Page Not Found
We could not find what you were looking for.
Please contact the owner of the site that linked you to the original URL and let them know their link is broken.
We could not find what you were looking for.
Please contact the owner of the site that linked you to the original URL and let them know their link is broken.
auth_request directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",level:2},{value:"Configuring for use with the Traefik (v2) ForwardAuth middleware",id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware",level:2},{value:"ForwardAuth with 401 errors middleware",id:"forwardauth-with-401-errors-middleware",level:3},{value:"ForwardAuth with static upstreams configuration",id:"forwardauth-with-static-upstreams-configuration",level:3}],g={toc:k},N="wrapper";function c(t){var e=t.components,n=(0,r.Z)(t,d);return(0,l.kt)(N,(0,a.Z)({},g,n,{components:e,mdxType:"MDXLayout"}),(0,l.kt)("p",null,(0,l.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",(0,l.kt)("a",{parentName:"p",href:"#command-line-options"},"command line options"),", ",(0,l.kt)("a",{parentName:"p",href:"#environment-variables"},"environment variables")," or ",(0,l.kt)("a",{parentName:"p",href:"#config-file"},"config file")," (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."),(0,l.kt)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),(0,l.kt)("p",null,"To generate a strong cookie secret use one of the below commands:"),(0,l.kt)(i.Z,{defaultValue:"python",values:[{label:"Python",value:"python"},{label:"Bash",value:"bash"},{label:"OpenSSL",value:"openssl"},{label:"PowerShell",value:"powershell"},{label:"Terraform",value:"terraform"}],mdxType:"Tabs"},(0,l.kt)(o.Z,{value:"python",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'\n"))),(0,l.kt)(o.Z,{value:"bash",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\\n' | tr -- '+/' '-_'; echo\n"))),(0,l.kt)(o.Z,{value:"openssl",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"openssl rand -base64 32 | tr -- '+/' '-_'\n"))),(0,l.kt)(o.Z,{value:"powershell",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},'# Add System.Web assembly to session, just in case\nAdd-Type -AssemblyName System.Web\n[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")\n'))),(0,l.kt)(o.Z,{value:"terraform",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},'# Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret\nresource "random_password" "cookie_secret" {\n length = 32\n override_special = "-_"\n}\n')))),(0,l.kt)("h3",{id:"config-file"},"Config File"),(0,l.kt)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),(0,l.kt)("p",null,"An example ",(0,l.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"},"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",(0,l.kt)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),(0,l.kt)("h3",{id:"command-line-options"},"Command Line Options"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Option"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"),(0,l.kt)("th",{parentName:"tr",align:null},"Default"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--acr-values")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"optional, see ",(0,l.kt)("a",{parentName:"td",href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"},"docs")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--api-route")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"return HTTP 401 instead of redirecting to authentication server if token is not valid. Format: path_regex"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--approval-prompt")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth approval_prompt"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"force"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log authentication attempts"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for authentication log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate against emails via file (one per line)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--azure-tenant")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"go to a tenant-specific or common (tenant-independent) endpoint."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"common"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--basic-auth-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the password to set when passing the HTTP Basic Auth header"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-id")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client ID, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the file with OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--code-challenge-method")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"use PKCE code challenges with the specified method. Either 'plain' or 'S256' (recommended)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--config")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to config file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Optional cookie domains to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-expire")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"expire timeframe for cookie. If set to 0, cookie becomes a session-cookie which will expire when the browser is closed."),(0,l.kt)("td",{parentName:"tr",align:null},"168h0m0s")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-httponly")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set HttpOnly cookie flag"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the name of the cookie that the oauth_proxy creates. Should be changed to use a ",(0,l.kt)("a",{parentName:"td",href:"https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes"},"cookie prefix")," (",(0,l.kt)("inlineCode",{parentName:"td"},"__Host-")," or ",(0,l.kt)("inlineCode",{parentName:"td"},"__Secure-"),") if ",(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secure")," is set."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"an optional cookie path to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"/poc/"),")"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-refresh")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"refresh the cookie after this duration; ",(0,l.kt)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",(0,l.kt)("a",{parentName:"td",href:"#footnote1"},"1"),"]"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the seed string for secure cookies (optionally base64 encoded)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secure")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set ",(0,l.kt)("a",{parentName:"td",href:"https://owasp.org/www-community/controls/SecureFlag"},"secure (HTTPS only) cookie flag")),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-samesite")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"set SameSite cookie attribute (",(0,l.kt)("inlineCode",{parentName:"td"},'"lax"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"strict"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"none"'),", or ",(0,l.kt)("inlineCode",{parentName:"td"},'""'),")."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-csrf-per-request")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Enable having different CSRF cookies per request, making it possible to have parallel requests."),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-csrf-expire")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"expire timeframe for CSRF cookie"),(0,l.kt)("td",{parentName:"tr",align:null},"15m")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--custom-templates-dir")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to custom html templates"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--custom-sign-in-logo")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path or a URL to an custom image for the sign_in page logo. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default logo."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"display username / password login form if an htpasswd file is provided"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--email-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate emails with the specified domain (may be given multiple times). Use ",(0,l.kt)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--errors-to-info-log")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"redirects error-level logging to default log channel instead of stderr"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"if ",(0,l.kt)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",(0,l.kt)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",(0,l.kt)("inlineCode",{parentName:"td"},"iss"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--exclude-logging-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"comma separated list of paths to exclude from logging, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"/ping,/path2"')),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--flush-interval")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"period between flushing response buffers when streaming responses"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"1s"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--force-https")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"enforce https redirect"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"false"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--force-json-errors")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"force JSON errors instead of HTTP error pages or redirects"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"false"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--banner")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) banner string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--footer")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) footer string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-org")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this organisation"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-team")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these teams (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-repo")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to collaborators of this repository formatted as ",(0,l.kt)("inlineCode",{parentName:"td"},"orgname/repo")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-token")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the token to use when verifying repository collaborators (must have push access to the repository)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-user")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gitlab-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these groups (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gitlab-projects")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these projects (may be given multiple times) formatted as ",(0,l.kt)("inlineCode",{parentName:"td"},"orgname/repo=accesslevel"),". Access level should be a value matching ",(0,l.kt)("a",{parentName:"td",href:"https://docs.gitlab.com/ee/api/members.html#valid-access-levels"},"Gitlab access levels"),", defaulted to 20 if absent"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-admin-email")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the google admin to impersonate for api calls"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this google group (may be given multiple times)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-service-account-json")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the path to the service account json credentials"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-use-application-default-credentials")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"use application default credentials instead of service account json (i.e. GKE Workload Identity)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-target-principal")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"the targetprincipal to impersonate when using ADC"),(0,l.kt)("td",{parentName:"tr",align:null},"defaults to the service account configured for ADC")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--htpasswd-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"additionally authenticate against a htpasswd file. Entries must be created with ",(0,l.kt)("inlineCode",{parentName:"td"},"htpasswd -B")," for bcrypt encryption"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--htpasswd-user-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"the groups to be set on sessions for htpasswd users"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--http-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"[http://]auth_request directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",level:2},{value:"Configuring for use with the Traefik (v2) ForwardAuth middleware",id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware",level:2},{value:"ForwardAuth with 401 errors middleware",id:"forwardauth-with-401-errors-middleware",level:3},{value:"ForwardAuth with static upstreams configuration",id:"forwardauth-with-static-upstreams-configuration",level:3}],g={toc:k},N="wrapper";function c(t){var e=t.components,n=(0,r.Z)(t,d);return(0,l.kt)(N,(0,a.Z)({},g,n,{components:e,mdxType:"MDXLayout"}),(0,l.kt)("p",null,(0,l.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",(0,l.kt)("a",{parentName:"p",href:"#command-line-options"},"command line options"),", ",(0,l.kt)("a",{parentName:"p",href:"#environment-variables"},"environment variables")," or ",(0,l.kt)("a",{parentName:"p",href:"#config-file"},"config file")," (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."),(0,l.kt)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),(0,l.kt)("p",null,"To generate a strong cookie secret use one of the below commands:"),(0,l.kt)(i.Z,{defaultValue:"python",mdxType:"Tabs"},(0,l.kt)(o.Z,{value:"python",label:"Python",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'\n"))),(0,l.kt)(o.Z,{value:"bash",label:"Bash",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\\n' | tr -- '+/' '-_' ; echo\n"))),(0,l.kt)(o.Z,{value:"openssl",label:"OpenSSL",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"openssl rand -base64 32 | tr -- '+/' '-_'\n"))),(0,l.kt)(o.Z,{value:"powershell",label:"PowerShell",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-powershell"},'# Add System.Web assembly to session, just in case\nAdd-Type -AssemblyName System.Web\n[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")\n'))),(0,l.kt)(o.Z,{value:"terraform",label:"Terraform",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-hcl"},'# Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret\nresource "random_password" "cookie_secret" {\n length = 32\n override_special = "-_"\n}\n')))),(0,l.kt)("h3",{id:"config-file"},"Config File"),(0,l.kt)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),(0,l.kt)("p",null,"An example ",(0,l.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"},"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",(0,l.kt)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),(0,l.kt)("h3",{id:"command-line-options"},"Command Line Options"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Option"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"),(0,l.kt)("th",{parentName:"tr",align:null},"Default"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--acr-values")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"optional, see ",(0,l.kt)("a",{parentName:"td",href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"},"docs")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--api-route")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"return HTTP 401 instead of redirecting to authentication server if token is not valid. Format: path_regex"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--approval-prompt")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth approval_prompt"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"force"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log authentication attempts"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for authentication log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate against emails via file (one per line)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--azure-tenant")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"go to a tenant-specific or common (tenant-independent) endpoint."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"common"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--basic-auth-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the password to set when passing the HTTP Basic Auth header"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-id")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client ID, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the file with OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--code-challenge-method")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"use PKCE code challenges with the specified method. Either 'plain' or 'S256' (recommended)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--config")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to config file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Optional cookie domains to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-expire")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"expire timeframe for cookie. If set to 0, cookie becomes a session-cookie which will expire when the browser is closed."),(0,l.kt)("td",{parentName:"tr",align:null},"168h0m0s")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-httponly")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set HttpOnly cookie flag"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the name of the cookie that the oauth_proxy creates. Should be changed to use a ",(0,l.kt)("a",{parentName:"td",href:"https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes"},"cookie prefix")," (",(0,l.kt)("inlineCode",{parentName:"td"},"__Host-")," or ",(0,l.kt)("inlineCode",{parentName:"td"},"__Secure-"),") if ",(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secure")," is set."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"an optional cookie path to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"/poc/"),")"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-refresh")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"refresh the cookie after this duration; ",(0,l.kt)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",(0,l.kt)("a",{parentName:"td",href:"#footnote1"},"1"),"]"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the seed string for secure cookies (optionally base64 encoded)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secure")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set ",(0,l.kt)("a",{parentName:"td",href:"https://owasp.org/www-community/controls/SecureFlag"},"secure (HTTPS only) cookie flag")),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-samesite")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"set SameSite cookie attribute (",(0,l.kt)("inlineCode",{parentName:"td"},'"lax"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"strict"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"none"'),", or ",(0,l.kt)("inlineCode",{parentName:"td"},'""'),")."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-csrf-per-request")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Enable having different CSRF cookies per request, making it possible to have parallel requests."),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-csrf-expire")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"expire timeframe for CSRF cookie"),(0,l.kt)("td",{parentName:"tr",align:null},"15m")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--custom-templates-dir")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to custom html templates"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--custom-sign-in-logo")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path or a URL to an custom image for the sign_in page logo. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default logo."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"display username / password login form if an htpasswd file is provided"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--email-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate emails with the specified domain (may be given multiple times). Use ",(0,l.kt)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--errors-to-info-log")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"redirects error-level logging to default log channel instead of stderr"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"if ",(0,l.kt)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",(0,l.kt)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",(0,l.kt)("inlineCode",{parentName:"td"},"iss"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--exclude-logging-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"comma separated list of paths to exclude from logging, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"/ping,/path2"')),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--flush-interval")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"period between flushing response buffers when streaming responses"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"1s"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--force-https")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"enforce https redirect"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"false"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--force-json-errors")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"force JSON errors instead of HTTP error pages or redirects"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"false"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--banner")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) banner string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--footer")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) footer string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-org")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this organisation"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-team")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these teams (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-repo")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to collaborators of this repository formatted as ",(0,l.kt)("inlineCode",{parentName:"td"},"orgname/repo")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-token")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the token to use when verifying repository collaborators (must have push access to the repository)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-user")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gitlab-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these groups (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gitlab-projects")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these projects (may be given multiple times) formatted as ",(0,l.kt)("inlineCode",{parentName:"td"},"orgname/repo=accesslevel"),". Access level should be a value matching ",(0,l.kt)("a",{parentName:"td",href:"https://docs.gitlab.com/ee/api/members.html#valid-access-levels"},"Gitlab access levels"),", defaulted to 20 if absent"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-admin-email")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the google admin to impersonate for api calls"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this google group (may be given multiple times)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-service-account-json")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the path to the service account json credentials"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-use-application-default-credentials")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"use application default credentials instead of service account json (i.e. GKE Workload Identity)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-target-principal")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"the target principal to impersonate when using ADC"),(0,l.kt)("td",{parentName:"tr",align:null},"defaults to the service account configured for ADC")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--htpasswd-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"additionally authenticate against a htpasswd file. Entries must be created with ",(0,l.kt)("inlineCode",{parentName:"td"},"htpasswd -B")," for bcrypt encryption"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--htpasswd-user-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"the groups to be set on sessions for htpasswd users"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--http-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"[http://]string alias)",id:"string-alias-1",level:4},{value:"Providers",id:"providers",level:3},{value:"([]Provider alias)",id:"provider-alias",level:4},{value:"SecretSource",id:"secretsource",level:3},{value:"Server",id:"server",level:3},{value:"TLS",id:"tls",level:3},{value:"URLParameterRule",id:"urlparameterrule",level:3},{value:"Upstream",id:"upstream",level:3},{value:"UpstreamConfig",id:"upstreamconfig",level:3}],u={toc:s},k="wrapper";function N(t){var e=t.components,a=(0,r.Z)(t,i);return(0,l.kt)(k,(0,n.Z)({},u,a,{components:e,mdxType:"MDXLayout"}),(0,l.kt)("admonition",{type:"warning"},(0,l.kt)("p",{parentName:"admonition"},"This page contains documentation for alpha features.\nWe reserve the right to make breaking changes to the features detailed within this page with no notice."),(0,l.kt)("p",{parentName:"admonition"},"Options described in this page may be changed, removed, renamed or moved without prior warning.\nPlease beware of this before you use alpha configuration options.")),(0,l.kt)("p",null,"This page details a set of ",(0,l.kt)("strong",{parentName:"p"},"alpha")," configuration options in a new format.\nGoing forward we are intending to add structured configuration in YAML format to\nreplace the existing TOML based configuration file and flags."),(0,l.kt)("p",null,"Below is a reference for the structure of the configuration, with\n",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions")," as the root of the configuration."),(0,l.kt)("p",null,"When using alpha configuration, your config file will look something like below:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},"upstreams:\n - id: ...\n ...\ninjectRequestHeaders:\n - name: ...\n ...\ninjectResponseHeaders:\n - name: ...\n ...\n")),(0,l.kt)("p",null,"Please browse the ",(0,l.kt)("a",{parentName:"p",href:"#configuration-reference"},"reference")," below for the structure\nof the new configuration format."),(0,l.kt)("h2",{id:"using-alpha-configuration"},"Using Alpha Configuration"),(0,l.kt)("p",null,"To use the new ",(0,l.kt)("strong",{parentName:"p"},"alpha")," configuration, generate a YAML file based on the format\ndescribed in the ",(0,l.kt)("a",{parentName:"p",href:"#configuration-reference"},"reference")," below."),(0,l.kt)("p",null,"Provide the path to this file using the ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config")," flag."),(0,l.kt)("admonition",{type:"note"},(0,l.kt)("p",{parentName:"admonition"},"When using the ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config")," flag, some options are no longer available.\nSee ",(0,l.kt)("a",{parentName:"p",href:"#removed-options"},"removed options")," below for more information.")),(0,l.kt)("h3",{id:"converting-configuration-to-the-new-structure"},"Converting configuration to the new structure"),(0,l.kt)("p",null,"Before adding the new ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config")," option, start OAuth2 Proxy using the\n",(0,l.kt)("inlineCode",{parentName:"p"},"convert-config-to-alpha")," flag to convert existing configuration to the new format."),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-bash"},"oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg\n")),(0,l.kt)("p",null,"This will convert any options supported by the new format to YAML and print the\nnew configuration to ",(0,l.kt)("inlineCode",{parentName:"p"},"STDOUT"),"."),(0,l.kt)("p",null,"Copy this to a new file, remove any options from your existing configuration\nnoted in ",(0,l.kt)("a",{parentName:"p",href:"#removed-options"},"removed options")," and then start OAuth2 Proxy using\nthe new config."),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-bash"},"oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg\n")),(0,l.kt)("h2",{id:"removed-options"},"Removed options"),(0,l.kt)("p",null,"The following flags/options and their respective environment variables are no\nlonger available when using alpha configuration:"),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"flush-interval"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"flush_interval")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-host-header"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_host_header")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"proxy-websockets"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"proxy_websockets")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"ssl-upstream-insecure-skip-verify"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"ssl_upstream_insecure_skip_verify")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"upstream"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"upstreams"))),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-basic-auth"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_basic_auth")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-access-token"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_access_token")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-user-headers"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_user_headers")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-authorization-header"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_authorization_header")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"set-basic-auth"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"set_basic_auth")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"set-xauthrequest"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"set_xauthrequest")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"set-authorization-header"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"set_authorization_header")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"prefer-email-to-user"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"prefer_email_to_user")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"basic-auth-password"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"basic_auth_password")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"skip-auth-strip-headers"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"skip_auth_strip_headers"))),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"client-id"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"client_id")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"client-secret"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"client_secret"),", and ",(0,l.kt)("inlineCode",{parentName:"li"},"client-secret-file"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"client_secret_file")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"provider")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"provider-display-name"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"provider_display_name")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"provider-ca-file"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"provider_ca_files")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"login-url"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"login_url")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"redeem-url"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"redeem_url")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"profile-url"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"profile_url")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"resource")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"validate-url"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"validate_url")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"scope")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"prompt")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"approval-prompt"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"approval_prompt")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"acr-values"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"acr_values")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"user-id-claim"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"user_id_claim")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"allowed-group"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"allowed_groups")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"allowed-role"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"allowed_roles")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"jwt-key"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"jwt_key")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"jwt-key-file"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"jwt_key_file")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pubjwk-url"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pubjwk_url"))),(0,l.kt)("p",null,"and all provider-specific options, i.e. any option whose name includes ",(0,l.kt)("inlineCode",{parentName:"p"},"oidc"),",\n",(0,l.kt)("inlineCode",{parentName:"p"},"azure"),", ",(0,l.kt)("inlineCode",{parentName:"p"},"bitbucket"),", ",(0,l.kt)("inlineCode",{parentName:"p"},"github"),", ",(0,l.kt)("inlineCode",{parentName:"p"},"gitlab"),", ",(0,l.kt)("inlineCode",{parentName:"p"},"google")," or ",(0,l.kt)("inlineCode",{parentName:"p"},"keycloak"),". Attempting to\nuse any of these options via flags or via config when ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config")," is\nset will result in an error."),(0,l.kt)("admonition",{type:"important"},(0,l.kt)("p",{parentName:"admonition"},"You must remove these options before starting OAuth2 Proxy with ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config"))),(0,l.kt)("h2",{id:"configuration-reference"},"Configuration Reference"),(0,l.kt)("h3",{id:"adfsoptions"},"ADFSOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"skipScope")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"Skip adding the scope parameter in login request",(0,l.kt)("br",null),"Default value is 'false'")))),(0,l.kt)("h3",{id:"alphaoptions"},"AlphaOptions"),(0,l.kt)("p",null,"AlphaOptions contains alpha structured configuration options.\nUsage of these options allows users to access alpha features that are not\navailable as part of the primary configuration structure for OAuth2 Proxy."),(0,l.kt)("admonition",{type:"warning"},(0,l.kt)("p",{parentName:"admonition"},"The options within this structure are considered alpha.\nThey may change between releases without notice.")),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"upstreamConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#upstreamconfig"},"UpstreamConfig"))),(0,l.kt)("td",{parentName:"tr",align:null},"UpstreamConfig is used to configure upstream servers.",(0,l.kt)("br",null),"Once a user is authenticated, requests to the server will be proxied to",(0,l.kt)("br",null),"these upstream servers based on the path mappings defined in this list.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"injectRequestHeaders")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#header"},"[]Header"))),(0,l.kt)("td",{parentName:"tr",align:null},"InjectRequestHeaders is used to configure headers that should be added",(0,l.kt)("br",null),"to requests to upstream servers.",(0,l.kt)("br",null),"Headers may source values from either the authenticated user's session",(0,l.kt)("br",null),"or from a static secret value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"injectResponseHeaders")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#header"},"[]Header"))),(0,l.kt)("td",{parentName:"tr",align:null},"InjectResponseHeaders is used to configure headers that should be added",(0,l.kt)("br",null),"to responses from the proxy.",(0,l.kt)("br",null),"This is typically used when using the proxy as an external authentication",(0,l.kt)("br",null),"provider in conjunction with another proxy such as NGINX and its",(0,l.kt)("br",null),"auth_request module.",(0,l.kt)("br",null),"Headers may source values from either the authenticated user's session",(0,l.kt)("br",null),"or from a static secret value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"server")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#server"},"Server"))),(0,l.kt)("td",{parentName:"tr",align:null},"Server is used to configure the HTTP(S) server for the proxy application.",(0,l.kt)("br",null),"You may choose to run both HTTP and HTTPS servers simultaneously.",(0,l.kt)("br",null),"This can be done by setting the BindAddress and the SecureBindAddress simultaneously.",(0,l.kt)("br",null),"To use the secure server you must configure a TLS certificate and key.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"metricsServer")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#server"},"Server"))),(0,l.kt)("td",{parentName:"tr",align:null},"MetricsServer is used to configure the HTTP(S) server for metrics.",(0,l.kt)("br",null),"You may choose to run both HTTP and HTTPS servers simultaneously.",(0,l.kt)("br",null),"This can be done by setting the BindAddress and the SecureBindAddress simultaneously.",(0,l.kt)("br",null),"To use the secure server you must configure a TLS certificate and key.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"providers")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#providers"},"Providers"))),(0,l.kt)("td",{parentName:"tr",align:null},"Providers is used to configure multiple providers.")))),(0,l.kt)("h3",{id:"azureoptions"},"AzureOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"tenant")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Tenant directs to a tenant-specific or common (tenant-independent) endpoint",(0,l.kt)("br",null),"Default value is 'common'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"graphGroupField")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"GraphGroupField configures the group field to be used when building the groups list from Microsoft Graph",(0,l.kt)("br",null),"Default value is 'id'")))),(0,l.kt)("h3",{id:"bitbucketoptions"},"BitbucketOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"team")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Team sets restrict logins to members of this team")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"repository")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Repository sets restrict logins to user with access to this repository")))),(0,l.kt)("h3",{id:"claimsource"},"ClaimSource"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#headervalue"},"HeaderValue"),")"),(0,l.kt)("p",null,"ClaimSource allows loading a header value from a claim within the session"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"claim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Claim is the name of the claim in the session that the value should be",(0,l.kt)("br",null),"loaded from.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"prefix")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Prefix is an optional prefix that will be prepended to the value of the",(0,l.kt)("br",null),"claim if it is non-empty.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"basicAuthPassword")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,l.kt)("td",{parentName:"tr",align:null},"BasicAuthPassword converts this claim into a basic auth header.",(0,l.kt)("br",null),"Note the value of claim will become the basic auth username and the",(0,l.kt)("br",null),"basicAuthPassword will be used as the password value.")))),(0,l.kt)("h3",{id:"duration"},"Duration"),(0,l.kt)("h4",{id:"string-alias"},"(",(0,l.kt)("inlineCode",{parentName:"h4"},"string")," alias)"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#upstream"},"Upstream"),")"),(0,l.kt)("p",null,'Duration is as string representation of a period of time.\nA duration string is a is a possibly signed sequence of decimal numbers,\neach with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".\nValid time units are "ns", "us" (or "\xb5s"), "ms", "s", "m", "h".'),(0,l.kt)("h3",{id:"githuboptions"},"GitHubOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"org")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Org sets restrict logins to members of this organisation")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"team")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Team sets restrict logins to members of this team")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"repo")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Repo sets restrict logins to collaborators of this repository")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"token")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Token is the token to use when verifying repository collaborators",(0,l.kt)("br",null),"it must have push access to the repository")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"users")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Users allows users with these usernames to login",(0,l.kt)("br",null),"even if they do not belong to the specified org and team or collaborators")))),(0,l.kt)("h3",{id:"gitlaboptions"},"GitLabOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"group")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Group sets restrict logins to members of this group")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"projects")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Projects restricts logins to members of these projects")))),(0,l.kt)("h3",{id:"googleoptions"},"GoogleOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"group")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Groups sets restrict logins to members of this Google group")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"adminEmail")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"AdminEmail is the Google admin to impersonate for api calls")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"serviceAccountJson")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ServiceAccountJSON is the path to the service account json credentials")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"useApplicationDefaultCredentials")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"UseApplicationDefaultCredentials is a boolean whether to use Application Default Credentials instead of a ServiceAccountJSON")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"targetPrincipal")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"TargetPrincipal is the Google Service Account used for Application Default Credentials")))),(0,l.kt)("h3",{id:"header"},"Header"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions"),")"),(0,l.kt)("p",null,"Header represents an individual header that will be added to a request or\nresponse header."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"name")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Name is the header name to be used for this set of values.",(0,l.kt)("br",null),"Names should be unique within a list of Headers.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"preserveRequestValue")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"PreserveRequestValue determines whether any values for this header",(0,l.kt)("br",null),"should be preserved for the request to the upstream server.",(0,l.kt)("br",null),"This option only applies to injected request headers.",(0,l.kt)("br",null),"Defaults to false (headers that match this header will be stripped).")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"values")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#headervalue"},"[]HeaderValue"))),(0,l.kt)("td",{parentName:"tr",align:null},"Values contains the desired values for this header")))),(0,l.kt)("h3",{id:"headervalue"},"HeaderValue"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#header"},"Header"),")"),(0,l.kt)("p",null,"HeaderValue represents a single header value and the sources that can\nmake up the header value"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"value")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]byte")),(0,l.kt)("td",{parentName:"tr",align:null},"Value expects a base64 encoded string value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"fromEnv")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"FromEnv expects the name of an environment variable.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"fromFile")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"FromFile expects a path to a file containing the secret value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"claim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Claim is the name of the claim in the session that the value should be",(0,l.kt)("br",null),"loaded from.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"prefix")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Prefix is an optional prefix that will be prepended to the value of the",(0,l.kt)("br",null),"claim if it is non-empty.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"basicAuthPassword")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,l.kt)("td",{parentName:"tr",align:null},"BasicAuthPassword converts this claim into a basic auth header.",(0,l.kt)("br",null),"Note the value of claim will become the basic auth username and the",(0,l.kt)("br",null),"basicAuthPassword will be used as the password value.")))),(0,l.kt)("h3",{id:"keycloakoptions"},"KeycloakOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"groups")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Group enables to restrict login to members of indicated group")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"roles")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Role enables to restrict login to users with role (only available when using the keycloak-oidc provider)")))),(0,l.kt)("h3",{id:"logingovoptions"},"LoginGovOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"jwtKey")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"JWTKey is a private key in PEM format used to sign JWT,")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"jwtKeyFile")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"JWTKeyFile is a path to the private key file in PEM format used to sign the JWT")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"pubjwkURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"PubJWKURL is the JWK pubkey access endpoint")))),(0,l.kt)("h3",{id:"loginurlparameter"},"LoginURLParameter"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("p",null,"LoginURLParameter is the configuration for a single query parameter that\ncan be passed through from the ",(0,l.kt)("inlineCode",{parentName:"p"},"/oauth2/start"),' endpoint to the IdP login\nURL. The "default" option specifies the default value or values (if any)\nthat will be passed to the IdP for this parameter, and "allow" is a list\nof options for ways in which this parameter can be set or overridden via\nthe query string to ',(0,l.kt)("inlineCode",{parentName:"p"},"/oauth2/start"),".\nIf ",(0,l.kt)("em",{parentName:"p"},"only"),' a default is specified and no "allow" then the parameter is\neffectively fixed - the default value will always be used and anything\npassed to the start URL will be ignored. If ',(0,l.kt)("em",{parentName:"p"},"only"),' "allow" is specified\nbut no default then the parameter will only be passed on to the IdP if\nthe caller provides it, and no value will be sent otherwise.'),(0,l.kt)("p",null,"Examples:"),(0,l.kt)("h1",{id:"a-parameter-whose-value-is-fixed"},"A parameter whose value is fixed"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"name: organization\ndefault:\n- myorg\n")),(0,l.kt)("p",null,"A parameter that is not passed by default, but may be set to one of a\nfixed set of values"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"name: prompt\nallow:\n- value: login\n- value: consent\n- value: select_account\n")),(0,l.kt)("p",null,"A parameter that is passed by default but may be overridden by one of\na fixed set of values"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},'name: prompt\ndefault: ["login"]\nallow:\n- value: consent\n- value: select_account\n')),(0,l.kt)("p",null,"A parameter that may be overridden, but only by values that match a\nregular expression. For example to restrict ",(0,l.kt)("inlineCode",{parentName:"p"},"login_hint")," to email\naddresses in your organization's domain:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},'name: login_hint\nallow:\n- pattern: \'^[^@]*@example\\.com$\'\n# this allows at most one "@" sign, and requires "example.com" domain.\n')),(0,l.kt)("p",null,'Note that the YAML rules around exactly which characters are allowed\nand/or require escaping in different types of string literals are\nconvoluted. For regular expressions the single quoted form is simplest\nas backslash is not considered to be an escape character. Alternatively\nuse the "chomped block" format ',(0,l.kt)("inlineCode",{parentName:"p"},"|-"),":"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"}," - pattern: |-\n ^[^@]*@example\\.com$\n\n")),(0,l.kt)("p",null,"The hyphen is important, a ",(0,l.kt)("inlineCode",{parentName:"p"},"|")," block would have a trailing newline\ncharacter."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"name")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Name specifies the name of the query parameter.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"default")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"(Optional)")," Default specifies a default value or values that will be",(0,l.kt)("br",null),"passed to the IdP if not overridden.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"allow")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#urlparameterrule"},"[]URLParameterRule"))),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"(Optional)")," Allow specifies rules about how the default (if any) may be",(0,l.kt)("br",null),"overridden via the query string to ",(0,l.kt)("inlineCode",{parentName:"td"},"/oauth2/start"),". Only",(0,l.kt)("br",null),"values that match one or more of the allow rules will be",(0,l.kt)("br",null),"forwarded to the IdP.")))),(0,l.kt)("h3",{id:"oidcoptions"},"OIDCOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"issuerURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"IssuerURL is the OpenID Connect issuer URL",(0,l.kt)("br",null),"eg: ",(0,l.kt)("a",{parentName:"td",href:"https://accounts.google.com"},"https://accounts.google.com"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"insecureAllowUnverifiedEmail")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"InsecureAllowUnverifiedEmail prevents failures if an email address in an id_token is not verified",(0,l.kt)("br",null),"default set to 'false'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"insecureSkipIssuerVerification")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"InsecureSkipIssuerVerification skips verification of ID token issuers. When false, ID Token Issuers must match the OIDC discovery URL",(0,l.kt)("br",null),"default set to 'false'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"insecureSkipNonce")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"InsecureSkipNonce skips verifying the ID Token's nonce claim that must match",(0,l.kt)("br",null),"the random nonce sent in the initial OAuth flow. Otherwise, the nonce is checked",(0,l.kt)("br",null),"after the initial OAuth redeem & subsequent token refreshes.",(0,l.kt)("br",null),"default set to 'true'",(0,l.kt)("br",null),"Warning: In a future release, this will change to 'false' by default for enhanced security.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"skipDiscovery")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"SkipDiscovery allows to skip OIDC discovery and use manually supplied Endpoints",(0,l.kt)("br",null),"default set to 'false'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"jwksURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"JwksURL is the OpenID Connect JWKS URL",(0,l.kt)("br",null),"eg: ",(0,l.kt)("a",{parentName:"td",href:"https://www.googleapis.com/oauth2/v3/certs"},"https://www.googleapis.com/oauth2/v3/certs"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"emailClaim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"EmailClaim indicates which claim contains the user email,",(0,l.kt)("br",null),"default set to 'email'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"groupsClaim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"GroupsClaim indicates which claim contains the user groups",(0,l.kt)("br",null),"default set to 'groups'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"userIDClaim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"UserIDClaim indicates which claim contains the user ID",(0,l.kt)("br",null),"default set to 'email'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"audienceClaims")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"AudienceClaim allows to define any claim that is verified against the client id",(0,l.kt)("br",null),"By default ",(0,l.kt)("inlineCode",{parentName:"td"},"aud")," claim is used for verification.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"extraAudiences")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"ExtraAudiences is a list of additional audiences that are allowed",(0,l.kt)("br",null),"to pass verification in addition to the client id.")))),(0,l.kt)("h3",{id:"provider"},"Provider"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#providers"},"Providers"),")"),(0,l.kt)("p",null,"Provider holds all configuration for a single provider"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"clientID")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ClientID is the OAuth Client ID that is defined in the provider",(0,l.kt)("br",null),"This value is required for all providers.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"clientSecret")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ClientSecret is the OAuth Client Secret that is defined in the provider",(0,l.kt)("br",null),"This value is required for all providers.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"clientSecretFile")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ClientSecretFile is the name of the file",(0,l.kt)("br",null),"containing the OAuth Client Secret, it will be used if ClientSecret is not set.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"keycloakConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#keycloakoptions"},"KeycloakOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"KeycloakConfig holds all configurations for Keycloak provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"azureConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#azureoptions"},"AzureOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"AzureConfig holds all configurations for Azure provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"ADFSConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#adfsoptions"},"ADFSOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"ADFSConfig holds all configurations for ADFS provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"bitbucketConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#bitbucketoptions"},"BitbucketOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"BitbucketConfig holds all configurations for Bitbucket provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"githubConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#githuboptions"},"GitHubOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"GitHubConfig holds all configurations for GitHubC provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"gitlabConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#gitlaboptions"},"GitLabOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"GitLabConfig holds all configurations for GitLab provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"googleConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#googleoptions"},"GoogleOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"GoogleConfig holds all configurations for Google provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"oidcConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#oidcoptions"},"OIDCOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"OIDCConfig holds all configurations for OIDC provider",(0,l.kt)("br",null),"or providers utilize OIDC configurations.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"loginGovConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#logingovoptions"},"LoginGovOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"LoginGovConfig holds all configurations for LoginGov provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"id")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ID should be a unique identifier for the provider.",(0,l.kt)("br",null),"This value is required for all providers.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"provider")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#providertype"},"ProviderType"))),(0,l.kt)("td",{parentName:"tr",align:null},"Type is the OAuth provider",(0,l.kt)("br",null),"must be set from the supported providers group,",(0,l.kt)("br",null),"otherwise 'Google' is set as default")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"name")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Name is the providers display name",(0,l.kt)("br",null),"if set, it will be shown to the users in the login page.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"caFiles")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"CAFiles is a list of paths to CA certificates that should be used when connecting to the provider.",(0,l.kt)("br",null),"If not specified, the default Go trust sources are used instead")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"useSystemTrustStore")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"UseSystemTrustStore determines if your custom CA files and the system trust store are used",(0,l.kt)("br",null),"If set to true, your custom CA files and the system trust store are used otherwise only your custom CA files.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"loginURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"LoginURL is the authentication endpoint")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"loginURLParameters")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#loginurlparameter"},"[]LoginURLParameter"))),(0,l.kt)("td",{parentName:"tr",align:null},"LoginURLParameters defines the parameters that can be passed from the start URL to the IdP login URL")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"redeemURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"RedeemURL is the token redemption endpoint")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"profileURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ProfileURL is the profile access endpoint")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"resource")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ProtectedResource is the resource that is protected (Azure AD and ADFS only)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"validateURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ValidateURL is the access token validation endpoint")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"scope")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Scope is the OAuth scope specification")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"allowedGroups")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"AllowedGroups is a list of restrict logins to members of this group")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"code_challenge_method")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"The code challenge method")))),(0,l.kt)("h3",{id:"providertype"},"ProviderType"),(0,l.kt)("h4",{id:"string-alias-1"},"(",(0,l.kt)("inlineCode",{parentName:"h4"},"string")," alias)"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("p",null,"ProviderType is used to enumerate the different provider type options\nValid options are: adfs, azure, bitbucket, digitalocean facebook, github,\ngitlab, google, keycloak, keycloak-oidc, linkedin, login.gov, nextcloud\nand oidc."),(0,l.kt)("h3",{id:"providers"},"Providers"),(0,l.kt)("h4",{id:"provider-alias"},"(",(0,l.kt)("a",{parentName:"h4",href:"#provider"},"[]Provider")," alias)"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions"),")"),(0,l.kt)("p",null,"Providers is a collection of definitions for providers."),(0,l.kt)("h3",{id:"secretsource"},"SecretSource"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#claimsource"},"ClaimSource"),", ",(0,l.kt)("a",{parentName:"p",href:"#headervalue"},"HeaderValue"),", ",(0,l.kt)("a",{parentName:"p",href:"#tls"},"TLS"),")"),(0,l.kt)("p",null,"SecretSource references an individual secret value.\nOnly one source within the struct should be defined at any time."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"value")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]byte")),(0,l.kt)("td",{parentName:"tr",align:null},"Value expects a base64 encoded string value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"fromEnv")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"FromEnv expects the name of an environment variable.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"fromFile")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"FromFile expects a path to a file containing the secret value.")))),(0,l.kt)("h3",{id:"server"},"Server"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions"),")"),(0,l.kt)("p",null,"Server represents the configuration for an HTTP(S) server"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"BindAddress")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"BindAddress is the address on which to serve traffic.",(0,l.kt)("br",null),'Leave blank or set to "-" to disable.')),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"SecureBindAddress")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"SecureBindAddress is the address on which to serve secure traffic.",(0,l.kt)("br",null),'Leave blank or set to "-" to disable.')),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"TLS")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#tls"},"TLS"))),(0,l.kt)("td",{parentName:"tr",align:null},"TLS contains the information for loading the certificate and key for the",(0,l.kt)("br",null),"secure traffic and further configuration for the TLS server.")))),(0,l.kt)("h3",{id:"tls"},"TLS"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#server"},"Server"),")"),(0,l.kt)("p",null,"TLS contains the information for loading a TLS certificate and key\nas well as an optional minimal TLS version that is acceptable."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"Key")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,l.kt)("td",{parentName:"tr",align:null},"Key is the TLS key data to use.",(0,l.kt)("br",null),"Typically this will come from a file.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"Cert")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,l.kt)("td",{parentName:"tr",align:null},"Cert is the TLS certificate data to use.",(0,l.kt)("br",null),"Typically this will come from a file.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"MinVersion")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"MinVersion is the minimal TLS version that is acceptable.",(0,l.kt)("br",null),'E.g. Set to "TLS1.3" to select TLS version 1.3')),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"CipherSuites")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"CipherSuites is a list of TLS cipher suites that are allowed.",(0,l.kt)("br",null),"E.g.:",(0,l.kt)("br",null),"- TLS_RSA_WITH_RC4_128_SHA",(0,l.kt)("br",null),"- TLS_RSA_WITH_AES_256_GCM_SHA384",(0,l.kt)("br",null),"If not specified, the default Go safe cipher list is used.",(0,l.kt)("br",null),"List of valid cipher suites can be found in the ",(0,l.kt)("a",{parentName:"td",href:"https://pkg.go.dev/crypto/tls#pkg-constants"},"crypto/tls documentation"),".")))),(0,l.kt)("h3",{id:"urlparameterrule"},"URLParameterRule"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#loginurlparameter"},"LoginURLParameter"),")"),(0,l.kt)("p",null,"URLParameterRule represents a rule by which query parameters\npassed to the ",(0,l.kt)("inlineCode",{parentName:"p"},"/oauth2/start")," endpoint are checked to determine whether\nthey are valid overrides for the given parameter passed to the IdP's\nlogin URL. Either Value or Pattern should be supplied, not both."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"value")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"A Value rule matches just this specific value")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"pattern")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"A Pattern rule gives a regular expression that must be matched by",(0,l.kt)("br",null),"some substring of the value. The expression is ",(0,l.kt)("em",{parentName:"td"},"not")," automatically",(0,l.kt)("br",null),"anchored to the start and end of the value, if you ",(0,l.kt)("em",{parentName:"td"},"want")," to restrict",(0,l.kt)("br",null),"the whole parameter value you must anchor it yourself with ",(0,l.kt)("inlineCode",{parentName:"td"},"^")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"$"),".")))),(0,l.kt)("h3",{id:"upstream"},"Upstream"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#upstreamconfig"},"UpstreamConfig"),")"),(0,l.kt)("p",null,"Upstream represents the configuration for an upstream server.\nRequests will be proxied to this upstream if the path matches the request path."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"id")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ID should be a unique identifier for the upstream.",(0,l.kt)("br",null),"This value is required for all upstreams.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"path")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Path is used to map requests to the upstream server.",(0,l.kt)("br",null),"The closest match will take precedence and all Paths must be unique.",(0,l.kt)("br",null),"Path can also take a pattern when used with RewriteTarget.",(0,l.kt)("br",null),"Path segments can be captured and matched using regular experessions.",(0,l.kt)("br",null),"Eg:",(0,l.kt)("br",null),"- ",(0,l.kt)("inlineCode",{parentName:"td"},"^/foo$"),": Match only the explicit path ",(0,l.kt)("inlineCode",{parentName:"td"},"/foo"),(0,l.kt)("br",null),"- ",(0,l.kt)("inlineCode",{parentName:"td"},"^/bar/$"),": Match any path prefixed with ",(0,l.kt)("inlineCode",{parentName:"td"},"/bar/"),(0,l.kt)("br",null),"- ",(0,l.kt)("inlineCode",{parentName:"td"},"^/baz/(.*)$"),": Match any path prefixed with ",(0,l.kt)("inlineCode",{parentName:"td"},"/baz")," and capture the remaining path for use with RewriteTarget")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"rewriteTarget")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"RewriteTarget allows users to rewrite the request path before it is sent to",(0,l.kt)("br",null),"the upstream server.",(0,l.kt)("br",null),"Use the Path to capture segments for reuse within the rewrite target.",(0,l.kt)("br",null),"Eg: With a Path of ",(0,l.kt)("inlineCode",{parentName:"td"},"^/baz/(.*)"),", a RewriteTarget of ",(0,l.kt)("inlineCode",{parentName:"td"},"/foo/$1")," would rewrite",(0,l.kt)("br",null),"the request ",(0,l.kt)("inlineCode",{parentName:"td"},"/baz/abc/123")," to ",(0,l.kt)("inlineCode",{parentName:"td"},"/foo/abc/123")," before proxying to the",(0,l.kt)("br",null),"upstream server.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"uri")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"The URI of the upstream server. This may be an HTTP(S) server of a File",(0,l.kt)("br",null),"based URL. It may include a path, in which case all requests will be served",(0,l.kt)("br",null),"under that path.",(0,l.kt)("br",null),"Eg:",(0,l.kt)("br",null),"- http://localhost:8080",(0,l.kt)("br",null),"- ",(0,l.kt)("a",{parentName:"td",href:"https://service.localhost"},"https://service.localhost"),(0,l.kt)("br",null),"- ",(0,l.kt)("a",{parentName:"td",href:"https://service.localhost/path"},"https://service.localhost/path"),(0,l.kt)("br",null),"- file://host/path",(0,l.kt)("br",null),'If the URI\'s path is "/base" and the incoming request was for "/dir",',(0,l.kt)("br",null),'the upstream request will be for "/base/dir".')),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"insecureSkipTLSVerify")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.",(0,l.kt)("br",null),"This option is insecure and will allow potential Man-In-The-Middle attacks",(0,l.kt)("br",null),"betweem OAuth2 Proxy and the usptream server.",(0,l.kt)("br",null),"Defaults to false.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"static")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"Static will make all requests to this upstream have a static response.",(0,l.kt)("br",null),'The response will have a body of "Authenticated" and a response code',(0,l.kt)("br",null),"matching StaticCode.",(0,l.kt)("br",null),"If StaticCode is not set, the response will return a 200 response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"staticCode")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"int")),(0,l.kt)("td",{parentName:"tr",align:null},"StaticCode determines the response code for the Static response.",(0,l.kt)("br",null),"This option can only be used with Static enabled.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"flushInterval")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#duration"},"Duration"))),(0,l.kt)("td",{parentName:"tr",align:null},"FlushInterval is the period between flushing the response buffer when",(0,l.kt)("br",null),"streaming response from the upstream.",(0,l.kt)("br",null),"Defaults to 1 second.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"passHostHeader")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"PassHostHeader determines whether the request host header should be proxied",(0,l.kt)("br",null),"to the upstream server.",(0,l.kt)("br",null),"Defaults to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"proxyWebSockets")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"ProxyWebSockets enables proxying of websockets to upstream servers",(0,l.kt)("br",null),"Defaults to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"timeout")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#duration"},"Duration"))),(0,l.kt)("td",{parentName:"tr",align:null},"Timeout is the maximum duration the server will wait for a response from the upstream server.",(0,l.kt)("br",null),"Defaults to 30 seconds.")))),(0,l.kt)("h3",{id:"upstreamconfig"},"UpstreamConfig"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions"),")"),(0,l.kt)("p",null,"UpstreamConfig is a collection of definitions for upstream servers."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"proxyRawPath")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"ProxyRawPath will pass the raw url path to upstream allowing for url's",(0,l.kt)("br",null),'like: "/%2F/" which would otherwise be redirected to "/"')),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"upstreams")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#upstream"},"[]Upstream"))),(0,l.kt)("td",{parentName:"tr",align:null},"Upstreams represents the configuration for the upstream servers.",(0,l.kt)("br",null),"Requests will be proxied to this upstream if the path matches the request path.")))))}N.isMDXComponent=!0}}]);
\ No newline at end of file
diff --git a/assets/js/cd4a49c1.e28e38c5.js b/assets/js/cd4a49c1.e28e38c5.js
new file mode 100644
index 00000000..5b9e4ee6
--- /dev/null
+++ b/assets/js/cd4a49c1.e28e38c5.js
@@ -0,0 +1 @@
+"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[2439],{3905:function(t,e,a){a.d(e,{Zo:function(){return m},kt:function(){return N}});var n=a(7294);function r(t,e,a){return e in t?Object.defineProperty(t,e,{value:a,enumerable:!0,configurable:!0,writable:!0}):t[e]=a,t}function l(t,e){var a=Object.keys(t);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(t);e&&(n=n.filter((function(e){return Object.getOwnPropertyDescriptor(t,e).enumerable}))),a.push.apply(a,n)}return a}function i(t){for(var e=1;estring alias)",id:"string-alias-1",level:4},{value:"Providers",id:"providers",level:3},{value:"([]Provider alias)",id:"provider-alias",level:4},{value:"SecretSource",id:"secretsource",level:3},{value:"Server",id:"server",level:3},{value:"TLS",id:"tls",level:3},{value:"URLParameterRule",id:"urlparameterrule",level:3},{value:"Upstream",id:"upstream",level:3},{value:"UpstreamConfig",id:"upstreamconfig",level:3}],u={toc:s},k="wrapper";function N(t){var e=t.components,a=(0,r.Z)(t,i);return(0,l.kt)(k,(0,n.Z)({},u,a,{components:e,mdxType:"MDXLayout"}),(0,l.kt)("admonition",{type:"warning"},(0,l.kt)("p",{parentName:"admonition"},"This page contains documentation for alpha features.\nWe reserve the right to make breaking changes to the features detailed within this page with no notice."),(0,l.kt)("p",{parentName:"admonition"},"Options described in this page may be changed, removed, renamed or moved without prior warning.\nPlease beware of this before you use alpha configuration options.")),(0,l.kt)("p",null,"This page details a set of ",(0,l.kt)("strong",{parentName:"p"},"alpha")," configuration options in a new format.\nGoing forward we are intending to add structured configuration in YAML format to\nreplace the existing TOML based configuration file and flags."),(0,l.kt)("p",null,"Below is a reference for the structure of the configuration, with\n",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions")," as the root of the configuration."),(0,l.kt)("p",null,"When using alpha configuration, your config file will look something like below:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},"upstreams:\n - id: ...\n ...: ...\ninjectRequestHeaders:\n - name: ...\n ...: ...\ninjectResponseHeaders:\n - name: ...\n ...: ...\n")),(0,l.kt)("p",null,"Please browse the ",(0,l.kt)("a",{parentName:"p",href:"#configuration-reference"},"reference")," below for the structure\nof the new configuration format."),(0,l.kt)("h2",{id:"using-alpha-configuration"},"Using Alpha Configuration"),(0,l.kt)("p",null,"To use the new ",(0,l.kt)("strong",{parentName:"p"},"alpha")," configuration, generate a YAML file based on the format\ndescribed in the ",(0,l.kt)("a",{parentName:"p",href:"#configuration-reference"},"reference")," below."),(0,l.kt)("p",null,"Provide the path to this file using the ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config")," flag."),(0,l.kt)("admonition",{type:"note"},(0,l.kt)("p",{parentName:"admonition"},"When using the ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config")," flag, some options are no longer available.\nSee ",(0,l.kt)("a",{parentName:"p",href:"#removed-options"},"removed options")," below for more information.")),(0,l.kt)("h3",{id:"converting-configuration-to-the-new-structure"},"Converting configuration to the new structure"),(0,l.kt)("p",null,"Before adding the new ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config")," option, start OAuth2 Proxy using the\n",(0,l.kt)("inlineCode",{parentName:"p"},"convert-config-to-alpha")," flag to convert existing configuration to the new format."),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-bash"},"oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg\n")),(0,l.kt)("p",null,"This will convert any options supported by the new format to YAML and print the\nnew configuration to ",(0,l.kt)("inlineCode",{parentName:"p"},"STDOUT"),"."),(0,l.kt)("p",null,"Copy this to a new file, remove any options from your existing configuration\nnoted in ",(0,l.kt)("a",{parentName:"p",href:"#removed-options"},"removed options")," and then start OAuth2 Proxy using\nthe new config."),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-bash"},"oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg\n")),(0,l.kt)("h2",{id:"removed-options"},"Removed options"),(0,l.kt)("p",null,"The following flags/options and their respective environment variables are no\nlonger available when using alpha configuration:"),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"flush-interval"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"flush_interval")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-host-header"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_host_header")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"proxy-websockets"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"proxy_websockets")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"ssl-upstream-insecure-skip-verify"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"ssl_upstream_insecure_skip_verify")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"upstream"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"upstreams"))),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-basic-auth"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_basic_auth")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-access-token"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_access_token")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-user-headers"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_user_headers")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-authorization-header"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_authorization_header")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"set-basic-auth"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"set_basic_auth")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"set-xauthrequest"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"set_xauthrequest")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"set-authorization-header"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"set_authorization_header")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"prefer-email-to-user"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"prefer_email_to_user")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"basic-auth-password"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"basic_auth_password")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"skip-auth-strip-headers"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"skip_auth_strip_headers"))),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"client-id"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"client_id")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"client-secret"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"client_secret"),", and ",(0,l.kt)("inlineCode",{parentName:"li"},"client-secret-file"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"client_secret_file")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"provider")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"provider-display-name"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"provider_display_name")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"provider-ca-file"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"provider_ca_files")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"login-url"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"login_url")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"redeem-url"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"redeem_url")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"profile-url"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"profile_url")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"resource")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"validate-url"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"validate_url")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"scope")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"prompt")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"approval-prompt"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"approval_prompt")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"acr-values"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"acr_values")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"user-id-claim"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"user_id_claim")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"allowed-group"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"allowed_groups")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"allowed-role"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"allowed_roles")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"jwt-key"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"jwt_key")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"jwt-key-file"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"jwt_key_file")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pubjwk-url"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pubjwk_url"))),(0,l.kt)("p",null,"and all provider-specific options, i.e. any option whose name includes ",(0,l.kt)("inlineCode",{parentName:"p"},"oidc"),",\n",(0,l.kt)("inlineCode",{parentName:"p"},"azure"),", ",(0,l.kt)("inlineCode",{parentName:"p"},"bitbucket"),", ",(0,l.kt)("inlineCode",{parentName:"p"},"github"),", ",(0,l.kt)("inlineCode",{parentName:"p"},"gitlab"),", ",(0,l.kt)("inlineCode",{parentName:"p"},"google")," or ",(0,l.kt)("inlineCode",{parentName:"p"},"keycloak"),". Attempting to\nuse any of these options via flags or via config when ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config")," is\nset will result in an error."),(0,l.kt)("admonition",{type:"important"},(0,l.kt)("p",{parentName:"admonition"},"You must remove these options before starting OAuth2 Proxy with ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config"))),(0,l.kt)("h2",{id:"configuration-reference"},"Configuration Reference"),(0,l.kt)("h3",{id:"adfsoptions"},"ADFSOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"skipScope")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"Skip adding the scope parameter in login request",(0,l.kt)("br",null),"Default value is 'false'")))),(0,l.kt)("h3",{id:"alphaoptions"},"AlphaOptions"),(0,l.kt)("p",null,"AlphaOptions contains alpha structured configuration options.\nUsage of these options allows users to access alpha features that are not\navailable as part of the primary configuration structure for OAuth2 Proxy."),(0,l.kt)("admonition",{type:"warning"},(0,l.kt)("p",{parentName:"admonition"},"The options within this structure are considered alpha.\nThey may change between releases without notice.")),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"upstreamConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#upstreamconfig"},"UpstreamConfig"))),(0,l.kt)("td",{parentName:"tr",align:null},"UpstreamConfig is used to configure upstream servers.",(0,l.kt)("br",null),"Once a user is authenticated, requests to the server will be proxied to",(0,l.kt)("br",null),"these upstream servers based on the path mappings defined in this list.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"injectRequestHeaders")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#header"},"[]Header"))),(0,l.kt)("td",{parentName:"tr",align:null},"InjectRequestHeaders is used to configure headers that should be added",(0,l.kt)("br",null),"to requests to upstream servers.",(0,l.kt)("br",null),"Headers may source values from either the authenticated user's session",(0,l.kt)("br",null),"or from a static secret value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"injectResponseHeaders")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#header"},"[]Header"))),(0,l.kt)("td",{parentName:"tr",align:null},"InjectResponseHeaders is used to configure headers that should be added",(0,l.kt)("br",null),"to responses from the proxy.",(0,l.kt)("br",null),"This is typically used when using the proxy as an external authentication",(0,l.kt)("br",null),"provider in conjunction with another proxy such as NGINX and its",(0,l.kt)("br",null),"auth_request module.",(0,l.kt)("br",null),"Headers may source values from either the authenticated user's session",(0,l.kt)("br",null),"or from a static secret value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"server")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#server"},"Server"))),(0,l.kt)("td",{parentName:"tr",align:null},"Server is used to configure the HTTP(S) server for the proxy application.",(0,l.kt)("br",null),"You may choose to run both HTTP and HTTPS servers simultaneously.",(0,l.kt)("br",null),"This can be done by setting the BindAddress and the SecureBindAddress simultaneously.",(0,l.kt)("br",null),"To use the secure server you must configure a TLS certificate and key.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"metricsServer")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#server"},"Server"))),(0,l.kt)("td",{parentName:"tr",align:null},"MetricsServer is used to configure the HTTP(S) server for metrics.",(0,l.kt)("br",null),"You may choose to run both HTTP and HTTPS servers simultaneously.",(0,l.kt)("br",null),"This can be done by setting the BindAddress and the SecureBindAddress simultaneously.",(0,l.kt)("br",null),"To use the secure server you must configure a TLS certificate and key.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"providers")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#providers"},"Providers"))),(0,l.kt)("td",{parentName:"tr",align:null},"Providers is used to configure multiple providers.")))),(0,l.kt)("h3",{id:"azureoptions"},"AzureOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"tenant")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Tenant directs to a tenant-specific or common (tenant-independent) endpoint",(0,l.kt)("br",null),"Default value is 'common'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"graphGroupField")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"GraphGroupField configures the group field to be used when building the groups list from Microsoft Graph",(0,l.kt)("br",null),"Default value is 'id'")))),(0,l.kt)("h3",{id:"bitbucketoptions"},"BitbucketOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"team")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Team sets restrict logins to members of this team")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"repository")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Repository sets restrict logins to user with access to this repository")))),(0,l.kt)("h3",{id:"claimsource"},"ClaimSource"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#headervalue"},"HeaderValue"),")"),(0,l.kt)("p",null,"ClaimSource allows loading a header value from a claim within the session"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"claim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Claim is the name of the claim in the session that the value should be",(0,l.kt)("br",null),"loaded from.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"prefix")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Prefix is an optional prefix that will be prepended to the value of the",(0,l.kt)("br",null),"claim if it is non-empty.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"basicAuthPassword")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,l.kt)("td",{parentName:"tr",align:null},"BasicAuthPassword converts this claim into a basic auth header.",(0,l.kt)("br",null),"Note the value of claim will become the basic auth username and the",(0,l.kt)("br",null),"basicAuthPassword will be used as the password value.")))),(0,l.kt)("h3",{id:"duration"},"Duration"),(0,l.kt)("h4",{id:"string-alias"},"(",(0,l.kt)("inlineCode",{parentName:"h4"},"string")," alias)"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#upstream"},"Upstream"),")"),(0,l.kt)("p",null,'Duration is as string representation of a period of time.\nA duration string is a is a possibly signed sequence of decimal numbers,\neach with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".\nValid time units are "ns", "us" (or "\xb5s"), "ms", "s", "m", "h".'),(0,l.kt)("h3",{id:"githuboptions"},"GitHubOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"org")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Org sets restrict logins to members of this organisation")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"team")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Team sets restrict logins to members of this team")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"repo")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Repo sets restrict logins to collaborators of this repository")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"token")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Token is the token to use when verifying repository collaborators",(0,l.kt)("br",null),"it must have push access to the repository")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"users")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Users allows users with these usernames to login",(0,l.kt)("br",null),"even if they do not belong to the specified org and team or collaborators")))),(0,l.kt)("h3",{id:"gitlaboptions"},"GitLabOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"group")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Group sets restrict logins to members of this group")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"projects")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Projects restricts logins to members of these projects")))),(0,l.kt)("h3",{id:"googleoptions"},"GoogleOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"group")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Groups sets restrict logins to members of this Google group")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"adminEmail")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"AdminEmail is the Google admin to impersonate for api calls")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"serviceAccountJson")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ServiceAccountJSON is the path to the service account json credentials")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"useApplicationDefaultCredentials")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"UseApplicationDefaultCredentials is a boolean whether to use Application Default Credentials instead of a ServiceAccountJSON")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"targetPrincipal")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"TargetPrincipal is the Google Service Account used for Application Default Credentials")))),(0,l.kt)("h3",{id:"header"},"Header"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions"),")"),(0,l.kt)("p",null,"Header represents an individual header that will be added to a request or\nresponse header."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"name")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Name is the header name to be used for this set of values.",(0,l.kt)("br",null),"Names should be unique within a list of Headers.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"preserveRequestValue")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"PreserveRequestValue determines whether any values for this header",(0,l.kt)("br",null),"should be preserved for the request to the upstream server.",(0,l.kt)("br",null),"This option only applies to injected request headers.",(0,l.kt)("br",null),"Defaults to false (headers that match this header will be stripped).")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"values")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#headervalue"},"[]HeaderValue"))),(0,l.kt)("td",{parentName:"tr",align:null},"Values contains the desired values for this header")))),(0,l.kt)("h3",{id:"headervalue"},"HeaderValue"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#header"},"Header"),")"),(0,l.kt)("p",null,"HeaderValue represents a single header value and the sources that can\nmake up the header value"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"value")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]byte")),(0,l.kt)("td",{parentName:"tr",align:null},"Value expects a base64 encoded string value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"fromEnv")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"FromEnv expects the name of an environment variable.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"fromFile")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"FromFile expects a path to a file containing the secret value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"claim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Claim is the name of the claim in the session that the value should be",(0,l.kt)("br",null),"loaded from.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"prefix")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Prefix is an optional prefix that will be prepended to the value of the",(0,l.kt)("br",null),"claim if it is non-empty.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"basicAuthPassword")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,l.kt)("td",{parentName:"tr",align:null},"BasicAuthPassword converts this claim into a basic auth header.",(0,l.kt)("br",null),"Note the value of claim will become the basic auth username and the",(0,l.kt)("br",null),"basicAuthPassword will be used as the password value.")))),(0,l.kt)("h3",{id:"keycloakoptions"},"KeycloakOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"groups")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Group enables to restrict login to members of indicated group")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"roles")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Role enables to restrict login to users with role (only available when using the keycloak-oidc provider)")))),(0,l.kt)("h3",{id:"logingovoptions"},"LoginGovOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"jwtKey")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"JWTKey is a private key in PEM format used to sign JWT,")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"jwtKeyFile")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"JWTKeyFile is a path to the private key file in PEM format used to sign the JWT")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"pubjwkURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"PubJWKURL is the JWK pubkey access endpoint")))),(0,l.kt)("h3",{id:"loginurlparameter"},"LoginURLParameter"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("p",null,"LoginURLParameter is the configuration for a single query parameter that\ncan be passed through from the ",(0,l.kt)("inlineCode",{parentName:"p"},"/oauth2/start"),' endpoint to the IdP login\nURL. The "default" option specifies the default value or values (if any)\nthat will be passed to the IdP for this parameter, and "allow" is a list\nof options for ways in which this parameter can be set or overridden via\nthe query string to ',(0,l.kt)("inlineCode",{parentName:"p"},"/oauth2/start"),".\nIf ",(0,l.kt)("em",{parentName:"p"},"only"),' a default is specified and no "allow" then the parameter is\neffectively fixed - the default value will always be used and anything\npassed to the start URL will be ignored. If ',(0,l.kt)("em",{parentName:"p"},"only"),' "allow" is specified\nbut no default then the parameter will only be passed on to the IdP if\nthe caller provides it, and no value will be sent otherwise.'),(0,l.kt)("p",null,"Examples:"),(0,l.kt)("h1",{id:"a-parameter-whose-value-is-fixed"},"A parameter whose value is fixed"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"name: organization\ndefault:\n- myorg\n")),(0,l.kt)("p",null,"A parameter that is not passed by default, but may be set to one of a\nfixed set of values"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"name: prompt\nallow:\n- value: login\n- value: consent\n- value: select_account\n")),(0,l.kt)("p",null,"A parameter that is passed by default but may be overridden by one of\na fixed set of values"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},'name: prompt\ndefault: ["login"]\nallow:\n- value: consent\n- value: select_account\n')),(0,l.kt)("p",null,"A parameter that may be overridden, but only by values that match a\nregular expression. For example to restrict ",(0,l.kt)("inlineCode",{parentName:"p"},"login_hint")," to email\naddresses in your organization's domain:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},'name: login_hint\nallow:\n- pattern: \'^[^@]*@example\\.com$\'\n# this allows at most one "@" sign, and requires "example.com" domain.\n')),(0,l.kt)("p",null,'Note that the YAML rules around exactly which characters are allowed\nand/or require escaping in different types of string literals are\nconvoluted. For regular expressions the single quoted form is simplest\nas backslash is not considered to be an escape character. Alternatively\nuse the "chomped block" format ',(0,l.kt)("inlineCode",{parentName:"p"},"|-"),":"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"}," - pattern: |-\n ^[^@]*@example\\.com$\n\n")),(0,l.kt)("p",null,"The hyphen is important, a ",(0,l.kt)("inlineCode",{parentName:"p"},"|")," block would have a trailing newline\ncharacter."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"name")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Name specifies the name of the query parameter.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"default")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"(Optional)")," Default specifies a default value or values that will be",(0,l.kt)("br",null),"passed to the IdP if not overridden.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"allow")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#urlparameterrule"},"[]URLParameterRule"))),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"(Optional)")," Allow specifies rules about how the default (if any) may be",(0,l.kt)("br",null),"overridden via the query string to ",(0,l.kt)("inlineCode",{parentName:"td"},"/oauth2/start"),". Only",(0,l.kt)("br",null),"values that match one or more of the allow rules will be",(0,l.kt)("br",null),"forwarded to the IdP.")))),(0,l.kt)("h3",{id:"oidcoptions"},"OIDCOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"issuerURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"IssuerURL is the OpenID Connect issuer URL",(0,l.kt)("br",null),"eg: ",(0,l.kt)("a",{parentName:"td",href:"https://accounts.google.com"},"https://accounts.google.com"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"insecureAllowUnverifiedEmail")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"InsecureAllowUnverifiedEmail prevents failures if an email address in an id_token is not verified",(0,l.kt)("br",null),"default set to 'false'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"insecureSkipIssuerVerification")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"InsecureSkipIssuerVerification skips verification of ID token issuers. When false, ID Token Issuers must match the OIDC discovery URL",(0,l.kt)("br",null),"default set to 'false'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"insecureSkipNonce")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"InsecureSkipNonce skips verifying the ID Token's nonce claim that must match",(0,l.kt)("br",null),"the random nonce sent in the initial OAuth flow. Otherwise, the nonce is checked",(0,l.kt)("br",null),"after the initial OAuth redeem & subsequent token refreshes.",(0,l.kt)("br",null),"default set to 'true'",(0,l.kt)("br",null),"Warning: In a future release, this will change to 'false' by default for enhanced security.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"skipDiscovery")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"SkipDiscovery allows to skip OIDC discovery and use manually supplied Endpoints",(0,l.kt)("br",null),"default set to 'false'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"jwksURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"JwksURL is the OpenID Connect JWKS URL",(0,l.kt)("br",null),"eg: ",(0,l.kt)("a",{parentName:"td",href:"https://www.googleapis.com/oauth2/v3/certs"},"https://www.googleapis.com/oauth2/v3/certs"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"emailClaim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"EmailClaim indicates which claim contains the user email,",(0,l.kt)("br",null),"default set to 'email'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"groupsClaim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"GroupsClaim indicates which claim contains the user groups",(0,l.kt)("br",null),"default set to 'groups'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"userIDClaim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"UserIDClaim indicates which claim contains the user ID",(0,l.kt)("br",null),"default set to 'email'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"audienceClaims")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"AudienceClaim allows to define any claim that is verified against the client id",(0,l.kt)("br",null),"By default ",(0,l.kt)("inlineCode",{parentName:"td"},"aud")," claim is used for verification.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"extraAudiences")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"ExtraAudiences is a list of additional audiences that are allowed",(0,l.kt)("br",null),"to pass verification in addition to the client id.")))),(0,l.kt)("h3",{id:"provider"},"Provider"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#providers"},"Providers"),")"),(0,l.kt)("p",null,"Provider holds all configuration for a single provider"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"clientID")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ClientID is the OAuth Client ID that is defined in the provider",(0,l.kt)("br",null),"This value is required for all providers.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"clientSecret")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ClientSecret is the OAuth Client Secret that is defined in the provider",(0,l.kt)("br",null),"This value is required for all providers.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"clientSecretFile")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ClientSecretFile is the name of the file",(0,l.kt)("br",null),"containing the OAuth Client Secret, it will be used if ClientSecret is not set.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"keycloakConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#keycloakoptions"},"KeycloakOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"KeycloakConfig holds all configurations for Keycloak provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"azureConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#azureoptions"},"AzureOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"AzureConfig holds all configurations for Azure provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"ADFSConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#adfsoptions"},"ADFSOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"ADFSConfig holds all configurations for ADFS provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"bitbucketConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#bitbucketoptions"},"BitbucketOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"BitbucketConfig holds all configurations for Bitbucket provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"githubConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#githuboptions"},"GitHubOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"GitHubConfig holds all configurations for GitHubC provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"gitlabConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#gitlaboptions"},"GitLabOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"GitLabConfig holds all configurations for GitLab provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"googleConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#googleoptions"},"GoogleOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"GoogleConfig holds all configurations for Google provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"oidcConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#oidcoptions"},"OIDCOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"OIDCConfig holds all configurations for OIDC provider",(0,l.kt)("br",null),"or providers utilize OIDC configurations.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"loginGovConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#logingovoptions"},"LoginGovOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"LoginGovConfig holds all configurations for LoginGov provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"id")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ID should be a unique identifier for the provider.",(0,l.kt)("br",null),"This value is required for all providers.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"provider")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#providertype"},"ProviderType"))),(0,l.kt)("td",{parentName:"tr",align:null},"Type is the OAuth provider",(0,l.kt)("br",null),"must be set from the supported providers group,",(0,l.kt)("br",null),"otherwise 'Google' is set as default")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"name")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Name is the providers display name",(0,l.kt)("br",null),"if set, it will be shown to the users in the login page.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"caFiles")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"CAFiles is a list of paths to CA certificates that should be used when connecting to the provider.",(0,l.kt)("br",null),"If not specified, the default Go trust sources are used instead")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"useSystemTrustStore")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"UseSystemTrustStore determines if your custom CA files and the system trust store are used",(0,l.kt)("br",null),"If set to true, your custom CA files and the system trust store are used otherwise only your custom CA files.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"loginURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"LoginURL is the authentication endpoint")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"loginURLParameters")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#loginurlparameter"},"[]LoginURLParameter"))),(0,l.kt)("td",{parentName:"tr",align:null},"LoginURLParameters defines the parameters that can be passed from the start URL to the IdP login URL")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"redeemURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"RedeemURL is the token redemption endpoint")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"profileURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ProfileURL is the profile access endpoint")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"resource")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ProtectedResource is the resource that is protected (Azure AD and ADFS only)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"validateURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ValidateURL is the access token validation endpoint")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"scope")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Scope is the OAuth scope specification")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"allowedGroups")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"AllowedGroups is a list of restrict logins to members of this group")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"code_challenge_method")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"The code challenge method")))),(0,l.kt)("h3",{id:"providertype"},"ProviderType"),(0,l.kt)("h4",{id:"string-alias-1"},"(",(0,l.kt)("inlineCode",{parentName:"h4"},"string")," alias)"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("p",null,"ProviderType is used to enumerate the different provider type options\nValid options are: adfs, azure, bitbucket, digitalocean facebook, github,\ngitlab, google, keycloak, keycloak-oidc, linkedin, login.gov, nextcloud\nand oidc."),(0,l.kt)("h3",{id:"providers"},"Providers"),(0,l.kt)("h4",{id:"provider-alias"},"(",(0,l.kt)("a",{parentName:"h4",href:"#provider"},"[]Provider")," alias)"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions"),")"),(0,l.kt)("p",null,"Providers is a collection of definitions for providers."),(0,l.kt)("h3",{id:"secretsource"},"SecretSource"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#claimsource"},"ClaimSource"),", ",(0,l.kt)("a",{parentName:"p",href:"#headervalue"},"HeaderValue"),", ",(0,l.kt)("a",{parentName:"p",href:"#tls"},"TLS"),")"),(0,l.kt)("p",null,"SecretSource references an individual secret value.\nOnly one source within the struct should be defined at any time."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"value")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]byte")),(0,l.kt)("td",{parentName:"tr",align:null},"Value expects a base64 encoded string value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"fromEnv")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"FromEnv expects the name of an environment variable.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"fromFile")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"FromFile expects a path to a file containing the secret value.")))),(0,l.kt)("h3",{id:"server"},"Server"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions"),")"),(0,l.kt)("p",null,"Server represents the configuration for an HTTP(S) server"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"BindAddress")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"BindAddress is the address on which to serve traffic.",(0,l.kt)("br",null),'Leave blank or set to "-" to disable.')),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"SecureBindAddress")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"SecureBindAddress is the address on which to serve secure traffic.",(0,l.kt)("br",null),'Leave blank or set to "-" to disable.')),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"TLS")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#tls"},"TLS"))),(0,l.kt)("td",{parentName:"tr",align:null},"TLS contains the information for loading the certificate and key for the",(0,l.kt)("br",null),"secure traffic and further configuration for the TLS server.")))),(0,l.kt)("h3",{id:"tls"},"TLS"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#server"},"Server"),")"),(0,l.kt)("p",null,"TLS contains the information for loading a TLS certificate and key\nas well as an optional minimal TLS version that is acceptable."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"Key")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,l.kt)("td",{parentName:"tr",align:null},"Key is the TLS key data to use.",(0,l.kt)("br",null),"Typically this will come from a file.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"Cert")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,l.kt)("td",{parentName:"tr",align:null},"Cert is the TLS certificate data to use.",(0,l.kt)("br",null),"Typically this will come from a file.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"MinVersion")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"MinVersion is the minimal TLS version that is acceptable.",(0,l.kt)("br",null),'E.g. Set to "TLS1.3" to select TLS version 1.3')),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"CipherSuites")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"CipherSuites is a list of TLS cipher suites that are allowed.",(0,l.kt)("br",null),"E.g.:",(0,l.kt)("br",null),"- TLS_RSA_WITH_RC4_128_SHA",(0,l.kt)("br",null),"- TLS_RSA_WITH_AES_256_GCM_SHA384",(0,l.kt)("br",null),"If not specified, the default Go safe cipher list is used.",(0,l.kt)("br",null),"List of valid cipher suites can be found in the ",(0,l.kt)("a",{parentName:"td",href:"https://pkg.go.dev/crypto/tls#pkg-constants"},"crypto/tls documentation"),".")))),(0,l.kt)("h3",{id:"urlparameterrule"},"URLParameterRule"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#loginurlparameter"},"LoginURLParameter"),")"),(0,l.kt)("p",null,"URLParameterRule represents a rule by which query parameters\npassed to the ",(0,l.kt)("inlineCode",{parentName:"p"},"/oauth2/start")," endpoint are checked to determine whether\nthey are valid overrides for the given parameter passed to the IdP's\nlogin URL. Either Value or Pattern should be supplied, not both."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"value")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"A Value rule matches just this specific value")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"pattern")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"A Pattern rule gives a regular expression that must be matched by",(0,l.kt)("br",null),"some substring of the value. The expression is ",(0,l.kt)("em",{parentName:"td"},"not")," automatically",(0,l.kt)("br",null),"anchored to the start and end of the value, if you ",(0,l.kt)("em",{parentName:"td"},"want")," to restrict",(0,l.kt)("br",null),"the whole parameter value you must anchor it yourself with ",(0,l.kt)("inlineCode",{parentName:"td"},"^")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"$"),".")))),(0,l.kt)("h3",{id:"upstream"},"Upstream"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#upstreamconfig"},"UpstreamConfig"),")"),(0,l.kt)("p",null,"Upstream represents the configuration for an upstream server.\nRequests will be proxied to this upstream if the path matches the request path."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"id")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ID should be a unique identifier for the upstream.",(0,l.kt)("br",null),"This value is required for all upstreams.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"path")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Path is used to map requests to the upstream server.",(0,l.kt)("br",null),"The closest match will take precedence and all Paths must be unique.",(0,l.kt)("br",null),"Path can also take a pattern when used with RewriteTarget.",(0,l.kt)("br",null),"Path segments can be captured and matched using regular experessions.",(0,l.kt)("br",null),"Eg:",(0,l.kt)("br",null),"- ",(0,l.kt)("inlineCode",{parentName:"td"},"^/foo$"),": Match only the explicit path ",(0,l.kt)("inlineCode",{parentName:"td"},"/foo"),(0,l.kt)("br",null),"- ",(0,l.kt)("inlineCode",{parentName:"td"},"^/bar/$"),": Match any path prefixed with ",(0,l.kt)("inlineCode",{parentName:"td"},"/bar/"),(0,l.kt)("br",null),"- ",(0,l.kt)("inlineCode",{parentName:"td"},"^/baz/(.*)$"),": Match any path prefixed with ",(0,l.kt)("inlineCode",{parentName:"td"},"/baz")," and capture the remaining path for use with RewriteTarget")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"rewriteTarget")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"RewriteTarget allows users to rewrite the request path before it is sent to",(0,l.kt)("br",null),"the upstream server.",(0,l.kt)("br",null),"Use the Path to capture segments for reuse within the rewrite target.",(0,l.kt)("br",null),"Eg: With a Path of ",(0,l.kt)("inlineCode",{parentName:"td"},"^/baz/(.*)"),", a RewriteTarget of ",(0,l.kt)("inlineCode",{parentName:"td"},"/foo/$1")," would rewrite",(0,l.kt)("br",null),"the request ",(0,l.kt)("inlineCode",{parentName:"td"},"/baz/abc/123")," to ",(0,l.kt)("inlineCode",{parentName:"td"},"/foo/abc/123")," before proxying to the",(0,l.kt)("br",null),"upstream server.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"uri")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"The URI of the upstream server. This may be an HTTP(S) server of a File",(0,l.kt)("br",null),"based URL. It may include a path, in which case all requests will be served",(0,l.kt)("br",null),"under that path.",(0,l.kt)("br",null),"Eg:",(0,l.kt)("br",null),"- http://localhost:8080",(0,l.kt)("br",null),"- ",(0,l.kt)("a",{parentName:"td",href:"https://service.localhost"},"https://service.localhost"),(0,l.kt)("br",null),"- ",(0,l.kt)("a",{parentName:"td",href:"https://service.localhost/path"},"https://service.localhost/path"),(0,l.kt)("br",null),"- file://host/path",(0,l.kt)("br",null),'If the URI\'s path is "/base" and the incoming request was for "/dir",',(0,l.kt)("br",null),'the upstream request will be for "/base/dir".')),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"insecureSkipTLSVerify")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.",(0,l.kt)("br",null),"This option is insecure and will allow potential Man-In-The-Middle attacks",(0,l.kt)("br",null),"between OAuth2 Proxy and the upstream server.",(0,l.kt)("br",null),"Defaults to false.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"static")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"Static will make all requests to this upstream have a static response.",(0,l.kt)("br",null),'The response will have a body of "Authenticated" and a response code',(0,l.kt)("br",null),"matching StaticCode.",(0,l.kt)("br",null),"If StaticCode is not set, the response will return a 200 response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"staticCode")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"int")),(0,l.kt)("td",{parentName:"tr",align:null},"StaticCode determines the response code for the Static response.",(0,l.kt)("br",null),"This option can only be used with Static enabled.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"flushInterval")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#duration"},"Duration"))),(0,l.kt)("td",{parentName:"tr",align:null},"FlushInterval is the period between flushing the response buffer when",(0,l.kt)("br",null),"streaming response from the upstream.",(0,l.kt)("br",null),"Defaults to 1 second.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"passHostHeader")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"PassHostHeader determines whether the request host header should be proxied",(0,l.kt)("br",null),"to the upstream server.",(0,l.kt)("br",null),"Defaults to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"proxyWebSockets")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"ProxyWebSockets enables proxying of websockets to upstream servers",(0,l.kt)("br",null),"Defaults to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"timeout")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#duration"},"Duration"))),(0,l.kt)("td",{parentName:"tr",align:null},"Timeout is the maximum duration the server will wait for a response from the upstream server.",(0,l.kt)("br",null),"Defaults to 30 seconds.")))),(0,l.kt)("h3",{id:"upstreamconfig"},"UpstreamConfig"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions"),")"),(0,l.kt)("p",null,"UpstreamConfig is a collection of definitions for upstream servers."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"proxyRawPath")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"ProxyRawPath will pass the raw url path to upstream allowing for urls",(0,l.kt)("br",null),'like: "/%2F/" which would otherwise be redirected to "/"')),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"upstreams")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#upstream"},"[]Upstream"))),(0,l.kt)("td",{parentName:"tr",align:null},"Upstreams represents the configuration for the upstream servers.",(0,l.kt)("br",null),"Requests will be proxied to this upstream if the path matches the request path.")))))}N.isMDXComponent=!0}}]);
\ No newline at end of file
diff --git a/assets/js/d0e8d649.a7878f00.js b/assets/js/d0e8d649.a7878f00.js
new file mode 100644
index 00000000..7420b55e
--- /dev/null
+++ b/assets/js/d0e8d649.a7878f00.js
@@ -0,0 +1 @@
+"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[7398],{3905:function(e,t,n){n.d(t,{Zo:function(){return p},kt:function(){return m}});var r=n(7294);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function i(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function a(e){for(var t=1;t