From 7cfd9675a46cd682f12855765acb862dbcf38939 Mon Sep 17 00:00:00 2001 From: gh-actions Date: Tue, 18 Jan 2022 13:56:37 +0000 Subject: [PATCH] Deploy website - based on 4f5efd4074098223aeee244b963dafa9cfd4924b --- 404.html | 4 ++-- a1bbfb14.ec0422a1.js => a1bbfb14.599b1799.js | 2 +- docs/6.1.x/behaviour/index.html | 4 ++-- docs/6.1.x/community/security/index.html | 4 ++-- docs/6.1.x/configuration/oauth_provider/index.html | 4 ++-- docs/6.1.x/configuration/overview/index.html | 4 ++-- docs/6.1.x/configuration/session_storage/index.html | 4 ++-- docs/6.1.x/configuration/tls/index.html | 4 ++-- docs/6.1.x/features/endpoints/index.html | 4 ++-- docs/6.1.x/features/request_signatures/index.html | 4 ++-- docs/6.1.x/index.html | 4 ++-- docs/7.0.x/behaviour/index.html | 4 ++-- docs/7.0.x/community/security/index.html | 4 ++-- docs/7.0.x/configuration/alpha-config/index.html | 4 ++-- docs/7.0.x/configuration/oauth_provider/index.html | 4 ++-- docs/7.0.x/configuration/overview/index.html | 4 ++-- docs/7.0.x/configuration/session_storage/index.html | 4 ++-- docs/7.0.x/configuration/tls/index.html | 4 ++-- docs/7.0.x/features/endpoints/index.html | 4 ++-- docs/7.0.x/features/request_signatures/index.html | 4 ++-- docs/7.0.x/index.html | 4 ++-- docs/7.1.x/behaviour/index.html | 4 ++-- docs/7.1.x/community/security/index.html | 4 ++-- docs/7.1.x/configuration/alpha-config/index.html | 4 ++-- docs/7.1.x/configuration/oauth_provider/index.html | 4 ++-- docs/7.1.x/configuration/overview/index.html | 4 ++-- docs/7.1.x/configuration/session_storage/index.html | 4 ++-- docs/7.1.x/configuration/tls/index.html | 4 ++-- docs/7.1.x/features/endpoints/index.html | 4 ++-- docs/7.1.x/index.html | 4 ++-- docs/behaviour/index.html | 4 ++-- docs/community/security/index.html | 4 ++-- docs/configuration/alpha-config/index.html | 4 ++-- docs/configuration/oauth_provider/index.html | 10 +++++----- docs/configuration/overview/index.html | 4 ++-- docs/configuration/session_storage/index.html | 4 ++-- docs/configuration/tls/index.html | 4 ++-- docs/features/endpoints/index.html | 4 ++-- docs/index.html | 4 ++-- docs/next/behaviour/index.html | 4 ++-- docs/next/community/security/index.html | 4 ++-- docs/next/configuration/alpha-config/index.html | 4 ++-- docs/next/configuration/oauth_provider/index.html | 4 ++-- docs/next/configuration/overview/index.html | 4 ++-- docs/next/configuration/session_storage/index.html | 4 ++-- docs/next/configuration/tls/index.html | 4 ++-- docs/next/features/endpoints/index.html | 4 ++-- docs/next/index.html | 4 ++-- index.html | 4 ++-- runtime~main.34f995af.js => runtime~main.514d3324.js | 2 +- 50 files changed, 101 insertions(+), 101 deletions(-) rename a1bbfb14.ec0422a1.js => a1bbfb14.599b1799.js (99%) rename runtime~main.34f995af.js => runtime~main.514d3324.js (97%) diff --git a/404.html b/404.html index 6063a2de..9d329b9d 100644 --- a/404.html +++ b/404.html @@ -6,14 +6,14 @@ Page Not Found | OAuth2 Proxy - +

Page Not Found

We could not find what you were looking for.

Please contact the owner of the site that linked you to the original URL and let them know their link is broken.

Copyright © 2022 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/a1bbfb14.ec0422a1.js b/a1bbfb14.599b1799.js similarity index 99% rename from a1bbfb14.ec0422a1.js rename to a1bbfb14.599b1799.js index f69a86d0..d734f7d9 100644 --- a/a1bbfb14.ec0422a1.js +++ b/a1bbfb14.599b1799.js @@ -1 +1 @@ -(window.webpackJsonp=window.webpackJsonp||[]).push([[35],{116:function(e,t,a){"use strict";a.d(t,"a",(function(){return s})),a.d(t,"b",(function(){return h}));var o=a(0),n=a.n(o);function r(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function i(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,o)}return a}function l(e){for(var t=1;t=0||(n[a]=e[a]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(o=0;o=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(n[a]=e[a])}return n}var p=n.a.createContext({}),b=function(e){var t=n.a.useContext(p),a=t;return e&&(a="function"==typeof e?e(t):l(l({},t),e)),a},s=function(e){var t=b(e.components);return n.a.createElement(p.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return n.a.createElement(n.a.Fragment,{},t)}},d=n.a.forwardRef((function(e,t){var a=e.components,o=e.mdxType,r=e.originalType,i=e.parentName,p=c(e,["components","mdxType","originalType","parentName"]),s=b(a),d=o,h=s["".concat(i,".").concat(d)]||s[d]||u[d]||r;return a?n.a.createElement(h,l(l({ref:t},p),{},{components:a})):n.a.createElement(h,l({ref:t},p))}));function h(e,t){var a=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var r=a.length,i=new Array(r);i[0]=d;var l={};for(var c in t)hasOwnProperty.call(t,c)&&(l[c]=t[c]);l.originalType=e,l.mdxType="string"==typeof e?e:o,i[1]=l;for(var p=2;p\n --client-secret=\n --oidc-issuer-url=https://sts.windows.net/{tenant-id}/\n")),Object(r.b)("p",null,"Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the ",Object(r.b)("inlineCode",{parentName:"p"},"proxy_buffer_size")," in nginx or implementing the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/configuration/session_storage#redis-storage"}),"redis session storage")," should resolve this."),Object(r.b)("h3",{id:"adfs-auth-provider"},"ADFS Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Open the ADFS administration console on your Windows Server and add a new Application Group"),Object(r.b)("li",{parentName:"ol"},"Provide a name for the integration, select Server Application from the Standalone applications section and click Next"),Object(r.b)("li",{parentName:"ol"},"Follow the wizard to get the client-id, client-secret and configure the application credentials"),Object(r.b)("li",{parentName:"ol"},"Configure the proxy with")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=adfs\n --client-id=\n --client-secret=\n")),Object(r.b)("p",null,"Note: When using the ADFS Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/configuration/session_storage#redis-storage"}),"redis session storage")," should resolve this."),Object(r.b)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new FB App from ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.facebook.com/"}),"https://developers.facebook.com/")),Object(r.b)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://github.com/settings/developers"}),"https://github.com/settings/developers")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*")),Object(r.b)("p",null,"NOTE: When ",Object(r.b)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),Object(r.b)("p",null,"To restrict by organization only, include the following flag:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-org="": restrict logins to members of this organisation\n')),Object(r.b)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",Object(r.b)("inlineCode",{parentName:"p"},"-github-org"),":"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),Object(r.b)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),Object(r.b)("p",null,"If you'd like to allow access to users with ",Object(r.b)("strong",{parentName:"p"},"read only")," access to a ",Object(r.b)("strong",{parentName:"p"},"public")," repository you will need to provide a ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/settings/tokens"}),"token")," for a user that has write access to the repository. The token must be created with at least the ",Object(r.b)("inlineCode",{parentName:"p"},"public_repo")," scope:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-token="": the token to use when verifying repository collaborators\n')),Object(r.b)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-user="": allow logins by username, separated by a comma\n')),Object(r.b)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-login-url="http(s):///login/oauth/authorize"\n-redeem-url="http(s):///login/oauth/access_token"\n-validate-url="http(s):///api/v3"\n')),Object(r.b)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),Object(r.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(r.b)("div",Object(o.a)({parentName:"div"},{className:"admonition-heading"}),Object(r.b)("h5",{parentName:"div"},Object(r.b)("span",Object(o.a)({parentName:"h5"},{className:"admonition-icon"}),Object(r.b)("svg",Object(o.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(r.b)("path",Object(o.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(r.b)("div",Object(o.a)({parentName:"div"},{className:"admonition-content"}),Object(r.b)("p",{parentName:"div"},"This is the legacy provider for Keycloak, use ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"#keycloak-oidc-auth-provider"}),"Keycloak OIDC Auth Provider")," if possible."))),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",Object(r.b)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",Object(r.b)("strong",{parentName:"li"},"Valid Redirect URIs")," '",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://internal.yourcompany.com/oauth2/callback'"}),"https://internal.yourcompany.com/oauth2/callback'")),Object(r.b)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),Object(r.b)("li",{parentName:"ol"},"Create a mapper with ",Object(r.b)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",Object(r.b)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),Object(r.b)("p",null,"Make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' --provider=keycloak\n --client-id=\n --client-secret=\n --login-url="http(s):///auth/realms//protocol/openid-connect/auth"\n --redeem-url="http(s):///auth/realms//protocol/openid-connect/token"\n --profile-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n --validate-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n --keycloak-group=\n --keycloak-group=\n')),Object(r.b)("p",null,"For group based authorization, the optional ",Object(r.b)("inlineCode",{parentName:"p"},"--keycloak-group")," (legacy) or ",Object(r.b)("inlineCode",{parentName:"p"},"--allowed-group")," (global standard)\nflags can be used to specify which groups to limit access to."),Object(r.b)("p",null,"If these are unset but a ",Object(r.b)("inlineCode",{parentName:"p"},"groups")," mapper is set up above in step (3), the provider will still\npopulate the ",Object(r.b)("inlineCode",{parentName:"p"},"X-Forwarded-Groups")," header to your upstream server with the ",Object(r.b)("inlineCode",{parentName:"p"},"groups")," data in the\nKeycloak userinfo endpoint response."),Object(r.b)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak\nyou should define the 'keycloak-group' value to /admin."),Object(r.b)("h3",{id:"keycloak-oidc-auth-provider"},"Keycloak OIDC Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",Object(r.b)("strong",{parentName:"li"},"Access Type")," 'confidental', ",Object(r.b)("strong",{parentName:"li"},"Client protocol")," 'openid-connect' and ",Object(r.b)("strong",{parentName:"li"},"Valid Redirect URIs")," '",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://internal.yourcompany.com/oauth2/callback'"}),"https://internal.yourcompany.com/oauth2/callback'")),Object(r.b)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),Object(r.b)("li",{parentName:"ol"},"Create a mapper with ",Object(r.b)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",Object(r.b)("strong",{parentName:"li"},"Token Claim Name")," 'groups'."),Object(r.b)("li",{parentName:"ol"},"Create a mapper with ",Object(r.b)("strong",{parentName:"li"},"Mapper Type")," 'Audience' and ",Object(r.b)("strong",{parentName:"li"},"Included Client Audience")," and ",Object(r.b)("strong",{parentName:"li"},"Included Custom Audience")," set to your client name.")),Object(r.b)("p",null,"Make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=keycloak-oidc\n --client-id=\n --client-secret=\n --redirect-url=https://myapp.com/oauth2/callback\n --oidc-issuer-url=https:///auth/realms/\n --allowed-role= // Optional, required realm role\n --allowed-role=: // Optional, required client role\n")),Object(r.b)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),Object(r.b)("p",null,"This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/issues/994"}),"994"),")."),Object(r.b)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"}),"these steps to add an application"),". Make sure to enable at least the ",Object(r.b)("inlineCode",{parentName:"p"},"openid"),", ",Object(r.b)("inlineCode",{parentName:"p"},"profile")," and ",Object(r.b)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://myapp.com/oauth2/callback"}),"https://myapp.com/oauth2/callback"),"."),Object(r.b)("p",null,"If you need projects filtering, add the extra ",Object(r.b)("inlineCode",{parentName:"p"},"read_api")," scope to your application."),Object(r.b)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/configuration/overview#generating-a-cookie-secret"}),"these steps")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' --provider="gitlab"\n --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n --client-id=GITLAB_CLIENT_ID\n --client-secret=GITLAB_CLIENT_SECRET\n --cookie-secret=COOKIE_SECRET\n')),Object(r.b)("p",null,"Restricting by group membership is possible with the following option:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),Object(r.b)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--oidc-issuer-url=""\n')),Object(r.b)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),Object(r.b)("p",null,"For LinkedIn, the registration steps are:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://www.linkedin.com/secure/developer"}),"https://www.linkedin.com/secure/developer")),Object(r.b)("li",{parentName:"ol"},"In the OAuth User Agreement section:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),Object(r.b)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),Object(r.b)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),Object(r.b)("li",{parentName:"ol"},"Take note of the ",Object(r.b)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",Object(r.b)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),Object(r.b)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),Object(r.b)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."),Object(r.b)("p",null,"This provider was originally built against CoreOS Dex and we will use it as an example.\nThe OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below."),Object(r.b)("h4",{id:"dex"},"Dex"),Object(r.b)("p",null,"To configure the OIDC provider for Dex, perform the following steps:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Download Dex:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"go get github.com/dexidp/dex\n")),Object(r.b)("p",{parentName:"li"},"See the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/coreos/dex/blob/master/Documentation/getting-started.md"}),"getting started guide")," for more details.")),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the ",Object(r.b)("inlineCode",{parentName:"p"},"staticClients")," section of ",Object(r.b)("inlineCode",{parentName:"p"},"examples/config-dev.yaml"),":"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"- id: oauth2-proxy\nredirectURIs:\n- 'http://127.0.0.1:4180/oauth2/callback'\nname: 'oauth2-proxy'\nsecret: proxy\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Launch Dex: from ",Object(r.b)("inlineCode",{parentName:"p"},"$GOPATH/github.com/dexidp/dex"),", run:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"bin/dex serve examples/config-dev.yaml\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"In a second terminal, run the oauth2-proxy with the following args:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-provider oidc\n-provider-display-name "My OIDC Provider"\n-client-id oauth2-proxy\n-client-secret proxy\n-redirect-url http://127.0.0.1:4180/oauth2/callback\n-oidc-issuer-url http://127.0.0.1:5556/dex\n-cookie-secure=false\n-cookie-secret=secret\n-email-domain kilgore.trout\n')),Object(r.b)("p",{parentName:"li"},"To serve the current working directory as a web site under the ",Object(r.b)("inlineCode",{parentName:"p"},"/static")," endpoint, add:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"-upstream file://$PWD/#/static/\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Test the setup by visiting ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"http://127.0.0.1:4180"}),"http://127.0.0.1:4180")," or ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"http://127.0.0.1:4180/static"}),"http://127.0.0.1:4180/static")," ."))),Object(r.b)("p",null,"See also ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment"}),"our local testing environment")," for a self-contained example using Docker and etcd as storage for Dex."),Object(r.b)("h4",{id:"okta"},"Okta"),Object(r.b)("p",null,"To configure the OIDC provider for Okta, perform the following steps:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",Object(r.b)("inlineCode",{parentName:"li"},"example.oktapreview.com")),Object(r.b)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",Object(r.b)("inlineCode",{parentName:"li"},"default")," will work.")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Security")," then select ",Object(r.b)("strong",{parentName:"li"},"API")),Object(r.b)("li",{parentName:"ul"},"Click ",Object(r.b)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),Object(r.b)("li",{parentName:"ul"},"Fill out the ",Object(r.b)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),Object(r.b)("li",{parentName:"ul"},"For ",Object(r.b)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://example.corp.com"}),"https://example.corp.com")),Object(r.b)("li",{parentName:"ul"},"Fill out a ",Object(r.b)("strong",{parentName:"li"},"Description")),Object(r.b)("li",{parentName:"ul"},"Add any ",Object(r.b)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),Object(r.b)("li",{parentName:"ul"},"The default settings will work for other options.\n",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"}),"See Okta documentation for more information on Authorization Servers"))),Object(r.b)("ol",{start:3},Object(r.b)("li",{parentName:"ol"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Applications")," then select ",Object(r.b)("strong",{parentName:"li"},"Add Application"),".")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"Web")," for the ",Object(r.b)("strong",{parentName:"li"},"Platform")," setting."),Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"OpenID Connect")," and click ",Object(r.b)("strong",{parentName:"li"},"Create")),Object(r.b)("li",{parentName:"ul"},"Pick an ",Object(r.b)("strong",{parentName:"li"},"Application Name")," such as ",Object(r.b)("inlineCode",{parentName:"li"},"Example App"),"."),Object(r.b)("li",{parentName:"ul"},"Set the ",Object(r.b)("strong",{parentName:"li"},"Login redirect URI")," to ",Object(r.b)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"General")," set the ",Object(r.b)("strong",{parentName:"li"},"Allowed grant types")," to ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token"),"."),Object(r.b)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client Secret"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),Object(r.b)("ol",{start:4},Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Create a configuration file like the following:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n "https://example.corp.com"\n]\nemail_domains = [\n "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')))),Object(r.b)("p",null,"The ",Object(r.b)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",Object(r.b)("strong",{parentName:"p"},"Authorization Server"),"'s ",Object(r.b)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://corp.okta.com"}),"https://corp.okta.com")," .\nThe ",Object(r.b)("inlineCode",{parentName:"p"},"client_id")," and ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," to encrypt the cookie."),Object(r.b)("p",null,"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),Object(r.b)("h4",{id:"okta---localhost"},"Okta - localhost"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Signup for developer account: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/signup/"}),"https://developer.okta.com/signup/")),Object(r.b)("li",{parentName:"ol"},"Create New ",Object(r.b)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),Object(r.b)("li",{parentName:"ol"},"Example Application Settings for localhost:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Name:")," My Web App"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Group assignments:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Everyone")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Grant type allowed:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token")))),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),Object(r.b)("li",{parentName:"ol"},"Example config file ",Object(r.b)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n "http://0.0.0.0:8080"\n]\nemail_domains = [\n "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),Object(r.b)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),Object(r.b)("h3",{id:"logingov-provider"},"login.gov Provider"),Object(r.b)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://login.gov/developers/"}),"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),Object(r.b)("p",null,"A developer guide is available here: ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://developers.login.gov/"}),"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),Object(r.b)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),Object(r.b)("p",null,"First, register your application in the dashboard. The important bits are:"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Identity protocol: make this ",Object(r.b)("inlineCode",{parentName:"li"},"Openid connect")),Object(r.b)("li",{parentName:"ul"},"Issuer: do what they say for OpenID Connect. We will refer to this string as ",Object(r.b)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),Object(r.b)("li",{parentName:"ul"},"Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",Object(r.b)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",Object(r.b)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",Object(r.b)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),Object(r.b)("li",{parentName:"ul"},"Return to App URL: Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/")),Object(r.b)("li",{parentName:"ul"},"Redirect URIs: Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),Object(r.b)("li",{parentName:"ul"},"Attribute Bundle: Make sure that email is selected.")),Object(r.b)("p",null,"Now start the proxy up with the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'./oauth2-proxy -provider login.gov \\\n -client-id=${LOGINGOV_ISSUER} \\\n -redirect-url=http://localhost:4180/oauth2/callback \\\n -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n -cookie-secure=false \\\n -email-domain=gsa.gov \\\n -upstream=http://localhost:3000/ \\\n -cookie-secret=somerandomstring12341234567890AB \\\n -cookie-domain=localhost \\\n -skip-provider-button=true \\\n -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),Object(r.b)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",Object(r.b)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",Object(r.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",Object(r.b)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),Object(r.b)("p",null,"Once it is running, you should be able to go to ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:3000/"),". In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),Object(r.b)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),Object(r.b)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),Object(r.b)("p",null,"In this case, you can set the ",Object(r.b)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," -provider oidc\n -client-id oauth2-proxy\n -client-secret proxy\n -redirect-url http://127.0.0.1:4180/oauth2/callback\n -oidc-issuer-url http://127.0.0.1:5556\n -skip-oidc-discovery\n -login-url http://127.0.0.1:5556/authorize\n -redeem-url http://127.0.0.1:5556/token\n -oidc-jwks-url http://127.0.0.1:5556/keys\n -cookie-secure=false\n -email-domain example.com\n")),Object(r.b)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),Object(r.b)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),Object(r.b)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",Object(r.b)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",Object(r.b)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),Object(r.b)("p",null,"Refer to the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"}),"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',Object(r.b)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' -provider nextcloud\n -client-id \n -client-secret \n -login-url="/index.php/apps/oauth2/authorize"\n -redeem-url="/index.php/apps/oauth2/api/v1/token"\n -validate-url="/ocs/v2.php/cloud/user?format=json"\n')),Object(r.b)("p",null,"Note: in ",Object(r.b)("em",{parentName:"p"},"all")," cases the validate-url will ",Object(r.b)("em",{parentName:"p"},"not")," have the ",Object(r.b)("inlineCode",{parentName:"p"},"index.php"),"."),Object(r.b)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://cloud.digitalocean.com/account/api/applications"}),"Create a new OAuth application"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),Object(r.b)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',Object(r.b)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=digitalocean\n --client-id=\n --client-secret=\n")),Object(r.b)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",Object(r.b)("inlineCode",{parentName:"p"},"https:///oauth2/callback"),". If you need to change it, you can use the ",Object(r.b)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),Object(r.b)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"}),"Add a new OAuth consumer"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},'In "Callback URL" use ',Object(r.b)("inlineCode",{parentName:"li"},"https:///oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"")," with the actual hostname that oauth2-proxy is running on."),Object(r.b)("li",{parentName:"ul"},"In Permissions section select:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"Account -> Email"),Object(r.b)("li",{parentName:"ul"},"Team membership -> Read"),Object(r.b)("li",{parentName:"ul"},"Repositories -> Read"))))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=bitbucket\n --client-id=\n --client-secret=\n")),Object(r.b)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-team="),". To restrict the access to only these users who has access to one selected repository use ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-repository="),"."),Object(r.b)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new application: ",Object(r.b)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",Object(r.b)("inlineCode",{parentName:"li"},"https:///oauth2/callback")),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),Object(r.b)("li",{parentName:"ol"},"Pass the following options to the proxy:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' --provider="github"\n --redirect-url="https:///oauth2/callback"\n --provider-display-name="Gitea"\n --client-id="< client_id as generated by Gitea >"\n --client-secret="< client_secret as generated by Gitea >"\n --login-url="https://< your gitea host >/login/oauth/authorize"\n --redeem-url="https://< your gitea host >/login/oauth/access_token"\n --validate-url="https://< your gitea host >/api/v1"\n')),Object(r.b)("h2",{id:"email-authentication"},"Email Authentication"),Object(r.b)("p",null,"To authorize by email domain use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),Object(r.b)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),Object(r.b)("p",null,"Follow the examples in the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"}),Object(r.b)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",Object(r.b)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",Object(r.b)("inlineCode",{parentName:"p"},"case")," to\n",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"}),Object(r.b)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",Object(r.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",Object(r.b)("inlineCode",{parentName:"p"},"Provider"),"."))}b.isMDXComponent=!0}}]); \ No newline at end of file +(window.webpackJsonp=window.webpackJsonp||[]).push([[35],{116:function(e,t,a){"use strict";a.d(t,"a",(function(){return s})),a.d(t,"b",(function(){return h}));var o=a(0),n=a.n(o);function r(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function i(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,o)}return a}function l(e){for(var t=1;t=0||(n[a]=e[a]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(o=0;o=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(n[a]=e[a])}return n}var p=n.a.createContext({}),b=function(e){var t=n.a.useContext(p),a=t;return e&&(a="function"==typeof e?e(t):l(l({},t),e)),a},s=function(e){var t=b(e.components);return n.a.createElement(p.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return n.a.createElement(n.a.Fragment,{},t)}},d=n.a.forwardRef((function(e,t){var a=e.components,o=e.mdxType,r=e.originalType,i=e.parentName,p=c(e,["components","mdxType","originalType","parentName"]),s=b(a),d=o,h=s["".concat(i,".").concat(d)]||s[d]||u[d]||r;return a?n.a.createElement(h,l(l({ref:t},p),{},{components:a})):n.a.createElement(h,l({ref:t},p))}));function h(e,t){var a=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var r=a.length,i=new Array(r);i[0]=d;var l={};for(var c in t)hasOwnProperty.call(t,c)&&(l[c]=t[c]);l.originalType=e,l.mdxType="string"==typeof e?e:o,i[1]=l;for(var p=2;p\n --client-secret=\n --oidc-issuer-url=https://sts.windows.net/{tenant-id}/\n")),Object(r.b)("p",null,"Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the ",Object(r.b)("inlineCode",{parentName:"p"},"proxy_buffer_size")," in nginx or implementing the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/configuration/session_storage#redis-storage"}),"redis session storage")," should resolve this."),Object(r.b)("h3",{id:"adfs-auth-provider"},"ADFS Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Open the ADFS administration console on your Windows Server and add a new Application Group"),Object(r.b)("li",{parentName:"ol"},"Provide a name for the integration, select Server Application from the Standalone applications section and click Next"),Object(r.b)("li",{parentName:"ol"},"Follow the wizard to get the client-id, client-secret and configure the application credentials"),Object(r.b)("li",{parentName:"ol"},"Configure the proxy with")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=adfs\n --client-id=\n --client-secret=\n")),Object(r.b)("p",null,"Note: When using the ADFS Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/configuration/session_storage#redis-storage"}),"redis session storage")," should resolve this."),Object(r.b)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new FB App from ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.facebook.com/"}),"https://developers.facebook.com/")),Object(r.b)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://github.com/settings/developers"}),"https://github.com/settings/developers")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*")),Object(r.b)("p",null,"NOTE: When ",Object(r.b)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),Object(r.b)("p",null,"To restrict by organization only, include the following flag:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-org="": restrict logins to members of this organisation\n')),Object(r.b)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",Object(r.b)("inlineCode",{parentName:"p"},"-github-org"),":"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),Object(r.b)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),Object(r.b)("p",null,"If you'd like to allow access to users with ",Object(r.b)("strong",{parentName:"p"},"read only")," access to a ",Object(r.b)("strong",{parentName:"p"},"public")," repository you will need to provide a ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/settings/tokens"}),"token")," for a user that has write access to the repository. The token must be created with at least the ",Object(r.b)("inlineCode",{parentName:"p"},"public_repo")," scope:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-token="": the token to use when verifying repository collaborators\n')),Object(r.b)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-user="": allow logins by username, separated by a comma\n')),Object(r.b)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-login-url="http(s):///login/oauth/authorize"\n-redeem-url="http(s):///login/oauth/access_token"\n-validate-url="http(s):///api/v3"\n')),Object(r.b)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),Object(r.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(r.b)("div",Object(o.a)({parentName:"div"},{className:"admonition-heading"}),Object(r.b)("h5",{parentName:"div"},Object(r.b)("span",Object(o.a)({parentName:"h5"},{className:"admonition-icon"}),Object(r.b)("svg",Object(o.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(r.b)("path",Object(o.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(r.b)("div",Object(o.a)({parentName:"div"},{className:"admonition-content"}),Object(r.b)("p",{parentName:"div"},"This is the legacy provider for Keycloak, use ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"#keycloak-oidc-auth-provider"}),"Keycloak OIDC Auth Provider")," if possible."))),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",Object(r.b)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",Object(r.b)("strong",{parentName:"li"},"Valid Redirect URIs")," '",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://internal.yourcompany.com/oauth2/callback'"}),"https://internal.yourcompany.com/oauth2/callback'")),Object(r.b)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),Object(r.b)("li",{parentName:"ol"},"Create a mapper with ",Object(r.b)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",Object(r.b)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),Object(r.b)("p",null,"Make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' --provider=keycloak\n --client-id=\n --client-secret=\n --login-url="http(s):///auth/realms//protocol/openid-connect/auth"\n --redeem-url="http(s):///auth/realms//protocol/openid-connect/token"\n --profile-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n --validate-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n --keycloak-group=\n --keycloak-group=\n')),Object(r.b)("p",null,"For group based authorization, the optional ",Object(r.b)("inlineCode",{parentName:"p"},"--keycloak-group")," (legacy) or ",Object(r.b)("inlineCode",{parentName:"p"},"--allowed-group")," (global standard)\nflags can be used to specify which groups to limit access to."),Object(r.b)("p",null,"If these are unset but a ",Object(r.b)("inlineCode",{parentName:"p"},"groups")," mapper is set up above in step (3), the provider will still\npopulate the ",Object(r.b)("inlineCode",{parentName:"p"},"X-Forwarded-Groups")," header to your upstream server with the ",Object(r.b)("inlineCode",{parentName:"p"},"groups")," data in the\nKeycloak userinfo endpoint response."),Object(r.b)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak\nyou should define the 'keycloak-group' value to /admin."),Object(r.b)("h3",{id:"keycloak-oidc-auth-provider"},"Keycloak OIDC Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",Object(r.b)("strong",{parentName:"li"},"Access Type")," 'confidental', ",Object(r.b)("strong",{parentName:"li"},"Client protocol")," 'openid-connect' and ",Object(r.b)("strong",{parentName:"li"},"Valid Redirect URIs")," '",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://internal.yourcompany.com/oauth2/callback'"}),"https://internal.yourcompany.com/oauth2/callback'")),Object(r.b)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),Object(r.b)("li",{parentName:"ol"},"Create a mapper with ",Object(r.b)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",Object(r.b)("strong",{parentName:"li"},"Token Claim Name")," 'groups'."),Object(r.b)("li",{parentName:"ol"},"Create a mapper with ",Object(r.b)("strong",{parentName:"li"},"Mapper Type")," 'Audience' and ",Object(r.b)("strong",{parentName:"li"},"Included Client Audience")," and ",Object(r.b)("strong",{parentName:"li"},"Included Custom Audience")," set to your client name.")),Object(r.b)("p",null,"Make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=keycloak-oidc\n --client-id=\n --client-secret=\n --redirect-url=https://myapp.com/oauth2/callback\n --oidc-issuer-url=https:///auth/realms/\n --allowed-role= // Optional, required realm role\n --allowed-role=: // Optional, required client role\n")),Object(r.b)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),Object(r.b)("p",null,"This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/issues/994"}),"994"),")."),Object(r.b)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"}),"these steps to add an application"),". Make sure to enable at least the ",Object(r.b)("inlineCode",{parentName:"p"},"openid"),", ",Object(r.b)("inlineCode",{parentName:"p"},"profile")," and ",Object(r.b)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://myapp.com/oauth2/callback"}),"https://myapp.com/oauth2/callback"),"."),Object(r.b)("p",null,"If you need projects filtering, add the extra ",Object(r.b)("inlineCode",{parentName:"p"},"read_api")," scope to your application."),Object(r.b)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/configuration/overview#generating-a-cookie-secret"}),"these steps")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' --provider="gitlab"\n --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n --client-id=GITLAB_CLIENT_ID\n --client-secret=GITLAB_CLIENT_SECRET\n --cookie-secret=COOKIE_SECRET\n')),Object(r.b)("p",null,"Restricting by group membership is possible with the following option:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),Object(r.b)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--oidc-issuer-url=""\n')),Object(r.b)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),Object(r.b)("p",null,"For LinkedIn, the registration steps are:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://www.linkedin.com/secure/developer"}),"https://www.linkedin.com/secure/developer")),Object(r.b)("li",{parentName:"ol"},"In the OAuth User Agreement section:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),Object(r.b)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),Object(r.b)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),Object(r.b)("li",{parentName:"ol"},"Take note of the ",Object(r.b)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",Object(r.b)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),Object(r.b)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),Object(r.b)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."),Object(r.b)("p",null,"This provider was originally built against CoreOS Dex and we will use it as an example.\nThe OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below."),Object(r.b)("h4",{id:"dex"},"Dex"),Object(r.b)("p",null,"To configure the OIDC provider for Dex, perform the following steps:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Download Dex:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"go get github.com/dexidp/dex\n")),Object(r.b)("p",{parentName:"li"},"See the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/coreos/dex/blob/master/Documentation/getting-started.md"}),"getting started guide")," for more details.")),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the ",Object(r.b)("inlineCode",{parentName:"p"},"staticClients")," section of ",Object(r.b)("inlineCode",{parentName:"p"},"examples/config-dev.yaml"),":"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"- id: oauth2-proxy\nredirectURIs:\n- 'http://127.0.0.1:4180/oauth2/callback'\nname: 'oauth2-proxy'\nsecret: proxy\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Launch Dex: from ",Object(r.b)("inlineCode",{parentName:"p"},"$GOPATH/github.com/dexidp/dex"),", run:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"bin/dex serve examples/config-dev.yaml\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"In a second terminal, run the oauth2-proxy with the following args:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-provider oidc\n-provider-display-name "My OIDC Provider"\n-client-id oauth2-proxy\n-client-secret proxy\n-redirect-url http://127.0.0.1:4180/oauth2/callback\n-oidc-issuer-url http://127.0.0.1:5556/dex\n-cookie-secure=false\n-cookie-secret=secret\n-email-domain kilgore.trout\n')),Object(r.b)("p",{parentName:"li"},"To serve the current working directory as a web site under the ",Object(r.b)("inlineCode",{parentName:"p"},"/static")," endpoint, add:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"-upstream file://$PWD/#/static/\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Test the setup by visiting ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"http://127.0.0.1:4180"}),"http://127.0.0.1:4180")," or ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"http://127.0.0.1:4180/static"}),"http://127.0.0.1:4180/static")," ."))),Object(r.b)("p",null,"See also ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment"}),"our local testing environment")," for a self-contained example using Docker and etcd as storage for Dex."),Object(r.b)("h4",{id:"okta"},"Okta"),Object(r.b)("p",null,"To configure the OIDC provider for Okta, perform the following steps:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",Object(r.b)("inlineCode",{parentName:"li"},"example.oktapreview.com")),Object(r.b)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",Object(r.b)("inlineCode",{parentName:"li"},"default")," will work.")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Security")," then select ",Object(r.b)("strong",{parentName:"li"},"API")),Object(r.b)("li",{parentName:"ul"},"Click ",Object(r.b)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),Object(r.b)("li",{parentName:"ul"},"Fill out the ",Object(r.b)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),Object(r.b)("li",{parentName:"ul"},"For ",Object(r.b)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://example.corp.com"}),"https://example.corp.com")),Object(r.b)("li",{parentName:"ul"},"Fill out a ",Object(r.b)("strong",{parentName:"li"},"Description")),Object(r.b)("li",{parentName:"ul"},"Add any ",Object(r.b)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),Object(r.b)("li",{parentName:"ul"},"The default settings will work for other options.\n",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"}),"See Okta documentation for more information on Authorization Servers"))),Object(r.b)("ol",{start:3},Object(r.b)("li",{parentName:"ol"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Applications")," then select ",Object(r.b)("strong",{parentName:"li"},"Add Application"),".")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"Web")," for the ",Object(r.b)("strong",{parentName:"li"},"Platform")," setting."),Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"OpenID Connect")," and click ",Object(r.b)("strong",{parentName:"li"},"Create")),Object(r.b)("li",{parentName:"ul"},"Pick an ",Object(r.b)("strong",{parentName:"li"},"Application Name")," such as ",Object(r.b)("inlineCode",{parentName:"li"},"Example App"),"."),Object(r.b)("li",{parentName:"ul"},"Set the ",Object(r.b)("strong",{parentName:"li"},"Login redirect URI")," to ",Object(r.b)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"General")," set the ",Object(r.b)("strong",{parentName:"li"},"Allowed grant types")," to ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token"),"."),Object(r.b)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client Secret"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),Object(r.b)("ol",{start:4},Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Create a configuration file like the following:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n "https://example.corp.com"\n]\nemail_domains = [\n "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')))),Object(r.b)("p",null,"The ",Object(r.b)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",Object(r.b)("strong",{parentName:"p"},"Authorization Server"),"'s ",Object(r.b)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://corp.okta.com"}),"https://corp.okta.com")," .\nThe ",Object(r.b)("inlineCode",{parentName:"p"},"client_id")," and ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",Object(r.b)("inlineCode",{parentName:"p"},"cookie_secret")," to encrypt the cookie."),Object(r.b)("p",null,"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),Object(r.b)("h4",{id:"okta---localhost"},"Okta - localhost"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Signup for developer account: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/signup/"}),"https://developer.okta.com/signup/")),Object(r.b)("li",{parentName:"ol"},"Create New ",Object(r.b)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),Object(r.b)("li",{parentName:"ol"},"Example Application Settings for localhost:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Name:")," My Web App"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Group assignments:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Everyone")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Grant type allowed:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token")))),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),Object(r.b)("li",{parentName:"ol"},"Example config file ",Object(r.b)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n "http://0.0.0.0:8080"\n]\nemail_domains = [\n "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),Object(r.b)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),Object(r.b)("h3",{id:"logingov-provider"},"login.gov Provider"),Object(r.b)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://login.gov/developers/"}),"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),Object(r.b)("p",null,"A developer guide is available here: ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://developers.login.gov/"}),"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),Object(r.b)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),Object(r.b)("p",null,"First, register your application in the dashboard. The important bits are:"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Identity protocol: make this ",Object(r.b)("inlineCode",{parentName:"li"},"Openid connect")),Object(r.b)("li",{parentName:"ul"},"Issuer: do what they say for OpenID Connect. We will refer to this string as ",Object(r.b)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),Object(r.b)("li",{parentName:"ul"},"Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",Object(r.b)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",Object(r.b)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",Object(r.b)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),Object(r.b)("li",{parentName:"ul"},"Return to App URL: Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/")),Object(r.b)("li",{parentName:"ul"},"Redirect URIs: Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),Object(r.b)("li",{parentName:"ul"},"Attribute Bundle: Make sure that email is selected.")),Object(r.b)("p",null,"Now start the proxy up with the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'./oauth2-proxy -provider login.gov \\\n -client-id=${LOGINGOV_ISSUER} \\\n -redirect-url=http://localhost:4180/oauth2/callback \\\n -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n -cookie-secure=false \\\n -email-domain=gsa.gov \\\n -upstream=http://localhost:3000/ \\\n -cookie-secret=somerandomstring12341234567890AB \\\n -cookie-domain=localhost \\\n -skip-provider-button=true \\\n -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),Object(r.b)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",Object(r.b)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",Object(r.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",Object(r.b)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),Object(r.b)("p",null,"Once it is running, you should be able to go to ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:3000/"),". In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),Object(r.b)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),Object(r.b)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),Object(r.b)("p",null,"In this case, you can set the ",Object(r.b)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," -provider oidc\n -client-id oauth2-proxy\n -client-secret proxy\n -redirect-url http://127.0.0.1:4180/oauth2/callback\n -oidc-issuer-url http://127.0.0.1:5556\n -skip-oidc-discovery\n -login-url http://127.0.0.1:5556/authorize\n -redeem-url http://127.0.0.1:5556/token\n -oidc-jwks-url http://127.0.0.1:5556/keys\n -cookie-secure=false\n -email-domain example.com\n")),Object(r.b)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),Object(r.b)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),Object(r.b)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",Object(r.b)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",Object(r.b)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),Object(r.b)("p",null,"Refer to the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"}),"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',Object(r.b)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' -provider nextcloud\n -client-id \n -client-secret \n -login-url="/index.php/apps/oauth2/authorize"\n -redeem-url="/index.php/apps/oauth2/api/v1/token"\n -validate-url="/ocs/v2.php/cloud/user?format=json"\n')),Object(r.b)("p",null,"Note: in ",Object(r.b)("em",{parentName:"p"},"all")," cases the validate-url will ",Object(r.b)("em",{parentName:"p"},"not")," have the ",Object(r.b)("inlineCode",{parentName:"p"},"index.php"),"."),Object(r.b)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://cloud.digitalocean.com/account/api/applications"}),"Create a new OAuth application"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),Object(r.b)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',Object(r.b)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=digitalocean\n --client-id=\n --client-secret=\n")),Object(r.b)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",Object(r.b)("inlineCode",{parentName:"p"},"https:///oauth2/callback"),". If you need to change it, you can use the ",Object(r.b)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),Object(r.b)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"}),"Add a new OAuth consumer"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},'In "Callback URL" use ',Object(r.b)("inlineCode",{parentName:"li"},"https:///oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"")," with the actual hostname that oauth2-proxy is running on."),Object(r.b)("li",{parentName:"ul"},"In Permissions section select:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"Account -> Email"),Object(r.b)("li",{parentName:"ul"},"Team membership -> Read"),Object(r.b)("li",{parentName:"ul"},"Repositories -> Read"))))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=bitbucket\n --client-id=\n --client-secret=\n")),Object(r.b)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-team="),". To restrict the access to only these users who has access to one selected repository use ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-repository="),"."),Object(r.b)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new application: ",Object(r.b)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",Object(r.b)("inlineCode",{parentName:"li"},"https:///oauth2/callback")),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),Object(r.b)("li",{parentName:"ol"},"Pass the following options to the proxy:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' --provider="github"\n --redirect-url="https:///oauth2/callback"\n --provider-display-name="Gitea"\n --client-id="< client_id as generated by Gitea >"\n --client-secret="< client_secret as generated by Gitea >"\n --login-url="https://< your gitea host >/login/oauth/authorize"\n --redeem-url="https://< your gitea host >/login/oauth/access_token"\n --validate-url="https://< your gitea host >/api/v1"\n')),Object(r.b)("h2",{id:"email-authentication"},"Email Authentication"),Object(r.b)("p",null,"To authorize by email domain use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),Object(r.b)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),Object(r.b)("p",null,"Follow the examples in the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"}),Object(r.b)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",Object(r.b)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",Object(r.b)("inlineCode",{parentName:"p"},"case")," to\n",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"}),Object(r.b)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",Object(r.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",Object(r.b)("inlineCode",{parentName:"p"},"Provider"),"."))}b.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/docs/6.1.x/behaviour/index.html b/docs/6.1.x/behaviour/index.html index 1ee7fd62..22fca604 100644 --- a/docs/6.1.x/behaviour/index.html +++ b/docs/6.1.x/behaviour/index.html @@ -6,7 +6,7 @@ Behaviour | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 6.1.x

Behaviour

  1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).
  2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with Accept: application/json, in which case 401 Unauthorized is returned)
  3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
  4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)

Notice that the proxy also provides a number of useful endpoints.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/6.1.x/community/security/index.html b/docs/6.1.x/community/security/index.html index 9fa363b2..f2b9b5d5 100644 --- a/docs/6.1.x/community/security/index.html +++ b/docs/6.1.x/community/security/index.html @@ -6,7 +6,7 @@ Security | OAuth2 Proxy - + @@ -38,7 +38,7 @@ merging fixes until all patches are ready. We may also backport the fix to previous releases, but this will be at the discretion of the maintainers.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/6.1.x/configuration/oauth_provider/index.html b/docs/6.1.x/configuration/oauth_provider/index.html index 12c41df8..f4f79468 100644 --- a/docs/6.1.x/configuration/oauth_provider/index.html +++ b/docs/6.1.x/configuration/oauth_provider/index.html @@ -6,7 +6,7 @@ OAuth Provider Configuration | OAuth2 Proxy - + @@ -55,7 +55,7 @@ to setup the client id and client secret. Your "Redirection URI" will providers.New() to allow oauth2-proxy to use the new Provider.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/6.1.x/configuration/overview/index.html b/docs/6.1.x/configuration/overview/index.html index c522c0c8..757631d3 100644 --- a/docs/6.1.x/configuration/overview/index.html +++ b/docs/6.1.x/configuration/overview/index.html @@ -6,7 +6,7 @@ Overview | OAuth2 Proxy - + @@ -39,7 +39,7 @@ Variables set with auth_request_set are not set-able i Note that nginxinc/kubernetes-ingress does not include the Lua module.

nginx.ingress.kubernetes.io/auth-response-headers: Authorization
nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
nginx.ingress.kubernetes.io/configuration-snippet: |
auth_request_set $name_upstream_1 $upstream_cookie_name_1;
access_by_lua_block {
if ngx.var.name_upstream_1 ~= "" then
ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")
end
}

It is recommended to use --session-store-type=redis when expecting large sessions/OIDC tokens (e.g. with MS Azure).

You have to substitute name with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".

note

If you set up your OAuth2 provider to rotate your client secret, you can use the client-secret-file option to reload the secret when it is updated.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/6.1.x/configuration/session_storage/index.html b/docs/6.1.x/configuration/session_storage/index.html index bf01cacc..1df23c4d 100644 --- a/docs/6.1.x/configuration/session_storage/index.html +++ b/docs/6.1.x/configuration/session_storage/index.html @@ -6,7 +6,7 @@ Session Storage | OAuth2 Proxy - + @@ -35,7 +35,7 @@ disclosure.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/6.1.x/configuration/tls/index.html b/docs/6.1.x/configuration/tls/index.html index d6c75750..8ecc5def 100644 --- a/docs/6.1.x/configuration/tls/index.html +++ b/docs/6.1.x/configuration/tls/index.html @@ -6,7 +6,7 @@ TLS Configuration | OAuth2 Proxy - + @@ -26,7 +26,7 @@ would be https://internal.yourcompany.com/.

An example Nginx via HSTS:

server {
listen 443 default ssl;
server_name internal.yourcompany.com;
ssl_certificate /path/to/cert.pem;
ssl_certificate_key /path/to/cert.key;
add_header Strict-Transport-Security max-age=2592000;
location / {
proxy_pass http://127.0.0.1:4180;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_connect_timeout 1;
proxy_send_timeout 30;
proxy_read_timeout 30;
}
}

The command line to run oauth2-proxy in this configuration would look like this:

./oauth2-proxy \
--email-domain="yourcompany.com" \
--upstream=http://127.0.0.1:8080/ \
--cookie-secret=... \
--cookie-secure=true \
--provider=... \
--reverse-proxy=true \
--client-id=... \
--client-secret=...
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/6.1.x/features/endpoints/index.html b/docs/6.1.x/features/endpoints/index.html index ba19577b..8c92bae3 100644 --- a/docs/6.1.x/features/endpoints/index.html +++ b/docs/6.1.x/features/endpoints/index.html @@ -6,7 +6,7 @@ Endpoints | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 6.1.x

Endpoints

OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.

  • /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see robotstxt.org for more info
  • /ping - returns a 200 OK response, which is intended for use with health checks
  • /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
  • /oauth2/sign_out - this URL is used to clear the session cookie
  • /oauth2/start - a URL that will redirect to start the OAuth cycle
  • /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
  • /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
  • /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the Nginx auth_request directive

Sign out

To sign the user out, redirect them to /oauth2/sign_out. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the rd query parameter, i.e. redirect the user to something like (notice the url-encoding!):

/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page

Alternatively, include the redirect URL in the X-Auth-Request-Redirect header:

GET /oauth2/sign_out HTTP/1.1
X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
...

(The "sign_out_page" should be the end_session_endpoint from the metadata if your OIDC provider supports Session Management and Discovery.)

BEWARE that the domain you want to redirect to (my-oidc-provider.example.com in the example) must be added to the --whitelist-domain configuration option otherwise the redirect will be ignored.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/6.1.x/features/request_signatures/index.html b/docs/6.1.x/features/request_signatures/index.html index f1f6ce66..6469dab7 100644 --- a/docs/6.1.x/features/request_signatures/index.html +++ b/docs/6.1.x/features/request_signatures/index.html @@ -6,7 +6,7 @@ Request Signatures | OAuth2 Proxy - + @@ -27,7 +27,7 @@ following:

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/6.1.x/index.html b/docs/6.1.x/index.html index e2d04291..0eeccb26 100644 --- a/docs/6.1.x/index.html +++ b/docs/6.1.x/index.html @@ -6,7 +6,7 @@ Installation | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 6.1.x

Installation

  1. Choose how to deploy:

    a. Download Prebuilt Binary (current release is v6.1.1)

    b. Build with $ go get github.com/oauth2-proxy/oauth2-proxy which will put the binary in $GOPATH/bin

    c. Using the prebuilt docker image quay.io/oauth2-proxy/oauth2-proxy (AMD64, ARMv6 and ARM64 tags available)

Prebuilt binaries can be validated by extracting the file and verifying it against the sha256sum.txt checksum file provided for each release starting with version v3.0.0.

$ sha256sum -c sha256sum.txt 2>&1 | grep OK
oauth2-proxy-x.y.z.linux-amd64: OK
  1. Select a Provider and Register an OAuth Application with a Provider
  2. Configure OAuth2 Proxy using config file, command line options, or environment variables
  3. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.0.x/behaviour/index.html b/docs/7.0.x/behaviour/index.html index dd614d7f..c7a37095 100644 --- a/docs/7.0.x/behaviour/index.html +++ b/docs/7.0.x/behaviour/index.html @@ -6,7 +6,7 @@ Behaviour | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 7.0.x

Behaviour

  1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).
  2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with Accept: application/json, in which case 401 Unauthorized is returned)
  3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
  4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)

Notice that the proxy also provides a number of useful endpoints.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.0.x/community/security/index.html b/docs/7.0.x/community/security/index.html index 6a29a893..1d18ec67 100644 --- a/docs/7.0.x/community/security/index.html +++ b/docs/7.0.x/community/security/index.html @@ -6,7 +6,7 @@ Security | OAuth2 Proxy - + @@ -38,7 +38,7 @@ merging fixes until all patches are ready. We may also backport the fix to previous releases, but this will be at the discretion of the maintainers.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.0.x/configuration/alpha-config/index.html b/docs/7.0.x/configuration/alpha-config/index.html index d6a6bcb0..aaf239bb 100644 --- a/docs/7.0.x/configuration/alpha-config/index.html +++ b/docs/7.0.x/configuration/alpha-config/index.html @@ -6,7 +6,7 @@ Alpha Configuration | OAuth2 Proxy - + @@ -44,7 +44,7 @@ make up the header value

FieldTypeDes Only one source within the struct should be defined at any time.

FieldTypeDescription
value[]byteValue expects a base64 encoded string value.
fromEnvstringFromEnv expects the name of an environment variable.
fromFilestringFromFile expects a path to a file containing the secret value.

Upstream

(Appears on: Upstreams)

Upstream represents the configuration for an upstream server. Requests will be proxied to this upstream if the path matches the request path.

FieldTypeDescription
idstringID should be a unique identifier for the upstream.
This value is required for all upstreams.
pathstringPath is used to map requests to the upstream server.
The closest match will take precedence and all Paths must be unique.
uristringThe URI of the upstream server. This may be an HTTP(S) server of a File
based URL. It may include a path, in which case all requests will be served
under that path.
Eg:
- http://localhost:8080
- https://service.localhost
- https://service.localhost/path
- file://host/path
If the URI's path is "/base" and the incoming request was for "/dir",
the upstream request will be for "/base/dir".
insecureSkipTLSVerifyboolInsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.
This option is insecure and will allow potential Man-In-The-Middle attacks
betweem OAuth2 Proxy and the usptream server.
Defaults to false.
staticboolStatic will make all requests to this upstream have a static response.
The response will have a body of "Authenticated" and a response code
matching StaticCode.
If StaticCode is not set, the response will return a 200 response.
staticCodeintStaticCode determines the response code for the Static response.
This option can only be used with Static enabled.
flushIntervalDurationFlushInterval is the period between flushing the response buffer when
streaming response from the upstream.
Defaults to 1 second.
passHostHeaderboolPassHostHeader determines whether the request host header should be proxied
to the upstream server.
Defaults to true.
proxyWebSocketsboolProxyWebSockets enables proxying of websockets to upstream servers
Defaults to true.

Upstreams

([]Upstream alias)

(Appears on: AlphaOptions)

Upstreams is a collection of definitions for upstream servers.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.0.x/configuration/oauth_provider/index.html b/docs/7.0.x/configuration/oauth_provider/index.html index 0c2aedd4..a50ba7e6 100644 --- a/docs/7.0.x/configuration/oauth_provider/index.html +++ b/docs/7.0.x/configuration/oauth_provider/index.html @@ -6,7 +6,7 @@ OAuth Provider Configuration | OAuth2 Proxy - + @@ -59,7 +59,7 @@ to setup the client id and client secret. Your "Redirection URI" will providers.New() to allow oauth2-proxy to use the new Provider.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.0.x/configuration/overview/index.html b/docs/7.0.x/configuration/overview/index.html index cb2d014b..93b6d701 100644 --- a/docs/7.0.x/configuration/overview/index.html +++ b/docs/7.0.x/configuration/overview/index.html @@ -6,7 +6,7 @@ Overview | OAuth2 Proxy - + @@ -43,7 +43,7 @@ Note that nginxinc/kubernetes-ingress does not include the Lua modu
services:
a-service-backend:
loadBalancer:
servers:
- url: http://172.16.0.2:7555
b-service-backend:
loadBalancer:
servers:
- url: http://172.16.0.3:7555
oauth-backend:
loadBalancer:
servers:
- url: http://172.16.0.1:4180
middlewares:
auth-headers:
headers:
sslRedirect: true
stsSeconds: 315360000
browserXssFilter: true
contentTypeNosniff: true
forceSTSHeader: true
sslHost: example.com
stsIncludeSubdomains: true
stsPreload: true
frameDeny: true
oauth-auth-redirect:
forwardAuth:
address: https://oauth.example.com/
trustForwardHeader: true
authResponseHeaders:
- X-Auth-Request-Access-Token
- Authorization
oauth-auth-wo-redirect:
forwardAuth:
address: https://oauth.example.com/oauth2/auth
trustForwardHeader: true
authResponseHeaders:
- X-Auth-Request-Access-Token
- Authorization
note

If you set up your OAuth2 provider to rotate your client secret, you can use the client-secret-file option to reload the secret when it is updated.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.0.x/configuration/session_storage/index.html b/docs/7.0.x/configuration/session_storage/index.html index 4fa572f6..4fe24453 100644 --- a/docs/7.0.x/configuration/session_storage/index.html +++ b/docs/7.0.x/configuration/session_storage/index.html @@ -6,7 +6,7 @@ Session Storage | OAuth2 Proxy - + @@ -35,7 +35,7 @@ disclosure.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.0.x/configuration/tls/index.html b/docs/7.0.x/configuration/tls/index.html index 1d085e57..8a506958 100644 --- a/docs/7.0.x/configuration/tls/index.html +++ b/docs/7.0.x/configuration/tls/index.html @@ -6,7 +6,7 @@ TLS Configuration | OAuth2 Proxy - + @@ -26,7 +26,7 @@ would be https://internal.yourcompany.com/.

An example Nginx via HSTS:

server {
listen 443 default ssl;
server_name internal.yourcompany.com;
ssl_certificate /path/to/cert.pem;
ssl_certificate_key /path/to/cert.key;
add_header Strict-Transport-Security max-age=2592000;
location / {
proxy_pass http://127.0.0.1:4180;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_connect_timeout 1;
proxy_send_timeout 30;
proxy_read_timeout 30;
}
}

The command line to run oauth2-proxy in this configuration would look like this:

./oauth2-proxy \
--email-domain="yourcompany.com" \
--upstream=http://127.0.0.1:8080/ \
--cookie-secret=... \
--cookie-secure=true \
--provider=... \
--reverse-proxy=true \
--client-id=... \
--client-secret=...
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.0.x/features/endpoints/index.html b/docs/7.0.x/features/endpoints/index.html index 5b9f43bd..c018f2f4 100644 --- a/docs/7.0.x/features/endpoints/index.html +++ b/docs/7.0.x/features/endpoints/index.html @@ -6,7 +6,7 @@ Endpoints | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 7.0.x

Endpoints

OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.

  • /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see robotstxt.org for more info
  • /ping - returns a 200 OK response, which is intended for use with health checks
  • /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
  • /oauth2/sign_out - this URL is used to clear the session cookie
  • /oauth2/start - a URL that will redirect to start the OAuth cycle
  • /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
  • /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
  • /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the Nginx auth_request directive

Sign out

To sign the user out, redirect them to /oauth2/sign_out. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the rd query parameter, i.e. redirect the user to something like (notice the url-encoding!):

/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page

Alternatively, include the redirect URL in the X-Auth-Request-Redirect header:

GET /oauth2/sign_out HTTP/1.1
X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
...

(The "sign_out_page" should be the end_session_endpoint from the metadata if your OIDC provider supports Session Management and Discovery.)

BEWARE that the domain you want to redirect to (my-oidc-provider.example.com in the example) must be added to the --whitelist-domain configuration option otherwise the redirect will be ignored.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.0.x/features/request_signatures/index.html b/docs/7.0.x/features/request_signatures/index.html index d28a2387..2da53869 100644 --- a/docs/7.0.x/features/request_signatures/index.html +++ b/docs/7.0.x/features/request_signatures/index.html @@ -6,7 +6,7 @@ Request Signatures | OAuth2 Proxy - + @@ -27,7 +27,7 @@ following:

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.0.x/index.html b/docs/7.0.x/index.html index d0d0fdeb..b2b2b438 100644 --- a/docs/7.0.x/index.html +++ b/docs/7.0.x/index.html @@ -6,7 +6,7 @@ Installation | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 7.0.x

Installation

  1. Choose how to deploy:

    a. Download Prebuilt Binary (current release is v7.0.1)

    b. Build with $ go get github.com/oauth2-proxy/oauth2-proxy/v7 which will put the binary in $GOPATH/bin

    c. Using the prebuilt docker image quay.io/oauth2-proxy/oauth2-proxy (AMD64, ARMv6 and ARM64 tags available)

Prebuilt binaries can be validated by extracting the file and verifying it against the sha256sum.txt checksum file provided for each release starting with version v3.0.0.

$ sha256sum -c sha256sum.txt 2>&1 | grep OK
oauth2-proxy-x.y.z.linux-amd64: OK
  1. Select a Provider and Register an OAuth Application with a Provider
  2. Configure OAuth2 Proxy using config file, command line options, or environment variables
  3. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.1.x/behaviour/index.html b/docs/7.1.x/behaviour/index.html index ac0786a9..b0214a31 100644 --- a/docs/7.1.x/behaviour/index.html +++ b/docs/7.1.x/behaviour/index.html @@ -6,7 +6,7 @@ Behaviour | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 7.1.x

Behaviour

  1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).
  2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with Accept: application/json, in which case 401 Unauthorized is returned)
  3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
  4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)

Notice that the proxy also provides a number of useful endpoints.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.1.x/community/security/index.html b/docs/7.1.x/community/security/index.html index 8ed63ca4..848f7245 100644 --- a/docs/7.1.x/community/security/index.html +++ b/docs/7.1.x/community/security/index.html @@ -6,7 +6,7 @@ Security | OAuth2 Proxy - + @@ -38,7 +38,7 @@ merging fixes until all patches are ready. We may also backport the fix to previous releases, but this will be at the discretion of the maintainers.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.1.x/configuration/alpha-config/index.html b/docs/7.1.x/configuration/alpha-config/index.html index 8e830aae..9be6b0d2 100644 --- a/docs/7.1.x/configuration/alpha-config/index.html +++ b/docs/7.1.x/configuration/alpha-config/index.html @@ -6,7 +6,7 @@ Alpha Configuration | OAuth2 Proxy - + @@ -44,7 +44,7 @@ make up the header value

FieldTypeDes Only one source within the struct should be defined at any time.

FieldTypeDescription
value[]byteValue expects a base64 encoded string value.
fromEnvstringFromEnv expects the name of an environment variable.
fromFilestringFromFile expects a path to a file containing the secret value.

Server

(Appears on: AlphaOptions)

Server represents the configuration for an HTTP(S) server

FieldTypeDescription
BindAddressstringBindAddress is the address on which to serve traffic.
Leave blank or set to "-" to disable.
SecureBindAddressstringSecureBindAddress is the address on which to serve secure traffic.
Leave blank or set to "-" to disable.
TLSTLSTLS contains the information for loading the certificate and key for the
secure traffic.

TLS

(Appears on: Server)

TLS contains the information for loading a TLS certifcate and key.

FieldTypeDescription
KeySecretSourceKey is the TLS key data to use.
Typically this will come from a file.
CertSecretSourceCert is the TLS certificate data to use.
Typically this will come from a file.

Upstream

(Appears on: Upstreams)

Upstream represents the configuration for an upstream server. Requests will be proxied to this upstream if the path matches the request path.

FieldTypeDescription
idstringID should be a unique identifier for the upstream.
This value is required for all upstreams.
pathstringPath is used to map requests to the upstream server.
The closest match will take precedence and all Paths must be unique.
uristringThe URI of the upstream server. This may be an HTTP(S) server of a File
based URL. It may include a path, in which case all requests will be served
under that path.
Eg:
- http://localhost:8080
- https://service.localhost
- https://service.localhost/path
- file://host/path
If the URI's path is "/base" and the incoming request was for "/dir",
the upstream request will be for "/base/dir".
insecureSkipTLSVerifyboolInsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.
This option is insecure and will allow potential Man-In-The-Middle attacks
betweem OAuth2 Proxy and the usptream server.
Defaults to false.
staticboolStatic will make all requests to this upstream have a static response.
The response will have a body of "Authenticated" and a response code
matching StaticCode.
If StaticCode is not set, the response will return a 200 response.
staticCodeintStaticCode determines the response code for the Static response.
This option can only be used with Static enabled.
flushIntervalDurationFlushInterval is the period between flushing the response buffer when
streaming response from the upstream.
Defaults to 1 second.
passHostHeaderboolPassHostHeader determines whether the request host header should be proxied
to the upstream server.
Defaults to true.
proxyWebSocketsboolProxyWebSockets enables proxying of websockets to upstream servers
Defaults to true.

Upstreams

([]Upstream alias)

(Appears on: AlphaOptions)

Upstreams is a collection of definitions for upstream servers.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.1.x/configuration/oauth_provider/index.html b/docs/7.1.x/configuration/oauth_provider/index.html index 119ac7a6..04ad90cb 100644 --- a/docs/7.1.x/configuration/oauth_provider/index.html +++ b/docs/7.1.x/configuration/oauth_provider/index.html @@ -6,7 +6,7 @@ OAuth Provider Configuration | OAuth2 Proxy - + @@ -59,7 +59,7 @@ to setup the client id and client secret. Your "Redirection URI" will providers.New() to allow oauth2-proxy to use the new Provider.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.1.x/configuration/overview/index.html b/docs/7.1.x/configuration/overview/index.html index 7556bb99..9bce0b8f 100644 --- a/docs/7.1.x/configuration/overview/index.html +++ b/docs/7.1.x/configuration/overview/index.html @@ -6,7 +6,7 @@ Overview | OAuth2 Proxy - + @@ -43,7 +43,7 @@ Note that nginxinc/kubernetes-ingress does not include the Lua modu
services:
a-service-backend:
loadBalancer:
servers:
- url: http://172.16.0.2:7555
b-service-backend:
loadBalancer:
servers:
- url: http://172.16.0.3:7555
oauth-backend:
loadBalancer:
servers:
- url: http://172.16.0.1:4180
middlewares:
auth-headers:
headers:
sslRedirect: true
stsSeconds: 315360000
browserXssFilter: true
contentTypeNosniff: true
forceSTSHeader: true
sslHost: example.com
stsIncludeSubdomains: true
stsPreload: true
frameDeny: true
oauth-auth-redirect:
forwardAuth:
address: https://oauth.example.com/
trustForwardHeader: true
authResponseHeaders:
- X-Auth-Request-Access-Token
- Authorization
oauth-auth-wo-redirect:
forwardAuth:
address: https://oauth.example.com/oauth2/auth
trustForwardHeader: true
authResponseHeaders:
- X-Auth-Request-Access-Token
- Authorization
note

If you set up your OAuth2 provider to rotate your client secret, you can use the client-secret-file option to reload the secret when it is updated.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.1.x/configuration/session_storage/index.html b/docs/7.1.x/configuration/session_storage/index.html index ea94483e..93b6220a 100644 --- a/docs/7.1.x/configuration/session_storage/index.html +++ b/docs/7.1.x/configuration/session_storage/index.html @@ -6,7 +6,7 @@ Session Storage | OAuth2 Proxy - + @@ -35,7 +35,7 @@ disclosure.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.1.x/configuration/tls/index.html b/docs/7.1.x/configuration/tls/index.html index e3d919af..5b683605 100644 --- a/docs/7.1.x/configuration/tls/index.html +++ b/docs/7.1.x/configuration/tls/index.html @@ -6,7 +6,7 @@ TLS Configuration | OAuth2 Proxy - + @@ -26,7 +26,7 @@ would be https://internal.yourcompany.com/.

An example Nginx via HSTS:

server {
listen 443 default ssl;
server_name internal.yourcompany.com;
ssl_certificate /path/to/cert.pem;
ssl_certificate_key /path/to/cert.key;
add_header Strict-Transport-Security max-age=2592000;
location / {
proxy_pass http://127.0.0.1:4180;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_connect_timeout 1;
proxy_send_timeout 30;
proxy_read_timeout 30;
}
}

The command line to run oauth2-proxy in this configuration would look like this:

./oauth2-proxy \
--email-domain="yourcompany.com" \
--upstream=http://127.0.0.1:8080/ \
--cookie-secret=... \
--cookie-secure=true \
--provider=... \
--reverse-proxy=true \
--client-id=... \
--client-secret=...
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.1.x/features/endpoints/index.html b/docs/7.1.x/features/endpoints/index.html index 6ea30459..5944db93 100644 --- a/docs/7.1.x/features/endpoints/index.html +++ b/docs/7.1.x/features/endpoints/index.html @@ -6,7 +6,7 @@ Endpoints | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 7.1.x

Endpoints

OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.

  • /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see robotstxt.org for more info
  • /ping - returns a 200 OK response, which is intended for use with health checks
  • /metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by --metrics-address, disabled by default
  • /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
  • /oauth2/sign_out - this URL is used to clear the session cookie
  • /oauth2/start - a URL that will redirect to start the OAuth cycle
  • /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
  • /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
  • /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the Nginx auth_request directive

Sign out

To sign the user out, redirect them to /oauth2/sign_out. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the rd query parameter, i.e. redirect the user to something like (notice the url-encoding!):

/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page

Alternatively, include the redirect URL in the X-Auth-Request-Redirect header:

GET /oauth2/sign_out HTTP/1.1
X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
...

(The "sign_out_page" should be the end_session_endpoint from the metadata if your OIDC provider supports Session Management and Discovery.)

BEWARE that the domain you want to redirect to (my-oidc-provider.example.com in the example) must be added to the --whitelist-domain configuration option otherwise the redirect will be ignored.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.1.x/index.html b/docs/7.1.x/index.html index f3c6c969..47852b78 100644 --- a/docs/7.1.x/index.html +++ b/docs/7.1.x/index.html @@ -6,7 +6,7 @@ Installation | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 7.1.x

Installation

  1. Choose how to deploy:

    a. Download Prebuilt Binary (current release is v7.1.3)

    b. Build with $ go get github.com/oauth2-proxy/oauth2-proxy/v7 which will put the binary in $GOPATH/bin

    c. Using the prebuilt docker image quay.io/oauth2-proxy/oauth2-proxy (AMD64, ARMv6 and ARM64 tags available)

    d. Using a Kubernetes manifest (Helm)

Prebuilt binaries can be validated by extracting the file and verifying it against the sha256sum.txt checksum file provided for each release starting with version v3.0.0.

$ sha256sum -c sha256sum.txt 2>&1 | grep OK
oauth2-proxy-x.y.z.linux-amd64: OK
  1. Select a Provider and Register an OAuth Application with a Provider
  2. Configure OAuth2 Proxy using config file, command line options, or environment variables
  3. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/behaviour/index.html b/docs/behaviour/index.html index 289758e8..2c0a163d 100644 --- a/docs/behaviour/index.html +++ b/docs/behaviour/index.html @@ -6,7 +6,7 @@ Behaviour | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 7.2.x

Behaviour

  1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).
  2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with Accept: application/json, in which case 401 Unauthorized is returned)
  3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
  4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)

Notice that the proxy also provides a number of useful endpoints.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/community/security/index.html b/docs/community/security/index.html index 22b03f30..756a4892 100644 --- a/docs/community/security/index.html +++ b/docs/community/security/index.html @@ -6,7 +6,7 @@ Security | OAuth2 Proxy - + @@ -38,7 +38,7 @@ merging fixes until all patches are ready. We may also backport the fix to previous releases, but this will be at the discretion of the maintainers.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/configuration/alpha-config/index.html b/docs/configuration/alpha-config/index.html index 4c0d72c7..21d976c8 100644 --- a/docs/configuration/alpha-config/index.html +++ b/docs/configuration/alpha-config/index.html @@ -6,7 +6,7 @@ Alpha Configuration | OAuth2 Proxy - + @@ -44,7 +44,7 @@ make up the header value

FieldTypeDes Only one source within the struct should be defined at any time.

FieldTypeDescription
value[]byteValue expects a base64 encoded string value.
fromEnvstringFromEnv expects the name of an environment variable.
fromFilestringFromFile expects a path to a file containing the secret value.

Server

(Appears on: AlphaOptions)

Server represents the configuration for an HTTP(S) server

FieldTypeDescription
BindAddressstringBindAddress is the address on which to serve traffic.
Leave blank or set to "-" to disable.
SecureBindAddressstringSecureBindAddress is the address on which to serve secure traffic.
Leave blank or set to "-" to disable.
TLSTLSTLS contains the information for loading the certificate and key for the
secure traffic.

TLS

(Appears on: Server)

TLS contains the information for loading a TLS certifcate and key.

FieldTypeDescription
KeySecretSourceKey is the TLS key data to use.
Typically this will come from a file.
CertSecretSourceCert is the TLS certificate data to use.
Typically this will come from a file.

Upstream

(Appears on: UpstreamConfig)

Upstream represents the configuration for an upstream server. Requests will be proxied to this upstream if the path matches the request path.

FieldTypeDescription
idstringID should be a unique identifier for the upstream.
This value is required for all upstreams.
pathstringPath is used to map requests to the upstream server.
The closest match will take precedence and all Paths must be unique.
Path can also take a pattern when used with RewriteTarget.
Path segments can be captured and matched using regular experessions.
Eg:
- ^/foo$: Match only the explicit path /foo
- ^/bar/$: Match any path prefixed with /bar/
- ^/baz/(.*)$: Match any path prefixed with /baz and capture the remaining path for use with RewriteTarget
rewriteTargetstringRewriteTarget allows users to rewrite the request path before it is sent to
the upstream server.
Use the Path to capture segments for reuse within the rewrite target.
Eg: With a Path of ^/baz/(.*), a RewriteTarget of /foo/$1 would rewrite
the request /baz/abc/123 to /foo/abc/123 before proxying to the
upstream server.
uristringThe URI of the upstream server. This may be an HTTP(S) server of a File
based URL. It may include a path, in which case all requests will be served
under that path.
Eg:
- http://localhost:8080
- https://service.localhost
- https://service.localhost/path
- file://host/path
If the URI's path is "/base" and the incoming request was for "/dir",
the upstream request will be for "/base/dir".
insecureSkipTLSVerifyboolInsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.
This option is insecure and will allow potential Man-In-The-Middle attacks
betweem OAuth2 Proxy and the usptream server.
Defaults to false.
staticboolStatic will make all requests to this upstream have a static response.
The response will have a body of "Authenticated" and a response code
matching StaticCode.
If StaticCode is not set, the response will return a 200 response.
staticCodeintStaticCode determines the response code for the Static response.
This option can only be used with Static enabled.
flushIntervalDurationFlushInterval is the period between flushing the response buffer when
streaming response from the upstream.
Defaults to 1 second.
passHostHeaderboolPassHostHeader determines whether the request host header should be proxied
to the upstream server.
Defaults to true.
proxyWebSocketsboolProxyWebSockets enables proxying of websockets to upstream servers
Defaults to true.

UpstreamConfig

(Appears on: AlphaOptions)

UpstreamConfig is a collection of definitions for upstream servers.

FieldTypeDescription
proxyRawPathboolProxyRawPath will pass the raw url path to upstream allowing for url's
like: "/%2F/" which would otherwise be redirected to "/"
upstreams[]UpstreamUpstreams represents the configuration for the upstream servers.
Requests will be proxied to this upstream if the path matches the request path.
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/configuration/oauth_provider/index.html b/docs/configuration/oauth_provider/index.html index d0fedbbb..2c39ecc4 100644 --- a/docs/configuration/oauth_provider/index.html +++ b/docs/configuration/oauth_provider/index.html @@ -6,7 +6,7 @@ OAuth Provider Configuration | OAuth2 Proxy - + @@ -14,7 +14,7 @@ - +
@@ -28,7 +28,7 @@ The OpenID Connect Provider (OIDC) can also be used to connect to other Identity you may wish to configure an authorization server for each application. Otherwise, the provided default will work.
  • Navigate to Security then select API
  • Click Add Authorization Server, if this option is not available you may require an additional license for a custom authorization server.
  • Fill out the Name with something to describe the application you are protecting. e.g. 'Example App'.
  • For Audience, pick the URL of the application you wish to protect: https://example.corp.com
  • Fill out a Description
  • Add any Access Policies you wish to configure to limit application access.
  • The default settings will work for other options. See Okta documentation for more information on Authorization Servers
  1. Navigate to Applications then select Add Application.
  • Select Web for the Platform setting.
  • Select OpenID Connect and click Create
  • Pick an Application Name such as Example App.
  • Set the Login redirect URI to https://example.corp.com.
  • Under General set the Allowed grant types to Authorization Code and Refresh Token.
  • Leave the rest as default, taking note of the Client ID and Client Secret.
  • Under Assignments select the users or groups you wish to access your application.

  1. Create a configuration file like the following:

    provider = "oidc"
    redirect_url = "https://example.corp.com/oauth2/callback"
    oidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"
    upstreams = [
    "https://example.corp.com"
    ]
    email_domains = [
    "corp.com"
    ]
    client_id = "XXXXX"
    client_secret = "YYYYY"
    pass_access_token = true
    cookie_secret = "ZZZZZ"
    skip_provider_button = true

The oidc_issuer_url is based on URL from your Authorization Server's Issuer field in step 2, or simply https://corp.okta.com . The client_id and client_secret are configured in the application settings. -Generate a unique client_secret to encrypt the cookie.

Then you can start the oauth2-proxy with ./oauth2-proxy --config /etc/example.cfg

Okta - localhost

  1. Signup for developer account: https://developer.okta.com/signup/
  2. Create New Web Application: https://${your-okta-domain}/dev/console/apps/new
  3. Example Application Settings for localhost:
    • Name: My Web App
    • Base URIs: http://localhost:4180/
    • Login redirect URIs: http://localhost:4180/oauth2/callback
    • Logout redirect URIs: http://localhost:4180/
    • Group assignments: Everyone
    • Grant type allowed: Authorization Code and Refresh Token
  4. Make note of the Client ID and Client secret, they are needed in a future step
  5. Make note of the default Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as
  6. Example config file /etc/localhost.cfg
    provider = "oidc"
    redirect_url = "http://localhost:4180/oauth2/callback"
    oidc_issuer_url = "https://${your-okta-domain}/oauth2/default"
    upstreams = [
    "http://0.0.0.0:8080"
    ]
    email_domains = [
    "*"
    ]
    client_id = "XXX"
    client_secret = "YYY"
    pass_access_token = true
    cookie_secret = "ZZZ"
    cookie_secure = false
    skip_provider_button = true
    # Note: use the following for testing within a container
    # http_address = "0.0.0.0:4180"
  7. Then you can start the oauth2-proxy with ./oauth2-proxy --config /etc/localhost.cfg

login.gov Provider

login.gov is an OIDC provider for the US Government. +Generate a unique cookie_secret to encrypt the cookie.

Then you can start the oauth2-proxy with ./oauth2-proxy --config /etc/example.cfg

Okta - localhost

  1. Signup for developer account: https://developer.okta.com/signup/
  2. Create New Web Application: https://${your-okta-domain}/dev/console/apps/new
  3. Example Application Settings for localhost:
    • Name: My Web App
    • Base URIs: http://localhost:4180/
    • Login redirect URIs: http://localhost:4180/oauth2/callback
    • Logout redirect URIs: http://localhost:4180/
    • Group assignments: Everyone
    • Grant type allowed: Authorization Code and Refresh Token
  4. Make note of the Client ID and Client secret, they are needed in a future step
  5. Make note of the default Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as
  6. Example config file /etc/localhost.cfg
    provider = "oidc"
    redirect_url = "http://localhost:4180/oauth2/callback"
    oidc_issuer_url = "https://${your-okta-domain}/oauth2/default"
    upstreams = [
    "http://0.0.0.0:8080"
    ]
    email_domains = [
    "*"
    ]
    client_id = "XXX"
    client_secret = "YYY"
    pass_access_token = true
    cookie_secret = "ZZZ"
    cookie_secure = false
    skip_provider_button = true
    # Note: use the following for testing within a container
    # http_address = "0.0.0.0:4180"
  7. Then you can start the oauth2-proxy with ./oauth2-proxy --config /etc/localhost.cfg

login.gov Provider

login.gov is an OIDC provider for the US Government. If you are a US Government agency, you can contact the login.gov team through the contact information that you can find on https://login.gov/developers/ and work with them to understand how to get login.gov accounts for integration/test and production access.

A developer guide is available here: https://developers.login.gov/, though this proxy handles everything @@ -59,7 +59,7 @@ to setup the client id and client secret. Your "Redirection URI" will providers.New() to allow oauth2-proxy to use the new Provider.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + @@ -67,6 +67,6 @@ new Provider.

- + \ No newline at end of file diff --git a/docs/configuration/overview/index.html b/docs/configuration/overview/index.html index 577a449c..a7cf31d3 100644 --- a/docs/configuration/overview/index.html +++ b/docs/configuration/overview/index.html @@ -6,7 +6,7 @@ Overview | OAuth2 Proxy - + @@ -43,7 +43,7 @@ Note that nginxinc/kubernetes-ingress does not include the Lua modu
services:
a-service-backend:
loadBalancer:
servers:
- url: http://172.16.0.2:7555
b-service-backend:
loadBalancer:
servers:
- url: http://172.16.0.3:7555
oauth-backend:
loadBalancer:
servers:
- url: http://172.16.0.1:4180
middlewares:
auth-headers:
headers:
sslRedirect: true
stsSeconds: 315360000
browserXssFilter: true
contentTypeNosniff: true
forceSTSHeader: true
sslHost: example.com
stsIncludeSubdomains: true
stsPreload: true
frameDeny: true
oauth-auth-redirect:
forwardAuth:
address: https://oauth.example.com/
trustForwardHeader: true
authResponseHeaders:
- X-Auth-Request-Access-Token
- Authorization
oauth-auth-wo-redirect:
forwardAuth:
address: https://oauth.example.com/oauth2/auth
trustForwardHeader: true
authResponseHeaders:
- X-Auth-Request-Access-Token
- Authorization
note

If you set up your OAuth2 provider to rotate your client secret, you can use the client-secret-file option to reload the secret when it is updated.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/configuration/session_storage/index.html b/docs/configuration/session_storage/index.html index 8376eafb..791b8697 100644 --- a/docs/configuration/session_storage/index.html +++ b/docs/configuration/session_storage/index.html @@ -6,7 +6,7 @@ Session Storage | OAuth2 Proxy - + @@ -35,7 +35,7 @@ disclosure.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/configuration/tls/index.html b/docs/configuration/tls/index.html index d75a0946..c6b7b239 100644 --- a/docs/configuration/tls/index.html +++ b/docs/configuration/tls/index.html @@ -6,7 +6,7 @@ TLS Configuration | OAuth2 Proxy - + @@ -26,7 +26,7 @@ would be https://internal.yourcompany.com/.

An example Nginx via HSTS:

server {
listen 443 default ssl;
server_name internal.yourcompany.com;
ssl_certificate /path/to/cert.pem;
ssl_certificate_key /path/to/cert.key;
add_header Strict-Transport-Security max-age=2592000;
location / {
proxy_pass http://127.0.0.1:4180;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_connect_timeout 1;
proxy_send_timeout 30;
proxy_read_timeout 30;
}
}

The command line to run oauth2-proxy in this configuration would look like this:

./oauth2-proxy \
--email-domain="yourcompany.com" \
--upstream=http://127.0.0.1:8080/ \
--cookie-secret=... \
--cookie-secure=true \
--provider=... \
--reverse-proxy=true \
--client-id=... \
--client-secret=...
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/features/endpoints/index.html b/docs/features/endpoints/index.html index 7bab1cdb..d13942e1 100644 --- a/docs/features/endpoints/index.html +++ b/docs/features/endpoints/index.html @@ -6,7 +6,7 @@ Endpoints | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 7.2.x

Endpoints

OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.

  • /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see robotstxt.org for more info
  • /ping - returns a 200 OK response, which is intended for use with health checks
  • /metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by --metrics-address, disabled by default
  • /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
  • /oauth2/sign_out - this URL is used to clear the session cookie
  • /oauth2/start - a URL that will redirect to start the OAuth cycle
  • /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
  • /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
  • /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the Nginx auth_request directive

Sign out

To sign the user out, redirect them to /oauth2/sign_out. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the rd query parameter, i.e. redirect the user to something like (notice the url-encoding!):

/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page

Alternatively, include the redirect URL in the X-Auth-Request-Redirect header:

GET /oauth2/sign_out HTTP/1.1
X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
...

(The "sign_out_page" should be the end_session_endpoint from the metadata if your OIDC provider supports Session Management and Discovery.)

BEWARE that the domain you want to redirect to (my-oidc-provider.example.com in the example) must be added to the --whitelist-domain configuration option otherwise the redirect will be ignored.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/index.html b/docs/index.html index f813ddcb..29c45042 100644 --- a/docs/index.html +++ b/docs/index.html @@ -6,7 +6,7 @@ Installation | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 7.2.x

Installation

  1. Choose how to deploy:

    a. Download Prebuilt Binary (current release is v7.2.1)

    b. Build with $ go get github.com/oauth2-proxy/oauth2-proxy/v7 which will put the binary in $GOPATH/bin

    c. Using the prebuilt docker image quay.io/oauth2-proxy/oauth2-proxy (AMD64, ARMv6 and ARM64 tags available)

    d. Using a Kubernetes manifest (Helm)

Prebuilt binaries can be validated by extracting the file and verifying it against the sha256sum.txt checksum file provided for each release starting with version v3.0.0.

$ sha256sum -c sha256sum.txt
oauth2-proxy-x.y.z.linux-amd64: OK
  1. Select a Provider and Register an OAuth Application with a Provider
  2. Configure OAuth2 Proxy using config file, command line options, or environment variables
  3. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/next/behaviour/index.html b/docs/next/behaviour/index.html index 40fe9138..0e29a462 100644 --- a/docs/next/behaviour/index.html +++ b/docs/next/behaviour/index.html @@ -6,7 +6,7 @@ Behaviour | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: Next

Behaviour

  1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).
  2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with Accept: application/json, in which case 401 Unauthorized is returned)
  3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
  4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)

Notice that the proxy also provides a number of useful endpoints.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/next/community/security/index.html b/docs/next/community/security/index.html index 1bd9c3fa..53086d56 100644 --- a/docs/next/community/security/index.html +++ b/docs/next/community/security/index.html @@ -6,7 +6,7 @@ Security | OAuth2 Proxy - + @@ -38,7 +38,7 @@ merging fixes until all patches are ready. We may also backport the fix to previous releases, but this will be at the discretion of the maintainers.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/next/configuration/alpha-config/index.html b/docs/next/configuration/alpha-config/index.html index 36827db2..bf8ee36a 100644 --- a/docs/next/configuration/alpha-config/index.html +++ b/docs/next/configuration/alpha-config/index.html @@ -6,7 +6,7 @@ Alpha Configuration | OAuth2 Proxy - + @@ -44,7 +44,7 @@ make up the header value

FieldTypeDes Only one source within the struct should be defined at any time.

FieldTypeDescription
value[]byteValue expects a base64 encoded string value.
fromEnvstringFromEnv expects the name of an environment variable.
fromFilestringFromFile expects a path to a file containing the secret value.

Server

(Appears on: AlphaOptions)

Server represents the configuration for an HTTP(S) server

FieldTypeDescription
BindAddressstringBindAddress is the address on which to serve traffic.
Leave blank or set to "-" to disable.
SecureBindAddressstringSecureBindAddress is the address on which to serve secure traffic.
Leave blank or set to "-" to disable.
TLSTLSTLS contains the information for loading the certificate and key for the
secure traffic.

TLS

(Appears on: Server)

TLS contains the information for loading a TLS certifcate and key.

FieldTypeDescription
KeySecretSourceKey is the TLS key data to use.
Typically this will come from a file.
CertSecretSourceCert is the TLS certificate data to use.
Typically this will come from a file.

Upstream

(Appears on: UpstreamConfig)

Upstream represents the configuration for an upstream server. Requests will be proxied to this upstream if the path matches the request path.

FieldTypeDescription
idstringID should be a unique identifier for the upstream.
This value is required for all upstreams.
pathstringPath is used to map requests to the upstream server.
The closest match will take precedence and all Paths must be unique.
Path can also take a pattern when used with RewriteTarget.
Path segments can be captured and matched using regular experessions.
Eg:
- ^/foo$: Match only the explicit path /foo
- ^/bar/$: Match any path prefixed with /bar/
- ^/baz/(.*)$: Match any path prefixed with /baz and capture the remaining path for use with RewriteTarget
rewriteTargetstringRewriteTarget allows users to rewrite the request path before it is sent to
the upstream server.
Use the Path to capture segments for reuse within the rewrite target.
Eg: With a Path of ^/baz/(.*), a RewriteTarget of /foo/$1 would rewrite
the request /baz/abc/123 to /foo/abc/123 before proxying to the
upstream server.
uristringThe URI of the upstream server. This may be an HTTP(S) server of a File
based URL. It may include a path, in which case all requests will be served
under that path.
Eg:
- http://localhost:8080
- https://service.localhost
- https://service.localhost/path
- file://host/path
If the URI's path is "/base" and the incoming request was for "/dir",
the upstream request will be for "/base/dir".
insecureSkipTLSVerifyboolInsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.
This option is insecure and will allow potential Man-In-The-Middle attacks
betweem OAuth2 Proxy and the usptream server.
Defaults to false.
staticboolStatic will make all requests to this upstream have a static response.
The response will have a body of "Authenticated" and a response code
matching StaticCode.
If StaticCode is not set, the response will return a 200 response.
staticCodeintStaticCode determines the response code for the Static response.
This option can only be used with Static enabled.
flushIntervalDurationFlushInterval is the period between flushing the response buffer when
streaming response from the upstream.
Defaults to 1 second.
passHostHeaderboolPassHostHeader determines whether the request host header should be proxied
to the upstream server.
Defaults to true.
proxyWebSocketsboolProxyWebSockets enables proxying of websockets to upstream servers
Defaults to true.

UpstreamConfig

(Appears on: AlphaOptions)

UpstreamConfig is a collection of definitions for upstream servers.

FieldTypeDescription
proxyRawPathboolProxyRawPath will pass the raw url path to upstream allowing for url's
like: "/%2F/" which would otherwise be redirected to "/"
upstreams[]UpstreamUpstreams represents the configuration for the upstream servers.
Requests will be proxied to this upstream if the path matches the request path.
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/next/configuration/oauth_provider/index.html b/docs/next/configuration/oauth_provider/index.html index 9268f534..80e78779 100644 --- a/docs/next/configuration/oauth_provider/index.html +++ b/docs/next/configuration/oauth_provider/index.html @@ -6,7 +6,7 @@ OAuth Provider Configuration | OAuth2 Proxy - + @@ -59,7 +59,7 @@ to setup the client id and client secret. Your "Redirection URI" will providers.New() to allow oauth2-proxy to use the new Provider.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/next/configuration/overview/index.html b/docs/next/configuration/overview/index.html index 6c24a278..e11739de 100644 --- a/docs/next/configuration/overview/index.html +++ b/docs/next/configuration/overview/index.html @@ -6,7 +6,7 @@ Overview | OAuth2 Proxy - + @@ -43,7 +43,7 @@ Note that nginxinc/kubernetes-ingress does not include the Lua modu
services:
a-service-backend:
loadBalancer:
servers:
- url: http://172.16.0.2:7555
b-service-backend:
loadBalancer:
servers:
- url: http://172.16.0.3:7555
oauth-backend:
loadBalancer:
servers:
- url: http://172.16.0.1:4180
middlewares:
auth-headers:
headers:
sslRedirect: true
stsSeconds: 315360000
browserXssFilter: true
contentTypeNosniff: true
forceSTSHeader: true
sslHost: example.com
stsIncludeSubdomains: true
stsPreload: true
frameDeny: true
oauth-auth-redirect:
forwardAuth:
address: https://oauth.example.com/
trustForwardHeader: true
authResponseHeaders:
- X-Auth-Request-Access-Token
- Authorization
oauth-auth-wo-redirect:
forwardAuth:
address: https://oauth.example.com/oauth2/auth
trustForwardHeader: true
authResponseHeaders:
- X-Auth-Request-Access-Token
- Authorization
note

If you set up your OAuth2 provider to rotate your client secret, you can use the client-secret-file option to reload the secret when it is updated.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/next/configuration/session_storage/index.html b/docs/next/configuration/session_storage/index.html index dfdc5355..753972b3 100644 --- a/docs/next/configuration/session_storage/index.html +++ b/docs/next/configuration/session_storage/index.html @@ -6,7 +6,7 @@ Session Storage | OAuth2 Proxy - + @@ -35,7 +35,7 @@ disclosure.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/next/configuration/tls/index.html b/docs/next/configuration/tls/index.html index 413005a7..761807f2 100644 --- a/docs/next/configuration/tls/index.html +++ b/docs/next/configuration/tls/index.html @@ -6,7 +6,7 @@ TLS Configuration | OAuth2 Proxy - + @@ -26,7 +26,7 @@ would be https://internal.yourcompany.com/.

An example Nginx via HSTS:

server {
listen 443 default ssl;
server_name internal.yourcompany.com;
ssl_certificate /path/to/cert.pem;
ssl_certificate_key /path/to/cert.key;
add_header Strict-Transport-Security max-age=2592000;
location / {
proxy_pass http://127.0.0.1:4180;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_connect_timeout 1;
proxy_send_timeout 30;
proxy_read_timeout 30;
}
}

The command line to run oauth2-proxy in this configuration would look like this:

./oauth2-proxy \
--email-domain="yourcompany.com" \
--upstream=http://127.0.0.1:8080/ \
--cookie-secret=... \
--cookie-secure=true \
--provider=... \
--reverse-proxy=true \
--client-id=... \
--client-secret=...
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/next/features/endpoints/index.html b/docs/next/features/endpoints/index.html index 0cdaa8f0..e40d281f 100644 --- a/docs/next/features/endpoints/index.html +++ b/docs/next/features/endpoints/index.html @@ -6,7 +6,7 @@ Endpoints | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: Next

Endpoints

OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.

  • /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see robotstxt.org for more info
  • /ping - returns a 200 OK response, which is intended for use with health checks
  • /metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by --metrics-address, disabled by default
  • /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
  • /oauth2/sign_out - this URL is used to clear the session cookie
  • /oauth2/start - a URL that will redirect to start the OAuth cycle
  • /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
  • /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
  • /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the Nginx auth_request directive

Sign out

To sign the user out, redirect them to /oauth2/sign_out. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the rd query parameter, i.e. redirect the user to something like (notice the url-encoding!):

/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page

Alternatively, include the redirect URL in the X-Auth-Request-Redirect header:

GET /oauth2/sign_out HTTP/1.1
X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
...

(The "sign_out_page" should be the end_session_endpoint from the metadata if your OIDC provider supports Session Management and Discovery.)

BEWARE that the domain you want to redirect to (my-oidc-provider.example.com in the example) must be added to the --whitelist-domain configuration option otherwise the redirect will be ignored.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/next/index.html b/docs/next/index.html index 25c42653..bf915fbf 100644 --- a/docs/next/index.html +++ b/docs/next/index.html @@ -6,7 +6,7 @@ Installation | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: Next

Installation

  1. Choose how to deploy:

    a. Download Prebuilt Binary (current release is v7.2.1)

    b. Build with $ go get github.com/oauth2-proxy/oauth2-proxy/v7 which will put the binary in $GOPATH/bin

    c. Using the prebuilt docker image quay.io/oauth2-proxy/oauth2-proxy (AMD64, ARMv6 and ARM64 tags available)

    d. Using a Kubernetes manifest (Helm)

Prebuilt binaries can be validated by extracting the file and verifying it against the sha256sum.txt checksum file provided for each release starting with version v3.0.0.

$ sha256sum -c sha256sum.txt
oauth2-proxy-x.y.z.linux-amd64: OK
  1. Select a Provider and Register an OAuth Application with a Provider
  2. Configure OAuth2 Proxy using config file, command line options, or environment variables
  3. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/index.html b/index.html index 640eaac7..f3744f5a 100644 --- a/index.html +++ b/index.html @@ -6,7 +6,7 @@ Welcome to OAuth2 Proxy | OAuth2 Proxy - + @@ -20,7 +20,7 @@ to validate accounts by email, domain or group.

CHANGELOG.

Sign In Page

Architecture

OAuth2 Proxy Architecture

Copyright © 2022 OAuth2 Proxy.
- + diff --git a/runtime~main.34f995af.js b/runtime~main.514d3324.js similarity index 97% rename from runtime~main.34f995af.js rename to runtime~main.514d3324.js index 327a82ea..cbdb871c 100644 --- a/runtime~main.34f995af.js +++ b/runtime~main.514d3324.js @@ -1 +1 @@ -!function(e){function c(c){for(var f,b,n=c[0],d=c[1],o=c[2],u=0,l=[];u