><li>Note the Client ID and Client Secret.</li></ol><p>T
<code>Provider</code> instance. Add a new <code>case</code> to
<ahref="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"target="_blank"rel="noopener noreferrer"><code>providers.New()</code></a> to allow <code>oauth2-proxy</code> to use the
