diff --git a/404.html b/404.html index 1f953d84..8fcaa13b 100644 --- a/404.html +++ b/404.html @@ -5,13 +5,13 @@ Page Not Found | OAuth2 Proxy - +
Skip to main content

Page Not Found

We could not find what you were looking for.

Please contact the owner of the site that linked you to the original URL and let them know their link is broken.

- + \ No newline at end of file diff --git a/assets/js/357fe94d.89fabb9f.js b/assets/js/357fe94d.89fabb9f.js new file mode 100644 index 00000000..c9dac066 --- /dev/null +++ b/assets/js/357fe94d.89fabb9f.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[9267],{3905:function(e,t,a){a.d(t,{Zo:function(){return u},kt:function(){return m}});var n=a(7294);function o(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function r(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function i(e){for(var t=1;t=0||(o[a]=e[a]);return o}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(o[a]=e[a])}return o}var p=n.createContext({}),s=function(e){var t=n.useContext(p),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},u=function(e){var t=s(e.components);return n.createElement(p.Provider,{value:t},e.children)},c={inlineCode:"code",wrapper:function(e){var t=e.children;return n.createElement(n.Fragment,{},t)}},d=n.forwardRef((function(e,t){var a=e.components,o=e.mdxType,r=e.originalType,p=e.parentName,u=l(e,["components","mdxType","originalType","parentName"]),d=s(a),m=o,h=d["".concat(p,".").concat(m)]||d[m]||c[m]||r;return a?n.createElement(h,i(i({ref:t},u),{},{components:a})):n.createElement(h,i({ref:t},u))}));function m(e,t){var a=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var r=a.length,i=new Array(r);i[0]=d;var l={};for(var p in t)hasOwnProperty.call(t,p)&&(l[p]=t[p]);l.originalType=e,l.mdxType="string"==typeof e?e:o,i[1]=l;for(var s=2;s\n --client-secret=\n --azure-tenant={tenant-id}\n --oidc-issuer-url=https://sts.windows.net/{tenant-id}/\n")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"for V2 Azure Auth endpoint (Microsoft Identity Platform Endpoints - ",(0,r.kt)("a",{parentName:"li",href:"https://login.microsoftonline.com/common/oauth2/v2.0/authorize"},"https://login.microsoftonline.com/common/oauth2/v2.0/authorize"),")")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=azure\n --client-id=\n --client-secret=\n --azure-tenant={tenant-id}\n --oidc-issuer-url=https://login.microsoftonline.com/{tenant-id}/v2.0\n")),(0,r.kt)("p",null,(0,r.kt)("strong",{parentName:"p"},(0,r.kt)("em",{parentName:"strong"},"Notes")),":"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"When using v2.0 Azure Auth endpoint (",(0,r.kt)("inlineCode",{parentName:"li"},"https://login.microsoftonline.com/{tenant-id}/v2.0"),") as ",(0,r.kt)("inlineCode",{parentName:"li"},"--oidc_issuer_url"),", in conjunction\nwith ",(0,r.kt)("inlineCode",{parentName:"li"},"--resource")," flag, be sure to append ",(0,r.kt)("inlineCode",{parentName:"li"},"/.default")," at the end of the resource name. See\n",(0,r.kt)("a",{parentName:"li",href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#the-default-scope"},"https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#the-default-scope")," for more details."),(0,r.kt)("li",{parentName:"ul"},"When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't\nget passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",(0,r.kt)("a",{parentName:"li",href:"/oauth2-proxy/docs/next/configuration/session_storage#redis-storage"},"redis session storage"),"\nshould resolve this.")),(0,r.kt)("h3",{id:"adfs-auth-provider"},"ADFS Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Open the ADFS administration console on your Windows Server and add a new Application Group"),(0,r.kt)("li",{parentName:"ol"},"Provide a name for the integration, select Server Application from the Standalone applications section and click Next"),(0,r.kt)("li",{parentName:"ol"},"Follow the wizard to get the client-id, client-secret and configure the application credentials"),(0,r.kt)("li",{parentName:"ol"},"Configure the proxy with")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=adfs\n --client-id=\n --client-secret=\n")),(0,r.kt)("p",null,"Note: When using the ADFS Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/next/configuration/session_storage#redis-storage"},"redis session storage")," should resolve this."),(0,r.kt)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new FB App from ",(0,r.kt)("a",{parentName:"li",href:"https://developers.facebook.com/"},"https://developers.facebook.com/")),(0,r.kt)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),(0,r.kt)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://github.com/settings/developers"},"https://github.com/settings/developers")),(0,r.kt)("li",{parentName:"ol"},"Under ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),(0,r.kt)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=*")),(0,r.kt)("p",null,"NOTE: When ",(0,r.kt)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),(0,r.kt)("p",null,"To restrict by organization only, include the following flag:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-org="": restrict logins to members of this organisation\n')),(0,r.kt)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",(0,r.kt)("inlineCode",{parentName:"p"},"-github-org"),":"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),(0,r.kt)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),(0,r.kt)("p",null,"If you'd like to allow access to users with ",(0,r.kt)("strong",{parentName:"p"},"read only")," access to a ",(0,r.kt)("strong",{parentName:"p"},"public")," repository you will need to provide a ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/settings/tokens"},"token")," for a user that has write access to the repository. The token must be created with at least the ",(0,r.kt)("inlineCode",{parentName:"p"},"public_repo")," scope:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-token="": the token to use when verifying repository collaborators\n')),(0,r.kt)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-user="": allow logins by username, separated by a comma\n')),(0,r.kt)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-login-url="http(s):///login/oauth/authorize"\n-redeem-url="http(s):///login/oauth/access_token"\n-validate-url="http(s):///api/v3"\n')),(0,r.kt)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),(0,r.kt)("div",{className:"admonition admonition-note alert alert--secondary"},(0,r.kt)("div",{parentName:"div",className:"admonition-heading"},(0,r.kt)("h5",{parentName:"div"},(0,r.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,r.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,r.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"}))),"note")),(0,r.kt)("div",{parentName:"div",className:"admonition-content"},(0,r.kt)("p",{parentName:"div"},"This is the legacy provider for Keycloak, use ",(0,r.kt)("a",{parentName:"p",href:"#keycloak-oidc-auth-provider"},"Keycloak OIDC Auth Provider")," if possible."))),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",(0,r.kt)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",(0,r.kt)("strong",{parentName:"li"},"Valid Redirect URIs")," '",(0,r.kt)("a",{parentName:"li",href:"https://internal.yourcompany.com/oauth2/callback'"},"https://internal.yourcompany.com/oauth2/callback'")),(0,r.kt)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",(0,r.kt)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),(0,r.kt)("p",null,"Make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider=keycloak\n --client-id=\n --client-secret=\n --login-url="http(s):///auth/realms//protocol/openid-connect/auth"\n --redeem-url="http(s):///auth/realms//protocol/openid-connect/token"\n --profile-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n --validate-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n --keycloak-group=\n --keycloak-group=\n')),(0,r.kt)("p",null,"For group based authorization, the optional ",(0,r.kt)("inlineCode",{parentName:"p"},"--keycloak-group")," (legacy) or ",(0,r.kt)("inlineCode",{parentName:"p"},"--allowed-group")," (global standard)\nflags can be used to specify which groups to limit access to."),(0,r.kt)("p",null,"If these are unset but a ",(0,r.kt)("inlineCode",{parentName:"p"},"groups")," mapper is set up above in step (3), the provider will still\npopulate the ",(0,r.kt)("inlineCode",{parentName:"p"},"X-Forwarded-Groups")," header to your upstream server with the ",(0,r.kt)("inlineCode",{parentName:"p"},"groups")," data in the\nKeycloak userinfo endpoint response."),(0,r.kt)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak\nyou should define the 'keycloak-group' value to /admin."),(0,r.kt)("h3",{id:"keycloak-oidc-auth-provider"},"Keycloak OIDC Auth Provider"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=keycloak-oidc\n --client-id=\n --client-secret=\n --redirect-url=https://internal.yourcompany.com/oauth2/callback\n --oidc-issuer-url=https:///auth/realms/\n --email-domain= // Validate email domain for users, see option documentation\n --allowed-role= // Optional, required realm role\n --allowed-role=: // Optional, required client role\n --allowed-group= // Optional, requires group client scope\n --code-challenge-method=S256 // PKCE\n")),(0,r.kt)("div",{className:"admonition admonition-note alert alert--secondary"},(0,r.kt)("div",{parentName:"div",className:"admonition-heading"},(0,r.kt)("h5",{parentName:"div"},(0,r.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,r.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,r.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"}))),"note")),(0,r.kt)("div",{parentName:"div",className:"admonition-content"},(0,r.kt)("p",{parentName:"div"},"Keycloak has updated its admin console and as of version 19.0.0, the new admin console is enabled by default. The legacy admin console has been announced for removal with the release of version 21.0.0."))),(0,r.kt)("p",null,(0,r.kt)("strong",{parentName:"p"},"Keycloak legacy admin console")),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",(0,r.kt)("strong",{parentName:"li"},"Access Type")," 'confidential', ",(0,r.kt)("strong",{parentName:"li"},"Client protocol")," 'openid-connect' and ",(0,r.kt)("strong",{parentName:"li"},"Valid Redirect URIs")," '",(0,r.kt)("a",{parentName:"li",href:"https://internal.yourcompany.com/oauth2/callback'"},"https://internal.yourcompany.com/oauth2/callback'")),(0,r.kt)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",(0,r.kt)("strong",{parentName:"li"},"Token Claim Name")," 'groups'."),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Audience' and ",(0,r.kt)("strong",{parentName:"li"},"Included Client Audience")," and ",(0,r.kt)("strong",{parentName:"li"},"Included Custom Audience")," set to your client name.")),(0,r.kt)("p",null,(0,r.kt)("strong",{parentName:"p"},"Keycloak new admin console (default as of v19.0.0)")),(0,r.kt)("p",null,"The following example shows how to create a simple OIDC client using the new Keycloak admin2 console. However, for best practices, it is recommended to consult the Keycloak documentation."),(0,r.kt)("p",null,"The OIDC client must be configured with an ",(0,r.kt)("em",{parentName:"p"},"audience mapper")," to include the client's name in the ",(0,r.kt)("inlineCode",{parentName:"p"},"aud")," claim of the JWT token.",(0,r.kt)("br",{parentName:"p"}),"\n","The ",(0,r.kt)("inlineCode",{parentName:"p"},"aud")," claim specifies the intended recipient of the token, and OAuth2 Proxy expects a match against the values of either ",(0,r.kt)("inlineCode",{parentName:"p"},"--client-id")," or ",(0,r.kt)("inlineCode",{parentName:"p"},"--oidc-extra-audience"),"."),(0,r.kt)("p",null,(0,r.kt)("em",{parentName:"p"},'In Keycloak, claims are added to JWT tokens through the use of mappers at either the realm level using "client scopes" or through "dedicated" client mappers.')),(0,r.kt)("p",null,(0,r.kt)("strong",{parentName:"p"},"Creating the client")),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new OIDC client in your Keycloak realm by navigating to:",(0,r.kt)("br",{parentName:"li"}),(0,r.kt)("strong",{parentName:"li"},"Clients")," -> ",(0,r.kt)("strong",{parentName:"li"},"Create client"))),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Client Type")," 'OpenID Connect'"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Client ID")," ",(0,r.kt)("inlineCode",{parentName:"li"},""),", please complete the remaining fields as appropriate and click ",(0,r.kt)("strong",{parentName:"li"},"Next"),".",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Client authentication")," 'On'"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Authentication flow"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Standard flow")," 'selected'"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Direct access grants")," 'deselect'",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("em",{parentName:"li"},"Save the configuration.")))))),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Settings / Access settings"),":",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Valid redirect URIs")," ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("em",{parentName:"li"},"Save the configuration.")))))),(0,r.kt)("li",{parentName:"ul"},"Under the ",(0,r.kt)("strong",{parentName:"li"},"Credentials")," tab you will now be able to locate ",(0,r.kt)("inlineCode",{parentName:"li"},""),".")))),(0,r.kt)("ol",{start:2},(0,r.kt)("li",{parentName:"ol"},"Configure a dedicated ",(0,r.kt)("em",{parentName:"li"},"audience mapper")," for your client by navigating to ",(0,r.kt)("strong",{parentName:"li"},"Clients")," -> ",(0,r.kt)("strong",{parentName:"li"},"")," -> ",(0,r.kt)("strong",{parentName:"li"},"Client scopes"),".")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Access the dedicated mappers pane by clicking ",(0,r.kt)("strong",{parentName:"li"},"-dedicated"),", located under ",(0,r.kt)("em",{parentName:"li"},"Assigned client scope"),".",(0,r.kt)("br",{parentName:"li"}),(0,r.kt)("em",{parentName:"li"},'(It should have a description of "Dedicated scope and mappers for this client")'),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"Click ",(0,r.kt)("strong",{parentName:"li"},"Configure a new mapper")," and select ",(0,r.kt)("strong",{parentName:"li"},"Audience"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Name")," 'aud-mapper-'"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Included Client Audience")," select ",(0,r.kt)("inlineCode",{parentName:"li"},"")," from the dropdown.",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("em",{parentName:"li"},"OAuth2 proxy can be set up to pass both the access and ID JWT tokens to your upstream services.\nIf you require additional audience entries, you can use the ",(0,r.kt)("strong",{parentName:"em"},"Included Custom Audience"),' field in addition to the "Included Client Audience" dropdown. Note that the "aud" claim of a JWT token should be limited and only specify its intended recipients.')))),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Add to ID token")," 'On'"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Add to access token")," 'On' - ",(0,r.kt)("a",{parentName:"li",href:"https://github.com/oauth2-proxy/oauth2-proxy/pull/1916"},"#1916"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("em",{parentName:"li"},"Save the configuration.")))))))),(0,r.kt)("li",{parentName:"ul"},"Any subsequent dedicated client mappers can be defined by clicking ",(0,r.kt)("strong",{parentName:"li"},"Dedicated scopes")," -> ",(0,r.kt)("strong",{parentName:"li"},"Add mapper")," -> ",(0,r.kt)("strong",{parentName:"li"},"By configuration")," -> ",(0,r.kt)("em",{parentName:"li"},"Select mapper"))),(0,r.kt)("p",null,"You should now be able to create a test user in Keycloak and get access to the OAuth2 Proxy instance, make sure to set an email address matching ",(0,r.kt)("inlineCode",{parentName:"p"},"")," and select ",(0,r.kt)("em",{parentName:"p"},"Email verified"),"."),(0,r.kt)("p",null,(0,r.kt)("strong",{parentName:"p"},"Authorization")),(0,r.kt)("p",null,(0,r.kt)("em",{parentName:"p"},"OAuth2 Proxy will perform authorization by requiring a valid user, this authorization can be extended to take into account a user's membership in Keycloak ",(0,r.kt)("inlineCode",{parentName:"em"},"groups"),", ",(0,r.kt)("inlineCode",{parentName:"em"},"realm roles"),", and ",(0,r.kt)("inlineCode",{parentName:"em"},"client roles")," using the keycloak-oidc provider options",(0,r.kt)("br",{parentName:"em"}),(0,r.kt)("inlineCode",{parentName:"em"},"--allowed-role")," or ",(0,r.kt)("inlineCode",{parentName:"em"},"--allowed-group"))),(0,r.kt)("p",null,(0,r.kt)("strong",{parentName:"p"},"Roles")),(0,r.kt)("p",null,(0,r.kt)("em",{parentName:"p"},"A standard Keycloak installation comes with the required mappers for ",(0,r.kt)("strong",{parentName:"em"},"realm roles")," and ",(0,r.kt)("strong",{parentName:"em"},"client roles"),' through the pre-defined client scope "roles".\nThis ensures that any roles assigned to a user are included in the ',(0,r.kt)("inlineCode",{parentName:"em"},"JWT"),' tokens when using an OIDC client that has the "Full scope allowed" feature activated, the feature is enabled by default.')),(0,r.kt)("p",null,(0,r.kt)("em",{parentName:"p"},"Creating a realm role")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Realm roles")," -> ",(0,r.kt)("strong",{parentName:"li"},"Create role"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Role name"),", ",(0,r.kt)("em",{parentName:"li"},(0,r.kt)("inlineCode",{parentName:"em"},""))," -> ",(0,r.kt)("strong",{parentName:"li"},"save"))))),(0,r.kt)("p",null,(0,r.kt)("em",{parentName:"p"},"Creating a client role")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Clients")," -> ",(0,r.kt)("inlineCode",{parentName:"li"},"")," -> ",(0,r.kt)("strong",{parentName:"li"},"Roles")," -> ",(0,r.kt)("strong",{parentName:"li"},"Create role"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Role name"),", ",(0,r.kt)("em",{parentName:"li"},(0,r.kt)("inlineCode",{parentName:"em"},""))," -> ",(0,r.kt)("strong",{parentName:"li"},"save"))))),(0,r.kt)("p",null,(0,r.kt)("em",{parentName:"p"},"Assign a role to a user")),(0,r.kt)("p",null,(0,r.kt)("strong",{parentName:"p"},"Users")," -> ",(0,r.kt)("em",{parentName:"p"},"Username")," -> ",(0,r.kt)("strong",{parentName:"p"},"Role mapping")," -> ",(0,r.kt)("strong",{parentName:"p"},"Assign role")," -> ",(0,r.kt)("em",{parentName:"p"},"filter by roles or clients and select")," -> ",(0,r.kt)("strong",{parentName:"p"},"Assign"),"."),(0,r.kt)("p",null,'Keycloak "realm roles" can be authorized using the ',(0,r.kt)("inlineCode",{parentName:"p"},"--allowed-role="),' option, while "client roles" can be evaluated using ',(0,r.kt)("inlineCode",{parentName:"p"},"--allowed-role=:"),"."),(0,r.kt)("p",null,"You may limit the ",(0,r.kt)("em",{parentName:"p"},"realm roles")," included in the JWT tokens for any given client by navigating to:",(0,r.kt)("br",{parentName:"p"}),"\n",(0,r.kt)("strong",{parentName:"p"},"Clients")," -> ",(0,r.kt)("inlineCode",{parentName:"p"},"")," -> ",(0,r.kt)("strong",{parentName:"p"},"Client scopes")," -> ",(0,r.kt)("em",{parentName:"p"},"-dedicated")," -> ",(0,r.kt)("strong",{parentName:"p"},"Scope"),(0,r.kt)("br",{parentName:"p"}),"\n","Disabling ",(0,r.kt)("strong",{parentName:"p"},"Full scope allowed")," activates the ",(0,r.kt)("strong",{parentName:"p"},"Assign role")," option, allowing you to select which roles, if assigned to a user, will be included in the user's JWT tokens. This can be useful when a user has many associated roles, and you want to reduce the size and impact of the JWT token."),(0,r.kt)("p",null,(0,r.kt)("strong",{parentName:"p"},"Groups")),(0,r.kt)("p",null,"You may also do authorization on group memberships by using the OAuth2 Proxy option ",(0,r.kt)("inlineCode",{parentName:"p"},"--allowed-group"),".",(0,r.kt)("br",{parentName:"p"}),"\n","We will only do a brief description of creating the required ",(0,r.kt)("em",{parentName:"p"},"client scope")," ",(0,r.kt)("strong",{parentName:"p"},"groups")," and refer you to read the Keycloak documentation."),(0,r.kt)("p",null,"To summarize, the steps required to authorize Keycloak group membership with OAuth2 Proxy are as follows:"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Create a new Client Scope with the name ",(0,r.kt)("strong",{parentName:"li"},"groups")," in Keycloak.",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"Include a mapper of type ",(0,r.kt)("strong",{parentName:"li"},"Group Membership"),"."),(0,r.kt)("li",{parentName:"ul"},'Set the "Token Claim Name" to ',(0,r.kt)("strong",{parentName:"li"},"groups")," or customize by matching it to the ",(0,r.kt)("inlineCode",{parentName:"li"},"--oidc-groups-claim")," option of OAuth2 Proxy."),(0,r.kt)("li",{parentName:"ul"},'If the "Full group path" option is selected, you need to include a "/" separator in the group names defined in the ',(0,r.kt)("inlineCode",{parentName:"li"},"--allowed-group"),' option of OAuth2 Proxy. Example: "/groupname" or "/groupname/childgroup".')))),(0,r.kt)("p",null,"After creating the ",(0,r.kt)("em",{parentName:"p"},"Client Scope")," named ",(0,r.kt)("em",{parentName:"p"},"groups")," you will need to attach it to your client.",(0,r.kt)("br",{parentName:"p"}),"\n",(0,r.kt)("strong",{parentName:"p"},"Clients")," -> ",(0,r.kt)("inlineCode",{parentName:"p"},"")," -> ",(0,r.kt)("strong",{parentName:"p"},"Client scopes")," -> ",(0,r.kt)("strong",{parentName:"p"},"Add client scope")," -> Select ",(0,r.kt)("strong",{parentName:"p"},"groups")," and choose Optional and you should now have a client that maps group memberships into the JWT tokens so that Oauth2 Proxy may evaluate them."),(0,r.kt)("p",null,"Create a group by navigating to ",(0,r.kt)("strong",{parentName:"p"},"Groups")," -> ",(0,r.kt)("strong",{parentName:"p"},"Create group")," and ",(0,r.kt)("em",{parentName:"p"},"add")," your test user as a member."),(0,r.kt)("p",null,"The OAuth2 Proxy option ",(0,r.kt)("inlineCode",{parentName:"p"},"--allowed-group=/groupname")," will now allow you to filter on group membership"),(0,r.kt)("p",null,"Keycloak also has the option of attaching roles to groups, please refer to the Keycloak documentation for more information."),(0,r.kt)("p",null,(0,r.kt)("strong",{parentName:"p"},"Tip")),(0,r.kt)("p",null,"To check if roles or groups are added to JWT tokens, you can preview a users token in the Keycloak console by following these steps:\n",(0,r.kt)("strong",{parentName:"p"},"Clients")," -> ",(0,r.kt)("inlineCode",{parentName:"p"},"")," -> ",(0,r.kt)("strong",{parentName:"p"},"Client scopes")," -> ",(0,r.kt)("strong",{parentName:"p"},"Evaluate"),".",(0,r.kt)("br",{parentName:"p"}),"\n","Select a ",(0,r.kt)("em",{parentName:"p"},"realm user")," and optional ",(0,r.kt)("em",{parentName:"p"},"scope parameters")," such as groups, and generate the JSON representation of an access or id token to examine its contents."),(0,r.kt)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),(0,r.kt)("p",null,"This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/issues/994"},"994"),")."),(0,r.kt)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",(0,r.kt)("a",{parentName:"p",href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"},"these steps to add an application"),". Make sure to enable at least the ",(0,r.kt)("inlineCode",{parentName:"p"},"openid"),", ",(0,r.kt)("inlineCode",{parentName:"p"},"profile")," and ",(0,r.kt)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",(0,r.kt)("a",{parentName:"p",href:"https://myapp.com/oauth2/callback"},"https://myapp.com/oauth2/callback"),"."),(0,r.kt)("p",null,"If you need projects filtering, add the extra ",(0,r.kt)("inlineCode",{parentName:"p"},"read_api")," scope to your application."),(0,r.kt)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/next/configuration/overview#generating-a-cookie-secret"},"these steps")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider="gitlab"\n --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n --client-id=GITLAB_CLIENT_ID\n --client-secret=GITLAB_CLIENT_SECRET\n --cookie-secret=COOKIE_SECRET\n')),(0,r.kt)("p",null,"Restricting by group membership is possible with the following option:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),(0,r.kt)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--oidc-issuer-url=""\n')),(0,r.kt)("p",null,"If your self-hosted GitLab is on a sub-directory (e.g. domain.tld/gitlab), as opposed to its own sub-domain (e.g. gitlab.domain.tld), you may need to add a redirect from domain.tld/oauth pointing at e.g. domain.tld/gitlab/oauth."),(0,r.kt)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),(0,r.kt)("p",null,"For LinkedIn, the registration steps are:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://www.linkedin.com/secure/developer"},"https://www.linkedin.com/secure/developer")),(0,r.kt)("li",{parentName:"ol"},"In the OAuth User Agreement section:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),(0,r.kt)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),(0,r.kt)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),(0,r.kt)("li",{parentName:"ol"},"Take note of the ",(0,r.kt)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",(0,r.kt)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),(0,r.kt)("h3",{id:"microsoft-azure-ad-provider"},"Microsoft Azure AD Provider"),(0,r.kt)("p",null,"For adding an application to the Microsoft Azure AD follow ",(0,r.kt)("a",{parentName:"p",href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"},"these steps to add an application"),"."),(0,r.kt)("p",null,"Take note of your ",(0,r.kt)("inlineCode",{parentName:"p"},"TenantId")," if applicable for your situation. The ",(0,r.kt)("inlineCode",{parentName:"p"},"TenantId")," can be used to override the default ",(0,r.kt)("inlineCode",{parentName:"p"},"common")," authorization server with a tenant specific server."),(0,r.kt)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),(0,r.kt)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."),(0,r.kt)("p",null,"This provider was originally built against CoreOS Dex and we will use it as an example.\nThe OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below."),(0,r.kt)("h4",{id:"dex"},"Dex"),(0,r.kt)("p",null,"To configure the OIDC provider for Dex, perform the following steps:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Download Dex:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"go get github.com/dexidp/dex\n")),(0,r.kt)("p",{parentName:"li"},"See the ",(0,r.kt)("a",{parentName:"p",href:"https://dexidp.io/docs/getting-started/"},"getting started guide")," for more details.")),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the ",(0,r.kt)("inlineCode",{parentName:"p"},"staticClients")," section of ",(0,r.kt)("inlineCode",{parentName:"p"},"examples/config-dev.yaml"),":"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"- id: oauth2-proxy\nredirectURIs:\n- 'http://127.0.0.1:4180/oauth2/callback'\nname: 'oauth2-proxy'\nsecret: proxy\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Launch Dex: from ",(0,r.kt)("inlineCode",{parentName:"p"},"$GOPATH/github.com/dexidp/dex"),", run:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"bin/dex serve examples/config-dev.yaml\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"In a second terminal, run the oauth2-proxy with the following args:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'-provider oidc\n-provider-display-name "My OIDC Provider"\n-client-id oauth2-proxy\n-client-secret proxy\n-redirect-url http://127.0.0.1:4180/oauth2/callback\n-oidc-issuer-url http://127.0.0.1:5556/dex\n-cookie-secure=false\n-cookie-secret=secret\n-email-domain kilgore.trout\n')),(0,r.kt)("p",{parentName:"li"},"To serve the current working directory as a web site under the ",(0,r.kt)("inlineCode",{parentName:"p"},"/static")," endpoint, add:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"-upstream file://$PWD/#/static/\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Test the setup by visiting ",(0,r.kt)("a",{parentName:"p",href:"http://127.0.0.1:4180"},"http://127.0.0.1:4180")," or ",(0,r.kt)("a",{parentName:"p",href:"http://127.0.0.1:4180/static"},"http://127.0.0.1:4180/static")," ."))),(0,r.kt)("p",null,"See also ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment"},"our local testing environment")," for a self-contained example using Docker and etcd as storage for Dex."),(0,r.kt)("h4",{id:"okta"},"Okta"),(0,r.kt)("p",null,"To configure the OIDC provider for Okta, perform the following steps:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",(0,r.kt)("inlineCode",{parentName:"li"},"example.oktapreview.com")),(0,r.kt)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",(0,r.kt)("inlineCode",{parentName:"li"},"default")," will work.")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Security")," then select ",(0,r.kt)("strong",{parentName:"li"},"API")),(0,r.kt)("li",{parentName:"ul"},"Click ",(0,r.kt)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),(0,r.kt)("li",{parentName:"ul"},"Fill out the ",(0,r.kt)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),(0,r.kt)("li",{parentName:"ul"},"For ",(0,r.kt)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",(0,r.kt)("a",{parentName:"li",href:"https://example.corp.com"},"https://example.corp.com")),(0,r.kt)("li",{parentName:"ul"},"Fill out a ",(0,r.kt)("strong",{parentName:"li"},"Description")),(0,r.kt)("li",{parentName:"ul"},"Add any ",(0,r.kt)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),(0,r.kt)("li",{parentName:"ul"},"The default settings will work for other options.\n",(0,r.kt)("a",{parentName:"li",href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"},"See Okta documentation for more information on Authorization Servers"))),(0,r.kt)("ol",{start:3},(0,r.kt)("li",{parentName:"ol"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Applications")," then select ",(0,r.kt)("strong",{parentName:"li"},"Add Application"),".")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Select ",(0,r.kt)("strong",{parentName:"li"},"Web")," for the ",(0,r.kt)("strong",{parentName:"li"},"Platform")," setting."),(0,r.kt)("li",{parentName:"ul"},"Select ",(0,r.kt)("strong",{parentName:"li"},"OpenID Connect")," and click ",(0,r.kt)("strong",{parentName:"li"},"Create")),(0,r.kt)("li",{parentName:"ul"},"Pick an ",(0,r.kt)("strong",{parentName:"li"},"Application Name")," such as ",(0,r.kt)("inlineCode",{parentName:"li"},"Example App"),"."),(0,r.kt)("li",{parentName:"ul"},"Set the ",(0,r.kt)("strong",{parentName:"li"},"Login redirect URI")," to ",(0,r.kt)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),(0,r.kt)("li",{parentName:"ul"},"Under ",(0,r.kt)("strong",{parentName:"li"},"General")," set the ",(0,r.kt)("strong",{parentName:"li"},"Allowed grant types")," to ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization Code")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Refresh Token"),"."),(0,r.kt)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",(0,r.kt)("inlineCode",{parentName:"li"},"Client ID")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Client Secret"),"."),(0,r.kt)("li",{parentName:"ul"},"Under ",(0,r.kt)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),(0,r.kt)("ol",{start:4},(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Create a configuration file like the following:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n "https://example.corp.com"\n]\nemail_domains = [\n "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')))),(0,r.kt)("p",null,"The ",(0,r.kt)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",(0,r.kt)("strong",{parentName:"p"},"Authorization Server"),"'s ",(0,r.kt)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",(0,r.kt)("a",{parentName:"p",href:"https://corp.okta.com"},"https://corp.okta.com")," .\nThe ",(0,r.kt)("inlineCode",{parentName:"p"},"client_id")," and ",(0,r.kt)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",(0,r.kt)("inlineCode",{parentName:"p"},"cookie_secret")," to encrypt the cookie."),(0,r.kt)("p",null,"Then you can start the oauth2-proxy with ",(0,r.kt)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),(0,r.kt)("h4",{id:"okta---localhost"},"Okta - localhost"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Signup for developer account: ",(0,r.kt)("a",{parentName:"li",href:"https://developer.okta.com/signup/"},"https://developer.okta.com/signup/")),(0,r.kt)("li",{parentName:"ol"},"Create New ",(0,r.kt)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),(0,r.kt)("li",{parentName:"ol"},"Example Application Settings for localhost:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Name:")," My Web App"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Group assignments:")," ",(0,r.kt)("inlineCode",{parentName:"li"},"Everyone")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Grant type allowed:")," ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization Code")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Refresh Token")))),(0,r.kt)("li",{parentName:"ol"},"Make note of the ",(0,r.kt)("inlineCode",{parentName:"li"},"Client ID")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),(0,r.kt)("li",{parentName:"ol"},"Make note of the ",(0,r.kt)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),(0,r.kt)("li",{parentName:"ol"},"Example config file ",(0,r.kt)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n "http://0.0.0.0:8080"\n]\nemail_domains = [\n "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),(0,r.kt)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",(0,r.kt)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),(0,r.kt)("h3",{id:"logingov-provider"},"login.gov Provider"),(0,r.kt)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",(0,r.kt)("a",{parentName:"p",href:"https://login.gov/developers/"},"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),(0,r.kt)("p",null,"A developer guide is available here: ",(0,r.kt)("a",{parentName:"p",href:"https://developers.login.gov/"},"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),(0,r.kt)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),(0,r.kt)("p",null,"First, register your application in the dashboard. The important bits are:"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Identity protocol: make this ",(0,r.kt)("inlineCode",{parentName:"li"},"Openid connect")),(0,r.kt)("li",{parentName:"ul"},"Issuer: do what they say for OpenID Connect. We will refer to this string as ",(0,r.kt)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),(0,r.kt)("li",{parentName:"ul"},"Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",(0,r.kt)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",(0,r.kt)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",(0,r.kt)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),(0,r.kt)("li",{parentName:"ul"},"Return to App URL: Make this be ",(0,r.kt)("inlineCode",{parentName:"li"},"http://localhost:4180/")),(0,r.kt)("li",{parentName:"ul"},"Redirect URIs: Make this be ",(0,r.kt)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),(0,r.kt)("li",{parentName:"ul"},"Attribute Bundle: Make sure that email is selected.")),(0,r.kt)("p",null,"Now start the proxy up with the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'./oauth2-proxy -provider login.gov \\\n -client-id=${LOGINGOV_ISSUER} \\\n -redirect-url=http://localhost:4180/oauth2/callback \\\n -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n -cookie-secure=false \\\n -email-domain=gsa.gov \\\n -upstream=http://localhost:3000/ \\\n -cookie-secret=somerandomstring12341234567890AB \\\n -cookie-domain=localhost \\\n -skip-provider-button=true \\\n -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),(0,r.kt)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",(0,r.kt)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",(0,r.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",(0,r.kt)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),(0,r.kt)("p",null,"Once it is running, you should be able to go to ",(0,r.kt)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",(0,r.kt)("inlineCode",{parentName:"p"},"http://localhost:3000/"),". In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),(0,r.kt)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),(0,r.kt)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),(0,r.kt)("p",null,"In this case, you can set the ",(0,r.kt)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," -provider oidc\n -client-id oauth2-proxy\n -client-secret proxy\n -redirect-url http://127.0.0.1:4180/oauth2/callback\n -oidc-issuer-url http://127.0.0.1:5556\n -skip-oidc-discovery\n -login-url http://127.0.0.1:5556/authorize\n -redeem-url http://127.0.0.1:5556/token\n -oidc-jwks-url http://127.0.0.1:5556/keys\n -cookie-secure=false\n -email-domain example.com\n")),(0,r.kt)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),(0,r.kt)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),(0,r.kt)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",(0,r.kt)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",(0,r.kt)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),(0,r.kt)("p",null,"Refer to the ",(0,r.kt)("a",{parentName:"p",href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"},"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',(0,r.kt)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' -provider nextcloud\n -client-id \n -client-secret \n -login-url="/index.php/apps/oauth2/authorize"\n -redeem-url="/index.php/apps/oauth2/api/v1/token"\n -validate-url="/ocs/v2.php/cloud/user?format=json"\n')),(0,r.kt)("p",null,"Note: in ",(0,r.kt)("em",{parentName:"p"},"all")," cases the validate-url will ",(0,r.kt)("em",{parentName:"p"},"not")," have the ",(0,r.kt)("inlineCode",{parentName:"p"},"index.php"),"."),(0,r.kt)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("a",{parentName:"li",href:"https://cloud.digitalocean.com/account/api/applications"},"Create a new OAuth application"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),(0,r.kt)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',(0,r.kt)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",(0,r.kt)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),(0,r.kt)("p",null,"To use the provider, pass the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=digitalocean\n --client-id=\n --client-secret=\n")),(0,r.kt)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",(0,r.kt)("inlineCode",{parentName:"p"},"https:///oauth2/callback"),". If you need to change it, you can use the ",(0,r.kt)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),(0,r.kt)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("a",{parentName:"li",href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"},"Add a new OAuth consumer"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},'In "Callback URL" use ',(0,r.kt)("inlineCode",{parentName:"li"},"https:///oauth2/callback"),", substituting ",(0,r.kt)("inlineCode",{parentName:"li"},"")," with the actual hostname that oauth2-proxy is running on."),(0,r.kt)("li",{parentName:"ul"},"In Permissions section select:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"Account -> Email"),(0,r.kt)("li",{parentName:"ul"},"Team membership -> Read"),(0,r.kt)("li",{parentName:"ul"},"Repositories -> Read"))))),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),(0,r.kt)("p",null,"To use the provider, pass the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=bitbucket\n --client-id=\n --client-secret=\n")),(0,r.kt)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",(0,r.kt)("inlineCode",{parentName:"p"},"--bitbucket-team="),". To restrict the access to only these users who has access to one selected repository use ",(0,r.kt)("inlineCode",{parentName:"p"},"--bitbucket-repository="),"."),(0,r.kt)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new application: ",(0,r.kt)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),(0,r.kt)("li",{parentName:"ol"},"Under ",(0,r.kt)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",(0,r.kt)("inlineCode",{parentName:"li"},"https:///oauth2/callback")),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),(0,r.kt)("li",{parentName:"ol"},"Pass the following options to the proxy:")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider="github"\n --redirect-url="https:///oauth2/callback"\n --provider-display-name="Gitea"\n --client-id="< client_id as generated by Gitea >"\n --client-secret="< client_secret as generated by Gitea >"\n --login-url="https://< your gitea host >/login/oauth/authorize"\n --redeem-url="https://< your gitea host >/login/oauth/access_token"\n --validate-url="https://< your gitea host >/api/v1"\n')),(0,r.kt)("h2",{id:"email-authentication"},"Email Authentication"),(0,r.kt)("p",null,"To authorize by email domain use ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",(0,r.kt)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),(0,r.kt)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),(0,r.kt)("p",null,"Follow the examples in the ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"},(0,r.kt)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",(0,r.kt)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",(0,r.kt)("inlineCode",{parentName:"p"},"case")," to\n",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"},(0,r.kt)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",(0,r.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",(0,r.kt)("inlineCode",{parentName:"p"},"Provider"),"."))}d.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/js/357fe94d.c84c0f72.js b/assets/js/357fe94d.c84c0f72.js deleted file mode 100644 index a86d88a8..00000000 --- a/assets/js/357fe94d.c84c0f72.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[9267],{3905:function(e,t,o){o.d(t,{Zo:function(){return c},kt:function(){return h}});var a=o(7294);function n(e,t,o){return t in e?Object.defineProperty(e,t,{value:o,enumerable:!0,configurable:!0,writable:!0}):e[t]=o,e}function r(e,t){var o=Object.keys(e);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);t&&(a=a.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),o.push.apply(o,a)}return o}function i(e){for(var t=1;t=0||(n[o]=e[o]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(a=0;a=0||Object.prototype.propertyIsEnumerable.call(e,o)&&(n[o]=e[o])}return n}var p=a.createContext({}),s=function(e){var t=a.useContext(p),o=t;return e&&(o="function"==typeof e?e(t):i(i({},t),e)),o},c=function(e){var t=s(e.components);return a.createElement(p.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return a.createElement(a.Fragment,{},t)}},d=a.forwardRef((function(e,t){var o=e.components,n=e.mdxType,r=e.originalType,p=e.parentName,c=l(e,["components","mdxType","originalType","parentName"]),d=s(o),h=n,m=d["".concat(p,".").concat(h)]||d[h]||u[h]||r;return o?a.createElement(m,i(i({ref:t},c),{},{components:o})):a.createElement(m,i({ref:t},c))}));function h(e,t){var o=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var r=o.length,i=new Array(r);i[0]=d;var l={};for(var p in t)hasOwnProperty.call(t,p)&&(l[p]=t[p]);l.originalType=e,l.mdxType="string"==typeof e?e:n,i[1]=l;for(var s=2;s\n --client-secret=\n --azure-tenant={tenant-id}\n --oidc-issuer-url=https://sts.windows.net/{tenant-id}/\n")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"for V2 Azure Auth endpoint (Microsoft Identity Platform Endpoints - ",(0,r.kt)("a",{parentName:"li",href:"https://login.microsoftonline.com/common/oauth2/v2.0/authorize"},"https://login.microsoftonline.com/common/oauth2/v2.0/authorize"),")")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=azure\n --client-id=\n --client-secret=\n --azure-tenant={tenant-id}\n --oidc-issuer-url=https://login.microsoftonline.com/{tenant-id}/v2.0\n")),(0,r.kt)("p",null,(0,r.kt)("strong",{parentName:"p"},(0,r.kt)("em",{parentName:"strong"},"Notes")),":"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"When using v2.0 Azure Auth endpoint (",(0,r.kt)("inlineCode",{parentName:"li"},"https://login.microsoftonline.com/{tenant-id}/v2.0"),") as ",(0,r.kt)("inlineCode",{parentName:"li"},"--oidc_issuer_url"),", in conjunction\nwith ",(0,r.kt)("inlineCode",{parentName:"li"},"--resource")," flag, be sure to append ",(0,r.kt)("inlineCode",{parentName:"li"},"/.default")," at the end of the resource name. See\n",(0,r.kt)("a",{parentName:"li",href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#the-default-scope"},"https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#the-default-scope")," for more details."),(0,r.kt)("li",{parentName:"ul"},"When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't\nget passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",(0,r.kt)("a",{parentName:"li",href:"/oauth2-proxy/docs/next/configuration/session_storage#redis-storage"},"redis session storage"),"\nshould resolve this.")),(0,r.kt)("h3",{id:"adfs-auth-provider"},"ADFS Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Open the ADFS administration console on your Windows Server and add a new Application Group"),(0,r.kt)("li",{parentName:"ol"},"Provide a name for the integration, select Server Application from the Standalone applications section and click Next"),(0,r.kt)("li",{parentName:"ol"},"Follow the wizard to get the client-id, client-secret and configure the application credentials"),(0,r.kt)("li",{parentName:"ol"},"Configure the proxy with")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=adfs\n --client-id=\n --client-secret=\n")),(0,r.kt)("p",null,"Note: When using the ADFS Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/next/configuration/session_storage#redis-storage"},"redis session storage")," should resolve this."),(0,r.kt)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new FB App from ",(0,r.kt)("a",{parentName:"li",href:"https://developers.facebook.com/"},"https://developers.facebook.com/")),(0,r.kt)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),(0,r.kt)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://github.com/settings/developers"},"https://github.com/settings/developers")),(0,r.kt)("li",{parentName:"ol"},"Under ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),(0,r.kt)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=*")),(0,r.kt)("p",null,"NOTE: When ",(0,r.kt)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),(0,r.kt)("p",null,"To restrict by organization only, include the following flag:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-org="": restrict logins to members of this organisation\n')),(0,r.kt)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",(0,r.kt)("inlineCode",{parentName:"p"},"-github-org"),":"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),(0,r.kt)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),(0,r.kt)("p",null,"If you'd like to allow access to users with ",(0,r.kt)("strong",{parentName:"p"},"read only")," access to a ",(0,r.kt)("strong",{parentName:"p"},"public")," repository you will need to provide a ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/settings/tokens"},"token")," for a user that has write access to the repository. The token must be created with at least the ",(0,r.kt)("inlineCode",{parentName:"p"},"public_repo")," scope:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-token="": the token to use when verifying repository collaborators\n')),(0,r.kt)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-user="": allow logins by username, separated by a comma\n')),(0,r.kt)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-login-url="http(s):///login/oauth/authorize"\n-redeem-url="http(s):///login/oauth/access_token"\n-validate-url="http(s):///api/v3"\n')),(0,r.kt)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),(0,r.kt)("div",{className:"admonition admonition-note alert alert--secondary"},(0,r.kt)("div",{parentName:"div",className:"admonition-heading"},(0,r.kt)("h5",{parentName:"div"},(0,r.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,r.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,r.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"}))),"note")),(0,r.kt)("div",{parentName:"div",className:"admonition-content"},(0,r.kt)("p",{parentName:"div"},"This is the legacy provider for Keycloak, use ",(0,r.kt)("a",{parentName:"p",href:"#keycloak-oidc-auth-provider"},"Keycloak OIDC Auth Provider")," if possible."))),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",(0,r.kt)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",(0,r.kt)("strong",{parentName:"li"},"Valid Redirect URIs")," '",(0,r.kt)("a",{parentName:"li",href:"https://internal.yourcompany.com/oauth2/callback'"},"https://internal.yourcompany.com/oauth2/callback'")),(0,r.kt)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",(0,r.kt)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),(0,r.kt)("p",null,"Make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider=keycloak\n --client-id=\n --client-secret=\n --login-url="http(s):///auth/realms//protocol/openid-connect/auth"\n --redeem-url="http(s):///auth/realms//protocol/openid-connect/token"\n --profile-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n --validate-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n --keycloak-group=\n --keycloak-group=\n')),(0,r.kt)("p",null,"For group based authorization, the optional ",(0,r.kt)("inlineCode",{parentName:"p"},"--keycloak-group")," (legacy) or ",(0,r.kt)("inlineCode",{parentName:"p"},"--allowed-group")," (global standard)\nflags can be used to specify which groups to limit access to."),(0,r.kt)("p",null,"If these are unset but a ",(0,r.kt)("inlineCode",{parentName:"p"},"groups")," mapper is set up above in step (3), the provider will still\npopulate the ",(0,r.kt)("inlineCode",{parentName:"p"},"X-Forwarded-Groups")," header to your upstream server with the ",(0,r.kt)("inlineCode",{parentName:"p"},"groups")," data in the\nKeycloak userinfo endpoint response."),(0,r.kt)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak\nyou should define the 'keycloak-group' value to /admin."),(0,r.kt)("h3",{id:"keycloak-oidc-auth-provider"},"Keycloak OIDC Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",(0,r.kt)("strong",{parentName:"li"},"Access Type")," 'confidental', ",(0,r.kt)("strong",{parentName:"li"},"Client protocol")," 'openid-connect' and ",(0,r.kt)("strong",{parentName:"li"},"Valid Redirect URIs")," '",(0,r.kt)("a",{parentName:"li",href:"https://internal.yourcompany.com/oauth2/callback'"},"https://internal.yourcompany.com/oauth2/callback'")),(0,r.kt)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",(0,r.kt)("strong",{parentName:"li"},"Token Claim Name")," 'groups'."),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Audience' and ",(0,r.kt)("strong",{parentName:"li"},"Included Client Audience")," and ",(0,r.kt)("strong",{parentName:"li"},"Included Custom Audience")," set to your client name.")),(0,r.kt)("p",null,"Make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=keycloak-oidc\n --client-id=\n --client-secret=\n --redirect-url=https://myapp.com/oauth2/callback\n --oidc-issuer-url=https:///auth/realms/\n --allowed-role= // Optional, required realm role\n --allowed-role=: // Optional, required client role\n")),(0,r.kt)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),(0,r.kt)("p",null,"This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/issues/994"},"994"),")."),(0,r.kt)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",(0,r.kt)("a",{parentName:"p",href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"},"these steps to add an application"),". Make sure to enable at least the ",(0,r.kt)("inlineCode",{parentName:"p"},"openid"),", ",(0,r.kt)("inlineCode",{parentName:"p"},"profile")," and ",(0,r.kt)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",(0,r.kt)("a",{parentName:"p",href:"https://myapp.com/oauth2/callback"},"https://myapp.com/oauth2/callback"),"."),(0,r.kt)("p",null,"If you need projects filtering, add the extra ",(0,r.kt)("inlineCode",{parentName:"p"},"read_api")," scope to your application."),(0,r.kt)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/next/configuration/overview#generating-a-cookie-secret"},"these steps")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider="gitlab"\n --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n --client-id=GITLAB_CLIENT_ID\n --client-secret=GITLAB_CLIENT_SECRET\n --cookie-secret=COOKIE_SECRET\n')),(0,r.kt)("p",null,"Restricting by group membership is possible with the following option:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),(0,r.kt)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--oidc-issuer-url=""\n')),(0,r.kt)("p",null,"If your self-hosted GitLab is on a sub-directory (e.g. domain.tld/gitlab), as opposed to its own sub-domain (e.g. gitlab.domain.tld), you may need to add a redirect from domain.tld/oauth pointing at e.g. domain.tld/gitlab/oauth."),(0,r.kt)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),(0,r.kt)("p",null,"For LinkedIn, the registration steps are:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://www.linkedin.com/secure/developer"},"https://www.linkedin.com/secure/developer")),(0,r.kt)("li",{parentName:"ol"},"In the OAuth User Agreement section:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),(0,r.kt)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),(0,r.kt)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),(0,r.kt)("li",{parentName:"ol"},"Take note of the ",(0,r.kt)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",(0,r.kt)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),(0,r.kt)("h3",{id:"microsoft-azure-ad-provider"},"Microsoft Azure AD Provider"),(0,r.kt)("p",null,"For adding an application to the Microsoft Azure AD follow ",(0,r.kt)("a",{parentName:"p",href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"},"these steps to add an application"),"."),(0,r.kt)("p",null,"Take note of your ",(0,r.kt)("inlineCode",{parentName:"p"},"TenantId")," if applicable for your situation. The ",(0,r.kt)("inlineCode",{parentName:"p"},"TenantId")," can be used to override the default ",(0,r.kt)("inlineCode",{parentName:"p"},"common")," authorization server with a tenant specific server."),(0,r.kt)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),(0,r.kt)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."),(0,r.kt)("p",null,"This provider was originally built against CoreOS Dex and we will use it as an example.\nThe OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below."),(0,r.kt)("h4",{id:"dex"},"Dex"),(0,r.kt)("p",null,"To configure the OIDC provider for Dex, perform the following steps:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Download Dex:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"go get github.com/dexidp/dex\n")),(0,r.kt)("p",{parentName:"li"},"See the ",(0,r.kt)("a",{parentName:"p",href:"https://dexidp.io/docs/getting-started/"},"getting started guide")," for more details.")),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the ",(0,r.kt)("inlineCode",{parentName:"p"},"staticClients")," section of ",(0,r.kt)("inlineCode",{parentName:"p"},"examples/config-dev.yaml"),":"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"- id: oauth2-proxy\nredirectURIs:\n- 'http://127.0.0.1:4180/oauth2/callback'\nname: 'oauth2-proxy'\nsecret: proxy\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Launch Dex: from ",(0,r.kt)("inlineCode",{parentName:"p"},"$GOPATH/github.com/dexidp/dex"),", run:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"bin/dex serve examples/config-dev.yaml\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"In a second terminal, run the oauth2-proxy with the following args:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'-provider oidc\n-provider-display-name "My OIDC Provider"\n-client-id oauth2-proxy\n-client-secret proxy\n-redirect-url http://127.0.0.1:4180/oauth2/callback\n-oidc-issuer-url http://127.0.0.1:5556/dex\n-cookie-secure=false\n-cookie-secret=secret\n-email-domain kilgore.trout\n')),(0,r.kt)("p",{parentName:"li"},"To serve the current working directory as a web site under the ",(0,r.kt)("inlineCode",{parentName:"p"},"/static")," endpoint, add:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"-upstream file://$PWD/#/static/\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Test the setup by visiting ",(0,r.kt)("a",{parentName:"p",href:"http://127.0.0.1:4180"},"http://127.0.0.1:4180")," or ",(0,r.kt)("a",{parentName:"p",href:"http://127.0.0.1:4180/static"},"http://127.0.0.1:4180/static")," ."))),(0,r.kt)("p",null,"See also ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment"},"our local testing environment")," for a self-contained example using Docker and etcd as storage for Dex."),(0,r.kt)("h4",{id:"okta"},"Okta"),(0,r.kt)("p",null,"To configure the OIDC provider for Okta, perform the following steps:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",(0,r.kt)("inlineCode",{parentName:"li"},"example.oktapreview.com")),(0,r.kt)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",(0,r.kt)("inlineCode",{parentName:"li"},"default")," will work.")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Security")," then select ",(0,r.kt)("strong",{parentName:"li"},"API")),(0,r.kt)("li",{parentName:"ul"},"Click ",(0,r.kt)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),(0,r.kt)("li",{parentName:"ul"},"Fill out the ",(0,r.kt)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),(0,r.kt)("li",{parentName:"ul"},"For ",(0,r.kt)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",(0,r.kt)("a",{parentName:"li",href:"https://example.corp.com"},"https://example.corp.com")),(0,r.kt)("li",{parentName:"ul"},"Fill out a ",(0,r.kt)("strong",{parentName:"li"},"Description")),(0,r.kt)("li",{parentName:"ul"},"Add any ",(0,r.kt)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),(0,r.kt)("li",{parentName:"ul"},"The default settings will work for other options.\n",(0,r.kt)("a",{parentName:"li",href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"},"See Okta documentation for more information on Authorization Servers"))),(0,r.kt)("ol",{start:3},(0,r.kt)("li",{parentName:"ol"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Applications")," then select ",(0,r.kt)("strong",{parentName:"li"},"Add Application"),".")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Select ",(0,r.kt)("strong",{parentName:"li"},"Web")," for the ",(0,r.kt)("strong",{parentName:"li"},"Platform")," setting."),(0,r.kt)("li",{parentName:"ul"},"Select ",(0,r.kt)("strong",{parentName:"li"},"OpenID Connect")," and click ",(0,r.kt)("strong",{parentName:"li"},"Create")),(0,r.kt)("li",{parentName:"ul"},"Pick an ",(0,r.kt)("strong",{parentName:"li"},"Application Name")," such as ",(0,r.kt)("inlineCode",{parentName:"li"},"Example App"),"."),(0,r.kt)("li",{parentName:"ul"},"Set the ",(0,r.kt)("strong",{parentName:"li"},"Login redirect URI")," to ",(0,r.kt)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),(0,r.kt)("li",{parentName:"ul"},"Under ",(0,r.kt)("strong",{parentName:"li"},"General")," set the ",(0,r.kt)("strong",{parentName:"li"},"Allowed grant types")," to ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization Code")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Refresh Token"),"."),(0,r.kt)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",(0,r.kt)("inlineCode",{parentName:"li"},"Client ID")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Client Secret"),"."),(0,r.kt)("li",{parentName:"ul"},"Under ",(0,r.kt)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),(0,r.kt)("ol",{start:4},(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Create a configuration file like the following:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n "https://example.corp.com"\n]\nemail_domains = [\n "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')))),(0,r.kt)("p",null,"The ",(0,r.kt)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",(0,r.kt)("strong",{parentName:"p"},"Authorization Server"),"'s ",(0,r.kt)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",(0,r.kt)("a",{parentName:"p",href:"https://corp.okta.com"},"https://corp.okta.com")," .\nThe ",(0,r.kt)("inlineCode",{parentName:"p"},"client_id")," and ",(0,r.kt)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",(0,r.kt)("inlineCode",{parentName:"p"},"cookie_secret")," to encrypt the cookie."),(0,r.kt)("p",null,"Then you can start the oauth2-proxy with ",(0,r.kt)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),(0,r.kt)("h4",{id:"okta---localhost"},"Okta - localhost"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Signup for developer account: ",(0,r.kt)("a",{parentName:"li",href:"https://developer.okta.com/signup/"},"https://developer.okta.com/signup/")),(0,r.kt)("li",{parentName:"ol"},"Create New ",(0,r.kt)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),(0,r.kt)("li",{parentName:"ol"},"Example Application Settings for localhost:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Name:")," My Web App"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Group assignments:")," ",(0,r.kt)("inlineCode",{parentName:"li"},"Everyone")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Grant type allowed:")," ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization Code")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Refresh Token")))),(0,r.kt)("li",{parentName:"ol"},"Make note of the ",(0,r.kt)("inlineCode",{parentName:"li"},"Client ID")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),(0,r.kt)("li",{parentName:"ol"},"Make note of the ",(0,r.kt)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),(0,r.kt)("li",{parentName:"ol"},"Example config file ",(0,r.kt)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n "http://0.0.0.0:8080"\n]\nemail_domains = [\n "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),(0,r.kt)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",(0,r.kt)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),(0,r.kt)("h3",{id:"logingov-provider"},"login.gov Provider"),(0,r.kt)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",(0,r.kt)("a",{parentName:"p",href:"https://login.gov/developers/"},"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),(0,r.kt)("p",null,"A developer guide is available here: ",(0,r.kt)("a",{parentName:"p",href:"https://developers.login.gov/"},"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),(0,r.kt)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),(0,r.kt)("p",null,"First, register your application in the dashboard. The important bits are:"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Identity protocol: make this ",(0,r.kt)("inlineCode",{parentName:"li"},"Openid connect")),(0,r.kt)("li",{parentName:"ul"},"Issuer: do what they say for OpenID Connect. We will refer to this string as ",(0,r.kt)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),(0,r.kt)("li",{parentName:"ul"},"Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",(0,r.kt)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",(0,r.kt)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",(0,r.kt)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),(0,r.kt)("li",{parentName:"ul"},"Return to App URL: Make this be ",(0,r.kt)("inlineCode",{parentName:"li"},"http://localhost:4180/")),(0,r.kt)("li",{parentName:"ul"},"Redirect URIs: Make this be ",(0,r.kt)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),(0,r.kt)("li",{parentName:"ul"},"Attribute Bundle: Make sure that email is selected.")),(0,r.kt)("p",null,"Now start the proxy up with the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'./oauth2-proxy -provider login.gov \\\n -client-id=${LOGINGOV_ISSUER} \\\n -redirect-url=http://localhost:4180/oauth2/callback \\\n -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n -cookie-secure=false \\\n -email-domain=gsa.gov \\\n -upstream=http://localhost:3000/ \\\n -cookie-secret=somerandomstring12341234567890AB \\\n -cookie-domain=localhost \\\n -skip-provider-button=true \\\n -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),(0,r.kt)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",(0,r.kt)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",(0,r.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",(0,r.kt)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),(0,r.kt)("p",null,"Once it is running, you should be able to go to ",(0,r.kt)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",(0,r.kt)("inlineCode",{parentName:"p"},"http://localhost:3000/"),". In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),(0,r.kt)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),(0,r.kt)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),(0,r.kt)("p",null,"In this case, you can set the ",(0,r.kt)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," -provider oidc\n -client-id oauth2-proxy\n -client-secret proxy\n -redirect-url http://127.0.0.1:4180/oauth2/callback\n -oidc-issuer-url http://127.0.0.1:5556\n -skip-oidc-discovery\n -login-url http://127.0.0.1:5556/authorize\n -redeem-url http://127.0.0.1:5556/token\n -oidc-jwks-url http://127.0.0.1:5556/keys\n -cookie-secure=false\n -email-domain example.com\n")),(0,r.kt)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),(0,r.kt)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),(0,r.kt)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",(0,r.kt)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",(0,r.kt)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),(0,r.kt)("p",null,"Refer to the ",(0,r.kt)("a",{parentName:"p",href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"},"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',(0,r.kt)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' -provider nextcloud\n -client-id \n -client-secret \n -login-url="/index.php/apps/oauth2/authorize"\n -redeem-url="/index.php/apps/oauth2/api/v1/token"\n -validate-url="/ocs/v2.php/cloud/user?format=json"\n')),(0,r.kt)("p",null,"Note: in ",(0,r.kt)("em",{parentName:"p"},"all")," cases the validate-url will ",(0,r.kt)("em",{parentName:"p"},"not")," have the ",(0,r.kt)("inlineCode",{parentName:"p"},"index.php"),"."),(0,r.kt)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("a",{parentName:"li",href:"https://cloud.digitalocean.com/account/api/applications"},"Create a new OAuth application"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),(0,r.kt)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',(0,r.kt)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",(0,r.kt)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),(0,r.kt)("p",null,"To use the provider, pass the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=digitalocean\n --client-id=\n --client-secret=\n")),(0,r.kt)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",(0,r.kt)("inlineCode",{parentName:"p"},"https:///oauth2/callback"),". If you need to change it, you can use the ",(0,r.kt)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),(0,r.kt)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("a",{parentName:"li",href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"},"Add a new OAuth consumer"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},'In "Callback URL" use ',(0,r.kt)("inlineCode",{parentName:"li"},"https:///oauth2/callback"),", substituting ",(0,r.kt)("inlineCode",{parentName:"li"},"")," with the actual hostname that oauth2-proxy is running on."),(0,r.kt)("li",{parentName:"ul"},"In Permissions section select:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"Account -> Email"),(0,r.kt)("li",{parentName:"ul"},"Team membership -> Read"),(0,r.kt)("li",{parentName:"ul"},"Repositories -> Read"))))),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),(0,r.kt)("p",null,"To use the provider, pass the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=bitbucket\n --client-id=\n --client-secret=\n")),(0,r.kt)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",(0,r.kt)("inlineCode",{parentName:"p"},"--bitbucket-team="),". To restrict the access to only these users who has access to one selected repository use ",(0,r.kt)("inlineCode",{parentName:"p"},"--bitbucket-repository="),"."),(0,r.kt)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new application: ",(0,r.kt)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),(0,r.kt)("li",{parentName:"ol"},"Under ",(0,r.kt)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",(0,r.kt)("inlineCode",{parentName:"li"},"https:///oauth2/callback")),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),(0,r.kt)("li",{parentName:"ol"},"Pass the following options to the proxy:")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider="github"\n --redirect-url="https:///oauth2/callback"\n --provider-display-name="Gitea"\n --client-id="< client_id as generated by Gitea >"\n --client-secret="< client_secret as generated by Gitea >"\n --login-url="https://< your gitea host >/login/oauth/authorize"\n --redeem-url="https://< your gitea host >/login/oauth/access_token"\n --validate-url="https://< your gitea host >/api/v1"\n')),(0,r.kt)("h2",{id:"email-authentication"},"Email Authentication"),(0,r.kt)("p",null,"To authorize by email domain use ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",(0,r.kt)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),(0,r.kt)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),(0,r.kt)("p",null,"Follow the examples in the ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"},(0,r.kt)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",(0,r.kt)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",(0,r.kt)("inlineCode",{parentName:"p"},"case")," to\n",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"},(0,r.kt)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",(0,r.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",(0,r.kt)("inlineCode",{parentName:"p"},"Provider"),"."))}d.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/js/runtime~main.28f7e902.js b/assets/js/runtime~main.0569d14f.js similarity index 61% rename from assets/js/runtime~main.28f7e902.js rename to assets/js/runtime~main.0569d14f.js index 2ef2bdd3..07c352e8 100644 --- a/assets/js/runtime~main.28f7e902.js +++ b/assets/js/runtime~main.0569d14f.js @@ -1 +1 @@ -!function(){"use strict";var e,c,f,a,t,d={},r={};function n(e){var c=r[e];if(void 0!==c)return c.exports;var f=r[e]={id:e,loaded:!1,exports:{}};return d[e].call(f.exports,f,f.exports,n),f.loaded=!0,f.exports}n.m=d,n.c=r,e=[],n.O=function(c,f,a,t){if(!f){var d=1/0;for(u=0;u=t)&&Object.keys(n.O).every((function(e){return n.O[e](f[b])}))?f.splice(b--,1):(r=!1,t0&&e[u-1][2]>t;u--)e[u]=e[u-1];e[u]=[f,a,t]},n.n=function(e){var c=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(c,{a:c}),c},f=Object.getPrototypeOf?function(e){return Object.getPrototypeOf(e)}:function(e){return e.__proto__},n.t=function(e,a){if(1&a&&(e=this(e)),8&a)return e;if("object"==typeof e&&e){if(4&a&&e.__esModule)return e;if(16&a&&"function"==typeof e.then)return e}var t=Object.create(null);n.r(t);var d={};c=c||[null,f({}),f([]),f(f)];for(var r=2&a&&e;"object"==typeof r&&!~c.indexOf(r);r=f(r))Object.getOwnPropertyNames(r).forEach((function(c){d[c]=function(){return e[c]}}));return d.default=function(){return e},n.d(t,d),t},n.d=function(e,c){for(var f in c)n.o(c,f)&&!n.o(e,f)&&Object.defineProperty(e,f,{enumerable:!0,get:c[f]})},n.f={},n.e=function(e){return Promise.all(Object.keys(n.f).reduce((function(c,f){return n.f[f](e,c),c}),[]))},n.u=function(e){return"assets/js/"+({53:"935f2afb",74:"4ae90ba0",268:"9c6b37b9",507:"8f68f251",707:"76aee1e9",811:"e8c74efb",1351:"7dcecc8d",1365:"b9702c11",1487:"adcdd4d2",1558:"efec474a",1898:"1999cd7b",2098:"92147208",2114:"6f497b56",2158:"35234f08",2260:"d4a2a59c",2439:"cd4a49c1",2506:"03a491a5",2593:"300a9996",2598:"5a047177",2608:"9ac82b89",2822:"94285305",2844:"f3976560",2871:"a37c03cb",2960:"d319f4c2",3085:"1f391b9e",3217:"3b8c55ea",3291:"230aeb34",3358:"be200c4b",3608:"9e4087bc",3782:"a1bbfb14",3843:"ecc333f0",3938:"65a49553",4024:"f8ffbaca",4042:"08659987",4189:"3def9002",4431:"001ca130",4472:"f4c9d322",4998:"7b04b1d5",5144:"1737cda1",5322:"00691219",5410:"9b9cfcc1",5437:"f98fc388",5597:"5dfb0b41",5626:"452b66d6",5679:"4922efd5",5809:"f5afe1a5",5845:"243cbd97",5874:"ea7cbf6d",5995:"cecf159a",6042:"fb908f49",6119:"efc9be4b",6482:"7874e99f",6760:"0721a2c0",7165:"3b8e2d60",7240:"0f425520",7250:"41de83de",7356:"64f5dfca",7401:"63d69a63",7559:"d8b74189",7595:"42326c77",7826:"f5839aac",7918:"17896441",8249:"585bdad0",8338:"de718920",8447:"ade45c9a",8500:"acde588d",8555:"cbc8963c",8583:"9f61b932",8724:"edfc6e1b",8873:"b89e1cb0",8967:"3fa022c7",9267:"357fe94d",9464:"674dcd29",9512:"a991188b",9514:"1be78505",9692:"2c77072c",9890:"8c826f25"}[e]||e)+"."+{53:"4a3f1d92",74:"1b7f95b8",268:"1a4d8f2a",507:"7e096a77",707:"198d514c",811:"6f3ea057",1351:"02aac3e1",1365:"f7fe4bdb",1487:"f89f4cb4",1558:"bccec428",1898:"67af2e9d",2098:"93096b74",2114:"d1fafb1d",2158:"75b00d70",2260:"41f1390f",2439:"d290876f",2506:"e2cd0143",2593:"f753e41d",2598:"1f48e99a",2608:"844c4c60",2822:"1f5fc964",2844:"2cb9bfe2",2871:"4fbaf920",2960:"aa47a8c1",3085:"e29f8c90",3217:"79e5ef17",3291:"9e93a797",3358:"0994fc5b",3608:"fcc33365",3782:"191e1df5",3843:"f0614c4d",3938:"8f91bc1a",4024:"7dab5eab",4042:"7dcc30c9",4189:"0566d6b8",4431:"df12b21c",4472:"114701fa",4608:"2c7b7ade",4998:"d117d167",5144:"3fa3c755",5322:"1534c076",5410:"37c53500",5437:"3b0c1664",5597:"9e45482d",5626:"afac7ad4",5679:"a555c365",5809:"8c2bc2da",5845:"547fc342",5874:"7aaa7faa",5897:"ca6e53fd",5995:"90b73e88",6042:"120ce48b",6119:"904748ed",6482:"ffe18382",6760:"ffdc7189",7165:"7229dec3",7240:"2e900a3e",7250:"41ba64ac",7356:"7aecfa1a",7401:"bbcebc27",7559:"4b70dd77",7595:"8e971b20",7826:"b034b05a",7918:"b571fd1c",8249:"dbf4b31b",8338:"cd0c4637",8447:"fb2dab7b",8500:"750d9fa4",8555:"4522119e",8583:"b7164f76",8724:"25fb710b",8873:"d176f819",8967:"d245265c",9267:"c84c0f72",9464:"385786f5",9512:"d0024de2",9514:"7b2cd06e",9692:"e9ddc94f",9890:"e65a6b95"}[e]+".js"},n.miniCssF=function(e){return"assets/css/styles.19258e03.css"},n.g=function(){if("object"==typeof globalThis)return globalThis;try{return this||new Function("return this")()}catch(e){if("object"==typeof window)return window}}(),n.o=function(e,c){return Object.prototype.hasOwnProperty.call(e,c)},a={},t="docusaurus:",n.l=function(e,c,f,d){if(a[e])a[e].push(c);else{var r,b;if(void 0!==f)for(var o=document.getElementsByTagName("script"),u=0;u=t)&&Object.keys(d.O).every((function(e){return d.O[e](f[b])}))?f.splice(b--,1):(n=!1,t0&&e[u-1][2]>t;u--)e[u]=e[u-1];e[u]=[f,a,t]},d.n=function(e){var c=e&&e.__esModule?function(){return e.default}:function(){return e};return d.d(c,{a:c}),c},f=Object.getPrototypeOf?function(e){return Object.getPrototypeOf(e)}:function(e){return e.__proto__},d.t=function(e,a){if(1&a&&(e=this(e)),8&a)return e;if("object"==typeof e&&e){if(4&a&&e.__esModule)return e;if(16&a&&"function"==typeof e.then)return e}var t=Object.create(null);d.r(t);var r={};c=c||[null,f({}),f([]),f(f)];for(var n=2&a&&e;"object"==typeof n&&!~c.indexOf(n);n=f(n))Object.getOwnPropertyNames(n).forEach((function(c){r[c]=function(){return e[c]}}));return r.default=function(){return e},d.d(t,r),t},d.d=function(e,c){for(var f in c)d.o(c,f)&&!d.o(e,f)&&Object.defineProperty(e,f,{enumerable:!0,get:c[f]})},d.f={},d.e=function(e){return Promise.all(Object.keys(d.f).reduce((function(c,f){return d.f[f](e,c),c}),[]))},d.u=function(e){return"assets/js/"+({53:"935f2afb",74:"4ae90ba0",268:"9c6b37b9",507:"8f68f251",707:"76aee1e9",811:"e8c74efb",1351:"7dcecc8d",1365:"b9702c11",1487:"adcdd4d2",1558:"efec474a",1898:"1999cd7b",2098:"92147208",2114:"6f497b56",2158:"35234f08",2260:"d4a2a59c",2439:"cd4a49c1",2506:"03a491a5",2593:"300a9996",2598:"5a047177",2608:"9ac82b89",2822:"94285305",2844:"f3976560",2871:"a37c03cb",2960:"d319f4c2",3085:"1f391b9e",3217:"3b8c55ea",3291:"230aeb34",3358:"be200c4b",3608:"9e4087bc",3782:"a1bbfb14",3843:"ecc333f0",3938:"65a49553",4024:"f8ffbaca",4042:"08659987",4189:"3def9002",4431:"001ca130",4472:"f4c9d322",4998:"7b04b1d5",5144:"1737cda1",5322:"00691219",5410:"9b9cfcc1",5437:"f98fc388",5597:"5dfb0b41",5626:"452b66d6",5679:"4922efd5",5809:"f5afe1a5",5845:"243cbd97",5874:"ea7cbf6d",5995:"cecf159a",6042:"fb908f49",6119:"efc9be4b",6482:"7874e99f",6760:"0721a2c0",7165:"3b8e2d60",7240:"0f425520",7250:"41de83de",7356:"64f5dfca",7401:"63d69a63",7559:"d8b74189",7595:"42326c77",7826:"f5839aac",7918:"17896441",8249:"585bdad0",8338:"de718920",8447:"ade45c9a",8500:"acde588d",8555:"cbc8963c",8583:"9f61b932",8724:"edfc6e1b",8873:"b89e1cb0",8967:"3fa022c7",9267:"357fe94d",9464:"674dcd29",9512:"a991188b",9514:"1be78505",9692:"2c77072c",9890:"8c826f25"}[e]||e)+"."+{53:"4a3f1d92",74:"1b7f95b8",268:"1a4d8f2a",507:"7e096a77",707:"198d514c",811:"6f3ea057",1351:"02aac3e1",1365:"f7fe4bdb",1487:"f89f4cb4",1558:"bccec428",1898:"67af2e9d",2098:"93096b74",2114:"d1fafb1d",2158:"75b00d70",2260:"41f1390f",2439:"d290876f",2506:"e2cd0143",2593:"f753e41d",2598:"1f48e99a",2608:"844c4c60",2822:"1f5fc964",2844:"2cb9bfe2",2871:"4fbaf920",2960:"aa47a8c1",3085:"e29f8c90",3217:"79e5ef17",3291:"9e93a797",3358:"0994fc5b",3608:"fcc33365",3782:"191e1df5",3843:"f0614c4d",3938:"8f91bc1a",4024:"7dab5eab",4042:"7dcc30c9",4189:"0566d6b8",4431:"df12b21c",4472:"114701fa",4608:"2c7b7ade",4998:"d117d167",5144:"3fa3c755",5322:"1534c076",5410:"37c53500",5437:"3b0c1664",5597:"9e45482d",5626:"afac7ad4",5679:"a555c365",5809:"8c2bc2da",5845:"547fc342",5874:"7aaa7faa",5897:"ca6e53fd",5995:"90b73e88",6042:"120ce48b",6119:"904748ed",6482:"ffe18382",6760:"ffdc7189",7165:"7229dec3",7240:"2e900a3e",7250:"41ba64ac",7356:"7aecfa1a",7401:"bbcebc27",7559:"4b70dd77",7595:"8e971b20",7826:"b034b05a",7918:"b571fd1c",8249:"dbf4b31b",8338:"cd0c4637",8447:"fb2dab7b",8500:"750d9fa4",8555:"4522119e",8583:"b7164f76",8724:"25fb710b",8873:"d176f819",8967:"d245265c",9267:"89fabb9f",9464:"385786f5",9512:"d0024de2",9514:"7b2cd06e",9692:"e9ddc94f",9890:"e65a6b95"}[e]+".js"},d.miniCssF=function(e){return"assets/css/styles.19258e03.css"},d.g=function(){if("object"==typeof globalThis)return globalThis;try{return this||new Function("return this")()}catch(e){if("object"==typeof window)return window}}(),d.o=function(e,c){return Object.prototype.hasOwnProperty.call(e,c)},a={},t="docusaurus:",d.l=function(e,c,f,r){if(a[e])a[e].push(c);else{var n,b;if(void 0!==f)for(var o=document.getElementsByTagName("script"),u=0;u Archive | OAuth2 Proxy - +

Archive

Archive

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/6.1.x/behaviour/index.html b/docs/6.1.x/behaviour/index.html index 386f4a87..018240f3 100644 --- a/docs/6.1.x/behaviour/index.html +++ b/docs/6.1.x/behaviour/index.html @@ -5,13 +5,13 @@ Behaviour | OAuth2 Proxy - +
Version: 6.1.x

Behaviour

  1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).
  2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with Accept: application/json, in which case 401 Unauthorized is returned)
  3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
  4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)

Notice that the proxy also provides a number of useful endpoints.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/6.1.x/community/security/index.html b/docs/6.1.x/community/security/index.html index 833a8318..ae4498d3 100644 --- a/docs/6.1.x/community/security/index.html +++ b/docs/6.1.x/community/security/index.html @@ -5,7 +5,7 @@ Security | OAuth2 Proxy - + @@ -29,7 +29,7 @@ If we have multiple security issues in flight simultaneously, we may delay merging fixes until all patches are ready. We may also backport the fix to previous releases, but this will be at the discretion of the maintainers.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/6.1.x/configuration/oauth_provider/index.html b/docs/6.1.x/configuration/oauth_provider/index.html index 3fc7c28f..0ab84bf1 100644 --- a/docs/6.1.x/configuration/oauth_provider/index.html +++ b/docs/6.1.x/configuration/oauth_provider/index.html @@ -5,7 +5,7 @@ OAuth Provider Configuration | OAuth2 Proxy - + @@ -46,7 +46,7 @@ to setup the client id and client secret. Your "Redirection URI" will Provider instance. Add a new case to providers.New() to allow oauth2-proxy to use the new Provider.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/6.1.x/configuration/overview/index.html b/docs/6.1.x/configuration/overview/index.html index 83f5ba7b..0a54f99d 100644 --- a/docs/6.1.x/configuration/overview/index.html +++ b/docs/6.1.x/configuration/overview/index.html @@ -5,7 +5,7 @@ Overview | OAuth2 Proxy - + @@ -20,7 +20,7 @@ The default format is configured as follows:

{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}

Available variables for request logging:

VariableExampleDescription
Client74.125.224.72The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.
Hostdomain.comThe value of the Host header.
ProtocolHTTP/1.0The request protocol.
RequestDuration0.001The time in seconds that a request took to process.
RequestMethodGETThe request method.
RequestURI"/oauth2/auth"The URI path of the request.
ResponseSize12The size in bytes of the response.
StatusCode200The HTTP status code of the response.
Timestamp19/Mar/2015:17:20:19 -0400The date and time of the logging event.
Upstream-The upstream data of the HTTP request.
UserAgent-The full user agent as reported by the requesting client.
Usernameusername@email.comThe email or username of the auth request.

Standard Log Format​

All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:

[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE>

If you require a different format than that, you can configure it with the --standard-logging-format flag. The default format is configured as follows:

[{{.Timestamp}}] [{{.File}}] {{.Message}}

Available variables for standard logging:

VariableExampleDescription
Timestamp19/Mar/2015:17:20:19 -0400The date and time of the logging event.
Filemain.go:40The file and line number of the logging statement.
MessageHTTP: listening on 127.0.0.1:4180The details of the log statement.

Configuring for use with the Nginx auth_request directive​

The Nginx auth_request directive allows Nginx to authenticate requests via the oauth2-proxy's /auth endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:

server {
  listen 443 ssl;
  server_name ...;
  include ssl/ssl.conf;

  location /oauth2/ {
    proxy_pass       http://127.0.0.1:4180;
    proxy_set_header Host                    $host;
    proxy_set_header X-Real-IP               $remote_addr;
    proxy_set_header X-Scheme                $scheme;
    proxy_set_header X-Auth-Request-Redirect $request_uri;
    # or, if you are handling multiple domains:
    # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
  }
  location = /oauth2/auth {
    proxy_pass       http://127.0.0.1:4180;
    proxy_set_header Host             $host;
    proxy_set_header X-Real-IP        $remote_addr;
    proxy_set_header X-Scheme         $scheme;
    # nginx auth_request includes headers but not body
    proxy_set_header Content-Length   "";
    proxy_pass_request_body           off;
  }

  location / {
    auth_request /oauth2/auth;
    error_page 401 = /oauth2/sign_in;

    # pass information via X-User and X-Email headers to backend,
    # requires running with --set-xauthrequest flag
    auth_request_set $user   $upstream_http_x_auth_request_user;
    auth_request_set $email  $upstream_http_x_auth_request_email;
    proxy_set_header X-User  $user;
    proxy_set_header X-Email $email;

    # if you enabled --pass-access-token, this will pass the token to the backend
    auth_request_set $token  $upstream_http_x_auth_request_access_token;
    proxy_set_header X-Access-Token $token;

    # if you enabled --cookie-refresh, this is needed for it to work with auth_request
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;

    # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
    # limit and so the OAuth2 Proxy splits these into multiple parts.
    # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
    # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
    auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;

    # Extract the Cookie attributes from the first Set-Cookie header and append them
    # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
    if ($auth_cookie ~* "(; .*)") {
        set $auth_cookie_name_0 $auth_cookie;
        set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
    }

    # Send both Set-Cookie headers now if there was a second part
    if ($auth_cookie_name_upstream_1) {
        add_header Set-Cookie $auth_cookie_name_0;
        add_header Set-Cookie $auth_cookie_name_1;
    }

    proxy_pass http://backend/;
    # or "root /path/to/site;" or "fastcgi_pass ..." etc
  }
}

When you use ingress-nginx in Kubernetes, you MUST use kubernetes/ingress-nginx (which includes the Lua module) and the following configuration snippet for your Ingress. Variables set with auth_request_set are not set-able in plain nginx config when the location is processed via proxy_pass and then may only be processed by Lua. Note that nginxinc/kubernetes-ingress does not include the Lua module.

nginx.ingress.kubernetes.io/auth-response-headers: Authorization
nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
nginx.ingress.kubernetes.io/configuration-snippet: |
  auth_request_set $name_upstream_1 $upstream_cookie_name_1;

  access_by_lua_block {
    if ngx.var.name_upstream_1 ~= "" then
      ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")
    end
  }

It is recommended to use --session-store-type=redis when expecting large sessions/OIDC tokens (e.g. with MS Azure).

You have to substitute name with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".

note

If you set up your OAuth2 provider to rotate your client secret, you can use the client-secret-file option to reload the secret when it is updated.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/6.1.x/configuration/session_storage/index.html b/docs/6.1.x/configuration/session_storage/index.html index ac4362cf..e32b11a5 100644 --- a/docs/6.1.x/configuration/session_storage/index.html +++ b/docs/6.1.x/configuration/session_storage/index.html @@ -5,7 +5,7 @@ Session Storage | OAuth2 Proxy - + @@ -26,7 +26,7 @@ disclosure.

Usage--redis-use-sentinel=true flag, as well as configure the flags --redis-sentinel-master-name and --redis-sentinel-connection-urls appropriately.

Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the --redis-use-cluster=true flag, and configure the flags --redis-cluster-connection-urls appropriately.

Note that flags --redis-use-sentinel=true and --redis-use-cluster=true are mutually exclusive.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/6.1.x/configuration/tls/index.html b/docs/6.1.x/configuration/tls/index.html index 26d29ebe..13a82ed4 100644 --- a/docs/6.1.x/configuration/tls/index.html +++ b/docs/6.1.x/configuration/tls/index.html @@ -5,7 +5,7 @@ TLS Configuration | OAuth2 Proxy - + @@ -16,7 +16,7 @@ external load balancer like Amazon ELB or Google Platform Load Balancing) use oauth2-proxy will then authenticate requests for an upstream application. The external endpoint for this example would be https://internal.yourcompany.com/.

An example Nginx config follows. Note the use of Strict-Transport-Security header to pin requests to SSL via HSTS:

server {
    listen 443 default ssl;
    server_name internal.yourcompany.com;
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/cert.key;
    add_header Strict-Transport-Security max-age=2592000;

    location / {
        proxy_pass http://127.0.0.1:4180;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Scheme $scheme;
        proxy_connect_timeout 1;
        proxy_send_timeout 30;
        proxy_read_timeout 30;
    }
}

The command line to run oauth2-proxy in this configuration would look like this:

./oauth2-proxy \
   --email-domain="yourcompany.com"  \
   --upstream=http://127.0.0.1:8080/ \
   --cookie-secret=... \
   --cookie-secure=true \
   --provider=... \
   --reverse-proxy=true \
   --client-id=... \
   --client-secret=...
Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/6.1.x/features/endpoints/index.html b/docs/6.1.x/features/endpoints/index.html index f534e288..e6783d54 100644 --- a/docs/6.1.x/features/endpoints/index.html +++ b/docs/6.1.x/features/endpoints/index.html @@ -5,13 +5,13 @@ Endpoints | OAuth2 Proxy - +
Version: 6.1.x

Endpoints

OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.

  • /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see robotstxt.org for more info
  • /ping - returns a 200 OK response, which is intended for use with health checks
  • /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
  • /oauth2/sign_out - this URL is used to clear the session cookie
  • /oauth2/start - a URL that will redirect to start the OAuth cycle
  • /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
  • /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
  • /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the Nginx auth_request directive

Sign out​

To sign the user out, redirect them to /oauth2/sign_out. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the rd query parameter, i.e. redirect the user to something like (notice the url-encoding!):

/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page

Alternatively, include the redirect URL in the X-Auth-Request-Redirect header:

GET /oauth2/sign_out HTTP/1.1
X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
...

(The "sign_out_page" should be the end_session_endpoint from the metadata if your OIDC provider supports Session Management and Discovery.)

BEWARE that the domain you want to redirect to (my-oidc-provider.example.com in the example) must be added to the --whitelist-domain configuration option otherwise the redirect will be ignored.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/6.1.x/features/request_signatures/index.html b/docs/6.1.x/features/request_signatures/index.html index 654c55a7..b1a2d7a3 100644 --- a/docs/6.1.x/features/request_signatures/index.html +++ b/docs/6.1.x/features/request_signatures/index.html @@ -5,7 +5,7 @@ Request Signatures | OAuth2 Proxy - + @@ -18,7 +18,7 @@ in oauthproxy.go.

signature_key must be of t following:

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/6.1.x/index.html b/docs/6.1.x/index.html index da9d141a..ef21882d 100644 --- a/docs/6.1.x/index.html +++ b/docs/6.1.x/index.html @@ -5,13 +5,13 @@ Installation | OAuth2 Proxy - +
Version: 6.1.x

Installation

  1. Choose how to deploy:

    a. Download Prebuilt Binary (current release is v6.1.1)

    b. Build with $ go get github.com/oauth2-proxy/oauth2-proxy which will put the binary in $GOPATH/bin

    c. Using the prebuilt docker image quay.io/oauth2-proxy/oauth2-proxy (AMD64, ARMv6 and ARM64 tags available)

Prebuilt binaries can be validated by extracting the file and verifying it against the sha256sum.txt checksum file provided for each release starting with version v3.0.0.

$ sha256sum -c sha256sum.txt 2>&1 | grep OK
oauth2-proxy-x.y.z.linux-amd64: OK
  1. Select a Provider and Register an OAuth Application with a Provider
  2. Configure OAuth2 Proxy using config file, command line options, or environment variables
  3. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.0.x/behaviour/index.html b/docs/7.0.x/behaviour/index.html index 66f05f04..742c7577 100644 --- a/docs/7.0.x/behaviour/index.html +++ b/docs/7.0.x/behaviour/index.html @@ -5,13 +5,13 @@ Behaviour | OAuth2 Proxy - +
Version: 7.0.x

Behaviour

  1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).
  2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with Accept: application/json, in which case 401 Unauthorized is returned)
  3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
  4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)

Notice that the proxy also provides a number of useful endpoints.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.0.x/community/security/index.html b/docs/7.0.x/community/security/index.html index 4f23216f..60675f12 100644 --- a/docs/7.0.x/community/security/index.html +++ b/docs/7.0.x/community/security/index.html @@ -5,7 +5,7 @@ Security | OAuth2 Proxy - + @@ -29,7 +29,7 @@ If we have multiple security issues in flight simultaneously, we may delay merging fixes until all patches are ready. We may also backport the fix to previous releases, but this will be at the discretion of the maintainers.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.0.x/configuration/alpha-config/index.html b/docs/7.0.x/configuration/alpha-config/index.html index bf02c42a..c201e7c2 100644 --- a/docs/7.0.x/configuration/alpha-config/index.html +++ b/docs/7.0.x/configuration/alpha-config/index.html @@ -5,7 +5,7 @@ Alpha Configuration | OAuth2 Proxy - + @@ -35,7 +35,7 @@ response header.

FieldTypeDescription make up the header value

FieldTypeDescription
value[]byteValue expects a base64 encoded string value.
fromEnvstringFromEnv expects the name of an environment variable.
fromFilestringFromFile expects a path to a file containing the secret value.
claimstringClaim is the name of the claim in the session that the value should be
loaded from.
prefixstringPrefix is an optional prefix that will be prepended to the value of the
claim if it is non-empty.
basicAuthPasswordSecretSourceBasicAuthPassword converts this claim into a basic auth header.
Note the value of claim will become the basic auth username and the
basicAuthPassword will be used as the password value.

SecretSource​

(Appears on: ClaimSource, HeaderValue)

SecretSource references an individual secret value. Only one source within the struct should be defined at any time.

FieldTypeDescription
value[]byteValue expects a base64 encoded string value.
fromEnvstringFromEnv expects the name of an environment variable.
fromFilestringFromFile expects a path to a file containing the secret value.

Upstream​

(Appears on: Upstreams)

Upstream represents the configuration for an upstream server. Requests will be proxied to this upstream if the path matches the request path.

FieldTypeDescription
idstringID should be a unique identifier for the upstream.
This value is required for all upstreams.
pathstringPath is used to map requests to the upstream server.
The closest match will take precedence and all Paths must be unique.
uristringThe URI of the upstream server. This may be an HTTP(S) server of a File
based URL. It may include a path, in which case all requests will be served
under that path.
Eg:
- http://localhost:8080
- https://service.localhost
- https://service.localhost/path
- file://host/path
If the URI's path is "/base" and the incoming request was for "/dir",
the upstream request will be for "/base/dir".
insecureSkipTLSVerifyboolInsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.
This option is insecure and will allow potential Man-In-The-Middle attacks
betweem OAuth2 Proxy and the usptream server.
Defaults to false.
staticboolStatic will make all requests to this upstream have a static response.
The response will have a body of "Authenticated" and a response code
matching StaticCode.
If StaticCode is not set, the response will return a 200 response.
staticCodeintStaticCode determines the response code for the Static response.
This option can only be used with Static enabled.
flushIntervalDurationFlushInterval is the period between flushing the response buffer when
streaming response from the upstream.
Defaults to 1 second.
passHostHeaderboolPassHostHeader determines whether the request host header should be proxied
to the upstream server.
Defaults to true.
proxyWebSocketsboolProxyWebSockets enables proxying of websockets to upstream servers
Defaults to true.

Upstreams​

([]Upstream alias)​

(Appears on: AlphaOptions)

Upstreams is a collection of definitions for upstream servers.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.0.x/configuration/oauth_provider/index.html b/docs/7.0.x/configuration/oauth_provider/index.html index cb0f806e..51d2aa85 100644 --- a/docs/7.0.x/configuration/oauth_provider/index.html +++ b/docs/7.0.x/configuration/oauth_provider/index.html @@ -5,7 +5,7 @@ OAuth Provider Configuration | OAuth2 Proxy - + @@ -50,7 +50,7 @@ to setup the client id and client secret. Your "Redirection URI" will Provider instance. Add a new case to providers.New() to allow oauth2-proxy to use the new Provider.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.0.x/configuration/overview/index.html b/docs/7.0.x/configuration/overview/index.html index ddffe8e5..c39133d0 100644 --- a/docs/7.0.x/configuration/overview/index.html +++ b/docs/7.0.x/configuration/overview/index.html @@ -5,7 +5,7 @@ Overview | OAuth2 Proxy - + @@ -20,7 +20,7 @@ The default format is configured as follows:

{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}

Available variables for request logging:

VariableExampleDescription
Client74.125.224.72The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.
Hostdomain.comThe value of the Host header.
ProtocolHTTP/1.0The request protocol.
RequestDuration0.001The time in seconds that a request took to process.
RequestMethodGETThe request method.
RequestURI"/oauth2/auth"The URI path of the request.
ResponseSize12The size in bytes of the response.
StatusCode200The HTTP status code of the response.
Timestamp19/Mar/2015:17:20:19 -0400The date and time of the logging event.
Upstream-The upstream data of the HTTP request.
UserAgent-The full user agent as reported by the requesting client.
Usernameusername@email.comThe email or username of the auth request.

Standard Log Format​

All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:

[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE>

If you require a different format than that, you can configure it with the --standard-logging-format flag. The default format is configured as follows:

[{{.Timestamp}}] [{{.File}}] {{.Message}}

Available variables for standard logging:

VariableExampleDescription
Timestamp19/Mar/2015:17:20:19 -0400The date and time of the logging event.
Filemain.go:40The file and line number of the logging statement.
MessageHTTP: listening on 127.0.0.1:4180The details of the log statement.

Configuring for use with the Nginx auth_request directive​

The Nginx auth_request directive allows Nginx to authenticate requests via the oauth2-proxy's /auth endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:

server {
  listen 443 ssl;
  server_name ...;
  include ssl/ssl.conf;

  location /oauth2/ {
    proxy_pass       http://127.0.0.1:4180;
    proxy_set_header Host                    $host;
    proxy_set_header X-Real-IP               $remote_addr;
    proxy_set_header X-Scheme                $scheme;
    proxy_set_header X-Auth-Request-Redirect $request_uri;
    # or, if you are handling multiple domains:
    # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
  }
  location = /oauth2/auth {
    proxy_pass       http://127.0.0.1:4180;
    proxy_set_header Host             $host;
    proxy_set_header X-Real-IP        $remote_addr;
    proxy_set_header X-Scheme         $scheme;
    # nginx auth_request includes headers but not body
    proxy_set_header Content-Length   "";
    proxy_pass_request_body           off;
  }

  location / {
    auth_request /oauth2/auth;
    error_page 401 = /oauth2/sign_in;

    # pass information via X-User and X-Email headers to backend,
    # requires running with --set-xauthrequest flag
    auth_request_set $user   $upstream_http_x_auth_request_user;
    auth_request_set $email  $upstream_http_x_auth_request_email;
    proxy_set_header X-User  $user;
    proxy_set_header X-Email $email;

    # if you enabled --pass-access-token, this will pass the token to the backend
    auth_request_set $token  $upstream_http_x_auth_request_access_token;
    proxy_set_header X-Access-Token $token;

    # if you enabled --cookie-refresh, this is needed for it to work with auth_request
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;

    # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
    # limit and so the OAuth2 Proxy splits these into multiple parts.
    # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
    # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
    auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;

    # Extract the Cookie attributes from the first Set-Cookie header and append them
    # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
    if ($auth_cookie ~* "(; .*)") {
        set $auth_cookie_name_0 $auth_cookie;
        set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
    }

    # Send both Set-Cookie headers now if there was a second part
    if ($auth_cookie_name_upstream_1) {
        add_header Set-Cookie $auth_cookie_name_0;
        add_header Set-Cookie $auth_cookie_name_1;
    }

    proxy_pass http://backend/;
    # or "root /path/to/site;" or "fastcgi_pass ..." etc
  }
}

When you use ingress-nginx in Kubernetes, you MUST use kubernetes/ingress-nginx (which includes the Lua module) and the following configuration snippet for your Ingress. Variables set with auth_request_set are not set-able in plain nginx config when the location is processed via proxy_pass and then may only be processed by Lua. Note that nginxinc/kubernetes-ingress does not include the Lua module.

nginx.ingress.kubernetes.io/auth-response-headers: Authorization
nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
nginx.ingress.kubernetes.io/configuration-snippet: |
  auth_request_set $name_upstream_1 $upstream_cookie_name_1;

  access_by_lua_block {
    if ngx.var.name_upstream_1 ~= "" then
      ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")
    end
  }

It is recommended to use --session-store-type=redis when expecting large sessions/OIDC tokens (e.g. with MS Azure).

You have to substitute name with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".

Configuring for use with the Traefik (v2) ForwardAuth middleware​

This option requires --reverse-proxy option to be set.

ForwardAuth with 401 errors middleware​

The Traefik v2 ForwardAuth middleware allows Traefik to authenticate requests via the oauth2-proxy's /oauth2/auth endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:

http:
  routers:
    a-service:
      rule: "Host(`a-service.example.com`)"
      service: a-service-backend
      middlewares:
        - oauth-errors
        - oauth-auth
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"
    oauth:
      rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"
      middlewares:
        - auth-headers
      service: oauth-backend
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"

  services:
    a-service-backend:
      loadBalancer:
        servers:
          - url: http://172.16.0.2:7555
    oauth-backend:
      loadBalancer:
        servers:
          - url: http://172.16.0.1:4180

  middlewares:
    auth-headers:
      headers:
        sslRedirect: true
        stsSeconds: 315360000
        browserXssFilter: true
        contentTypeNosniff: true
        forceSTSHeader: true
        sslHost: example.com
        stsIncludeSubdomains: true
        stsPreload: true
        frameDeny: true
    oauth-auth:
      forwardAuth:
        address: https://oauth.example.com/oauth2/auth
        trustForwardHeader: true
    oauth-errors:
      errors:
        status:
          - "401-403"
        service: oauth-backend
        query: "/oauth2/sign_in"

ForwardAuth with static upstreams configuration​

Redirect to sign_in functionality provided without the use of errors middleware with Traefik v2 ForwardAuth middleware pointing to oauth2-proxy service's / endpoint

Following options need to be set on oauth2-proxy:

  • --upstream=static://202: Configures a static response for authenticated sessions
  • --reverseproxy=true: Enables the use of X-Forwarded-* headers to determine redirects correctly
http:
  routers:
    a-service-route-1:
      rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"
      service: a-service-backend
      middlewares:
        - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"
    a-service-route-2:
      rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"
      service: a-service-backend
      middlewares:
        - oauth-auth-wo-redirect # unauthenticated session will return a 401
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"
    services-oauth2-route:
      rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"
      middlewares:
        - auth-headers
      service: oauth-backend
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"
    oauth2-proxy-route:
      rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"
      middlewares:
        - auth-headers
      service: oauth-backend
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"

  services:
    a-service-backend:
      loadBalancer:
        servers:
          - url: http://172.16.0.2:7555
    b-service-backend:
      loadBalancer:
        servers:
          - url: http://172.16.0.3:7555
    oauth-backend:
      loadBalancer:
        servers:
          - url: http://172.16.0.1:4180

  middlewares:
    auth-headers:
      headers:
        sslRedirect: true
        stsSeconds: 315360000
        browserXssFilter: true
        contentTypeNosniff: true
        forceSTSHeader: true
        sslHost: example.com
        stsIncludeSubdomains: true
        stsPreload: true
        frameDeny: true
    oauth-auth-redirect:
      forwardAuth:
        address: https://oauth.example.com/
        trustForwardHeader: true
        authResponseHeaders:
          - X-Auth-Request-Access-Token
          - Authorization
    oauth-auth-wo-redirect:
      forwardAuth:
        address: https://oauth.example.com/oauth2/auth
        trustForwardHeader: true
        authResponseHeaders:
          - X-Auth-Request-Access-Token
          - Authorization
note

If you set up your OAuth2 provider to rotate your client secret, you can use the client-secret-file option to reload the secret when it is updated.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.0.x/configuration/session_storage/index.html b/docs/7.0.x/configuration/session_storage/index.html index 8864624b..672783ca 100644 --- a/docs/7.0.x/configuration/session_storage/index.html +++ b/docs/7.0.x/configuration/session_storage/index.html @@ -5,7 +5,7 @@ Session Storage | OAuth2 Proxy - + @@ -26,7 +26,7 @@ disclosure.

Usage--redis-use-sentinel=true flag, as well as configure the flags --redis-sentinel-master-name and --redis-sentinel-connection-urls appropriately.

Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the --redis-use-cluster=true flag, and configure the flags --redis-cluster-connection-urls appropriately.

Note that flags --redis-use-sentinel=true and --redis-use-cluster=true are mutually exclusive.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.0.x/configuration/tls/index.html b/docs/7.0.x/configuration/tls/index.html index c6d989ec..9b63e2d3 100644 --- a/docs/7.0.x/configuration/tls/index.html +++ b/docs/7.0.x/configuration/tls/index.html @@ -5,7 +5,7 @@ TLS Configuration | OAuth2 Proxy - + @@ -16,7 +16,7 @@ external load balancer like Amazon ELB or Google Platform Load Balancing) use oauth2-proxy will then authenticate requests for an upstream application. The external endpoint for this example would be https://internal.yourcompany.com/.

An example Nginx config follows. Note the use of Strict-Transport-Security header to pin requests to SSL via HSTS:

server {
    listen 443 default ssl;
    server_name internal.yourcompany.com;
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/cert.key;
    add_header Strict-Transport-Security max-age=2592000;

    location / {
        proxy_pass http://127.0.0.1:4180;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Scheme $scheme;
        proxy_connect_timeout 1;
        proxy_send_timeout 30;
        proxy_read_timeout 30;
    }
}

The command line to run oauth2-proxy in this configuration would look like this:

./oauth2-proxy \
   --email-domain="yourcompany.com"  \
   --upstream=http://127.0.0.1:8080/ \
   --cookie-secret=... \
   --cookie-secure=true \
   --provider=... \
   --reverse-proxy=true \
   --client-id=... \
   --client-secret=...
Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.0.x/features/endpoints/index.html b/docs/7.0.x/features/endpoints/index.html index 2c3b4c8e..28b3c9ad 100644 --- a/docs/7.0.x/features/endpoints/index.html +++ b/docs/7.0.x/features/endpoints/index.html @@ -5,13 +5,13 @@ Endpoints | OAuth2 Proxy - +
Version: 7.0.x

Endpoints

OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.

  • /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see robotstxt.org for more info
  • /ping - returns a 200 OK response, which is intended for use with health checks
  • /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
  • /oauth2/sign_out - this URL is used to clear the session cookie
  • /oauth2/start - a URL that will redirect to start the OAuth cycle
  • /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
  • /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
  • /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the Nginx auth_request directive

Sign out​

To sign the user out, redirect them to /oauth2/sign_out. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the rd query parameter, i.e. redirect the user to something like (notice the url-encoding!):

/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page

Alternatively, include the redirect URL in the X-Auth-Request-Redirect header:

GET /oauth2/sign_out HTTP/1.1
X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
...

(The "sign_out_page" should be the end_session_endpoint from the metadata if your OIDC provider supports Session Management and Discovery.)

BEWARE that the domain you want to redirect to (my-oidc-provider.example.com in the example) must be added to the --whitelist-domain configuration option otherwise the redirect will be ignored.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.0.x/features/request_signatures/index.html b/docs/7.0.x/features/request_signatures/index.html index 9be604ac..c3cb4537 100644 --- a/docs/7.0.x/features/request_signatures/index.html +++ b/docs/7.0.x/features/request_signatures/index.html @@ -5,7 +5,7 @@ Request Signatures | OAuth2 Proxy - + @@ -18,7 +18,7 @@ in oauthproxy.go.

signature_key must be of t following:

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.0.x/index.html b/docs/7.0.x/index.html index 6e4d72fe..f384648c 100644 --- a/docs/7.0.x/index.html +++ b/docs/7.0.x/index.html @@ -5,13 +5,13 @@ Installation | OAuth2 Proxy - +
Version: 7.0.x

Installation

  1. Choose how to deploy:

    a. Download Prebuilt Binary (current release is v7.0.1)

    b. Build with $ go get github.com/oauth2-proxy/oauth2-proxy/v7 which will put the binary in $GOPATH/bin

    c. Using the prebuilt docker image quay.io/oauth2-proxy/oauth2-proxy (AMD64, ARMv6 and ARM64 tags available)

Prebuilt binaries can be validated by extracting the file and verifying it against the sha256sum.txt checksum file provided for each release starting with version v3.0.0.

$ sha256sum -c sha256sum.txt 2>&1 | grep OK
oauth2-proxy-x.y.z.linux-amd64: OK
  1. Select a Provider and Register an OAuth Application with a Provider
  2. Configure OAuth2 Proxy using config file, command line options, or environment variables
  3. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.1.x/behaviour/index.html b/docs/7.1.x/behaviour/index.html index df51801e..ca691543 100644 --- a/docs/7.1.x/behaviour/index.html +++ b/docs/7.1.x/behaviour/index.html @@ -5,13 +5,13 @@ Behaviour | OAuth2 Proxy - +
Version: 7.1.x

Behaviour

  1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).
  2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with Accept: application/json, in which case 401 Unauthorized is returned)
  3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
  4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)

Notice that the proxy also provides a number of useful endpoints.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.1.x/community/security/index.html b/docs/7.1.x/community/security/index.html index 80610c99..9300b888 100644 --- a/docs/7.1.x/community/security/index.html +++ b/docs/7.1.x/community/security/index.html @@ -5,7 +5,7 @@ Security | OAuth2 Proxy - + @@ -29,7 +29,7 @@ If we have multiple security issues in flight simultaneously, we may delay merging fixes until all patches are ready. We may also backport the fix to previous releases, but this will be at the discretion of the maintainers.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.1.x/configuration/alpha-config/index.html b/docs/7.1.x/configuration/alpha-config/index.html index 561ec813..33844315 100644 --- a/docs/7.1.x/configuration/alpha-config/index.html +++ b/docs/7.1.x/configuration/alpha-config/index.html @@ -5,7 +5,7 @@ Alpha Configuration | OAuth2 Proxy - + @@ -35,7 +35,7 @@ response header.

FieldTypeDescription make up the header value

FieldTypeDescription
value[]byteValue expects a base64 encoded string value.
fromEnvstringFromEnv expects the name of an environment variable.
fromFilestringFromFile expects a path to a file containing the secret value.
claimstringClaim is the name of the claim in the session that the value should be
loaded from.
prefixstringPrefix is an optional prefix that will be prepended to the value of the
claim if it is non-empty.
basicAuthPasswordSecretSourceBasicAuthPassword converts this claim into a basic auth header.
Note the value of claim will become the basic auth username and the
basicAuthPassword will be used as the password value.

SecretSource​

(Appears on: ClaimSource, HeaderValue, TLS)

SecretSource references an individual secret value. Only one source within the struct should be defined at any time.

FieldTypeDescription
value[]byteValue expects a base64 encoded string value.
fromEnvstringFromEnv expects the name of an environment variable.
fromFilestringFromFile expects a path to a file containing the secret value.

Server​

(Appears on: AlphaOptions)

Server represents the configuration for an HTTP(S) server

FieldTypeDescription
BindAddressstringBindAddress is the address on which to serve traffic.
Leave blank or set to "-" to disable.
SecureBindAddressstringSecureBindAddress is the address on which to serve secure traffic.
Leave blank or set to "-" to disable.
TLSTLSTLS contains the information for loading the certificate and key for the
secure traffic.

TLS​

(Appears on: Server)

TLS contains the information for loading a TLS certifcate and key.

FieldTypeDescription
KeySecretSourceKey is the TLS key data to use.
Typically this will come from a file.
CertSecretSourceCert is the TLS certificate data to use.
Typically this will come from a file.

Upstream​

(Appears on: Upstreams)

Upstream represents the configuration for an upstream server. Requests will be proxied to this upstream if the path matches the request path.

FieldTypeDescription
idstringID should be a unique identifier for the upstream.
This value is required for all upstreams.
pathstringPath is used to map requests to the upstream server.
The closest match will take precedence and all Paths must be unique.
uristringThe URI of the upstream server. This may be an HTTP(S) server of a File
based URL. It may include a path, in which case all requests will be served
under that path.
Eg:
- http://localhost:8080
- https://service.localhost
- https://service.localhost/path
- file://host/path
If the URI's path is "/base" and the incoming request was for "/dir",
the upstream request will be for "/base/dir".
insecureSkipTLSVerifyboolInsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.
This option is insecure and will allow potential Man-In-The-Middle attacks
betweem OAuth2 Proxy and the usptream server.
Defaults to false.
staticboolStatic will make all requests to this upstream have a static response.
The response will have a body of "Authenticated" and a response code
matching StaticCode.
If StaticCode is not set, the response will return a 200 response.
staticCodeintStaticCode determines the response code for the Static response.
This option can only be used with Static enabled.
flushIntervalDurationFlushInterval is the period between flushing the response buffer when
streaming response from the upstream.
Defaults to 1 second.
passHostHeaderboolPassHostHeader determines whether the request host header should be proxied
to the upstream server.
Defaults to true.
proxyWebSocketsboolProxyWebSockets enables proxying of websockets to upstream servers
Defaults to true.

Upstreams​

([]Upstream alias)​

(Appears on: AlphaOptions)

Upstreams is a collection of definitions for upstream servers.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.1.x/configuration/oauth_provider/index.html b/docs/7.1.x/configuration/oauth_provider/index.html index 903a96ef..4ecf53ab 100644 --- a/docs/7.1.x/configuration/oauth_provider/index.html +++ b/docs/7.1.x/configuration/oauth_provider/index.html @@ -5,7 +5,7 @@ OAuth Provider Configuration | OAuth2 Proxy - + @@ -50,7 +50,7 @@ to setup the client id and client secret. Your "Redirection URI" will Provider instance. Add a new case to providers.New() to allow oauth2-proxy to use the new Provider.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.1.x/configuration/overview/index.html b/docs/7.1.x/configuration/overview/index.html index 02890a30..fe07328a 100644 --- a/docs/7.1.x/configuration/overview/index.html +++ b/docs/7.1.x/configuration/overview/index.html @@ -5,7 +5,7 @@ Overview | OAuth2 Proxy - + @@ -20,7 +20,7 @@ The default format is configured as follows:

{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}

Available variables for request logging:

VariableExampleDescription
Client74.125.224.72The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.
Hostdomain.comThe value of the Host header.
ProtocolHTTP/1.0The request protocol.
RequestDuration0.001The time in seconds that a request took to process.
RequestID00010203-0405-4607-8809-0a0b0c0d0e0fThe request ID pulled from the --request-id-header. Random UUID if empty
RequestMethodGETThe request method.
RequestURI"/oauth2/auth"The URI path of the request.
ResponseSize12The size in bytes of the response.
StatusCode200The HTTP status code of the response.
Timestamp19/Mar/2015:17:20:19 -0400The date and time of the logging event.
Upstream-The upstream data of the HTTP request.
UserAgent-The full user agent as reported by the requesting client.
Usernameusername@email.comThe email or username of the auth request.

Standard Log Format​

All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:

[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE>

If you require a different format than that, you can configure it with the --standard-logging-format flag. The default format is configured as follows:

[{{.Timestamp}}] [{{.File}}] {{.Message}}

Available variables for standard logging:

VariableExampleDescription
Timestamp19/Mar/2015:17:20:19 -0400The date and time of the logging event.
Filemain.go:40The file and line number of the logging statement.
MessageHTTP: listening on 127.0.0.1:4180The details of the log statement.

Configuring for use with the Nginx auth_request directive​

The Nginx auth_request directive allows Nginx to authenticate requests via the oauth2-proxy's /auth endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:

server {
  listen 443 ssl;
  server_name ...;
  include ssl/ssl.conf;

  location /oauth2/ {
    proxy_pass       http://127.0.0.1:4180;
    proxy_set_header Host                    $host;
    proxy_set_header X-Real-IP               $remote_addr;
    proxy_set_header X-Scheme                $scheme;
    proxy_set_header X-Auth-Request-Redirect $request_uri;
    # or, if you are handling multiple domains:
    # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
  }
  location = /oauth2/auth {
    proxy_pass       http://127.0.0.1:4180;
    proxy_set_header Host             $host;
    proxy_set_header X-Real-IP        $remote_addr;
    proxy_set_header X-Scheme         $scheme;
    # nginx auth_request includes headers but not body
    proxy_set_header Content-Length   "";
    proxy_pass_request_body           off;
  }

  location / {
    auth_request /oauth2/auth;
    error_page 401 = /oauth2/sign_in;

    # pass information via X-User and X-Email headers to backend,
    # requires running with --set-xauthrequest flag
    auth_request_set $user   $upstream_http_x_auth_request_user;
    auth_request_set $email  $upstream_http_x_auth_request_email;
    proxy_set_header X-User  $user;
    proxy_set_header X-Email $email;

    # if you enabled --pass-access-token, this will pass the token to the backend
    auth_request_set $token  $upstream_http_x_auth_request_access_token;
    proxy_set_header X-Access-Token $token;

    # if you enabled --cookie-refresh, this is needed for it to work with auth_request
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;

    # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
    # limit and so the OAuth2 Proxy splits these into multiple parts.
    # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
    # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
    auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;

    # Extract the Cookie attributes from the first Set-Cookie header and append them
    # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
    if ($auth_cookie ~* "(; .*)") {
        set $auth_cookie_name_0 $auth_cookie;
        set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
    }

    # Send both Set-Cookie headers now if there was a second part
    if ($auth_cookie_name_upstream_1) {
        add_header Set-Cookie $auth_cookie_name_0;
        add_header Set-Cookie $auth_cookie_name_1;
    }

    proxy_pass http://backend/;
    # or "root /path/to/site;" or "fastcgi_pass ..." etc
  }
}

When you use ingress-nginx in Kubernetes, you MUST use kubernetes/ingress-nginx (which includes the Lua module) and the following configuration snippet for your Ingress. Variables set with auth_request_set are not set-able in plain nginx config when the location is processed via proxy_pass and then may only be processed by Lua. Note that nginxinc/kubernetes-ingress does not include the Lua module.

nginx.ingress.kubernetes.io/auth-response-headers: Authorization
nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
nginx.ingress.kubernetes.io/configuration-snippet: |
  auth_request_set $name_upstream_1 $upstream_cookie_name_1;

  access_by_lua_block {
    if ngx.var.name_upstream_1 ~= "" then
      ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")
    end
  }

It is recommended to use --session-store-type=redis when expecting large sessions/OIDC tokens (e.g. with MS Azure).

You have to substitute name with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".

Configuring for use with the Traefik (v2) ForwardAuth middleware​

This option requires --reverse-proxy option to be set.

ForwardAuth with 401 errors middleware​

The Traefik v2 ForwardAuth middleware allows Traefik to authenticate requests via the oauth2-proxy's /oauth2/auth endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:

http:
  routers:
    a-service:
      rule: "Host(`a-service.example.com`)"
      service: a-service-backend
      middlewares:
        - oauth-errors
        - oauth-auth
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"
    oauth:
      rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"
      middlewares:
        - auth-headers
      service: oauth-backend
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"

  services:
    a-service-backend:
      loadBalancer:
        servers:
          - url: http://172.16.0.2:7555
    oauth-backend:
      loadBalancer:
        servers:
          - url: http://172.16.0.1:4180

  middlewares:
    auth-headers:
      headers:
        sslRedirect: true
        stsSeconds: 315360000
        browserXssFilter: true
        contentTypeNosniff: true
        forceSTSHeader: true
        sslHost: example.com
        stsIncludeSubdomains: true
        stsPreload: true
        frameDeny: true
    oauth-auth:
      forwardAuth:
        address: https://oauth.example.com/oauth2/auth
        trustForwardHeader: true
    oauth-errors:
      errors:
        status:
          - "401-403"
        service: oauth-backend
        query: "/oauth2/sign_in"

ForwardAuth with static upstreams configuration​

Redirect to sign_in functionality provided without the use of errors middleware with Traefik v2 ForwardAuth middleware pointing to oauth2-proxy service's / endpoint

Following options need to be set on oauth2-proxy:

  • --upstream=static://202: Configures a static response for authenticated sessions
  • --reverseproxy=true: Enables the use of X-Forwarded-* headers to determine redirects correctly
http:
  routers:
    a-service-route-1:
      rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"
      service: a-service-backend
      middlewares:
        - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"
    a-service-route-2:
      rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"
      service: a-service-backend
      middlewares:
        - oauth-auth-wo-redirect # unauthenticated session will return a 401
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"
    services-oauth2-route:
      rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"
      middlewares:
        - auth-headers
      service: oauth-backend
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"
    oauth2-proxy-route:
      rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"
      middlewares:
        - auth-headers
      service: oauth-backend
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"

  services:
    a-service-backend:
      loadBalancer:
        servers:
          - url: http://172.16.0.2:7555
    b-service-backend:
      loadBalancer:
        servers:
          - url: http://172.16.0.3:7555
    oauth-backend:
      loadBalancer:
        servers:
          - url: http://172.16.0.1:4180

  middlewares:
    auth-headers:
      headers:
        sslRedirect: true
        stsSeconds: 315360000
        browserXssFilter: true
        contentTypeNosniff: true
        forceSTSHeader: true
        sslHost: example.com
        stsIncludeSubdomains: true
        stsPreload: true
        frameDeny: true
    oauth-auth-redirect:
      forwardAuth:
        address: https://oauth.example.com/
        trustForwardHeader: true
        authResponseHeaders:
          - X-Auth-Request-Access-Token
          - Authorization
    oauth-auth-wo-redirect:
      forwardAuth:
        address: https://oauth.example.com/oauth2/auth
        trustForwardHeader: true
        authResponseHeaders:
          - X-Auth-Request-Access-Token
          - Authorization
note

If you set up your OAuth2 provider to rotate your client secret, you can use the client-secret-file option to reload the secret when it is updated.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.1.x/configuration/session_storage/index.html b/docs/7.1.x/configuration/session_storage/index.html index ea6ef22e..108e67b8 100644 --- a/docs/7.1.x/configuration/session_storage/index.html +++ b/docs/7.1.x/configuration/session_storage/index.html @@ -5,7 +5,7 @@ Session Storage | OAuth2 Proxy - + @@ -26,7 +26,7 @@ disclosure.

Usage--redis-use-sentinel=true flag, as well as configure the flags --redis-sentinel-master-name and --redis-sentinel-connection-urls appropriately.

Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the --redis-use-cluster=true flag, and configure the flags --redis-cluster-connection-urls appropriately.

Note that flags --redis-use-sentinel=true and --redis-use-cluster=true are mutually exclusive.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.1.x/configuration/tls/index.html b/docs/7.1.x/configuration/tls/index.html index dadc6f0a..f2a07f0f 100644 --- a/docs/7.1.x/configuration/tls/index.html +++ b/docs/7.1.x/configuration/tls/index.html @@ -5,7 +5,7 @@ TLS Configuration | OAuth2 Proxy - + @@ -16,7 +16,7 @@ external load balancer like Amazon ELB or Google Platform Load Balancing) use oauth2-proxy will then authenticate requests for an upstream application. The external endpoint for this example would be https://internal.yourcompany.com/.

An example Nginx config follows. Note the use of Strict-Transport-Security header to pin requests to SSL via HSTS:

server {
    listen 443 default ssl;
    server_name internal.yourcompany.com;
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/cert.key;
    add_header Strict-Transport-Security max-age=2592000;

    location / {
        proxy_pass http://127.0.0.1:4180;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Scheme $scheme;
        proxy_connect_timeout 1;
        proxy_send_timeout 30;
        proxy_read_timeout 30;
    }
}

The command line to run oauth2-proxy in this configuration would look like this:

./oauth2-proxy \
   --email-domain="yourcompany.com"  \
   --upstream=http://127.0.0.1:8080/ \
   --cookie-secret=... \
   --cookie-secure=true \
   --provider=... \
   --reverse-proxy=true \
   --client-id=... \
   --client-secret=...
Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.1.x/features/endpoints/index.html b/docs/7.1.x/features/endpoints/index.html index 92a6fd21..1d370559 100644 --- a/docs/7.1.x/features/endpoints/index.html +++ b/docs/7.1.x/features/endpoints/index.html @@ -5,13 +5,13 @@ Endpoints | OAuth2 Proxy - +
Version: 7.1.x

Endpoints

OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.

  • /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see robotstxt.org for more info
  • /ping - returns a 200 OK response, which is intended for use with health checks
  • /metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by --metrics-address, disabled by default
  • /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
  • /oauth2/sign_out - this URL is used to clear the session cookie
  • /oauth2/start - a URL that will redirect to start the OAuth cycle
  • /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
  • /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
  • /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the Nginx auth_request directive

Sign out​

To sign the user out, redirect them to /oauth2/sign_out. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the rd query parameter, i.e. redirect the user to something like (notice the url-encoding!):

/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page

Alternatively, include the redirect URL in the X-Auth-Request-Redirect header:

GET /oauth2/sign_out HTTP/1.1
X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
...

(The "sign_out_page" should be the end_session_endpoint from the metadata if your OIDC provider supports Session Management and Discovery.)

BEWARE that the domain you want to redirect to (my-oidc-provider.example.com in the example) must be added to the --whitelist-domain configuration option otherwise the redirect will be ignored.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.1.x/index.html b/docs/7.1.x/index.html index 7a2abd2d..9778f508 100644 --- a/docs/7.1.x/index.html +++ b/docs/7.1.x/index.html @@ -5,13 +5,13 @@ Installation | OAuth2 Proxy - +
Version: 7.1.x

Installation

  1. Choose how to deploy:

    a. Download Prebuilt Binary (current release is v7.1.3)

    b. Build with $ go get github.com/oauth2-proxy/oauth2-proxy/v7 which will put the binary in $GOPATH/bin

    c. Using the prebuilt docker image quay.io/oauth2-proxy/oauth2-proxy (AMD64, ARMv6 and ARM64 tags available)

    d. Using a Kubernetes manifest (Helm)

Prebuilt binaries can be validated by extracting the file and verifying it against the sha256sum.txt checksum file provided for each release starting with version v3.0.0.

$ sha256sum -c sha256sum.txt 2>&1 | grep OK
oauth2-proxy-x.y.z.linux-amd64: OK
  1. Select a Provider and Register an OAuth Application with a Provider
  2. Configure OAuth2 Proxy using config file, command line options, or environment variables
  3. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.2.x/behaviour/index.html b/docs/7.2.x/behaviour/index.html index 5aba9b0b..1f2f00ee 100644 --- a/docs/7.2.x/behaviour/index.html +++ b/docs/7.2.x/behaviour/index.html @@ -5,13 +5,13 @@ Behaviour | OAuth2 Proxy - +
Version: 7.2.x

Behaviour

  1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).
  2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with Accept: application/json, in which case 401 Unauthorized is returned)
  3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
  4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)

Notice that the proxy also provides a number of useful endpoints.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.2.x/community/security/index.html b/docs/7.2.x/community/security/index.html index 80c7e12a..c7fb09ee 100644 --- a/docs/7.2.x/community/security/index.html +++ b/docs/7.2.x/community/security/index.html @@ -5,7 +5,7 @@ Security | OAuth2 Proxy - + @@ -29,7 +29,7 @@ If we have multiple security issues in flight simultaneously, we may delay merging fixes until all patches are ready. We may also backport the fix to previous releases, but this will be at the discretion of the maintainers.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.2.x/configuration/alpha-config/index.html b/docs/7.2.x/configuration/alpha-config/index.html index 17e3730b..6c0e30d8 100644 --- a/docs/7.2.x/configuration/alpha-config/index.html +++ b/docs/7.2.x/configuration/alpha-config/index.html @@ -5,7 +5,7 @@ Alpha Configuration | OAuth2 Proxy - + @@ -35,7 +35,7 @@ response header.

FieldTypeDescription make up the header value

FieldTypeDescription
value[]byteValue expects a base64 encoded string value.
fromEnvstringFromEnv expects the name of an environment variable.
fromFilestringFromFile expects a path to a file containing the secret value.
claimstringClaim is the name of the claim in the session that the value should be
loaded from.
prefixstringPrefix is an optional prefix that will be prepended to the value of the
claim if it is non-empty.
basicAuthPasswordSecretSourceBasicAuthPassword converts this claim into a basic auth header.
Note the value of claim will become the basic auth username and the
basicAuthPassword will be used as the password value.

KeycloakOptions​

(Appears on: Provider)

FieldTypeDescription
groups[]stringGroup enables to restrict login to members of indicated group
roles[]stringRole enables to restrict login to users with role (only available when using the keycloak-oidc provider)

LoginGovOptions​

(Appears on: Provider)

FieldTypeDescription
jwtKeystringJWTKey is a private key in PEM format used to sign JWT,
jwtKeyFilestringJWTKeyFile is a path to the private key file in PEM format used to sign the JWT
pubjwkURLstringPubJWKURL is the JWK pubkey access endpoint

OIDCOptions​

(Appears on: Provider)

FieldTypeDescription
issuerURLstringIssuerURL is the OpenID Connect issuer URL
eg: https://accounts.google.com
insecureAllowUnverifiedEmailboolInsecureAllowUnverifiedEmail prevents failures if an email address in an id_token is not verified
default set to 'false'
insecureSkipIssuerVerificationboolInsecureSkipIssuerVerification skips verification of ID token issuers. When false, ID Token Issuers must match the OIDC discovery URL
default set to 'false'
insecureSkipNonceboolInsecureSkipNonce skips verifying the ID Token's nonce claim that must match
the random nonce sent in the initial OAuth flow. Otherwise, the nonce is checked
after the initial OAuth redeem & subsequent token refreshes.
default set to 'true'
Warning: In a future release, this will change to 'false' by default for enhanced security.
skipDiscoveryboolSkipDiscovery allows to skip OIDC discovery and use manually supplied Endpoints
default set to 'false'
jwksURLstringJwksURL is the OpenID Connect JWKS URL
eg: https://www.googleapis.com/oauth2/v3/certs
emailClaimstringEmailClaim indicates which claim contains the user email,
default set to 'email'
groupsClaimstringGroupsClaim indicates which claim contains the user groups
default set to 'groups'
userIDClaimstringUserIDClaim indicates which claim contains the user ID
default set to 'email'

Provider​

(Appears on: Providers)

Provider holds all configuration for a single provider

FieldTypeDescription
clientIDstringClientID is the OAuth Client ID that is defined in the provider
This value is required for all providers.
clientSecretstringClientSecret is the OAuth Client Secret that is defined in the provider
This value is required for all providers.
clientSecretFilestringClientSecretFile is the name of the file
containing the OAuth Client Secret, it will be used if ClientSecret is not set.
keycloakConfigKeycloakOptionsKeycloakConfig holds all configurations for Keycloak provider.
azureConfigAzureOptionsAzureConfig holds all configurations for Azure provider.
ADFSConfigADFSOptionsADFSConfig holds all configurations for ADFS provider.
bitbucketConfigBitbucketOptionsBitbucketConfig holds all configurations for Bitbucket provider.
githubConfigGitHubOptionsGitHubConfig holds all configurations for GitHubC provider.
gitlabConfigGitLabOptionsGitLabConfig holds all configurations for GitLab provider.
googleConfigGoogleOptionsGoogleConfig holds all configurations for Google provider.
oidcConfigOIDCOptionsOIDCConfig holds all configurations for OIDC provider
or providers utilize OIDC configurations.
loginGovConfigLoginGovOptionsLoginGovConfig holds all configurations for LoginGov provider.
idstringID should be a unique identifier for the provider.
This value is required for all providers.
providerstringType is the OAuth provider
must be set from the supported providers group,
otherwise 'Google' is set as default
namestringName is the providers display name
if set, it will be shown to the users in the login page.
caFiles[]stringCAFiles is a list of paths to CA certificates that should be used when connecting to the provider.
If not specified, the default Go trust sources are used instead
loginURLstringLoginURL is the authentication endpoint
redeemURLstringRedeemURL is the token redemption endpoint
profileURLstringProfileURL is the profile access endpoint
resourcestringProtectedResource is the resource that is protected (Azure AD and ADFS only)
validateURLstringValidateURL is the access token validation endpoint
scopestringScope is the OAuth scope specification
promptstringPrompt is OIDC prompt
approvalPromptstringApprovalPrompt is the OAuth approval_prompt
default is set to 'force'
allowedGroups[]stringAllowedGroups is a list of restrict logins to members of this group
acrValuesstringAcrValues is a string of acr values

Providers​

([]Provider alias)​

(Appears on: AlphaOptions)

Providers is a collection of definitions for providers.

SecretSource​

(Appears on: ClaimSource, HeaderValue, TLS)

SecretSource references an individual secret value. Only one source within the struct should be defined at any time.

FieldTypeDescription
value[]byteValue expects a base64 encoded string value.
fromEnvstringFromEnv expects the name of an environment variable.
fromFilestringFromFile expects a path to a file containing the secret value.

Server​

(Appears on: AlphaOptions)

Server represents the configuration for an HTTP(S) server

FieldTypeDescription
BindAddressstringBindAddress is the address on which to serve traffic.
Leave blank or set to "-" to disable.
SecureBindAddressstringSecureBindAddress is the address on which to serve secure traffic.
Leave blank or set to "-" to disable.
TLSTLSTLS contains the information for loading the certificate and key for the
secure traffic.

TLS​

(Appears on: Server)

TLS contains the information for loading a TLS certifcate and key.

FieldTypeDescription
KeySecretSourceKey is the TLS key data to use.
Typically this will come from a file.
CertSecretSourceCert is the TLS certificate data to use.
Typically this will come from a file.

Upstream​

(Appears on: UpstreamConfig)

Upstream represents the configuration for an upstream server. Requests will be proxied to this upstream if the path matches the request path.

FieldTypeDescription
idstringID should be a unique identifier for the upstream.
This value is required for all upstreams.
pathstringPath is used to map requests to the upstream server.
The closest match will take precedence and all Paths must be unique.
Path can also take a pattern when used with RewriteTarget.
Path segments can be captured and matched using regular experessions.
Eg:
- ^/foo$: Match only the explicit path /foo
- ^/bar/$: Match any path prefixed with /bar/
- ^/baz/(.*)$: Match any path prefixed with /baz and capture the remaining path for use with RewriteTarget
rewriteTargetstringRewriteTarget allows users to rewrite the request path before it is sent to
the upstream server.
Use the Path to capture segments for reuse within the rewrite target.
Eg: With a Path of ^/baz/(.*), a RewriteTarget of /foo/$1 would rewrite
the request /baz/abc/123 to /foo/abc/123 before proxying to the
upstream server.
uristringThe URI of the upstream server. This may be an HTTP(S) server of a File
based URL. It may include a path, in which case all requests will be served
under that path.
Eg:
- http://localhost:8080
- https://service.localhost
- https://service.localhost/path
- file://host/path
If the URI's path is "/base" and the incoming request was for "/dir",
the upstream request will be for "/base/dir".
insecureSkipTLSVerifyboolInsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.
This option is insecure and will allow potential Man-In-The-Middle attacks
betweem OAuth2 Proxy and the usptream server.
Defaults to false.
staticboolStatic will make all requests to this upstream have a static response.
The response will have a body of "Authenticated" and a response code
matching StaticCode.
If StaticCode is not set, the response will return a 200 response.
staticCodeintStaticCode determines the response code for the Static response.
This option can only be used with Static enabled.
flushIntervalDurationFlushInterval is the period between flushing the response buffer when
streaming response from the upstream.
Defaults to 1 second.
passHostHeaderboolPassHostHeader determines whether the request host header should be proxied
to the upstream server.
Defaults to true.
proxyWebSocketsboolProxyWebSockets enables proxying of websockets to upstream servers
Defaults to true.

UpstreamConfig​

(Appears on: AlphaOptions)

UpstreamConfig is a collection of definitions for upstream servers.

FieldTypeDescription
proxyRawPathboolProxyRawPath will pass the raw url path to upstream allowing for url's
like: "/%2F/" which would otherwise be redirected to "/"
upstreams[]UpstreamUpstreams represents the configuration for the upstream servers.
Requests will be proxied to this upstream if the path matches the request path.
Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.2.x/configuration/oauth_provider/index.html b/docs/7.2.x/configuration/oauth_provider/index.html index 37b9b31a..23fa5243 100644 --- a/docs/7.2.x/configuration/oauth_provider/index.html +++ b/docs/7.2.x/configuration/oauth_provider/index.html @@ -5,7 +5,7 @@ OAuth Provider Configuration | OAuth2 Proxy - + @@ -50,7 +50,7 @@ to setup the client id and client secret. Your "Redirection URI" will Provider instance. Add a new case to providers.New() to allow oauth2-proxy to use the new Provider.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.2.x/configuration/overview/index.html b/docs/7.2.x/configuration/overview/index.html index 8043c1a6..2a6a8162 100644 --- a/docs/7.2.x/configuration/overview/index.html +++ b/docs/7.2.x/configuration/overview/index.html @@ -5,7 +5,7 @@ Overview | OAuth2 Proxy - + @@ -20,7 +20,7 @@ The default format is configured as follows:

{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}

Available variables for request logging:

VariableExampleDescription
Client74.125.224.72The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.
Hostdomain.comThe value of the Host header.
ProtocolHTTP/1.0The request protocol.
RequestDuration0.001The time in seconds that a request took to process.
RequestID00010203-0405-4607-8809-0a0b0c0d0e0fThe request ID pulled from the --request-id-header. Random UUID if empty
RequestMethodGETThe request method.
RequestURI"/oauth2/auth"The URI path of the request.
ResponseSize12The size in bytes of the response.
StatusCode200The HTTP status code of the response.
Timestamp19/Mar/2015:17:20:19 -0400The date and time of the logging event.
Upstream-The upstream data of the HTTP request.
UserAgent-The full user agent as reported by the requesting client.
Usernameusername@email.comThe email or username of the auth request.

Standard Log Format​

All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:

[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE>

If you require a different format than that, you can configure it with the --standard-logging-format flag. The default format is configured as follows:

[{{.Timestamp}}] [{{.File}}] {{.Message}}

Available variables for standard logging:

VariableExampleDescription
Timestamp19/Mar/2015:17:20:19 -0400The date and time of the logging event.
Filemain.go:40The file and line number of the logging statement.
MessageHTTP: listening on 127.0.0.1:4180The details of the log statement.

Configuring for use with the Nginx auth_request directive​

The Nginx auth_request directive allows Nginx to authenticate requests via the oauth2-proxy's /auth endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:

server {
  listen 443 ssl;
  server_name ...;
  include ssl/ssl.conf;

  location /oauth2/ {
    proxy_pass       http://127.0.0.1:4180;
    proxy_set_header Host                    $host;
    proxy_set_header X-Real-IP               $remote_addr;
    proxy_set_header X-Scheme                $scheme;
    proxy_set_header X-Auth-Request-Redirect $request_uri;
    # or, if you are handling multiple domains:
    # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
  }
  location = /oauth2/auth {
    proxy_pass       http://127.0.0.1:4180;
    proxy_set_header Host             $host;
    proxy_set_header X-Real-IP        $remote_addr;
    proxy_set_header X-Scheme         $scheme;
    # nginx auth_request includes headers but not body
    proxy_set_header Content-Length   "";
    proxy_pass_request_body           off;
  }

  location / {
    auth_request /oauth2/auth;
    error_page 401 = /oauth2/sign_in;

    # pass information via X-User and X-Email headers to backend,
    # requires running with --set-xauthrequest flag
    auth_request_set $user   $upstream_http_x_auth_request_user;
    auth_request_set $email  $upstream_http_x_auth_request_email;
    proxy_set_header X-User  $user;
    proxy_set_header X-Email $email;

    # if you enabled --pass-access-token, this will pass the token to the backend
    auth_request_set $token  $upstream_http_x_auth_request_access_token;
    proxy_set_header X-Access-Token $token;

    # if you enabled --cookie-refresh, this is needed for it to work with auth_request
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;

    # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
    # limit and so the OAuth2 Proxy splits these into multiple parts.
    # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
    # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
    auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;

    # Extract the Cookie attributes from the first Set-Cookie header and append them
    # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
    if ($auth_cookie ~* "(; .*)") {
        set $auth_cookie_name_0 $auth_cookie;
        set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
    }

    # Send both Set-Cookie headers now if there was a second part
    if ($auth_cookie_name_upstream_1) {
        add_header Set-Cookie $auth_cookie_name_0;
        add_header Set-Cookie $auth_cookie_name_1;
    }

    proxy_pass http://backend/;
    # or "root /path/to/site;" or "fastcgi_pass ..." etc
  }
}

When you use ingress-nginx in Kubernetes, you MUST use kubernetes/ingress-nginx (which includes the Lua module) and the following configuration snippet for your Ingress. Variables set with auth_request_set are not set-able in plain nginx config when the location is processed via proxy_pass and then may only be processed by Lua. Note that nginxinc/kubernetes-ingress does not include the Lua module.

nginx.ingress.kubernetes.io/auth-response-headers: Authorization
nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
nginx.ingress.kubernetes.io/configuration-snippet: |
  auth_request_set $name_upstream_1 $upstream_cookie_name_1;

  access_by_lua_block {
    if ngx.var.name_upstream_1 ~= "" then
      ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")
    end
  }

It is recommended to use --session-store-type=redis when expecting large sessions/OIDC tokens (e.g. with MS Azure).

You have to substitute name with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".

Configuring for use with the Traefik (v2) ForwardAuth middleware​

This option requires --reverse-proxy option to be set.

ForwardAuth with 401 errors middleware​

The Traefik v2 ForwardAuth middleware allows Traefik to authenticate requests via the oauth2-proxy's /oauth2/auth endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:

http:
  routers:
    a-service:
      rule: "Host(`a-service.example.com`)"
      service: a-service-backend
      middlewares:
        - oauth-errors
        - oauth-auth
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"
    oauth:
      rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"
      middlewares:
        - auth-headers
      service: oauth-backend
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"

  services:
    a-service-backend:
      loadBalancer:
        servers:
          - url: http://172.16.0.2:7555
    oauth-backend:
      loadBalancer:
        servers:
          - url: http://172.16.0.1:4180

  middlewares:
    auth-headers:
      headers:
        sslRedirect: true
        stsSeconds: 315360000
        browserXssFilter: true
        contentTypeNosniff: true
        forceSTSHeader: true
        sslHost: example.com
        stsIncludeSubdomains: true
        stsPreload: true
        frameDeny: true
    oauth-auth:
      forwardAuth:
        address: https://oauth.example.com/oauth2/auth
        trustForwardHeader: true
    oauth-errors:
      errors:
        status:
          - "401-403"
        service: oauth-backend
        query: "/oauth2/sign_in"

ForwardAuth with static upstreams configuration​

Redirect to sign_in functionality provided without the use of errors middleware with Traefik v2 ForwardAuth middleware pointing to oauth2-proxy service's / endpoint

Following options need to be set on oauth2-proxy:

  • --upstream=static://202: Configures a static response for authenticated sessions
  • --reverse-proxy=true: Enables the use of X-Forwarded-* headers to determine redirects correctly
http:
  routers:
    a-service-route-1:
      rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"
      service: a-service-backend
      middlewares:
        - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"
    a-service-route-2:
      rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"
      service: a-service-backend
      middlewares:
        - oauth-auth-wo-redirect # unauthenticated session will return a 401
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"
    services-oauth2-route:
      rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"
      middlewares:
        - auth-headers
      service: oauth-backend
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"
    oauth2-proxy-route:
      rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"
      middlewares:
        - auth-headers
      service: oauth-backend
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"

  services:
    a-service-backend:
      loadBalancer:
        servers:
          - url: http://172.16.0.2:7555
    b-service-backend:
      loadBalancer:
        servers:
          - url: http://172.16.0.3:7555
    oauth-backend:
      loadBalancer:
        servers:
          - url: http://172.16.0.1:4180

  middlewares:
    auth-headers:
      headers:
        sslRedirect: true
        stsSeconds: 315360000
        browserXssFilter: true
        contentTypeNosniff: true
        forceSTSHeader: true
        sslHost: example.com
        stsIncludeSubdomains: true
        stsPreload: true
        frameDeny: true
    oauth-auth-redirect:
      forwardAuth:
        address: https://oauth.example.com/
        trustForwardHeader: true
        authResponseHeaders:
          - X-Auth-Request-Access-Token
          - Authorization
    oauth-auth-wo-redirect:
      forwardAuth:
        address: https://oauth.example.com/oauth2/auth
        trustForwardHeader: true
        authResponseHeaders:
          - X-Auth-Request-Access-Token
          - Authorization
note

If you set up your OAuth2 provider to rotate your client secret, you can use the client-secret-file option to reload the secret when it is updated.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.2.x/configuration/session_storage/index.html b/docs/7.2.x/configuration/session_storage/index.html index e4f00ab7..8773099f 100644 --- a/docs/7.2.x/configuration/session_storage/index.html +++ b/docs/7.2.x/configuration/session_storage/index.html @@ -5,7 +5,7 @@ Session Storage | OAuth2 Proxy - + @@ -26,7 +26,7 @@ disclosure.

Usage--redis-use-sentinel=true flag, as well as configure the flags --redis-sentinel-master-name and --redis-sentinel-connection-urls appropriately.

Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the --redis-use-cluster=true flag, and configure the flags --redis-cluster-connection-urls appropriately.

Note that flags --redis-use-sentinel=true and --redis-use-cluster=true are mutually exclusive.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.2.x/configuration/tls/index.html b/docs/7.2.x/configuration/tls/index.html index e31cc179..1ce7ba58 100644 --- a/docs/7.2.x/configuration/tls/index.html +++ b/docs/7.2.x/configuration/tls/index.html @@ -5,7 +5,7 @@ TLS Configuration | OAuth2 Proxy - + @@ -16,7 +16,7 @@ external load balancer like Amazon ELB or Google Platform Load Balancing) use oauth2-proxy will then authenticate requests for an upstream application. The external endpoint for this example would be https://internal.yourcompany.com/.

An example Nginx config follows. Note the use of Strict-Transport-Security header to pin requests to SSL via HSTS:

server {
    listen 443 default ssl;
    server_name internal.yourcompany.com;
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/cert.key;
    add_header Strict-Transport-Security max-age=2592000;

    location / {
        proxy_pass http://127.0.0.1:4180;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Scheme $scheme;
        proxy_connect_timeout 1;
        proxy_send_timeout 30;
        proxy_read_timeout 30;
    }
}

The command line to run oauth2-proxy in this configuration would look like this:

./oauth2-proxy \
   --email-domain="yourcompany.com"  \
   --upstream=http://127.0.0.1:8080/ \
   --cookie-secret=... \
   --cookie-secure=true \
   --provider=... \
   --reverse-proxy=true \
   --client-id=... \
   --client-secret=...
Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.2.x/features/endpoints/index.html b/docs/7.2.x/features/endpoints/index.html index 76aeb252..e7fe64c7 100644 --- a/docs/7.2.x/features/endpoints/index.html +++ b/docs/7.2.x/features/endpoints/index.html @@ -5,13 +5,13 @@ Endpoints | OAuth2 Proxy - +
Version: 7.2.x

Endpoints

OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.

  • /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see robotstxt.org for more info
  • /ping - returns a 200 OK response, which is intended for use with health checks
  • /metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by --metrics-address, disabled by default
  • /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
  • /oauth2/sign_out - this URL is used to clear the session cookie
  • /oauth2/start - a URL that will redirect to start the OAuth cycle
  • /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
  • /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
  • /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the Nginx auth_request directive

Sign out​

To sign the user out, redirect them to /oauth2/sign_out. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the rd query parameter, i.e. redirect the user to something like (notice the url-encoding!):

/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page

Alternatively, include the redirect URL in the X-Auth-Request-Redirect header:

GET /oauth2/sign_out HTTP/1.1
X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
...

(The "sign_out_page" should be the end_session_endpoint from the metadata if your OIDC provider supports Session Management and Discovery.)

BEWARE that the domain you want to redirect to (my-oidc-provider.example.com in the example) must be added to the --whitelist-domain configuration option otherwise the redirect will be ignored.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.2.x/index.html b/docs/7.2.x/index.html index 840cbd08..d17179e5 100644 --- a/docs/7.2.x/index.html +++ b/docs/7.2.x/index.html @@ -5,13 +5,13 @@ Installation | OAuth2 Proxy - +
Version: 7.2.x

Installation

  1. Choose how to deploy:

    a. Download Prebuilt Binary (current release is v7.2.1)

    b. Build with $ go get github.com/oauth2-proxy/oauth2-proxy/v7 which will put the binary in $GOPATH/bin

    c. Using the prebuilt docker image quay.io/oauth2-proxy/oauth2-proxy (AMD64, ARMv6 and ARM64 tags available)

    d. Using a Kubernetes manifest (Helm)

Prebuilt binaries can be validated by extracting the file and verifying it against the sha256sum.txt checksum file provided for each release starting with version v3.0.0.

$ sha256sum -c sha256sum.txt
oauth2-proxy-x.y.z.linux-amd64: OK
  1. Select a Provider and Register an OAuth Application with a Provider
  2. Configure OAuth2 Proxy using config file, command line options, or environment variables
  3. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.3.x/behaviour/index.html b/docs/7.3.x/behaviour/index.html index efbee8e6..6cd557a5 100644 --- a/docs/7.3.x/behaviour/index.html +++ b/docs/7.3.x/behaviour/index.html @@ -5,13 +5,13 @@ Behaviour | OAuth2 Proxy - +
Version: 7.3.x

Behaviour

  1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).
  2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with Accept: application/json, in which case 401 Unauthorized is returned)
  3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
  4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)

Notice that the proxy also provides a number of useful endpoints.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.3.x/community/security/index.html b/docs/7.3.x/community/security/index.html index 331fb22d..f6c9bf1a 100644 --- a/docs/7.3.x/community/security/index.html +++ b/docs/7.3.x/community/security/index.html @@ -5,7 +5,7 @@ Security | OAuth2 Proxy - + @@ -29,7 +29,7 @@ If we have multiple security issues in flight simultaneously, we may delay merging fixes until all patches are ready. We may also backport the fix to previous releases, but this will be at the discretion of the maintainers.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.3.x/configuration/alpha-config/index.html b/docs/7.3.x/configuration/alpha-config/index.html index 1f856e25..cc16b513 100644 --- a/docs/7.3.x/configuration/alpha-config/index.html +++ b/docs/7.3.x/configuration/alpha-config/index.html @@ -5,7 +5,7 @@ Alpha Configuration | OAuth2 Proxy - + @@ -63,7 +63,7 @@ passed to the /oauth2/start endpoint are checked to determine wheth they are valid overrides for the given parameter passed to the IdP's login URL. Either Value or Pattern should be supplied, not both.

FieldTypeDescription
valuestringA Value rule matches just this specific value
patternstringA Pattern rule gives a regular expression that must be matched by
some substring of the value. The expression is not automatically
anchored to the start and end of the value, if you want to restrict
the whole parameter value you must anchor it yourself with ^ and $.

Upstream​

(Appears on: UpstreamConfig)

Upstream represents the configuration for an upstream server. Requests will be proxied to this upstream if the path matches the request path.

FieldTypeDescription
idstringID should be a unique identifier for the upstream.
This value is required for all upstreams.
pathstringPath is used to map requests to the upstream server.
The closest match will take precedence and all Paths must be unique.
Path can also take a pattern when used with RewriteTarget.
Path segments can be captured and matched using regular experessions.
Eg:
- ^/foo$: Match only the explicit path /foo
- ^/bar/$: Match any path prefixed with /bar/
- ^/baz/(.*)$: Match any path prefixed with /baz and capture the remaining path for use with RewriteTarget
rewriteTargetstringRewriteTarget allows users to rewrite the request path before it is sent to
the upstream server.
Use the Path to capture segments for reuse within the rewrite target.
Eg: With a Path of ^/baz/(.*), a RewriteTarget of /foo/$1 would rewrite
the request /baz/abc/123 to /foo/abc/123 before proxying to the
upstream server.
uristringThe URI of the upstream server. This may be an HTTP(S) server of a File
based URL. It may include a path, in which case all requests will be served
under that path.
Eg:
- http://localhost:8080
- https://service.localhost
- https://service.localhost/path
- file://host/path
If the URI's path is "/base" and the incoming request was for "/dir",
the upstream request will be for "/base/dir".
insecureSkipTLSVerifyboolInsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.
This option is insecure and will allow potential Man-In-The-Middle attacks
betweem OAuth2 Proxy and the usptream server.
Defaults to false.
staticboolStatic will make all requests to this upstream have a static response.
The response will have a body of "Authenticated" and a response code
matching StaticCode.
If StaticCode is not set, the response will return a 200 response.
staticCodeintStaticCode determines the response code for the Static response.
This option can only be used with Static enabled.
flushIntervalDurationFlushInterval is the period between flushing the response buffer when
streaming response from the upstream.
Defaults to 1 second.
passHostHeaderboolPassHostHeader determines whether the request host header should be proxied
to the upstream server.
Defaults to true.
proxyWebSocketsboolProxyWebSockets enables proxying of websockets to upstream servers
Defaults to true.
timeoutDurationTimeout is the maximum duration the server will wait for a response from the upstream server.
Defaults to 30 seconds.

UpstreamConfig​

(Appears on: AlphaOptions)

UpstreamConfig is a collection of definitions for upstream servers.

FieldTypeDescription
proxyRawPathboolProxyRawPath will pass the raw url path to upstream allowing for url's
like: "/%2F/" which would otherwise be redirected to "/"
upstreams[]UpstreamUpstreams represents the configuration for the upstream servers.
Requests will be proxied to this upstream if the path matches the request path.
Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.3.x/configuration/oauth_provider/index.html b/docs/7.3.x/configuration/oauth_provider/index.html index 1adf6d74..703f78e2 100644 --- a/docs/7.3.x/configuration/oauth_provider/index.html +++ b/docs/7.3.x/configuration/oauth_provider/index.html @@ -5,7 +5,7 @@ OAuth Provider Configuration | OAuth2 Proxy - + @@ -50,7 +50,7 @@ to setup the client id and client secret. Your "Redirection URI" will Provider instance. Add a new case to providers.New() to allow oauth2-proxy to use the new Provider.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.3.x/configuration/overview/index.html b/docs/7.3.x/configuration/overview/index.html index 743e4286..dd4f69ae 100644 --- a/docs/7.3.x/configuration/overview/index.html +++ b/docs/7.3.x/configuration/overview/index.html @@ -5,7 +5,7 @@ Overview | OAuth2 Proxy - + @@ -20,7 +20,7 @@ The default format is configured as follows:

{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}

Available variables for request logging:

VariableExampleDescription
Client74.125.224.72The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.
Hostdomain.comThe value of the Host header.
ProtocolHTTP/1.0The request protocol.
RequestDuration0.001The time in seconds that a request took to process.
RequestID00010203-0405-4607-8809-0a0b0c0d0e0fThe request ID pulled from the --request-id-header. Random UUID if empty
RequestMethodGETThe request method.
RequestURI"/oauth2/auth"The URI path of the request.
ResponseSize12The size in bytes of the response.
StatusCode200The HTTP status code of the response.
Timestamp19/Mar/2015:17:20:19 -0400The date and time of the logging event.
Upstream-The upstream data of the HTTP request.
UserAgent-The full user agent as reported by the requesting client.
Usernameusername@email.comThe email or username of the auth request.

Standard Log Format​

All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:

[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE>

If you require a different format than that, you can configure it with the --standard-logging-format flag. The default format is configured as follows:

[{{.Timestamp}}] [{{.File}}] {{.Message}}

Available variables for standard logging:

VariableExampleDescription
Timestamp19/Mar/2015:17:20:19 -0400The date and time of the logging event.
Filemain.go:40The file and line number of the logging statement.
MessageHTTP: listening on 127.0.0.1:4180The details of the log statement.

Configuring for use with the Nginx auth_request directive​

The Nginx auth_request directive allows Nginx to authenticate requests via the oauth2-proxy's /auth endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:

server {
  listen 443 ssl;
  server_name ...;
  include ssl/ssl.conf;

  location /oauth2/ {
    proxy_pass       http://127.0.0.1:4180;
    proxy_set_header Host                    $host;
    proxy_set_header X-Real-IP               $remote_addr;
    proxy_set_header X-Scheme                $scheme;
    proxy_set_header X-Auth-Request-Redirect $request_uri;
    # or, if you are handling multiple domains:
    # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
  }
  location = /oauth2/auth {
    proxy_pass       http://127.0.0.1:4180;
    proxy_set_header Host             $host;
    proxy_set_header X-Real-IP        $remote_addr;
    proxy_set_header X-Scheme         $scheme;
    # nginx auth_request includes headers but not body
    proxy_set_header Content-Length   "";
    proxy_pass_request_body           off;
  }

  location / {
    auth_request /oauth2/auth;
    error_page 401 = /oauth2/sign_in;

    # pass information via X-User and X-Email headers to backend,
    # requires running with --set-xauthrequest flag
    auth_request_set $user   $upstream_http_x_auth_request_user;
    auth_request_set $email  $upstream_http_x_auth_request_email;
    proxy_set_header X-User  $user;
    proxy_set_header X-Email $email;

    # if you enabled --pass-access-token, this will pass the token to the backend
    auth_request_set $token  $upstream_http_x_auth_request_access_token;
    proxy_set_header X-Access-Token $token;

    # if you enabled --cookie-refresh, this is needed for it to work with auth_request
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;

    # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
    # limit and so the OAuth2 Proxy splits these into multiple parts.
    # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
    # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
    auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;

    # Extract the Cookie attributes from the first Set-Cookie header and append them
    # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
    if ($auth_cookie ~* "(; .*)") {
        set $auth_cookie_name_0 $auth_cookie;
        set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
    }

    # Send both Set-Cookie headers now if there was a second part
    if ($auth_cookie_name_upstream_1) {
        add_header Set-Cookie $auth_cookie_name_0;
        add_header Set-Cookie $auth_cookie_name_1;
    }

    proxy_pass http://backend/;
    # or "root /path/to/site;" or "fastcgi_pass ..." etc
  }
}

When you use ingress-nginx in Kubernetes, you MUST use kubernetes/ingress-nginx (which includes the Lua module) and the following configuration snippet for your Ingress. Variables set with auth_request_set are not set-able in plain nginx config when the location is processed via proxy_pass and then may only be processed by Lua. Note that nginxinc/kubernetes-ingress does not include the Lua module.

nginx.ingress.kubernetes.io/auth-response-headers: Authorization
nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
nginx.ingress.kubernetes.io/configuration-snippet: |
  auth_request_set $name_upstream_1 $upstream_cookie_name_1;

  access_by_lua_block {
    if ngx.var.name_upstream_1 ~= "" then
      ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")
    end
  }

It is recommended to use --session-store-type=redis when expecting large sessions/OIDC tokens (e.g. with MS Azure).

You have to substitute name with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".

Configuring for use with the Traefik (v2) ForwardAuth middleware​

This option requires --reverse-proxy option to be set.

ForwardAuth with 401 errors middleware​

The Traefik v2 ForwardAuth middleware allows Traefik to authenticate requests via the oauth2-proxy's /oauth2/auth endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:

http:
  routers:
    a-service:
      rule: "Host(`a-service.example.com`)"
      service: a-service-backend
      middlewares:
        - oauth-errors
        - oauth-auth
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"
    oauth:
      rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"
      middlewares:
        - auth-headers
      service: oauth-backend
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"

  services:
    a-service-backend:
      loadBalancer:
        servers:
          - url: http://172.16.0.2:7555
    oauth-backend:
      loadBalancer:
        servers:
          - url: http://172.16.0.1:4180

  middlewares:
    auth-headers:
      headers:
        sslRedirect: true
        stsSeconds: 315360000
        browserXssFilter: true
        contentTypeNosniff: true
        forceSTSHeader: true
        sslHost: example.com
        stsIncludeSubdomains: true
        stsPreload: true
        frameDeny: true
    oauth-auth:
      forwardAuth:
        address: https://oauth.example.com/oauth2/auth
        trustForwardHeader: true
    oauth-errors:
      errors:
        status:
          - "401-403"
        service: oauth-backend
        query: "/oauth2/sign_in"

ForwardAuth with static upstreams configuration​

Redirect to sign_in functionality provided without the use of errors middleware with Traefik v2 ForwardAuth middleware pointing to oauth2-proxy service's / endpoint

Following options need to be set on oauth2-proxy:

  • --upstream=static://202: Configures a static response for authenticated sessions
  • --reverse-proxy=true: Enables the use of X-Forwarded-* headers to determine redirects correctly
http:
  routers:
    a-service-route-1:
      rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"
      service: a-service-backend
      middlewares:
        - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"
    a-service-route-2:
      rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"
      service: a-service-backend
      middlewares:
        - oauth-auth-wo-redirect # unauthenticated session will return a 401
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"
    services-oauth2-route:
      rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"
      middlewares:
        - auth-headers
      service: oauth-backend
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"
    oauth2-proxy-route:
      rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"
      middlewares:
        - auth-headers
      service: oauth-backend
      tls:
        certResolver: default
        domains:
          - main: "example.com"
            sans:
              - "*.example.com"

  services:
    a-service-backend:
      loadBalancer:
        servers:
          - url: http://172.16.0.2:7555
    b-service-backend:
      loadBalancer:
        servers:
          - url: http://172.16.0.3:7555
    oauth-backend:
      loadBalancer:
        servers:
          - url: http://172.16.0.1:4180

  middlewares:
    auth-headers:
      headers:
        sslRedirect: true
        stsSeconds: 315360000
        browserXssFilter: true
        contentTypeNosniff: true
        forceSTSHeader: true
        sslHost: example.com
        stsIncludeSubdomains: true
        stsPreload: true
        frameDeny: true
    oauth-auth-redirect:
      forwardAuth:
        address: https://oauth.example.com/
        trustForwardHeader: true
        authResponseHeaders:
          - X-Auth-Request-Access-Token
          - Authorization
    oauth-auth-wo-redirect:
      forwardAuth:
        address: https://oauth.example.com/oauth2/auth
        trustForwardHeader: true
        authResponseHeaders:
          - X-Auth-Request-Access-Token
          - Authorization
note

If you set up your OAuth2 provider to rotate your client secret, you can use the client-secret-file option to reload the secret when it is updated.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.3.x/configuration/session_storage/index.html b/docs/7.3.x/configuration/session_storage/index.html index 936771c1..a4bd9344 100644 --- a/docs/7.3.x/configuration/session_storage/index.html +++ b/docs/7.3.x/configuration/session_storage/index.html @@ -5,7 +5,7 @@ Session Storage | OAuth2 Proxy - + @@ -26,7 +26,7 @@ disclosure.

Usage--redis-use-sentinel=true flag, as well as configure the flags --redis-sentinel-master-name and --redis-sentinel-connection-urls appropriately.

Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the --redis-use-cluster=true flag, and configure the flags --redis-cluster-connection-urls appropriately.

Note that flags --redis-use-sentinel=true and --redis-use-cluster=true are mutually exclusive.

Copyright © 2023 OAuth2 Proxy.
- + \ No newline at end of file diff --git a/docs/7.3.x/configuration/tls/index.html b/docs/7.3.x/configuration/tls/index.html index 1db15531..8bbd0535 100644 --- a/docs/7.3.x/configuration/tls/index.html +++ b/docs/7.3.x/configuration/tls/index.html @@ -5,7 +5,7 @@ TLS Configuration | OAuth2 Proxy - + @@ -19,7 +19,7 @@ external load balancer like Amazon ELB or Google Platform Load Balancing) use oauth2-proxy will then authenticate requests for an upstream application. The external endpoint for this example would be https://internal.yourcompany.com/.

An example Nginx config follows. Note the use of Strict-Transport-Security header to pin requests to SSL via HSTS:

server {
    listen 443 default ssl;
    server_name internal.yourcompany.com;
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/cert.key;
    add_header Strict-Transport-Security max-age=2592000;

    location / {
        proxy_pass http://127.0.0.1:4180;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Scheme $scheme;
        proxy_connect_timeout 1;
        proxy_send_timeout 30;
        proxy_read_timeout 30;
    }
}

  • The command line to run oauth2-proxy in this configuration would look like this:

    ./oauth2-proxy \
       --email-domain="yourcompany.com"  \
       --upstream=http://127.0.0.1:8080/ \
       --cookie-secret=... \
       --cookie-secure=true \
       --provider=... \
       --reverse-proxy=true \
       --client-id=... \
       --client-secret=...
    • Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file diff --git a/docs/7.3.x/features/endpoints/index.html b/docs/7.3.x/features/endpoints/index.html index 97cf7716..cdae49bd 100644 --- a/docs/7.3.x/features/endpoints/index.html +++ b/docs/7.3.x/features/endpoints/index.html @@ -5,13 +5,13 @@ Endpoints | OAuth2 Proxy - +
    Version: 7.3.x

    Endpoints

    OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.

    • /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see robotstxt.org for more info
    • /ping - returns a 200 OK response, which is intended for use with health checks
    • /metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by --metrics-address, disabled by default
    • /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
    • /oauth2/sign_out - this URL is used to clear the session cookie
    • /oauth2/start - a URL that will redirect to start the OAuth cycle
    • /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
    • /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
    • /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the Nginx auth_request directive

    Sign out​

    To sign the user out, redirect them to /oauth2/sign_out. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the rd query parameter, i.e. redirect the user to something like (notice the url-encoding!):

    /oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page

    Alternatively, include the redirect URL in the X-Auth-Request-Redirect header:

    GET /oauth2/sign_out HTTP/1.1
    X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
    ...

    (The "sign_out_page" should be the end_session_endpoint from the metadata if your OIDC provider supports Session Management and Discovery.)

    BEWARE that the domain you want to redirect to (my-oidc-provider.example.com in the example) must be added to the --whitelist-domain configuration option otherwise the redirect will be ignored.

    Auth​

    This endpoint returns 202 Accepted response or a 401 Unauthorized response.

    It can be configured using the following query parameters query parameters:

    • allowed_groups: comma separated list of allowed groups
    • allowed_email_domains: comma separated list of allowed email domains
    • allowed_emails: comma separated list of allowed emails
    Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file diff --git a/docs/7.3.x/index.html b/docs/7.3.x/index.html index 9033a8b8..a220bb4f 100644 --- a/docs/7.3.x/index.html +++ b/docs/7.3.x/index.html @@ -5,13 +5,13 @@ Installation | OAuth2 Proxy - +
    Version: 7.3.x

    Installation

    1. Choose how to deploy:

      a. Download Prebuilt Binary (current release is v7.3.0)

      b. Build with $ go get github.com/oauth2-proxy/oauth2-proxy/v7 which will put the binary in $GOPATH/bin

      c. Using the prebuilt docker image quay.io/oauth2-proxy/oauth2-proxy (AMD64, ARMv6 and ARM64 tags available)

      d. Using a Kubernetes manifest (Helm)

    Prebuilt binaries can be validated by extracting the file and verifying it against the sha256sum.txt checksum file provided for each release starting with version v3.0.0.

    $ sha256sum -c sha256sum.txt
    oauth2-proxy-x.y.z.linux-amd64: OK
    1. Select a Provider and Register an OAuth Application with a Provider
    2. Configure OAuth2 Proxy using config file, command line options, or environment variables
    3. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
    Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file diff --git a/docs/behaviour/index.html b/docs/behaviour/index.html index 65a2393f..27732f53 100644 --- a/docs/behaviour/index.html +++ b/docs/behaviour/index.html @@ -5,13 +5,13 @@ Behaviour | OAuth2 Proxy - +
    Version: 7.4.x

    Behaviour

    1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).
    2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with Accept: application/json, in which case 401 Unauthorized is returned)
    3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
    4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)

    Notice that the proxy also provides a number of useful endpoints.

    Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file diff --git a/docs/community/security/index.html b/docs/community/security/index.html index b32750bb..4c67cdab 100644 --- a/docs/community/security/index.html +++ b/docs/community/security/index.html @@ -5,7 +5,7 @@ Security | OAuth2 Proxy - + @@ -29,7 +29,7 @@ If we have multiple security issues in flight simultaneously, we may delay merging fixes until all patches are ready. We may also backport the fix to previous releases, but this will be at the discretion of the maintainers.

    Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file diff --git a/docs/configuration/alpha-config/index.html b/docs/configuration/alpha-config/index.html index dd3990d2..5c8341fe 100644 --- a/docs/configuration/alpha-config/index.html +++ b/docs/configuration/alpha-config/index.html @@ -5,7 +5,7 @@ Alpha Configuration | OAuth2 Proxy - + @@ -63,7 +63,7 @@ passed to the /oauth2/start endpoint are checked to determine wheth they are valid overrides for the given parameter passed to the IdP's login URL. Either Value or Pattern should be supplied, not both.

    FieldTypeDescription
    valuestringA Value rule matches just this specific value
    patternstringA Pattern rule gives a regular expression that must be matched by
    some substring of the value. The expression is not automatically
    anchored to the start and end of the value, if you want to restrict
    the whole parameter value you must anchor it yourself with ^ and $.

    Upstream​

    (Appears on: UpstreamConfig)

    Upstream represents the configuration for an upstream server. Requests will be proxied to this upstream if the path matches the request path.

    FieldTypeDescription
    idstringID should be a unique identifier for the upstream.
    This value is required for all upstreams.
    pathstringPath is used to map requests to the upstream server.
    The closest match will take precedence and all Paths must be unique.
    Path can also take a pattern when used with RewriteTarget.
    Path segments can be captured and matched using regular experessions.
    Eg:
    - ^/foo$: Match only the explicit path /foo
    - ^/bar/$: Match any path prefixed with /bar/
    - ^/baz/(.*)$: Match any path prefixed with /baz and capture the remaining path for use with RewriteTarget
    rewriteTargetstringRewriteTarget allows users to rewrite the request path before it is sent to
    the upstream server.
    Use the Path to capture segments for reuse within the rewrite target.
    Eg: With a Path of ^/baz/(.*), a RewriteTarget of /foo/$1 would rewrite
    the request /baz/abc/123 to /foo/abc/123 before proxying to the
    upstream server.
    uristringThe URI of the upstream server. This may be an HTTP(S) server of a File
    based URL. It may include a path, in which case all requests will be served
    under that path.
    Eg:
    - http://localhost:8080
    - https://service.localhost
    - https://service.localhost/path
    - file://host/path
    If the URI's path is "/base" and the incoming request was for "/dir",
    the upstream request will be for "/base/dir".
    insecureSkipTLSVerifyboolInsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.
    This option is insecure and will allow potential Man-In-The-Middle attacks
    betweem OAuth2 Proxy and the usptream server.
    Defaults to false.
    staticboolStatic will make all requests to this upstream have a static response.
    The response will have a body of "Authenticated" and a response code
    matching StaticCode.
    If StaticCode is not set, the response will return a 200 response.
    staticCodeintStaticCode determines the response code for the Static response.
    This option can only be used with Static enabled.
    flushIntervalDurationFlushInterval is the period between flushing the response buffer when
    streaming response from the upstream.
    Defaults to 1 second.
    passHostHeaderboolPassHostHeader determines whether the request host header should be proxied
    to the upstream server.
    Defaults to true.
    proxyWebSocketsboolProxyWebSockets enables proxying of websockets to upstream servers
    Defaults to true.
    timeoutDurationTimeout is the maximum duration the server will wait for a response from the upstream server.
    Defaults to 30 seconds.

    UpstreamConfig​

    (Appears on: AlphaOptions)

    UpstreamConfig is a collection of definitions for upstream servers.

    FieldTypeDescription
    proxyRawPathboolProxyRawPath will pass the raw url path to upstream allowing for url's
    like: "/%2F/" which would otherwise be redirected to "/"
    upstreams[]UpstreamUpstreams represents the configuration for the upstream servers.
    Requests will be proxied to this upstream if the path matches the request path.
    Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file diff --git a/docs/configuration/oauth_provider/index.html b/docs/configuration/oauth_provider/index.html index 904ce8c0..540fe035 100644 --- a/docs/configuration/oauth_provider/index.html +++ b/docs/configuration/oauth_provider/index.html @@ -5,7 +5,7 @@ OAuth Provider Configuration | OAuth2 Proxy - + @@ -60,7 +60,7 @@ to setup the client id and client secret. Your "Redirection URI" will Provider instance. Add a new case to providers.New() to allow oauth2-proxy to use the new Provider.

    Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file diff --git a/docs/configuration/overview/index.html b/docs/configuration/overview/index.html index e272f057..86336b25 100644 --- a/docs/configuration/overview/index.html +++ b/docs/configuration/overview/index.html @@ -5,7 +5,7 @@ Overview | OAuth2 Proxy - + @@ -20,7 +20,7 @@ The default format is configured as follows:

    {{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}

    Available variables for request logging:

    VariableExampleDescription
    Client74.125.224.72The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.
    Hostdomain.comThe value of the Host header.
    ProtocolHTTP/1.0The request protocol.
    RequestDuration0.001The time in seconds that a request took to process.
    RequestID00010203-0405-4607-8809-0a0b0c0d0e0fThe request ID pulled from the --request-id-header. Random UUID if empty
    RequestMethodGETThe request method.
    RequestURI"/oauth2/auth"The URI path of the request.
    ResponseSize12The size in bytes of the response.
    StatusCode200The HTTP status code of the response.
    Timestamp19/Mar/2015:17:20:19 -0400The date and time of the logging event.
    Upstream-The upstream data of the HTTP request.
    UserAgent-The full user agent as reported by the requesting client.
    Usernameusername@email.comThe email or username of the auth request.

    Standard Log Format​

    All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:

    [19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE>

    If you require a different format than that, you can configure it with the --standard-logging-format flag. The default format is configured as follows:

    [{{.Timestamp}}] [{{.File}}] {{.Message}}

    Available variables for standard logging:

    VariableExampleDescription
    Timestamp19/Mar/2015:17:20:19 -0400The date and time of the logging event.
    Filemain.go:40The file and line number of the logging statement.
    MessageHTTP: listening on 127.0.0.1:4180The details of the log statement.

    Configuring for use with the Nginx auth_request directive​

    The Nginx auth_request directive allows Nginx to authenticate requests via the oauth2-proxy's /auth endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:

    server {
      listen 443 ssl;
      server_name ...;
      include ssl/ssl.conf;

      location /oauth2/ {
        proxy_pass       http://127.0.0.1:4180;
        proxy_set_header Host                    $host;
        proxy_set_header X-Real-IP               $remote_addr;
        proxy_set_header X-Scheme                $scheme;
        proxy_set_header X-Auth-Request-Redirect $request_uri;
        # or, if you are handling multiple domains:
        # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
      }
      location = /oauth2/auth {
        proxy_pass       http://127.0.0.1:4180;
        proxy_set_header Host             $host;
        proxy_set_header X-Real-IP        $remote_addr;
        proxy_set_header X-Scheme         $scheme;
        # nginx auth_request includes headers but not body
        proxy_set_header Content-Length   "";
        proxy_pass_request_body           off;
      }

      location / {
        auth_request /oauth2/auth;
        error_page 401 = /oauth2/sign_in;

        # pass information via X-User and X-Email headers to backend,
        # requires running with --set-xauthrequest flag
        auth_request_set $user   $upstream_http_x_auth_request_user;
        auth_request_set $email  $upstream_http_x_auth_request_email;
        proxy_set_header X-User  $user;
        proxy_set_header X-Email $email;

        # if you enabled --pass-access-token, this will pass the token to the backend
        auth_request_set $token  $upstream_http_x_auth_request_access_token;
        proxy_set_header X-Access-Token $token;

        # if you enabled --cookie-refresh, this is needed for it to work with auth_request
        auth_request_set $auth_cookie $upstream_http_set_cookie;
        add_header Set-Cookie $auth_cookie;

        # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
        # limit and so the OAuth2 Proxy splits these into multiple parts.
        # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
        # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
        auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;

        # Extract the Cookie attributes from the first Set-Cookie header and append them
        # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
        if ($auth_cookie ~* "(; .*)") {
            set $auth_cookie_name_0 $auth_cookie;
            set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
        }

        # Send both Set-Cookie headers now if there was a second part
        if ($auth_cookie_name_upstream_1) {
            add_header Set-Cookie $auth_cookie_name_0;
            add_header Set-Cookie $auth_cookie_name_1;
        }

        proxy_pass http://backend/;
        # or "root /path/to/site;" or "fastcgi_pass ..." etc
      }
    }

    When you use ingress-nginx in Kubernetes, you MUST use kubernetes/ingress-nginx (which includes the Lua module) and the following configuration snippet for your Ingress. Variables set with auth_request_set are not set-able in plain nginx config when the location is processed via proxy_pass and then may only be processed by Lua. Note that nginxinc/kubernetes-ingress does not include the Lua module.

    nginx.ingress.kubernetes.io/auth-response-headers: Authorization
    nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
    nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
    nginx.ingress.kubernetes.io/configuration-snippet: |
      auth_request_set $name_upstream_1 $upstream_cookie_name_1;

      access_by_lua_block {
        if ngx.var.name_upstream_1 ~= "" then
          ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")
        end
      }

    It is recommended to use --session-store-type=redis when expecting large sessions/OIDC tokens (e.g. with MS Azure).

    You have to substitute name with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".

    Configuring for use with the Traefik (v2) ForwardAuth middleware​

    This option requires --reverse-proxy option to be set.

    ForwardAuth with 401 errors middleware​

    The Traefik v2 ForwardAuth middleware allows Traefik to authenticate requests via the oauth2-proxy's /oauth2/auth endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:

    http:
      routers:
        a-service:
          rule: "Host(`a-service.example.com`)"
          service: a-service-backend
          middlewares:
            - oauth-errors
            - oauth-auth
          tls:
            certResolver: default
            domains:
              - main: "example.com"
                sans:
                  - "*.example.com"
        oauth:
          rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"
          middlewares:
            - auth-headers
          service: oauth-backend
          tls:
            certResolver: default
            domains:
              - main: "example.com"
                sans:
                  - "*.example.com"

      services:
        a-service-backend:
          loadBalancer:
            servers:
              - url: http://172.16.0.2:7555
        oauth-backend:
          loadBalancer:
            servers:
              - url: http://172.16.0.1:4180

      middlewares:
        auth-headers:
          headers:
            sslRedirect: true
            stsSeconds: 315360000
            browserXssFilter: true
            contentTypeNosniff: true
            forceSTSHeader: true
            sslHost: example.com
            stsIncludeSubdomains: true
            stsPreload: true
            frameDeny: true
        oauth-auth:
          forwardAuth:
            address: https://oauth.example.com/oauth2/auth
            trustForwardHeader: true
        oauth-errors:
          errors:
            status:
              - "401-403"
            service: oauth-backend
            query: "/oauth2/sign_in"

    ForwardAuth with static upstreams configuration​

    Redirect to sign_in functionality provided without the use of errors middleware with Traefik v2 ForwardAuth middleware pointing to oauth2-proxy service's / endpoint

    Following options need to be set on oauth2-proxy:

    • --upstream=static://202: Configures a static response for authenticated sessions
    • --reverse-proxy=true: Enables the use of X-Forwarded-* headers to determine redirects correctly
    http:
      routers:
        a-service-route-1:
          rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"
          service: a-service-backend
          middlewares:
            - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin
          tls:
            certResolver: default
            domains:
              - main: "example.com"
                sans:
                  - "*.example.com"
        a-service-route-2:
          rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"
          service: a-service-backend
          middlewares:
            - oauth-auth-wo-redirect # unauthenticated session will return a 401
          tls:
            certResolver: default
            domains:
              - main: "example.com"
                sans:
                  - "*.example.com"
        services-oauth2-route:
          rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"
          middlewares:
            - auth-headers
          service: oauth-backend
          tls:
            certResolver: default
            domains:
              - main: "example.com"
                sans:
                  - "*.example.com"
        oauth2-proxy-route:
          rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"
          middlewares:
            - auth-headers
          service: oauth-backend
          tls:
            certResolver: default
            domains:
              - main: "example.com"
                sans:
                  - "*.example.com"

      services:
        a-service-backend:
          loadBalancer:
            servers:
              - url: http://172.16.0.2:7555
        b-service-backend:
          loadBalancer:
            servers:
              - url: http://172.16.0.3:7555
        oauth-backend:
          loadBalancer:
            servers:
              - url: http://172.16.0.1:4180

      middlewares:
        auth-headers:
          headers:
            sslRedirect: true
            stsSeconds: 315360000
            browserXssFilter: true
            contentTypeNosniff: true
            forceSTSHeader: true
            sslHost: example.com
            stsIncludeSubdomains: true
            stsPreload: true
            frameDeny: true
        oauth-auth-redirect:
          forwardAuth:
            address: https://oauth.example.com/
            trustForwardHeader: true
            authResponseHeaders:
              - X-Auth-Request-Access-Token
              - Authorization
        oauth-auth-wo-redirect:
          forwardAuth:
            address: https://oauth.example.com/oauth2/auth
            trustForwardHeader: true
            authResponseHeaders:
              - X-Auth-Request-Access-Token
              - Authorization
    note

    If you set up your OAuth2 provider to rotate your client secret, you can use the client-secret-file option to reload the secret when it is updated.

    Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file diff --git a/docs/configuration/session_storage/index.html b/docs/configuration/session_storage/index.html index 997c1083..7ca686ca 100644 --- a/docs/configuration/session_storage/index.html +++ b/docs/configuration/session_storage/index.html @@ -5,7 +5,7 @@ Session Storage | OAuth2 Proxy - + @@ -28,7 +28,7 @@ and --redis-sentinel-connection-urls appropriately.

    Redis Clu --redis-use-cluster=true flag, and configure the flags --redis-cluster-connection-urls appropriately.

    Note that flags --redis-use-sentinel=true and --redis-use-cluster=true are mutually exclusive.

    Note, if Redis timeout option is set to non-zero, the --redis-connection-idle-timeout must be less than Redis timeout option. For example: if either redis.conf includes timeout 15 or using CONFIG SET timeout 15 the --redis-connection-idle-timeout must be at least --redis-connection-idle-timeout=14

    Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file diff --git a/docs/configuration/tls/index.html b/docs/configuration/tls/index.html index f821972d..371e7827 100644 --- a/docs/configuration/tls/index.html +++ b/docs/configuration/tls/index.html @@ -5,7 +5,7 @@ TLS Configuration | OAuth2 Proxy - + @@ -20,7 +20,7 @@ external load balancer like Amazon ELB or Google Platform Load Balancing) use oauth2-proxy will then authenticate requests for an upstream application. The external endpoint for this example would be https://internal.yourcompany.com/.

    An example Nginx config follows. Note the use of Strict-Transport-Security header to pin requests to SSL via HSTS:

    server {
        listen 443 default ssl;
        server_name internal.yourcompany.com;
        ssl_certificate /path/to/cert.pem;
        ssl_certificate_key /path/to/cert.key;
        add_header Strict-Transport-Security max-age=2592000;

        location / {
            proxy_pass http://127.0.0.1:4180;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Scheme $scheme;
            proxy_connect_timeout 1;
            proxy_send_timeout 30;
            proxy_read_timeout 30;
        }
    }

  • The command line to run oauth2-proxy in this configuration would look like this:

    ./oauth2-proxy \
       --email-domain="yourcompany.com"  \
       --upstream=http://127.0.0.1:8080/ \
       --cookie-secret=... \
       --cookie-secure=true \
       --provider=... \
       --reverse-proxy=true \
       --client-id=... \
       --client-secret=...
    • Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file diff --git a/docs/features/endpoints/index.html b/docs/features/endpoints/index.html index c92432a3..a4b59cd3 100644 --- a/docs/features/endpoints/index.html +++ b/docs/features/endpoints/index.html @@ -5,13 +5,13 @@ Endpoints | OAuth2 Proxy - +
    Version: 7.4.x

    Endpoints

    OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.

    • /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see robotstxt.org for more info
    • /ping - returns a 200 OK response, which is intended for use with health checks
    • /metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by --metrics-address, disabled by default
    • /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
    • /oauth2/sign_out - this URL is used to clear the session cookie
    • /oauth2/start - a URL that will redirect to start the OAuth cycle
    • /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
    • /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
    • /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the Nginx auth_request directive

    Sign out​

    To sign the user out, redirect them to /oauth2/sign_out. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the rd query parameter, i.e. redirect the user to something like (notice the url-encoding!):

    /oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page

    Alternatively, include the redirect URL in the X-Auth-Request-Redirect header:

    GET /oauth2/sign_out HTTP/1.1
    X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
    ...

    (The "sign_out_page" should be the end_session_endpoint from the metadata if your OIDC provider supports Session Management and Discovery.)

    BEWARE that the domain you want to redirect to (my-oidc-provider.example.com in the example) must be added to the --whitelist-domain configuration option otherwise the redirect will be ignored. Make sure to include the actual domain and port (if needed) and not the URL (e.g "localhost:8081" instead of "http://localhost:8081").

    Auth​

    This endpoint returns 202 Accepted response or a 401 Unauthorized response.

    It can be configured using the following query parameters query parameters:

    • allowed_groups: comma separated list of allowed groups
    • allowed_email_domains: comma separated list of allowed email domains
    • allowed_emails: comma separated list of allowed emails
    Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file diff --git a/docs/index.html b/docs/index.html index 7dfe58bb..f1c826a7 100644 --- a/docs/index.html +++ b/docs/index.html @@ -5,13 +5,13 @@ Installation | OAuth2 Proxy - +
    Version: 7.4.x

    Installation

    1. Choose how to deploy:

      a. Download Prebuilt Binary (current release is v7.4.0)

      b. Build with $ go get github.com/oauth2-proxy/oauth2-proxy/v7 which will put the binary in $GOPATH/bin

      c. Using the prebuilt docker image quay.io/oauth2-proxy/oauth2-proxy (AMD64, ARMv6 and ARM64 tags available)

      d. Using a Kubernetes manifest (Helm)

    Prebuilt binaries can be validated by extracting the file and verifying it against the sha256sum.txt checksum file provided for each release starting with version v3.0.0.

    $ sha256sum -c sha256sum.txt
    oauth2-proxy-x.y.z.linux-amd64: OK
    1. Select a Provider and Register an OAuth Application with a Provider
    2. Configure OAuth2 Proxy using config file, command line options, or environment variables
    3. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
    Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file diff --git a/docs/next/behaviour/index.html b/docs/next/behaviour/index.html index 2a09d49f..4002a87f 100644 --- a/docs/next/behaviour/index.html +++ b/docs/next/behaviour/index.html @@ -5,13 +5,13 @@ Behaviour | OAuth2 Proxy - +
    Version: Next

    Behaviour

    1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).
    2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with Accept: application/json, in which case 401 Unauthorized is returned)
    3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
    4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)

    Notice that the proxy also provides a number of useful endpoints.

    Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file diff --git a/docs/next/community/security/index.html b/docs/next/community/security/index.html index e72b5f4a..ba3ee226 100644 --- a/docs/next/community/security/index.html +++ b/docs/next/community/security/index.html @@ -5,7 +5,7 @@ Security | OAuth2 Proxy - + @@ -29,7 +29,7 @@ If we have multiple security issues in flight simultaneously, we may delay merging fixes until all patches are ready. We may also backport the fix to previous releases, but this will be at the discretion of the maintainers.

    Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file diff --git a/docs/next/configuration/alpha-config/index.html b/docs/next/configuration/alpha-config/index.html index 85d9db72..33b223f6 100644 --- a/docs/next/configuration/alpha-config/index.html +++ b/docs/next/configuration/alpha-config/index.html @@ -5,7 +5,7 @@ Alpha Configuration | OAuth2 Proxy - + @@ -63,7 +63,7 @@ passed to the /oauth2/start endpoint are checked to determine wheth they are valid overrides for the given parameter passed to the IdP's login URL. Either Value or Pattern should be supplied, not both.

    FieldTypeDescription
    valuestringA Value rule matches just this specific value
    patternstringA Pattern rule gives a regular expression that must be matched by
    some substring of the value. The expression is not automatically
    anchored to the start and end of the value, if you want to restrict
    the whole parameter value you must anchor it yourself with ^ and $.

    Upstream​

    (Appears on: UpstreamConfig)

    Upstream represents the configuration for an upstream server. Requests will be proxied to this upstream if the path matches the request path.

    FieldTypeDescription
    idstringID should be a unique identifier for the upstream.
    This value is required for all upstreams.
    pathstringPath is used to map requests to the upstream server.
    The closest match will take precedence and all Paths must be unique.
    Path can also take a pattern when used with RewriteTarget.
    Path segments can be captured and matched using regular experessions.
    Eg:
    - ^/foo$: Match only the explicit path /foo
    - ^/bar/$: Match any path prefixed with /bar/
    - ^/baz/(.*)$: Match any path prefixed with /baz and capture the remaining path for use with RewriteTarget
    rewriteTargetstringRewriteTarget allows users to rewrite the request path before it is sent to
    the upstream server.
    Use the Path to capture segments for reuse within the rewrite target.
    Eg: With a Path of ^/baz/(.*), a RewriteTarget of /foo/$1 would rewrite
    the request /baz/abc/123 to /foo/abc/123 before proxying to the
    upstream server.
    uristringThe URI of the upstream server. This may be an HTTP(S) server of a File
    based URL. It may include a path, in which case all requests will be served
    under that path.
    Eg:
    - http://localhost:8080
    - https://service.localhost
    - https://service.localhost/path
    - file://host/path
    If the URI's path is "/base" and the incoming request was for "/dir",
    the upstream request will be for "/base/dir".
    insecureSkipTLSVerifyboolInsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.
    This option is insecure and will allow potential Man-In-The-Middle attacks
    betweem OAuth2 Proxy and the usptream server.
    Defaults to false.
    staticboolStatic will make all requests to this upstream have a static response.
    The response will have a body of "Authenticated" and a response code
    matching StaticCode.
    If StaticCode is not set, the response will return a 200 response.
    staticCodeintStaticCode determines the response code for the Static response.
    This option can only be used with Static enabled.
    flushIntervalDurationFlushInterval is the period between flushing the response buffer when
    streaming response from the upstream.
    Defaults to 1 second.
    passHostHeaderboolPassHostHeader determines whether the request host header should be proxied
    to the upstream server.
    Defaults to true.
    proxyWebSocketsboolProxyWebSockets enables proxying of websockets to upstream servers
    Defaults to true.
    timeoutDurationTimeout is the maximum duration the server will wait for a response from the upstream server.
    Defaults to 30 seconds.

    UpstreamConfig​

    (Appears on: AlphaOptions)

    UpstreamConfig is a collection of definitions for upstream servers.

    FieldTypeDescription
    proxyRawPathboolProxyRawPath will pass the raw url path to upstream allowing for url's
    like: "/%2F/" which would otherwise be redirected to "/"
    upstreams[]UpstreamUpstreams represents the configuration for the upstream servers.
    Requests will be proxied to this upstream if the path matches the request path.
    Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file diff --git a/docs/next/configuration/oauth_provider/index.html b/docs/next/configuration/oauth_provider/index.html index cb94695a..7a535ce6 100644 --- a/docs/next/configuration/oauth_provider/index.html +++ b/docs/next/configuration/oauth_provider/index.html @@ -5,7 +5,7 @@ OAuth Provider Configuration | OAuth2 Proxy - + @@ -25,7 +25,16 @@ should resolve this.

    If these are unset but a groups mapper is set up above in step (3), the provider will still populate the X-Forwarded-Groups header to your upstream server with the groups data in the Keycloak userinfo endpoint response.

    The group management in keycloak is using a tree. If you create a group named admin in keycloak -you should define the 'keycloak-group' value to /admin.

    Keycloak OIDC Auth Provider​

    1. Create new client in your Keycloak realm with Access Type 'confidental', Client protocol 'openid-connect' and Valid Redirect URIs 'https://internal.yourcompany.com/oauth2/callback'
    2. Take note of the Secret in the credential tab of the client
    3. Create a mapper with Mapper Type 'Group Membership' and Token Claim Name 'groups'.
    4. Create a mapper with Mapper Type 'Audience' and Included Client Audience and Included Custom Audience set to your client name.

    Make sure you set the following to the appropriate url:

        --provider=keycloak-oidc
        --client-id=<your client's id>
        --client-secret=<your client's secret>
        --redirect-url=https://myapp.com/oauth2/callback
        --oidc-issuer-url=https://<keycloak host>/auth/realms/<your realm>
        --allowed-role=<realm role name> // Optional, required realm role
        --allowed-role=<client id>:<client role name> // Optional, required client role

    GitLab Auth Provider​

    This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see 994).

    Whether you are using GitLab.com or self-hosting GitLab, follow these steps to add an application. Make sure to enable at least the openid, profile and email scopes, and set the redirect url to your application url e.g. https://myapp.com/oauth2/callback.

    If you need projects filtering, add the extra read_api scope to your application.

    The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow these steps

        --provider="gitlab"
        --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab
        --client-id=GITLAB_CLIENT_ID
        --client-secret=GITLAB_CLIENT_SECRET
        --cookie-secret=COOKIE_SECRET

    Restricting by group membership is possible with the following option:

    --gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma

    If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:

    --oidc-issuer-url="<your gitlab url>"

    If your self-hosted GitLab is on a sub-directory (e.g. domain.tld/gitlab), as opposed to its own sub-domain (e.g. gitlab.domain.tld), you may need to add a redirect from domain.tld/oauth pointing at e.g. domain.tld/gitlab/oauth.

    LinkedIn Auth Provider​

    For LinkedIn, the registration steps are:

    1. Create a new project: https://www.linkedin.com/secure/developer
    2. In the OAuth User Agreement section:
      • In default scope, select r_basicprofile and r_emailaddress.
      • In "OAuth 2.0 Redirect URLs", enter https://internal.yourcompany.com/oauth2/callback
    3. Fill in the remaining required fields and Save.
    4. Take note of the Consumer Key / API Key and Consumer Secret / Secret Key

    Microsoft Azure AD Provider​

    For adding an application to the Microsoft Azure AD follow these steps to add an application.

    Take note of your TenantId if applicable for your situation. The TenantId can be used to override the default common authorization server with a tenant specific server.

    OpenID Connect Provider​

    OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects.

    This provider was originally built against CoreOS Dex and we will use it as an example. +you should define the 'keycloak-group' value to /admin.

    Keycloak OIDC Auth Provider​

        --provider=keycloak-oidc
        --client-id=<your client's id>
        --client-secret=<your client's secret>
        --redirect-url=https://internal.yourcompany.com/oauth2/callback
        --oidc-issuer-url=https://<keycloak host>/auth/realms/<your realm>
        --email-domain=<yourcompany.com> // Validate email domain for users, see option documentation
        --allowed-role=<realm role name> // Optional, required realm role
        --allowed-role=<client id>:<client role name> // Optional, required client role
        --allowed-group=</group name> // Optional, requires group client scope
        --code-challenge-method=S256 // PKCE
    note

    Keycloak has updated its admin console and as of version 19.0.0, the new admin console is enabled by default. The legacy admin console has been announced for removal with the release of version 21.0.0.

    Keycloak legacy admin console

    1. Create new client in your Keycloak realm with Access Type 'confidential', Client protocol 'openid-connect' and Valid Redirect URIs 'https://internal.yourcompany.com/oauth2/callback'
    2. Take note of the Secret in the credential tab of the client
    3. Create a mapper with Mapper Type 'Group Membership' and Token Claim Name 'groups'.
    4. Create a mapper with Mapper Type 'Audience' and Included Client Audience and Included Custom Audience set to your client name.

    Keycloak new admin console (default as of v19.0.0)

    The following example shows how to create a simple OIDC client using the new Keycloak admin2 console. However, for best practices, it is recommended to consult the Keycloak documentation.

    The OIDC client must be configured with an audience mapper to include the client's name in the aud claim of the JWT token.
    +The aud claim specifies the intended recipient of the token, and OAuth2 Proxy expects a match against the values of either --client-id or --oidc-extra-audience.

    In Keycloak, claims are added to JWT tokens through the use of mappers at either the realm level using "client scopes" or through "dedicated" client mappers.

    Creating the client

    1. Create a new OIDC client in your Keycloak realm by navigating to:
      Clients -> Create client
    • Client Type 'OpenID Connect'
    • Client ID <your client's id>, please complete the remaining fields as appropriate and click Next.
      • Client authentication 'On'
      • Authentication flow
        • Standard flow 'selected'
        • Direct access grants 'deselect'
          • Save the configuration.
      • Settings / Access settings:
        • Valid redirect URIs https://internal.yourcompany.com/oauth2/callback
          • Save the configuration.
      • Under the Credentials tab you will now be able to locate <your client's secret>.
    1. Configure a dedicated audience mapper for your client by navigating to Clients -> <your client's id> -> Client scopes.
    • Access the dedicated mappers pane by clicking <your client's id>-dedicated, located under Assigned client scope.
      (It should have a description of "Dedicated scope and mappers for this client")
      • Click Configure a new mapper and select Audience
        • Name 'aud-mapper-<your client's id>'
        • Included Client Audience select <your client's id> from the dropdown.
          • OAuth2 proxy can be set up to pass both the access and ID JWT tokens to your upstream services. +If you require additional audience entries, you can use the Included Custom Audience field in addition to the "Included Client Audience" dropdown. Note that the "aud" claim of a JWT token should be limited and only specify its intended recipients.
        • Add to ID token 'On'
        • Add to access token 'On' - #1916
          • Save the configuration.
    • Any subsequent dedicated client mappers can be defined by clicking Dedicated scopes -> Add mapper -> By configuration -> Select mapper

    You should now be able to create a test user in Keycloak and get access to the OAuth2 Proxy instance, make sure to set an email address matching <yourcompany.com> and select Email verified.

    Authorization

    OAuth2 Proxy will perform authorization by requiring a valid user, this authorization can be extended to take into account a user's membership in Keycloak groups, realm roles, and client roles using the keycloak-oidc provider options
    --allowed-role or --allowed-group

    Roles

    A standard Keycloak installation comes with the required mappers for realm roles and client roles through the pre-defined client scope "roles". +This ensures that any roles assigned to a user are included in the JWT tokens when using an OIDC client that has the "Full scope allowed" feature activated, the feature is enabled by default.

    Creating a realm role

    • Navigate to Realm roles -> Create role
      • Role name, <realm role name> -> save

    Creating a client role

    • Navigate to Clients -> <your client's id> -> Roles -> Create role
      • Role name, <client role name> -> save

    Assign a role to a user

    Users -> Username -> Role mapping -> Assign role -> filter by roles or clients and select -> Assign.

    Keycloak "realm roles" can be authorized using the --allowed-role=<realm role name> option, while "client roles" can be evaluated using --allowed-role=<your client's id>:<client role name>.

    You may limit the realm roles included in the JWT tokens for any given client by navigating to:
    +Clients -> <your client's id> -> Client scopes -> <your client's id>-dedicated -> Scope
    +Disabling Full scope allowed activates the Assign role option, allowing you to select which roles, if assigned to a user, will be included in the user's JWT tokens. This can be useful when a user has many associated roles, and you want to reduce the size and impact of the JWT token.

    Groups

    You may also do authorization on group memberships by using the OAuth2 Proxy option --allowed-group.
    +We will only do a brief description of creating the required client scope groups and refer you to read the Keycloak documentation.

    To summarize, the steps required to authorize Keycloak group membership with OAuth2 Proxy are as follows:

    • Create a new Client Scope with the name groups in Keycloak.
      • Include a mapper of type Group Membership.
      • Set the "Token Claim Name" to groups or customize by matching it to the --oidc-groups-claim option of OAuth2 Proxy.
      • If the "Full group path" option is selected, you need to include a "/" separator in the group names defined in the --allowed-group option of OAuth2 Proxy. Example: "/groupname" or "/groupname/childgroup".

    After creating the Client Scope named groups you will need to attach it to your client.
    +Clients -> <your client's id> -> Client scopes -> Add client scope -> Select groups and choose Optional and you should now have a client that maps group memberships into the JWT tokens so that Oauth2 Proxy may evaluate them.

    Create a group by navigating to Groups -> Create group and add your test user as a member.

    The OAuth2 Proxy option --allowed-group=/groupname will now allow you to filter on group membership

    Keycloak also has the option of attaching roles to groups, please refer to the Keycloak documentation for more information.

    Tip

    To check if roles or groups are added to JWT tokens, you can preview a users token in the Keycloak console by following these steps: +Clients -> <your client's id> -> Client scopes -> Evaluate.
    +Select a realm user and optional scope parameters such as groups, and generate the JSON representation of an access or id token to examine its contents.

    GitLab Auth Provider​

    This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see 994).

    Whether you are using GitLab.com or self-hosting GitLab, follow these steps to add an application. Make sure to enable at least the openid, profile and email scopes, and set the redirect url to your application url e.g. https://myapp.com/oauth2/callback.

    If you need projects filtering, add the extra read_api scope to your application.

    The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow these steps

        --provider="gitlab"
        --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab
        --client-id=GITLAB_CLIENT_ID
        --client-secret=GITLAB_CLIENT_SECRET
        --cookie-secret=COOKIE_SECRET

    Restricting by group membership is possible with the following option:

    --gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma

    If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:

    --oidc-issuer-url="<your gitlab url>"

    If your self-hosted GitLab is on a sub-directory (e.g. domain.tld/gitlab), as opposed to its own sub-domain (e.g. gitlab.domain.tld), you may need to add a redirect from domain.tld/oauth pointing at e.g. domain.tld/gitlab/oauth.

    LinkedIn Auth Provider​

    For LinkedIn, the registration steps are:

    1. Create a new project: https://www.linkedin.com/secure/developer
    2. In the OAuth User Agreement section:
      • In default scope, select r_basicprofile and r_emailaddress.
      • In "OAuth 2.0 Redirect URLs", enter https://internal.yourcompany.com/oauth2/callback
    3. Fill in the remaining required fields and Save.
    4. Take note of the Consumer Key / API Key and Consumer Secret / Secret Key

    Microsoft Azure AD Provider​

    For adding an application to the Microsoft Azure AD follow these steps to add an application.

    Take note of your TenantId if applicable for your situation. The TenantId can be used to override the default common authorization server with a tenant specific server.

    OpenID Connect Provider​

    OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects.

    This provider was originally built against CoreOS Dex and we will use it as an example. The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below.

    Dex​

    To configure the OIDC provider for Dex, perform the following steps:

    1. Download Dex:

      go get github.com/dexidp/dex

      See the getting started guide for more details.

    2. Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the staticClients section of examples/config-dev.yaml:

      - id: oauth2-proxy
      redirectURIs:
      - 'http://127.0.0.1:4180/oauth2/callback'
      name: 'oauth2-proxy'
      secret: proxy

    3. Launch Dex: from $GOPATH/github.com/dexidp/dex, run:

      bin/dex serve examples/config-dev.yaml

    4. In a second terminal, run the oauth2-proxy with the following args:

      -provider oidc
      -provider-display-name "My OIDC Provider"
      -client-id oauth2-proxy
      -client-secret proxy
      -redirect-url http://127.0.0.1:4180/oauth2/callback
      -oidc-issuer-url http://127.0.0.1:5556/dex
      -cookie-secure=false
      -cookie-secret=secret
      -email-domain kilgore.trout

      To serve the current working directory as a web site under the /static endpoint, add:

      -upstream file://$PWD/#/static/

    5. Test the setup by visiting http://127.0.0.1:4180 or http://127.0.0.1:4180/static .

    See also our local testing environment for a self-contained example using Docker and etcd as storage for Dex.

    Okta​

    To configure the OIDC provider for Okta, perform the following steps:

    1. Log in to Okta using an administrative account. It is suggested you try this in preview first, example.oktapreview.com
    2. (OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications, you may wish to configure an authorization server for each application. Otherwise, the provided default will work.
    • Navigate to Security then select API
    • Click Add Authorization Server, if this option is not available you may require an additional license for a custom authorization server.
    • Fill out the Name with something to describe the application you are protecting. e.g. 'Example App'.
    • For Audience, pick the URL of the application you wish to protect: https://example.corp.com
    • Fill out a Description
    • Add any Access Policies you wish to configure to limit application access.
    • The default settings will work for other options. See Okta documentation for more information on Authorization Servers
    1. Navigate to Applications then select Add Application.
    • Select Web for the Platform setting.
    • Select OpenID Connect and click Create
    • Pick an Application Name such as Example App.
    • Set the Login redirect URI to https://example.corp.com.
    • Under General set the Allowed grant types to Authorization Code and Refresh Token.
    • Leave the rest as default, taking note of the Client ID and Client Secret.
    • Under Assignments select the users or groups you wish to access your application.

    1. Create a configuration file like the following:

      provider = "oidc"
      redirect_url = "https://example.corp.com/oauth2/callback"
      oidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"
      upstreams = [
          "https://example.corp.com"
      ]
      email_domains = [
          "corp.com"
      ]
      client_id = "XXXXX"
      client_secret = "YYYYY"
      pass_access_token = true
      cookie_secret = "ZZZZZ"
      skip_provider_button = true

    The oidc_issuer_url is based on URL from your Authorization Server's Issuer field in step 2, or simply https://corp.okta.com . @@ -60,7 +69,7 @@ to setup the client id and client secret. Your "Redirection URI" will Provider instance. Add a new case to providers.New() to allow oauth2-proxy to use the new Provider.

    Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file diff --git a/docs/next/configuration/overview/index.html b/docs/next/configuration/overview/index.html index 640b6e76..9b02f4fa 100644 --- a/docs/next/configuration/overview/index.html +++ b/docs/next/configuration/overview/index.html @@ -5,7 +5,7 @@ Overview | OAuth2 Proxy - + @@ -20,7 +20,7 @@ The default format is configured as follows:

    {{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}

    Available variables for request logging:

    VariableExampleDescription
    Client74.125.224.72The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.
    Hostdomain.comThe value of the Host header.
    ProtocolHTTP/1.0The request protocol.
    RequestDuration0.001The time in seconds that a request took to process.
    RequestID00010203-0405-4607-8809-0a0b0c0d0e0fThe request ID pulled from the --request-id-header. Random UUID if empty
    RequestMethodGETThe request method.
    RequestURI"/oauth2/auth"The URI path of the request.
    ResponseSize12The size in bytes of the response.
    StatusCode200The HTTP status code of the response.
    Timestamp19/Mar/2015:17:20:19 -0400The date and time of the logging event.
    Upstream-The upstream data of the HTTP request.
    UserAgent-The full user agent as reported by the requesting client.
    Usernameusername@email.comThe email or username of the auth request.

    Standard Log Format​

    All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:

    [19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE>

    If you require a different format than that, you can configure it with the --standard-logging-format flag. The default format is configured as follows:

    [{{.Timestamp}}] [{{.File}}] {{.Message}}

    Available variables for standard logging:

    VariableExampleDescription
    Timestamp19/Mar/2015:17:20:19 -0400The date and time of the logging event.
    Filemain.go:40The file and line number of the logging statement.
    MessageHTTP: listening on 127.0.0.1:4180The details of the log statement.

    Configuring for use with the Nginx auth_request directive​

    The Nginx auth_request directive allows Nginx to authenticate requests via the oauth2-proxy's /auth endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:

    server {
      listen 443 ssl;
      server_name ...;
      include ssl/ssl.conf;

      location /oauth2/ {
        proxy_pass       http://127.0.0.1:4180;
        proxy_set_header Host                    $host;
        proxy_set_header X-Real-IP               $remote_addr;
        proxy_set_header X-Scheme                $scheme;
        proxy_set_header X-Auth-Request-Redirect $request_uri;
        # or, if you are handling multiple domains:
        # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
      }
      location = /oauth2/auth {
        proxy_pass       http://127.0.0.1:4180;
        proxy_set_header Host             $host;
        proxy_set_header X-Real-IP        $remote_addr;
        proxy_set_header X-Scheme         $scheme;
        # nginx auth_request includes headers but not body
        proxy_set_header Content-Length   "";
        proxy_pass_request_body           off;
      }

      location / {
        auth_request /oauth2/auth;
        error_page 401 = /oauth2/sign_in;

        # pass information via X-User and X-Email headers to backend,
        # requires running with --set-xauthrequest flag
        auth_request_set $user   $upstream_http_x_auth_request_user;
        auth_request_set $email  $upstream_http_x_auth_request_email;
        proxy_set_header X-User  $user;
        proxy_set_header X-Email $email;

        # if you enabled --pass-access-token, this will pass the token to the backend
        auth_request_set $token  $upstream_http_x_auth_request_access_token;
        proxy_set_header X-Access-Token $token;

        # if you enabled --cookie-refresh, this is needed for it to work with auth_request
        auth_request_set $auth_cookie $upstream_http_set_cookie;
        add_header Set-Cookie $auth_cookie;

        # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
        # limit and so the OAuth2 Proxy splits these into multiple parts.
        # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
        # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
        auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;

        # Extract the Cookie attributes from the first Set-Cookie header and append them
        # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
        if ($auth_cookie ~* "(; .*)") {
            set $auth_cookie_name_0 $auth_cookie;
            set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
        }

        # Send both Set-Cookie headers now if there was a second part
        if ($auth_cookie_name_upstream_1) {
            add_header Set-Cookie $auth_cookie_name_0;
            add_header Set-Cookie $auth_cookie_name_1;
        }

        proxy_pass http://backend/;
        # or "root /path/to/site;" or "fastcgi_pass ..." etc
      }
    }

    When you use ingress-nginx in Kubernetes, you MUST use kubernetes/ingress-nginx (which includes the Lua module) and the following configuration snippet for your Ingress. Variables set with auth_request_set are not set-able in plain nginx config when the location is processed via proxy_pass and then may only be processed by Lua. Note that nginxinc/kubernetes-ingress does not include the Lua module.

    nginx.ingress.kubernetes.io/auth-response-headers: Authorization
    nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
    nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
    nginx.ingress.kubernetes.io/configuration-snippet: |
      auth_request_set $name_upstream_1 $upstream_cookie_name_1;

      access_by_lua_block {
        if ngx.var.name_upstream_1 ~= "" then
          ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")
        end
      }

    It is recommended to use --session-store-type=redis when expecting large sessions/OIDC tokens (e.g. with MS Azure).

    You have to substitute name with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".

    Configuring for use with the Traefik (v2) ForwardAuth middleware​

    This option requires --reverse-proxy option to be set.

    ForwardAuth with 401 errors middleware​

    The Traefik v2 ForwardAuth middleware allows Traefik to authenticate requests via the oauth2-proxy's /oauth2/auth endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:

    http:
      routers:
        a-service:
          rule: "Host(`a-service.example.com`)"
          service: a-service-backend
          middlewares:
            - oauth-errors
            - oauth-auth
          tls:
            certResolver: default
            domains:
              - main: "example.com"
                sans:
                  - "*.example.com"
        oauth:
          rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"
          middlewares:
            - auth-headers
          service: oauth-backend
          tls:
            certResolver: default
            domains:
              - main: "example.com"
                sans:
                  - "*.example.com"

      services:
        a-service-backend:
          loadBalancer:
            servers:
              - url: http://172.16.0.2:7555
        oauth-backend:
          loadBalancer:
            servers:
              - url: http://172.16.0.1:4180

      middlewares:
        auth-headers:
          headers:
            sslRedirect: true
            stsSeconds: 315360000
            browserXssFilter: true
            contentTypeNosniff: true
            forceSTSHeader: true
            sslHost: example.com
            stsIncludeSubdomains: true
            stsPreload: true
            frameDeny: true
        oauth-auth:
          forwardAuth:
            address: https://oauth.example.com/oauth2/auth
            trustForwardHeader: true
        oauth-errors:
          errors:
            status:
              - "401-403"
            service: oauth-backend
            query: "/oauth2/sign_in"

    ForwardAuth with static upstreams configuration​

    Redirect to sign_in functionality provided without the use of errors middleware with Traefik v2 ForwardAuth middleware pointing to oauth2-proxy service's / endpoint

    Following options need to be set on oauth2-proxy:

    • --upstream=static://202: Configures a static response for authenticated sessions
    • --reverse-proxy=true: Enables the use of X-Forwarded-* headers to determine redirects correctly
    http:
      routers:
        a-service-route-1:
          rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"
          service: a-service-backend
          middlewares:
            - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin
          tls:
            certResolver: default
            domains:
              - main: "example.com"
                sans:
                  - "*.example.com"
        a-service-route-2:
          rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"
          service: a-service-backend
          middlewares:
            - oauth-auth-wo-redirect # unauthenticated session will return a 401
          tls:
            certResolver: default
            domains:
              - main: "example.com"
                sans:
                  - "*.example.com"
        services-oauth2-route:
          rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"
          middlewares:
            - auth-headers
          service: oauth-backend
          tls:
            certResolver: default
            domains:
              - main: "example.com"
                sans:
                  - "*.example.com"
        oauth2-proxy-route:
          rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"
          middlewares:
            - auth-headers
          service: oauth-backend
          tls:
            certResolver: default
            domains:
              - main: "example.com"
                sans:
                  - "*.example.com"

      services:
        a-service-backend:
          loadBalancer:
            servers:
              - url: http://172.16.0.2:7555
        b-service-backend:
          loadBalancer:
            servers:
              - url: http://172.16.0.3:7555
        oauth-backend:
          loadBalancer:
            servers:
              - url: http://172.16.0.1:4180

      middlewares:
        auth-headers:
          headers:
            sslRedirect: true
            stsSeconds: 315360000
            browserXssFilter: true
            contentTypeNosniff: true
            forceSTSHeader: true
            sslHost: example.com
            stsIncludeSubdomains: true
            stsPreload: true
            frameDeny: true
        oauth-auth-redirect:
          forwardAuth:
            address: https://oauth.example.com/
            trustForwardHeader: true
            authResponseHeaders:
              - X-Auth-Request-Access-Token
              - Authorization
        oauth-auth-wo-redirect:
          forwardAuth:
            address: https://oauth.example.com/oauth2/auth
            trustForwardHeader: true
            authResponseHeaders:
              - X-Auth-Request-Access-Token
              - Authorization
    note

    If you set up your OAuth2 provider to rotate your client secret, you can use the client-secret-file option to reload the secret when it is updated.

    Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file diff --git a/docs/next/configuration/session_storage/index.html b/docs/next/configuration/session_storage/index.html index 12fea16d..9fffc63a 100644 --- a/docs/next/configuration/session_storage/index.html +++ b/docs/next/configuration/session_storage/index.html @@ -5,7 +5,7 @@ Session Storage | OAuth2 Proxy - + @@ -28,7 +28,7 @@ and --redis-sentinel-connection-urls appropriately.

    Redis Clu --redis-use-cluster=true flag, and configure the flags --redis-cluster-connection-urls appropriately.

    Note that flags --redis-use-sentinel=true and --redis-use-cluster=true are mutually exclusive.

    Note, if Redis timeout option is set to non-zero, the --redis-connection-idle-timeout must be less than Redis timeout option. For example: if either redis.conf includes timeout 15 or using CONFIG SET timeout 15 the --redis-connection-idle-timeout must be at least --redis-connection-idle-timeout=14

    Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file diff --git a/docs/next/configuration/tls/index.html b/docs/next/configuration/tls/index.html index efcdeb1e..8b79f28b 100644 --- a/docs/next/configuration/tls/index.html +++ b/docs/next/configuration/tls/index.html @@ -5,7 +5,7 @@ TLS Configuration | OAuth2 Proxy - + @@ -20,7 +20,7 @@ external load balancer like Amazon ELB or Google Platform Load Balancing) use oauth2-proxy will then authenticate requests for an upstream application. The external endpoint for this example would be https://internal.yourcompany.com/.

    An example Nginx config follows. Note the use of Strict-Transport-Security header to pin requests to SSL via HSTS:

    server {
        listen 443 default ssl;
        server_name internal.yourcompany.com;
        ssl_certificate /path/to/cert.pem;
        ssl_certificate_key /path/to/cert.key;
        add_header Strict-Transport-Security max-age=2592000;

        location / {
            proxy_pass http://127.0.0.1:4180;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Scheme $scheme;
            proxy_connect_timeout 1;
            proxy_send_timeout 30;
            proxy_read_timeout 30;
        }
    }

  • The command line to run oauth2-proxy in this configuration would look like this:

    ./oauth2-proxy \
       --email-domain="yourcompany.com"  \
       --upstream=http://127.0.0.1:8080/ \
       --cookie-secret=... \
       --cookie-secure=true \
       --provider=... \
       --reverse-proxy=true \
       --client-id=... \
       --client-secret=...
    • Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file diff --git a/docs/next/features/endpoints/index.html b/docs/next/features/endpoints/index.html index bda1ece7..910c7ebf 100644 --- a/docs/next/features/endpoints/index.html +++ b/docs/next/features/endpoints/index.html @@ -5,13 +5,13 @@ Endpoints | OAuth2 Proxy - +
    Version: Next

    Endpoints

    OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.

    • /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see robotstxt.org for more info
    • /ping - returns a 200 OK response, which is intended for use with health checks
    • /ready - returns a 200 OK response if all the underlying connections (e.g., Redis store) are connected
    • /metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by --metrics-address, disabled by default
    • /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
    • /oauth2/sign_out - this URL is used to clear the session cookie
    • /oauth2/start - a URL that will redirect to start the OAuth cycle
    • /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
    • /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
    • /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the Nginx auth_request directive

    Sign out​

    To sign the user out, redirect them to /oauth2/sign_out. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the rd query parameter, i.e. redirect the user to something like (notice the url-encoding!):

    /oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page

    Alternatively, include the redirect URL in the X-Auth-Request-Redirect header:

    GET /oauth2/sign_out HTTP/1.1
    X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
    ...

    (The "sign_out_page" should be the end_session_endpoint from the metadata if your OIDC provider supports Session Management and Discovery.)

    BEWARE that the domain you want to redirect to (my-oidc-provider.example.com in the example) must be added to the --whitelist-domain configuration option otherwise the redirect will be ignored. Make sure to include the actual domain and port (if needed) and not the URL (e.g "localhost:8081" instead of "http://localhost:8081").

    Auth​

    This endpoint returns 202 Accepted response or a 401 Unauthorized response.

    It can be configured using the following query parameters query parameters:

    • allowed_groups: comma separated list of allowed groups
    • allowed_email_domains: comma separated list of allowed email domains
    • allowed_emails: comma separated list of allowed emails
    Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file diff --git a/docs/next/index.html b/docs/next/index.html index cb38e319..966ca78f 100644 --- a/docs/next/index.html +++ b/docs/next/index.html @@ -5,13 +5,13 @@ Installation | OAuth2 Proxy - +
    Version: Next

    Installation

    1. Choose how to deploy:

      a. Download Prebuilt Binary (current release is v7.4.0)

      b. Build with $ go get github.com/oauth2-proxy/oauth2-proxy/v7 which will put the binary in $GOPATH/bin

      c. Using the prebuilt docker image quay.io/oauth2-proxy/oauth2-proxy (AMD64, ARMv6 and ARM64 tags available)

      d. Using a Kubernetes manifest (Helm)

    Prebuilt binaries can be validated by extracting the file and verifying it against the sha256sum.txt checksum file provided for each release starting with version v3.0.0.

    $ sha256sum -c sha256sum.txt
    oauth2-proxy-x.y.z.linux-amd64: OK
    1. Select a Provider and Register an OAuth Application with a Provider
    2. Configure OAuth2 Proxy using config file, command line options, or environment variables
    3. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
    Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file diff --git a/index.html b/index.html index a2571007..153ad513 100644 --- a/index.html +++ b/index.html @@ -5,7 +5,7 @@ Welcome to OAuth2 Proxy | OAuth2 Proxy - + @@ -14,7 +14,7 @@ to validate accounts by email, domain or group.

    note

    This repository was forked from bitly/OAuth2_Proxy on 27/11/2018. Versions v3.0.0 and up are from this fork and will have diverged from any changes in the original fork. A list of changes can be seen in the CHANGELOG.

    Sign In Page

    Architecture​

    OAuth2 Proxy Architecture

    Copyright © 2023 OAuth2 Proxy.
    - + \ No newline at end of file