diff --git a/404.html b/404.html index 85b883d5..7bf359a4 100644 --- a/404.html +++ b/404.html @@ -6,14 +6,14 @@ Page Not Found | OAuth2 Proxy - +

Page Not Found

We could not find what you were looking for.

Please contact the owner of the site that linked you to the original URL and let them know their link is broken.

- + \ No newline at end of file diff --git a/cd4a49c1.23aff2c4.js b/cd4a49c1.23aff2c4.js deleted file mode 100644 index 46108a47..00000000 --- a/cd4a49c1.23aff2c4.js +++ /dev/null @@ -1 +0,0 @@ -(window.webpackJsonp=window.webpackJsonp||[]).push([[43],{101:function(e,t,a){"use strict";a.r(t),a.d(t,"frontMatter",(function(){return l})),a.d(t,"metadata",(function(){return i})),a.d(t,"rightToc",(function(){return c})),a.d(t,"default",(function(){return p}));var n=a(2),b=a(6),r=(a(0),a(116)),l={id:"alpha-config",title:"Alpha Configuration"},i={unversionedId:"configuration/alpha-config",id:"configuration/alpha-config",isDocsHomePage:!1,title:"Alpha Configuration",description:"This page contains documentation for alpha features.",source:"@site/docs/configuration/alpha_config.md",slug:"/configuration/alpha-config",permalink:"/oauth2-proxy/docs/next/configuration/alpha-config",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/alpha_config.md",version:"current",sidebar:"docs",previous:{title:"TLS Configuration",permalink:"/oauth2-proxy/docs/next/configuration/tls"},next:{title:"Endpoints",permalink:"/oauth2-proxy/docs/next/features/endpoints"}},c=[{value:"Using Alpha Configuration",id:"using-alpha-configuration",children:[{value:"Converting configuration to the new structure",id:"converting-configuration-to-the-new-structure",children:[]}]},{value:"Removed options",id:"removed-options",children:[]},{value:"Configuration Reference",id:"configuration-reference",children:[{value:"ADFSOptions",id:"adfsoptions",children:[]},{value:"AlphaOptions",id:"alphaoptions",children:[]},{value:"AzureOptions",id:"azureoptions",children:[]},{value:"BitbucketOptions",id:"bitbucketoptions",children:[]},{value:"ClaimSource",id:"claimsource",children:[]},{value:"Duration",id:"duration",children:[]},{value:"GitHubOptions",id:"githuboptions",children:[]},{value:"GitLabOptions",id:"gitlaboptions",children:[]},{value:"GoogleOptions",id:"googleoptions",children:[]},{value:"Header",id:"header",children:[]},{value:"HeaderValue",id:"headervalue",children:[]},{value:"KeycloakOptions",id:"keycloakoptions",children:[]},{value:"LoginGovOptions",id:"logingovoptions",children:[]},{value:"OIDCOptions",id:"oidcoptions",children:[]},{value:"Provider",id:"provider",children:[]},{value:"ProviderType",id:"providertype",children:[]},{value:"Providers",id:"providers",children:[]},{value:"SecretSource",id:"secretsource",children:[]},{value:"Server",id:"server",children:[]},{value:"TLS",id:"tls",children:[]},{value:"Upstream",id:"upstream",children:[]},{value:"UpstreamConfig",id:"upstreamconfig",children:[]}]}],o={rightToc:c};function p(e){var t=e.components,a=Object(b.a)(e,["components"]);return Object(r.b)("wrapper",Object(n.a)({},o,a,{components:t,mdxType:"MDXLayout"}),Object(r.b)("div",{className:"admonition admonition-warning alert alert--danger"},Object(r.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(r.b)("h5",{parentName:"div"},Object(r.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(r.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"12",height:"16",viewBox:"0 0 12 16"}),Object(r.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M5.05.31c.81 2.17.41 3.38-.52 4.31C3.55 5.67 1.98 6.45.9 7.98c-1.45 2.05-1.7 6.53 3.53 7.7-2.2-1.16-2.67-4.52-.3-6.61-.61 2.03.53 3.33 1.94 2.86 1.39-.47 2.3.53 2.27 1.67-.02.78-.31 1.44-1.13 1.81 3.42-.59 4.78-3.42 4.78-5.56 0-2.84-2.53-3.22-1.25-5.61-1.52.13-2.03 1.13-1.89 2.75.09 1.08-1.02 1.8-1.86 1.33-.67-.41-.66-1.19-.06-1.78C8.18 5.31 8.68 2.45 5.05.32L5.03.3l.02.01z"})))),"warning")),Object(r.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(r.b)("p",{parentName:"div"},"This page contains documentation for alpha features.\nWe reserve the right to make breaking changes to the features detailed within this page with no notice."),Object(r.b)("p",{parentName:"div"},"Options described in this page may be changed, removed, renamed or moved without prior warning.\nPlease beware of this before you use alpha configuration options."))),Object(r.b)("p",null,"This page details a set of ",Object(r.b)("strong",{parentName:"p"},"alpha")," configuration options in a new format.\nGoing forward we are intending to add structured configuration in YAML format to\nreplace the existing TOML based configuration file and flags."),Object(r.b)("p",null,"Below is a reference for the structure of the configuration, with\n",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#alphaoptions"}),"AlphaOptions")," as the root of the configuration."),Object(r.b)("p",null,"When using alpha configuration, your config file will look something like below:"),Object(r.b)("pre",null,Object(r.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),"upstreams:\n - id: ...\n ...\ninjectRequestHeaders:\n - name: ...\n ...\ninjectResponseHeaders:\n - name: ...\n ...\n")),Object(r.b)("p",null,"Please browse the ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#configuration-reference"}),"reference")," below for the structure\nof the new configuration format."),Object(r.b)("h2",{id:"using-alpha-configuration"},"Using Alpha Configuration"),Object(r.b)("p",null,"To use the new ",Object(r.b)("strong",{parentName:"p"},"alpha")," configuration, generate a YAML file based on the format\ndescribed in the ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#configuration-reference"}),"reference")," below."),Object(r.b)("p",null,"Provide the path to this file using the ",Object(r.b)("inlineCode",{parentName:"p"},"--alpha-config")," flag."),Object(r.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(r.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(r.b)("h5",{parentName:"div"},Object(r.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(r.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(r.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(r.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(r.b)("p",{parentName:"div"},"When using the ",Object(r.b)("inlineCode",{parentName:"p"},"--alpha-config")," flag, some options are no longer available.\nSee ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#removed-options"}),"removed options")," below for more information."))),Object(r.b)("h3",{id:"converting-configuration-to-the-new-structure"},"Converting configuration to the new structure"),Object(r.b)("p",null,"Before adding the new ",Object(r.b)("inlineCode",{parentName:"p"},"--alpha-config")," option, start OAuth2 Proxy using the\n",Object(r.b)("inlineCode",{parentName:"p"},"convert-config-to-alpha")," flag to convert existing configuration to the new format."),Object(r.b)("pre",null,Object(r.b)("code",Object(n.a)({parentName:"pre"},{className:"language-bash"}),"oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg\n")),Object(r.b)("p",null,"This will convert any options supported by the new format to YAML and print the\nnew configuration to ",Object(r.b)("inlineCode",{parentName:"p"},"STDOUT"),"."),Object(r.b)("p",null,"Copy this to a new file, remove any options from your existing configuration\nnoted in ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#removed-options"}),"removed options")," and then start OAuth2 Proxy using\nthe new config."),Object(r.b)("pre",null,Object(r.b)("code",Object(n.a)({parentName:"pre"},{className:"language-bash"}),"oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg\n")),Object(r.b)("h2",{id:"removed-options"},"Removed options"),Object(r.b)("p",null,"The following flags/options and their respective environment variables are no\nlonger available when using alpha configuration:"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},Object(r.b)("inlineCode",{parentName:"li"},"flush-interval"),"/",Object(r.b)("inlineCode",{parentName:"li"},"flush_interval")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("inlineCode",{parentName:"li"},"pass-host-header"),"/",Object(r.b)("inlineCode",{parentName:"li"},"pass_host_header")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("inlineCode",{parentName:"li"},"proxy-websockets"),"/",Object(r.b)("inlineCode",{parentName:"li"},"proxy_websockets")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("inlineCode",{parentName:"li"},"ssl-upstream-insecure-skip-verify"),"/",Object(r.b)("inlineCode",{parentName:"li"},"ssl_upstream_insecure_skip_verify")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("inlineCode",{parentName:"li"},"upstream"),"/",Object(r.b)("inlineCode",{parentName:"li"},"upstreams"))),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},Object(r.b)("inlineCode",{parentName:"li"},"pass-basic-auth"),"/",Object(r.b)("inlineCode",{parentName:"li"},"pass_basic_auth")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("inlineCode",{parentName:"li"},"pass-access-token"),"/",Object(r.b)("inlineCode",{parentName:"li"},"pass_access_token")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("inlineCode",{parentName:"li"},"pass-user-headers"),"/",Object(r.b)("inlineCode",{parentName:"li"},"pass_user_headers")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("inlineCode",{parentName:"li"},"pass-authorization-header"),"/",Object(r.b)("inlineCode",{parentName:"li"},"pass_authorization_header")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("inlineCode",{parentName:"li"},"set-basic-auth"),"/",Object(r.b)("inlineCode",{parentName:"li"},"set_basic_auth")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("inlineCode",{parentName:"li"},"set-xauthrequest"),"/",Object(r.b)("inlineCode",{parentName:"li"},"set_xauthrequest")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("inlineCode",{parentName:"li"},"set-authorization-header"),"/",Object(r.b)("inlineCode",{parentName:"li"},"set_authorization_header")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("inlineCode",{parentName:"li"},"prefer-email-to-user"),"/",Object(r.b)("inlineCode",{parentName:"li"},"prefer_email_to_user")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("inlineCode",{parentName:"li"},"basic-auth-password"),"/",Object(r.b)("inlineCode",{parentName:"li"},"basic_auth_password")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("inlineCode",{parentName:"li"},"skip-auth-strip-headers"),"/",Object(r.b)("inlineCode",{parentName:"li"},"skip_auth_strip_headers"))),Object(r.b)("p",null,"Attempting to use these options via flags or via config when ",Object(r.b)("inlineCode",{parentName:"p"},"--alpha-config"),"\nset will result in an error."),Object(r.b)("div",{className:"admonition admonition-important alert alert--info"},Object(r.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(r.b)("h5",{parentName:"div"},Object(r.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(r.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(r.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"})))),"important")),Object(r.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(r.b)("p",{parentName:"div"},"You must remove these options before starting OAuth2 Proxy with ",Object(r.b)("inlineCode",{parentName:"p"},"--alpha-config")))),Object(r.b)("h2",{id:"configuration-reference"},"Configuration Reference"),Object(r.b)("h3",{id:"adfsoptions"},"ADFSOptions"),Object(r.b)("p",null,"(",Object(r.b)("strong",{parentName:"p"},"Appears on:")," ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#provider"}),"Provider"),")"),Object(r.b)("table",null,Object(r.b)("thead",{parentName:"table"},Object(r.b)("tr",{parentName:"thead"},Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(r.b)("tbody",{parentName:"table"},Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"skipScope")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"bool")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Skip adding the scope parameter in login request",Object(r.b)("br",null),"Default value is 'false'")))),Object(r.b)("h3",{id:"alphaoptions"},"AlphaOptions"),Object(r.b)("p",null,"AlphaOptions contains alpha structured configuration options.\nUsage of these options allows users to access alpha features that are not\navailable as part of the primary configuration structure for OAuth2 Proxy."),Object(r.b)("div",{className:"admonition admonition-warning alert alert--danger"},Object(r.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(r.b)("h5",{parentName:"div"},Object(r.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(r.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"12",height:"16",viewBox:"0 0 12 16"}),Object(r.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M5.05.31c.81 2.17.41 3.38-.52 4.31C3.55 5.67 1.98 6.45.9 7.98c-1.45 2.05-1.7 6.53 3.53 7.7-2.2-1.16-2.67-4.52-.3-6.61-.61 2.03.53 3.33 1.94 2.86 1.39-.47 2.3.53 2.27 1.67-.02.78-.31 1.44-1.13 1.81 3.42-.59 4.78-3.42 4.78-5.56 0-2.84-2.53-3.22-1.25-5.61-1.52.13-2.03 1.13-1.89 2.75.09 1.08-1.02 1.8-1.86 1.33-.67-.41-.66-1.19-.06-1.78C8.18 5.31 8.68 2.45 5.05.32L5.03.3l.02.01z"})))),"warning")),Object(r.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(r.b)("p",{parentName:"div"},"The options within this structure are considered alpha.\nThey may change between releases without notice."))),Object(r.b)("table",null,Object(r.b)("thead",{parentName:"table"},Object(r.b)("tr",{parentName:"thead"},Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(r.b)("tbody",{parentName:"table"},Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"upstreamConfig")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#upstreamconfig"}),"UpstreamConfig"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UpstreamConfig is used to configure upstream servers.",Object(r.b)("br",null),"Once a user is authenticated, requests to the server will be proxied to",Object(r.b)("br",null),"these upstream servers based on the path mappings defined in this list.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"injectRequestHeaders")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#header"}),"[]Header"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"InjectRequestHeaders is used to configure headers that should be added",Object(r.b)("br",null),"to requests to upstream servers.",Object(r.b)("br",null),"Headers may source values from either the authenticated user's session",Object(r.b)("br",null),"or from a static secret value.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"injectResponseHeaders")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#header"}),"[]Header"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"InjectResponseHeaders is used to configure headers that should be added",Object(r.b)("br",null),"to responses from the proxy.",Object(r.b)("br",null),"This is typically used when using the proxy as an external authentication",Object(r.b)("br",null),"provider in conjunction with another proxy such as NGINX and its",Object(r.b)("br",null),"auth_request module.",Object(r.b)("br",null),"Headers may source values from either the authenticated user's session",Object(r.b)("br",null),"or from a static secret value.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"server")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#server"}),"Server"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Server is used to configure the HTTP(S) server for the proxy application.",Object(r.b)("br",null),"You may choose to run both HTTP and HTTPS servers simultaneously.",Object(r.b)("br",null),"This can be done by setting the BindAddress and the SecureBindAddress simultaneously.",Object(r.b)("br",null),"To use the secure server you must configure a TLS certificate and key.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"metricsServer")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#server"}),"Server"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"MetricsServer is used to configure the HTTP(S) server for metrics.",Object(r.b)("br",null),"You may choose to run both HTTP and HTTPS servers simultaneously.",Object(r.b)("br",null),"This can be done by setting the BindAddress and the SecureBindAddress simultaneously.",Object(r.b)("br",null),"To use the secure server you must configure a TLS certificate and key.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"providers")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#providers"}),"Providers"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Providers is used to configure multiple providers.")))),Object(r.b)("h3",{id:"azureoptions"},"AzureOptions"),Object(r.b)("p",null,"(",Object(r.b)("strong",{parentName:"p"},"Appears on:")," ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#provider"}),"Provider"),")"),Object(r.b)("table",null,Object(r.b)("thead",{parentName:"table"},Object(r.b)("tr",{parentName:"thead"},Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(r.b)("tbody",{parentName:"table"},Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"tenant")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Tenant directs to a tenant-specific or common (tenant-independent) endpoint",Object(r.b)("br",null),"Default value is 'common'")))),Object(r.b)("h3",{id:"bitbucketoptions"},"BitbucketOptions"),Object(r.b)("p",null,"(",Object(r.b)("strong",{parentName:"p"},"Appears on:")," ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#provider"}),"Provider"),")"),Object(r.b)("table",null,Object(r.b)("thead",{parentName:"table"},Object(r.b)("tr",{parentName:"thead"},Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(r.b)("tbody",{parentName:"table"},Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"team")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Team sets restrict logins to members of this team")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"repository")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Repository sets restrict logins to user with access to this repository")))),Object(r.b)("h3",{id:"claimsource"},"ClaimSource"),Object(r.b)("p",null,"(",Object(r.b)("strong",{parentName:"p"},"Appears on:")," ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#headervalue"}),"HeaderValue"),")"),Object(r.b)("p",null,"ClaimSource allows loading a header value from a claim within the session"),Object(r.b)("table",null,Object(r.b)("thead",{parentName:"table"},Object(r.b)("tr",{parentName:"thead"},Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(r.b)("tbody",{parentName:"table"},Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"claim")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Claim is the name of the claim in the session that the value should be",Object(r.b)("br",null),"loaded from.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"prefix")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefix is an optional prefix that will be prepended to the value of the",Object(r.b)("br",null),"claim if it is non-empty.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"basicAuthPassword")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#secretsource"}),"SecretSource"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"BasicAuthPassword converts this claim into a basic auth header.",Object(r.b)("br",null),"Note the value of claim will become the basic auth username and the",Object(r.b)("br",null),"basicAuthPassword will be used as the password value.")))),Object(r.b)("h3",{id:"duration"},"Duration"),Object(r.b)("h4",{id:"string-alias"},"(",Object(r.b)("inlineCode",{parentName:"h4"},"string")," alias)"),Object(r.b)("p",null,"(",Object(r.b)("strong",{parentName:"p"},"Appears on:")," ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#upstream"}),"Upstream"),")"),Object(r.b)("p",null,'Duration is as string representation of a period of time.\nA duration string is a is a possibly signed sequence of decimal numbers,\neach with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".\nValid time units are "ns", "us" (or "\xb5s"), "ms", "s", "m", "h".'),Object(r.b)("h3",{id:"githuboptions"},"GitHubOptions"),Object(r.b)("p",null,"(",Object(r.b)("strong",{parentName:"p"},"Appears on:")," ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#provider"}),"Provider"),")"),Object(r.b)("table",null,Object(r.b)("thead",{parentName:"table"},Object(r.b)("tr",{parentName:"thead"},Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(r.b)("tbody",{parentName:"table"},Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"org")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Org sets restrict logins to members of this organisation")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"team")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Team sets restrict logins to members of this team")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"repo")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Repo sets restrict logins to collaborators of this repository")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"token")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Token is the token to use when verifying repository collaborators",Object(r.b)("br",null),"it must have push access to the repository")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"users")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"[]string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Users allows users with these usernames to login",Object(r.b)("br",null),"even if they do not belong to the specified org and team or collaborators")))),Object(r.b)("h3",{id:"gitlaboptions"},"GitLabOptions"),Object(r.b)("p",null,"(",Object(r.b)("strong",{parentName:"p"},"Appears on:")," ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#provider"}),"Provider"),")"),Object(r.b)("table",null,Object(r.b)("thead",{parentName:"table"},Object(r.b)("tr",{parentName:"thead"},Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(r.b)("tbody",{parentName:"table"},Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"group")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"[]string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Group sets restrict logins to members of this group")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"projects")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"[]string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Projects restricts logins to members of any of these projects")))),Object(r.b)("h3",{id:"googleoptions"},"GoogleOptions"),Object(r.b)("p",null,"(",Object(r.b)("strong",{parentName:"p"},"Appears on:")," ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#provider"}),"Provider"),")"),Object(r.b)("table",null,Object(r.b)("thead",{parentName:"table"},Object(r.b)("tr",{parentName:"thead"},Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(r.b)("tbody",{parentName:"table"},Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"group")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"[]string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Groups sets restrict logins to members of this google group")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"adminEmail")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"AdminEmail is the google admin to impersonate for api calls")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"serviceAccountJson")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ServiceAccountJSON is the path to the service account json credentials")))),Object(r.b)("h3",{id:"header"},"Header"),Object(r.b)("p",null,"(",Object(r.b)("strong",{parentName:"p"},"Appears on:")," ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#alphaoptions"}),"AlphaOptions"),")"),Object(r.b)("p",null,"Header represents an individual header that will be added to a request or\nresponse header."),Object(r.b)("table",null,Object(r.b)("thead",{parentName:"table"},Object(r.b)("tr",{parentName:"thead"},Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(r.b)("tbody",{parentName:"table"},Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"name")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Name is the header name to be used for this set of values.",Object(r.b)("br",null),"Names should be unique within a list of Headers.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"preserveRequestValue")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"bool")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"PreserveRequestValue determines whether any values for this header",Object(r.b)("br",null),"should be preserved for the request to the upstream server.",Object(r.b)("br",null),"This option only applies to injected request headers.",Object(r.b)("br",null),"Defaults to false (headers that match this header will be stripped).")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"values")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#headervalue"}),"[]HeaderValue"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Values contains the desired values for this header")))),Object(r.b)("h3",{id:"headervalue"},"HeaderValue"),Object(r.b)("p",null,"(",Object(r.b)("strong",{parentName:"p"},"Appears on:")," ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#header"}),"Header"),")"),Object(r.b)("p",null,"HeaderValue represents a single header value and the sources that can\nmake up the header value"),Object(r.b)("table",null,Object(r.b)("thead",{parentName:"table"},Object(r.b)("tr",{parentName:"thead"},Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(r.b)("tbody",{parentName:"table"},Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"value")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"[]byte")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Value expects a base64 encoded string value.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"fromEnv")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FromEnv expects the name of an environment variable.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"fromFile")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FromFile expects a path to a file containing the secret value.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"claim")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Claim is the name of the claim in the session that the value should be",Object(r.b)("br",null),"loaded from.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"prefix")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefix is an optional prefix that will be prepended to the value of the",Object(r.b)("br",null),"claim if it is non-empty.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"basicAuthPassword")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#secretsource"}),"SecretSource"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"BasicAuthPassword converts this claim into a basic auth header.",Object(r.b)("br",null),"Note the value of claim will become the basic auth username and the",Object(r.b)("br",null),"basicAuthPassword will be used as the password value.")))),Object(r.b)("h3",{id:"keycloakoptions"},"KeycloakOptions"),Object(r.b)("p",null,"(",Object(r.b)("strong",{parentName:"p"},"Appears on:")," ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#provider"}),"Provider"),")"),Object(r.b)("table",null,Object(r.b)("thead",{parentName:"table"},Object(r.b)("tr",{parentName:"thead"},Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(r.b)("tbody",{parentName:"table"},Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"groups")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"[]string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Group enables to restrict login to members of indicated group")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"roles")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"[]string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Role enables to restrict login to users with role (only available when using the keycloak-oidc provider)")))),Object(r.b)("h3",{id:"logingovoptions"},"LoginGovOptions"),Object(r.b)("p",null,"(",Object(r.b)("strong",{parentName:"p"},"Appears on:")," ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#provider"}),"Provider"),")"),Object(r.b)("table",null,Object(r.b)("thead",{parentName:"table"},Object(r.b)("tr",{parentName:"thead"},Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(r.b)("tbody",{parentName:"table"},Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"jwtKey")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"JWTKey is a private key in PEM format used to sign JWT,")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"jwtKeyFile")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"JWTKeyFile is a path to the private key file in PEM format used to sign the JWT")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"pubjwkURL")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"PubJWKURL is the JWK pubkey access endpoint")))),Object(r.b)("h3",{id:"oidcoptions"},"OIDCOptions"),Object(r.b)("p",null,"(",Object(r.b)("strong",{parentName:"p"},"Appears on:")," ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#provider"}),"Provider"),")"),Object(r.b)("table",null,Object(r.b)("thead",{parentName:"table"},Object(r.b)("tr",{parentName:"thead"},Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(r.b)("tbody",{parentName:"table"},Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"issuerURL")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"IssuerURL is the OpenID Connect issuer URL",Object(r.b)("br",null),"eg: ",Object(r.b)("a",Object(n.a)({parentName:"td"},{href:"https://accounts.google.com"}),"https://accounts.google.com"))),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"insecureAllowUnverifiedEmail")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"bool")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"InsecureAllowUnverifiedEmail prevents failures if an email address in an id_token is not verified",Object(r.b)("br",null),"default set to 'false'")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"insecureSkipIssuerVerification")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"bool")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"InsecureSkipIssuerVerification skips verification of ID token issuers. When false, ID Token Issuers must match the OIDC discovery URL",Object(r.b)("br",null),"default set to 'false'")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"insecureSkipNonce")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"bool")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"InsecureSkipNonce skips verifying the ID Token's nonce claim that must match",Object(r.b)("br",null),"the random nonce sent in the initial OAuth flow. Otherwise, the nonce is checked",Object(r.b)("br",null),"after the initial OAuth redeem & subsequent token refreshes.",Object(r.b)("br",null),"default set to 'true'",Object(r.b)("br",null),"Warning: In a future release, this will change to 'false' by default for enhanced security.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"skipDiscovery")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"bool")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"SkipDiscovery allows to skip OIDC discovery and use manually supplied Endpoints",Object(r.b)("br",null),"default set to 'false'")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"jwksURL")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"JwksURL is the OpenID Connect JWKS URL",Object(r.b)("br",null),"eg: ",Object(r.b)("a",Object(n.a)({parentName:"td"},{href:"https://www.googleapis.com/oauth2/v3/certs"}),"https://www.googleapis.com/oauth2/v3/certs"))),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"emailClaim")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"EmailClaim indicates which claim contains the user email,",Object(r.b)("br",null),"default set to 'email'")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"groupsClaim")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GroupsClaim indicates which claim contains the user groups",Object(r.b)("br",null),"default set to 'groups'")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"userIDClaim")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserIDClaim indicates which claim contains the user ID",Object(r.b)("br",null),"default set to 'email'")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"audienceClaims")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"[]string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"AudienceClaim allows to define any claim that is verified against the client id",Object(r.b)("br",null),"By default ",Object(r.b)("inlineCode",{parentName:"td"},"aud")," claim is used for verification.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"extraAudiences")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"[]string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ExtraAudiences is a list of additional audiences that are allowed",Object(r.b)("br",null),"to pass verification in addition to the client id.")))),Object(r.b)("h3",{id:"provider"},"Provider"),Object(r.b)("p",null,"(",Object(r.b)("strong",{parentName:"p"},"Appears on:")," ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#providers"}),"Providers"),")"),Object(r.b)("p",null,"Provider holds all configuration for a single provider"),Object(r.b)("table",null,Object(r.b)("thead",{parentName:"table"},Object(r.b)("tr",{parentName:"thead"},Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(r.b)("tbody",{parentName:"table"},Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"clientID")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ClientID is the OAuth Client ID that is defined in the provider",Object(r.b)("br",null),"This value is required for all providers.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"clientSecret")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ClientSecret is the OAuth Client Secret that is defined in the provider",Object(r.b)("br",null),"This value is required for all providers.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"clientSecretFile")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ClientSecretFile is the name of the file",Object(r.b)("br",null),"containing the OAuth Client Secret, it will be used if ClientSecret is not set.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"keycloakConfig")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#keycloakoptions"}),"KeycloakOptions"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"KeycloakConfig holds all configurations for Keycloak provider.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"azureConfig")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#azureoptions"}),"AzureOptions"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"AzureConfig holds all configurations for Azure provider.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"ADFSConfig")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#adfsoptions"}),"ADFSOptions"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ADFSConfig holds all configurations for ADFS provider.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"bitbucketConfig")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#bitbucketoptions"}),"BitbucketOptions"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"BitbucketConfig holds all configurations for Bitbucket provider.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"githubConfig")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#githuboptions"}),"GitHubOptions"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GitHubConfig holds all configurations for GitHubC provider.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"gitlabConfig")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#gitlaboptions"}),"GitLabOptions"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GitLabConfig holds all configurations for GitLab provider.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"googleConfig")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#googleoptions"}),"GoogleOptions"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GoogleConfig holds all configurations for Google provider.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"oidcConfig")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#oidcoptions"}),"OIDCOptions"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OIDCConfig holds all configurations for OIDC provider",Object(r.b)("br",null),"or providers utilize OIDC configurations.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"loginGovConfig")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#logingovoptions"}),"LoginGovOptions"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"LoginGovConfig holds all configurations for LoginGov provider.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"id")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ID should be a unique identifier for the provider.",Object(r.b)("br",null),"This value is required for all providers.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"provider")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#providertype"}),"ProviderType"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Type is the OAuth provider",Object(r.b)("br",null),"must be set from the supported providers group,",Object(r.b)("br",null),"otherwise 'Google' is set as default")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"name")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Name is the providers display name",Object(r.b)("br",null),"if set, it will be shown to the users in the login page.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"caFiles")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"[]string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"CAFiles is a list of paths to CA certificates that should be used when connecting to the provider.",Object(r.b)("br",null),"If not specified, the default Go trust sources are used instead")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"loginURL")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"LoginURL is the authentication endpoint")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"redeemURL")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RedeemURL is the token redemption endpoint")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"profileURL")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ProfileURL is the profile access endpoint")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"resource")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ProtectedResource is the resource that is protected (Azure AD and ADFS only)")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"validateURL")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ValidateURL is the access token validation endpoint")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"scope")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Scope is the OAuth scope specification")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"prompt")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prompt is OIDC prompt")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"approvalPrompt")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ApprovalPrompt is the OAuth approval_prompt",Object(r.b)("br",null),"default is set to 'force'")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"allowedGroups")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"[]string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"AllowedGroups is a list of restrict logins to members of this group")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"acrValues")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"AcrValues is a string of acr values")))),Object(r.b)("h3",{id:"providertype"},"ProviderType"),Object(r.b)("h4",{id:"string-alias-1"},"(",Object(r.b)("inlineCode",{parentName:"h4"},"string")," alias)"),Object(r.b)("p",null,"(",Object(r.b)("strong",{parentName:"p"},"Appears on:")," ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#provider"}),"Provider"),")"),Object(r.b)("p",null,"ProviderType is used to enumerate the different provider type options\nValid options are: adfs, azure, bitbucket, digitalocean facebook, github,\ngitlab, google, keycloak, keycloak-oidc, linkedin, login.gov, nextcloud\nand oidc."),Object(r.b)("h3",{id:"providers"},"Providers"),Object(r.b)("h4",{id:"provider-alias"},"(",Object(r.b)("a",Object(n.a)({parentName:"h4"},{href:"#provider"}),"[]Provider")," alias)"),Object(r.b)("p",null,"(",Object(r.b)("strong",{parentName:"p"},"Appears on:")," ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#alphaoptions"}),"AlphaOptions"),")"),Object(r.b)("p",null,"Providers is a collection of definitions for providers."),Object(r.b)("h3",{id:"secretsource"},"SecretSource"),Object(r.b)("p",null,"(",Object(r.b)("strong",{parentName:"p"},"Appears on:")," ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#claimsource"}),"ClaimSource"),", ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#headervalue"}),"HeaderValue"),", ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#tls"}),"TLS"),")"),Object(r.b)("p",null,"SecretSource references an individual secret value.\nOnly one source within the struct should be defined at any time."),Object(r.b)("table",null,Object(r.b)("thead",{parentName:"table"},Object(r.b)("tr",{parentName:"thead"},Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(r.b)("tbody",{parentName:"table"},Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"value")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"[]byte")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Value expects a base64 encoded string value.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"fromEnv")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FromEnv expects the name of an environment variable.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"fromFile")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FromFile expects a path to a file containing the secret value.")))),Object(r.b)("h3",{id:"server"},"Server"),Object(r.b)("p",null,"(",Object(r.b)("strong",{parentName:"p"},"Appears on:")," ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#alphaoptions"}),"AlphaOptions"),")"),Object(r.b)("p",null,"Server represents the configuration for an HTTP(S) server"),Object(r.b)("table",null,Object(r.b)("thead",{parentName:"table"},Object(r.b)("tr",{parentName:"thead"},Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(r.b)("tbody",{parentName:"table"},Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"BindAddress")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"BindAddress is the address on which to serve traffic.",Object(r.b)("br",null),'Leave blank or set to "-" to disable.')),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"SecureBindAddress")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"SecureBindAddress is the address on which to serve secure traffic.",Object(r.b)("br",null),'Leave blank or set to "-" to disable.')),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"TLS")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#tls"}),"TLS"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"TLS contains the information for loading the certificate and key for the",Object(r.b)("br",null),"secure traffic and further configuration for the TLS server.")))),Object(r.b)("h3",{id:"tls"},"TLS"),Object(r.b)("p",null,"(",Object(r.b)("strong",{parentName:"p"},"Appears on:")," ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#server"}),"Server"),")"),Object(r.b)("p",null,"TLS contains the information for loading a TLS certificate and key\nas well as an optional minimal TLS version that is acceptable."),Object(r.b)("table",null,Object(r.b)("thead",{parentName:"table"},Object(r.b)("tr",{parentName:"thead"},Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(r.b)("tbody",{parentName:"table"},Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"Key")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#secretsource"}),"SecretSource"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Key is the TLS key data to use.",Object(r.b)("br",null),"Typically this will come from a file.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"Cert")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#secretsource"}),"SecretSource"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Cert is the TLS certificate data to use.",Object(r.b)("br",null),"Typically this will come from a file.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"MinVersion")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"MinVersion is the minimal TLS version that is acceptable.",Object(r.b)("br",null),'E.g. Set to "TLS1.3" to select TLS version 1.3')))),Object(r.b)("h3",{id:"upstream"},"Upstream"),Object(r.b)("p",null,"(",Object(r.b)("strong",{parentName:"p"},"Appears on:")," ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#upstreamconfig"}),"UpstreamConfig"),")"),Object(r.b)("p",null,"Upstream represents the configuration for an upstream server.\nRequests will be proxied to this upstream if the path matches the request path."),Object(r.b)("table",null,Object(r.b)("thead",{parentName:"table"},Object(r.b)("tr",{parentName:"thead"},Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(r.b)("tbody",{parentName:"table"},Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"id")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ID should be a unique identifier for the upstream.",Object(r.b)("br",null),"This value is required for all upstreams.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"path")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Path is used to map requests to the upstream server.",Object(r.b)("br",null),"The closest match will take precedence and all Paths must be unique.",Object(r.b)("br",null),"Path can also take a pattern when used with RewriteTarget.",Object(r.b)("br",null),"Path segments can be captured and matched using regular experessions.",Object(r.b)("br",null),"Eg:",Object(r.b)("br",null),"- ",Object(r.b)("inlineCode",{parentName:"td"},"^/foo$"),": Match only the explicit path ",Object(r.b)("inlineCode",{parentName:"td"},"/foo"),Object(r.b)("br",null),"- ",Object(r.b)("inlineCode",{parentName:"td"},"^/bar/$"),": Match any path prefixed with ",Object(r.b)("inlineCode",{parentName:"td"},"/bar/"),Object(r.b)("br",null),"- ",Object(r.b)("inlineCode",{parentName:"td"},"^/baz/(.*)$"),": Match any path prefixed with ",Object(r.b)("inlineCode",{parentName:"td"},"/baz")," and capture the remaining path for use with RewriteTarget")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"rewriteTarget")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RewriteTarget allows users to rewrite the request path before it is sent to",Object(r.b)("br",null),"the upstream server.",Object(r.b)("br",null),"Use the Path to capture segments for reuse within the rewrite target.",Object(r.b)("br",null),"Eg: With a Path of ",Object(r.b)("inlineCode",{parentName:"td"},"^/baz/(.*)"),", a RewriteTarget of ",Object(r.b)("inlineCode",{parentName:"td"},"/foo/$1")," would rewrite",Object(r.b)("br",null),"the request ",Object(r.b)("inlineCode",{parentName:"td"},"/baz/abc/123")," to ",Object(r.b)("inlineCode",{parentName:"td"},"/foo/abc/123")," before proxying to the",Object(r.b)("br",null),"upstream server.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"uri")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"string")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The URI of the upstream server. This may be an HTTP(S) server of a File",Object(r.b)("br",null),"based URL. It may include a path, in which case all requests will be served",Object(r.b)("br",null),"under that path.",Object(r.b)("br",null),"Eg:",Object(r.b)("br",null),"- http://localhost:8080",Object(r.b)("br",null),"- ",Object(r.b)("a",Object(n.a)({parentName:"td"},{href:"https://service.localhost"}),"https://service.localhost"),Object(r.b)("br",null),"- ",Object(r.b)("a",Object(n.a)({parentName:"td"},{href:"https://service.localhost/path"}),"https://service.localhost/path"),Object(r.b)("br",null),"- file://host/path",Object(r.b)("br",null),'If the URI\'s path is "/base" and the incoming request was for "/dir",',Object(r.b)("br",null),'the upstream request will be for "/base/dir".')),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"insecureSkipTLSVerify")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"bool")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.",Object(r.b)("br",null),"This option is insecure and will allow potential Man-In-The-Middle attacks",Object(r.b)("br",null),"betweem OAuth2 Proxy and the usptream server.",Object(r.b)("br",null),"Defaults to false.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"static")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"bool")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Static will make all requests to this upstream have a static response.",Object(r.b)("br",null),'The response will have a body of "Authenticated" and a response code',Object(r.b)("br",null),"matching StaticCode.",Object(r.b)("br",null),"If StaticCode is not set, the response will return a 200 response.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"staticCode")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"int")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"StaticCode determines the response code for the Static response.",Object(r.b)("br",null),"This option can only be used with Static enabled.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"flushInterval")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#duration"}),"Duration"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"FlushInterval is the period between flushing the response buffer when",Object(r.b)("br",null),"streaming response from the upstream.",Object(r.b)("br",null),"Defaults to 1 second.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"passHostHeader")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"bool")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"PassHostHeader determines whether the request host header should be proxied",Object(r.b)("br",null),"to the upstream server.",Object(r.b)("br",null),"Defaults to true.")),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"proxyWebSockets")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"bool")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ProxyWebSockets enables proxying of websockets to upstream servers",Object(r.b)("br",null),"Defaults to true.")))),Object(r.b)("h3",{id:"upstreamconfig"},"UpstreamConfig"),Object(r.b)("p",null,"(",Object(r.b)("strong",{parentName:"p"},"Appears on:")," ",Object(r.b)("a",Object(n.a)({parentName:"p"},{href:"#alphaoptions"}),"AlphaOptions"),")"),Object(r.b)("p",null,"UpstreamConfig is a collection of definitions for upstream servers."),Object(r.b)("table",null,Object(r.b)("thead",{parentName:"table"},Object(r.b)("tr",{parentName:"thead"},Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Field"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(r.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(r.b)("tbody",{parentName:"table"},Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"proxyRawPath")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},"bool")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ProxyRawPath will pass the raw url path to upstream allowing for url's",Object(r.b)("br",null),'like: "/%2F/" which would otherwise be redirected to "/"')),Object(r.b)("tr",{parentName:"tbody"},Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("inlineCode",{parentName:"td"},"upstreams")),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(r.b)("em",{parentName:"td"},Object(r.b)("a",Object(n.a)({parentName:"em"},{href:"#upstream"}),"[]Upstream"))),Object(r.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Upstreams represents the configuration for the upstream servers.",Object(r.b)("br",null),"Requests will be proxied to this upstream if the path matches the request path.")))))}p.isMDXComponent=!0},116:function(e,t,a){"use strict";a.d(t,"a",(function(){return O})),a.d(t,"b",(function(){return s}));var n=a(0),b=a.n(n);function r(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function l(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function i(e){for(var t=1;t=0||(b[a]=e[a]);return b}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(b[a]=e[a])}return b}var o=b.a.createContext({}),p=function(e){var t=b.a.useContext(o),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},O=function(e){var t=p(e.components);return b.a.createElement(o.Provider,{value:t},e.children)},j={inlineCode:"code",wrapper:function(e){var t=e.children;return b.a.createElement(b.a.Fragment,{},t)}},d=b.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,r=e.originalType,l=e.parentName,o=c(e,["components","mdxType","originalType","parentName"]),O=p(a),d=n,s=O["".concat(l,".").concat(d)]||O[d]||j[d]||r;return a?b.a.createElement(s,i(i({ref:t},o),{},{components:a})):b.a.createElement(s,i({ref:t},o))}));function s(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var r=a.length,l=new Array(r);l[0]=d;var i={};for(var c in t)hasOwnProperty.call(t,c)&&(i[c]=t[c]);i.originalType=e,i.mdxType="string"==typeof e?e:n,l[1]=i;for(var o=2;o=0||(b[a]=e[a]);return b}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(b[a]=e[a])}return b}var o=b.a.createContext({}),p=function(e){var t=b.a.useContext(o),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},O=function(e){var t=p(e.components);return b.a.createElement(o.Provider,{value:t},e.children)},j={inlineCode:"code",wrapper:function(e){var t=e.children;return b.a.createElement(b.a.Fragment,{},t)}},d=b.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,r=e.originalType,l=e.parentName,o=c(e,["components","mdxType","originalType","parentName"]),O=p(a),d=n,s=O["".concat(l,".").concat(d)]||O[d]||j[d]||r;return a?b.a.createElement(s,i(i({ref:t},o),{},{components:a})):b.a.createElement(s,i({ref:t},o))}));function s(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var r=a.length,l=new Array(r);l[0]=d;var i={};for(var c in t)hasOwnProperty.call(t,c)&&(i[c]=t[c]);i.originalType=e,i.mdxType="string"==typeof e?e:n,l[1]=i;for(var o=2;o Behaviour | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 6.1.x

Behaviour

  1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).
  2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with Accept: application/json, in which case 401 Unauthorized is returned)
  3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
  4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)

Notice that the proxy also provides a number of useful endpoints.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/6.1.x/community/security/index.html b/docs/6.1.x/community/security/index.html index 1d533a48..235b0b27 100644 --- a/docs/6.1.x/community/security/index.html +++ b/docs/6.1.x/community/security/index.html @@ -6,7 +6,7 @@ Security | OAuth2 Proxy - + @@ -38,7 +38,7 @@ merging fixes until all patches are ready. We may also backport the fix to previous releases, but this will be at the discretion of the maintainers.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/6.1.x/configuration/oauth_provider/index.html b/docs/6.1.x/configuration/oauth_provider/index.html index 81d10f25..85681deb 100644 --- a/docs/6.1.x/configuration/oauth_provider/index.html +++ b/docs/6.1.x/configuration/oauth_provider/index.html @@ -6,7 +6,7 @@ OAuth Provider Configuration | OAuth2 Proxy - + @@ -55,7 +55,7 @@ to setup the client id and client secret. Your "Redirection URI" will providers.New() to allow oauth2-proxy to use the new Provider.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/6.1.x/configuration/overview/index.html b/docs/6.1.x/configuration/overview/index.html index 17fa7a60..9e48e810 100644 --- a/docs/6.1.x/configuration/overview/index.html +++ b/docs/6.1.x/configuration/overview/index.html @@ -6,7 +6,7 @@ Overview | OAuth2 Proxy - + @@ -39,7 +39,7 @@ Variables set with auth_request_set are not set-able i Note that nginxinc/kubernetes-ingress does not include the Lua module.

nginx.ingress.kubernetes.io/auth-response-headers: Authorization
nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
nginx.ingress.kubernetes.io/configuration-snippet: |
auth_request_set $name_upstream_1 $upstream_cookie_name_1;
access_by_lua_block {
if ngx.var.name_upstream_1 ~= "" then
ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")
end
}

It is recommended to use --session-store-type=redis when expecting large sessions/OIDC tokens (e.g. with MS Azure).

You have to substitute name with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".

note

If you set up your OAuth2 provider to rotate your client secret, you can use the client-secret-file option to reload the secret when it is updated.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/6.1.x/configuration/session_storage/index.html b/docs/6.1.x/configuration/session_storage/index.html index 4702f611..f32a07ff 100644 --- a/docs/6.1.x/configuration/session_storage/index.html +++ b/docs/6.1.x/configuration/session_storage/index.html @@ -6,7 +6,7 @@ Session Storage | OAuth2 Proxy - + @@ -35,7 +35,7 @@ disclosure.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/6.1.x/configuration/tls/index.html b/docs/6.1.x/configuration/tls/index.html index da3d5cac..914fc599 100644 --- a/docs/6.1.x/configuration/tls/index.html +++ b/docs/6.1.x/configuration/tls/index.html @@ -6,7 +6,7 @@ TLS Configuration | OAuth2 Proxy - + @@ -26,7 +26,7 @@ would be https://internal.yourcompany.com/.

An example Nginx via HSTS:

server {
listen 443 default ssl;
server_name internal.yourcompany.com;
ssl_certificate /path/to/cert.pem;
ssl_certificate_key /path/to/cert.key;
add_header Strict-Transport-Security max-age=2592000;
location / {
proxy_pass http://127.0.0.1:4180;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_connect_timeout 1;
proxy_send_timeout 30;
proxy_read_timeout 30;
}
}

The command line to run oauth2-proxy in this configuration would look like this:

./oauth2-proxy \
--email-domain="yourcompany.com" \
--upstream=http://127.0.0.1:8080/ \
--cookie-secret=... \
--cookie-secure=true \
--provider=... \
--reverse-proxy=true \
--client-id=... \
--client-secret=...
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/6.1.x/features/endpoints/index.html b/docs/6.1.x/features/endpoints/index.html index fcb4c99d..e3b3bd75 100644 --- a/docs/6.1.x/features/endpoints/index.html +++ b/docs/6.1.x/features/endpoints/index.html @@ -6,7 +6,7 @@ Endpoints | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 6.1.x

Endpoints

OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.

  • /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see robotstxt.org for more info
  • /ping - returns a 200 OK response, which is intended for use with health checks
  • /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
  • /oauth2/sign_out - this URL is used to clear the session cookie
  • /oauth2/start - a URL that will redirect to start the OAuth cycle
  • /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
  • /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
  • /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the Nginx auth_request directive

Sign out

To sign the user out, redirect them to /oauth2/sign_out. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the rd query parameter, i.e. redirect the user to something like (notice the url-encoding!):

/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page

Alternatively, include the redirect URL in the X-Auth-Request-Redirect header:

GET /oauth2/sign_out HTTP/1.1
X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
...

(The "sign_out_page" should be the end_session_endpoint from the metadata if your OIDC provider supports Session Management and Discovery.)

BEWARE that the domain you want to redirect to (my-oidc-provider.example.com in the example) must be added to the --whitelist-domain configuration option otherwise the redirect will be ignored.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/6.1.x/features/request_signatures/index.html b/docs/6.1.x/features/request_signatures/index.html index 82d5d550..1a08d897 100644 --- a/docs/6.1.x/features/request_signatures/index.html +++ b/docs/6.1.x/features/request_signatures/index.html @@ -6,7 +6,7 @@ Request Signatures | OAuth2 Proxy - + @@ -27,7 +27,7 @@ following:

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/6.1.x/index.html b/docs/6.1.x/index.html index 0ec5b8fd..f8de2728 100644 --- a/docs/6.1.x/index.html +++ b/docs/6.1.x/index.html @@ -6,7 +6,7 @@ Installation | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 6.1.x

Installation

  1. Choose how to deploy:

    a. Download Prebuilt Binary (current release is v6.1.1)

    b. Build with $ go get github.com/oauth2-proxy/oauth2-proxy which will put the binary in $GOPATH/bin

    c. Using the prebuilt docker image quay.io/oauth2-proxy/oauth2-proxy (AMD64, ARMv6 and ARM64 tags available)

Prebuilt binaries can be validated by extracting the file and verifying it against the sha256sum.txt checksum file provided for each release starting with version v3.0.0.

$ sha256sum -c sha256sum.txt 2>&1 | grep OK
oauth2-proxy-x.y.z.linux-amd64: OK
  1. Select a Provider and Register an OAuth Application with a Provider
  2. Configure OAuth2 Proxy using config file, command line options, or environment variables
  3. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.0.x/behaviour/index.html b/docs/7.0.x/behaviour/index.html index 63793540..169c654a 100644 --- a/docs/7.0.x/behaviour/index.html +++ b/docs/7.0.x/behaviour/index.html @@ -6,7 +6,7 @@ Behaviour | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 7.0.x

Behaviour

  1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).
  2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with Accept: application/json, in which case 401 Unauthorized is returned)
  3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
  4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)

Notice that the proxy also provides a number of useful endpoints.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.0.x/community/security/index.html b/docs/7.0.x/community/security/index.html index 2f2c2c45..feb7fd09 100644 --- a/docs/7.0.x/community/security/index.html +++ b/docs/7.0.x/community/security/index.html @@ -6,7 +6,7 @@ Security | OAuth2 Proxy - + @@ -38,7 +38,7 @@ merging fixes until all patches are ready. We may also backport the fix to previous releases, but this will be at the discretion of the maintainers.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.0.x/configuration/alpha-config/index.html b/docs/7.0.x/configuration/alpha-config/index.html index 84cdee52..ca230d8c 100644 --- a/docs/7.0.x/configuration/alpha-config/index.html +++ b/docs/7.0.x/configuration/alpha-config/index.html @@ -6,7 +6,7 @@ Alpha Configuration | OAuth2 Proxy - + @@ -44,7 +44,7 @@ make up the header value

FieldTypeDes Only one source within the struct should be defined at any time.

FieldTypeDescription
value[]byteValue expects a base64 encoded string value.
fromEnvstringFromEnv expects the name of an environment variable.
fromFilestringFromFile expects a path to a file containing the secret value.

Upstream

(Appears on: Upstreams)

Upstream represents the configuration for an upstream server. Requests will be proxied to this upstream if the path matches the request path.

FieldTypeDescription
idstringID should be a unique identifier for the upstream.
This value is required for all upstreams.
pathstringPath is used to map requests to the upstream server.
The closest match will take precedence and all Paths must be unique.
uristringThe URI of the upstream server. This may be an HTTP(S) server of a File
based URL. It may include a path, in which case all requests will be served
under that path.
Eg:
- http://localhost:8080
- https://service.localhost
- https://service.localhost/path
- file://host/path
If the URI's path is "/base" and the incoming request was for "/dir",
the upstream request will be for "/base/dir".
insecureSkipTLSVerifyboolInsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.
This option is insecure and will allow potential Man-In-The-Middle attacks
betweem OAuth2 Proxy and the usptream server.
Defaults to false.
staticboolStatic will make all requests to this upstream have a static response.
The response will have a body of "Authenticated" and a response code
matching StaticCode.
If StaticCode is not set, the response will return a 200 response.
staticCodeintStaticCode determines the response code for the Static response.
This option can only be used with Static enabled.
flushIntervalDurationFlushInterval is the period between flushing the response buffer when
streaming response from the upstream.
Defaults to 1 second.
passHostHeaderboolPassHostHeader determines whether the request host header should be proxied
to the upstream server.
Defaults to true.
proxyWebSocketsboolProxyWebSockets enables proxying of websockets to upstream servers
Defaults to true.

Upstreams

([]Upstream alias)

(Appears on: AlphaOptions)

Upstreams is a collection of definitions for upstream servers.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.0.x/configuration/oauth_provider/index.html b/docs/7.0.x/configuration/oauth_provider/index.html index 3e369b16..3b7ee2cc 100644 --- a/docs/7.0.x/configuration/oauth_provider/index.html +++ b/docs/7.0.x/configuration/oauth_provider/index.html @@ -6,7 +6,7 @@ OAuth Provider Configuration | OAuth2 Proxy - + @@ -59,7 +59,7 @@ to setup the client id and client secret. Your "Redirection URI" will providers.New() to allow oauth2-proxy to use the new Provider.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.0.x/configuration/overview/index.html b/docs/7.0.x/configuration/overview/index.html index 927605dc..c2a7c99f 100644 --- a/docs/7.0.x/configuration/overview/index.html +++ b/docs/7.0.x/configuration/overview/index.html @@ -6,7 +6,7 @@ Overview | OAuth2 Proxy - + @@ -43,7 +43,7 @@ Note that nginxinc/kubernetes-ingress does not include the Lua modu
services:
a-service-backend:
loadBalancer:
servers:
- url: http://172.16.0.2:7555
b-service-backend:
loadBalancer:
servers:
- url: http://172.16.0.3:7555
oauth-backend:
loadBalancer:
servers:
- url: http://172.16.0.1:4180
middlewares:
auth-headers:
headers:
sslRedirect: true
stsSeconds: 315360000
browserXssFilter: true
contentTypeNosniff: true
forceSTSHeader: true
sslHost: example.com
stsIncludeSubdomains: true
stsPreload: true
frameDeny: true
oauth-auth-redirect:
forwardAuth:
address: https://oauth.example.com/
trustForwardHeader: true
authResponseHeaders:
- X-Auth-Request-Access-Token
- Authorization
oauth-auth-wo-redirect:
forwardAuth:
address: https://oauth.example.com/oauth2/auth
trustForwardHeader: true
authResponseHeaders:
- X-Auth-Request-Access-Token
- Authorization
note

If you set up your OAuth2 provider to rotate your client secret, you can use the client-secret-file option to reload the secret when it is updated.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.0.x/configuration/session_storage/index.html b/docs/7.0.x/configuration/session_storage/index.html index b22f3976..d7ee4ce0 100644 --- a/docs/7.0.x/configuration/session_storage/index.html +++ b/docs/7.0.x/configuration/session_storage/index.html @@ -6,7 +6,7 @@ Session Storage | OAuth2 Proxy - + @@ -35,7 +35,7 @@ disclosure.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.0.x/configuration/tls/index.html b/docs/7.0.x/configuration/tls/index.html index 349c3b34..7ad29a17 100644 --- a/docs/7.0.x/configuration/tls/index.html +++ b/docs/7.0.x/configuration/tls/index.html @@ -6,7 +6,7 @@ TLS Configuration | OAuth2 Proxy - + @@ -26,7 +26,7 @@ would be https://internal.yourcompany.com/.

An example Nginx via HSTS:

server {
listen 443 default ssl;
server_name internal.yourcompany.com;
ssl_certificate /path/to/cert.pem;
ssl_certificate_key /path/to/cert.key;
add_header Strict-Transport-Security max-age=2592000;
location / {
proxy_pass http://127.0.0.1:4180;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_connect_timeout 1;
proxy_send_timeout 30;
proxy_read_timeout 30;
}
}

The command line to run oauth2-proxy in this configuration would look like this:

./oauth2-proxy \
--email-domain="yourcompany.com" \
--upstream=http://127.0.0.1:8080/ \
--cookie-secret=... \
--cookie-secure=true \
--provider=... \
--reverse-proxy=true \
--client-id=... \
--client-secret=...
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.0.x/features/endpoints/index.html b/docs/7.0.x/features/endpoints/index.html index 2bd1c888..ae3ff184 100644 --- a/docs/7.0.x/features/endpoints/index.html +++ b/docs/7.0.x/features/endpoints/index.html @@ -6,7 +6,7 @@ Endpoints | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 7.0.x

Endpoints

OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.

  • /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see robotstxt.org for more info
  • /ping - returns a 200 OK response, which is intended for use with health checks
  • /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
  • /oauth2/sign_out - this URL is used to clear the session cookie
  • /oauth2/start - a URL that will redirect to start the OAuth cycle
  • /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
  • /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
  • /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the Nginx auth_request directive

Sign out

To sign the user out, redirect them to /oauth2/sign_out. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the rd query parameter, i.e. redirect the user to something like (notice the url-encoding!):

/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page

Alternatively, include the redirect URL in the X-Auth-Request-Redirect header:

GET /oauth2/sign_out HTTP/1.1
X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
...

(The "sign_out_page" should be the end_session_endpoint from the metadata if your OIDC provider supports Session Management and Discovery.)

BEWARE that the domain you want to redirect to (my-oidc-provider.example.com in the example) must be added to the --whitelist-domain configuration option otherwise the redirect will be ignored.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.0.x/features/request_signatures/index.html b/docs/7.0.x/features/request_signatures/index.html index 3dc70248..fc545e16 100644 --- a/docs/7.0.x/features/request_signatures/index.html +++ b/docs/7.0.x/features/request_signatures/index.html @@ -6,7 +6,7 @@ Request Signatures | OAuth2 Proxy - + @@ -27,7 +27,7 @@ following:

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.0.x/index.html b/docs/7.0.x/index.html index 006ac92f..a9129807 100644 --- a/docs/7.0.x/index.html +++ b/docs/7.0.x/index.html @@ -6,7 +6,7 @@ Installation | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 7.0.x

Installation

  1. Choose how to deploy:

    a. Download Prebuilt Binary (current release is v7.0.1)

    b. Build with $ go get github.com/oauth2-proxy/oauth2-proxy/v7 which will put the binary in $GOPATH/bin

    c. Using the prebuilt docker image quay.io/oauth2-proxy/oauth2-proxy (AMD64, ARMv6 and ARM64 tags available)

Prebuilt binaries can be validated by extracting the file and verifying it against the sha256sum.txt checksum file provided for each release starting with version v3.0.0.

$ sha256sum -c sha256sum.txt 2>&1 | grep OK
oauth2-proxy-x.y.z.linux-amd64: OK
  1. Select a Provider and Register an OAuth Application with a Provider
  2. Configure OAuth2 Proxy using config file, command line options, or environment variables
  3. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.1.x/behaviour/index.html b/docs/7.1.x/behaviour/index.html index a2f77539..43d809cd 100644 --- a/docs/7.1.x/behaviour/index.html +++ b/docs/7.1.x/behaviour/index.html @@ -6,7 +6,7 @@ Behaviour | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 7.1.x

Behaviour

  1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).
  2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with Accept: application/json, in which case 401 Unauthorized is returned)
  3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
  4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)

Notice that the proxy also provides a number of useful endpoints.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.1.x/community/security/index.html b/docs/7.1.x/community/security/index.html index 2a508467..6868e6b0 100644 --- a/docs/7.1.x/community/security/index.html +++ b/docs/7.1.x/community/security/index.html @@ -6,7 +6,7 @@ Security | OAuth2 Proxy - + @@ -38,7 +38,7 @@ merging fixes until all patches are ready. We may also backport the fix to previous releases, but this will be at the discretion of the maintainers.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.1.x/configuration/alpha-config/index.html b/docs/7.1.x/configuration/alpha-config/index.html index e111bdb7..c9069527 100644 --- a/docs/7.1.x/configuration/alpha-config/index.html +++ b/docs/7.1.x/configuration/alpha-config/index.html @@ -6,7 +6,7 @@ Alpha Configuration | OAuth2 Proxy - + @@ -44,7 +44,7 @@ make up the header value

FieldTypeDes Only one source within the struct should be defined at any time.

FieldTypeDescription
value[]byteValue expects a base64 encoded string value.
fromEnvstringFromEnv expects the name of an environment variable.
fromFilestringFromFile expects a path to a file containing the secret value.

Server

(Appears on: AlphaOptions)

Server represents the configuration for an HTTP(S) server

FieldTypeDescription
BindAddressstringBindAddress is the address on which to serve traffic.
Leave blank or set to "-" to disable.
SecureBindAddressstringSecureBindAddress is the address on which to serve secure traffic.
Leave blank or set to "-" to disable.
TLSTLSTLS contains the information for loading the certificate and key for the
secure traffic.

TLS

(Appears on: Server)

TLS contains the information for loading a TLS certifcate and key.

FieldTypeDescription
KeySecretSourceKey is the TLS key data to use.
Typically this will come from a file.
CertSecretSourceCert is the TLS certificate data to use.
Typically this will come from a file.

Upstream

(Appears on: Upstreams)

Upstream represents the configuration for an upstream server. Requests will be proxied to this upstream if the path matches the request path.

FieldTypeDescription
idstringID should be a unique identifier for the upstream.
This value is required for all upstreams.
pathstringPath is used to map requests to the upstream server.
The closest match will take precedence and all Paths must be unique.
uristringThe URI of the upstream server. This may be an HTTP(S) server of a File
based URL. It may include a path, in which case all requests will be served
under that path.
Eg:
- http://localhost:8080
- https://service.localhost
- https://service.localhost/path
- file://host/path
If the URI's path is "/base" and the incoming request was for "/dir",
the upstream request will be for "/base/dir".
insecureSkipTLSVerifyboolInsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.
This option is insecure and will allow potential Man-In-The-Middle attacks
betweem OAuth2 Proxy and the usptream server.
Defaults to false.
staticboolStatic will make all requests to this upstream have a static response.
The response will have a body of "Authenticated" and a response code
matching StaticCode.
If StaticCode is not set, the response will return a 200 response.
staticCodeintStaticCode determines the response code for the Static response.
This option can only be used with Static enabled.
flushIntervalDurationFlushInterval is the period between flushing the response buffer when
streaming response from the upstream.
Defaults to 1 second.
passHostHeaderboolPassHostHeader determines whether the request host header should be proxied
to the upstream server.
Defaults to true.
proxyWebSocketsboolProxyWebSockets enables proxying of websockets to upstream servers
Defaults to true.

Upstreams

([]Upstream alias)

(Appears on: AlphaOptions)

Upstreams is a collection of definitions for upstream servers.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.1.x/configuration/oauth_provider/index.html b/docs/7.1.x/configuration/oauth_provider/index.html index 2c5d6cb0..e64ffe31 100644 --- a/docs/7.1.x/configuration/oauth_provider/index.html +++ b/docs/7.1.x/configuration/oauth_provider/index.html @@ -6,7 +6,7 @@ OAuth Provider Configuration | OAuth2 Proxy - + @@ -59,7 +59,7 @@ to setup the client id and client secret. Your "Redirection URI" will providers.New() to allow oauth2-proxy to use the new Provider.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.1.x/configuration/overview/index.html b/docs/7.1.x/configuration/overview/index.html index 6b1111ab..4dbc5095 100644 --- a/docs/7.1.x/configuration/overview/index.html +++ b/docs/7.1.x/configuration/overview/index.html @@ -6,7 +6,7 @@ Overview | OAuth2 Proxy - + @@ -43,7 +43,7 @@ Note that nginxinc/kubernetes-ingress does not include the Lua modu
services:
a-service-backend:
loadBalancer:
servers:
- url: http://172.16.0.2:7555
b-service-backend:
loadBalancer:
servers:
- url: http://172.16.0.3:7555
oauth-backend:
loadBalancer:
servers:
- url: http://172.16.0.1:4180
middlewares:
auth-headers:
headers:
sslRedirect: true
stsSeconds: 315360000
browserXssFilter: true
contentTypeNosniff: true
forceSTSHeader: true
sslHost: example.com
stsIncludeSubdomains: true
stsPreload: true
frameDeny: true
oauth-auth-redirect:
forwardAuth:
address: https://oauth.example.com/
trustForwardHeader: true
authResponseHeaders:
- X-Auth-Request-Access-Token
- Authorization
oauth-auth-wo-redirect:
forwardAuth:
address: https://oauth.example.com/oauth2/auth
trustForwardHeader: true
authResponseHeaders:
- X-Auth-Request-Access-Token
- Authorization
note

If you set up your OAuth2 provider to rotate your client secret, you can use the client-secret-file option to reload the secret when it is updated.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.1.x/configuration/session_storage/index.html b/docs/7.1.x/configuration/session_storage/index.html index 9fa8f996..1d6bed69 100644 --- a/docs/7.1.x/configuration/session_storage/index.html +++ b/docs/7.1.x/configuration/session_storage/index.html @@ -6,7 +6,7 @@ Session Storage | OAuth2 Proxy - + @@ -35,7 +35,7 @@ disclosure.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.1.x/configuration/tls/index.html b/docs/7.1.x/configuration/tls/index.html index 035f7b82..d5ab6d50 100644 --- a/docs/7.1.x/configuration/tls/index.html +++ b/docs/7.1.x/configuration/tls/index.html @@ -6,7 +6,7 @@ TLS Configuration | OAuth2 Proxy - + @@ -26,7 +26,7 @@ would be https://internal.yourcompany.com/.

An example Nginx via HSTS:

server {
listen 443 default ssl;
server_name internal.yourcompany.com;
ssl_certificate /path/to/cert.pem;
ssl_certificate_key /path/to/cert.key;
add_header Strict-Transport-Security max-age=2592000;
location / {
proxy_pass http://127.0.0.1:4180;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_connect_timeout 1;
proxy_send_timeout 30;
proxy_read_timeout 30;
}
}

The command line to run oauth2-proxy in this configuration would look like this:

./oauth2-proxy \
--email-domain="yourcompany.com" \
--upstream=http://127.0.0.1:8080/ \
--cookie-secret=... \
--cookie-secure=true \
--provider=... \
--reverse-proxy=true \
--client-id=... \
--client-secret=...
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.1.x/features/endpoints/index.html b/docs/7.1.x/features/endpoints/index.html index 4a277d76..f916c82b 100644 --- a/docs/7.1.x/features/endpoints/index.html +++ b/docs/7.1.x/features/endpoints/index.html @@ -6,7 +6,7 @@ Endpoints | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 7.1.x

Endpoints

OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.

  • /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see robotstxt.org for more info
  • /ping - returns a 200 OK response, which is intended for use with health checks
  • /metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by --metrics-address, disabled by default
  • /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
  • /oauth2/sign_out - this URL is used to clear the session cookie
  • /oauth2/start - a URL that will redirect to start the OAuth cycle
  • /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
  • /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
  • /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the Nginx auth_request directive

Sign out

To sign the user out, redirect them to /oauth2/sign_out. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the rd query parameter, i.e. redirect the user to something like (notice the url-encoding!):

/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page

Alternatively, include the redirect URL in the X-Auth-Request-Redirect header:

GET /oauth2/sign_out HTTP/1.1
X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
...

(The "sign_out_page" should be the end_session_endpoint from the metadata if your OIDC provider supports Session Management and Discovery.)

BEWARE that the domain you want to redirect to (my-oidc-provider.example.com in the example) must be added to the --whitelist-domain configuration option otherwise the redirect will be ignored.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/7.1.x/index.html b/docs/7.1.x/index.html index 63375792..2b1235f2 100644 --- a/docs/7.1.x/index.html +++ b/docs/7.1.x/index.html @@ -6,7 +6,7 @@ Installation | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 7.1.x

Installation

  1. Choose how to deploy:

    a. Download Prebuilt Binary (current release is v7.1.3)

    b. Build with $ go get github.com/oauth2-proxy/oauth2-proxy/v7 which will put the binary in $GOPATH/bin

    c. Using the prebuilt docker image quay.io/oauth2-proxy/oauth2-proxy (AMD64, ARMv6 and ARM64 tags available)

    d. Using a Kubernetes manifest (Helm)

Prebuilt binaries can be validated by extracting the file and verifying it against the sha256sum.txt checksum file provided for each release starting with version v3.0.0.

$ sha256sum -c sha256sum.txt 2>&1 | grep OK
oauth2-proxy-x.y.z.linux-amd64: OK
  1. Select a Provider and Register an OAuth Application with a Provider
  2. Configure OAuth2 Proxy using config file, command line options, or environment variables
  3. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/behaviour/index.html b/docs/behaviour/index.html index 03136c45..eb1a430e 100644 --- a/docs/behaviour/index.html +++ b/docs/behaviour/index.html @@ -6,7 +6,7 @@ Behaviour | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 7.2.x

Behaviour

  1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).
  2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with Accept: application/json, in which case 401 Unauthorized is returned)
  3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
  4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)

Notice that the proxy also provides a number of useful endpoints.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/community/security/index.html b/docs/community/security/index.html index 3efbd27e..a3d6f8d3 100644 --- a/docs/community/security/index.html +++ b/docs/community/security/index.html @@ -6,7 +6,7 @@ Security | OAuth2 Proxy - + @@ -38,7 +38,7 @@ merging fixes until all patches are ready. We may also backport the fix to previous releases, but this will be at the discretion of the maintainers.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/configuration/alpha-config/index.html b/docs/configuration/alpha-config/index.html index 2e81e9c8..75d06af2 100644 --- a/docs/configuration/alpha-config/index.html +++ b/docs/configuration/alpha-config/index.html @@ -6,7 +6,7 @@ Alpha Configuration | OAuth2 Proxy - + @@ -44,7 +44,7 @@ make up the header value

FieldTypeDes Only one source within the struct should be defined at any time.

FieldTypeDescription
value[]byteValue expects a base64 encoded string value.
fromEnvstringFromEnv expects the name of an environment variable.
fromFilestringFromFile expects a path to a file containing the secret value.

Server

(Appears on: AlphaOptions)

Server represents the configuration for an HTTP(S) server

FieldTypeDescription
BindAddressstringBindAddress is the address on which to serve traffic.
Leave blank or set to "-" to disable.
SecureBindAddressstringSecureBindAddress is the address on which to serve secure traffic.
Leave blank or set to "-" to disable.
TLSTLSTLS contains the information for loading the certificate and key for the
secure traffic.

TLS

(Appears on: Server)

TLS contains the information for loading a TLS certifcate and key.

FieldTypeDescription
KeySecretSourceKey is the TLS key data to use.
Typically this will come from a file.
CertSecretSourceCert is the TLS certificate data to use.
Typically this will come from a file.

Upstream

(Appears on: UpstreamConfig)

Upstream represents the configuration for an upstream server. Requests will be proxied to this upstream if the path matches the request path.

FieldTypeDescription
idstringID should be a unique identifier for the upstream.
This value is required for all upstreams.
pathstringPath is used to map requests to the upstream server.
The closest match will take precedence and all Paths must be unique.
Path can also take a pattern when used with RewriteTarget.
Path segments can be captured and matched using regular experessions.
Eg:
- ^/foo$: Match only the explicit path /foo
- ^/bar/$: Match any path prefixed with /bar/
- ^/baz/(.*)$: Match any path prefixed with /baz and capture the remaining path for use with RewriteTarget
rewriteTargetstringRewriteTarget allows users to rewrite the request path before it is sent to
the upstream server.
Use the Path to capture segments for reuse within the rewrite target.
Eg: With a Path of ^/baz/(.*), a RewriteTarget of /foo/$1 would rewrite
the request /baz/abc/123 to /foo/abc/123 before proxying to the
upstream server.
uristringThe URI of the upstream server. This may be an HTTP(S) server of a File
based URL. It may include a path, in which case all requests will be served
under that path.
Eg:
- http://localhost:8080
- https://service.localhost
- https://service.localhost/path
- file://host/path
If the URI's path is "/base" and the incoming request was for "/dir",
the upstream request will be for "/base/dir".
insecureSkipTLSVerifyboolInsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.
This option is insecure and will allow potential Man-In-The-Middle attacks
betweem OAuth2 Proxy and the usptream server.
Defaults to false.
staticboolStatic will make all requests to this upstream have a static response.
The response will have a body of "Authenticated" and a response code
matching StaticCode.
If StaticCode is not set, the response will return a 200 response.
staticCodeintStaticCode determines the response code for the Static response.
This option can only be used with Static enabled.
flushIntervalDurationFlushInterval is the period between flushing the response buffer when
streaming response from the upstream.
Defaults to 1 second.
passHostHeaderboolPassHostHeader determines whether the request host header should be proxied
to the upstream server.
Defaults to true.
proxyWebSocketsboolProxyWebSockets enables proxying of websockets to upstream servers
Defaults to true.

UpstreamConfig

(Appears on: AlphaOptions)

UpstreamConfig is a collection of definitions for upstream servers.

FieldTypeDescription
proxyRawPathboolProxyRawPath will pass the raw url path to upstream allowing for url's
like: "/%2F/" which would otherwise be redirected to "/"
upstreams[]UpstreamUpstreams represents the configuration for the upstream servers.
Requests will be proxied to this upstream if the path matches the request path.
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/configuration/oauth_provider/index.html b/docs/configuration/oauth_provider/index.html index 86abdea8..0c75d3fe 100644 --- a/docs/configuration/oauth_provider/index.html +++ b/docs/configuration/oauth_provider/index.html @@ -6,7 +6,7 @@ OAuth Provider Configuration | OAuth2 Proxy - + @@ -59,7 +59,7 @@ to setup the client id and client secret. Your "Redirection URI" will providers.New() to allow oauth2-proxy to use the new Provider.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/configuration/overview/index.html b/docs/configuration/overview/index.html index baf75826..9084ef41 100644 --- a/docs/configuration/overview/index.html +++ b/docs/configuration/overview/index.html @@ -6,7 +6,7 @@ Overview | OAuth2 Proxy - + @@ -43,7 +43,7 @@ Note that nginxinc/kubernetes-ingress does not include the Lua modu
services:
a-service-backend:
loadBalancer:
servers:
- url: http://172.16.0.2:7555
b-service-backend:
loadBalancer:
servers:
- url: http://172.16.0.3:7555
oauth-backend:
loadBalancer:
servers:
- url: http://172.16.0.1:4180
middlewares:
auth-headers:
headers:
sslRedirect: true
stsSeconds: 315360000
browserXssFilter: true
contentTypeNosniff: true
forceSTSHeader: true
sslHost: example.com
stsIncludeSubdomains: true
stsPreload: true
frameDeny: true
oauth-auth-redirect:
forwardAuth:
address: https://oauth.example.com/
trustForwardHeader: true
authResponseHeaders:
- X-Auth-Request-Access-Token
- Authorization
oauth-auth-wo-redirect:
forwardAuth:
address: https://oauth.example.com/oauth2/auth
trustForwardHeader: true
authResponseHeaders:
- X-Auth-Request-Access-Token
- Authorization
note

If you set up your OAuth2 provider to rotate your client secret, you can use the client-secret-file option to reload the secret when it is updated.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/configuration/session_storage/index.html b/docs/configuration/session_storage/index.html index 73d08a2a..8a1cfc37 100644 --- a/docs/configuration/session_storage/index.html +++ b/docs/configuration/session_storage/index.html @@ -6,7 +6,7 @@ Session Storage | OAuth2 Proxy - + @@ -35,7 +35,7 @@ disclosure.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/configuration/tls/index.html b/docs/configuration/tls/index.html index f94719c0..7b0b2c88 100644 --- a/docs/configuration/tls/index.html +++ b/docs/configuration/tls/index.html @@ -6,7 +6,7 @@ TLS Configuration | OAuth2 Proxy - + @@ -26,7 +26,7 @@ would be https://internal.yourcompany.com/.

An example Nginx via HSTS:

server {
listen 443 default ssl;
server_name internal.yourcompany.com;
ssl_certificate /path/to/cert.pem;
ssl_certificate_key /path/to/cert.key;
add_header Strict-Transport-Security max-age=2592000;
location / {
proxy_pass http://127.0.0.1:4180;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_connect_timeout 1;
proxy_send_timeout 30;
proxy_read_timeout 30;
}
}

The command line to run oauth2-proxy in this configuration would look like this:

./oauth2-proxy \
--email-domain="yourcompany.com" \
--upstream=http://127.0.0.1:8080/ \
--cookie-secret=... \
--cookie-secure=true \
--provider=... \
--reverse-proxy=true \
--client-id=... \
--client-secret=...
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/features/endpoints/index.html b/docs/features/endpoints/index.html index 2bc82c52..af880f45 100644 --- a/docs/features/endpoints/index.html +++ b/docs/features/endpoints/index.html @@ -6,7 +6,7 @@ Endpoints | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 7.2.x

Endpoints

OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.

  • /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see robotstxt.org for more info
  • /ping - returns a 200 OK response, which is intended for use with health checks
  • /metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by --metrics-address, disabled by default
  • /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
  • /oauth2/sign_out - this URL is used to clear the session cookie
  • /oauth2/start - a URL that will redirect to start the OAuth cycle
  • /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
  • /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
  • /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the Nginx auth_request directive

Sign out

To sign the user out, redirect them to /oauth2/sign_out. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the rd query parameter, i.e. redirect the user to something like (notice the url-encoding!):

/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page

Alternatively, include the redirect URL in the X-Auth-Request-Redirect header:

GET /oauth2/sign_out HTTP/1.1
X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
...

(The "sign_out_page" should be the end_session_endpoint from the metadata if your OIDC provider supports Session Management and Discovery.)

BEWARE that the domain you want to redirect to (my-oidc-provider.example.com in the example) must be added to the --whitelist-domain configuration option otherwise the redirect will be ignored.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/index.html b/docs/index.html index 3fcc623b..99e2b3ad 100644 --- a/docs/index.html +++ b/docs/index.html @@ -6,7 +6,7 @@ Installation | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: 7.2.x

Installation

  1. Choose how to deploy:

    a. Download Prebuilt Binary (current release is v7.2.1)

    b. Build with $ go get github.com/oauth2-proxy/oauth2-proxy/v7 which will put the binary in $GOPATH/bin

    c. Using the prebuilt docker image quay.io/oauth2-proxy/oauth2-proxy (AMD64, ARMv6 and ARM64 tags available)

    d. Using a Kubernetes manifest (Helm)

Prebuilt binaries can be validated by extracting the file and verifying it against the sha256sum.txt checksum file provided for each release starting with version v3.0.0.

$ sha256sum -c sha256sum.txt
oauth2-proxy-x.y.z.linux-amd64: OK
  1. Select a Provider and Register an OAuth Application with a Provider
  2. Configure OAuth2 Proxy using config file, command line options, or environment variables
  3. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/next/behaviour/index.html b/docs/next/behaviour/index.html index 58dd117e..d98fe5f6 100644 --- a/docs/next/behaviour/index.html +++ b/docs/next/behaviour/index.html @@ -6,7 +6,7 @@ Behaviour | OAuth2 Proxy - + @@ -20,7 +20,7 @@
Version: Next

Behaviour

  1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).
  2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with Accept: application/json, in which case 401 Unauthorized is returned)
  3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
  4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)

Notice that the proxy also provides a number of useful endpoints.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/next/community/security/index.html b/docs/next/community/security/index.html index 7af64462..5e9c3dfb 100644 --- a/docs/next/community/security/index.html +++ b/docs/next/community/security/index.html @@ -6,7 +6,7 @@ Security | OAuth2 Proxy - + @@ -38,7 +38,7 @@ merging fixes until all patches are ready. We may also backport the fix to previous releases, but this will be at the discretion of the maintainers.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/next/configuration/alpha-config/index.html b/docs/next/configuration/alpha-config/index.html index 20ffdb37..b8768511 100644 --- a/docs/next/configuration/alpha-config/index.html +++ b/docs/next/configuration/alpha-config/index.html @@ -6,7 +6,7 @@ Alpha Configuration | OAuth2 Proxy - + @@ -14,7 +14,7 @@ - +
@@ -40,15 +40,37 @@ A duration string is a is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".

GitHubOptions

(Appears on: Provider)

FieldTypeDescription
orgstringOrg sets restrict logins to members of this organisation
teamstringTeam sets restrict logins to members of this team
repostringRepo sets restrict logins to collaborators of this repository
tokenstringToken is the token to use when verifying repository collaborators
it must have push access to the repository
users[]stringUsers allows users with these usernames to login
even if they do not belong to the specified org and team or collaborators

GitLabOptions

(Appears on: Provider)

FieldTypeDescription
group[]stringGroup sets restrict logins to members of this group
projects[]stringProjects restricts logins to members of any of these projects

GoogleOptions

(Appears on: Provider)

FieldTypeDescription
group[]stringGroups sets restrict logins to members of this google group
adminEmailstringAdminEmail is the google admin to impersonate for api calls
serviceAccountJsonstringServiceAccountJSON is the path to the service account json credentials

Header

(Appears on: AlphaOptions)

Header represents an individual header that will be added to a request or response header.

FieldTypeDescription
namestringName is the header name to be used for this set of values.
Names should be unique within a list of Headers.
preserveRequestValueboolPreserveRequestValue determines whether any values for this header
should be preserved for the request to the upstream server.
This option only applies to injected request headers.
Defaults to false (headers that match this header will be stripped).
values[]HeaderValueValues contains the desired values for this header

HeaderValue

(Appears on: Header)

HeaderValue represents a single header value and the sources that can -make up the header value

FieldTypeDescription
value[]byteValue expects a base64 encoded string value.
fromEnvstringFromEnv expects the name of an environment variable.
fromFilestringFromFile expects a path to a file containing the secret value.
claimstringClaim is the name of the claim in the session that the value should be
loaded from.
prefixstringPrefix is an optional prefix that will be prepended to the value of the
claim if it is non-empty.
basicAuthPasswordSecretSourceBasicAuthPassword converts this claim into a basic auth header.
Note the value of claim will become the basic auth username and the
basicAuthPassword will be used as the password value.

KeycloakOptions

(Appears on: Provider)

FieldTypeDescription
groups[]stringGroup enables to restrict login to members of indicated group
roles[]stringRole enables to restrict login to users with role (only available when using the keycloak-oidc provider)

LoginGovOptions

(Appears on: Provider)

FieldTypeDescription
jwtKeystringJWTKey is a private key in PEM format used to sign JWT,
jwtKeyFilestringJWTKeyFile is a path to the private key file in PEM format used to sign the JWT
pubjwkURLstringPubJWKURL is the JWK pubkey access endpoint

OIDCOptions

(Appears on: Provider)

FieldTypeDescription
issuerURLstringIssuerURL is the OpenID Connect issuer URL
eg: https://accounts.google.com
insecureAllowUnverifiedEmailboolInsecureAllowUnverifiedEmail prevents failures if an email address in an id_token is not verified
default set to 'false'
insecureSkipIssuerVerificationboolInsecureSkipIssuerVerification skips verification of ID token issuers. When false, ID Token Issuers must match the OIDC discovery URL
default set to 'false'
insecureSkipNonceboolInsecureSkipNonce skips verifying the ID Token's nonce claim that must match
the random nonce sent in the initial OAuth flow. Otherwise, the nonce is checked
after the initial OAuth redeem & subsequent token refreshes.
default set to 'true'
Warning: In a future release, this will change to 'false' by default for enhanced security.
skipDiscoveryboolSkipDiscovery allows to skip OIDC discovery and use manually supplied Endpoints
default set to 'false'
jwksURLstringJwksURL is the OpenID Connect JWKS URL
eg: https://www.googleapis.com/oauth2/v3/certs
emailClaimstringEmailClaim indicates which claim contains the user email,
default set to 'email'
groupsClaimstringGroupsClaim indicates which claim contains the user groups
default set to 'groups'
userIDClaimstringUserIDClaim indicates which claim contains the user ID
default set to 'email'
audienceClaims[]stringAudienceClaim allows to define any claim that is verified against the client id
By default aud claim is used for verification.
extraAudiences[]stringExtraAudiences is a list of additional audiences that are allowed
to pass verification in addition to the client id.

Provider

(Appears on: Providers)

Provider holds all configuration for a single provider

FieldTypeDescription
clientIDstringClientID is the OAuth Client ID that is defined in the provider
This value is required for all providers.
clientSecretstringClientSecret is the OAuth Client Secret that is defined in the provider
This value is required for all providers.
clientSecretFilestringClientSecretFile is the name of the file
containing the OAuth Client Secret, it will be used if ClientSecret is not set.
keycloakConfigKeycloakOptionsKeycloakConfig holds all configurations for Keycloak provider.
azureConfigAzureOptionsAzureConfig holds all configurations for Azure provider.
ADFSConfigADFSOptionsADFSConfig holds all configurations for ADFS provider.
bitbucketConfigBitbucketOptionsBitbucketConfig holds all configurations for Bitbucket provider.
githubConfigGitHubOptionsGitHubConfig holds all configurations for GitHubC provider.
gitlabConfigGitLabOptionsGitLabConfig holds all configurations for GitLab provider.
googleConfigGoogleOptionsGoogleConfig holds all configurations for Google provider.
oidcConfigOIDCOptionsOIDCConfig holds all configurations for OIDC provider
or providers utilize OIDC configurations.
loginGovConfigLoginGovOptionsLoginGovConfig holds all configurations for LoginGov provider.
idstringID should be a unique identifier for the provider.
This value is required for all providers.
providerProviderTypeType is the OAuth provider
must be set from the supported providers group,
otherwise 'Google' is set as default
namestringName is the providers display name
if set, it will be shown to the users in the login page.
caFiles[]stringCAFiles is a list of paths to CA certificates that should be used when connecting to the provider.
If not specified, the default Go trust sources are used instead
loginURLstringLoginURL is the authentication endpoint
redeemURLstringRedeemURL is the token redemption endpoint
profileURLstringProfileURL is the profile access endpoint
resourcestringProtectedResource is the resource that is protected (Azure AD and ADFS only)
validateURLstringValidateURL is the access token validation endpoint
scopestringScope is the OAuth scope specification
promptstringPrompt is OIDC prompt
approvalPromptstringApprovalPrompt is the OAuth approval_prompt
default is set to 'force'
allowedGroups[]stringAllowedGroups is a list of restrict logins to members of this group
acrValuesstringAcrValues is a string of acr values

ProviderType

(string alias)

(Appears on: Provider)

ProviderType is used to enumerate the different provider type options +make up the header value

FieldTypeDescription
value[]byteValue expects a base64 encoded string value.
fromEnvstringFromEnv expects the name of an environment variable.
fromFilestringFromFile expects a path to a file containing the secret value.
claimstringClaim is the name of the claim in the session that the value should be
loaded from.
prefixstringPrefix is an optional prefix that will be prepended to the value of the
claim if it is non-empty.
basicAuthPasswordSecretSourceBasicAuthPassword converts this claim into a basic auth header.
Note the value of claim will become the basic auth username and the
basicAuthPassword will be used as the password value.

KeycloakOptions

(Appears on: Provider)

FieldTypeDescription
groups[]stringGroup enables to restrict login to members of indicated group
roles[]stringRole enables to restrict login to users with role (only available when using the keycloak-oidc provider)

LoginGovOptions

(Appears on: Provider)

FieldTypeDescription
jwtKeystringJWTKey is a private key in PEM format used to sign JWT,
jwtKeyFilestringJWTKeyFile is a path to the private key file in PEM format used to sign the JWT
pubjwkURLstringPubJWKURL is the JWK pubkey access endpoint

LoginURLParameter

(Appears on: Provider)

LoginURLParameter is the configuration for a single query parameter that +can be passed through from the /oauth2/start endpoint to the IdP login +URL. The "default" option specifies the default value or values (if any) +that will be passed to the IdP for this parameter, and "allow" is a list +of options for ways in which this parameter can be set or overridden via +the query string to /oauth2/start. +If only a default is specified and no "allow" then the parameter is +effectively fixed - the default value will always be used and anything +passed to the start URL will be ignored. If only "allow" is specified +but no default then the parameter will only be passed on to the IdP if +the caller provides it, and no value will be sent otherwise.

Examples:

A parameter whose value is fixed

name: organization
default:
- myorg

A parameter that is not passed by default, but may be set to one of a +fixed set of values

name: prompt
allow:
- value: login
- value: consent
- value: select_account

A parameter that is passed by default but may be overridden by one of +a fixed set of values

name: prompt
default: ["login"]
allow:
- value: consent
- value: select_account

A parameter that may be overridden, but only by values that match a +regular expression. For example to restrict login_hint to email +addresses in your organization's domain:

name: login_hint
allow:
- pattern: '^[^@]*@example\.com$'
# this allows at most one "@" sign, and requires "example.com" domain.

Note that the YAML rules around exactly which characters are allowed +and/or require escaping in different types of string literals are +convoluted. For regular expressions the single quoted form is simplest +as backslash is not considered to be an escape character. Alternatively +use the "chomped block" format |-:

- pattern: |-
^[^@]*@example\.com$

The hyphen is important, a | block would have a trailing newline +character.

FieldTypeDescription
namestringName specifies the name of the query parameter.
default[]string(Optional) Default specifies a default value or values that will be
passed to the IdP if not overridden.
allow[]URLParameterRule(Optional) Allow specifies rules about how the default (if any) may be
overridden via the query string to /oauth2/start. Only
values that match one or more of the allow rules will be
forwarded to the IdP.

OIDCOptions

(Appears on: Provider)

FieldTypeDescription
issuerURLstringIssuerURL is the OpenID Connect issuer URL
eg: https://accounts.google.com
insecureAllowUnverifiedEmailboolInsecureAllowUnverifiedEmail prevents failures if an email address in an id_token is not verified
default set to 'false'
insecureSkipIssuerVerificationboolInsecureSkipIssuerVerification skips verification of ID token issuers. When false, ID Token Issuers must match the OIDC discovery URL
default set to 'false'
insecureSkipNonceboolInsecureSkipNonce skips verifying the ID Token's nonce claim that must match
the random nonce sent in the initial OAuth flow. Otherwise, the nonce is checked
after the initial OAuth redeem & subsequent token refreshes.
default set to 'true'
Warning: In a future release, this will change to 'false' by default for enhanced security.
skipDiscoveryboolSkipDiscovery allows to skip OIDC discovery and use manually supplied Endpoints
default set to 'false'
jwksURLstringJwksURL is the OpenID Connect JWKS URL
eg: https://www.googleapis.com/oauth2/v3/certs
emailClaimstringEmailClaim indicates which claim contains the user email,
default set to 'email'
groupsClaimstringGroupsClaim indicates which claim contains the user groups
default set to 'groups'
userIDClaimstringUserIDClaim indicates which claim contains the user ID
default set to 'email'
audienceClaims[]stringAudienceClaim allows to define any claim that is verified against the client id
By default aud claim is used for verification.
extraAudiences[]stringExtraAudiences is a list of additional audiences that are allowed
to pass verification in addition to the client id.

Provider

(Appears on: Providers)

Provider holds all configuration for a single provider

FieldTypeDescription
clientIDstringClientID is the OAuth Client ID that is defined in the provider
This value is required for all providers.
clientSecretstringClientSecret is the OAuth Client Secret that is defined in the provider
This value is required for all providers.
clientSecretFilestringClientSecretFile is the name of the file
containing the OAuth Client Secret, it will be used if ClientSecret is not set.
keycloakConfigKeycloakOptionsKeycloakConfig holds all configurations for Keycloak provider.
azureConfigAzureOptionsAzureConfig holds all configurations for Azure provider.
ADFSConfigADFSOptionsADFSConfig holds all configurations for ADFS provider.
bitbucketConfigBitbucketOptionsBitbucketConfig holds all configurations for Bitbucket provider.
githubConfigGitHubOptionsGitHubConfig holds all configurations for GitHubC provider.
gitlabConfigGitLabOptionsGitLabConfig holds all configurations for GitLab provider.
googleConfigGoogleOptionsGoogleConfig holds all configurations for Google provider.
oidcConfigOIDCOptionsOIDCConfig holds all configurations for OIDC provider
or providers utilize OIDC configurations.
loginGovConfigLoginGovOptionsLoginGovConfig holds all configurations for LoginGov provider.
idstringID should be a unique identifier for the provider.
This value is required for all providers.
providerProviderTypeType is the OAuth provider
must be set from the supported providers group,
otherwise 'Google' is set as default
namestringName is the providers display name
if set, it will be shown to the users in the login page.
caFiles[]stringCAFiles is a list of paths to CA certificates that should be used when connecting to the provider.
If not specified, the default Go trust sources are used instead
loginURLstringLoginURL is the authentication endpoint
loginURLParameters[]LoginURLParameterLoginURLParameters defines the parameters that can be passed from the start URL to the IdP login URL
redeemURLstringRedeemURL is the token redemption endpoint
profileURLstringProfileURL is the profile access endpoint
resourcestringProtectedResource is the resource that is protected (Azure AD and ADFS only)
validateURLstringValidateURL is the access token validation endpoint
scopestringScope is the OAuth scope specification
allowedGroups[]stringAllowedGroups is a list of restrict logins to members of this group

ProviderType

(string alias)

(Appears on: Provider)

ProviderType is used to enumerate the different provider type options Valid options are: adfs, azure, bitbucket, digitalocean facebook, github, gitlab, google, keycloak, keycloak-oidc, linkedin, login.gov, nextcloud and oidc.

Providers

([]Provider alias)

(Appears on: AlphaOptions)

Providers is a collection of definitions for providers.

SecretSource

(Appears on: ClaimSource, HeaderValue, TLS)

SecretSource references an individual secret value. Only one source within the struct should be defined at any time.

FieldTypeDescription
value[]byteValue expects a base64 encoded string value.
fromEnvstringFromEnv expects the name of an environment variable.
fromFilestringFromFile expects a path to a file containing the secret value.

Server

(Appears on: AlphaOptions)

Server represents the configuration for an HTTP(S) server

FieldTypeDescription
BindAddressstringBindAddress is the address on which to serve traffic.
Leave blank or set to "-" to disable.
SecureBindAddressstringSecureBindAddress is the address on which to serve secure traffic.
Leave blank or set to "-" to disable.
TLSTLSTLS contains the information for loading the certificate and key for the
secure traffic and further configuration for the TLS server.

TLS

(Appears on: Server)

TLS contains the information for loading a TLS certificate and key -as well as an optional minimal TLS version that is acceptable.

FieldTypeDescription
KeySecretSourceKey is the TLS key data to use.
Typically this will come from a file.
CertSecretSourceCert is the TLS certificate data to use.
Typically this will come from a file.
MinVersionstringMinVersion is the minimal TLS version that is acceptable.
E.g. Set to "TLS1.3" to select TLS version 1.3

Upstream

(Appears on: UpstreamConfig)

Upstream represents the configuration for an upstream server. -Requests will be proxied to this upstream if the path matches the request path.

FieldTypeDescription
idstringID should be a unique identifier for the upstream.
This value is required for all upstreams.
pathstringPath is used to map requests to the upstream server.
The closest match will take precedence and all Paths must be unique.
Path can also take a pattern when used with RewriteTarget.
Path segments can be captured and matched using regular experessions.
Eg:
- ^/foo$: Match only the explicit path /foo
- ^/bar/$: Match any path prefixed with /bar/
- ^/baz/(.*)$: Match any path prefixed with /baz and capture the remaining path for use with RewriteTarget
rewriteTargetstringRewriteTarget allows users to rewrite the request path before it is sent to
the upstream server.
Use the Path to capture segments for reuse within the rewrite target.
Eg: With a Path of ^/baz/(.*), a RewriteTarget of /foo/$1 would rewrite
the request /baz/abc/123 to /foo/abc/123 before proxying to the
upstream server.
uristringThe URI of the upstream server. This may be an HTTP(S) server of a File
based URL. It may include a path, in which case all requests will be served
under that path.
Eg:
- http://localhost:8080
- https://service.localhost
- https://service.localhost/path
- file://host/path
If the URI's path is "/base" and the incoming request was for "/dir",
the upstream request will be for "/base/dir".
insecureSkipTLSVerifyboolInsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.
This option is insecure and will allow potential Man-In-The-Middle attacks
betweem OAuth2 Proxy and the usptream server.
Defaults to false.
staticboolStatic will make all requests to this upstream have a static response.
The response will have a body of "Authenticated" and a response code
matching StaticCode.
If StaticCode is not set, the response will return a 200 response.
staticCodeintStaticCode determines the response code for the Static response.
This option can only be used with Static enabled.
flushIntervalDurationFlushInterval is the period between flushing the response buffer when
streaming response from the upstream.
Defaults to 1 second.
passHostHeaderboolPassHostHeader determines whether the request host header should be proxied
to the upstream server.
Defaults to true.
proxyWebSocketsboolProxyWebSockets enables proxying of websockets to upstream servers
Defaults to true.

UpstreamConfig

(Appears on: AlphaOptions)

UpstreamConfig is a collection of definitions for upstream servers.

FieldTypeDescription
proxyRawPathboolProxyRawPath will pass the raw url path to upstream allowing for url's
like: "/%2F/" which would otherwise be redirected to "/"
upstreams[]UpstreamUpstreams represents the configuration for the upstream servers.
Requests will be proxied to this upstream if the path matches the request path.
Edit this page
Copyright © 2022 OAuth2 Proxy.
+as well as an optional minimal TLS version that is acceptable.

FieldTypeDescription
KeySecretSourceKey is the TLS key data to use.
Typically this will come from a file.
CertSecretSourceCert is the TLS certificate data to use.
Typically this will come from a file.
MinVersionstringMinVersion is the minimal TLS version that is acceptable.
E.g. Set to "TLS1.3" to select TLS version 1.3

URLParameterRule

(Appears on: LoginURLParameter)

URLParameterRule represents a rule by which query parameters +passed to the /oauth2/start endpoint are checked to determine whether +they are valid overrides for the given parameter passed to the IdP's +login URL. Either Value or Pattern should be supplied, not both.

FieldTypeDescription
valuestringA Value rule matches just this specific value
patternstringA Pattern rule gives a regular expression that must be matched by
some substring of the value. The expression is not automatically
anchored to the start and end of the value, if you want to restrict
the whole parameter value you must anchor it yourself with ^ and $.

Upstream

(Appears on: UpstreamConfig)

Upstream represents the configuration for an upstream server. +Requests will be proxied to this upstream if the path matches the request path.

FieldTypeDescription
idstringID should be a unique identifier for the upstream.
This value is required for all upstreams.
pathstringPath is used to map requests to the upstream server.
The closest match will take precedence and all Paths must be unique.
Path can also take a pattern when used with RewriteTarget.
Path segments can be captured and matched using regular experessions.
Eg:
- ^/foo$: Match only the explicit path /foo
- ^/bar/$: Match any path prefixed with /bar/
- ^/baz/(.*)$: Match any path prefixed with /baz and capture the remaining path for use with RewriteTarget
rewriteTargetstringRewriteTarget allows users to rewrite the request path before it is sent to
the upstream server.
Use the Path to capture segments for reuse within the rewrite target.
Eg: With a Path of ^/baz/(.*), a RewriteTarget of /foo/$1 would rewrite
the request /baz/abc/123 to /foo/abc/123 before proxying to the
upstream server.
uristringThe URI of the upstream server. This may be an HTTP(S) server of a File
based URL. It may include a path, in which case all requests will be served
under that path.
Eg:
- http://localhost:8080
- https://service.localhost
- https://service.localhost/path
- file://host/path
If the URI's path is "/base" and the incoming request was for "/dir",
the upstream request will be for "/base/dir".
insecureSkipTLSVerifyboolInsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.
This option is insecure and will allow potential Man-In-The-Middle attacks
betweem OAuth2 Proxy and the usptream server.
Defaults to false.
staticboolStatic will make all requests to this upstream have a static response.
The response will have a body of "Authenticated" and a response code
matching StaticCode.
If StaticCode is not set, the response will return a 200 response.
staticCodeintStaticCode determines the response code for the Static response.
This option can only be used with Static enabled.
flushIntervalDurationFlushInterval is the period between flushing the response buffer when
streaming response from the upstream.
Defaults to 1 second.
passHostHeaderboolPassHostHeader determines whether the request host header should be proxied
to the upstream server.
Defaults to true.
proxyWebSocketsboolProxyWebSockets enables proxying of websockets to upstream servers
Defaults to true.

UpstreamConfig

(Appears on: AlphaOptions)

UpstreamConfig is a collection of definitions for upstream servers.

FieldTypeDescription
proxyRawPathboolProxyRawPath will pass the raw url path to upstream allowing for url's
like: "/%2F/" which would otherwise be redirected to "/"
upstreams[]UpstreamUpstreams represents the configuration for the upstream servers.
Requests will be proxied to this upstream if the path matches the request path.
Edit this page
Copyright © 2022 OAuth2 Proxy.
- + @@ -56,6 +78,6 @@ Requests will be proxied to this upstream if the path matches the request path.< - + \ No newline at end of file diff --git a/docs/next/configuration/oauth_provider/index.html b/docs/next/configuration/oauth_provider/index.html index 1fd9b7bd..c4d3dcc8 100644 --- a/docs/next/configuration/oauth_provider/index.html +++ b/docs/next/configuration/oauth_provider/index.html @@ -6,7 +6,7 @@ OAuth Provider Configuration | OAuth2 Proxy - + @@ -59,7 +59,7 @@ to setup the client id and client secret. Your "Redirection URI" will providers.New() to allow oauth2-proxy to use the new Provider.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/next/configuration/overview/index.html b/docs/next/configuration/overview/index.html index f1ef3aca..5c7264a0 100644 --- a/docs/next/configuration/overview/index.html +++ b/docs/next/configuration/overview/index.html @@ -6,7 +6,7 @@ Overview | OAuth2 Proxy - + @@ -43,7 +43,7 @@ Note that nginxinc/kubernetes-ingress does not include the Lua modu
services:
a-service-backend:
loadBalancer:
servers:
- url: http://172.16.0.2:7555
b-service-backend:
loadBalancer:
servers:
- url: http://172.16.0.3:7555
oauth-backend:
loadBalancer:
servers:
- url: http://172.16.0.1:4180
middlewares:
auth-headers:
headers:
sslRedirect: true
stsSeconds: 315360000
browserXssFilter: true
contentTypeNosniff: true
forceSTSHeader: true
sslHost: example.com
stsIncludeSubdomains: true
stsPreload: true
frameDeny: true
oauth-auth-redirect:
forwardAuth:
address: https://oauth.example.com/
trustForwardHeader: true
authResponseHeaders:
- X-Auth-Request-Access-Token
- Authorization
oauth-auth-wo-redirect:
forwardAuth:
address: https://oauth.example.com/oauth2/auth
trustForwardHeader: true
authResponseHeaders:
- X-Auth-Request-Access-Token
- Authorization
note

If you set up your OAuth2 provider to rotate your client secret, you can use the client-secret-file option to reload the secret when it is updated.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/next/configuration/session_storage/index.html b/docs/next/configuration/session_storage/index.html index ccea23b0..9d2acdcf 100644 --- a/docs/next/configuration/session_storage/index.html +++ b/docs/next/configuration/session_storage/index.html @@ -6,7 +6,7 @@ Session Storage | OAuth2 Proxy - + @@ -35,7 +35,7 @@ disclosure.

Edit this page
Copyright © 2022 OAuth2 Proxy.
- + diff --git a/docs/next/configuration/tls/index.html b/docs/next/configuration/tls/index.html index 2285669e..48eb9dbd 100644 --- a/docs/next/configuration/tls/index.html +++ b/docs/next/configuration/tls/index.html @@ -6,7 +6,7 @@ TLS Configuration | OAuth2 Proxy - + @@ -29,7 +29,7 @@ would be https://internal.yourcompany.com/.

An example Nginx via HSTS:

server {
listen 443 default ssl;
server_name internal.yourcompany.com;
ssl_certificate /path/to/cert.pem;
ssl_certificate_key /path/to/cert.key;
add_header Strict-Transport-Security max-age=2592000;
location / {
proxy_pass http://127.0.0.1:4180;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_connect_timeout 1;
proxy_send_timeout 30;
proxy_read_timeout 30;
}
}

  • The command line to run oauth2-proxy in this configuration would look like this:

    ./oauth2-proxy \
    --email-domain="yourcompany.com" \
    --upstream=http://127.0.0.1:8080/ \
    --cookie-secret=... \
    --cookie-secure=true \
    --provider=... \
    --reverse-proxy=true \
    --client-id=... \
    --client-secret=...
    • Edit this page
    Copyright © 2022 OAuth2 Proxy.
    - + diff --git a/docs/next/features/endpoints/index.html b/docs/next/features/endpoints/index.html index 7da1761f..ae816eda 100644 --- a/docs/next/features/endpoints/index.html +++ b/docs/next/features/endpoints/index.html @@ -6,7 +6,7 @@ Endpoints | OAuth2 Proxy - + @@ -20,7 +20,7 @@
    Version: Next

    Endpoints

    OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.

    • /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see robotstxt.org for more info
    • /ping - returns a 200 OK response, which is intended for use with health checks
    • /metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by --metrics-address, disabled by default
    • /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
    • /oauth2/sign_out - this URL is used to clear the session cookie
    • /oauth2/start - a URL that will redirect to start the OAuth cycle
    • /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
    • /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
    • /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the Nginx auth_request directive

    Sign out

    To sign the user out, redirect them to /oauth2/sign_out. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the rd query parameter, i.e. redirect the user to something like (notice the url-encoding!):

    /oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page

    Alternatively, include the redirect URL in the X-Auth-Request-Redirect header:

    GET /oauth2/sign_out HTTP/1.1
    X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
    ...

    (The "sign_out_page" should be the end_session_endpoint from the metadata if your OIDC provider supports Session Management and Discovery.)

    BEWARE that the domain you want to redirect to (my-oidc-provider.example.com in the example) must be added to the --whitelist-domain configuration option otherwise the redirect will be ignored.

    Auth

    This endpoint returns 202 Accepted response or a 401 Unauthorized response.

    It can be configured using the following query parameters query parameters:

    • allowed_groups: comma separated list of allowed groups
    • allowed_email_domains: comma separated list of allowed email domains
    Edit this page
    Copyright © 2022 OAuth2 Proxy.
    - + diff --git a/docs/next/index.html b/docs/next/index.html index c2dcd6f5..5b4d30dc 100644 --- a/docs/next/index.html +++ b/docs/next/index.html @@ -6,7 +6,7 @@ Installation | OAuth2 Proxy - + @@ -20,7 +20,7 @@
    Version: Next

    Installation

    1. Choose how to deploy:

      a. Download Prebuilt Binary (current release is v7.2.1)

      b. Build with $ go get github.com/oauth2-proxy/oauth2-proxy/v7 which will put the binary in $GOPATH/bin

      c. Using the prebuilt docker image quay.io/oauth2-proxy/oauth2-proxy (AMD64, ARMv6 and ARM64 tags available)

      d. Using a Kubernetes manifest (Helm)

    Prebuilt binaries can be validated by extracting the file and verifying it against the sha256sum.txt checksum file provided for each release starting with version v3.0.0.

    $ sha256sum -c sha256sum.txt
    oauth2-proxy-x.y.z.linux-amd64: OK
    1. Select a Provider and Register an OAuth Application with a Provider
    2. Configure OAuth2 Proxy using config file, command line options, or environment variables
    3. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
    Edit this page
    Copyright © 2022 OAuth2 Proxy.
    - + diff --git a/index.html b/index.html index 524e646f..18133f7b 100644 --- a/index.html +++ b/index.html @@ -6,7 +6,7 @@ Welcome to OAuth2 Proxy | OAuth2 Proxy - + @@ -20,7 +20,7 @@ to validate accounts by email, domain or group.

    CHANGELOG.

    Sign In Page

    Architecture

    OAuth2 Proxy Architecture

    Copyright © 2022 OAuth2 Proxy.
    - + diff --git a/runtime~main.97af83ee.js b/runtime~main.b17d8bbd.js similarity index 98% rename from runtime~main.97af83ee.js rename to runtime~main.b17d8bbd.js index a42aefce..5e9aa3de 100644 --- a/runtime~main.97af83ee.js +++ b/runtime~main.b17d8bbd.js @@ -1 +1 @@ -!function(e){function c(c){for(var f,b,d=c[0],n=c[1],o=c[2],u=0,l=[];u