mirror of
https://github.com/oauth2-proxy/oauth2-proxy.git
synced 2025-04-23 12:18:50 +02:00
68 lines
61 KiB
HTML
68 lines
61 KiB
HTML
|
<!doctype html>
|
||
|
|
<html lang="en">
|
||
|
|
<head>
|
||
|
|
<meta charset="UTF-8">
|
||
|
|
<meta name="viewport" content="width=device-width,initial-scale=1">
|
||
|
|
<meta name="generator" content="Docusaurus v2.0.0-alpha.66">
|
||
|
|
<title data-react-helmet="true">OAuth Provider Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="OAuth Provider Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><meta data-react-helmet="true" property="og:description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/oauth_provider"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/oauth_provider"><link rel="stylesheet" href="/oauth2-proxy/styles.58710d0f.css">
|
||
|
|
<link rel="preload" href="/oauth2-proxy/styles.1b985414.js" as="script">
|
||
|
|
<link rel="preload" href="/oauth2-proxy/runtime~main.25c65d8f.js" as="script">
|
||
|
|
<link rel="preload" href="/oauth2-proxy/main.0241cc8c.js" as="script">
|
||
|
|
<link rel="preload" href="/oauth2-proxy/1.d056dcee.js" as="script">
|
||
|
|
<link rel="preload" href="/oauth2-proxy/2.5ccb8738.js" as="script">
|
||
|
|
<link rel="preload" href="/oauth2-proxy/25.0c5e951d.js" as="script">
|
||
|
|
<link rel="preload" href="/oauth2-proxy/27.e98e570f.js" as="script">
|
||
|
|
<link rel="preload" href="/oauth2-proxy/935f2afb.5cbdda77.js" as="script">
|
||
|
|
<link rel="preload" href="/oauth2-proxy/17896441.4b6aaeea.js" as="script">
|
||
|
|
<link rel="preload" href="/oauth2-proxy/357fe94d.4ef71147.js" as="script">
|
||
|
|
</head>
|
||
|
|
<body>
|
||
|
|
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
|
||
|
|
<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__item navbar__link" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/configuration/oauth_provider">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/configuration/oauth_provider">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a role="button" class="menu__link menu__link--sublist">Versions</a><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active" href="/oauth2-proxy/docs/next/configuration/oauth_provider">Next</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/configuration/oauth_provider">6.1.x</a></li></ul></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li>
|
||
|
|
and the user will be checked against all the provided groups.</li><li>Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the <code>google-service-account-json</code> flag.</li><li>Restart oauth2-proxy.</li></ol><p>Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour ).</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="azure-auth-provider"></a>Azure Auth Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#azure-auth-provider" title="Direct link to heading">#</a></h3><ol><li>Add an application: go to <a href="https://portal.azure.com" target="_blank" rel="noopener noreferrer">https://portal.azure.com</a>, choose <strong>"Azure Active Directory"</strong> in the left menu, select <strong>"App registrations"</strong> and then click on <strong>"New app registration"</strong>.</li><li>Pick a name and choose <strong>"Webapp / API"</strong> as application type. Use <code>https://internal.yourcompany.com</code> as Sign-on URL. Click <strong>"Create"</strong>.</li><li>On the <strong>"Settings"</strong> / <strong>"Properties"</strong> page of the app, pick a logo and select <strong>"Multi-tenanted"</strong> if you want to allow users from multiple organizations to access your app. Note down the application ID. Click <strong>"Save"</strong>.</li><li>On the <strong>"Settings"</strong> / <strong>"Required Permissions"</strong> page of the app, click on <strong>"Windows Azure Active Directory"</strong> and then on <strong>"Access the directory as the signed in user"</strong>. Hit <strong>"Save"</strong> and then then on <strong>"Grant permissions"</strong> (you might need another admin to do this).</li><li>On the <strong>"Settings"</strong> / <strong>"Reply URLs"</strong> page of the app, add <code>https://internal.yourcompanycom/oauth2/callback</code> for each host that you want to protect by the oauth2 proxy. Click <strong>"Save"</strong>.</li><li>On the <strong>"Settings"</strong> / <strong>"Keys"</strong> page of the app, add a new key and note down the value after hitting <strong>"Save"</strong>.</li><li>Configure the proxy with</li></ol><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --provider=azure</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-id=<application ID from step 3></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-secret=<value from step 6></span></div></div></div></div></div><p>Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the <a href="/oauth2-proxy/docs/next/configuration/session_storage#redis-storage">redis session storage</a> should resolve this.</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="facebook-auth-provider"></a>Facebook Auth Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#facebook-auth-provider" title="Direct link to heading">#</a></h3><ol><li>Create a new FB App from <a href="https://developers.facebook.com/" target="_blank" rel="noopener noreferrer">https://developers.facebook.com/</a></li><li>Under FB Login, set your Valid OAuth redirect URIs to <code>https://internal.yourcompany.com/oauth2/callback</co
|
||
|
|
the following steps:</p><h4><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="configuring-the-oidc-provider-with-okta"></a>Configuring the OIDC Provider with Okta<a aria-hidden="true" tabindex="-1" class="hash-link" href="#configuring-the-oidc-provider-with-okta" title="Direct link to heading">#</a></h4><ol><li>Log in to Okta using an administrative account. It is suggested you try this in preview first, <code>example.oktapreview.com</code></li><li>(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,
|
||
|
|
you may wish to configure an authorization server for each application. Otherwise, the provided <code>default</code> will work.</li></ol><ul><li>Navigate to <strong>Security</strong> then select <strong>API</strong></li><li>Click <strong>Add Authorization Server</strong>, if this option is not available you may require an additional license for a custom authorization server.</li><li>Fill out the <strong>Name</strong> with something to describe the application you are protecting. e.g. 'Example App'.</li><li>For <strong>Audience</strong>, pick the URL of the application you wish to protect: <a href="https://example.corp.com" target="_blank" rel="noopener noreferrer">https://example.corp.com</a></li><li>Fill out a <strong>Description</strong></li><li>Add any <strong>Access Policies</strong> you wish to configure to limit application access.</li><li>The default settings will work for other options.
|
||
|
|
<a href="https://developer.okta.com/docs/guides/customize-authz-server/overview/" target="_blank" rel="noopener noreferrer">See Okta documentation for more information on Authorization Servers</a></li></ul><ol start="3"><li>Navigate to <strong>Applications</strong> then select <strong>Add Application</strong>.</li></ol><ul><li>Select <strong>Web</strong> for the <strong>Platform</strong> setting.</li><li>Select <strong>OpenID Connect</strong> and click <strong>Create</strong></li><li>Pick an <strong>Application Name</strong> such as <code>Example App</code>.</li><li>Set the <strong>Login redirect URI</strong> to <code>https://example.corp.com</code>.</li><li>Under <strong>General</strong> set the <strong>Allowed grant types</strong> to <code>Authorization Code</code> and <code>Refresh Token</code>.</li><li>Leave the rest as default, taking note of the <code>Client ID</code> and <code>Client Secret</code>.</li><li>Under <strong>Assignments</strong> select the users or groups you wish to access your application.</li></ul><ol start="4"><li>Create a configuration file like the following:</li></ol><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">provider = "oidc"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">redirect_url = "https://example.corp.com/oauth2/callback"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">oidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">upstreams = [</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> "https://example.corp.com"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">]</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">email_domains = [</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> "corp.com"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">]</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">client_id = "XXXXX"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">client_secret = "YYYYY"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">pass_access_token = true</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">cookie_secret = "ZZZZZ"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">skip_provider_button = true</span></div></div></div></div></div><p>The <code>oidc_issuer_url</code> is based on URL from your <strong>Authorization Server</strong>'s <strong>Issuer</strong> field in step 2, or simply <a href="https://corp.okta.com" target="_blank" rel="noopener noreferrer">https://corp.okta.com</a>
|
||
|
|
The <code>client_id</code> and <code>client_secret</code> are configured in the application settings.
|
||
|
|
Generate a unique <code>client_secret</code> to encrypt the cookie.</p><p>Then you can start the oauth2-proxy with <code>./oauth2-proxy --config /etc/example.cfg</code></p><h4><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="configuring-the-oidc-provider-with-okta---localhost"></a>Configuring the OIDC Provider with Okta - localhost<a aria-hidden="true" tabindex="-1" class="hash-link" href="#configuring-the-oidc-provider-with-okta---localhost" title="Direct link to heading">#</a></h4><ol><li>Signup for developer account: <a href="https://developer.okta.com/signup/" target="_blank" rel="noopener noreferrer">https://developer.okta.com/signup/</a></li><li>Create New <code>Web</code> Application: https://${your-okta-domain}/dev/console/apps/new</li><li>Example Application Settings for localhost:<ul><li><strong>Name:</strong> My Web App</li><li><strong>Base URIs:</strong> http://localhost:4180/</li><li><strong>Login redirect URIs:</strong> http://localhost:4180/oauth2/callback</li><li><strong>Logout redirect URIs:</strong> http://localhost:4180/</li><li><strong>Group assignments:</strong> <code>Everyone</code></li><li><strong>Grant type allowed:</strong> <code>Authorization Code</code> and <code>Refresh Token</code></li></ul></li><li>Make note of the <code>Client ID</code> and <code>Client secret</code>, they are needed in a future step</li><li>Make note of the <strong>default</strong> Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as</li><li>Example config file <code>/etc/localhost.cfg</code><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">provider = "oidc"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">redirect_url = "http://localhost:4180/oauth2/callback"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">oidc_issuer_url = "https://${your-okta-domain}/oauth2/default"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">upstreams = [</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> "http://0.0.0.0:8080"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">]</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">email_domains = [</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> "*"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">]</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">client_id = "XXX"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">client_secret = "YYY"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">pass_access_token = true</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">cookie_secret = "ZZZ"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">cookie_secure = false</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">skip_provider_button = true</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"># Note: use the following for testing within a container</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"># http_address = "0.0.0.0:4180"</span></div></div></div></div></div></li><li>Then you can start the oauth2-proxy with <code>./oauth2-proxy --config /etc/localhost.cfg</code></li></ol><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="logingov-provider"></a>login.gov Provider<a a
|
||
|
|
If you are a US Government agency, you can contact the login.gov team through the contact information
|
||
|
|
that you can find on <a href="https://login.gov/developers/" target="_blank" rel="noopener noreferrer">https://login.gov/developers/</a> and work with them to understand how to get login.gov
|
||
|
|
accounts for integration/test and production access.</p><p>A developer guide is available here: <a href="https://developers.login.gov/" target="_blank" rel="noopener noreferrer">https://developers.login.gov/</a>, though this proxy handles everything
|
||
|
|
but the data you need to create to register your application in the login.gov dashboard.</p><p>As a demo, we will assume that you are running your application that you want to secure locally on
|
||
|
|
http://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that
|
||
|
|
you have an agency integration account for testing.</p><p>First, register your application in the dashboard. The important bits are:</p><ul><li>Identity protocol: make this <code>Openid connect</code></li><li>Issuer: do what they say for OpenID Connect. We will refer to this string as <code>${LOGINGOV_ISSUER}</code>.</li><li>Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.
|
||
|
|
A quick way to do this is <code>openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'</code>,
|
||
|
|
The contents of the <code>key.pem</code> shall be referred to as <code>${OAUTH2_PROXY_JWT_KEY}</code>.</li><li>Return to App URL: Make this be <code>http://localhost:4180/</code></li><li>Redirect URIs: Make this be <code>http://localhost:4180/oauth2/callback</code>.</li><li>Attribute Bundle: Make sure that email is selected.</li></ul><p>Now start the proxy up with the following options:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">./oauth2-proxy -provider login.gov \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -client-id=${LOGINGOV_ISSUER} \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -redirect-url=http://localhost:4180/oauth2/callback \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -cookie-secure=false \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -email-domain=gsa.gov \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -upstream=http://localhost:3000/ \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -cookie-secret=somerandomstring12341234567890AB \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -cookie-domain=localhost \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -skip-provider-button=true \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -jwt-key="${OAUTH2_PROXY_JWT_KEY}"</span></div></div></div></div></div><p>You can also set all these options with environment variables, for use in cloud/docker environments.
|
||
|
|
One tricky thing that you may encounter is that some cloud environments will pass in environment
|
||
|
|
variables in a docker env-file, which does not allow multiline variables like a PEM file.
|
||
|
|
If you encounter this, then you can create a <code>jwt_signing_key.pem</code> file in the top level
|
||
|
|
directory of the repo which contains the key in PEM format and then do your docker build.
|
||
|
|
The docker build process will copy that file into your image which you can then access by
|
||
|
|
setting the <code>OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem</code>
|
||
|
|
environment variable, or by setting <code>--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem</code> on the commandline.</p><p>Once it is running, you should be able to go to <code>http://localhost:4180/</code> in your browser,
|
||
|
|
get authenticated by the login.gov integration server, and then get proxied on to your
|
||
|
|
application running on <code>http://localhost:3000/</code>. In a real deployment, you would secure
|
||
|
|
your application with a firewall or something so that it was only accessible from the
|
||
|
|
proxy, and you would use real hostnames everywhere.</p><h4><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="skip-oidc-discovery"></a>Skip OIDC discovery<a aria-hidden="true" tabindex="-1" class="hash-link" href="#skip-oidc-discovery" title="Direct link to heading">#</a></h4><p>Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata.</p><p>In this case, you can set the <code>--skip-oidc-discovery</code> option, and supply those required endpoints manually:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -provider oidc</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -client-id oauth2-proxy</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -client-secret proxy</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -redirect-url http://127.0.0.1:4180/oauth2/callback</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -oidc-issuer-url http://127.0.0.1:5556</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -skip-oidc-discovery</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -login-url http://127.0.0.1:5556/authorize</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -redeem-url http://127.0.0.1:5556/token</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -oidc-jwks-url http://127.0.0.1:5556/keys</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -cookie-secure=false</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -email-domain example.com</span></div></div></div></div></div><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="nextcloud-provider"></a>Nextcloud Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#nextcloud-provider" title="Direct link to heading">#</a></h3><p>The Nextcloud provider allows you to authenticate against users in your
|
||
|
|
Nextcloud instance.</p><p>When you are using the Nextcloud provider, you must specify the urls via
|
||
|
|
configuration, environment variable, or command line argument. Depending
|
||
|
|
on whether your Nextcloud instance is using pretty urls your urls may be of the
|
||
|
|
form <code>/index.php/apps/oauth2/*</code> or <code>/apps/oauth2/*</code>.</p><p>Refer to the <a href="https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html" target="_blank" rel="noopener noreferrer">OAuth2
|
||
|
|
documentation</a>
|
||
|
|
to setup the client id and client secret. Your "Redirection URI" will be
|
||
|
|
<code>https://internalapp.yourcompany.com/oauth2/callback</code>.</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -provider nextcloud</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -client-id <from nextcloud admin></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -client-secret <from nextcloud admin></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -login-url="<your nextcloud url>/index.php/apps/oauth2/authorize"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -redeem-url="<your nextcloud url>/index.php/apps/oauth2/api/v1/token"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -validate-url="<your nextcloud url>/ocs/v2.php/cloud/user?format=json"</span></div></div></div></div></div><p>Note: in <em>all</em> cases the validate-url will <em>not</em> have the <code>index.php</code>.</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="digitalocean-auth-provider"></a>DigitalOcean Auth Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#digitalocean-auth-provider" title="Direct link to heading">#</a></h3><ol><li><a href="https://cloud.digitalocean.com/account/api/applications" target="_blank" rel="noopener noreferrer">Create a new OAuth application</a><ul><li>You can fill in the name, homepage, and description however you wish.</li><li>In the "Application callback URL" field, enter: <code>https://oauth-proxy/oauth2/callback</code>, substituting <code>oauth2-proxy</code> with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL.</li></ul></li><li>Note the Client ID and Client Secret.</li></ol><p>To use the provider, pass the following options:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --provider=digitalocean</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-id=<Client ID></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-secret=<Client Secret></span></div></div></div></div></div><p> Alternatively, set the equivalent options in the config file. The redirect URL defaults to <code>https://<requested host header>/oauth2/callback</code>. If you need to change it, you can use the <code>--redirect-url</code> command-line option.</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="bitbucket-auth-provider"></a>Bitbucket Auth Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#bitbucket-auth-provider" title="Direct link to heading">#</a></h3><ol><li><a href="https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html" target="_blank" rel="noopener noreferrer">Add a new OAuth consumer</a><ul><li>In "Callback URL" use <code>https://<oauth2-proxy>/oauth2/callback</code>, substituting <code><oauth2-proxy></code> with the actual hostname that oauth2-proxy is running on.</li><li>In Permissions section select:<ul><li>Account -> Email</li><li>Team membership -> Read</li><li>Repositories -> Read</li></ul></li></ul></li><li>Note the Client ID and Client Secret.</li></ol><p>To use the provider
|
||
|
|
<code>Provider</code> instance. Add a new <code>case</code> to
|
||
|
|
<a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go" target="_blank" rel="noopener noreferrer"><code>providers.New()</code></a> to allow <code>oauth2-proxy</code> to use the
|
||
|
|
new <code>Provider</code>.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/auth.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/overview"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Overview</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/next/configuration/session_storage"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Session Storage »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#google-auth-provider" class="table-of-contents__link">Google Auth Provider</a></li><li><a href="#azure-auth-provider" class="table-of-contents__link">Azure Auth Provider</a></li><li><a href="#facebook-auth-provider" class="table-of-contents__link">Facebook Auth Provider</a></li><li><a href="#github-auth-provider" class="table-of-contents__link">GitHub Auth Provider</a></li><li><a href="#keycloak-auth-provider" class="table-of-contents__link">Keycloak Auth Provider</a></li><li><a href="#gitlab-auth-provider" class="table-of-contents__link">GitLab Auth Provider</a></li><li><a href="#linkedin-auth-provider" class="table-of-contents__link">LinkedIn Auth Provider</a></li><li><a href="#microsoft-azure-ad-provider" class="table-of-contents__link">Microsoft Azure AD Provider</a></li><li><a href="#openid-connect-provider" class="table-of-contents__link">OpenID Connect Provider</a></li><li><a href="#logingov-provider" class="table-of-contents__link">login.gov Provider</a></li><li><a href="#nextcloud-provider" class="table-of-contents__link">Nextcloud Provider</a></li><li><a href="#digitalocean-auth-provider" class="table-of-contents__link">DigitalOcean Auth Provider</a></li><li><a href="#bitbucket-auth-provider" class="table-of-contents__link">Bitbucket Auth Provider</a></li><li><a href="#gitea-auth-provider" class="table-of-contents__link">Gitea Auth Provider</a></li><li><a href="#email-authentication" class="table-of-contents__link">Email Authentication</a></li><li><a href="#adding-a-new-provider" class="table-of-contents__link">Adding a new Provider</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2020 OAuth2 Proxy.</div></div></div></footer></div>
|
||
|
|
<script src="/oauth2-proxy/styles.1b985414.js"></script>
|
||
|
|
<script src="/oauth2-proxy/runtime~main.25c65d8f.js"></script>
|
||
|
|
<script src="/oauth2-proxy/main.0241cc8c.js"></script>
|
||
|
|
<script src="/oauth2-proxy/1.d056dcee.js"></script>
|
||
|
|
<script src="/oauth2-proxy/2.5ccb8738.js"></script>
|
||
|
|
<script src="/oauth2-proxy/25.0c5e951d.js"></script>
|
||
|
|
<script src="/oauth2-proxy/27.e98e570f.js"></script>
|
||
|
|
<script src="/oauth2-proxy/935f2afb.5cbdda77.js"></script>
|
||
|
|
<script src="/oauth2-proxy/17896441.4b6aaeea.js"></script>
|
||
|
|
<script src="/oauth2-proxy/357fe94d.4ef71147.js"></script>
|
||
|
|
</body>
|
||
|
|
</html>
|