go/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2025-08-08 22:46:33 +02:00
Code Issues Releases Activity

docs: upgrade to docusaurus 3.1.0 (#2388)

Browse Source 
* initial commit for docusaurus 3 upgrade

* fix mdx errors

* fix mdx issues

* fix routing issues

* update docs generation workflow

* fix version

* fix permissions

* move slack to header

* remove background color and minify

* Add suggestions

* add shell to code blocks
This commit is contained in:
Jan Larwig
2024-01-26 13:07:01 +01:00
committed by GitHub
parent de0b6dd8a9
commit 6c2c115d30
41 changed files with 7102 additions and 14474 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
docs/versioned_docs/version-7.2.x/configuration/auth.md
View File

@@ -105,7 +105,7 @@ Note: When using the ADFS Auth provider with nginx and the cookie session store
### Facebook Auth Provider
1. Create a new FB App from <https://developers.facebook.com/>
1. Create a new FB App from https://developers.facebook.com/
2. Under FB Login, set your Valid OAuth redirect URIs to `https://internal.yourcompany.com/oauth2/callback`
### GitHub Auth Provider
@@ -119,29 +119,41 @@ NOTE: When `--github-user` is set, the specified users are allowed to login even
To restrict by organization only, include the following flag:
-github-org="": restrict logins to members of this organisation
```
--github-org="": restrict logins to members of this organisation
```
To restrict within an organization to specific teams, include the following flag in addition to `-github-org`:
-github-team="": restrict logins to members of any of these teams (slug), separated by a comma
```
--github-team="": restrict logins to members of any of these teams (slug), separated by a comma
```
If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:
-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo
```
--github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo
```
If you'd like to allow access to users with **read only** access to a **public** repository you will need to provide a [token](https://github.com/settings/tokens) for a user that has write access to the repository. The token must be created with at least the `public_repo` scope:
-github-token="": the token to use when verifying repository collaborators
```
--github-token="": the token to use when verifying repository collaborators
```
To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma
-github-user="": allow logins by username, separated by a comma
```
--github-user="": allow logins by username, separated by a comma
```
If you are using GitHub enterprise, make sure you set the following to the appropriate url:
-login-url="http(s)://<enterprise github host>/login/oauth/authorize"
-redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"
-validate-url="http(s)://<enterprise github host>/api/v3"
```
--login-url="http(s)://<enterprise github host>/login/oauth/authorize"
--redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"
--validate-url="http(s)://<enterprise github host>/api/v3"
```
### Keycloak Auth Provider
@@ -216,11 +228,15 @@ The following config should be set to ensure that the oauth will work properly.
Restricting by group membership is possible with the following option:
```
--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma
```
If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:
```
--oidc-issuer-url="<your gitlab url>"
```
If your self-hosted GitLab is on a sub-directory (e.g. domain.tld/gitlab), as opposed to its own sub-domain (e.g. gitlab.domain.tld), you may need to add a redirect from domain.tld/oauth pointing at e.g. domain.tld/gitlab/oauth.
@@ -345,7 +361,7 @@ Then you can start the oauth2-proxy with `./oauth2-proxy --config /etc/example.c
#### Okta - localhost
1. Signup for developer account: https://developer.okta.com/signup/
2. Create New `Web` Application: https://${your-okta-domain}/dev/console/apps/new
2. Create New `Web` Application: https://$\{your-okta-domain\}/dev/console/apps/new
3. Example Application Settings for localhost:
* **Name:** My Web App
* **Base URIs:** http://localhost:4180/
@@ -354,12 +370,12 @@ Then you can start the oauth2-proxy with `./oauth2-proxy --config /etc/example.c
* **Group assignments:** `Everyone`
* **Grant type allowed:** `Authorization Code` and `Refresh Token`
4. Make note of the `Client ID` and `Client secret`, they are needed in a future step
5. Make note of the **default** Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as
5. Make note of the **default** Authorization Server Issuer URI from: https://$\{your-okta-domain\}/admin/oauth2/as
6. Example config file `/etc/localhost.cfg`
```
provider = "oidc"
redirect_url = "http://localhost:4180/oauth2/callback"
oidc_issuer_url = "https://${your-okta-domain}/oauth2/default"
oidc_issuer_url = "https://$\{your-okta-domain\}/oauth2/default"
upstreams = [
"http://0.0.0.0:8080"
]