Add loader for static users

* Initial commit of multiple provider logic:
1. Created new provider options.
2. Created legacy provider options and conversion options.
3. Added Providers to alpha Options.
4. Started Validation migration of multiple providers
5. Tests.

* fixed lint issues

* additional lint fixes

* Nits and alterations based on CR: manliy splitting large providers validation function and adding comments to provider options

* fixed typo

* removed weird : file

* small CR changes

* Removed GoogleGroups validation due to new allowed-groups (including tests). Added line in CHANGELOG

* Update pkg/apis/options/providers.go

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

* Update pkg/apis/options/providers.go

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

* Update pkg/apis/options/providers.go

Co-authored-by: Nick Meves <nick.meves@greenhouse.io>

* Initial commit of multiple provider logic:
1. Created new provider options.
2. Created legacy provider options and conversion options.
3. Added Providers to alpha Options.
4. Started Validation migration of multiple providers
5. Tests.

* fixed lint issues

* additional lint fixes

* Nits and alterations based on CR: manliy splitting large providers validation function and adding comments to provider options

* small CR changes

* auto generates alpha_config.md

* rebase (mainly service alpha options related conflicts)

* removed :

* Nits and alterations based on CR: manliy splitting large providers validation function and adding comments to provider options

* small CR changes

* Removed GoogleGroups validation due to new allowed-groups (including tests). Added line in CHANGELOG

* "cntd. rebase"

* ran make generate again

* last conflicts

* removed duplicate client id validation

* 1. Removed provider prefixes
2. altered optionsWithNilProvider logic
3. altered default provider logic
4. moved change in CHANELOG to 7.0.0

* fixed TestGoogleGroupOptions test

* ran make generate

* moved CHANGLOG line to 7.1.1

* moved changelog comment to 7.1.2 (additional rebase)

Co-authored-by: Yana Segal <yana.segal@nielsen.com>
Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
Co-authored-by: Nick Meves <nick.meves@greenhouse.io>

.dockerignore

@@ -0,0 +1,5 @@
+Dockerfile.dev
+docs
+vendor
+.git
+oauth2-proxy

.github/CODEOWNERS

@@ -0,0 +1,23 @@
+# Default owner should be a core org reviewers unless overridden by later rules in this file
+* @oauth2-proxy/reviewers
+
+# login.gov provider
+# Note:  If @timothy-spencer terms out of his appointment, your best bet
+# for finding somebody who can test the oauth2-proxy would be to ask somebody
+# in the login.gov team (https://login.gov/developers/), the cloud.gov team
+# (https://cloud.gov/docs/help/), or the 18F org (https://18f.gsa.gov/contact/
+# or the public devops channel at https://chat.18f.gov/).
+providers/logingov.go @timothy-spencer
+providers/logingov_test.go @timothy-spencer
+
+# Bitbucket provider
+providers/bitbucket.go @aledeganopix4d
+providers/bitbucket_test.go @aledeganopix4d
+
+# Nextcloud provider
+providers/nextcloud.go @Ramblurr
+providers/nextcloud_test.go @Ramblurr
+
+# DigitalOcean provider
+providers/digitalocean.go @kamaln7
+providers/digitalocean_test.go @kamaln7

.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,37 @@
+<!--- Provide a general summary of the issue in the Title above -->
+
+## Expected Behavior
+
+<!--- If you're describing a bug, tell us what should happen -->
+<!--- If you're suggesting a change/improvement, tell us how it should work -->
+
+## Current Behavior
+
+<!--- If describing a bug, tell us what happens instead of the expected behavior -->
+<!--- If suggesting a change/improvement, explain the difference from current behavior -->
+
+## Possible Solution
+
+<!--- Not obligatory, but suggest a fix/reason for the bug, -->
+<!--- or ideas how to implement the addition or change -->
+
+## Steps to Reproduce (for bugs)
+
+<!--- Provide a link to a live example, or an unambiguous set of steps to -->
+<!--- reproduce this bug. Include code to reproduce, if relevant -->
+
+1.  <!--- Step 1 --->
+2.  <!--- Step 2 --->
+3.  <!--- Step 3 --->
+4.  <!--- Step 4 --->
+
+## Context
+
+<!--- How has this issue affected you? What are you trying to accomplish? -->
+<!--- Providing context helps us come up with a solution that is most useful in the real world -->
+
+## Your Environment
+
+<!--- Include as many relevant details about the environment you experienced the bug in -->
+
+- Version used:

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,25 @@
+<!--- Provide a general summary of your changes in the Title above -->
+
+## Description
+
+<!--- Describe your changes in detail -->
+
+## Motivation and Context
+
+<!--- Why is this change required? What problem does it solve? -->
+<!--- If it fixes an open issue, please link to the issue here. -->
+
+## How Has This Been Tested?
+
+<!--- Please describe in detail how you tested your changes. -->
+<!--- Include details of your testing environment, and the tests you ran to -->
+<!--- see how your change affects other areas of the code, etc. -->
+
+## Checklist:
+
+<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
+<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
+
+- [ ] My change requires a change to the documentation or CHANGELOG.
+- [ ] I have updated the documentation/CHANGELOG accordingly.
+- [ ] I have created a feature (non-master) branch for my PR.

.github/workflows/ci.yaml

@@ -0,0 +1,62 @@
+name: Continuous Integration
+
+on:
+  push:
+    branches:
+      - '**'
+      # - $default-branch
+  pull_request:
+    branches:
+      - '**'
+      # - $default-branch
+
+jobs:
+  build:
+    env:
+      COVER: true
+    runs-on: ubuntu-20.04
+    steps:
+
+    - name: Check out code
+      uses: actions/checkout@v2
+
+    - name: Set up Go 1.16
+      uses: actions/setup-go@v2
+      with:
+        go-version: 1.16.x
+      id: go
+
+    - name: Get dependencies
+      run: |
+        curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.36.0
+        curl -L https://codeclimate.com/downloads/test-reporter/test-reporter-latest-linux-amd64 > ./cc-test-reporter
+        chmod +x ./cc-test-reporter
+
+    - name: Verify Code Generation
+      run: |
+        make verify-generate
+
+    - name: Lint
+      run: |
+        make lint
+
+    - name: Build
+      run: |
+        make build
+
+    - name: Test
+      env:
+        CC_TEST_REPORTER_ID: ${{ secrets.CC_TEST_REPORTER_ID }}
+      run: |
+        ./.github/workflows/test.sh
+
+  docker:
+    runs-on: ubuntu-20.04
+    steps:
+
+    - name: Check out code
+      uses: actions/checkout@v2
+
+    - name: Docker Build
+      run: |
+        make docker

.github/workflows/codeql.yml

@@ -0,0 +1,57 @@
+name: "Code scanning - action"
+
+on:
+  push:
+    branches: [master, ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [master]
+  schedule:
+    - cron: '0 15 * * 2'
+      
+jobs:
+  CodeQL-Build:
+
+    strategy:
+      fail-fast: false
+
+    # CodeQL runs on ubuntu-latest and windows-latest
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+      with:
+        # We must fetch at least the immediate parents so that if this is
+        # a pull request then we can checkout the head.
+        fetch-depth: 2
+
+    # If this run was triggered by a pull request event, then checkout
+    # the head of the pull request instead of the merge commit.
+    - run: git checkout HEAD^2
+      if: ${{ github.event_name == 'pull_request' }}
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v1
+      with:
+        languages: go
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v1
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 https://git.io/JvXDl
+
+    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+    #    and modify them (or add more) to build your code if your project
+    #    uses a compiled language
+
+    #- run: |
+    #   make bootstrap
+    #   make release
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v1

.github/workflows/docs.yaml

@@ -0,0 +1,67 @@
+name: documentation
+
+on:
+  pull_request:
+    branches: [master]
+    paths: ['docs/**']
+  push:
+    branches: [master]
+    paths: ['docs/**']
+
+jobs:
+  checks:
+    if: github.event_name != 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+      - uses: actions/setup-node@v1
+        with:
+          node-version: '12.x'
+      - name: Test Build
+        working-directory: ./docs
+        run: |
+          if [ -e yarn.lock ]; then
+          yarn install --frozen-lockfile
+          elif [ -e package-lock.json ]; then
+          npm ci
+          else
+          npm i
+          fi
+          npm run build
+  gh-release:
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+      - uses: actions/setup-node@v1
+        with:
+          node-version: '12.x'
+      - name: Add key to allow access to repository
+        env:
+          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+        run: |
+          mkdir -p ~/.ssh
+          ssh-keyscan github.com >> ~/.ssh/known_hosts
+          echo "${{ secrets.GH_PAGES_DEPLOY }}" > ~/.ssh/id_rsa
+          chmod 600 ~/.ssh/id_rsa
+          cat <<EOT >> ~/.ssh/config
+          Host github.com
+          HostName github.com
+          IdentityFile ~/.ssh/id_rsa
+          EOT
+      - name: Release to GitHub Pages
+        working-directory: ./docs
+        env:
+          USE_SSH: true
+          GIT_USER: git
+        run: |
+          git config --global user.email "actions@gihub.com"
+          git config --global user.name "gh-actions"
+          if [ -e yarn.lock ]; then
+          yarn install --frozen-lockfile
+          elif [ -e package-lock.json ]; then
+          npm ci
+          else
+          npm i
+          fi
+          npx docusaurus deploy

.github/workflows/stale.yml

@@ -0,0 +1,17 @@
+name: Mark stale issues and pull requests
+
+on:
+  schedule:
+  - cron: "0 0 * * *"
+
+jobs:
+  stale:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/stale@v1
+      with:
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        stale-issue-message: 'This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.'
+        stale-pr-message: 'This pull request has been inactive for 60 days. If the pull request is still relevant please comment to re-activate the pull request. If no action is taken within 7 days, the pull request will be marked closed.'

.github/workflows/test.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+# manually exiting from script, because after-build needs to run always
+set +e
+
+if [ -z $CC_TEST_REPORTER_ID ]; then
+  echo "1. CC_TEST_REPORTER_ID is unset, skipping"
+else
+  echo "1. Running before-build"
+  ./cc-test-reporter before-build
+fi
+
+echo "2. Running test"
+make test
+TEST_STATUS=$?
+
+if [ -z $CC_TEST_REPORTER_ID ]; then
+  echo "3. CC_TEST_REPORTER_ID is unset, skipping"
+else
+  echo "3. Running after-build"
+  ./cc-test-reporter after-build --exit-code $TEST_STATUS -t gocov --prefix $(go list -m)
+fi
+
+if [ "$TEST_STATUS" -ne 0 ]; then
+  echo "Test failed, status code: $TEST_STATUS"
+  exit $TEST_STATUS
+fi

.gitignore

@@ -1,5 +1,13 @@
-google_auth_proxy
-oauth2_proxy
+oauth2-proxy
+vendor
+dist
+release
+.godeps
+*.exe
+.env
+.bundle
+c.out
+
 # Go.gitignore
 # Compiled Object files, Static and Dynamic libs (Shared Objects)
 *.o
@@ -9,6 +17,7 @@ oauth2_proxy
 # Folders
 _obj
 _test
+.idea/
 
 # Architecture specific extensions/prefixes
 *.[568vq]
@@ -22,9 +31,12 @@ _cgo_export.*
 
 _testmain.go
 
-*.exe
-dist
-.godeps
-
 # Editor swap/temp files
 .*.swp
+
+# Dockerfile.dev is ignored by both git and docker
+# for faster development cycle of docker build
+# cp Dockerfile Dockerfile.dev
+# vi Dockerfile.dev
+# docker build -f Dockerfile.dev .
+Dockerfile.dev

.golangci.yml

@@ -0,0 +1,43 @@
+run:
+  deadline: 120s
+linters:
+  enable:
+    - govet
+    - golint
+    - ineffassign
+    - goconst
+    - deadcode
+    - gofmt
+    - goimports
+    - gosec
+    - gosimple
+    - staticcheck
+    - structcheck
+    - typecheck
+    - unused
+    - varcheck
+    - bodyclose
+    - dogsled
+    - goprintffuncname
+    - misspell
+    - prealloc
+    - scopelint
+    - stylecheck
+    - unconvert
+    - gocritic
+  disable-all: true
+issues:
+  exclude-rules:
+    - path: _test\.go
+      linters:
+        - scopelint
+        - bodyclose
+        - unconvert
+        - gocritic
+        - gosec
+    # If we have tests in shared test folders, these can be less strictly linted
+    - path: tests/.*_tests\.go
+      linters:
+        - golint
+        - bodyclose
+        - stylecheck

.travis.yml

@@ -1,13 +0,0 @@
-language: go
-go:
-  - 1.3.3
-  - 1.4.2
-script:
-  - curl -s https://raw.githubusercontent.com/pote/gpm/v1.3.2/bin/gpm > gpm
-  - chmod +x gpm
-  - ./gpm install
-  - ./test.sh
-sudo: false
-notifications:
-  email: false
-

CHANGELOG.md

@@ -0,0 +1,804 @@
+# Vx.x.x (Pre-release)
+
+## Release Highlights
+
+## Important Notes
+
+## Breaking Changes
+
+## Changes since v7.1.2
+
+- [#947](https://github.com/oauth2-proxy/oauth2-proxy/pull/947) Multiple provider ingestion and validation in alpha options (first stage: [#926](https://github.com/oauth2-proxy/oauth2-proxy/issues/926)) (@yanasega)
+
+# V7.1.2
+
+## Release Highlights
+
+- Metrics bind address initialisation was broken in config files
+
+## Important Notes
+
+N/A
+
+## Breaking Changes
+
+N/A
+
+## Changes since v7.1.1
+
+- [#1129](https://github.com/oauth2-proxy/oauth2-proxy/pull/1129) Rewrite OpenRedirect tests in ginkgo (@JoelSpeed)
+- [#1127](https://github.com/oauth2-proxy/oauth2-proxy/pull/1127) Remove unused fields from OAuthProxy (@JoelSpeed)
+- [#1141](https://github.com/oauth2-proxy/oauth2-proxy/pull/1141) Fix metrics server bind address initialization (@oliver006)
+
+# V7.1.1
+
+## Release Highlights
+
+- The metrics server could not be started in v7.1.0, this is now fixed.
+
+## Important Notes
+
+N/A
+
+## Breaking Changes
+
+N/A
+
+## Changes since v7.1.0
+
+- [#1133](https://github.com/oauth2-proxy/oauth2-proxy/pull/1133) Metrics server should be constructed with secure bind address for TLS (@JoelSpeed)
+
+# V7.1.0
+
+## Release Highlights
+
+- New improved design for sign in and error pages based on bulma framework
+- Refactored templates loading
+  - `robots.txt`, `sign_in.html` and `error.html` can now be provided individually in `--custom-templates-dir`
+  - If any of the above are not provided, defaults are used
+  - Defaults templates be found in [pkg/app/pagewriter](https://github.com/oauth2-proxy/oauth2-proxy/tree/v7.1.0/pkg/app/pagewriter)
+- Introduction of basic prometheus metrics
+- Introduction of Traefik based local testing/example environment
+- Support for request IDs to allow request co-ordination of log lines
+
+## Important Notes
+
+- [GHSA-652x-m2gr-hppm](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-652x-m2gr-hppm) GitLab group authorization stopped working in v7.0.0, the functionality has now been restored, please see the linked advisory for details
+- [#1103](https://github.com/oauth2-proxy/oauth2-proxy/pull/1103) Upstream request signatures via `--signature-key` is
+  deprecated. Support will be removed completely in v8.0.0.
+- [1087](https://github.com/oauth2-proxy/oauth2-proxy/pull/1087) The default logging templates have been updated to include {{.RequestID}}
+- [#1117](https://github.com/oauth2-proxy/oauth2-proxy/pull/1117) The `--gcp-healthchecks` option is now deprecated. It will be removed in a future release.
+  - To migrate, you can change your application health checks for OAuth2 Proxy to point to
+    the `--ping-path` value.
+  - You can also migrate the user agent based health check using the `--ping-user-agent` option. Set it to `GoogleHC/1.0` to allow health checks on the path `/` from the Google health checker.
+
+## Breaking Changes
+
+N/A
+
+## Changes since v7.0.1
+
+- [GHSA-652x-m2gr-hppm](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-652x-m2gr-hppm) `--gitlab-group` GitLab Group Authorization config flag stopped working in v7.0.0 (@NickMeves, @papey)
+- [#1113](https://github.com/oauth2-proxy/oauth2-proxy/pull/1113) Panic with GitLab project repository auth (@piersharding)
+- [#1116](https://github.com/oauth2-proxy/oauth2-proxy/pull/1116) Reinstate preferEmailToUser behaviour for basic auth sessions (@JoelSpeed)
+- [#1115](https://github.com/oauth2-proxy/oauth2-proxy/pull/1115) Fix upstream proxy appending ? to requests (@JoelSpeed)
+- [#1117](https://github.com/oauth2-proxy/oauth2-proxy/pull/1117) Deprecate GCP HealthCheck option (@JoelSpeed)
+- [#1104](https://github.com/oauth2-proxy/oauth2-proxy/pull/1104) Allow custom robots text pages (@JoelSpeed)
+- [#1045](https://github.com/oauth2-proxy/oauth2-proxy/pull/1045) Ensure redirect URI always has a scheme (@JoelSpeed)
+- [#1103](https://github.com/oauth2-proxy/oauth2-proxy/pull/1103) Deprecate upstream request signatures (@NickMeves)
+- [#1087](https://github.com/oauth2-proxy/oauth2-proxy/pull/1087) Support Request ID in logging (@NickMeves)
+- [#914](https://github.com/oauth2-proxy/oauth2-proxy/pull/914) Extract email from id_token for azure provider when oidc is configured (@weinong)
+- [#1047](https://github.com/oauth2-proxy/oauth2-proxy/pull/1047) Refactor HTTP Server and add ServerGroup to handle graceful shutdown of multiple servers (@JoelSpeed)
+- [#1070](https://github.com/oauth2-proxy/oauth2-proxy/pull/1070) Refactor logging middleware to middleware package (@NickMeves)
+- [#1064](https://github.com/oauth2-proxy/oauth2-proxy/pull/1064) Add support for setting groups on session when using basic auth (@stefansedich)
+- [#1056](https://github.com/oauth2-proxy/oauth2-proxy/pull/1056) Add option for custom logos on the sign in page (@JoelSpeed)
+- [#1054](https://github.com/oauth2-proxy/oauth2-proxy/pull/1054) Update to Go 1.16 (@JoelSpeed)
+- [#1052](https://github.com/oauth2-proxy/oauth2-proxy/pull/1052) Update golangci-lint to latest version (v1.36.0) (@JoelSpeed)
+- [#1043](https://github.com/oauth2-proxy/oauth2-proxy/pull/1043) Refactor Sign In Page rendering and capture all page rendering code in pagewriter package (@JoelSpeed)
+- [#1029](https://github.com/oauth2-proxy/oauth2-proxy/pull/1029) Refactor error page rendering and allow debug messages on error (@JoelSpeed)
+- [#1028](https://github.com/oauth2-proxy/oauth2-proxy/pull/1028) Refactor templates, update theme and provide styled error pages (@JoelSpeed)
+- [#1039](https://github.com/oauth2-proxy/oauth2-proxy/pull/1039) Ensure errors in tests are logged to the GinkgoWriter (@JoelSpeed)
+- [#980](https://github.com/oauth2-proxy/oauth2-proxy/pull/980) Add Prometheus metrics endpoint (@neuralsandwich)
+- [#1023](https://github.com/oauth2-proxy/oauth2-proxy/pull/1023) Update docs on Traefik ForwardAuth support without the use of Traefik 'errors' middleware (@pcneo83)
+- [#1091](https://github.com/oauth2-proxy/oauth2-proxy/pull/1091) Add an example with Traefik (configuration without Traefik 'errors' middleware) (@fcollonval)
+
+# V7.0.1
+
+## Release Highlights
+
+- Fixed a bug that meant that flag ordering mattered
+- Fixed a bug where response headers for groups were not being flattened
+
+## Important Notes
+
+N/A
+
+## Breaking Changes
+
+N/A
+
+## Changes since v7.0.0
+
+- [#1020](https://github.com/oauth2-proxy/oauth2-proxy/pull/1020) Flatten array-based response headers (@NickMeves)
+- [#1026](https://github.com/oauth2-proxy/oauth2-proxy/pull/1026) Ensure config flags get parsed correctly when other flags precede them (@JoelSpeed)
+
+# V7.0.0
+
+## Release Highlights
+
+- Major internal improvements to provider interfaces
+- Added group authorization support
+- Improved support for external auth for Traefik
+- Introduced alpha configuration format to allow users to trial new configuration format and alpha features
+- GitLab provider now supports restricting to members of a project
+- Keycloak provider now supports restricting users to members of a set of groups
+- (Alpha) Flexible header configuration allowing user defined mapping of session claims to header values
+
+
+## Important Notes
+
+- [GHSA-4mf2-f3wh-gvf2](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-4mf2-f3wh-gvf2) The whitelist domain feature has been updated to fix a vulnerability that was identified, please see the linked advisory for details
+- [#964](https://github.com/oauth2-proxy/oauth2-proxy/pull/964) Redirect URL generation will attempt secondary strategies
+  in the priority chain if any fail the `IsValidRedirect` security check. Previously any failures fell back to `/`.
+- [#953](https://github.com/oauth2-proxy/oauth2-proxy/pull/953) Keycloak will now use `--profile-url` if set for the userinfo endpoint
+  instead of `--validate-url`. `--validate-url` will still work for backwards compatibility.
+- [#957](https://github.com/oauth2-proxy/oauth2-proxy/pull/957) To use X-Forwarded-{Proto,Host,Uri} on redirect detection, `--reverse-proxy` must be `true`.
+- [#936](https://github.com/oauth2-proxy/oauth2-proxy/pull/936) `--user-id-claim` option is deprecated and replaced by `--oidc-email-claim`
+- [#630](https://github.com/oauth2-proxy/oauth2-proxy/pull/630) Gitlab projects needs a Gitlab application with the extra `read_api` enabled
+- [#849](https://github.com/oauth2-proxy/oauth2-proxy/pull/849) `/oauth2/auth` `allowed_groups` querystring parameter can be paired with the `allowed-groups` configuration option.
+  - The `allowed_groups` querystring parameter can specify multiple comma delimited groups.
+  - In this scenario, the user must have a group (from their multiple groups) present in both lists to not get a 401 or 403 response code.
+  - Example:
+    - OAuth2-Proxy globally sets the `allowed_groups` as `engineering`.
+    - An application using Kubernetes ingress uses the `/oauth2/auth` endpoint with `allowed_groups` querystring set to `backend`.
+    - A user must have a session with the groups `["engineering", "backend"]` to pass authorization.
+    - Another user with the groups `["engineering", "frontend"]` would fail the querystring authorization portion.
+- [#905](https://github.com/oauth2-proxy/oauth2-proxy/pull/905) Existing sessions from v6.0.0 or earlier are no longer valid. They will trigger a reauthentication.
+- [#826](https://github.com/oauth2-proxy/oauth2-proxy/pull/826) `skip-auth-strip-headers` now applies to all requests, not just those where authentication would be skipped.
+- [#797](https://github.com/oauth2-proxy/oauth2-proxy/pull/797) The behavior of the Google provider Groups restriction changes with this
+  - Either `--google-group` or the new `--allowed-group` will work for Google now (`--google-group` will be used if both are set)
+  - Group membership lists will be passed to the backend with the `X-Forwarded-Groups` header
+  - If you change the list of allowed groups, existing sessions that now don't have a valid group will be logged out immediately.
+    - Previously, group membership was only checked on session creation and refresh.
+- [#789](https://github.com/oauth2-proxy/oauth2-proxy/pull/789) `--skip-auth-route` is (almost) backwards compatible with `--skip-auth-regex`
+  - We are marking `--skip-auth-regex` as DEPRECATED and will remove it in the next major version.
+  - If your regex contains an `=` and you want it for all methods, you will need to add a leading `=` (this is the area where `--skip-auth-regex` doesn't port perfectly)
+- [#575](https://github.com/oauth2-proxy/oauth2-proxy/pull/575) Sessions from v5.1.1 or earlier will no longer validate since they were not signed with SHA1.
+  - Sessions from v6.0.0 or later had a graceful conversion to SHA256 that resulted in no reauthentication
+  - Upgrading from v5.1.1 or earlier will result in a reauthentication
+- [#616](https://github.com/oauth2-proxy/oauth2-proxy/pull/616) Ensure you have configured oauth2-proxy to use the `groups` scope.
+  - The user may be logged out initially as they may not currently have the `groups` claim however after going back through login process wil be authenticated.
+- [#839](https://github.com/oauth2-proxy/oauth2-proxy/pull/839) Enables complex data structures for group claim entries, which are output as Json by default.
+
+## Breaking Changes
+
+- [#964](https://github.com/oauth2-proxy/oauth2-proxy/pull/964) `--reverse-proxy` must be true to trust `X-Forwarded-*` headers as canonical.
+  These are used throughout the application in redirect URLs, cookie domains and host logging logic. These are the headers:
+  - `X-Forwarded-Proto` instead of `req.URL.Scheme`
+  - `X-Forwarded-Host` instead of `req.Host`
+  - `X-Forwarded-Uri` instead of `req.URL.RequestURI()`
+- [#953](https://github.com/oauth2-proxy/oauth2-proxy/pull/953) In config files & envvar configs, `keycloak_group` is now the plural `keycloak_groups`.
+  Flag configs are still `--keycloak-group` but it can be passed multiple times.
+- [#911](https://github.com/oauth2-proxy/oauth2-proxy/pull/911) Specifying a non-existent provider will cause OAuth2-Proxy to fail on startup instead of defaulting to "google".
+- [#797](https://github.com/oauth2-proxy/oauth2-proxy/pull/797) Security changes to Google provider group authorization flow
+  - If you change the list of allowed groups, existing sessions that now don't have a valid group will be logged out immediately.
+    - Previously, group membership was only checked on session creation and refresh.
+- [#722](https://github.com/oauth2-proxy/oauth2-proxy/pull/722) When a Redis session store is configured, OAuth2-Proxy will fail to start up unless connection and health checks to Redis pass
+- [#800](https://github.com/oauth2-proxy/oauth2-proxy/pull/800) Fix import path for v7. The import path has changed to support the go get installation.
+  - You can now `go get github.com/oauth2-proxy/oauth2-proxy/v7` to get the latest `v7` version of OAuth2 Proxy
+  - Import paths for package are now under `v7`, eg `github.com/oauth2-proxy/oauth2-proxy/v7/pkg/<module>`
+- [#753](https://github.com/oauth2-proxy/oauth2-proxy/pull/753) A bug in the Azure provider prevented it from properly passing the configured protected `--resource`
+  via the login url. If this option was used in the past, behavior will change with this release as it will
+  affect the tokens returned by Azure. In the past, the tokens were always for `https://graph.microsoft.com` (the default)
+  and will now be for the configured resource (if it exists, otherwise it will run into errors)
+- [#754](https://github.com/oauth2-proxy/oauth2-proxy/pull/754) The Azure provider now has token refresh functionality implemented. This means that there won't
+  be any redirects in the browser anymore when tokens expire, but instead a token refresh is initiated
+  in the background, which leads to new tokens being returned in the cookies.
+  - Please note that `--cookie-refresh` must be 0 (the default) or equal to the token lifespan configured in Azure AD to make
+    Azure token refresh reliable. Setting this value to 0 means that it relies on the provider implementation
+    to decide if a refresh is required.
+
+## Changes since v6.1.1
+
+- [GHSA-4mf2-f3wh-gvf2](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-4mf2-f3wh-gvf2) Subdomain checking of whitelisted domains could allow unintended redirects (@NickMeves)
+- [#1002](https://github.com/oauth2-proxy/oauth2-proxy/pull/1002) Use logger for logging refreshed session in azure and gitlab provider (@Bibob7)
+- [#799](https://github.com/oauth2-proxy/oauth2-proxy/pull/799) Use comma separated multiple values for header (@lilida)
+- [#903](https://github.com/oauth2-proxy/oauth2-proxy/pull/903) Add docs and generated reference for Alpha configuration (@JoelSpeed)
+- [#995](https://github.com/oauth2-proxy/oauth2-proxy/pull/995) Add Security Policy (@JoelSpeed)
+- [#964](https://github.com/oauth2-proxy/oauth2-proxy/pull/964) Require `--reverse-proxy` true to trust `X-Forwareded-*` type headers (@NickMeves)
+- [#970](https://github.com/oauth2-proxy/oauth2-proxy/pull/970) Fix joined cookie name for those containing underline in the suffix (@peppered)
+- [#953](https://github.com/oauth2-proxy/oauth2-proxy/pull/953) Migrate Keycloak to EnrichSession & support multiple groups for authorization (@NickMeves)
+- [#957](https://github.com/oauth2-proxy/oauth2-proxy/pull/957) Use X-Forwarded-{Proto,Host,Uri} on redirect as last resort (@linuxgemini)
+- [#630](https://github.com/oauth2-proxy/oauth2-proxy/pull/630) Add support for Gitlab project based authentication (@factorysh)
+- [#907](https://github.com/oauth2-proxy/oauth2-proxy/pull/907) Introduce alpha configuration option to enable testing of structured configuration (@JoelSpeed)
+- [#938](https://github.com/oauth2-proxy/oauth2-proxy/pull/938) Cleanup missed provider renaming refactor methods (@NickMeves)
+- [#816](https://github.com/oauth2-proxy/oauth2-proxy/pull/816) (via [#936](https://github.com/oauth2-proxy/oauth2-proxy/pull/936)) Support non-list group claims (@loafoe)
+- [#936](https://github.com/oauth2-proxy/oauth2-proxy/pull/936) Refactor OIDC Provider and support groups from Profile URL (@NickMeves)
+- [#869](https://github.com/oauth2-proxy/oauth2-proxy/pull/869) Streamline provider interface method names and signatures (@NickMeves)
+- [#849](https://github.com/oauth2-proxy/oauth2-proxy/pull/849) Support group authorization on `oauth2/auth` endpoint via `allowed_groups` querystring (@NickMeves)
+- [#925](https://github.com/oauth2-proxy/oauth2-proxy/pull/925) Fix basic auth legacy header conversion (@JoelSpeed)
+- [#916](https://github.com/oauth2-proxy/oauth2-proxy/pull/916) Add AlphaOptions struct to prepare for alpha config loading (@JoelSpeed)
+- [#923](https://github.com/oauth2-proxy/oauth2-proxy/pull/923) Support TLS 1.3 (@aajisaka)
+- [#918](https://github.com/oauth2-proxy/oauth2-proxy/pull/918) Fix log header output (@JoelSpeed)
+- [#911](https://github.com/oauth2-proxy/oauth2-proxy/pull/911) Validate provider type on startup. (@arcivanov)
+- [#906](https://github.com/oauth2-proxy/oauth2-proxy/pull/906) Set up v6.1.x versioned documentation as default documentation (@JoelSpeed)
+- [#905](https://github.com/oauth2-proxy/oauth2-proxy/pull/905) Remove v5 legacy sessions support (@NickMeves)
+- [#904](https://github.com/oauth2-proxy/oauth2-proxy/pull/904) Set `skip-auth-strip-headers` to `true` by default (@NickMeves)
+- [#826](https://github.com/oauth2-proxy/oauth2-proxy/pull/826) Integrate new header injectors into project (@JoelSpeed)
+- [#797](https://github.com/oauth2-proxy/oauth2-proxy/pull/797) Create universal Authorization behavior across providers (@NickMeves)
+- [#898](https://github.com/oauth2-proxy/oauth2-proxy/pull/898) Migrate documentation to Docusaurus (@JoelSpeed)
+- [#754](https://github.com/oauth2-proxy/oauth2-proxy/pull/754) Azure token refresh (@codablock)
+- [#850](https://github.com/oauth2-proxy/oauth2-proxy/pull/850) Increase session fields in `/oauth2/userinfo` endpoint (@NickMeves)
+- [#825](https://github.com/oauth2-proxy/oauth2-proxy/pull/825) Fix code coverage reporting on GitHub actions(@JoelSpeed)
+- [#796](https://github.com/oauth2-proxy/oauth2-proxy/pull/796) Deprecate GetUserName & GetEmailAdress for EnrichSessionState (@NickMeves)
+- [#705](https://github.com/oauth2-proxy/oauth2-proxy/pull/705) Add generic Header injectors for upstream request and response headers (@JoelSpeed)
+- [#753](https://github.com/oauth2-proxy/oauth2-proxy/pull/753) Pass resource parameter in login url (@codablock)
+- [#789](https://github.com/oauth2-proxy/oauth2-proxy/pull/789) Add `--skip-auth-route` configuration option for `METHOD=pathRegex` based allowlists (@NickMeves)
+- [#575](https://github.com/oauth2-proxy/oauth2-proxy/pull/575) Stop accepting legacy SHA1 signed cookies (@NickMeves)
+- [#722](https://github.com/oauth2-proxy/oauth2-proxy/pull/722) Validate Redis configuration options at startup (@NickMeves)
+- [#791](https://github.com/oauth2-proxy/oauth2-proxy/pull/791) Remove GetPreferredUsername method from provider interface (@NickMeves)
+- [#764](https://github.com/oauth2-proxy/oauth2-proxy/pull/764) Document bcrypt encryption for htpasswd (and hide SHA) (@lentzi90)
+- [#778](https://github.com/oauth2-proxy/oauth2-proxy/pull/778) Use display-htpasswd-form flag
+- [#616](https://github.com/oauth2-proxy/oauth2-proxy/pull/616) Add support to ensure user belongs in required groups when using the OIDC provider (@stefansedich)
+- [#800](https://github.com/oauth2-proxy/oauth2-proxy/pull/800) Fix import path for v7 (@johejo)
+- [#783](https://github.com/oauth2-proxy/oauth2-proxy/pull/783) Update Go to 1.15 (@johejo)
+- [#813](https://github.com/oauth2-proxy/oauth2-proxy/pull/813) Fix build (@thiagocaiubi)
+- [#801](https://github.com/oauth2-proxy/oauth2-proxy/pull/801) Update go-redis/redis to v8 (@johejo)
+- [#750](https://github.com/oauth2-proxy/oauth2-proxy/pull/750) ci: Migrate to Github Actions (@shinebayar-g)
+- [#829](https://github.com/oauth2-proxy/oauth2-proxy/pull/820) Rename test directory to testdata (@johejo)
+- [#819](https://github.com/oauth2-proxy/oauth2-proxy/pull/819) Improve CI (@johejo)
+- [#989](https://github.com/oauth2-proxy/oauth2-proxy/pull/989) Adapt isAjax to support mimetype lists (@rassie)
+- [#1013](https://github.com/oauth2-proxy/oauth2-proxy/pull/1013) Update alpine version to 3.13 (@nishanth-pinnapareddy)
+
+# v6.1.1
+
+## Release Highlights
+
+- Fixed a bug which prevented static upstreams from being used
+- Fixed a bug which prevented file based upstreams from being used
+- Ensure that X-Forwarded-Host is respected consistently
+
+## Important Notes
+
+N/A
+
+## Breaking
+
+N/A
+
+## Changes since v6.1.0
+
+- [#729](https://github.com/oauth2-proxy/oauth2-proxy/pull/729) Use X-Forwarded-Host consistently when set (@NickMeves)
+- [#746](https://github.com/oauth2-proxy/oauth2-proxy/pull/746) Fix conversion of static responses in upstreams (@JoelSpeed)
+
+# v6.1.0
+
+## Release Highlights
+
+- Redis session stores now support authenticated connections
+- Error logging can now be separated from info logging by directing error logs to stderr
+- Added --session-cookie-minimal flag which helps prevent large session cookies
+- Improvements to force-https behaviour
+- Allow requests to skip authentication based on their source IP
+
+## Important Notes
+
+- [#632](https://github.com/oauth2-proxy/oauth2-proxy/pull/632) There is backwards compatibility to sessions from v5
+  - Any unencrypted sessions from before v5 that only contained a Username & Email will trigger a reauthentication
+
+## Breaking Changes
+
+## Changes since v6.0.0
+
+- [#742](https://github.com/oauth2-proxy/oauth2-proxy/pull/742) Only log no cookie match if cookie domains specified (@JoelSpeed)
+- [#562](https://github.com/oauth2-proxy/oauth2-proxy/pull/562) Create generic Authorization Header constructor (@JoelSpeed)
+- [#715](https://github.com/oauth2-proxy/oauth2-proxy/pull/715) Ensure session times are not nil before printing them (@JoelSpeed)
+- [#714](https://github.com/oauth2-proxy/oauth2-proxy/pull/714) Support passwords with Redis session stores (@NickMeves)
+- [#719](https://github.com/oauth2-proxy/oauth2-proxy/pull/719) Add Gosec fixes to areas that are intermittently flagged on PRs (@NickMeves)
+- [#718](https://github.com/oauth2-proxy/oauth2-proxy/pull/718) Allow Logging to stdout with separate Error Log Channel
+- [#690](https://github.com/oauth2-proxy/oauth2-proxy/pull/690) Address GoSec security findings & remediate (@NickMeves)
+- [#689](https://github.com/oauth2-proxy/oauth2-proxy/pull/689) Fix finicky logging_handler_test from time drift (@NickMeves)
+- [#700](https://github.com/oauth2-proxy/oauth2-proxy/pull/700) Allow OIDC Bearer auth IDTokens to have empty email claim & profile URL (@NickMeves)
+- [#699](https://github.com/oauth2-proxy/oauth2-proxy/pull/699) Align persistence ginkgo tests with conventions (@NickMeves)
+- [#696](https://github.com/oauth2-proxy/oauth2-proxy/pull/696) Preserve query when building redirect
+- [#561](https://github.com/oauth2-proxy/oauth2-proxy/pull/561) Refactor provider URLs to package level vars (@JoelSpeed)
+- [#682](https://github.com/oauth2-proxy/oauth2-proxy/pull/682) Refactor persistent session store session ticket management (@NickMeves)
+- [#688](https://github.com/oauth2-proxy/oauth2-proxy/pull/688) Refactor session loading to make use of middleware pattern (@JoelSpeed)
+- [#593](https://github.com/oauth2-proxy/oauth2-proxy/pull/593) Integrate upstream package with OAuth2 Proxy (@JoelSpeed)
+- [#687](https://github.com/oauth2-proxy/oauth2-proxy/pull/687) Refactor HTPasswd Validator (@JoelSpeed)
+- [#624](https://github.com/oauth2-proxy/oauth2-proxy/pull/624) Allow stripping authentication headers from whitelisted requests with `--skip-auth-strip-headers` (@NickMeves)
+- [#673](https://github.com/oauth2-proxy/oauth2-proxy/pull/673) Add --session-cookie-minimal option to create session cookies with no tokens (@NickMeves)
+- [#632](https://github.com/oauth2-proxy/oauth2-proxy/pull/632) Reduce session size by encoding with MessagePack and using LZ4 compression (@NickMeves)
+- [#675](https://github.com/oauth2-proxy/oauth2-proxy/pull/675) Fix required ruby version and deprecated option for building docs (@mkontani)
+- [#669](https://github.com/oauth2-proxy/oauth2-proxy/pull/669) Reduce docker context to improve build times (@JoelSpeed)
+- [#668](https://github.com/oauth2-proxy/oauth2-proxy/pull/668) Use req.Host in --force-https when req.URL.Host is empty (@zucaritask)
+- [#660](https://github.com/oauth2-proxy/oauth2-proxy/pull/660) Use builder pattern to simplify requests to external endpoints (@JoelSpeed)
+- [#591](https://github.com/oauth2-proxy/oauth2-proxy/pull/591) Introduce upstream package with new reverse proxy implementation (@JoelSpeed)
+- [#576](https://github.com/oauth2-proxy/oauth2-proxy/pull/576) Separate Cookie validation out of main options validation (@JoelSpeed)
+- [#656](https://github.com/oauth2-proxy/oauth2-proxy/pull/656) Split long session cookies more precisely (@NickMeves)
+- [#619](https://github.com/oauth2-proxy/oauth2-proxy/pull/619) Improve Redirect to HTTPs behaviour (@JoelSpeed)
+- [#654](https://github.com/oauth2-proxy/oauth2-proxy/pull/654) Close client connections after each redis test (@JoelSpeed)
+- [#542](https://github.com/oauth2-proxy/oauth2-proxy/pull/542) Move SessionStore tests to independent package (@JoelSpeed)
+- [#577](https://github.com/oauth2-proxy/oauth2-proxy/pull/577) Move Cipher and Session Store initialisation out of Validation (@JoelSpeed)
+- [#635](https://github.com/oauth2-proxy/oauth2-proxy/pull/635) Support specifying alternative provider TLS trust source(s) (@k-wall)
+- [#649](https://github.com/oauth2-proxy/oauth2-proxy/pull/650) Resolve an issue where an empty healthcheck URL and ping-user-agent returns the healthcheck response (@jordancrawfordnz)
+- [#662](https://github.com/oauth2-proxy/oauth2-proxy/pull/662) Do not add Cache-Control header to response from auth only endpoint (@johejo)
+- [#552](https://github.com/oauth2-proxy/oauth2-proxy/pull/522) Implements --trusted-ip option to allow clients behind specified IPs or CIDR ranges to bypass authentication (@Izzette)
+- [#733](https://github.com/oauth2-proxy/oauth2-proxy/pull/733) dist.sh: remove go version from asset links (@syscll)
+
+# v6.0.0
+
+## Release Highlights
+
+- Migrated to an independent GitHub organisation
+- Added local test environment examples using docker-compose and kind
+- Error pages will now be rendered when upstream connections fail
+- Non-Existent options in config files will now return errors on startup
+- Sessions are now always encrypted, independent of configuration
+
+## Important Notes
+
+- (Security) Fix for [open redirect vulnerability](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5m6c-jp6f-2vcv).
+  - More invalid redirects that lead to open-redirects were reported
+  - An extensive test suite has been added to prevent future regressions
+- [#453](https://github.com/oauth2-proxy/oauth2-proxy/pull/453) Responses to endpoints with a proxy prefix will now return headers for preventing browser caching.
+
+## Breaking Changes
+
+- [#464](https://github.com/oauth2-proxy/oauth2-proxy/pull/464) Migration from Pusher to independent org may have introduced breaking changes for your environment.
+  - See the changes listed below for PR [#464](https://github.com/oauth2-proxy/oauth2-proxy/pull/464) for full details
+  - Binaries renamed from `oauth2_proxy` to `oauth2-proxy`
+- [#440](https://github.com/oauth2-proxy/oauth2-proxy/pull/440) Switch Azure AD Graph API to Microsoft Graph API
+  - The Azure AD Graph API has been [deprecated](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-graph-api) and is being replaced by the Microsoft Graph API.
+    If your application relies on the access token being passed to it to access the Azure AD Graph API, you should migrate your application to use the Microsoft Graph API.
+    Existing behaviour can be retained by setting `-resource=https://graph.windows.net`.
+- [#484](https://github.com/oauth2-proxy/oauth2-proxy/pull/484) Configuration loading has been replaced with Viper and PFlag
+  - Flags now require a `--` prefix before the option
+  - Previously flags allowed either `-` or `--` to prefix the option name
+  - Eg `-provider` must now be `--provider`
+- [#487](https://github.com/oauth2-proxy/oauth2-proxy/pull/487) Switch flags to StringSlice instead of StringArray
+  - Options that take multiple arguments now split strings on commas if present
+  - Eg `--foo=a,b,c,d` would result in the values `a`, `b`, `c` and `d` instead of a single `a,b,c,d` value as before
+- [#535](https://github.com/oauth2-proxy/oauth2-proxy/pull/535) Drop support for pre v3.1 cookies
+  - The encoding for session cookies was changed starting in v3.1.0, support for the previous encoding is now dropped
+  - If you are upgrading from a version earlier than this, please upgrade via a version between v3.1.0 and v5.1.1
+- [#537](https://github.com/oauth2-proxy/oauth2-proxy/pull/537) Drop Fallback to Email if User not set
+  - Previously, when a session was loaded, if the User was not set, it would be replaced by the Email.
+    This behaviour was inconsistent as it required the session to be stored and then loaded to function properly.
+  - This behaviour has now been removed and the User field will remain empty if it was not set when the session was saved.
+  - In some scenarios `X-Forwarded-User` will now be empty. Use `X-Forwarded-Email` instead.
+  - In some scenarios, this may break setting Basic Auth on upstream or responses.
+    Use `--prefer-email-to-user` to restore falling back to the Email in these cases.
+- [#556](https://github.com/oauth2-proxy/oauth2-proxy/pull/556) Remove unintentional auto-padding of secrets that were too short
+  - Previously, after cookie-secrets were opportunistically base64 decoded to raw bytes,
+    they were padded to have a length divisible by 4.
+  - This led to wrong sized secrets being valid AES lengths of 16, 24, or 32 bytes. Or it led to confusing errors
+    reporting an invalid length of 20 or 28 when the user input cookie-secret was not that length.
+  - Now we will only base64 decode a cookie-secret to raw bytes if it is 16, 24, or 32 bytes long. Otherwise, we will convert
+    the direct cookie-secret to bytes without silent padding added.
+- [#412](https://github.com/oauth2-proxy/oauth2-proxy/pull/412)/[#559](https://github.com/oauth2-proxy/oauth2-proxy/pull/559) Allow multiple cookie domains to be specified
+  - Multiple cookie domains may now be configured. The longest domain that matches will be used.
+  - The config options `cookie_domain` is now `cookie_domains`
+  - The environment variable `OAUTH2_PROXY_COOKIE_DOMAIN` is now `OAUTH2_PROXY_COOKIE_DOMAINS`
+- [#414](https://github.com/oauth2-proxy/oauth2-proxy/pull/414) Always encrypt sessions regardless of config
+  - Previously, sessions were encrypted only when certain options were configured.
+    This lead to confusion and misconfiguration as it was not obvious when a session should be encrypted.
+  - Cookie Secrets must now be 16, 24 or 32 bytes.
+  - If you need to change your secret, this will force users to reauthenticate.
+- [#548](https://github.com/oauth2-proxy/oauth2-proxy/pull/548) Separate logging options out of main options structure
+  - Fixes an inconsistency in the `--exclude-logging-paths` option by renaming it to `--exclude-logging-option`.
+  - This flag may now be given multiple times as with other list options
+  - This flag also accepts comma separated values
+- [#639](https://github.com/oauth2-proxy/oauth2-proxy/pull/639) Change how gitlab-group is parsed on options
+  - Previously, the flag gitlab-group used comma seperated values, while the config option used space seperated values.
+  - This fixes the config value to use slices internally.
+  - The config option `gitlab_group` is now `gitlab_groups`
+  - The environment variable `OAUTH2_PROXY_GITLAB_GROUP` is now `OAUTH2_PROXY_GITLAB_GROUPS`
+
+## Changes since v5.1.1
+
+- [GHSA-5m6c-jp6f-2vcv](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5m6c-jp6f-2vcv) New OpenRedirect cases have been found (@JoelSpeed)
+- [#639](https://github.com/oauth2-proxy/oauth2-proxy/pull/639) Change how gitlab-group is parsed on options (@linuxgemini)
+- [#615](https://github.com/oauth2-proxy/oauth2-proxy/pull/615) Kubernetes example based on Kind cluster and Nginx ingress (@EvgeniGordeev)
+- [#596](https://github.com/oauth2-proxy/oauth2-proxy/pull/596) Validate Bearer IDTokens in headers with correct provider/extra JWT Verifier (@NickMeves)
+- [#620](https://github.com/oauth2-proxy/oauth2-proxy/pull/620) Add HealthCheck middleware (@JoelSpeed)
+- [#597](https://github.com/oauth2-proxy/oauth2-proxy/pull/597) Don't log invalid redirect if redirect is empty (@JoelSpeed)
+- [#604](https://github.com/oauth2-proxy/oauth2-proxy/pull/604) Add Keycloak local testing environment (@EvgeniGordeev)
+- [#539](https://github.com/oauth2-proxy/oauth2-proxy/pull/539) Refactor encryption ciphers and add AES-GCM support (@NickMeves)
+- [#601](https://github.com/oauth2-proxy/oauth2-proxy/pull/601) Ensure decrypted user/email are valid UTF8 (@JoelSpeed)
+- [#560](https://github.com/oauth2-proxy/oauth2-proxy/pull/560) Fallback to UserInfo is User ID claim not present (@JoelSpeed)
+- [#598](https://github.com/oauth2-proxy/oauth2-proxy/pull/598) acr_values no longer sent to IdP when empty (@ScottGuymer)
+- [#548](https://github.com/oauth2-proxy/oauth2-proxy/pull/548) Separate logging options out of main options structure (@JoelSpeed)
+- [#567](https://github.com/oauth2-proxy/oauth2-proxy/pull/567) Allow health/ping request to be identified via User-Agent (@chkohner)
+- [#536](https://github.com/oauth2-proxy/oauth2-proxy/pull/536) Improvements to Session State code (@JoelSpeed)
+- [#573](https://github.com/oauth2-proxy/oauth2-proxy/pull/573) Properly parse redis urls for cluster and sentinel connections (@amnay-mo)
+- [#574](https://github.com/oauth2-proxy/oauth2-proxy/pull/574) render error page on 502 proxy status (@amnay-mo)
+- [#559](https://github.com/oauth2-proxy/oauth2-proxy/pull/559) Rename cookie-domain config to cookie-domains (@JoelSpeed)
+- [#569](https://github.com/oauth2-proxy/oauth2-proxy/pull/569) Updated autocompletion for `--` long options. (@Izzette)
+- [#489](https://github.com/oauth2-proxy/oauth2-proxy/pull/489) Move Options and Validation to separate packages (@JoelSpeed)
+- [#556](https://github.com/oauth2-proxy/oauth2-proxy/pull/556) Remove unintentional auto-padding of secrets that were too short (@NickMeves)
+- [#538](https://github.com/oauth2-proxy/oauth2-proxy/pull/538) Refactor sessions/utils.go functionality to other areas (@NickMeves)
+- [#503](https://github.com/oauth2-proxy/oauth2-proxy/pull/503) Implements --real-client-ip-header option to select the header from which to obtain a proxied client's IP (@Izzette)
+- [#529](https://github.com/oauth2-proxy/oauth2-proxy/pull/529) Add local test environments for testing changes and new features (@JoelSpeed)
+- [#537](https://github.com/oauth2-proxy/oauth2-proxy/pull/537) Drop Fallback to Email if User not set (@JoelSpeed)
+- [#535](https://github.com/oauth2-proxy/oauth2-proxy/pull/535) Drop support for pre v3.1 cookies (@JoelSpeed)
+- [#533](https://github.com/oauth2-proxy/oauth2-proxy/pull/487) Set up code coverage within Travis for Code Climate (@JoelSpeed)
+- [#514](https://github.com/oauth2-proxy/oauth2-proxy/pull/514) Add basic string functions to templates (@n-i-x)
+- [#524](https://github.com/oauth2-proxy/oauth2-proxy/pull/524) Sign cookies with SHA256 (@NickMeves)
+- [#515](https://github.com/oauth2-proxy/oauth2-proxy/pull/515) Drop configure script in favour of native Makefile env and checks (@JoelSpeed)
+- [#519](https://github.com/oauth2-proxy/oauth2-proxy/pull/519) Support context in providers (@johejo)
+- [#487](https://github.com/oauth2-proxy/oauth2-proxy/pull/487) Switch flags to PFlag to remove StringArray (@JoelSpeed)
+- [#484](https://github.com/oauth2-proxy/oauth2-proxy/pull/484) Replace configuration loading with Viper (@JoelSpeed)
+- [#499](https://github.com/oauth2-proxy/oauth2-proxy/pull/499) Add `-user-id-claim` to support generic claims in addition to email (@holyjak)
+- [#486](https://github.com/oauth2-proxy/oauth2-proxy/pull/486) Add new linters (@johejo)
+- [#440](https://github.com/oauth2-proxy/oauth2-proxy/pull/440) Switch Azure AD Graph API to Microsoft Graph API (@johejo)
+- [#453](https://github.com/oauth2-proxy/oauth2-proxy/pull/453) Prevent browser caching during auth flow (@johejo)
+- [#467](https://github.com/oauth2-proxy/oauth2-proxy/pull/467) Allow OIDC issuer verification to be skipped (@chkohner)
+- [#481](https://github.com/oauth2-proxy/oauth2-proxy/pull/481) Update Okta docs (@trevorbox)
+- [#474](https://github.com/oauth2-proxy/oauth2-proxy/pull/474) Always log hasMember request error object (@jbielick)
+- [#468](https://github.com/oauth2-proxy/oauth2-proxy/pull/468) Implement graceful shutdown and propagate request context (@johejo)
+- [#464](https://github.com/oauth2-proxy/oauth2-proxy/pull/464) Migrate to oauth2-proxy/oauth2-proxy (@JoelSpeed)
+  - Project renamed from `pusher/oauth2_proxy` to `oauth2-proxy`
+  - Move Go import path from `github.com/pusher/oauth2_proxy` to `github.com/oauth2-proxy/oauth2-proxy`
+  - Remove Pusher Cloud Team from CODEOWNERS
+  - Release images moved to `quay.io/oauth2-proxy/oauth2-proxy`
+  - Binaries renamed from `oauth2_proxy` to `oauth2-proxy`
+- [#432](https://github.com/oauth2-proxy/oauth2-proxy/pull/432) Update ruby dependencies for documentation (@theobarberbany)
+- [#471](https://github.com/oauth2-proxy/oauth2-proxy/pull/471) Add logging in case of invalid redirects (@gargath)
+- [#462](https://github.com/oauth2-proxy/oauth2-proxy/pull/462) Allow HTML in banner message (@eritikass)
+- [#412](https://github.com/oauth2-proxy/oauth2-proxy/pull/412) Allow multiple cookie domains to be specified (@edahlseng)
+- [#413](https://github.com/oauth2-proxy/oauth2-proxy/pull/413) Add -set-basic-auth param to set the Basic Authorization header for upstreams (@morarucostel)
+- [#483](https://github.com/oauth2-proxy/oauth2-proxy/pull/483) Warn users when session cookies are split (@JoelSpeed)
+- [#488](https://github.com/oauth2-proxy/oauth2-proxy/pull/488) Set-Basic-Auth should default to false (@JoelSpeed)
+- [#494](https://github.com/oauth2-proxy/oauth2-proxy/pull/494) Upstream websockets TLS certificate validation now depends on ssl-upstream-insecure-skip-verify (@yaroslavros)
+- [#497](https://github.com/oauth2-proxy/oauth2-proxy/pull/497) Restrict access using Github collaborators (@jsclayton)
+- [#414](https://github.com/oauth2-proxy/oauth2-proxy/pull/414) Always encrypt sessions regardless of config (@ti-mo)
+- [#421](https://github.com/oauth2-proxy/oauth2-proxy/pull/421) Allow logins by usernames even if they do not belong to the specified org and team or collaborators (@yyoshiki41)
+
+# v5.1.1
+
+## Release Highlights
+
+N/A
+
+## Important Notes
+
+- (Security) Fix for [open redirect vulnerability](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-j7px-6hwj-hpjg).
+  - A bad actor using encoded whitespace in redirect URIs can redirect a session to another domain
+
+## Breaking Changes
+
+N/A
+
+## Changes since v5.1.0
+
+- [GHSA-j7px-6hwj-hpjg](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-j7px-6hwj-hpjg) Fix Open Redirect Vulnerability with encoded Whitespace characters (@JoelSpeed)
+
+# v5.1.0
+
+## Release Highlights
+
+- Bump to Go 1.14
+- Reduced number of Google API requests for group validation
+- Support for Redis Cluster
+- Support for overriding hosts in hosts file
+
+## Important Notes
+
+- [#335] The session expiry for the OIDC provider is now taken from the Token Response (expires_in) rather than from the id_token (exp)
+
+## Breaking Changes
+
+N/A
+
+## Changes since v5.0.0
+
+- [#450](https://github.com/oauth2-proxy/oauth2-proxy/pull/450) Fix http.Cookie SameSite is not copied (@johejo)
+- [#445](https://github.com/oauth2-proxy/oauth2-proxy/pull/445) Expose `acr_values` to all providers (@holyjak)
+- [#419](https://github.com/oauth2-proxy/oauth2-proxy/pull/419) Support Go 1.14, upgrade dependencies, upgrade golangci-lint to 1.23.6 (@johejo)
+- [#444](https://github.com/oauth2-proxy/oauth2-proxy/pull/444) Support prompt in addition to approval-prompt (@holyjak)
+- [#435](https://github.com/oauth2-proxy/oauth2-proxy/pull/435) Fix issue with group validation calling google directory API on every HTTP request (@ericofusco)
+- [#400](https://github.com/oauth2-proxy/oauth2-proxy/pull/400) Add `nsswitch.conf` to Docker image to allow hosts file to work (@luketainton)
+- [#385](https://github.com/oauth2-proxy/oauth2-proxy/pull/385) Use the `Authorization` header instead of `access_token` for refreshing GitHub Provider sessions (@ibuclaw)
+- [#372](https://github.com/oauth2-proxy/oauth2-proxy/pull/372) Allow fallback to secondary verified email address in GitHub provider (@dmnemec)
+- [#335](https://github.com/oauth2-proxy/oauth2-proxy/pull/335) OIDC Provider support for empty id_tokens in the access token refresh response (@howzat)
+- [#363](https://github.com/oauth2-proxy/oauth2-proxy/pull/363) Extension of Redis Session Store to Support Redis Cluster (@yan-dblinf)
+- [#353](https://github.com/oauth2-proxy/oauth2-proxy/pull/353) Fix login page fragment handling after soft reload on Firefox (@ffdybuster)
+- [#355](https://github.com/oauth2-proxy/oauth2-proxy/pull/355) Add Client Secret File support for providers that rotate client secret via file system (@pasha-r)
+- [#401](https://github.com/oauth2-proxy/oauth2-proxy/pull/401) Give the option to pass email address in the Basic auth header instead of upstream usernames. (@Spindel)
+- [#405](https://github.com/oauth2-proxy/oauth2-proxy/pull/405) The `/sign_in` page now honors the `rd` query parameter, fixing the redirect after a successful authentication (@ti-mo)
+- [#434](https://github.com/oauth2-proxy/oauth2-proxy/pull/434) Give the option to prefer email address in the username header when using the -pass-user-headers option (@jordancrawfordnz)
+
+# v5.0.0
+
+## Release Highlights
+
+- Disabled CGO (binaries will work regardless og glibc/musl)
+- Allow whitelisted redirect ports
+- Nextcloud provider support added
+- DigitalOcean provider support added
+
+## Important Notes
+
+- (Security) Fix for [open redirect vulnerability](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-qqxw-m5fj-f7gv).. a bad actor using `/\` in redirect URIs can redirect a session to another domain
+
+## Breaking Changes
+
+- [#321](https://github.com/oauth2-proxy/oauth2-proxy/pull/331) Add reverse proxy boolean flag to control whether headers like `X-Real-Ip` are accepted.
+  This defaults to false. **Usage behind a reverse proxy will require this flag to be set to avoid logging the reverse proxy IP address**.
+
+## Changes since v4.1.0
+
+- [#331](https://github.com/oauth2-proxy/oauth2-proxy/pull/331) Add reverse proxy setting (@martin-css)
+- [#365](https://github.com/oauth2-proxy/oauth2-proxy/pull/365) Build with CGO=0 (@tomelliff)
+- [#339](https://github.com/oauth2-proxy/oauth2-proxy/pull/339) Add configuration for cookie 'SameSite' value. (@pgroudas)
+- [#347](https://github.com/oauth2-proxy/oauth2-proxy/pull/347) Update keycloak provider configuration documentation. (@sushiMix)
+- [#325](https://github.com/oauth2-proxy/oauth2-proxy/pull/325) dist.sh: use sha256sum (@syscll)
+- [#179](https://github.com/oauth2-proxy/oauth2-proxy/pull/179) Add Nextcloud provider (@Ramblurr)
+- [#280](https://github.com/oauth2-proxy/oauth2-proxy/pull/280) whitelisted redirect domains: add support for whitelisting specific ports or allowing wildcard ports (@kamaln7)
+- [#351](https://github.com/oauth2-proxy/oauth2-proxy/pull/351) Add DigitalOcean Auth provider (@kamaln7)
+
+# v4.1.0
+
+## Release Highlights
+
+- Added Keycloak provider
+- Build on Go 1.13
+- Upgrade Docker image to use Debian Buster
+- Added support for FreeBSD builds
+- Added new logo
+- Added support for GitHub teams
+
+## Important Notes
+
+N/A
+
+## Breaking Changes
+
+N/A
+
+## Changes since v4.0.0
+
+- [#292](https://github.com/oauth2-proxy/oauth2-proxy/pull/292) Added bash >= 4.0 dependency to configure script (@jmfrank63)
+- [#227](https://github.com/oauth2-proxy/oauth2-proxy/pull/227) Add Keycloak provider (@Ofinka)
+- [#259](https://github.com/oauth2-proxy/oauth2-proxy/pull/259) Redirect to HTTPS (@jmickey)
+- [#273](https://github.com/oauth2-proxy/oauth2-proxy/pull/273) Support Go 1.13 (@dio)
+- [#275](https://github.com/oauth2-proxy/oauth2-proxy/pull/275) docker: build from debian buster (@syscll)
+- [#258](https://github.com/oauth2-proxy/oauth2-proxy/pull/258) Add IDToken for Azure provider (@leyshon)
+  - This PR adds the IDToken into the session for the Azure provider allowing requests to a backend to be identified as a specific user. As a consequence, if you are using a cookie to store the session the cookie will now exceed the 4kb size limit and be split into multiple cookies. This can cause problems when using nginx as a proxy, resulting in no cookie being passed at all. Either increase the proxy_buffer_size in nginx or implement the redis session storage (see https://oauth2-proxy.github.io/oauth2-proxy/configuration#redis-storage)
+- [#286](https://github.com/oauth2-proxy/oauth2-proxy/pull/286) Requests.go updated with useful error messages (@biotom)
+- [#274](https://github.com/oauth2-proxy/oauth2-proxy/pull/274) Supports many github teams with api pagination support (@toshi-miura, @apratina)
+- [#302](https://github.com/oauth2-proxy/oauth2-proxy/pull/302) Rewrite dist script (@syscll)
+- [#304](https://github.com/oauth2-proxy/oauth2-proxy/pull/304) Add new Logo! :tada: (@JoelSpeed)
+- [#300](https://github.com/oauth2-proxy/oauth2-proxy/pull/300) Added userinfo endpoint (@kbabuadze)
+- [#309](https://github.com/oauth2-proxy/oauth2-proxy/pull/309) Added support for custom CA when connecting to Redis cache (@lleszczu)
+- [#248](https://github.com/oauth2-proxy/oauth2-proxy/pull/248) Fix issue with X-Auth-Request-Redirect header being ignored (@webnard)
+- [#314](https://github.com/oauth2-proxy/oauth2-proxy/pull/314) Add redirect capability to sign_out (@costelmoraru)
+- [#265](https://github.com/oauth2-proxy/oauth2-proxy/pull/265) Add upstream with static response (@cgroschupp)
+- [#317](https://github.com/oauth2-proxy/oauth2-proxy/pull/317) Add build for FreeBSD (@fnkr)
+- [#296](https://github.com/oauth2-proxy/oauth2-proxy/pull/296) Allow to override provider's name for sign-in page (@ffdybuster)
+
+# v4.0.0
+
+## Release Highlights
+
+- Documentation is now on a [microsite](https://oauth2-proxy.github.io/oauth2-proxy/)
+- Health check logging can now be disabled for quieter logs
+- Authorization Header JWTs can now be verified by the proxy to skip authentication for machine users
+- Sessions can now be stored in Redis. This reduces refresh failures and uses smaller cookies (Recommended for those using OIDC refreshing)
+- Logging overhaul allows customisable logging formats
+
+## Important Notes
+
+- This release includes a number of breaking changes that will require users to
+  reconfigure their proxies. Please read the Breaking Changes below thoroughly.
+
+## Breaking Changes
+
+- [#231](https://github.com/oauth2-proxy/oauth2-proxy/pull/231) Rework GitLab provider
+  - This PR changes the configuration options for the GitLab provider to use
+    a self-hosted instance. You now need to specify a `-oidc-issuer-url` rather than
+    explicit `-login-url`, `-redeem-url` and `-validate-url` parameters.
+- [#186](https://github.com/oauth2-proxy/oauth2-proxy/pull/186) Make config consistent
+  - This PR changes configuration options so that all flags have a config counterpart
+    of the same name but with underscores (`_`) in place of hyphens (`-`).
+    This change affects the following flags:
+  - The `--tls-key` flag is now `--tls-key-file` to be consistent with existing
+    file flags and the existing config and environment settings
+  - The `--tls-cert` flag is now `--tls-cert-file` to be consistent with existing
+    file flags and the existing config and environment settings
+    This change affects the following existing configuration options:
+  - The `proxy-prefix` option is now `proxy_prefix`.
+    This PR changes environment variables so that all flags have an environment
+    counterpart of the same name but capitalised, with underscores (`_`) in place
+    of hyphens (`-`) and with the prefix `OAUTH2_PROXY_`.
+    This change affects the following existing environment variables:
+  - The `OAUTH2_SKIP_OIDC_DISCOVERY` environment variable is now `OAUTH2_PROXY_SKIP_OIDC_DISCOVERY`.
+  - The `OAUTH2_OIDC_JWKS_URL` environment variable is now `OAUTH2_PROXY_OIDC_JWKS_URL`.
+- [#146](https://github.com/oauth2-proxy/oauth2-proxy/pull/146) Use full email address as `User` if the auth response did not contain a `User` field
+  - This change modifies the contents of the `X-Forwarded-User` header supplied by the proxy for users where the auth response from the IdP did not contain
+    a username.
+    In that case, this header used to only contain the local part of the user's email address (e.g. `john.doe` for `john.doe@example.com`) but now contains
+    the user's full email address instead.
+- [#170](https://github.com/oauth2-proxy/oauth2-proxy/pull/170) Pre-built binary tarballs changed format
+  - The pre-built binary tarballs again match the format of the [bitly](https://github.com/bitly/oauth2_proxy) repository, where the unpacked directory
+    has the same name as the tarball and the binary is always named `oauth2_proxy`. This was done to restore compatibility with third-party automation
+    recipes like https://github.com/jhoblitt/puppet-oauth2_proxy.
+
+## Changes since v3.2.0
+
+- [#234](https://github.com/oauth2-proxy/oauth2-proxy/pull/234) Added option `-ssl-upstream-insecure-skip-validation` to skip validation of upstream SSL certificates (@jansinger)
+- [#224](https://github.com/oauth2-proxy/oauth2-proxy/pull/224) Check Google group membership using hasMember to support nested groups and external users (@jpalpant)
+- [#231](https://github.com/oauth2-proxy/oauth2-proxy/pull/231) Add optional group membership and email domain checks to the GitLab provider (@Overv)
+- [#226](https://github.com/oauth2-proxy/oauth2-proxy/pull/226) Made setting of proxied headers deterministic based on configuration alone (@aeijdenberg)
+- [#178](https://github.com/oauth2-proxy/oauth2-proxy/pull/178) Add Silence Ping Logging and Exclude Logging Paths flags (@kskewes)
+- [#209](https://github.com/oauth2-proxy/oauth2-proxy/pull/209) Improve docker build caching of layers (@dekimsey)
+- [#186](https://github.com/oauth2-proxy/oauth2-proxy/pull/186) Make config consistent (@JoelSpeed)
+- [#187](https://github.com/oauth2-proxy/oauth2-proxy/pull/187) Move root packages to pkg folder (@JoelSpeed)
+- [#65](https://github.com/oauth2-proxy/oauth2-proxy/pull/65) Improvements to authenticate requests with a JWT bearer token in the `Authorization` header via
+  the `-skip-jwt-bearer-token` options. (@brianv0)
+  - Additional verifiers can be configured via the `-extra-jwt-issuers` flag if the JWT issuers is either an OpenID provider or has a JWKS URL
+    (e.g. `https://example.com/.well-known/jwks.json`).
+- [#180](https://github.com/oauth2-proxy/oauth2-proxy/pull/180) Minor refactor of core proxying path (@aeijdenberg).
+- [#175](https://github.com/oauth2-proxy/oauth2-proxy/pull/175) Bump go-oidc to v2.0.0 (@aeijdenberg).
+  - Includes fix for potential signature checking issue when OIDC discovery is skipped.
+- [#155](https://github.com/oauth2-proxy/oauth2-proxy/pull/155) Add RedisSessionStore implementation (@brianv0, @JoelSpeed)
+  - Implement flags to configure the redis session store
+    - `-session-store-type=redis` Sets the store type to redis
+    - `-redis-connection-url` Sets the Redis connection URL
+    - `-redis-use-sentinel=true` Enables Redis Sentinel support
+    - `-redis-sentinel-master-name` Sets the Sentinel master name, if sentinel is enabled
+    - `-redis-sentinel-connection-urls` Defines the Redis Sentinel Connection URLs, if sentinel is enabled
+  - Introduces the concept of a session ticket. Tickets are composed of the cookie name, a session ID, and a secret.
+  - Redis Sessions are stored encrypted with a per-session secret
+  - Added tests for server based session stores
+- [#168](https://github.com/oauth2-proxy/oauth2-proxy/pull/168) Drop Go 1.11 support in Travis (@JoelSpeed)
+- [#169](https://github.com/oauth2-proxy/oauth2-proxy/pull/169) Update Alpine to 3.9 (@kskewes)
+- [#148](https://github.com/oauth2-proxy/oauth2-proxy/pull/148) Implement SessionStore interface within proxy (@JoelSpeed)
+- [#147](https://github.com/oauth2-proxy/oauth2-proxy/pull/147) Add SessionStore interfaces and initial implementation (@JoelSpeed)
+  - Allows for multiple different session storage implementations including client and server side
+  - Adds tests suite for interface to ensure consistency across implementations
+  - Refactor some configuration options (around cookies) into packages
+- [#114](https://github.com/oauth2-proxy/oauth2-proxy/pull/114), [#154](https://github.com/oauth2-proxy/oauth2-proxy/pull/154) Documentation is now available live at our [docs website](https://oauth2-proxy.github.io/oauth2-proxy/) (@JoelSpeed, @icelynjennings)
+- [#146](https://github.com/oauth2-proxy/oauth2-proxy/pull/146) Use full email address as `User` if the auth response did not contain a `User` field (@gargath)
+- [#144](https://github.com/oauth2-proxy/oauth2-proxy/pull/144) Use GO 1.12 for ARM builds (@kskewes)
+- [#142](https://github.com/oauth2-proxy/oauth2-proxy/pull/142) ARM Docker USER fix (@kskewes)
+- [#52](https://github.com/oauth2-proxy/oauth2-proxy/pull/52) Logging Improvements (@MisterWil)
+  - Implement flags to configure file logging
+    - `-logging-filename` Defines the filename to log to
+    - `-logging-max-size` Defines the maximum
+    - `-logging-max-age` Defines the maximum age of backups to retain
+    - `-logging-max-backups` Defines the maximum number of rollover log files to retain
+    - `-logging-compress` Defines if rollover log files should be compressed
+    - `-logging-local-time` Defines if logging date and time should be local or UTC
+  - Implement two new flags to enable or disable specific logging types
+    - `-standard-logging` Enables or disables standard (not request or auth) logging
+    - `-auth-logging` Enables or disables auth logging
+  - Implement two new flags to customize the logging format
+    - `-standard-logging-format` Sets the format for standard logging
+    - `-auth-logging-format` Sets the format for auth logging
+- [#111](https://github.com/oauth2-proxy/oauth2-proxy/pull/111) Add option for telling where to find a login.gov JWT key file (@timothy-spencer)
+- [#170](https://github.com/oauth2-proxy/oauth2-proxy/pull/170) Restore binary tarball contents to be compatible with bitlys original tarballs (@zeha)
+- [#185](https://github.com/oauth2-proxy/oauth2-proxy/pull/185) Fix an unsupported protocol scheme error during token validation when using the Azure provider (@jonas)
+- [#141](https://github.com/oauth2-proxy/oauth2-proxy/pull/141) Check google group membership based on email address (@bchess)
+  - Google Group membership is additionally checked via email address, allowing users outside a GSuite domain to be authorized.
+- [#195](https://github.com/oauth2-proxy/oauth2-proxy/pull/195) Add `-banner` flag for overriding the banner line that is displayed (@steakunderscore)
+- [#198](https://github.com/oauth2-proxy/oauth2-proxy/pull/198) Switch from gometalinter to golangci-lint (@steakunderscore)
+- [#159](https://github.com/oauth2-proxy/oauth2-proxy/pull/159) Add option to skip the OIDC provider verified email check: `--insecure-oidc-allow-unverified-email` (@djfinlay)
+- [#210](https://github.com/oauth2-proxy/oauth2-proxy/pull/210) Update base image from Alpine 3.9 to 3.10 (@steakunderscore)
+- [#201](https://github.com/oauth2-proxy/oauth2-proxy/pull/201) Add Bitbucket as new OAuth2 provider, accepts email, team and repository permissions to determine authorization (@aledeganopix4d)
+  - Implement flags to enable Bitbucket authentication:
+    - `-bitbucket-repository` Restrict authorization to users that can access this repository
+    - `-bitbucket-team` Restrict authorization to users that are part of this Bitbucket team
+- [#211](https://github.com/oauth2-proxy/oauth2-proxy/pull/211) Switch from dep to go modules (@steakunderscore)
+- [#145](https://github.com/oauth2-proxy/oauth2-proxy/pull/145) Add support for OIDC UserInfo endpoint email verification (@rtluckie)
+
+# v3.2.0
+
+## Release highlights
+
+- Internal restructure of session state storage to use JSON rather than proprietary scheme
+- Added health check options for running on GCP behind a load balancer
+- Improved support for protecting websockets
+- Added provider for login.gov
+- Allow manual configuration of OIDC providers
+
+## Important notes
+
+- Dockerfile user is now non-root, this may break your existing deployment
+- In the OIDC provider, when no email is returned, the ID Token subject will be used
+  instead of returning an error
+- GitHub user emails must now be primary and verified before authenticating
+
+## Changes since v3.1.0
+
+- [#96](https://github.com/bitly/oauth2_proxy/pull/96) Check if email is verified on GitHub (@caarlos0)
+- [#110](https://github.com/oauth2-proxy/oauth2-proxy/pull/110) Added GCP healthcheck option (@timothy-spencer)
+- [#112](https://github.com/oauth2-proxy/oauth2-proxy/pull/112) Improve websocket support (@gyson)
+- [#63](https://github.com/oauth2-proxy/oauth2-proxy/pull/63) Use encoding/json for SessionState serialization (@yaegashi)
+  - Use JSON to encode session state to be stored in browser cookies
+  - Implement legacy decode function to support existing cookies generated by older versions
+  - Add detailed table driven tests in session_state_test.go
+- [#120](https://github.com/oauth2-proxy/oauth2-proxy/pull/120) Encrypting user/email from cookie (@costelmoraru)
+- [#55](https://github.com/oauth2-proxy/oauth2-proxy/pull/55) Added login.gov provider (@timothy-spencer)
+- [#55](https://github.com/oauth2-proxy/oauth2-proxy/pull/55) Added environment variables for all config options (@timothy-spencer)
+- [#70](https://github.com/oauth2-proxy/oauth2-proxy/pull/70) Fix handling of splitted cookies (@einfachchr)
+- [#92](https://github.com/oauth2-proxy/oauth2-proxy/pull/92) Merge websocket proxy feature from openshift/oauth-proxy (@butzist)
+- [#57](https://github.com/oauth2-proxy/oauth2-proxy/pull/57) Fall back to using OIDC Subject instead of Email (@aigarius)
+- [#85](https://github.com/oauth2-proxy/oauth2-proxy/pull/85) Use non-root user in docker images (@kskewes)
+- [#68](https://github.com/oauth2-proxy/oauth2-proxy/pull/68) forward X-Auth-Access-Token header (@davidholsgrove)
+- [#41](https://github.com/oauth2-proxy/oauth2-proxy/pull/41) Added option to manually specify OIDC endpoints instead of relying on discovery
+- [#83](https://github.com/oauth2-proxy/oauth2-proxy/pull/83) Add `id_token` refresh to Google provider (@leki75)
+- [#10](https://github.com/oauth2-proxy/oauth2-proxy/pull/10) fix redirect url param handling (@dt-rush)
+- [#122](https://github.com/oauth2-proxy/oauth2-proxy/pull/122) Expose -cookie-path as configuration parameter (@costelmoraru)
+- [#124](https://github.com/oauth2-proxy/oauth2-proxy/pull/124) Use Go 1.12 for testing and build environments (@syscll)
+
+# v3.1.0
+
+## Release highlights
+
+- Introduction of ARM releases and and general improvements to Docker builds
+- Improvements to OIDC provider allowing pass-through of ID Tokens
+- Multiple redirect domains can now be whitelisted
+- Streamed responses are now flushed periodically
+
+## Important notes
+
+- If you have been using [#bitly/621](https://github.com/bitly/oauth2_proxy/pull/621)
+  and have cookies larger than the 4kb limit,
+  the cookie splitting pattern has changed and now uses `_` in place of `-` when
+  indexing cookies.
+  This will force users to reauthenticate the first time they use `v3.1.0`.
+- Streamed responses will now be flushed every 1 second by default.
+  Previously streamed responses were flushed only when the buffer was full.
+  To retain the old behaviour set `--flush-interval=0`.
+  See [#23](https://github.com/oauth2-proxy/oauth2-proxy/pull/23) for further details.
+
+## Changes since v3.0.0
+
+- [#14](https://github.com/oauth2-proxy/oauth2-proxy/pull/14) OIDC ID Token, Authorization Headers, Refreshing and Verification (@joelspeed)
+  - Implement `pass-authorization-header` and `set-authorization-header` flags
+  - Implement token refreshing in OIDC provider
+  - Split cookies larger than 4k limit into multiple cookies
+  - Implement token validation in OIDC provider
+- [#15](https://github.com/oauth2-proxy/oauth2-proxy/pull/15) WhitelistDomains (@joelspeed)
+  - Add `--whitelist-domain` flag to allow redirection to approved domains after OAuth flow
+- [#21](https://github.com/oauth2-proxy/oauth2-proxy/pull/21) Docker Improvement (@yaegashi)
+  - Move Docker base image from debian to alpine
+  - Install ca-certificates in docker image
+- [#23](https://github.com/oauth2-proxy/oauth2-proxy/pull/23) Flushed streaming responses
+  - Long-running upstream responses will get flushed every <timeperiod> (1 second by default)
+- [#24](https://github.com/oauth2-proxy/oauth2-proxy/pull/24) Redirect fix (@agentgonzo)
+  - After a successful login, you will be redirected to your original URL rather than /
+- [#35](https://github.com/oauth2-proxy/oauth2-proxy/pull/35) arm and arm64 binary releases (@kskewes)
+  - Add armv6 and arm64 to Makefile `release` target
+- [#37](https://github.com/oauth2-proxy/oauth2-proxy/pull/37) cross build arm and arm64 docker images (@kskewes)
+
+# v3.0.0
+
+Adoption of OAuth2_Proxy by Pusher.
+Project was hard forked and tidied however no logical changes have occurred since
+v2.2 as released by Bitly.
+
+## Changes since v2.2:
+
+- [#7](https://github.com/oauth2-proxy/oauth2-proxy/pull/7) Migration to Pusher (@joelspeed)
+  - Move automated build to debian base image
+  - Add Makefile
+    - Update CI to run `make test`
+    - Update Dockerfile to use `make clean oauth2_proxy`
+    - Update `VERSION` parameter to be set by `ldflags` from Git Status
+    - Remove lint and test scripts
+  - Remove Go v1.8.x from Travis CI testing
+  - Add CODEOWNERS file
+  - Add CONTRIBUTING guide
+  - Add Issue and Pull Request templates
+  - Add Dockerfile
+  - Fix fsnotify import
+  - Update README to reflect new repository ownership
+  - Update CI scripts to separate linting and testing
+    - Now using `gometalinter` for linting
+  - Move Go import path from `github.com/bitly/oauth2_proxy` to `github.com/pusher/oauth2_proxy`
+  - Repository forked on 27/11/18
+    - README updated to include note that this repository is forked
+    - CHANGLOG created to track changes to repository from original fork

CONTRIBUTING.md

@@ -0,0 +1,23 @@
+# Contributing
+
+To develop on this project, please fork the repo and clone into your `$GOPATH`.
+
+Dependencies are **not** checked in so please download those separately.
+Download the dependencies using `go mod download`.
+
+```bash
+cd $GOPATH/src/github.com # Create this directory if it doesn't exist
+git clone git@github.com:<YOUR_FORK>/oauth2-proxy oauth2-proxy/oauth2-proxy
+cd oauth2-proxy/oauth2-proxy
+go mod download
+```
+
+## Pull Requests and Issues
+
+We track bugs and issues using Github.
+
+If you find a bug, please open an Issue.
+
+If you want to fix a bug, please fork, create a feature branch, fix the bug and
+open a PR back to this repo.
+Please mention the open bug issue number within your PR if applicable.

Dockerfile

@@ -0,0 +1,32 @@
+FROM golang:1.16-buster AS builder
+
+# Copy sources
+WORKDIR $GOPATH/src/github.com/oauth2-proxy/oauth2-proxy
+
+# Fetch dependencies
+COPY go.mod go.sum ./
+RUN GO111MODULE=on go mod download
+
+# Now pull in our code
+COPY . .
+
+ARG VERSION
+
+# Build binary and make sure there is at least an empty key file.
+#  This is useful for GCP App Engine custom runtime builds, because
+#  you cannot use multiline variables in their app.yaml, so you have to
+#  build the key into the container and then tell it where it is
+#  by setting OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem
+#  in app.yaml instead.
+RUN VERSION=${VERSION} make build && touch jwt_signing_key.pem
+
+# Copy binary to alpine
+FROM alpine:3.13
+COPY nsswitch.conf /etc/nsswitch.conf
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/oauth2-proxy /bin/oauth2-proxy
+COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/jwt_signing_key.pem /etc/ssl/private/jwt_signing_key.pem
+
+USER 2000:2000
+
+ENTRYPOINT ["/bin/oauth2-proxy"]

Dockerfile.arm64

@@ -0,0 +1,32 @@
+FROM golang:1.16-buster AS builder
+
+# Copy sources
+WORKDIR $GOPATH/src/github.com/oauth2-proxy/oauth2-proxy
+
+# Fetch dependencies
+COPY go.mod go.sum ./
+RUN GO111MODULE=on go mod download
+
+# Now pull in our code
+COPY . .
+
+ARG VERSION
+
+# Build binary and make sure there is at least an empty key file.
+#  This is useful for GCP App Engine custom runtime builds, because
+#  you cannot use multiline variables in their app.yaml, so you have to
+#  build the key into the container and then tell it where it is
+#  by setting OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem
+#  in app.yaml instead.
+RUN VERSION=${VERSION} GOARCH=arm64 make build && touch jwt_signing_key.pem
+
+# Copy binary to alpine
+FROM arm64v8/alpine:3.13
+COPY nsswitch.conf /etc/nsswitch.conf
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/oauth2-proxy /bin/oauth2-proxy
+COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/jwt_signing_key.pem /etc/ssl/private/jwt_signing_key.pem
+
+USER 2000:2000
+
+ENTRYPOINT ["/bin/oauth2-proxy"]

Dockerfile.armv6

@@ -0,0 +1,32 @@
+FROM golang:1.16-buster AS builder
+
+# Copy sources
+WORKDIR $GOPATH/src/github.com/oauth2-proxy/oauth2-proxy
+
+# Fetch dependencies
+COPY go.mod go.sum ./
+RUN GO111MODULE=on go mod download
+
+# Now pull in our code
+COPY . .
+
+ARG VERSION
+
+# Build binary and make sure there is at least an empty key file.
+#  This is useful for GCP App Engine custom runtime builds, because
+#  you cannot use multiline variables in their app.yaml, so you have to
+#  build the key into the container and then tell it where it is
+#  by setting OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem
+#  in app.yaml instead.
+RUN VERSION=${VERSION} GOARCH=arm GOARM=6 make build && touch jwt_signing_key.pem
+
+# Copy binary to alpine
+FROM arm32v6/alpine:3.13
+COPY nsswitch.conf /etc/nsswitch.conf
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/oauth2-proxy /bin/oauth2-proxy
+COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/jwt_signing_key.pem /etc/ssl/private/jwt_signing_key.pem
+
+USER 2000:2000
+
+ENTRYPOINT ["/bin/oauth2-proxy"]

Godeps

@@ -1,5 +0,0 @@
-github.com/BurntSushi/toml              3883ac1ce943878302255f538fce319d23226223
-github.com/bitly/go-simplejson          3378bdcb5cebedcbf8b5750edee28010f128fe24
-github.com/mreiferson/go-options        ee94b57f2fbf116075426f853e5abbcdfeca8b3d
-github.com/bmizerany/assert             e17e99893cb6509f428e1728281c2ad60a6b31e3
-gopkg.in/fsnotify.v1                    v1.2.0

MAINTAINERS

@@ -0,0 +1,3 @@
+Joel Speed <joel.speed@hotmail.co.uk> (@JoelSpeed)
+Henry Jenkins <henry@henryjenkins.name> (@steakunderscore)
+Nick Meves <nick.meves@greenhouse.io> (@NickMeves)

Makefile

@@ -0,0 +1,108 @@
+GO ?= go
+GOLANGCILINT ?= golangci-lint
+
+BINARY := oauth2-proxy
+VERSION ?= $(shell git describe --always --dirty --tags 2>/dev/null || echo "undefined")
+# Allow to override image registry.
+REGISTRY ?= quay.io/oauth2-proxy
+.NOTPARALLEL:
+
+GO_MAJOR_VERSION = $(shell $(GO) version | cut -c 14- | cut -d' ' -f1 | cut -d'.' -f1)
+GO_MINOR_VERSION = $(shell $(GO) version | cut -c 14- | cut -d' ' -f1 | cut -d'.' -f2)
+MINIMUM_SUPPORTED_GO_MAJOR_VERSION = 1
+MINIMUM_SUPPORTED_GO_MINOR_VERSION = 15
+GO_VERSION_VALIDATION_ERR_MSG = Golang version is not supported, please update to at least $(MINIMUM_SUPPORTED_GO_MAJOR_VERSION).$(MINIMUM_SUPPORTED_GO_MINOR_VERSION)
+
+DOCKER_BUILD := docker build --build-arg VERSION=${VERSION}
+
+ifeq ($(COVER),true)
+TESTCOVER ?= -coverprofile c.out
+endif
+
+.PHONY: all
+all: lint $(BINARY)
+
+.PHONY: clean
+clean:
+	rm -rf release
+	rm -f $(BINARY)
+
+.PHONY: distclean
+distclean: clean
+	rm -rf vendor
+
+.PHONY: lint
+lint: validate-go-version
+	GO111MODULE=on $(GOLANGCILINT) run
+
+.PHONY: build
+build: validate-go-version clean $(BINARY)
+
+$(BINARY):
+	GO111MODULE=on CGO_ENABLED=0 $(GO) build -a -installsuffix cgo -ldflags="-X main.VERSION=${VERSION}" -o $@ github.com/oauth2-proxy/oauth2-proxy/v7
+
+.PHONY: docker
+docker:
+	$(DOCKER_BUILD) -f Dockerfile -t $(REGISTRY)/oauth2-proxy:latest .
+
+.PHONY: docker-all
+docker-all: docker
+	$(DOCKER_BUILD) -f Dockerfile -t $(REGISTRY)/oauth2-proxy:latest-amd64 .
+	$(DOCKER_BUILD) -f Dockerfile -t $(REGISTRY)/oauth2-proxy:${VERSION} .
+	$(DOCKER_BUILD) -f Dockerfile -t $(REGISTRY)/oauth2-proxy:${VERSION}-amd64 .
+	$(DOCKER_BUILD) -f Dockerfile.arm64 -t $(REGISTRY)/oauth2-proxy:latest-arm64 .
+	$(DOCKER_BUILD) -f Dockerfile.arm64 -t $(REGISTRY)/oauth2-proxy:${VERSION}-arm64 .
+	$(DOCKER_BUILD) -f Dockerfile.armv6 -t $(REGISTRY)/oauth2-proxy:latest-armv6 .
+	$(DOCKER_BUILD) -f Dockerfile.armv6 -t $(REGISTRY)/oauth2-proxy:${VERSION}-armv6 .
+
+.PHONY: docker-push
+docker-push:
+	docker push $(REGISTRY)/oauth2-proxy:latest
+
+.PHONY: docker-push-all
+docker-push-all: docker-push
+	docker push $(REGISTRY)/oauth2-proxy:latest-amd64
+	docker push $(REGISTRY)/oauth2-proxy:${VERSION}
+	docker push $(REGISTRY)/oauth2-proxy:${VERSION}-amd64
+	docker push $(REGISTRY)/oauth2-proxy:latest-arm64
+	docker push $(REGISTRY)/oauth2-proxy:${VERSION}-arm64
+	docker push $(REGISTRY)/oauth2-proxy:latest-armv6
+	docker push $(REGISTRY)/oauth2-proxy:${VERSION}-armv6
+
+.PHONY: generate
+generate:
+	go generate ./pkg/...
+
+.PHONY: verify-generate
+verify-generate: generate
+	git diff --exit-code
+
+.PHONY: test
+test: lint
+	GO111MODULE=on $(GO) test $(TESTCOVER) -v -race ./...
+
+.PHONY: release
+release: validate-go-version lint test
+	BINARY=${BINARY} VERSION=${VERSION} ./dist.sh
+
+.PHONY: validate-go-version
+validate-go-version:
+	@if [ $(GO_MAJOR_VERSION) -gt $(MINIMUM_SUPPORTED_GO_MAJOR_VERSION) ]; then \
+		exit 0 ;\
+	elif [ $(GO_MAJOR_VERSION) -lt $(MINIMUM_SUPPORTED_GO_MAJOR_VERSION) ]; then \
+		echo '$(GO_VERSION_VALIDATION_ERR_MSG)';\
+		exit 1; \
+	elif [ $(GO_MINOR_VERSION) -lt $(MINIMUM_SUPPORTED_GO_MINOR_VERSION) ] ; then \
+		echo '$(GO_VERSION_VALIDATION_ERR_MSG)';\
+		exit 1; \
+	fi
+
+# local-env can be used to interact with the local development environment
+# eg:
+#    make local-env-up 					# Bring up a basic test environment
+#    make local-env-down 				# Tear down the basic test environment
+#    make local-env-nginx-up 		# Bring up an nginx based test environment
+#    make local-env-nginx-down 	# Tead down the nginx based test environment
+.PHONY: local-env-%
+local-env-%:
+	make -C contrib/local-environment $*

README.md

@@ -1,229 +1,61 @@
-oauth2_proxy
-=================
+![OAuth2 Proxy](/docs/static/img/logos/OAuth2_Proxy_horizontal.svg)
 
-<small>(This project was renamed from Google Auth Proxy - May 2015)</small>
+[![Build Status](https://secure.travis-ci.org/oauth2-proxy/oauth2-proxy.svg?branch=master)](http://travis-ci.org/oauth2-proxy/oauth2-proxy)
+[![Go Report Card](https://goreportcard.com/badge/github.com/oauth2-proxy/oauth2-proxy)](https://goreportcard.com/report/github.com/oauth2-proxy/oauth2-proxy)
+[![GoDoc](https://godoc.org/github.com/oauth2-proxy/oauth2-proxy?status.svg)](https://godoc.org/github.com/oauth2-proxy/oauth2-proxy)
+[![MIT licensed](https://img.shields.io/badge/license-MIT-blue.svg)](./LICENSE)
+[![Maintainability](https://api.codeclimate.com/v1/badges/a58ff79407212e2beacb/maintainability)](https://codeclimate.com/github/oauth2-proxy/oauth2-proxy/maintainability)
+[![Test Coverage](https://api.codeclimate.com/v1/badges/a58ff79407212e2beacb/test_coverage)](https://codeclimate.com/github/oauth2-proxy/oauth2-proxy/test_coverage)
 
-A reverse proxy that provides authentication using Providers (Google, Github, and others)
+A reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others)
 to validate accounts by email, domain or group.
 
-[![Build Status](https://secure.travis-ci.org/bitly/oauth2_proxy.png?branch=master)](http://travis-ci.org/bitly/oauth2_proxy)
+**Note:** This repository was forked from [bitly/OAuth2_Proxy](https://github.com/bitly/oauth2_proxy) on 27/11/2018.
+Versions v3.0.0 and up are from this fork and will have diverged from any changes in the original fork.
+A list of changes can be seen in the [CHANGELOG](CHANGELOG.md).
 
+**Note:** This project was formerly hosted as `pusher/oauth2_proxy` but has been renamed as of 29/03/2020 to `oauth2-proxy/oauth2-proxy`.
+Going forward, all images shall be available at `quay.io/oauth2-proxy/oauth2-proxy` and binaries will be named `oauth2-proxy`.
 
 ![Sign In Page](https://cloud.githubusercontent.com/assets/45028/4970624/7feb7dd8-6886-11e4-93e0-c9904af44ea8.png)
 
-## Architecture
+## Installation
+
+1.  Choose how to deploy:
+
+    a. Download [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.1.0`)
+
+    b. Build with `$ go get github.com/oauth2-proxy/oauth2-proxy` which will put the binary in `$GOROOT/bin`
+
+    c. Using the prebuilt docker image [quay.io/oauth2-proxy/oauth2-proxy](https://quay.io/oauth2-proxy/oauth2-proxy) (AMD64, ARMv6 and ARM64 tags available)
+
+Prebuilt binaries can be validated by extracting the file and verifying it against the `sha256sum.txt` checksum file provided for each release starting with version `v3.0.0`.
+
+```
+sha256sum -c sha256sum.txt 2>&1 | grep OK
+oauth2-proxy-x.y.z.linux-amd64: OK
+```
+
+2.  [Select a Provider and Register an OAuth Application with a Provider](https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider)
+3.  [Configure OAuth2 Proxy using config file, command line options, or environment variables](https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/overview)
+4.  [Configure SSL or Deploy behind a SSL endpoint](https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/tls) (example provided for Nginx)
+
+
+## Security
+
+If you are running a version older than v6.0.0 we **strongly recommend you please update** to a current version.
+See [open redirect vulnverability](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5m6c-jp6f-2vcv) for details.
+
+## Docs
+
+Read the docs on our [Docs site](https://oauth2-proxy.github.io/oauth2-proxy/docs/).
 
 ![OAuth2 Proxy Architecture](https://cloud.githubusercontent.com/assets/45028/8027702/bd040b7a-0d6a-11e5-85b9-f8d953d04f39.png)
 
-## Installation
+## Getting Involved
 
-1. Download [Prebuilt Binary](https://github.com/bitly/oauth2_proxy/releases) (current release is `v2.0`) or build with `$ go get github.com/bitly/oauth2_proxy` which will put the binary in `$GOROOT/bin`
-2. Select a Provider and Register an OAuth Application with a Provider
-3. Configure OAuth2 Proxy using config file, command line options, or environment variables
-4. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
+If you would like to reach out to the maintainers, come talk to us in the `#oauth2-proxy` channel in the [Gophers slack](http://gophers.slack.com/).
 
-## OAuth Provider Configuration
-
-You will need to register an OAuth application with a Provider (Google, Github or another provider), and configure it with Redirect URI(s) for the domain you intend to run `oauth2_proxy` on.
-
-Valid providers are :
-
-* [Google](#google-auth-provider) *default*
-* [GitHub](#github-auth-provider)
-* [LinkedIn](#linkedin-auth-provider)
-* [MyUSA](#myusa-auth-provider)
-
-The provider can be selected using the `provider` configuration value.
-
-### Google Auth Provider
-
-For Google, the registration steps are:
-
-1. Create a new project: https://console.developers.google.com/project
-2. Under "APIs & Auth", choose "Credentials"
-3. Now, choose "Create new Client ID"
-   * The Application Type should be **Web application**
-   * Enter your domain in the Authorized Javascript Origins `https://internal.yourcompany.com`
-   * Enter the correct Authorized Redirect URL `https://internal.yourcompany.com/oauth2/callback`
-     * NOTE: `oauth2_proxy` will _only_ callback on the path `/oauth2/callback`
-4. Under "APIs & Auth" choose "Consent Screen"
-   * Fill in the necessary fields and Save (this is _required_)
-5. Take note of the **Client ID** and **Client Secret**
-
-### GitHub Auth Provider
-
-1. Create a new project: https://github.com/settings/developers
-2. Under `Authorization callback URL` enter the correct url ie `https://internal.yourcompany.com/oauth2/callback`
-
-The GitHub auth provider supports two additional parameters to restrict authentication to Organization or Team level access. Restricting by org and team is normally accompanied with `--email-domain=*`
-
-    -github-org="": restrict logins to members of this organisation
-    -github-team="": restrict logins to members of this team
-
-
-### LinkedIn Auth Provider
-
-For LinkedIn, the registration steps are:
-
-1. Create a new project: https://www.linkedin.com/secure/developer
-2. In the OAuth User Agreement section:
-   * In default scope, select r_basicprofile and r_emailaddress.
-   * In "OAuth 2.0 Redirect URLs", enter `https://internal.yourcompany.com/oauth2/callback`
-3. Fill in the remaining required fields and Save.
-4. Take note of the **Consumer Key / API Key** and **Consumer Secret / Secret Key**
-
-### MyUSA Auth Provider
-
-The [MyUSA](https://alpha.my.usa.gov) authentication service ([GitHub](https://github.com/18F/myusa))
-
-## Email Authentication
-
-To authorize by email domain use `--email-domain=yourcompany.com`. To authorize individual email addresses use `--authenticated-emails-file=/path/to/file` with one email per line. To authorize all email addresse use `--email-domain=*`.
-
-## Configuration
-
-`oauth2_proxy` can be configured via [config file](#config-file), [command line options](#command-line-options) or [environment variables](#environment-variables).
-
-### Config File
-
-An example [oauth2_proxy.cfg](contrib/oauth2_proxy.cfg.example) config file is in the contrib directory. It can be used by specifying `-config=/etc/oauth2_proxy.cfg`
-
-### Command Line Options
-
-```
-Usage of oauth2_proxy:
-  -authenticated-emails-file="": authenticate against emails via file (one per line)
-  -client-id="": the OAuth Client ID: ie: "123456.apps.googleusercontent.com"
-  -client-secret="": the OAuth Client Secret
-  -config="": path to config file
-  -cookie-domain="": an optional cookie domain to force cookies to (ie: .yourcompany.com)*
-  -cookie-expire=168h0m0s: expire timeframe for cookie
-  -cookie-httponly=true: set HttpOnly cookie flag
-  -cookie-key="_oauth2_proxy": the name of the cookie that the oauth_proxy creates
-  -cookie-refresh=0: refresh the cookie when less than this much time remains before expiration; 0 to disable
-  -cookie-secret="": the seed string for secure cookies
-  -cookie-secure=true: set secure (HTTPS) cookie flag
-  -custom-templates-dir="": path to custom html templates
-  -display-htpasswd-form=true: display username / password login form if an htpasswd file is provided
-  -email-domain=: authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email
-  -github-org="": restrict logins to members of this organisation
-  -github-team="": restrict logins to members of this team
-  -htpasswd-file="": additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption
-  -http-address="127.0.0.1:4180": [http://]<addr>:<port> or unix://<path> to listen on for HTTP clients
-  -https-address=":443": <addr>:<port> to listen on for HTTPS clients
-  -login-url="": Authentication endpoint
-  -pass-access-token=false: pass OAuth access_token to upstream via X-Forwarded-Access-Token header
-  -pass-basic-auth=true: pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream
-  -pass-host-header=true: pass the request Host Header to upstream
-  -profile-url="": Profile access endpoint
-  -provider="google": OAuth provider
-  -proxy-prefix="/oauth2": the url root path that this proxy should be nested under (e.g. /<oauth2>/sign_in)
-  -redeem-url="": Token redemption endpoint
-  -redirect-url="": the OAuth Redirect URL. ie: "https://internalapp.yourcompany.com/oauth2/callback"
-  -request-logging=true: Log requests to stdout
-  -scope="": Oauth scope specification
-  -skip-auth-regex=: bypass authentication for requests path's that match (may be given multiple times)
-  -tls-cert="": path to certificate file
-  -tls-key="": path to private key file
-  -upstream=: the http url(s) of the upstream endpoint. If multiple, routing is based on path
-  -validate-url="": Access token validation endpoint
-  -version=false: print version string
-```
-
-See below for provider specific options
-
-### Environment variables
-
-The environment variables `OAUTH2_PROXY_CLIENT_ID`, `OAUTH2_PROXY_CLIENT_SECRET`, `OAUTH2_PROXY_COOKIE_SECRET`, `OAUTH2_PROXY_COOKIE_DOMAIN` and `OAUTH2_PROXY_COOKIE_EXPIRE` can be used in place of the corresponding command-line arguments.
-
-## SSL Configuration
-
-There are two recommended configurations. 
-
-1) Configure SSL Terminiation with OAuth2 Proxy by providing a `--tls-cert=/path/to/cert.pem` and `--tls-key=/path/to/cert.key`.
-
-The command line to run `oauth2_proxy` in this configuration would look like this:
-
-```bash
-./oauth2_proxy \
-   --email-domain="yourcompany.com"  \
-   --upstream=http://127.0.0.1:8080/ \
-   --tls-cert=/path/to/cert.pem \
-   --tls-key=/path/to/cert.key \
-   --cookie-secret=... \
-   --cookie-secure=true \
-   --provider=... \
-   --client-id=... \
-   --client-secret=...
-```
-
-
-2) Configure SSL Termination with [Nginx](http://nginx.org/) (example config below) or Amazon ELB, or ....
-
-Nginx will listen on port `443` and handle SSL connections while proxying to `oauth2_proxy` on port `4180`. 
-`oauth2_proxy` which will then authenticate requests for an upstream application. The external 
-endpoint for this example would be `https://internal.yourcompany.com/`.
-
-An example Nginx config follows. Note the use of `Strict-Transport-Security` header to pin requests to SSL 
-via [HSTS](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security):
-
-```
-server {
-    listen 443 default ssl;
-    server_name internal.yourcompany.com;
-    ssl_certificate /path/to/cert.pem;
-    ssl_certificate_key /path/to/cert.key;
-    add_header Strict-Transport-Security max-age=1209600;
-
-    location / {
-        proxy_pass http://127.0.0.1:4180;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Scheme $scheme;
-        proxy_connect_timeout 1;
-        proxy_send_timeout 30;
-        proxy_read_timeout 30;
-    }
-}
-```
-
-The command line to run `oauth2_proxy` in this configuration would look like this:
-
-```bash
-./oauth2_proxy \
-   --email-domain="yourcompany.com"  \
-   --upstream=http://127.0.0.1:8080/ \
-   --cookie-secret=... \
-   --cookie-secure=true \
-   --provider=... \
-   --client-id=... \
-   --client-secret=...
-```
-
-
-## Endpoint Documentation
-
-OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The `/oauth2` prefix can be changed with the `--proxy-prefix` config variable.
-
-* /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see [robotstxt.org](http://www.robotstxt.org/) for more info
-* /ping - returns an 200 OK response
-* /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
-* /oauth2/start - a URL that will redirect to start the OAuth cycle
-* /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this ass the callback url.
-
-## Logging Format
-
-OAuth2 Proxy logs requests to stdout in a format similar to Apache Combined Log.
-
-```
-<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] <HOST_HEADER> GET <UPSTREAM_HOST> "/path/" HTTP/1.1 "<USER_AGENT>" <RESPONSE_CODE> <RESPONSE_BYTES> <REQUEST_DURATION>
-```
-
-
-## Adding a new Provider
-
-Follow the examples in the [`providers` package](providers/) to define a new
-`Provider` instance. Add a new `case` to
-[`providers.New()`](providers/providers.go) to allow `oauth2_proxy` to use the
-new `Provider`.
+## Contributing
 
+Please see our [Contributing](CONTRIBUTING.md) guidelines. For releasing see our [release creation guide](RELEASE.md).

RELEASE.md

@@ -0,0 +1,47 @@
+# Release
+
+Here's how OAuth2 Proxy releases are created.
+
+## Schedule
+
+Our aim is to release once a quarter, but bug fixes will be prioritised and might be released earlier.
+
+## The Process
+
+Note this uses `v4.1.0` as an example release number.
+
+1. Create a draft Github release
+  * Use format `v4.1.0` for both the tag and title
+2. Update [CHANGELOG.md](CHANGELOG.md)
+  * Write the release highlights
+  * Copy in headings ready for the next release
+3. Create release commit
+  ```
+  git checkout -b release-v4.1.0
+  ```
+4. Create pull request getting other maintainers to review
+5. Copy the release notes in to the draft Github release, adding a link to [CHANGELOG.md](CHANGELOG.md)
+6. Update you local master branch
+  ```
+  git checkout master
+  git pull
+  ```
+7. Create & push the tag
+  ```
+  git tag v4.1.0
+  git push --tags
+  ```
+8. Make the release artefacts
+  ```
+  make release
+  ```
+9. Upload all the files (not the folders) from the `/release` folder to Github release as binary artefacts. There should be both the tarballs (`tar.gz`) and the checksum files (`sha256sum.txt`).
+10. Publish release in Github
+11. Make and push docker images to Quay
+  ```
+  make docker-all
+  make docker-push-all
+  ```
+  Note: Ensure the docker tags don't include `-dirty`. This means you have uncommitted changes.
+
+12. Verify everything looks good at [quay](https://quay.io/repository/oauth2-proxy/oauth2-proxy?tag=latest&tab=tags) and [github](https://github.com/oauth2-proxy/oauth2-proxy/releases)

SECURITY.md

@@ -0,0 +1,3 @@
+# Security Disclosures
+
+Please see [our community docs](https://oauth2-proxy.github.io/oauth2-proxy/docs/community/security) for our security policy.

api/api.go

@@ -1,39 +0,0 @@
-package api
-
-import (
-	"fmt"
-	"io/ioutil"
-	"net/http"
-
-	"github.com/bitly/go-simplejson"
-)
-
-func Request(req *http.Request) (*simplejson.Json, error) {
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	body, err := ioutil.ReadAll(resp.Body)
-	resp.Body.Close()
-	if err != nil {
-		return nil, err
-	}
-	if resp.StatusCode != 200 {
-		return nil, fmt.Errorf("got %d %s", resp.StatusCode, body)
-	}
-	data, err := simplejson.NewJson(body)
-	if err != nil {
-		return nil, err
-	}
-	return data, nil
-}
-
-func RequestUnparsedResponse(url string, header http.Header) (resp *http.Response, err error) {
-	req, err := http.NewRequest("GET", url, nil)
-	if err != nil {
-		return nil, err
-	}
-	req.Header = header
-
-	return http.DefaultClient.Do(req)
-}

api/api_test.go

@@ -1,127 +0,0 @@
-package api
-
-import (
-	"github.com/bitly/go-simplejson"
-	"github.com/bmizerany/assert"
-	"io/ioutil"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-func testBackend(response_code int, payload string) *httptest.Server {
-	return httptest.NewServer(http.HandlerFunc(
-		func(w http.ResponseWriter, r *http.Request) {
-			w.WriteHeader(response_code)
-			w.Write([]byte(payload))
-		}))
-}
-
-func TestRequest(t *testing.T) {
-	backend := testBackend(200, "{\"foo\": \"bar\"}")
-	defer backend.Close()
-
-	req, _ := http.NewRequest("GET", backend.URL, nil)
-	response, err := Request(req)
-	assert.Equal(t, nil, err)
-	result, err := response.Get("foo").String()
-	assert.Equal(t, nil, err)
-	assert.Equal(t, "bar", result)
-}
-
-func TestRequestFailure(t *testing.T) {
-	// Create a backend to generate a test URL, then close it to cause a
-	// connection error.
-	backend := testBackend(200, "{\"foo\": \"bar\"}")
-	backend.Close()
-
-	req, err := http.NewRequest("GET", backend.URL, nil)
-	assert.Equal(t, nil, err)
-	resp, err := Request(req)
-	assert.Equal(t, (*simplejson.Json)(nil), resp)
-	assert.NotEqual(t, nil, err)
-	if !strings.Contains(err.Error(), "refused") {
-		t.Error("expected error when a connection fails: ", err)
-	}
-}
-
-func TestHttpErrorCode(t *testing.T) {
-	backend := testBackend(404, "{\"foo\": \"bar\"}")
-	defer backend.Close()
-
-	req, err := http.NewRequest("GET", backend.URL, nil)
-	assert.Equal(t, nil, err)
-	resp, err := Request(req)
-	assert.Equal(t, (*simplejson.Json)(nil), resp)
-	assert.NotEqual(t, nil, err)
-}
-
-func TestJsonParsingError(t *testing.T) {
-	backend := testBackend(200, "not well-formed JSON")
-	defer backend.Close()
-
-	req, err := http.NewRequest("GET", backend.URL, nil)
-	assert.Equal(t, nil, err)
-	resp, err := Request(req)
-	assert.Equal(t, (*simplejson.Json)(nil), resp)
-	assert.NotEqual(t, nil, err)
-}
-
-// Parsing a URL practically never fails, so we won't cover that test case.
-func TestRequestUnparsedResponseUsingAccessTokenParameter(t *testing.T) {
-	backend := httptest.NewServer(http.HandlerFunc(
-		func(w http.ResponseWriter, r *http.Request) {
-			token := r.FormValue("access_token")
-			if r.URL.Path == "/" && token == "my_token" {
-				w.WriteHeader(200)
-				w.Write([]byte("some payload"))
-			} else {
-				w.WriteHeader(403)
-			}
-		}))
-	defer backend.Close()
-
-	response, err := RequestUnparsedResponse(
-		backend.URL+"?access_token=my_token", nil)
-	assert.Equal(t, nil, err)
-	assert.Equal(t, 200, response.StatusCode)
-	body, err := ioutil.ReadAll(response.Body)
-	assert.Equal(t, nil, err)
-	response.Body.Close()
-	assert.Equal(t, "some payload", string(body))
-}
-
-func TestRequestUnparsedResponseUsingAccessTokenParameterFailedResponse(t *testing.T) {
-	backend := testBackend(200, "some payload")
-	// Close the backend now to force a request failure.
-	backend.Close()
-
-	response, err := RequestUnparsedResponse(
-		backend.URL+"?access_token=my_token", nil)
-	assert.NotEqual(t, nil, err)
-	assert.Equal(t, (*http.Response)(nil), response)
-}
-
-func TestRequestUnparsedResponseUsingHeaders(t *testing.T) {
-	backend := httptest.NewServer(http.HandlerFunc(
-		func(w http.ResponseWriter, r *http.Request) {
-			if r.URL.Path == "/" && r.Header["Auth"][0] == "my_token" {
-				w.WriteHeader(200)
-				w.Write([]byte("some payload"))
-			} else {
-				w.WriteHeader(403)
-			}
-		}))
-	defer backend.Close()
-
-	headers := make(http.Header)
-	headers.Set("Auth", "my_token")
-	response, err := RequestUnparsedResponse(backend.URL, headers)
-	assert.Equal(t, nil, err)
-	assert.Equal(t, 200, response.StatusCode)
-	body, err := ioutil.ReadAll(response.Body)
-	assert.Equal(t, nil, err)
-	response.Body.Close()
-	assert.Equal(t, "some payload", string(body))
-}

contrib/local-environment/Makefile

@@ -0,0 +1,48 @@
+.PHONY: up
+up:
+	docker-compose up -d
+
+.PHONY: %
+%:
+	docker-compose $*
+
+.PHONY: alpha-config-up
+alpha-config-up:
+	docker-compose -f docker-compose.yaml -f docker-compose-alpha-config.yaml up -d
+
+.PHONY: alpha-config-%
+alpha-config-%:
+	docker-compose -f docker-compose.yaml -f docker-compose-nginx.yaml $*
+
+.PHONY: nginx-up
+nginx-up:
+	docker-compose -f docker-compose.yaml -f docker-compose-nginx.yaml up -d
+
+.PHONY: nginx-%
+nginx-%:
+	docker-compose -f docker-compose.yaml -f docker-compose-nginx.yaml $*
+
+.PHONY: keycloak-up
+keycloak-up:
+	docker-compose -f docker-compose-keycloak.yaml up -d
+
+.PHONY: keycloak-%
+keycloak-%:
+	docker-compose -f docker-compose-keycloak.yaml $*
+
+.PHONY: kubernetes-up
+kubernetes-up:
+	make -C kubernetes create-cluster
+	make -C kubernetes deploy
+
+.PHONY: kubernetes-down
+kubernetes-down:
+	make -C kubernetes delete-cluster
+
+.PHONY: traefik-up
+traefik-up:
+	docker-compose -f docker-compose.yaml -f docker-compose-traefik.yaml up -d
+
+.PHONY: traefik-%
+traefik-%:
+	docker-compose -f docker-compose.yaml -f docker-compose-traefik.yaml $*

contrib/local-environment/README.md

@@ -0,0 +1,3 @@
+# oauth2-proxy: local-environment
+
+Run `make up` to deploy local dex, etcd and oauth2-proxy instances in Docker containers. Review the [`Makefile`](Makefile) for additional deployment options.

contrib/local-environment/dex.yaml

@@ -0,0 +1,32 @@
+# This configuration is intended to be used with the docker-compose testing
+# environment.
+# This should configure Dex to run on port 4190 and provides a static login
+issuer: http://dex.localhost:4190/dex
+storage:
+  type: etcd
+  config:
+    endpoints:
+    - http://etcd:2379
+    namespace: dex/
+web:
+  http: 0.0.0.0:4190
+oauth2:
+  skipApprovalScreen: true
+expiry:
+  signingKeys: "4h"
+  idTokens: "1h"
+staticClients:
+- id: oauth2-proxy
+  redirectURIs:
+  # These redirect URIs point to the `--redirect-url` for OAuth2 proxy.
+  - 'http://localhost:4180/oauth2/callback' # For basic proxy example.
+  - 'http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback' # For nginx and traefik example.
+  name: 'OAuth2 Proxy'
+  secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK
+enablePasswordDB: true
+staticPasswords:
+- email: "admin@example.com"
+  # bcrypt hash of the string "password"
+  hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
+  username: "admin"
+  userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"

contrib/local-environment/docker-compose-alpha-config.yaml

@@ -0,0 +1,19 @@
+# This docker-compose file can be used to bring up an example instance of oauth2-proxy
+# for manual testing and exploration of features.
+# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,
+# etcd for storage for Dex  and HTTPBin as an example upstream.
+# This file also uses alpha configuration when configuring OAuth2 Proxy.
+#
+# This file is an extension of the main compose file and must be used with it
+#    docker-compose -f docker-compose.yaml -f docker-compose-alpha-config.yaml <command>
+# Alternatively:
+#    make alpha-config-<command> (eg make nginx-up, make nginx-down)
+#
+# Access http://localhost:4180 to initiate a login cycle
+version: '3.0'
+services:
+  oauth2-proxy:
+    command: --config /oauth2-proxy.cfg --alpha-config /oauth2-proxy-alpha-config.yaml
+    volumes:
+      - "./oauth2-proxy-alpha-config.cfg:/oauth2-proxy.cfg"
+      - "./oauth2-proxy-alpha-config.yaml:/oauth2-proxy-alpha-config.yaml"

contrib/local-environment/docker-compose-keycloak.yaml

@@ -0,0 +1,70 @@
+# This docker-compose file can be used to bring up an example instance of oauth2-proxy
+# for manual testing and exploration of features.
+# Alongside OAuth2-Proxy, this file also starts Keycloak to act as the identity provider,
+# HTTPBin as an example upstream.
+#
+# This can either be created using docker-compose
+#    docker-compose -f docker-compose-keycloak.yaml <command>
+# Or:
+#    make keycloak-<command> (eg. make keycloak-up, make keycloak-down)
+#
+# Access http://oauth2-proxy.localtest.me:4180 to initiate a login cycle using user=admin@example.com, password=password
+# Access http://keycloak.localtest.me:9080 with the same credentials to check out the settings
+version: '3.0'
+services:
+
+  oauth2-proxy:
+    container_name: oauth2-proxy
+    image: quay.io/oauth2-proxy/oauth2-proxy:v7.1.2
+    command: --config /oauth2-proxy.cfg
+    hostname: oauth2-proxy
+    volumes:
+      - "./oauth2-proxy-keycloak.cfg:/oauth2-proxy.cfg"
+    restart: unless-stopped
+    networks:
+      keycloak: {}
+      httpbin: {}
+      oauth2-proxy: {}
+    depends_on:
+      - httpbin
+      - keycloak
+    ports:
+      - 4180:4180/tcp
+
+  httpbin:
+    container_name: httpbin
+    image: kennethreitz/httpbin:latest
+    hostname: httpbin
+    networks:
+      httpbin: {}
+
+  keycloak:
+    container_name: keycloak
+    image: jboss/keycloak:10.0.0
+    hostname: keycloak
+    command:
+      [
+        '-b',
+        '0.0.0.0',
+        '-Djboss.socket.binding.port-offset=1000',
+        '-Dkeycloak.migration.action=import',
+        '-Dkeycloak.migration.provider=dir',
+        '-Dkeycloak.migration.dir=/realm-config',
+        '-Dkeycloak.migration.strategy=IGNORE_EXISTING',
+      ]
+    volumes:
+      - ./keycloak:/realm-config
+    environment:
+      KEYCLOAK_USER: admin@example.com
+      KEYCLOAK_PASSWORD: password
+    networks:
+      keycloak:
+        aliases:
+          - keycloak.localtest.me
+    ports:
+      - 9080:9080/tcp
+
+networks:
+  httpbin: {}
+  keycloak: {}
+  oauth2-proxy: {}

contrib/local-environment/docker-compose-nginx.yaml

@@ -0,0 +1,43 @@
+# This docker-compose file can be used to bring up an example instance of oauth2-proxy
+# for manual testing and exploration of features.
+# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,
+# etcd for storage for Dex, nginx as a reverse proxy and other http services for upstreams
+#
+# This file is an extension of the main compose file and must be used with it
+#    docker-compose -f docker-compose.yaml -f docker-compose-nginx.yaml <command>
+# Alternatively:
+#    make nginx-<command> (eg make nginx-up, make nginx-down)
+#
+# Access one of the following URLs to initiate a login flow:
+#    - http://oauth2-proxy.localhost
+#    - http://httpbin.oauth2-proxy.localhost
+#
+# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.oauth2-proxy.localhost
+#
+# Note, the above URLs should work with Chrome, but you may need to add hosts
+# entries for other browsers
+#    127.0.0.1 oauth2-proxy.localhost
+#    127.0.0.1 httpbin.oauth2-proxy.localhost
+#    127.0.0.1 oauth2-proxy.oauth2-proxy.localhost
+version: '3.0'
+services:
+  oauth2-proxy:
+    ports: []
+    hostname: oauth2-proxy
+    volumes:
+      - "./oauth2-proxy-nginx.cfg:/oauth2-proxy.cfg"
+    networks:
+      oauth2-proxy: {}
+  nginx:
+    container_name: nginx
+    image: nginx:1.18
+    ports:
+      - 80:80/tcp
+    hostname: nginx
+    volumes:
+      - "./nginx.conf:/etc/nginx/conf.d/default.conf"
+    networks:
+      oauth2-proxy: {}
+      httpbin: {}
+networks:
+  oauth2-proxy: {}

contrib/local-environment/docker-compose-traefik.yaml

@@ -0,0 +1,49 @@
+# This docker-compose file can be used to bring up an example instance of oauth2-proxy
+# for manual testing and exploration of features.
+# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,
+# HTTPBin as an example upstream.
+#
+# This can either be created using docker-compose
+#    docker-compose -f docker-compose-traefik.yaml <command>
+# Or:
+#    make traefik-<command> (eg. make traefik-up, make traefik-down)
+#
+# Access one of the following URLs to initiate a login flow:
+#    - http://oauth2-proxy.localhost
+#    - http://httpbin.oauth2-proxy.localhost
+#
+# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.oauth2-proxy.localhost
+#
+# Note, the above URLs should work with Chrome, but you may need to add hosts
+# entries for other browsers
+#    127.0.0.1 oauth2-proxy.localhost
+#    127.0.0.1 httpbin.oauth2-proxy.localhost
+#    127.0.0.1 oauth2-proxy.oauth2-proxy.localhost
+version: '3.0'
+services:
+
+  oauth2-proxy:
+    ports: []
+    hostname: oauth2-proxy
+    volumes:
+      - "./oauth2-proxy-traefik.cfg:/oauth2-proxy.cfg"
+    networks:
+      oauth2-proxy:
+
+  # Reverse proxy
+  gateway:
+    container_name: traefik
+    image: traefik:2.4.2
+    volumes:
+      - "./traefik:/etc/traefik"
+    ports:
+      - "80:80"
+      - "9090:8080"
+    depends_on:
+      - oauth2-proxy
+    networks:
+      oauth2-proxy:
+      httpbin:
+
+networks:
+  oauth2-proxy:

contrib/local-environment/docker-compose.yaml

@@ -0,0 +1,64 @@
+# This docker-compose file can be used to bring up an example instance of oauth2-proxy
+# for manual testing and exploration of features.
+# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,
+# etcd for storage for Dex  and HTTPBin as an example upstream.
+#
+# This can either be created using docker-compose
+#    docker-compose -f docker-compose.yaml <command>
+# Or:
+#    make <command> (eg. make up, make down)
+#
+# Access http://localhost:4180 to initiate a login cycle
+version: '3.0'
+services:
+  oauth2-proxy:
+    container_name: oauth2-proxy
+    image: quay.io/oauth2-proxy/oauth2-proxy:2
+    command: --config /oauth2-proxy.cfg
+    ports:
+      - 4180:4180/tcp
+    hostname: oauth2-proxy
+    volumes:
+      - "./oauth2-proxy.cfg:/oauth2-proxy.cfg"
+    restart: unless-stopped
+    networks:
+      dex: {}
+      httpbin: {}
+    depends_on:
+      - dex
+      - httpbin
+  dex:
+    container_name: dex
+    image: quay.io/dexidp/dex:v2.23.0
+    command: serve /dex.yaml
+    ports:
+      - 4190:4190/tcp
+    hostname: dex
+    volumes:
+      - "./dex.yaml:/dex.yaml"
+    restart: unless-stopped
+    networks:
+      dex:
+        aliases:
+        - dex.localhost
+      etcd: {}
+    depends_on:
+      - etcd
+  httpbin:
+    container_name: httpbin
+    image: kennethreitz/httpbin
+    networks:
+      httpbin: {}
+  etcd:
+    container_name: etcd
+    image: gcr.io/etcd-development/etcd:v3.4.7
+    entrypoint: /usr/local/bin/etcd
+    command:
+      - --listen-client-urls=http://0.0.0.0:2379
+      - --advertise-client-urls=http://etcd:2379
+    networks:
+      etcd: {}
+networks:
+  dex: {}
+  etcd: {}
+  httpbin: {}

contrib/local-environment/keycloak/master-users-0.json

@@ -0,0 +1,27 @@
+{
+  "realm" : "master",
+  "users" : [ {
+    "id" : "3356c0a0-d4d5-4436-9c5a-2299c71c08ec",
+    "createdTimestamp" : 1591297959169,
+    "username" : "admin@example.com",
+    "email" : "admin@example.com",
+    "enabled" : true,
+    "totp" : false,
+    "emailVerified" : true,
+    "credentials" : [ {
+      "id" : "a1a06ecd-fdc0-4e67-92cd-2da22d724e32",
+      "type" : "password",
+      "createdDate" : 1591297959315,
+      "secretData" : "{\"value\":\"6rt5zuqHVHopvd0FTFE0CYadXTtzY0mDY2BrqnNQGS51/7DfMJeGgj0roNnGMGvDv30imErNmiSOYl+cL9jiIA==\",\"salt\":\"LI0kqr09JB7J9wvr2Hxzzg==\"}",
+      "credentialData" : "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\"}"
+    } ],
+    "disableableCredentialTypes" : [ ],
+    "requiredActions" : [ ],
+    "realmRoles" : [ "offline_access", "admin", "uma_authorization" ],
+    "clientRoles" : {
+      "account" : [ "view-profile", "manage-account" ]
+    },
+    "notBefore" : 0,
+    "groups" : [ ]
+  } ]
+}

contrib/local-environment/kubernetes/.gitignore

@@ -0,0 +1 @@
+charts/

contrib/local-environment/kubernetes/Chart.lock

@@ -0,0 +1,15 @@
+dependencies:
+- name: dex
+  repository: https://charts.helm.sh/stable
+  version: 2.11.0
+- name: oauth2-proxy
+  repository: https://charts.helm.sh/stable
+  version: 3.1.0
+- name: httpbin
+  repository: https://conservis.github.io/helm-charts
+  version: 1.0.1
+- name: hello-world
+  repository: https://conservis.github.io/helm-charts
+  version: 1.0.1
+digest: sha256:e325948ece1706bd9d9e439568985db41e9a0d57623d0f9638249cb0d23821b8
+generated: "2020-11-23T11:45:07.908898-08:00"

contrib/local-environment/kubernetes/Chart.yaml

@@ -0,0 +1,19 @@
+apiVersion: v2
+description: K8S example based on https://kind.sigs.k8s.io
+name: kubernetes
+version: 5.1.1
+appVersion: 5.1.1
+dependencies:
+  - name: dex
+    version: 2.11.0
+    repository: https://charts.helm.sh/stable
+  - name: oauth2-proxy
+    version: 3.1.0
+    repository: https://charts.helm.sh/stable
+  # https://github.com/postmanlabs/httpbin/issues/549 is still in progress, for now using a non-official chart
+  - name: httpbin
+    version: 1.0.1
+    repository: https://conservis.github.io/helm-charts
+  - name: hello-world
+    version: 1.0.1
+    repository: https://conservis.github.io/helm-charts

contrib/local-environment/kubernetes/Makefile

@@ -0,0 +1,67 @@
+all:
+	@echo "Usage:"
+	@echo "  make create-cluster"
+	@echo "  make deploy"
+
+# create kind cluster with nginx-ingress as the most popular ingress controller for K8S
+.PHONY: deploy
+create-cluster:
+	kind create cluster --name oauth2-proxy --config kind-cluster.yaml
+	make setup-dns
+	make setup-ingress
+
+.PHONY: setup-ingress
+setup-ingress:
+	kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/kind/deploy.yaml
+	kubectl --namespace ingress-nginx rollout status --timeout 5m deployment/ingress-nginx-controller
+
+# default Pod CIDR is 10.244.0.0/16 https://github.com/kubernetes-sigs/kind/blob/a6e8108025bc7a9440beedb8ef7714aec84fe87e/pkg/apis/config/v1alpha4/default.go#L52
+# what makes cluster host IP equal to 10.244.0.1
+# thus we add dex.localtest.me and oauth2-proxy.localtest.me stub hosts pointing to this IP
+# NOT NEEDED IN REAL LIFE!
+.PHONY: setup-dns
+setup-dns:
+	kubectl apply -f custom-dns.yaml
+	kubectl -n kube-system rollout restart deployment/coredns
+	kubectl -n kube-system rollout status --timeout 5m deployment/coredns
+
+.PHONY: delete-cluster
+delete-cluster:
+	kind delete cluster --name oauth2-proxy
+
+.PHONY: deploy
+deploy:
+	kubectl apply -f oauth2-proxy-example-full.yaml
+	kubectl rollout status --timeout 5m deployment/oauth2-proxy-example-oauth2-proxy-sample
+	kubectl rollout status --timeout 1m deployment/oauth2-proxy-example-httpbin
+	kubectl rollout status --timeout 1m deployment/oauth2-proxy-example-hello-world
+
+.PHONY: undeploy
+undeploy:
+	kubectl delete -f oauth2-proxy-example-full.yaml
+
+######################
+###### HELM CMDs #####
+######################
+.PHONY: helm-init
+helm-init:
+	helm dep update
+
+# unpacking is useful to be able to explore underlying helm charts
+.PHONY: helm-unpack
+helm-unpack:
+	cd charts; for f in *.tgz; do tar -zxf "$$f"; done
+
+.PHONY: helm-deploy
+helm-deploy: helm-init
+	helm upgrade --wait --debug --install --render-subchart-notes oauth2-proxy-example .
+
+.PHONY: helm-undeploy
+helm-undeploy:
+	helm del oauth2-proxy-example
+
+# creates K8S manifest from helm chart
+.PHONY: helm-create-manifest
+helm-create-manifest: helm-init
+	echo "# WARNING: This file is auto-generated by 'make helm-create-manifest'! DO NOT EDIT MANUALLY!" > oauth2-proxy-example-full.yaml
+	helm template --namespace default oauth2-proxy-example . >> oauth2-proxy-example-full.yaml

contrib/local-environment/kubernetes/README.md

@@ -0,0 +1,24 @@
+# Kubernetes example
+Based on [kind](https://kind.sigs.k8s.io) as a local Kubernetes cluster.
+
+## Quick start
+
+Before you start: 
+
+_Required_
+* install [kind](https://kind.sigs.k8s.io/docs/user/quick-start/#installation)
+* install [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/)
+
+_Optional_
+* install [helm 3](https://helm.sh/docs/intro/quickstart/#install-helm).
+
+Then: 
+
+* `make create-cluster`
+* `make deploy` OR `make helm-deploy` for helm
+
+Visit http://httpbin.localtest.me or http://hello-world.localtest.me/
+
+## Uninstall
+
+* `make delete-cluster`

contrib/local-environment/kubernetes/custom-dns.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+data:
+  Corefile: |
+    .:53 {
+        errors
+        health {
+           lameduck 5s
+        }
+        ready
+        kubernetes cluster.local in-addr.arpa ip6.arpa {
+           pods insecure
+           fallthrough in-addr.arpa ip6.arpa
+           ttl 30
+        }
+        prometheus :9153
+        forward . /etc/resolv.conf
+        cache 30
+        loop
+        reload
+        loadbalance
+        hosts {
+            10.244.0.1 dex.localtest.me
+            10.244.0.1 oauth2-proxy.localtest.me
+            fallthrough
+        }
+    }
+kind: ConfigMap
+metadata:
+  name: coredns
+  namespace: kube-system

contrib/local-environment/kubernetes/kind-cluster.yaml

@@ -0,0 +1,17 @@
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+nodes:
+  - role: control-plane
+    kubeadmConfigPatches:
+      - |
+        kind: InitConfiguration
+        nodeRegistration:
+          kubeletExtraArgs:
+            node-labels: "ingress-ready=true"
+    extraPortMappings:
+      - containerPort: 80
+        hostPort: 80
+        protocol: TCP
+      - containerPort: 443
+        hostPort: 443
+        protocol: TCP

contrib/local-environment/kubernetes/oauth2-proxy-example-full.yaml

@@ -0,0 +1,564 @@
+# WARNING: This file is auto-generated by 'make helm-create-manifest'! DO NOT EDIT MANUALLY!
+---
+# Source: kubernetes/charts/dex/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/name: dex
+    helm.sh/chart: dex-2.11.0
+    app.kubernetes.io/instance: oauth2-proxy-example
+    app.kubernetes.io/version: "2.23.0"
+    app.kubernetes.io/managed-by: Helm
+  name: oauth2-proxy-example-dex
+---
+# Source: kubernetes/charts/hello-world/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: oauth2-proxy-example-hello-world
+  labels:
+    helm.sh/chart: hello-world-1.0.1
+    app.kubernetes.io/name: hello-world
+    app.kubernetes.io/instance: oauth2-proxy-example
+    app.kubernetes.io/version: "1.0.0"
+    app.kubernetes.io/managed-by: Helm
+---
+# Source: kubernetes/charts/httpbin/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: oauth2-proxy-example-httpbin
+  labels:
+    helm.sh/chart: httpbin-1.0.1
+    app.kubernetes.io/name: httpbin
+    app.kubernetes.io/instance: oauth2-proxy-example
+    app.kubernetes.io/version: "latest"
+    app.kubernetes.io/managed-by: Helm
+---
+# Source: kubernetes/charts/oauth2-proxy/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app: oauth2-proxy-sample
+    chart: oauth2-proxy-3.1.0
+    release: oauth2-proxy-example
+    heritage: Helm
+  name: oauth2-proxy-example-oauth2-proxy-sample
+---
+# Source: kubernetes/charts/dex/templates/secret.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    app.kubernetes.io/name: dex
+    helm.sh/chart: dex-2.11.0
+    app.kubernetes.io/instance: oauth2-proxy-example
+    app.kubernetes.io/version: "2.23.0"
+    app.kubernetes.io/managed-by: Helm
+  name: oauth2-proxy-example-dex
+stringData:
+  config.yaml: |-
+    issuer: http://dex.localtest.me
+    storage:
+      config:
+        inCluster: true
+      type: kubernetes
+    logger:
+      level: debug
+    web:
+      http: 0.0.0.0:5556
+    oauth2: 
+      alwaysShowLoginScreen: false
+      skipApprovalScreen: true
+    staticClients:
+    - id: oauth2-proxy
+      name: OAuth2 Proxy
+      redirectURIs:
+      - http://oauth2-proxy.localtest.me/oauth2/callback
+      secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK
+    enablePasswordDB: true
+    staticPasswords:
+    - email: admin@example.com
+      hash: $2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W
+      userID: 08a8684b-db88-4b73-90a9-3cd1661f5466
+      username: admin
+    expiry:
+      idTokens: 1h
+      signingKeys: 4h
+---
+# Source: kubernetes/charts/oauth2-proxy/templates/configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app: oauth2-proxy-sample
+    chart: oauth2-proxy-3.1.0
+    heritage: Helm
+    release: oauth2-proxy-example
+  name: oauth2-proxy-example-oauth2-proxy-sample
+data:
+  oauth2_proxy.cfg: "cookie_secret=\"OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w=\"\ncookie_domain=\".localtest.me\"\nwhitelist_domains=[\".localtest.me\"]\n# only users with this domain will be let in\nemail_domains=[\"example.com\"]\n\nclient_id=\"oauth2-proxy\"\nclient_secret=\"b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK\"\ncookie_secure=\"false\"\n\nredirect_url=\"http://oauth2-proxy.localtest.me/oauth2/callback\"\n\n# we don't want to proxy anything so pick a non-existent directory\nupstreams = [ \"file:///dev/null\" ]\n\n# return authenticated user to nginx\nset_xauthrequest = true\n# using http://dex.localtest.me/.well-known/openid-configuration oauth2-proxy will populate\n# login_url, redeem_url, and oidc_jwks_url\nprovider=\"oidc\"\noidc_issuer_url=\"http://dex.localtest.me\""
+---
+# Source: kubernetes/charts/dex/templates/clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: dex
+    helm.sh/chart: dex-2.11.0
+    app.kubernetes.io/instance: oauth2-proxy-example
+    app.kubernetes.io/version: "2.23.0"
+    app.kubernetes.io/managed-by: Helm
+  name: oauth2-proxy-example-dex
+rules:
+- apiGroups: ["dex.coreos.com"] # API group created by dex
+  resources: ["*"]
+  verbs: ["*"]
+- apiGroups: ["apiextensions.k8s.io"]
+  resources: ["customresourcedefinitions"]
+  verbs: ["create"] # To manage its own resources, dex must be able to create customresourcedefinitions
+---
+# Source: kubernetes/charts/dex/templates/clusterrolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/name: dex
+    helm.sh/chart: dex-2.11.0
+    app.kubernetes.io/instance: oauth2-proxy-example
+    app.kubernetes.io/version: "2.23.0"
+    app.kubernetes.io/managed-by: Helm
+  name: oauth2-proxy-example-dex
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: oauth2-proxy-example-dex
+subjects:
+  - kind: ServiceAccount
+    name: oauth2-proxy-example-dex
+    namespace: default
+---
+# Source: kubernetes/charts/dex/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: oauth2-proxy-example-dex
+  labels:
+    app.kubernetes.io/name: dex
+    helm.sh/chart: dex-2.11.0
+    app.kubernetes.io/instance: oauth2-proxy-example
+    app.kubernetes.io/version: "2.23.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: ClusterIP
+  sessionAffinity: None
+  ports:
+  - name: http
+    targetPort: http
+    port: 32000
+  selector:
+    app.kubernetes.io/name: dex
+    app.kubernetes.io/instance: oauth2-proxy-example
+---
+# Source: kubernetes/charts/hello-world/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: oauth2-proxy-example-hello-world
+  labels:
+    helm.sh/chart: hello-world-1.0.1
+    app.kubernetes.io/name: hello-world
+    app.kubernetes.io/instance: oauth2-proxy-example
+    app.kubernetes.io/version: "1.0.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: ClusterIP
+  ports:
+    - port: 9080
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: hello-world
+    app.kubernetes.io/instance: oauth2-proxy-example
+---
+# Source: kubernetes/charts/httpbin/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: oauth2-proxy-example-httpbin
+  labels:
+    helm.sh/chart: httpbin-1.0.1
+    app.kubernetes.io/name: httpbin
+    app.kubernetes.io/instance: oauth2-proxy-example
+    app.kubernetes.io/version: "latest"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: httpbin
+    app.kubernetes.io/instance: oauth2-proxy-example
+---
+# Source: kubernetes/charts/oauth2-proxy/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: oauth2-proxy-sample
+    chart: oauth2-proxy-3.1.0
+    release: oauth2-proxy-example
+    heritage: Helm
+  name: oauth2-proxy-example-oauth2-proxy-sample
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app: oauth2-proxy-sample
+    release: oauth2-proxy-example
+---
+# Source: kubernetes/charts/dex/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: oauth2-proxy-example-dex
+  labels:
+    app.kubernetes.io/name: dex
+    helm.sh/chart: dex-2.11.0
+    app.kubernetes.io/instance: oauth2-proxy-example
+    app.kubernetes.io/version: "2.23.0"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: dex
+spec:
+  replicas: 1
+  strategy:
+    rollingUpdate:
+      maxSurge: 0
+      maxUnavailable: 1
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: dex
+      app.kubernetes.io/instance: oauth2-proxy-example
+      app.kubernetes.io/component: dex
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: dex
+        app.kubernetes.io/instance: oauth2-proxy-example
+        app.kubernetes.io/component: dex
+      annotations:
+        checksum/config: 185f32cfabdf4f7467868dc301d4bd33e68951e12eddeb69f23ebc1d0f91ba28
+    spec:
+      serviceAccountName: oauth2-proxy-example-dex
+      nodeSelector:
+          {}
+      containers:
+      - name: main
+        image: "quay.io/dexidp/dex:v2.23.0"
+        imagePullPolicy: IfNotPresent
+        command:
+        - /usr/local/bin/dex
+        - serve
+        - /etc/dex/cfg/config.yaml
+        resources:
+          null
+        ports:
+        - name: http
+          containerPort: 5556
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+          initialDelaySeconds: 1
+          periodSeconds: 10
+          timeoutSeconds: 1
+          failureThreshold: 1
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+          initialDelaySeconds: 1
+          periodSeconds: 10
+          timeoutSeconds: 1
+          failureThreshold: 1
+        env:
+          []
+        volumeMounts:
+        - mountPath: /etc/dex/cfg
+          name: config
+      volumes:
+      - secret:
+          defaultMode: 420
+          items:
+          - key: config.yaml
+            path: config.yaml
+          secretName: oauth2-proxy-example-dex
+        name: config
+---
+# Source: kubernetes/charts/hello-world/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: oauth2-proxy-example-hello-world
+  labels:
+    helm.sh/chart: hello-world-1.0.1
+    app.kubernetes.io/name: hello-world
+    app.kubernetes.io/instance: oauth2-proxy-example
+    app.kubernetes.io/version: "1.0.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: hello-world
+      app.kubernetes.io/instance: oauth2-proxy-example
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: hello-world
+        app.kubernetes.io/instance: oauth2-proxy-example
+    spec:
+      serviceAccountName: oauth2-proxy-example-hello-world
+      securityContext:
+        {}
+      containers:
+        - name: hello-world
+          securityContext:
+            {}
+          image: "conservis/hello-world:1.0.0"
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 9080
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+          resources:
+            {}
+---
+# Source: kubernetes/charts/httpbin/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: oauth2-proxy-example-httpbin
+  labels:
+    helm.sh/chart: httpbin-1.0.1
+    app.kubernetes.io/name: httpbin
+    app.kubernetes.io/instance: oauth2-proxy-example
+    app.kubernetes.io/version: "latest"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: httpbin
+      app.kubernetes.io/instance: oauth2-proxy-example
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: httpbin
+        app.kubernetes.io/instance: oauth2-proxy-example
+    spec:
+      serviceAccountName: oauth2-proxy-example-httpbin
+      securityContext:
+        {}
+      containers:
+        - name: httpbin
+          securityContext:
+            {}
+          image: "kennethreitz/httpbin:latest"
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+          resources:
+            {}
+---
+# Source: kubernetes/charts/oauth2-proxy/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: oauth2-proxy-sample
+    chart: oauth2-proxy-3.1.0
+    heritage: Helm
+    release: oauth2-proxy-example
+  name: oauth2-proxy-example-oauth2-proxy-sample
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: oauth2-proxy-sample
+      release: oauth2-proxy-example
+  template:
+    metadata:
+      annotations:
+        checksum/config: 5d8892a7b1d9eb03f9d59b787ce339b374fa2be51991e4e7533cb0a541984fac
+        checksum/config-emails: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
+        checksum/secret: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
+        checksum/google-secret: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
+      labels:
+        app: oauth2-proxy-sample
+        release: "oauth2-proxy-example"
+    spec:
+      serviceAccountName: oauth2-proxy-example-oauth2-proxy-sample
+      containers:
+      - name: oauth2-proxy
+        image: "quay.io/pusher/oauth2_proxy:v5.1.0"
+        imagePullPolicy: IfNotPresent
+        args:
+          - --http-address=0.0.0.0:4180
+          - --config=/etc/oauth2_proxy/oauth2_proxy.cfg
+        ports:
+          - containerPort: 4180
+            name: http
+            protocol: TCP
+        livenessProbe:
+          httpGet:
+            path: /ping
+            port: http
+            scheme: HTTP
+          initialDelaySeconds: 0
+          timeoutSeconds: 1
+        readinessProbe:
+          httpGet:
+            path: /ping
+            port: http
+            scheme: HTTP
+          initialDelaySeconds: 0
+          timeoutSeconds: 1
+          successThreshold: 1
+          periodSeconds: 10
+        resources:
+          {}
+        volumeMounts:
+        - mountPath: /etc/oauth2_proxy
+          name: configmain
+      volumes:
+      - configMap:
+          defaultMode: 420
+          name: oauth2-proxy-example-oauth2-proxy-sample
+        name: configmain
+      tolerations:
+        []
+---
+# Source: kubernetes/charts/dex/templates/ingress.yaml
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: oauth2-proxy-example-dex
+  labels:
+    app.kubernetes.io/name: dex
+    helm.sh/chart: dex-2.11.0
+    app.kubernetes.io/instance: oauth2-proxy-example
+    app.kubernetes.io/version: "2.23.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  rules:
+    - host: "dex.localtest.me"
+      http:
+        paths:
+          - path: /
+            backend:
+              serviceName: oauth2-proxy-example-dex
+              servicePort: 32000
+---
+# Source: kubernetes/charts/hello-world/templates/ingress.yaml
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: oauth2-proxy-example-hello-world
+  labels:
+    helm.sh/chart: hello-world-1.0.1
+    app.kubernetes.io/name: hello-world
+    app.kubernetes.io/instance: oauth2-proxy-example
+    app.kubernetes.io/version: "1.0.0"
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email
+    nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start
+    nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy-example-oauth2-proxy-sample.default.svc.cluster.local/oauth2/auth
+spec:
+  rules:
+    - host: hello-world.localtest.me
+      http:
+        paths:
+          - path: /
+            backend:
+              serviceName: oauth2-proxy-example-hello-world
+              servicePort: 9080
+---
+# Source: kubernetes/charts/httpbin/templates/ingress.yaml
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: oauth2-proxy-example-httpbin
+  labels:
+    helm.sh/chart: httpbin-1.0.1
+    app.kubernetes.io/name: httpbin
+    app.kubernetes.io/instance: oauth2-proxy-example
+    app.kubernetes.io/version: "latest"
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email
+    nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start
+    nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy-example-oauth2-proxy-sample.default.svc.cluster.local/oauth2/auth
+spec:
+  rules:
+    - host: httpbin.localtest.me
+      http:
+        paths:
+          - path: /
+            backend:
+              serviceName: oauth2-proxy-example-httpbin
+              servicePort: 80
+---
+# Source: kubernetes/charts/oauth2-proxy/templates/ingress.yaml
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  labels:
+    app: oauth2-proxy-sample
+    chart: oauth2-proxy-3.1.0
+    heritage: Helm
+    release: oauth2-proxy-example
+  name: oauth2-proxy-example-oauth2-proxy-sample
+  annotations:
+    nginx.ingress.kubernetes.io/server-snippet: |
+      large_client_header_buffers 4 32k;
+spec:
+  rules:
+    - host: oauth2-proxy.localtest.me
+      http:
+        paths:
+          - path: /
+            backend:
+              serviceName: oauth2-proxy-example-oauth2-proxy-sample
+              servicePort: 80

contrib/local-environment/kubernetes/values.yaml

@@ -0,0 +1,91 @@
+dex:
+  ingress:
+    enabled: true
+    hosts:
+      - dex.localtest.me
+  grpc: false
+  certs:
+    grpc:
+      create: false
+    web:
+      create: false
+
+  config:
+    issuer: http://dex.localtest.me
+    expiry:
+      signingKeys: "4h"
+      idTokens: "1h"
+    staticClients:
+      - id: oauth2-proxy
+        redirectURIs:
+          # These redirect URI points to the `--redirect-url` for OAuth2 proxy.
+          - 'http://oauth2-proxy.localtest.me/oauth2/callback'
+        name: 'OAuth2 Proxy'
+        secret: "b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"
+    staticPasswords:
+     - email: "admin@example.com"
+       # bcrypt hash of the string "password"
+       hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
+       username: "admin"
+       userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
+
+oauth2-proxy:
+  nameOverride: oauth2-proxy-sample
+  ingress:
+    enabled: true
+    hosts:
+      - oauth2-proxy.localtest.me
+    annotations:
+      nginx.ingress.kubernetes.io/server-snippet: |
+        large_client_header_buffers 4 32k;
+  # pick up client_id and client_secret from configFile as opposed to helm .Values.config.clientID and .Values.config.clientSecret
+  proxyVarsAsSecrets: false
+  config:
+    configFile: |-
+      cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="
+      cookie_domain=".localtest.me"
+      whitelist_domains=[".localtest.me"]
+      # only users with this domain will be let in
+      email_domains=["example.com"]
+
+      client_id="oauth2-proxy"
+      client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"
+      cookie_secure="false"
+
+      redirect_url="http://oauth2-proxy.localtest.me/oauth2/callback"
+
+      # we don't want to proxy anything so pick a non-existent directory
+      upstreams = [ "file:///dev/null" ]
+
+      # return authenticated user to nginx
+      set_xauthrequest = true
+      # using http://dex.localtest.me/.well-known/openid-configuration oauth2-proxy will populate
+      # login_url, redeem_url, and oidc_jwks_url
+      provider="oidc"
+      oidc_issuer_url="http://dex.localtest.me"
+
+httpbin:
+  ingress:
+    enabled: true
+    hosts:
+      - httpbin.localtest.me
+    annotations:
+      nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start
+      # That's what will be used in REAL LIFE
+      #nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy.localtest.me/oauth2/auth
+      # but because of https://github.com/kubernetes/ingress-nginx/issues/3665
+      nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy-example-oauth2-proxy-sample.default.svc.cluster.local/oauth2/auth
+      nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email
+
+hello-world:
+  ingress:
+    enabled: true
+    hosts:
+      - hello-world.localtest.me
+    annotations:
+      nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start
+      # That's what will be used in REAL LIFE
+      #nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy.localtest.me/oauth2/auth
+      # but because of https://github.com/kubernetes/ingress-nginx/issues/3665
+      nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy-example-oauth2-proxy-sample.default.svc.cluster.local/oauth2/auth
+      nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email

contrib/local-environment/nginx.conf

@@ -0,0 +1,84 @@
+# Reverse proxy to oauth2-proxy
+server {
+  listen       80;
+  server_name  oauth2-proxy.oauth2-proxy.localhost;
+
+  location / {
+    proxy_set_header Host       $host;
+    proxy_set_header X-Real-IP  $remote_addr;
+
+    proxy_pass http://oauth2-proxy:4180/;
+  }
+}
+
+# Reverse proxy to httpbin
+server {
+  listen      80;
+  server_name httpbin.oauth2-proxy.localhost;
+
+  auth_request /internal-auth/oauth2/auth;
+
+  # If the auth_request denies the request (401), redirect to the sign_in page
+  # and include the final rd URL back to the user's original request.
+  error_page 401 = http://oauth2-proxy.oauth2-proxy.localhost/oauth2/sign_in?rd=$scheme://$host$request_uri;
+
+  # Alternatively send the request to `start` to skip the provider button
+  # error_page 401 = http://oauth2-proxy.oauth2-proxy.localhost/oauth2/start?rd=$scheme://$host$request_uri;
+
+  location / {
+    proxy_pass http://httpbin/;
+  }
+
+  # auth_request must be a URI so this allows an internal path to then proxy to
+  # the real auth_request path.
+  # The trailing /'s are required so that nginx strips the prefix before proxying.
+  location /internal-auth/ {
+    internal; # Ensure external users can't access this path
+
+    # Make sure the OAuth2 Proxy knows where the original request came from.
+    proxy_set_header Host       $host;
+    proxy_set_header X-Real-IP  $remote_addr;
+
+    proxy_pass http://oauth2-proxy:4180/;
+  }
+}
+
+# Statically serve the nginx welcome
+server {
+  listen       80;
+  server_name  oauth2-proxy.localhost;
+
+  location / {
+    auth_request /internal-auth/oauth2/auth;
+
+    # If the auth_request denies the request (401), redirect to the sign_in page
+    # and include the final rd URL back to the user's original request.
+    error_page 401 = http://oauth2-proxy.oauth2-proxy.localhost/oauth2/sign_in?rd=$scheme://$host$request_uri;
+
+    # Alternatively send the request to `start` to skip the provider button
+    # error_page 401 = http://oauth2-proxy.oauth2-proxy.localhost/oauth2/start?rd=$scheme://$host$request_uri;
+
+
+    root   /usr/share/nginx/html;
+    index  index.html index.htm;
+  }
+
+  # redirect server error pages to the static page /50x.html
+  error_page   500 502 503 504  /50x.html;
+  location = /50x.html {
+    root   /usr/share/nginx/html;
+  }
+
+  # auth_request must be a URI so this allows an internal path to then proxy to
+  # the real auth_request path.
+  # The trailing /'s are required so that nginx strips the prefix before proxying.
+  location /internal-auth/ {
+    internal; # Ensure external users can't access this path
+
+    # Make sure the OAuth2 Proxy knows where the original request came from.
+    proxy_set_header Host       $host;
+    proxy_set_header X-Real-IP  $remote_addr;
+
+    proxy_pass http://oauth2-proxy:4180/;
+  }
+}

contrib/local-environment/oauth2-proxy-alpha-config.cfg

@@ -0,0 +1,5 @@
+http_address="0.0.0.0:4180"
+cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="
+email_domains="example.com"
+cookie_secure="false"
+redirect_url="http://localhost:4180/oauth2/callback"

contrib/local-environment/oauth2-proxy-alpha-config.yaml

@@ -0,0 +1,23 @@
+upstreams:
+  - id: httpbin
+    path: /
+    uri: http://httpbin
+injectRequestHeaders:
+- name: X-Forwarded-Groups
+  values:
+  - claim: groups
+- name: X-Forwarded-User
+  values:
+  -   claim: user
+- name: X-Forwarded-Email
+  values:
+  - claim: email
+- name: X-Forwarded-Preferred-Username
+  values:
+  - claim: preferred_username
+providers:
+- provider: oidc
+  clientSecret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK
+  clientID: oauth2-proxy
+  oidcConfig:
+    oidcIssuerURL: http://dex.localhost:4190/dex

contrib/local-environment/oauth2-proxy-keycloak.cfg

@@ -0,0 +1,20 @@
+http_address="0.0.0.0:4180"
+cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="
+email_domains=["example.com"]
+cookie_secure="false"
+upstreams="http://httpbin"
+cookie_domains=[".localtest.me"] # Required so cookie can be read on all subdomains.
+whitelist_domains=[".localtest.me"] # Required to allow redirection back to original requested target.
+
+# keycloak provider
+client_secret="72341b6d-7065-4518-a0e4-50ee15025608"
+client_id="oauth2-proxy"
+redirect_url="http://oauth2-proxy.localtest.me:4180/oauth2/callback"
+
+# in this case oauth2-proxy is going to visit
+# http://keycloak.localtest.me:9080/auth/realms/master/.well-known/openid-configuration for configuration
+oidc_issuer_url="http://keycloak.localtest.me:9080/auth/realms/master"
+provider="oidc"
+provider_display_name="Keycloak"
+
+

contrib/local-environment/oauth2-proxy-nginx.cfg

@@ -0,0 +1,12 @@
+http_address="0.0.0.0:4180"
+cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="
+provider="oidc"
+email_domains="example.com"
+oidc_issuer_url="http://dex.localhost:4190/dex"
+client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"
+client_id="oauth2-proxy"
+cookie_secure="false"
+
+redirect_url="http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback"
+cookie_domains=".oauth2-proxy.localhost" # Required so cookie can be read on all subdomains.
+whitelist_domains=".oauth2-proxy.localhost" # Required to allow redirection back to original requested target.

contrib/local-environment/oauth2-proxy-traefik.cfg

@@ -0,0 +1,22 @@
+http_address="0.0.0.0:4180"
+cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="
+provider="oidc"
+email_domains=["example.com"]
+oidc_issuer_url="http://dex.localhost:4190/dex"
+client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"
+client_id="oauth2-proxy"
+cookie_secure="false"
+
+redirect_url="http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback"
+cookie_domains=".oauth2-proxy.localhost" # Required so cookie can be read on all subdomains.
+whitelist_domains=".oauth2-proxy.localhost" # Required to allow redirection back to original requested target.
+
+# Mandatory option when using oauth2-proxy with traefik
+reverse_proxy="true"
+# Required for traefik with ForwardAuth and static upstream configuration 
+upstreams="static://202"
+# The following option skip the page requesting the user
+# to click on a button to be redirected to the identity provider
+# It can be activated only when traefik is not configure with
+# the error redirection middleware as this example.
+skip_provider_button="true"

contrib/local-environment/oauth2-proxy.cfg

@@ -0,0 +1,11 @@
+http_address="0.0.0.0:4180"
+cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="
+provider="oidc"
+email_domains="example.com"
+oidc_issuer_url="http://dex.localhost:4190/dex"
+client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"
+client_id="oauth2-proxy"
+cookie_secure="false"
+
+redirect_url="http://localhost:4180/oauth2/callback"
+upstreams="http://httpbin"

contrib/local-environment/traefik/dynamic.yaml

@@ -0,0 +1,57 @@
+http:
+  routers:
+    oauth2-proxy-route:
+      rule: "Host(`oauth2-proxy.oauth2-proxy.localhost`)"
+      middlewares:
+        - auth-headers
+      service: oauth-backend
+    httpbin-route:
+      rule: "Host(`httpbin.oauth2-proxy.localhost`)"
+      service: httpbin-service
+      middlewares:
+        - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin    
+    httpbin-route-2:
+      rule: "Host(`httpbin.oauth2-proxy.localhost`) && PathPrefix(`/no-auto-redirect`)"
+      service: httpbin-service
+      middlewares:
+        - oauth-auth-wo-redirect # unauthenticated session will return a 401
+    services-oauth2-route:
+      rule: "Host(`httpbin.oauth2-proxy.localhost`) && PathPrefix(`/oauth2/`)"
+      middlewares:
+        - auth-headers
+      service: oauth-backend
+
+  services:
+    httpbin-service:
+      loadBalancer:
+        servers:
+          - url: http://httpbin
+    oauth-backend:
+      loadBalancer:
+        servers:
+          - url: http://oauth2-proxy:4180
+
+  middlewares:
+    auth-headers:
+      headers:
+        stsSeconds: 315360000
+        browserXssFilter: true
+        contentTypeNosniff: true
+        forceSTSHeader: true
+        stsIncludeSubdomains: true
+        stsPreload: true
+        frameDeny: true
+    oauth-auth-redirect:
+      forwardAuth:
+        address: http://oauth2-proxy:4180
+        trustForwardHeader: true
+        authResponseHeaders:
+          - X-Auth-Request-Access-Token
+          - Authorization
+    oauth-auth-wo-redirect:
+      forwardAuth:
+        address: http://oauth2-proxy:4180/oauth2/auth
+        trustForwardHeader: true
+        authResponseHeaders:
+          - X-Auth-Request-Access-Token
+          - Authorization

contrib/local-environment/traefik/traefik.yaml

@@ -0,0 +1,7 @@
+api:
+  insecure: true
+log:
+  level: INFO
+providers:
+  file:
+    filename: /etc/traefik/dynamic.yaml

contrib/oauth2-proxy.cfg.example

@@ -1,10 +1,13 @@
 ## OAuth2 Proxy Config File
-## https://github.com/bitly/oauth2_proxy
+## https://github.com/oauth2-proxy/oauth2-proxy
 
 ## <addr>:<port> to listen on for HTTP/HTTPS clients
 # http_address = "127.0.0.1:4180"
 # https_address = ":443"
 
+## Are we running behind a reverse proxy? Will not accept headers like X-Real-Ip unless this is set.
+# reverse_proxy = true
+
 ## TLS Settings
 # tls_cert_file = ""
 # tls_key_file = ""
@@ -18,14 +21,25 @@
 #     "http://127.0.0.1:8080/"
 # ]
 
-## Log requests to stdout
-# request_logging = true
+## Logging configuration
+#logging_filename = ""
+#logging_max_size = 100
+#logging_max_age = 7
+#logging_local_time = true
+#logging_compress = false
+#standard_logging = true
+#standard_logging_format = "[{{.Timestamp}}] [{{.File}}] {{.Message}}"
+#request_logging = true
+#request_logging_format = "{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}"
+#auth_logging = true
+#auth_logging_format = "{{.Client}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}"
 
 ## pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream
 # pass_basic_auth = true
+# pass_user_headers = true
 ## pass the request Host Header to upstream
 ## when disabled the upstream Host is used as the Host Header
-# pass_host_header = true 
+# pass_host_header = true
 
 ## Email Domains to allow authentication for (this authorizes any email on this domain)
 ## for more granular authorization use `authenticated_emails_file`
@@ -45,7 +59,7 @@
 # authenticated_emails_file = ""
 
 ## Htpasswd File (optional)
-## Additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption
+## Additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -B" for bcrypt encryption
 ## enabling exposes a username/login signin form
 # htpasswd_file = ""
 
@@ -53,21 +67,26 @@
 ## optional directory with custom sign_in.html and error.html
 # custom_templates_dir = ""
 
+## skip SSL checking for HTTPS requests
+# ssl_insecure_skip_verify = false
+
+
 ## Cookie Settings
-## Name    - the cookie name
-## Secret - the seed string for secure cookies; should be 16, 24, or 32 bytes
-##          for use with an AES cipher when cookie_refresh or pass_access_token
-##          is set
-## Domain - (optional) cookie domain to force cookies to (ie: .yourcompany.com)
-## Expire - (duration) expire timeframe for cookie
-## Refresh - (duration) refresh the cookie when less than this much time remains before
-##           expiration; should be less than cookie_expire; set to 0 to disable.
-##           Refresh revalidated the OAuth token to ensure it is still valid. ie: 24h
-## Secure - secure cookies are only sent by the browser of a HTTPS connection (recommended)
+## Name     - the cookie name
+## Secret   - the seed string for secure cookies; should be 16, 24, or 32 bytes
+##            for use with an AES cipher when cookie_refresh or pass_access_token
+##            is set
+## Domain   - (optional) cookie domain to force cookies to (ie: .yourcompany.com)
+## Expire   - (duration) expire timeframe for cookie
+## Refresh  - (duration) refresh the cookie when duration has elapsed after cookie was initially set.
+##            Should be less than cookie_expire; set to 0 to disable.
+##            On refresh, OAuth token is re-validated.
+##            (ie: 1h means tokens are refreshed on request 1hr+ after it was set)
+## Secure   - secure cookies are only sent by the browser of a HTTPS connection (recommended)
 ## HttpOnly - httponly cookies are not readable by javascript (recommended)
 # cookie_name = "_oauth2_proxy"
 # cookie_secret = ""
-# cookie_domain = ""
+# cookie_domains = ""
 # cookie_expire = "168h"
 # cookie_refresh = ""
 # cookie_secure = true

contrib/oauth2-proxy.service.example

@@ -0,0 +1,22 @@
+# Systemd service file for oauth2-proxy daemon
+#
+# Date: Feb 9, 2016
+# Author: Srdjan Grubor <sgnn7@sgnn7.org>
+
+[Unit]
+Description=oauth2-proxy daemon service
+After=syslog.target network.target
+
+[Service]
+# www-data group and user need to be created before using these lines
+User=www-data
+Group=www-data
+
+ExecStart=/usr/local/bin/oauth2-proxy --config=/etc/oauth2-proxy.cfg
+ExecReload=/bin/kill -HUP $MAINPID
+
+KillMode=process
+Restart=always
+
+[Install]
+WantedBy=multi-user.target

contrib/oauth2-proxy_autocomplete.sh

@@ -0,0 +1,34 @@
+#
+# Autocompletion for oauth2-proxy
+#
+# To install this, copy/move this file to /etc/bash.completion.d/
+# or add a line to your ~/.bashrc | ~/.bash_profile that says ". /path/to/oauth2-proxy/contrib/oauth2-proxy_autocomplete.sh"
+#
+
+_oauth2_proxy() {
+	_oauth2_proxy_commands=$(oauth2-proxy -h 2>&1 | sed -n '/^\s*--/s/ \+/ /gp' | awk '{print $1}' | tr '\n' ' ')
+	local cur prev
+	COMPREPLY=()
+	cur="${COMP_WORDS[COMP_CWORD]}"
+	prev="${COMP_WORDS[COMP_CWORD-1]}"
+	case "$prev" in
+		--@(config|tls-cert-file|tls-key-file|authenticated-emails-file|htpasswd-file|custom-templates-dir|logging-filename|jwt-key-file))
+			_filedir
+			return 0
+			;;
+		--provider)
+			COMPREPLY=( $(compgen -W "google azure facebook github keycloak gitlab linkedin login.gov digitalocean" -- ${cur}) )
+			return 0
+			;;
+		--real-client-ip-header)
+			COMPREPLY=( $(compgen -W 'X-Real-IP X-Forwarded-For X-ProxyUser-IP' -- ${cur}) )
+			return 0
+			;;
+		--@(http-address|https-address|redirect-url|upstream|basic-auth-password|skip-auth-regex|flush-interval|extra-jwt-issuers|email-domain|whitelist-domain|trusted-ip|keycloak-group|azure-tenant|bitbucket-team|bitbucket-repository|github-org|github-team|github-repo|github-token|gitlab-group|github-user|google-group|google-admin-email|google-service-account-json|client-id|client_secret|banner|footer|proxy-prefix|ping-path|cookie-name|cookie-secret|cookie-domain|cookie-path|cookie-expire|cookie-refresh|cookie-samesite|redist-sentinel-master-name|redist-sentinel-connection-urls|redist-cluster-connection-urls|logging-max-size|logging-max-age|logging-max-backups|standard-logging-format|request-logging-format|exclude-logging-paths|auth-logging-format|oidc-issuer-url|oidc-jwks-url|login-url|redeem-url|profile-url|resource|validate-url|scope|approval-prompt|signature-key|acr-values|jwt-key|pubjwk-url))
+			return 0
+			;;
+	esac
+	COMPREPLY=( $(compgen -W "${_oauth2_proxy_commands}" -- ${cur}) )
+	return 0;
+}
+complete -F _oauth2_proxy oauth2-proxy

cookies.go

@@ -1,130 +0,0 @@
-package main
-
-import (
-	"crypto/aes"
-	"crypto/cipher"
-	"crypto/hmac"
-	"crypto/rand"
-	"crypto/sha1"
-	"encoding/base64"
-	"fmt"
-	"io"
-	"net/http"
-	"strconv"
-	"strings"
-	"time"
-)
-
-func validateCookie(cookie *http.Cookie, seed string) (string, time.Time, bool) {
-	// value, timestamp, sig
-	parts := strings.Split(cookie.Value, "|")
-	if len(parts) != 3 {
-		return "", time.Unix(0, 0), false
-	}
-	sig := cookieSignature(seed, cookie.Name, parts[0], parts[1])
-	if checkHmac(parts[2], sig) {
-		ts, err := strconv.Atoi(parts[1])
-		if err == nil && int64(ts) > time.Now().Add(time.Duration(24)*7*time.Hour*-1).Unix() {
-			// it's a valid cookie. now get the contents
-			rawValue, err := base64.URLEncoding.DecodeString(parts[0])
-			if err == nil {
-				return string(rawValue), time.Unix(int64(ts), 0), true
-			}
-		}
-	}
-	return "", time.Unix(0, 0), false
-}
-
-func signedCookieValue(seed string, key string, value string) string {
-	encodedValue := base64.URLEncoding.EncodeToString([]byte(value))
-	timeStr := fmt.Sprintf("%d", time.Now().Unix())
-	sig := cookieSignature(seed, key, encodedValue, timeStr)
-	cookieVal := fmt.Sprintf("%s|%s|%s", encodedValue, timeStr, sig)
-	return cookieVal
-}
-
-func cookieSignature(args ...string) string {
-	h := hmac.New(sha1.New, []byte(args[0]))
-	for _, arg := range args[1:] {
-		h.Write([]byte(arg))
-	}
-	var b []byte
-	b = h.Sum(b)
-	return base64.URLEncoding.EncodeToString(b)
-}
-
-func checkHmac(input, expected string) bool {
-	inputMAC, err1 := base64.URLEncoding.DecodeString(input)
-	if err1 == nil {
-		expectedMAC, err2 := base64.URLEncoding.DecodeString(expected)
-		if err2 == nil {
-			return hmac.Equal(inputMAC, expectedMAC)
-		}
-	}
-	return false
-}
-
-func encodeAccessToken(aes_cipher cipher.Block, access_token string) (string, error) {
-	ciphertext := make([]byte, aes.BlockSize+len(access_token))
-	iv := ciphertext[:aes.BlockSize]
-	if _, err := io.ReadFull(rand.Reader, iv); err != nil {
-		return "", fmt.Errorf("failed to create access code initialization vector")
-	}
-
-	stream := cipher.NewCFBEncrypter(aes_cipher, iv)
-	stream.XORKeyStream(ciphertext[aes.BlockSize:], []byte(access_token))
-	return base64.StdEncoding.EncodeToString(ciphertext), nil
-}
-
-func decodeAccessToken(aes_cipher cipher.Block, encoded_access_token string) (string, error) {
-	encrypted_access_token, err := base64.StdEncoding.DecodeString(
-		encoded_access_token)
-
-	if err != nil {
-		return "", fmt.Errorf("failed to decode access token")
-	}
-
-	if len(encrypted_access_token) < aes.BlockSize {
-		return "", fmt.Errorf("encrypted access token should be "+
-			"at least %d bytes, but is only %d bytes",
-			aes.BlockSize, len(encrypted_access_token))
-	}
-
-	iv := encrypted_access_token[:aes.BlockSize]
-	encrypted_access_token = encrypted_access_token[aes.BlockSize:]
-	stream := cipher.NewCFBDecrypter(aes_cipher, iv)
-	stream.XORKeyStream(encrypted_access_token, encrypted_access_token)
-
-	return string(encrypted_access_token), nil
-}
-
-func buildCookieValue(email string, aes_cipher cipher.Block,
-	access_token string) (string, error) {
-	if aes_cipher == nil {
-		return email, nil
-	}
-
-	encoded_token, err := encodeAccessToken(aes_cipher, access_token)
-	if err != nil {
-		return email, fmt.Errorf(
-			"error encoding access token for %s: %s", email, err)
-	}
-	return email + "|" + encoded_token, nil
-}
-
-func parseCookieValue(value string, aes_cipher cipher.Block) (email, user,
-	access_token string, err error) {
-	components := strings.Split(value, "|")
-	email = components[0]
-	user = strings.Split(email, "@")[0]
-
-	if aes_cipher != nil && len(components) == 2 {
-		access_token, err = decodeAccessToken(aes_cipher, components[1])
-		if err != nil {
-			err = fmt.Errorf(
-				"error decoding access token for %s: %s",
-				email, err)
-		}
-	}
-	return email, user, access_token, err
-}

cookies_test.go

@@ -1,75 +0,0 @@
-package main
-
-import (
-	"crypto/aes"
-	"github.com/bmizerany/assert"
-	"strings"
-	"testing"
-)
-
-func TestEncodeAndDecodeAccessToken(t *testing.T) {
-	const key = "0123456789abcdefghijklmnopqrstuv"
-	const access_token = "my access token"
-	c, err := aes.NewCipher([]byte(key))
-	assert.Equal(t, nil, err)
-
-	encoded_token, err := encodeAccessToken(c, access_token)
-	assert.Equal(t, nil, err)
-
-	decoded_token, err := decodeAccessToken(c, encoded_token)
-	assert.Equal(t, nil, err)
-
-	assert.NotEqual(t, access_token, encoded_token)
-	assert.Equal(t, access_token, decoded_token)
-}
-
-func TestBuildCookieValueWithoutAccessToken(t *testing.T) {
-	value, err := buildCookieValue("michael.bland@gsa.gov", nil, "")
-	assert.Equal(t, nil, err)
-	assert.Equal(t, "michael.bland@gsa.gov", value)
-}
-
-func TestBuildCookieValueWithAccessTokenAndNilCipher(t *testing.T) {
-	value, err := buildCookieValue("michael.bland@gsa.gov", nil,
-		"access token")
-	assert.Equal(t, nil, err)
-	assert.Equal(t, "michael.bland@gsa.gov", value)
-}
-
-func TestParseCookieValueWithoutAccessToken(t *testing.T) {
-	email, user, access_token, err := parseCookieValue(
-		"michael.bland@gsa.gov", nil)
-	assert.Equal(t, nil, err)
-	assert.Equal(t, "michael.bland@gsa.gov", email)
-	assert.Equal(t, "michael.bland", user)
-	assert.Equal(t, "", access_token)
-}
-
-func TestParseCookieValueWithAccessTokenAndNilCipher(t *testing.T) {
-	email, user, access_token, err := parseCookieValue(
-		"michael.bland@gsa.gov|access_token", nil)
-	assert.Equal(t, nil, err)
-	assert.Equal(t, "michael.bland@gsa.gov", email)
-	assert.Equal(t, "michael.bland", user)
-	assert.Equal(t, "", access_token)
-}
-
-func TestBuildAndParseCookieValueWithAccessToken(t *testing.T) {
-	aes_cipher, err := aes.NewCipher([]byte("0123456789abcdef"))
-	assert.Equal(t, nil, err)
-	value, err := buildCookieValue("michael.bland@gsa.gov", aes_cipher,
-		"access_token")
-	assert.Equal(t, nil, err)
-
-	prefix := "michael.bland@gsa.gov|"
-	if !strings.HasPrefix(value, prefix) {
-		t.Fatal("cookie value does not start with \"%s\": %s",
-			prefix, value)
-	}
-
-	email, user, access_token, err := parseCookieValue(value, aes_cipher)
-	assert.Equal(t, nil, err)
-	assert.Equal(t, "michael.bland@gsa.gov", email)
-	assert.Equal(t, "michael.bland", user)
-	assert.Equal(t, "access_token", access_token)
-}

dist.sh

@@ -1,30 +1,39 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
-# build binary distributions for linux/amd64 and darwin/amd64
-set -e 
+set -o errexit
 
-DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-echo "working dir $DIR"
-mkdir -p $DIR/dist
-mkdir -p $DIR/.godeps
-export GOPATH=$DIR/.godeps:$GOPATH
-gpm install
+if [[ -z ${BINARY} ]] || [[ -z ${VERSION} ]]; then
+	echo "Missing required env var: BINARY=X VERSION=X $(basename $0)"
+	exit 1
+fi
 
-os=$(go env GOOS)
-arch=$(go env GOARCH)
-version=$(cat $DIR/version.go | grep "const VERSION" | awk '{print $NF}' | sed 's/"//g')
-goversion=$(go version | awk '{print $3}')
+ARCHS=(darwin-amd64 linux-amd64 linux-arm64 linux-armv6 freebsd-amd64 windows-amd64)
 
-echo "... running tests"
-./test.sh || exit 1
+mkdir -p release
 
-for os in windows linux darwin; do
-    echo "... building v$version for $os/$arch"
-    BUILD=$(mktemp -d -t oauth2_proxy)
-    TARGET="oauth2_proxy-$version.$os-$arch.$goversion"
-    GOOS=$os GOARCH=$arch CGO_ENABLED=0 go build -o $BUILD/$TARGET/oauth2_proxy || exit 1
-    pushd $BUILD
-    tar czvf $TARGET.tar.gz $TARGET
-    mv $TARGET.tar.gz $DIR/dist
-    popd
+# Create architecture specific release dirs
+for ARCH in "${ARCHS[@]}"; do
+	mkdir -p release/${BINARY}-${VERSION}.${ARCH}
+
+	GO_OS=$(echo $ARCH | awk -F- '{print $1}')
+	GO_ARCH=$(echo $ARCH | awk -F- '{print $2}')
+
+	# Create architecture specific binaries
+	if [[ ${GO_ARCH} == "armv6" ]]; then
+		GO111MODULE=on GOOS=${GO_OS} GOARCH=arm GOARM=6 CGO_ENABLED=0 go build -ldflags="-X main.VERSION=${VERSION}" \
+			-o release/${BINARY}-${VERSION}.${ARCH}/${BINARY} .
+	else
+		GO111MODULE=on GOOS=${GO_OS} GOARCH=${GO_ARCH} CGO_ENABLED=0 go build -ldflags="-X main.VERSION=${VERSION}" \
+			-o release/${BINARY}-${VERSION}.${ARCH}/${BINARY} .
+	fi
+
+	cd release
+
+	# Create sha256sum for architecture specific binary
+	sha256sum ${BINARY}-${VERSION}.${ARCH}/${BINARY} > ${BINARY}-${VERSION}.${ARCH}-sha256sum.txt
+
+	# Create tar file for architecture specific binary
+	tar -czvf ${BINARY}-${VERSION}.${ARCH}.tar.gz ${BINARY}-${VERSION}.${ARCH}
+
+	cd ..
 done

docs/.gitignore

@@ -0,0 +1,20 @@
+# Dependencies
+/node_modules
+
+# Production
+/build
+
+# Generated files
+.docusaurus
+.cache-loader
+
+# Misc
+.DS_Store
+.env.local
+.env.development.local
+.env.test.local
+.env.production.local
+
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*

docs/README.md

@@ -0,0 +1,33 @@
+# Website
+
+This website is built using [Docusaurus 2](https://v2.docusaurus.io/), a modern static website generator.
+
+## Installation
+
+```console
+yarn install
+```
+
+## Local Development
+
+```console
+yarn start
+```
+
+This command starts a local development server and open up a browser window. Most changes are reflected live without having to restart the server.
+
+## Build
+
+```console
+yarn build
+```
+
+This command generates static content into the `build` directory and can be served using any static contents hosting service.
+
+## Deployment
+
+```console
+GIT_USER=<Your GitHub username> USE_SSH=true yarn deploy
+```
+
+If you are using GitHub pages for hosting, this command is a convenient way to build the website and push to the `gh-pages` branch.

docs/babel.config.js

@@ -0,0 +1,3 @@
+module.exports = {
+  presets: [require.resolve('@docusaurus/core/lib/babel/preset')],
+};

docs/docs/behaviour.md

@@ -0,0 +1,11 @@
+---
+id: behaviour
+title: Behaviour
+---
+
+1. Any request passing through the proxy (and not matched by `--skip-auth-regex`) is checked for the proxy's session cookie (`--cookie-name`) (or, if allowed, a JWT token - see `--skip-jwt-bearer-tokens`).
+2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with `Accept: application/json`, in which case 401 Unauthorized is returned)
+3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
+4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)
+
+Notice that the proxy also provides a number of useful [endpoints](features/endpoints.md).

docs/docs/community/security.md

@@ -0,0 +1,49 @@
+---
+id: security
+title: Security
+---
+
+:::note
+OAuth2 Proxy is a community project.
+Maintainers do not work on this project full time, and as such,
+while we endeavour to respond to disclosures as quickly as possible,
+this may take longer than in projects with corporate sponsorship.
+:::
+
+## Security Disclosures
+
+:::important
+If you believe you have found a vulnerability within OAuth2 Proxy or any of its
+dependencies, please do NOT open an issue or PR on GitHub, please do NOT post
+any details publicly.
+:::
+
+Security disclosures MUST be done in private.
+If you have found an issue that you would like to bring to the attention of the
+maintenance team for OAuth2 Proxy, please compose an email and send it to the
+list of maintainers in our [MAINTAINERS](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/MAINTAINERS) file.
+
+Please include as much detail as possible.
+Ideally, your disclosure should include:
+- A reproducible case that can be used to demonstrate the exploit
+- How you discovered this vulnerability
+- A potential fix for the issue (if you have thought of one)
+- Versions affected (if not present in master)
+- Your GitHub ID
+
+### How will we respond to disclosures?
+
+We use [GitHub Security Advisories](https://docs.github.com/en/github/managing-security-vulnerabilities/about-github-security-advisories)
+to privately discuss fixes for disclosed vulnerabilities.
+If you include a GitHub ID with your disclosure we will add you as a collaborator
+for the advisory so that you can join the discussion and validate any fixes
+we may propose.
+
+For minor issues and previously disclosed vulnerabilities (typically for
+dependencies), we may use regular PRs for fixes and forego the security advisory.
+
+Once a fix has been agreed upon, we will merge the fix and create a new release.
+If we have multiple security issues in flight simultaneously, we may delay
+merging fixes until all patches are ready.
+We may also backport the fix to previous releases,
+but this will be at the discretion of the maintainers.

docs/docs/configuration/alpha_config.md

@@ -0,0 +1,378 @@
+---
+id: alpha-config
+title: Alpha Configuration
+---
+
+:::warning
+This page contains documentation for alpha features.
+We reserve the right to make breaking changes to the features detailed within this page with no notice.
+
+Options described in this page may be changed, removed, renamed or moved without prior warning.
+Please beware of this before you use alpha configuration options.
+:::
+
+This page details a set of **alpha** configuration options in a new format.
+Going forward we are intending to add structured configuration in YAML format to
+replace the existing TOML based configuration file and flags.
+
+Below is a reference for the structure of the configuration, with
+[AlphaOptions](#alphaoptions) as the root of the configuration.
+
+When using alpha configuration, your config file will look something like below:
+
+```yaml
+upstreams:
+  - id: ...
+    ...
+injectRequestHeaders:
+  - name: ...
+    ...
+injectResponseHeaders:
+  - name: ...
+    ...
+```
+
+Please browse the [reference](#configuration-reference) below for the structure
+of the new configuration format.
+
+## Using Alpha Configuration
+
+To use the new **alpha** configuration, generate a YAML file based on the format
+described in the [reference](#configuration-reference) below.
+
+Provide the path to this file using the `--alpha-config` flag.
+
+:::note
+When using the `--alpha-config` flag, some options are no longer available.
+See [removed options](#removed-options) below for more information.
+:::
+
+### Converting configuration to the new structure
+
+Before adding the new `--alpha-config` option, start OAuth2 Proxy using the
+`convert-config-to-alpha` flag to convert existing configuration to the new format.
+
+```bash
+oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg
+```
+
+This will convert any options supported by the new format to YAML and print the
+new configuration to `STDOUT`.
+
+Copy this to a new file, remove any options from your existing configuration
+noted in [removed options](#removed-options) and then start OAuth2 Proxy using
+the new config.
+
+```bash
+oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg
+```
+
+## Removed options
+
+The following flags/options and their respective environment variables are no
+longer available when using alpha configuration:
+
+<!-- Legacy Upstream FlagSet -->
+- `flush-interval`/`flush_interval`
+- `pass-host-header`/`pass_host_header`
+- `proxy-websockets`/`proxy_websockets`
+- `ssl-upstream-insecure-skip-verify`/`ssl_upstream_insecure_skip_verify`
+- `upstream`/`upstreams`
+
+<!-- Legacy Headers FlagSet -->
+- `pass-basic-auth`/`pass_basic_auth`
+- `pass-access-token`/`pass_access_token`
+- `pass-user-headers`/`pass_user_headers`
+- `pass-authorization-header`/`pass_authorization_header`
+- `set-basic-auth`/`set_basic_auth`
+- `set-xauthrequest`/`set_xauthrequest`
+- `set-authorization-header`/`set_authorization_header`
+- `prefer-email-to-user`/`prefer_email_to_user`
+- `basic-auth-password`/`basic_auth_password`
+- `skip-auth-strip-headers`/`skip_auth_strip_headers`
+
+Attempting to use these options via flags or via config when `--alpha-config`
+set will result in an error.
+
+:::important
+You must remove these options before starting OAuth2 Proxy with `--alpha-config`
+:::
+
+## Configuration Reference
+<!--- THIS FILE IS AUTOGENERATED!!! DO NOT EDIT!!! -->
+
+### AlphaOptions
+
+AlphaOptions contains alpha structured configuration options.
+Usage of these options allows users to access alpha features that are not
+available as part of the primary configuration structure for OAuth2 Proxy.
+
+:::warning
+The options within this structure are considered alpha.
+They may change between releases without notice.
+:::
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `upstreams` | _[Upstreams](#upstreams)_ | Upstreams is used to configure upstream servers.<br/>Once a user is authenticated, requests to the server will be proxied to<br/>these upstream servers based on the path mappings defined in this list. |
+| `injectRequestHeaders` | _[[]Header](#header)_ | InjectRequestHeaders is used to configure headers that should be added<br/>to requests to upstream servers.<br/>Headers may source values from either the authenticated user's session<br/>or from a static secret value. |
+| `injectResponseHeaders` | _[[]Header](#header)_ | InjectResponseHeaders is used to configure headers that should be added<br/>to responses from the proxy.<br/>This is typically used when using the proxy as an external authentication<br/>provider in conjunction with another proxy such as NGINX and its<br/>auth_request module.<br/>Headers may source values from either the authenticated user's session<br/>or from a static secret value. |
+| `server` | _[Server](#server)_ | Server is used to configure the HTTP(S) server for the proxy application.<br/>You may choose to run both HTTP and HTTPS servers simultaneously.<br/>This can be done by setting the BindAddress and the SecureBindAddress simultaneously.<br/>To use the secure server you must configure a TLS certificate and key. |
+| `metricsServer` | _[Server](#server)_ | MetricsServer is used to configure the HTTP(S) server for metrics.<br/>You may choose to run both HTTP and HTTPS servers simultaneously.<br/>This can be done by setting the BindAddress and the SecureBindAddress simultaneously.<br/>To use the secure server you must configure a TLS certificate and key. |
+| `providers` | _[Providers](#providers)_ | Providers is used to configure multiple providers. |
+
+### AzureOptions
+
+(**Appears on:** [Provider](#provider))
+
+
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `tenant` | _string_ | Tenant directs to a tenant-specific or common (tenant-independent) endpoint<br/>Default value is 'commmon' |
+
+### BitbucketOptions
+
+(**Appears on:** [Provider](#provider))
+
+
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `team` | _string_ | Team sets restrict logins to members of this team |
+| `repository` | _string_ | Repository sets restrict logins to user with access to this repository |
+
+### ClaimSource
+
+(**Appears on:** [HeaderValue](#headervalue))
+
+ClaimSource allows loading a header value from a claim within the session
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `claim` | _string_ | Claim is the name of the claim in the session that the value should be<br/>loaded from. |
+| `prefix` | _string_ | Prefix is an optional prefix that will be prepended to the value of the<br/>claim if it is non-empty. |
+| `basicAuthPassword` | _[SecretSource](#secretsource)_ | BasicAuthPassword converts this claim into a basic auth header.<br/>Note the value of claim will become the basic auth username and the<br/>basicAuthPassword will be used as the password value. |
+
+### Duration
+#### (`string` alias)
+
+(**Appears on:** [Upstream](#upstream))
+
+Duration is as string representation of a period of time.
+A duration string is a is a possibly signed sequence of decimal numbers,
+each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".
+Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
+
+
+### GitHubOptions
+
+(**Appears on:** [Provider](#provider))
+
+
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `org` | _string_ | Org sets restrict logins to members of this organisation |
+| `team` | _string_ | Team sets restrict logins to members of this team |
+| `repo` | _string_ | Repo sets restrict logins to collaborators of this repository |
+| `token` | _string_ | Token is the token to use when verifying repository collaborators<br/>it must have push access to the repository |
+| `users` | _[]string_ | Users allows users with these usernames to login<br/>even if they do not belong to the specified org and team or collaborators |
+
+### GitLabOptions
+
+(**Appears on:** [Provider](#provider))
+
+
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `group` | _[]string_ | Group sets restrict logins to members of this group |
+| `projects` | _[]string_ | Projects restricts logins to members of any of these projects |
+
+### GoogleOptions
+
+(**Appears on:** [Provider](#provider))
+
+
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `group` | _[]string_ | Groups sets restrict logins to members of this google group |
+| `adminEmail` | _string_ | AdminEmail is the google admin to impersonate for api calls |
+| `serviceAccountJson` | _string_ | ServiceAccountJSON is the path to the service account json credentials |
+
+### Header
+
+(**Appears on:** [AlphaOptions](#alphaoptions))
+
+Header represents an individual header that will be added to a request or
+response header.
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `name` | _string_ | Name is the header name to be used for this set of values.<br/>Names should be unique within a list of Headers. |
+| `preserveRequestValue` | _bool_ | PreserveRequestValue determines whether any values for this header<br/>should be preserved for the request to the upstream server.<br/>This option only takes effet on injected request headers.<br/>Defaults to false (headers that match this header will be stripped). |
+| `values` | _[[]HeaderValue](#headervalue)_ | Values contains the desired values for this header |
+
+### HeaderValue
+
+(**Appears on:** [Header](#header))
+
+HeaderValue represents a single header value and the sources that can
+make up the header value
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `value` | _[]byte_ | Value expects a base64 encoded string value. |
+| `fromEnv` | _string_ | FromEnv expects the name of an environment variable. |
+| `fromFile` | _string_ | FromFile expects a path to a file containing the secret value. |
+| `claim` | _string_ | Claim is the name of the claim in the session that the value should be<br/>loaded from. |
+| `prefix` | _string_ | Prefix is an optional prefix that will be prepended to the value of the<br/>claim if it is non-empty. |
+| `basicAuthPassword` | _[SecretSource](#secretsource)_ | BasicAuthPassword converts this claim into a basic auth header.<br/>Note the value of claim will become the basic auth username and the<br/>basicAuthPassword will be used as the password value. |
+
+### KeycloakOptions
+
+(**Appears on:** [Provider](#provider))
+
+
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `groups` | _[]string_ | Group enables to restrict login to members of indicated group |
+
+### LoginGovOptions
+
+(**Appears on:** [Provider](#provider))
+
+
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `jwtKey` | _string_ | JWTKey is a private key in PEM format used to sign JWT, |
+| `jwtKeyFile` | _string_ | JWTKeyFile is a path to the private key file in PEM format used to sign the JWT |
+| `pubjwkURL` | _string_ | PubJWKURL is the JWK pubkey access endpoint |
+
+### OIDCOptions
+
+(**Appears on:** [Provider](#provider))
+
+
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `issuerURL` | _string_ | IssuerURL is the OpenID Connect issuer URL<br/>eg: https://accounts.google.com |
+| `insecureAllowUnverifiedEmail` | _bool_ | InsecureAllowUnverifiedEmail prevents failures if an email address in an id_token is not verified<br/>default set to 'false' |
+| `insecureSkipIssuerVerification` | _bool_ | InsecureSkipIssuerVerification skips verification of ID token issuers. When false, ID Token Issuers must match the OIDC discovery URL<br/>default set to 'false' |
+| `skipDiscovery` | _bool_ | SkipDiscovery allows to skip OIDC discovery and use manually supplied Endpoints<br/>default set to 'false' |
+| `jwksURL` | _string_ | JwksURL is the OpenID Connect JWKS URL<br/>eg: https://www.googleapis.com/oauth2/v3/certs |
+| `emailClaim` | _string_ | EmailClaim indicates which claim contains the user email,<br/>default set to 'email' |
+| `groupsClaim` | _string_ | GroupsClaim indicates which claim contains the user groups<br/>default set to 'groups' |
+| `userIDClaim` | _string_ | UserIDClaim indicates which claim contains the user ID<br/>default set to 'email' |
+
+### Provider
+
+(**Appears on:** [Providers](#providers))
+
+Provider holds all configuration for a single provider
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `clientID` | _string_ | ClientID is the OAuth Client ID that is defined in the provider<br/>This value is required for all providers. |
+| `clientSecret` | _string_ | ClientSecret is the OAuth Client Secret that is defined in the provider<br/>This value is required for all providers. |
+| `clientSecretFile` | _string_ | ClientSecretFile is the name of the file<br/>containing the OAuth Client Secret, it will be used if ClientSecret is not set. |
+| `keycloakConfig` | _[KeycloakOptions](#keycloakoptions)_ | KeycloakConfig holds all configurations for Keycloak provider. |
+| `azureConfig` | _[AzureOptions](#azureoptions)_ | AzureConfig holds all configurations for Azure provider. |
+| `bitbucketConfig` | _[BitbucketOptions](#bitbucketoptions)_ | BitbucketConfig holds all configurations for Bitbucket provider. |
+| `githubConfig` | _[GitHubOptions](#githuboptions)_ | GitHubConfig holds all configurations for GitHubC provider. |
+| `gitlabConfig` | _[GitLabOptions](#gitlaboptions)_ | GitLabConfig holds all configurations for GitLab provider. |
+| `googleConfig` | _[GoogleOptions](#googleoptions)_ | GoogleConfig holds all configurations for Google provider. |
+| `oidcConfig` | _[OIDCOptions](#oidcoptions)_ | OIDCConfig holds all configurations for OIDC provider<br/>or providers utilize OIDC configurations. |
+| `loginGovConfig` | _[LoginGovOptions](#logingovoptions)_ | LoginGovConfig holds all configurations for LoginGov provider. |
+| `id` | _string_ | ID should be a unique identifier for the provider.<br/>This value is required for all providers. |
+| `provider` | _string_ | Type is the OAuth provider<br/>must be set from the supported providers group,<br/>otherwise 'Google' is set as default |
+| `name` | _string_ | Name is the providers display name<br/>if set, it will be shown to the users in the login page. |
+| `caFiles` | _[]string_ | CAFiles is a list of paths to CA certificates that should be used when connecting to the provider.<br/>If not specified, the default Go trust sources are used instead |
+| `loginURL` | _string_ | LoginURL is the authentication endpoint |
+| `redeemURL` | _string_ | RedeemURL is the token redemption endpoint |
+| `profileURL` | _string_ | ProfileURL is the profile access endpoint |
+| `resource` | _string_ | ProtectedResource is the resource that is protected (Azure AD only) |
+| `validateURL` | _string_ | ValidateURL is the access token validation endpoint |
+| `scope` | _string_ | Scope is the OAuth scope specification |
+| `prompt` | _string_ | Prompt is OIDC prompt |
+| `approvalPrompt` | _string_ | ApprovalPrompt is the OAuth approval_prompt<br/>default is set to 'force' |
+| `allowedGroups` | _[]string_ | AllowedGroups is a list of restrict logins to members of this group |
+| `acrValues` | _string_ | AcrValues is a string of acr values |
+
+### Providers
+
+#### ([[]Provider](#provider) alias)
+
+(**Appears on:** [AlphaOptions](#alphaoptions))
+
+Providers is a collection of definitions for providers.
+
+
+### SecretSource
+
+(**Appears on:** [ClaimSource](#claimsource), [HeaderValue](#headervalue), [TLS](#tls))
+
+SecretSource references an individual secret value.
+Only one source within the struct should be defined at any time.
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `value` | _[]byte_ | Value expects a base64 encoded string value. |
+| `fromEnv` | _string_ | FromEnv expects the name of an environment variable. |
+| `fromFile` | _string_ | FromFile expects a path to a file containing the secret value. |
+
+### Server
+
+(**Appears on:** [AlphaOptions](#alphaoptions))
+
+Server represents the configuration for an HTTP(S) server
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `BindAddress` | _string_ | BindAddress is the the address on which to serve traffic.<br/>Leave blank or set to "-" to disable. |
+| `SecureBindAddress` | _string_ | SecureBindAddress is the the address on which to serve secure traffic.<br/>Leave blank or set to "-" to disable. |
+| `TLS` | _[TLS](#tls)_ | TLS contains the information for loading the certificate and key for the<br/>secure traffic. |
+
+### TLS
+
+(**Appears on:** [Server](#server))
+
+TLS contains the information for loading a TLS certifcate and key.
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `Key` | _[SecretSource](#secretsource)_ | Key is the the TLS key data to use.<br/>Typically this will come from a file. |
+| `Cert` | _[SecretSource](#secretsource)_ | Cert is the TLS certificate data to use.<br/>Typically this will come from a file. |
+
+### Upstream
+
+(**Appears on:** [Upstreams](#upstreams))
+
+Upstream represents the configuration for an upstream server.
+Requests will be proxied to this upstream if the path matches the request path.
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `id` | _string_ | ID should be a unique identifier for the upstream.<br/>This value is required for all upstreams. |
+| `path` | _string_ | Path is used to map requests to the upstream server.<br/>The closest match will take precedence and all Paths must be unique. |
+| `uri` | _string_ | The URI of the upstream server. This may be an HTTP(S) server of a File<br/>based URL. It may include a path, in which case all requests will be served<br/>under that path.<br/>Eg:<br/>- http://localhost:8080<br/>- https://service.localhost<br/>- https://service.localhost/path<br/>- file://host/path<br/>If the URI's path is "/base" and the incoming request was for "/dir",<br/>the upstream request will be for "/base/dir". |
+| `insecureSkipTLSVerify` | _bool_ | InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.<br/>This option is insecure and will allow potential Man-In-The-Middle attacks<br/>betweem OAuth2 Proxy and the usptream server.<br/>Defaults to false. |
+| `static` | _bool_ | Static will make all requests to this upstream have a static response.<br/>The response will have a body of "Authenticated" and a response code<br/>matching StaticCode.<br/>If StaticCode is not set, the response will return a 200 response. |
+| `staticCode` | _int_ | StaticCode determines the response code for the Static response.<br/>This option can only be used with Static enabled. |
+| `flushInterval` | _[Duration](#duration)_ | FlushInterval is the period between flushing the response buffer when<br/>streaming response from the upstream.<br/>Defaults to 1 second. |
+| `passHostHeader` | _bool_ | PassHostHeader determines whether the request host header should be proxied<br/>to the upstream server.<br/>Defaults to true. |
+| `proxyWebSockets` | _bool_ | ProxyWebSockets enables proxying of websockets to upstream servers<br/>Defaults to true. |
+
+### Upstreams
+
+#### ([[]Upstream](#upstream) alias)
+
+(**Appears on:** [AlphaOptions](#alphaoptions))
+
+Upstreams is a collection of definitions for upstream servers.
+

docs/docs/configuration/alpha_config.md.tmpl

@@ -0,0 +1,101 @@
+---
+id: alpha-config
+title: Alpha Configuration
+---
+
+:::warning
+This page contains documentation for alpha features.
+We reserve the right to make breaking changes to the features detailed within this page with no notice.
+
+Options described in this page may be changed, removed, renamed or moved without prior warning.
+Please beware of this before you use alpha configuration options.
+:::
+
+This page details a set of **alpha** configuration options in a new format.
+Going forward we are intending to add structured configuration in YAML format to
+replace the existing TOML based configuration file and flags.
+
+Below is a reference for the structure of the configuration, with
+[AlphaOptions](#alphaoptions) as the root of the configuration.
+
+When using alpha configuration, your config file will look something like below:
+
+```yaml
+upstreams:
+  - id: ...
+    ...
+injectRequestHeaders:
+  - name: ...
+    ...
+injectResponseHeaders:
+  - name: ...
+    ...
+```
+
+Please browse the [reference](#configuration-reference) below for the structure
+of the new configuration format.
+
+## Using Alpha Configuration
+
+To use the new **alpha** configuration, generate a YAML file based on the format
+described in the [reference](#configuration-reference) below.
+
+Provide the path to this file using the `--alpha-config` flag.
+
+:::note
+When using the `--alpha-config` flag, some options are no longer available.
+See [removed options](#removed-options) below for more information.
+:::
+
+### Converting configuration to the new structure
+
+Before adding the new `--alpha-config` option, start OAuth2 Proxy using the
+`convert-config-to-alpha` flag to convert existing configuration to the new format.
+
+```bash
+oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg
+```
+
+This will convert any options supported by the new format to YAML and print the
+new configuration to `STDOUT`.
+
+Copy this to a new file, remove any options from your existing configuration
+noted in [removed options](#removed-options) and then start OAuth2 Proxy using
+the new config.
+
+```bash
+oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg
+```
+
+## Removed options
+
+The following flags/options and their respective environment variables are no
+longer available when using alpha configuration:
+
+<!-- Legacy Upstream FlagSet -->
+- `flush-interval`/`flush_interval`
+- `pass-host-header`/`pass_host_header`
+- `proxy-websockets`/`proxy_websockets`
+- `ssl-upstream-insecure-skip-verify`/`ssl_upstream_insecure_skip_verify`
+- `upstream`/`upstreams`
+
+<!-- Legacy Headers FlagSet -->
+- `pass-basic-auth`/`pass_basic_auth`
+- `pass-access-token`/`pass_access_token`
+- `pass-user-headers`/`pass_user_headers`
+- `pass-authorization-header`/`pass_authorization_header`
+- `set-basic-auth`/`set_basic_auth`
+- `set-xauthrequest`/`set_xauthrequest`
+- `set-authorization-header`/`set_authorization_header`
+- `prefer-email-to-user`/`prefer_email_to_user`
+- `basic-auth-password`/`basic_auth_password`
+- `skip-auth-strip-headers`/`skip_auth_strip_headers`
+
+Attempting to use these options via flags or via config when `--alpha-config`
+set will result in an error.
+
+:::important
+You must remove these options before starting OAuth2 Proxy with `--alpha-config`
+:::
+
+## Configuration Reference

docs/docs/configuration/auth.md

@@ -0,0 +1,510 @@
+---
+id: oauth_provider
+title: OAuth Provider Configuration
+---
+
+You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run `oauth2-proxy` on.
+
+Valid providers are :
+
+- [Google](#google-auth-provider) _default_
+- [Azure](#azure-auth-provider)
+- [Facebook](#facebook-auth-provider)
+- [GitHub](#github-auth-provider)
+- [Keycloak](#keycloak-auth-provider)
+- [GitLab](#gitlab-auth-provider)
+- [LinkedIn](#linkedin-auth-provider)
+- [Microsoft Azure AD](#microsoft-azure-ad-provider)
+- [OpenID Connect](#openid-connect-provider)
+- [login.gov](#logingov-provider)
+- [Nextcloud](#nextcloud-provider)
+- [DigitalOcean](#digitalocean-auth-provider)
+- [Bitbucket](#bitbucket-auth-provider)
+- [Gitea](#gitea-auth-provider)
+
+The provider can be selected using the `provider` configuration value.
+
+Please note that not all providers support all claims. The `preferred_username` claim is currently only supported by the OpenID Connect provider.
+
+### Google Auth Provider
+
+For Google, the registration steps are:
+
+1.  Create a new project: https://console.developers.google.com/project
+2.  Choose the new project from the top right project dropdown (only if another project is selected)
+3.  In the project Dashboard center pane, choose **"API Manager"**
+4.  In the left Nav pane, choose **"Credentials"**
+5.  In the center pane, choose **"OAuth consent screen"** tab. Fill in **"Product name shown to users"** and hit save.
+6.  In the center pane, choose **"Credentials"** tab.
+    - Open the **"New credentials"** drop down
+    - Choose **"OAuth client ID"**
+    - Choose **"Web application"**
+    - Application name is freeform, choose something appropriate
+    - Authorized JavaScript origins is your domain ex: `https://internal.yourcompany.com`
+    - Authorized redirect URIs is the location of oauth2/callback ex: `https://internal.yourcompany.com/oauth2/callback`
+    - Choose **"Create"**
+7.  Take note of the **Client ID** and **Client Secret**
+
+It's recommended to refresh sessions on a short interval (1h) with `cookie-refresh` setting which validates that the account is still authorized.
+
+#### Restrict auth to specific Google groups on your domain. (optional)
+
+1.  Create a service account: https://developers.google.com/identity/protocols/OAuth2ServiceAccount and make sure to download the json file.
+2.  Make note of the Client ID for a future step.
+3.  Under "APIs & Auth", choose APIs.
+4.  Click on Admin SDK and then Enable API.
+5.  Follow the steps on https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account and give the client id from step 2 the following oauth scopes:
+
+```
+https://www.googleapis.com/auth/admin.directory.group.readonly
+https://www.googleapis.com/auth/admin.directory.user.readonly
+```
+
+6.  Follow the steps on https://support.google.com/a/answer/60757 to enable Admin API access.
+7.  Create or choose an existing administrative email address on the Gmail domain to assign to the `google-admin-email` flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why.
+8.  Create or choose an existing email group and set that email to the `google-group` flag. You can pass multiple instances of this flag with different groups
+    and the user will be checked against all the provided groups.
+9.  Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the `google-service-account-json` flag.
+10. Restart oauth2-proxy.
+
+Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour ).
+
+### Azure Auth Provider
+
+1. Add an application: go to [https://portal.azure.com](https://portal.azure.com), choose **"Azure Active Directory"** in the left menu, select **"App registrations"** and then click on **"New app registration"**.
+2. Pick a name and choose **"Webapp / API"** as application type. Use `https://internal.yourcompany.com` as Sign-on URL. Click **"Create"**.
+3. On the **"Settings"** / **"Properties"** page of the app, pick a logo and select **"Multi-tenanted"** if you want to allow users from multiple organizations to access your app. Note down the application ID. Click **"Save"**.
+4. On the **"Settings"** / **"Required Permissions"** page of the app, click on **"Windows Azure Active Directory"** and then on **"Access the directory as the signed in user"**. Hit **"Save"** and then then on **"Grant permissions"** (you might need another admin to do this).
+5. On the **"Settings"** / **"Reply URLs"** page of the app, add `https://internal.yourcompanycom/oauth2/callback` for each host that you want to protect by the oauth2 proxy. Click **"Save"**.
+6. On the **"Settings"** / **"Keys"** page of the app, add a new key and note down the value after hitting **"Save"**.
+7. Configure the proxy with
+
+```
+   --provider=azure
+   --client-id=<application ID from step 3>
+   --client-secret=<value from step 6>
+```
+
+Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the [redis session storage](sessions.md#redis-storage) should resolve this.
+
+### Facebook Auth Provider
+
+1.  Create a new FB App from <https://developers.facebook.com/>
+2.  Under FB Login, set your Valid OAuth redirect URIs to `https://internal.yourcompany.com/oauth2/callback`
+
+### GitHub Auth Provider
+
+1.  Create a new project: https://github.com/settings/developers
+2.  Under `Authorization callback URL` enter the correct url ie `https://internal.yourcompany.com/oauth2/callback`
+
+The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with `--email-domain=*`
+
+NOTE: When `--github-user` is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators.
+
+To restrict by organization only, include the following flag:
+
+    -github-org="": restrict logins to members of this organisation
+
+To restrict within an organization to specific teams, include the following flag in addition to `-github-org`:
+
+    -github-team="": restrict logins to members of any of these teams (slug), separated by a comma
+
+If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:
+
+    -github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo
+
+If you'd like to allow access to users with **read only** access to a **public** repository you will need to provide a [token](https://github.com/settings/tokens) for a user that has write access to the repository. The token must be created with at least the `public_repo` scope:
+
+    -github-token="": the token to use when verifying repository collaborators
+
+To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma
+
+    -github-user="": allow logins by username, separated by a comma
+
+If you are using GitHub enterprise, make sure you set the following to the appropriate url:
+
+    -login-url="http(s)://<enterprise github host>/login/oauth/authorize"
+    -redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"
+    -validate-url="http(s)://<enterprise github host>/api/v3"
+
+### Keycloak Auth Provider
+
+1.  Create new client in your Keycloak with **Access Type** 'confidental' and **Valid Redirect URIs** 'https://internal.yourcompany.com/oauth2/callback'
+2.  Take note of the Secret in the credential tab of the client
+3.  Create a mapper with **Mapper Type** 'Group Membership' and **Token Claim Name** 'groups'.
+
+Make sure you set the following to the appropriate url:
+
+    --provider=keycloak
+    --client-id=<client you have created>
+    --client-secret=<your client's secret>
+    --login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"
+    --redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"
+    --profile-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
+    --validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
+    --keycloak-group=<first_allowed_user_group>
+    --keycloak-group=<second_allowed_user_group>
+    
+For group based authorization, the optional `--keycloak-group` (legacy) or `--allowed-group` (global standard)
+flags can be used to specify which groups to limit access to.
+
+If these are unset but a `groups` mapper is set up above in step (3), the provider will still
+populate the `X-Forwarded-Groups` header to your upstream server with the `groups` data in the
+Keycloak userinfo endpoint response.
+
+The group management in keycloak is using a tree. If you create a group named admin in keycloak
+you should define the 'keycloak-group' value to /admin.
+
+### GitLab Auth Provider
+
+This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see [994](https://github.com/oauth2-proxy/oauth2-proxy/issues/994)).
+
+Whether you are using GitLab.com or self-hosting GitLab, follow [these steps to add an application](https://docs.gitlab.com/ce/integration/oauth_provider.html). Make sure to enable at least the `openid`, `profile` and `email` scopes, and set the redirect url to your application url e.g. https://myapp.com/oauth2/callback.
+
+If you need projects filtering, add the extra `read_api` scope to your application.
+
+The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow [these steps](./overview.md#generating-a-cookie-secret)
+
+```
+    --provider="gitlab"
+    --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab
+    --client-id=GITLAB_CLIENT_ID
+    --client-secret=GITLAB_CLIENT_SECRET
+    --cookie-secret=COOKIE_SECRET
+```
+
+Restricting by group membership is possible with the following option:
+
+    --gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma
+
+If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:
+
+    --oidc-issuer-url="<your gitlab url>"
+
+### LinkedIn Auth Provider
+
+For LinkedIn, the registration steps are:
+
+1.  Create a new project: https://www.linkedin.com/secure/developer
+2.  In the OAuth User Agreement section:
+    - In default scope, select r_basicprofile and r_emailaddress.
+    - In "OAuth 2.0 Redirect URLs", enter `https://internal.yourcompany.com/oauth2/callback`
+3.  Fill in the remaining required fields and Save.
+4.  Take note of the **Consumer Key / API Key** and **Consumer Secret / Secret Key**
+
+### Microsoft Azure AD Provider
+
+For adding an application to the Microsoft Azure AD follow [these steps to add an application](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app).
+
+Take note of your `TenantId` if applicable for your situation. The `TenantId` can be used to override the default `common` authorization server with a tenant specific server.
+
+### OpenID Connect Provider
+
+OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects.
+
+This provider was originally built against CoreOS Dex and we will use it as an example.
+The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below.
+
+#### Dex
+
+To configure the OIDC provider for Dex, perform the following steps:
+
+1. Download Dex:
+
+    ```
+    go get github.com/dexidp/dex
+    ```
+
+    See the [getting started guide](https://github.com/coreos/dex/blob/master/Documentation/getting-started.md) for more details.
+
+2. Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the `staticClients` section of `examples/config-dev.yaml`:
+
+    ```
+    - id: oauth2-proxy
+    redirectURIs:
+    - 'http://127.0.0.1:4180/oauth2/callback'
+    name: 'oauth2-proxy'
+    secret: proxy
+    ```
+
+3. Launch Dex: from `$GOPATH/github.com/dexidp/dex`, run:
+
+    ```
+    bin/dex serve examples/config-dev.yaml
+    ```
+
+4. In a second terminal, run the oauth2-proxy with the following args:
+
+    ```
+    -provider oidc
+    -provider-display-name "My OIDC Provider"
+    -client-id oauth2-proxy
+    -client-secret proxy
+    -redirect-url http://127.0.0.1:4180/oauth2/callback
+    -oidc-issuer-url http://127.0.0.1:5556/dex
+    -cookie-secure=false
+    -cookie-secret=secret
+    -email-domain kilgore.trout
+    ```
+
+    To serve the current working directory as a web site under the `/static` endpoint, add:
+
+    ```
+    -upstream file://$PWD/#/static/
+    ```
+
+5. Test the setup by visiting http://127.0.0.1:4180 or http://127.0.0.1:4180/static .
+
+See also [our local testing environment](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment) for a self-contained example using Docker and etcd as storage for Dex.
+
+#### Okta
+
+To configure the OIDC provider for Okta, perform the following steps:
+
+1. Log in to Okta using an administrative account. It is suggested you try this in preview first, `example.oktapreview.com`
+2. (OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,
+you may wish to configure an authorization server for each application. Otherwise, the provided `default` will work.
+* Navigate to **Security** then select **API**
+* Click **Add Authorization Server**, if this option is not available you may require an additional license for a custom authorization server.
+* Fill out the **Name** with something to describe the application you are protecting. e.g. 'Example App'.
+* For **Audience**, pick the URL of the application you wish to protect: https://example.corp.com
+* Fill out a **Description**
+* Add any **Access Policies** you wish to configure to limit application access.
+* The default settings will work for other options.
+[See Okta documentation for more information on Authorization Servers](https://developer.okta.com/docs/guides/customize-authz-server/overview/)
+3. Navigate to **Applications** then select **Add Application**.
+* Select **Web** for the **Platform** setting.
+* Select **OpenID Connect** and click **Create**
+* Pick an **Application Name** such as `Example App`.
+* Set the **Login redirect URI** to `https://example.corp.com`.
+* Under **General** set the **Allowed grant types** to `Authorization Code` and `Refresh Token`.
+* Leave the rest as default, taking note of the `Client ID` and `Client Secret`.
+* Under **Assignments** select the users or groups you wish to access your application.
+4. Create a configuration file like the following:
+
+    ```
+    provider = "oidc"
+    redirect_url = "https://example.corp.com/oauth2/callback"
+    oidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"
+    upstreams = [
+        "https://example.corp.com"
+    ]
+    email_domains = [
+        "corp.com"
+    ]
+    client_id = "XXXXX"
+    client_secret = "YYYYY"
+    pass_access_token = true
+    cookie_secret = "ZZZZZ"
+    skip_provider_button = true
+    ```
+
+The `oidc_issuer_url` is based on URL from your **Authorization Server**'s **Issuer** field in step 2, or simply https://corp.okta.com .
+The `client_id` and `client_secret` are configured in the application settings.
+Generate a unique `client_secret` to encrypt the cookie.
+
+Then you can start the oauth2-proxy with `./oauth2-proxy --config /etc/example.cfg`
+
+#### Okta - localhost
+
+1. Signup for developer account: https://developer.okta.com/signup/
+2. Create New `Web` Application: https://${your-okta-domain}/dev/console/apps/new
+3. Example Application Settings for localhost:
+   * **Name:** My Web App
+   * **Base URIs:** http://localhost:4180/
+   * **Login redirect URIs:** http://localhost:4180/oauth2/callback
+   * **Logout redirect URIs:** http://localhost:4180/
+   * **Group assignments:** `Everyone`
+   * **Grant type allowed:** `Authorization Code` and `Refresh Token`
+4. Make note of the `Client ID` and `Client secret`, they are needed in a future step
+5. Make note of the **default** Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as
+6. Example config file `/etc/localhost.cfg`
+    ```
+    provider = "oidc"
+    redirect_url = "http://localhost:4180/oauth2/callback"
+    oidc_issuer_url = "https://${your-okta-domain}/oauth2/default"
+    upstreams = [
+        "http://0.0.0.0:8080"
+    ]
+    email_domains = [
+        "*"
+    ]
+    client_id = "XXX"
+    client_secret = "YYY"
+    pass_access_token = true
+    cookie_secret = "ZZZ"
+    cookie_secure = false
+    skip_provider_button = true
+    # Note: use the following for testing within a container
+    # http_address = "0.0.0.0:4180"
+    ```
+7. Then you can start the oauth2-proxy with `./oauth2-proxy --config /etc/localhost.cfg`
+
+### login.gov Provider
+
+login.gov is an OIDC provider for the US Government.
+If you are a US Government agency, you can contact the login.gov team through the contact information
+that you can find on https://login.gov/developers/ and work with them to understand how to get login.gov
+accounts for integration/test and production access.
+
+A developer guide is available here: https://developers.login.gov/, though this proxy handles everything
+but the data you need to create to register your application in the login.gov dashboard.
+
+As a demo, we will assume that you are running your application that you want to secure locally on
+http://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that
+you have an agency integration account for testing.
+
+First, register your application in the dashboard.  The important bits are:
+  * Identity protocol:  make this `Openid connect`
+  * Issuer:  do what they say for OpenID Connect.  We will refer to this string as `${LOGINGOV_ISSUER}`.
+  * Public key:  This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.
+    A quick way to do this is `openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'`,
+    The contents of the `key.pem` shall be referred to as `${OAUTH2_PROXY_JWT_KEY}`.
+  * Return to App URL:  Make this be `http://localhost:4180/`
+  * Redirect URIs:  Make this be `http://localhost:4180/oauth2/callback`.
+  * Attribute Bundle:  Make sure that email is selected.
+
+Now start the proxy up with the following options:
+```
+./oauth2-proxy -provider login.gov \
+  -client-id=${LOGINGOV_ISSUER} \
+  -redirect-url=http://localhost:4180/oauth2/callback \
+  -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \
+  -cookie-secure=false \
+  -email-domain=gsa.gov \
+  -upstream=http://localhost:3000/ \
+  -cookie-secret=somerandomstring12341234567890AB \
+  -cookie-domain=localhost \
+  -skip-provider-button=true \
+  -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \
+  -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \
+  -jwt-key="${OAUTH2_PROXY_JWT_KEY}"
+```
+You can also set all these options with environment variables, for use in cloud/docker environments.
+One tricky thing that you may encounter is that some cloud environments will pass in environment
+variables in a docker env-file, which does not allow multiline variables like a PEM file.
+If you encounter this, then you can create a `jwt_signing_key.pem` file in the top level
+directory of the repo which contains the key in PEM format and then do your docker build.
+The docker build process will copy that file into your image which you can then access by
+setting the `OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem`
+environment variable, or by setting `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem` on the commandline.
+
+Once it is running, you should be able to go to `http://localhost:4180/` in your browser,
+get authenticated by the login.gov integration server, and then get proxied on to your
+application running on `http://localhost:3000/`.  In a real deployment, you would secure
+your application with a firewall or something so that it was only accessible from the
+proxy, and you would use real hostnames everywhere.
+
+#### Skip OIDC discovery
+
+Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata.
+
+In this case, you can set the `--skip-oidc-discovery` option, and supply those required endpoints manually:
+
+```
+    -provider oidc
+    -client-id oauth2-proxy
+    -client-secret proxy
+    -redirect-url http://127.0.0.1:4180/oauth2/callback
+    -oidc-issuer-url http://127.0.0.1:5556
+    -skip-oidc-discovery
+    -login-url http://127.0.0.1:5556/authorize
+    -redeem-url http://127.0.0.1:5556/token
+    -oidc-jwks-url http://127.0.0.1:5556/keys
+    -cookie-secure=false
+    -email-domain example.com
+```
+
+### Nextcloud Provider
+
+The Nextcloud provider allows you to authenticate against users in your
+Nextcloud instance.
+
+When you are using the Nextcloud provider, you must specify the urls via
+configuration, environment variable, or command line argument. Depending
+on whether your Nextcloud instance is using pretty urls your urls may be of the
+form `/index.php/apps/oauth2/*` or `/apps/oauth2/*`.
+
+Refer to the [OAuth2
+documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html)
+to setup the client id and client secret. Your "Redirection URI" will be
+`https://internalapp.yourcompany.com/oauth2/callback`.
+
+```
+    -provider nextcloud
+    -client-id <from nextcloud admin>
+    -client-secret <from nextcloud admin>
+    -login-url="<your nextcloud url>/index.php/apps/oauth2/authorize"
+    -redeem-url="<your nextcloud url>/index.php/apps/oauth2/api/v1/token"
+    -validate-url="<your nextcloud url>/ocs/v2.php/cloud/user?format=json"
+```
+
+Note: in *all* cases the validate-url will *not* have the `index.php`.
+
+### DigitalOcean Auth Provider
+
+1. [Create a new OAuth application](https://cloud.digitalocean.com/account/api/applications)
+    * You can fill in the name, homepage, and description however you wish.
+    * In the "Application callback URL" field, enter: `https://oauth-proxy/oauth2/callback`, substituting `oauth2-proxy` with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL.
+2. Note the Client ID and Client Secret.
+
+To use the provider, pass the following options:
+
+```
+   --provider=digitalocean
+   --client-id=<Client ID>
+   --client-secret=<Client Secret>
+```
+
+ Alternatively, set the equivalent options in the config file. The redirect URL defaults to `https://<requested host header>/oauth2/callback`. If you need to change it, you can use the `--redirect-url` command-line option.
+
+### Bitbucket Auth Provider
+
+1. [Add a new OAuth consumer](https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html)
+    * In "Callback URL" use `https://<oauth2-proxy>/oauth2/callback`, substituting `<oauth2-proxy>` with the actual hostname that oauth2-proxy is running on.
+    * In Permissions section select:
+        * Account -> Email
+        * Team membership -> Read
+        * Repositories -> Read
+2. Note the Client ID and Client Secret.
+
+To use the provider, pass the following options:
+
+```
+   --provider=bitbucket
+   --client-id=<Client ID>
+   --client-secret=<Client Secret>
+```
+
+The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: `--bitbucket-team=<Team name>`. To restrict the access to only these users who has access to one selected repository use `--bitbucket-repository=<Repository name>`.
+
+
+### Gitea Auth Provider
+
+1. Create a new application: `https://< your gitea host >/user/settings/applications`
+2. Under `Redirect URI` enter the correct URL i.e. `https://<proxied host>/oauth2/callback`
+3. Note the Client ID and Client Secret.
+4. Pass the following options to the proxy:
+
+```
+    --provider="github"
+    --redirect-url="https://<proxied host>/oauth2/callback"
+    --provider-display-name="Gitea"
+    --client-id="< client_id as generated by Gitea >"
+    --client-secret="< client_secret as generated by Gitea >"
+    --login-url="https://< your gitea host >/login/oauth/authorize"
+    --redeem-url="https://< your gitea host >/login/oauth/access_token"
+    --validate-url="https://< your gitea host >/api/v1"
+```
+
+
+## Email Authentication
+
+To authorize by email domain use `--email-domain=yourcompany.com`. To authorize individual email addresses use `--authenticated-emails-file=/path/to/file` with one email per line. To authorize all email addresses use `--email-domain=*`.
+
+## Adding a new Provider
+
+Follow the examples in the [`providers` package](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/) to define a new
+`Provider` instance. Add a new `case` to
+[`providers.New()`](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go) to allow `oauth2-proxy` to use the
+new `Provider`.

docs/docs/configuration/overview.md

@@ -0,0 +1,534 @@
+---
+id: overview
+title: Overview
+---
+
+`oauth2-proxy` can be configured via [config file](#config-file), [command line options](#command-line-options) or [environment variables](#environment-variables).
+
+### Generating a Cookie Secret
+
+To generate a strong cookie secret use `python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(16)).decode())'`
+
+### Config File
+
+Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (\_). If the argument can be specified multiple times, the config option should be plural (trailing s).
+
+An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example) config file is in the contrib directory. It can be used by specifying `--config=/etc/oauth2-proxy.cfg`
+
+### Command Line Options
+
+| Option | Type | Description | Default |
+| ------ | ---- | ----------- | ------- |
+| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
+| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
+| `--auth-logging` | bool | Log authentication attempts | true |
+| `--auth-logging-format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
+| `--authenticated-emails-file` | string | authenticate against emails via file (one per line) | |
+| `--azure-tenant` | string | go to a tenant-specific or common (tenant-independent) endpoint. | `"common"` |
+| `--basic-auth-password` | string | the password to set when passing the HTTP Basic Auth header | |
+| `--client-id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
+| `--client-secret` | string | the OAuth Client Secret | |
+| `--client-secret-file` | string | the file with OAuth Client Secret | |
+| `--config` | string | path to config file | |
+| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
+| `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s |
+| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
+| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates | `"_oauth2_proxy"` |
+| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
+| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers \[[1](#footnote1)\] | |
+| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
+| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
+| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
+| `--custom-templates-dir` | string | path to custom html templates | |
+| `--custom-sign-in-logo` | string | path to an custom image for the sign_in page logo. Use \"-\" to disable default logo. |
+| `--display-htpasswd-form` | bool | display username / password login form if an htpasswd file is provided | true |
+| `--email-domain` | string \| list  | authenticate emails with the specified domain (may be given multiple times). Use `*` to authenticate any email | |
+| `--errors-to-info-log` | bool | redirects error-level logging to default log channel instead of stderr | |
+| `--extra-jwt-issuers` | string | if `--skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` (see a token's `iss`, `aud` fields) pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
+| `--exclude-logging-paths` | string | comma separated list of paths to exclude from logging, e.g. `"/ping,/path2"` |`""` (no paths excluded) |
+| `--flush-interval` | duration | period between flushing response buffers when streaming responses | `"1s"` |
+| `--force-https` | bool | enforce https redirect | `false` |
+| `--banner` | string | custom (html) banner string. Use `"-"` to disable default banner. | |
+| `--footer` | string | custom (html) footer string. Use `"-"` to disable default footer. | |
+| `--github-org` | string | restrict logins to members of this organisation | |
+| `--github-team` | string | restrict logins to members of any of these teams (slug), separated by a comma | |
+| `--github-repo` | string | restrict logins to collaborators of this repository formatted as `orgname/repo` | |
+| `--github-token` | string | the token to use when verifying repository collaborators (must have push access to the repository) | |
+| `--github-user` | string \| list | To allow users to login by username even if they do not belong to the specified org and team or collaborators | |
+| `--gitlab-group` | string \| list | restrict logins to members of any of these groups (slug), separated by a comma | |
+| `--gitlab-projects` | string \| list | restrict logins to members of any of these projects (may be given multiple times) formatted as `orgname/repo=accesslevel`. Access level should be a value matching [Gitlab access levels](https://docs.gitlab.com/ee/api/members.html#valid-access-levels), defaulted to 20 if absent | |
+| `--google-admin-email` | string | the google admin to impersonate for api calls | |
+| `--google-group` | string | restrict logins to members of this google group (may be given multiple times). | |
+| `--google-service-account-json` | string | the path to the service account json credentials | |
+| `--htpasswd-file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
+| `--htpasswd-user-group` | string \| list | the groups to be set on sessions for htpasswd users | |
+| `--http-address` | string | `[http://]<addr>:<port>` or `unix://<path>` to listen on for HTTP clients | `"127.0.0.1:4180"` |
+| `--https-address` | string | `<addr>:<port>` to listen on for HTTPS clients | `":443"` |
+| `--logging-compress` | bool | Should rotated log files be compressed using gzip | false |
+| `--logging-filename` | string | File to log requests to, empty for `stdout` | `""` (stdout) |
+| `--logging-local-time` | bool | Use local time in log files and backup filenames instead of UTC | true (local time) |
+| `--logging-max-age` | int | Maximum number of days to retain old log files | 7 |
+| `--logging-max-backups` | int | Maximum number of old log files to retain; 0 to disable | 0  |
+| `--logging-max-size` | int | Maximum size in megabytes of the log file before rotation | 100 |
+| `--jwt-key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |
+| `--jwt-key-file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |
+| `--login-url` | string | Authentication endpoint | |
+| `--insecure-oidc-allow-unverified-email` | bool | don't fail if an email address in an id_token is not verified | false |
+| `--insecure-oidc-skip-issuer-verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
+| `--oidc-issuer-url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
+| `--oidc-jwks-url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled | |
+| `--oidc-email-claim` | string | which OIDC claim contains the user's email | `"email"` |
+| `--oidc-groups-claim` | string | which OIDC claim contains the user groups | `"groups"` |
+| `--pass-access-token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
+| `--pass-authorization-header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
+| `--pass-basic-auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
+| `--prefer-email-to-user` | bool | Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with `--pass-basic-auth` and `--pass-user-headers` | false |
+| `--pass-host-header` | bool | pass the request Host Header to upstream | true |
+| `--pass-user-headers` | bool | pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
+| `--profile-url` | string | Profile access endpoint | |
+| `--prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
+| `--provider` | string | OAuth provider | google |
+| `--provider-ca-file` |  string \| list |  Paths to CA certificates that should be used when connecting to the provider.  If not specified, the default Go trust sources are used instead. |
+| `--provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
+| `--ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
+| `--ping-user-agent` | string | a User-Agent that can be used for basic health checks | `""` (don't check user agent) |
+| `--metrics-address` | string | the address prometheus metrics will be scraped from | `""` |
+| `--proxy-prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
+| `--proxy-websockets` | bool | enables WebSocket proxying | true |
+| `--pubjwk-url` | string | JWK pubkey access endpoint: required by login.gov | |
+| `--real-client-ip-header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
+| `--redeem-url` | string | Token redemption endpoint | |
+| `--redirect-url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
+| `--redis-cluster-connection-urls` | string \| list | List of Redis cluster connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-cluster` | |
+| `--redis-connection-url` | string | URL of redis server for redis session storage (e.g. `redis://HOST[:PORT]`) | |
+| `--redis-password` | string | Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url` | |
+| `--redis-sentinel-password` | string | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password` | |
+| `--redis-sentinel-master-name` | string | Redis sentinel master name. Used in conjunction with `--redis-use-sentinel` | |
+| `--redis-sentinel-connection-urls` | string \| list | List of Redis sentinel connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-sentinel` | |
+| `--redis-use-cluster` | bool | Connect to redis cluster. Must set `--redis-cluster-connection-urls` to use this feature | false |
+| `--redis-use-sentinel` | bool | Connect to redis via sentinels. Must set `--redis-sentinel-master-name` and `--redis-sentinel-connection-urls` to use this feature | false |
+| `--request-id-header` | string | Request header to use as the request ID in logging | X-Request-Id |
+| `--request-logging` | bool | Log requests | true |
+| `--request-logging-format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
+| `--resource` | string | The resource that is protected (Azure AD only) | |
+| `--reverse-proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection | false |
+| `--scope` | string | OAuth scope specification | |
+| `--session-cookie-minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
+| `--session-store-type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
+| `--set-xauthrequest` | bool | set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with `--pass-access-token`, X-Auth-Request-Access-Token is added to response headers.  | false |
+| `--set-authorization-header` | bool | set Authorization Bearer response header (useful in Nginx auth_request mode) | false |
+| `--set-basic-auth` | bool | set HTTP Basic Auth information in response (useful in Nginx auth_request mode) | false |
+| `--show-debug-on-error` | bool | show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production) | false |
+| `--signature-key` | string | GAP-Signature request signature key (algorithm:secretkey) | |
+| `--silence-ping-logging` | bool | disable logging of requests to ping endpoint | false |
+| `--skip-auth-preflight` | bool | will skip authentication for OPTIONS requests | false |
+| `--skip-auth-regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times) | |
+| `--skip-auth-route` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods | |
+| `--skip-auth-strip-headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy | true |
+| `--skip-jwt-bearer-tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
+| `--skip-oidc-discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
+| `--skip-provider-button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
+| `--ssl-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS providers | false |
+| `--ssl-upstream-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS upstreams | false |
+| `--standard-logging` | bool | Log standard runtime information | true |
+| `--standard-logging-format` | string | Template for standard log lines | see [Logging Configuration](#logging-configuration) |
+| `--tls-cert-file` | string | path to certificate file | |
+| `--tls-key-file` | string | path to private key file | |
+| `--upstream` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
+| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
+| `--validate-url` | string | Access token validation endpoint | |
+| `--version` | n/a | print version string | |
+| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` to allow subdomains (e.g. `.example.com`)&nbsp;\[[2](#footnote2)\] | |
+| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
+
+\[<a name="footnote1">1</a>\]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
+
+\[<a name="footnote2">2</a>\]: When using the `whitelist-domain` option, any domain prefixed with a `.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
+
+See below for provider specific options
+
+### Upstreams Configuration
+
+`oauth2-proxy` supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as `http://127.0.0.1:8080/` for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide `http://127.0.0.1:8080/some/path/` then it will only be requests that start with `/some/path/` which are forwarded to the upstream.
+
+Static file paths are configured as a file:// URL. `file:///var/www/static/` will serve the files from that directory at `http://[oauth2-proxy url]/var/www/static/`, which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. `file:///var/www/static/#/static/` will make `/var/www/static/` available at `http://[oauth2-proxy url]/static/`.
+
+Multiple upstreams can either be configured by supplying a comma separated list to the `--upstream` parameter, supplying the parameter multiple times or providing a list in the [config file](#config-file). When multiple upstreams are used routing to them will be based on the path they are set up with.
+
+### Environment variables
+
+Every command line argument can be specified as an environment variable by
+prefixing it with `OAUTH2_PROXY_`, capitalising it, and replacing hyphens (`-`)
+with underscores (`_`). If the argument can be specified multiple times, the
+environment variable should be plural (trailing `S`).
+
+This is particularly useful for storing secrets outside of a configuration file
+or the command line.
+
+For example, the `--cookie-secret` flag becomes `OAUTH2_PROXY_COOKIE_SECRET`,
+and the `--email-domain` flag becomes `OAUTH2_PROXY_EMAIL_DOMAINS`.
+
+## Logging Configuration
+
+By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the `--logging-filename` command.
+
+If logging to a file you can also configure the maximum file size (`--logging-max-size`), age (`--logging-max-age`), max backup logs (`--logging-max-backups`), and if backup logs should be compressed (`--logging-compress`).
+
+There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with `--standard-logging`, `--auth-logging`, and `--request-logging`.
+
+Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log.
+
+Logging of requests to the `/ping` endpoint (or using `--ping-user-agent`) can be disabled with `--silence-ping-logging` reducing log volume. This flag appends the `--ping-path` to `--exclude-logging-paths`.
+
+### Auth Log Format
+Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:
+
+```
+<REMOTE_ADDRESS> - <REQUEST ID> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] [<STATUS>] <MESSAGE>
+```
+
+The status block will contain one of the below strings:
+
+- `AuthSuccess` If a user has authenticated successfully by any method
+- `AuthFailure` If the user failed to authenticate explicitly
+- `AuthError` If there was an unexpected error during authentication
+
+If you require a different format than that, you can configure it with the `--auth-logging-format` flag.
+The default format is configured as follows:
+
+```
+{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}
+```
+
+Available variables for auth logging:
+
+| Variable | Example | Description |
+| --- | --- | --- |
+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
+| Host  | domain.com | The value of the Host header. |
+| Message | Authenticated via OAuth2 | The details of the auth attempt. |
+| Protocol | HTTP/1.0 | The request protocol. |
+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
+| RequestMethod | GET | The request method. |
+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
+| UserAgent | - | The full user agent as reported by the requesting client. |
+| Username | username@email.com | The email or username of the auth request. |
+| Status | AuthSuccess | The status of the auth request. See above for details. |
+
+### Request Log Format
+HTTP request logs will output by default in the below format:
+
+```
+<REMOTE_ADDRESS> - <REQUEST ID> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] <HOST_HEADER> GET <UPSTREAM_HOST> "/path/" HTTP/1.1 "<USER_AGENT>" <RESPONSE_CODE> <RESPONSE_BYTES> <REQUEST_DURATION>
+```
+
+If you require a different format than that, you can configure it with the `--request-logging-format` flag.
+The default format is configured as follows:
+
+```
+{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}
+```
+
+Available variables for request logging:
+
+| Variable | Example | Description |
+| --- | --- | --- |
+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
+| Host  | domain.com | The value of the Host header. |
+| Protocol | HTTP/1.0 | The request protocol. |
+| RequestDuration | 0.001 | The time in seconds that a request took to process. |
+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
+| RequestMethod | GET | The request method. |
+| RequestURI | "/oauth2/auth" | The URI path of the request. |
+| ResponseSize | 12 | The size in bytes of the response. |
+| StatusCode | 200 | The HTTP status code of the response. |
+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
+| Upstream | - | The upstream data of the HTTP request. |
+| UserAgent | - | The full user agent as reported by the requesting client. |
+| Username | username@email.com | The email or username of the auth request. |
+
+### Standard Log Format
+All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:
+
+```
+[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE>
+```
+
+If you require a different format than that, you can configure it with the `--standard-logging-format` flag. The default format is configured as follows:
+
+```
+[{{.Timestamp}}] [{{.File}}] {{.Message}}
+```
+
+Available variables for standard logging:
+
+| Variable | Example | Description |
+| --- | --- | --- |
+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
+| File | main.go:40 | The file and line number of the logging statement. |
+| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
+
+## Configuring for use with the Nginx `auth_request` directive
+
+The [Nginx `auth_request` directive](http://nginx.org/en/docs/http/ngx_http_auth_request_module.html) allows Nginx to authenticate requests via the oauth2-proxy's `/auth` endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:
+
+```nginx
+server {
+  listen 443 ssl;
+  server_name ...;
+  include ssl/ssl.conf;
+
+  location /oauth2/ {
+    proxy_pass       http://127.0.0.1:4180;
+    proxy_set_header Host                    $host;
+    proxy_set_header X-Real-IP               $remote_addr;
+    proxy_set_header X-Scheme                $scheme;
+    proxy_set_header X-Auth-Request-Redirect $request_uri;
+    # or, if you are handling multiple domains:
+    # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
+  }
+  location = /oauth2/auth {
+    proxy_pass       http://127.0.0.1:4180;
+    proxy_set_header Host             $host;
+    proxy_set_header X-Real-IP        $remote_addr;
+    proxy_set_header X-Scheme         $scheme;
+    # nginx auth_request includes headers but not body
+    proxy_set_header Content-Length   "";
+    proxy_pass_request_body           off;
+  }
+
+  location / {
+    auth_request /oauth2/auth;
+    error_page 401 = /oauth2/sign_in;
+
+    # pass information via X-User and X-Email headers to backend,
+    # requires running with --set-xauthrequest flag
+    auth_request_set $user   $upstream_http_x_auth_request_user;
+    auth_request_set $email  $upstream_http_x_auth_request_email;
+    proxy_set_header X-User  $user;
+    proxy_set_header X-Email $email;
+
+    # if you enabled --pass-access-token, this will pass the token to the backend
+    auth_request_set $token  $upstream_http_x_auth_request_access_token;
+    proxy_set_header X-Access-Token $token;
+
+    # if you enabled --cookie-refresh, this is needed for it to work with auth_request
+    auth_request_set $auth_cookie $upstream_http_set_cookie;
+    add_header Set-Cookie $auth_cookie;
+
+    # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
+    # limit and so the OAuth2 Proxy splits these into multiple parts.
+    # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
+    # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
+    auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;
+
+    # Extract the Cookie attributes from the first Set-Cookie header and append them
+    # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
+    if ($auth_cookie ~* "(; .*)") {
+        set $auth_cookie_name_0 $auth_cookie;
+        set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
+    }
+
+    # Send both Set-Cookie headers now if there was a second part
+    if ($auth_cookie_name_upstream_1) {
+        add_header Set-Cookie $auth_cookie_name_0;
+        add_header Set-Cookie $auth_cookie_name_1;
+    }
+
+    proxy_pass http://backend/;
+    # or "root /path/to/site;" or "fastcgi_pass ..." etc
+  }
+}
+```
+
+When you use ingress-nginx in Kubernetes, you MUST use `kubernetes/ingress-nginx` (which includes the Lua module) and the following configuration snippet for your `Ingress`.
+Variables set with `auth_request_set` are not `set`-able in plain nginx config when the location is processed via `proxy_pass` and then may only be processed by Lua.
+Note that `nginxinc/kubernetes-ingress` does not include the Lua module.
+
+```yaml
+nginx.ingress.kubernetes.io/auth-response-headers: Authorization
+nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
+nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
+nginx.ingress.kubernetes.io/configuration-snippet: |
+  auth_request_set $name_upstream_1 $upstream_cookie_name_1;
+
+  access_by_lua_block {
+    if ngx.var.name_upstream_1 ~= "" then
+      ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")
+    end
+  }
+```
+It is recommended to use `--session-store-type=redis` when expecting large sessions/OIDC tokens (_e.g._ with MS Azure).
+
+You have to substitute *name* with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable  should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".
+
+## Configuring for use with the Traefik (v2) `ForwardAuth` middleware
+
+**This option requires `--reverse-proxy` option to be set.**
+
+### ForwardAuth with 401 errors middleware
+
+The [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/forwardauth/) allows Traefik to authenticate requests via the oauth2-proxy's `/oauth2/auth` endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:
+
+```yaml
+http:
+  routers:
+    a-service:
+      rule: "Host(`a-service.example.com`)"
+      service: a-service-backend
+      middlewares:
+        - oauth-errors
+        - oauth-auth
+      tls:
+        certResolver: default
+        domains:
+          - main: "example.com"
+            sans:
+              - "*.example.com"
+    oauth:
+      rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"
+      middlewares:
+        - auth-headers
+      service: oauth-backend
+      tls:
+        certResolver: default
+        domains:
+          - main: "example.com"
+            sans:
+              - "*.example.com"
+
+  services:
+    a-service-backend:
+      loadBalancer:
+        servers:
+          - url: http://172.16.0.2:7555
+    oauth-backend:
+      loadBalancer:
+        servers:
+          - url: http://172.16.0.1:4180
+
+  middlewares:
+    auth-headers:
+      headers:
+        sslRedirect: true
+        stsSeconds: 315360000
+        browserXssFilter: true
+        contentTypeNosniff: true
+        forceSTSHeader: true
+        sslHost: example.com
+        stsIncludeSubdomains: true
+        stsPreload: true
+        frameDeny: true
+    oauth-auth:
+      forwardAuth:
+        address: https://oauth.example.com/oauth2/auth
+        trustForwardHeader: true
+    oauth-errors:
+      errors:
+        status:
+          - "401-403"
+        service: oauth-backend
+        query: "/oauth2/sign_in"
+```
+
+### ForwardAuth with static upstreams configuration
+
+Redirect to sign_in functionality provided without the use of `errors` middleware with [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/forwardauth/) pointing to oauth2-proxy service's `/` endpoint
+
+**Following options need to be set on `oauth2-proxy`:**
+- `--upstream=static://202`: Configures a static response for authenticated sessions
+- `--reverseproxy=true`: Enables the use of `X-Forwarded-*` headers to determine redirects correctly
+
+```yaml
+http:
+  routers:
+    a-service-route-1:
+      rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"
+      service: a-service-backend
+      middlewares:
+        - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin
+      tls:
+        certResolver: default
+        domains:
+          - main: "example.com"
+            sans:
+              - "*.example.com"
+    a-service-route-2:
+      rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"
+      service: a-service-backend
+      middlewares:
+        - oauth-auth-wo-redirect # unauthenticated session will return a 401
+      tls:
+        certResolver: default
+        domains:
+          - main: "example.com"
+            sans:
+              - "*.example.com"
+    services-oauth2-route:
+      rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"
+      middlewares:
+        - auth-headers
+      service: oauth-backend
+      tls:
+        certResolver: default
+        domains:
+          - main: "example.com"
+            sans:
+              - "*.example.com"
+    oauth2-proxy-route:
+      rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"
+      middlewares:
+        - auth-headers
+      service: oauth-backend
+      tls:
+        certResolver: default
+        domains:
+          - main: "example.com"
+            sans:
+              - "*.example.com"
+
+  services:
+    a-service-backend:
+      loadBalancer:
+        servers:
+          - url: http://172.16.0.2:7555
+    b-service-backend:
+      loadBalancer:
+        servers:
+          - url: http://172.16.0.3:7555
+    oauth-backend:
+      loadBalancer:
+        servers:
+          - url: http://172.16.0.1:4180
+
+  middlewares:
+    auth-headers:
+      headers:
+        sslRedirect: true
+        stsSeconds: 315360000
+        browserXssFilter: true
+        contentTypeNosniff: true
+        forceSTSHeader: true
+        sslHost: example.com
+        stsIncludeSubdomains: true
+        stsPreload: true
+        frameDeny: true
+    oauth-auth-redirect:
+      forwardAuth:
+        address: https://oauth.example.com/
+        trustForwardHeader: true
+        authResponseHeaders:
+          - X-Auth-Request-Access-Token
+          - Authorization
+    oauth-auth-wo-redirect:
+      forwardAuth:
+        address: https://oauth.example.com/oauth2/auth
+        trustForwardHeader: true
+        authResponseHeaders:
+          - X-Auth-Request-Access-Token
+          - Authorization
+```
+
+:::note
+If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.
+:::

docs/docs/configuration/sessions.md

@@ -0,0 +1,67 @@
+---
+id: session_storage
+title: Session Storage
+---
+
+Sessions allow a user's authentication to be tracked between multiple HTTP
+requests to a service.
+
+The OAuth2 Proxy uses a Cookie to track user sessions and will store the session
+data in one of the available session storage backends.
+
+At present the available backends are (as passed to `--session-store-type`):
+- [cookie](#cookie-storage) (default)
+- [redis](#redis-storage)
+
+### Cookie Storage
+
+The Cookie storage backend is the default backend implementation and has
+been used in the OAuth2 Proxy historically.
+
+With the Cookie storage backend, all session information is stored in client
+side cookies and transferred with each and every request.
+
+The following should be known when using this implementation:
+- Since all state is stored client side, this storage backend means that the OAuth2 Proxy is completely stateless
+- Cookies are signed server side to prevent modification client-side
+- It is mandatory to set a `cookie-secret` which will ensure data is encrypted within the cookie data.
+- Since multiple requests can be made concurrently to the OAuth2 Proxy, this session implementation
+cannot lock sessions and while updating and refreshing sessions, there can be conflicts which force
+users to re-authenticate
+
+
+### Redis Storage
+
+The Redis Storage backend stores sessions, encrypted, in redis. Instead sending all the information
+back the the client for storage, as in the [Cookie storage](#cookie-storage), a ticket is sent back
+to the user as the cookie value instead.
+
+A ticket is composed as the following:
+
+`{CookieName}-{ticketID}.{secret}`
+
+Where:
+
+- The `CookieName` is the OAuth2 cookie name (_oauth2_proxy by default)
+- The `ticketID` is a 128 bit random number, hex-encoded
+- The `secret` is a 128 bit random number, base64url encoded (no padding). The secret is unique for every session.
+- The pair of `{CookieName}-{ticketID}` comprises a ticket handle, and thus, the redis key
+to which the session is stored. The encoded session is encrypted with the secret and stored
+in redis via the `SETEX` command.
+
+Encrypting every session uniquely protects the refresh/access/id tokens stored in the session from
+disclosure.
+
+#### Usage
+
+When using the redis store, specify `--session-store-type=redis` as well as the Redis connection URL, via
+`--redis-connection-url=redis://host[:port][/db-number]`.
+
+You may also configure the store for Redis Sentinel. In this case, you will want to use the
+`--redis-use-sentinel=true` flag, as well as configure the flags `--redis-sentinel-master-name`
+and `--redis-sentinel-connection-urls` appropriately.
+
+Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the
+`--redis-use-cluster=true` flag, and configure the flags `--redis-cluster-connection-urls` appropriately.
+
+Note that flags `--redis-use-sentinel=true` and `--redis-use-cluster=true` are mutually exclusive.

docs/docs/configuration/tls.md

@@ -0,0 +1,70 @@
+---
+id: tls
+title: TLS Configuration
+---
+
+There are two recommended configurations.
+
+1.  Configure SSL Termination with OAuth2 Proxy by providing a `--tls-cert-file=/path/to/cert.pem` and `--tls-key-file=/path/to/cert.key`.
+
+    The command line to run `oauth2-proxy` in this configuration would look like this:
+
+    ```bash
+    ./oauth2-proxy \
+        --email-domain="yourcompany.com"  \
+        --upstream=http://127.0.0.1:8080/ \
+        --tls-cert-file=/path/to/cert.pem \
+        --tls-key-file=/path/to/cert.key \
+        --cookie-secret=... \
+        --cookie-secure=true \
+        --provider=... \
+        --client-id=... \
+        --client-secret=...
+    ```
+
+2.  Configure SSL Termination with [Nginx](http://nginx.org/) (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ....
+
+    Because `oauth2-proxy` listens on `127.0.0.1:4180` by default, to listen on all interfaces (needed when using an
+    external load balancer like Amazon ELB or Google Platform Load Balancing) use `--http-address="0.0.0.0:4180"` or
+    `--http-address="http://:4180"`.
+
+    Nginx will listen on port `443` and handle SSL connections while proxying to `oauth2-proxy` on port `4180`.
+    `oauth2-proxy` will then authenticate requests for an upstream application. The external endpoint for this example
+    would be `https://internal.yourcompany.com/`.
+
+    An example Nginx config follows. Note the use of `Strict-Transport-Security` header to pin requests to SSL
+    via [HSTS](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security):
+
+    ```
+    server {
+        listen 443 default ssl;
+        server_name internal.yourcompany.com;
+        ssl_certificate /path/to/cert.pem;
+        ssl_certificate_key /path/to/cert.key;
+        add_header Strict-Transport-Security max-age=2592000;
+
+        location / {
+            proxy_pass http://127.0.0.1:4180;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Scheme $scheme;
+            proxy_connect_timeout 1;
+            proxy_send_timeout 30;
+            proxy_read_timeout 30;
+        }
+    }
+    ```
+
+    The command line to run `oauth2-proxy` in this configuration would look like this:
+
+    ```bash
+    ./oauth2-proxy \
+       --email-domain="yourcompany.com"  \
+       --upstream=http://127.0.0.1:8080/ \
+       --cookie-secret=... \
+       --cookie-secure=true \
+       --provider=... \
+       --reverse-proxy=true \
+       --client-id=... \
+       --client-secret=...
+    ```

docs/docs/features/endpoints.md

@@ -0,0 +1,36 @@
+---
+id: endpoints
+title: Endpoints
+---
+
+OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The `/oauth2` prefix can be changed with the `--proxy-prefix` config variable.
+
+- /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see [robotstxt.org](http://www.robotstxt.org/) for more info
+- /ping - returns a 200 OK response, which is intended for use with health checks
+- /metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by `--metrics-address`, disabled by default
+- /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
+- /oauth2/sign_out - this URL is used to clear the session cookie
+- /oauth2/start - a URL that will redirect to start the OAuth cycle
+- /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
+- /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
+- /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the [Nginx `auth_request` directive](../configuration/overview.md#configuring-for-use-with-the-nginx-auth_request-directive)
+
+### Sign out
+
+To sign the user out, redirect them to `/oauth2/sign_out`. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the `rd` query parameter, i.e. redirect the user to something like (notice the url-encoding!):
+
+```
+/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page
+```
+
+Alternatively, include the redirect URL in the `X-Auth-Request-Redirect` header:
+
+```
+GET /oauth2/sign_out HTTP/1.1
+X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
+...
+```
+
+(The "sign_out_page" should be the [`end_session_endpoint`](https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1) from [the metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig) if your OIDC provider supports Session Management and Discovery.)
+
+BEWARE that the domain you want to redirect to (`my-oidc-provider.example.com` in the example) must be added to the [`--whitelist-domain`](../configuration/overview) configuration option otherwise the redirect will be ignored.

docs/docs/installation.md

@@ -0,0 +1,24 @@
+---
+id: installation
+title: Installation
+slug: /
+---
+
+1.  Choose how to deploy:
+
+    a. Download [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.1.2`)
+
+    b. Build with `$ go get github.com/oauth2-proxy/oauth2-proxy/v7` which will put the binary in `$GOPATH/bin`
+
+    c. Using the prebuilt docker image [quay.io/oauth2-proxy/oauth2-proxy](https://quay.io/oauth2-proxy/oauth2-proxy) (AMD64, ARMv6 and ARM64 tags available)
+
+Prebuilt binaries can be validated by extracting the file and verifying it against the `sha256sum.txt` checksum file provided for each release starting with version `v3.0.0`.
+
+```
+$ sha256sum -c sha256sum.txt 2>&1 | grep OK
+oauth2-proxy-x.y.z.linux-amd64: OK
+```
+
+2.  [Select a Provider and Register an OAuth Application with a Provider](configuration/auth.md)
+3.  [Configure OAuth2 Proxy using config file, command line options, or environment variables](configuration/overview.md)
+4.  [Configure SSL or Deploy behind a SSL endpoint](configuration/tls.md) (example provided for Nginx)

docs/docusaurus.config.js

@@ -0,0 +1,57 @@
+module.exports = {
+  title: 'OAuth2 Proxy',
+  tagline: 'A lightweight authentication proxy written in Go',
+  url: 'https://oauth2-proxy.github.io',
+  baseUrl: '/oauth2-proxy/',
+  onBrokenLinks: 'throw',
+  favicon: 'img/logos/OAuth2_Proxy_icon.svg',
+  organizationName: 'oauth2-proxy', // Usually your GitHub org/user name.
+  projectName: 'oauth2-proxy', // Usually your repo name.
+  themeConfig: {
+    navbar: {
+      title: 'OAuth2 Proxy',
+      logo: {
+        alt: 'OAuth2 Proxy',
+        src: 'img/logos/OAuth2_Proxy_icon.svg',
+      },
+      items: [
+        {
+          to: 'docs/',
+          activeBasePath: 'docs',
+          label: 'Docs',
+          position: 'left',
+        },
+        {
+          type: 'docsVersionDropdown',
+          position: 'right',
+          dropdownActiveClassDisabled: true,
+        },
+        {
+          href: 'https://github.com/oauth2-proxy/oauth2-proxy',
+          label: 'GitHub',
+          position: 'right',
+        },
+      ],
+    },
+    footer: {
+      style: 'dark',
+      copyright: `Copyright © ${new Date().getFullYear()} OAuth2 Proxy.`,
+    },
+  },
+  presets: [
+    [
+      '@docusaurus/preset-classic',
+      {
+        docs: {
+          sidebarPath: require.resolve('./sidebars.js'),
+          // Please change this to your repo.
+          editUrl:
+            'https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/',
+        },
+        theme: {
+          customCss: require.resolve('./src/css/custom.css'),
+        },
+      },
+    ],
+  ],
+};

docs/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "docusaurus",
+  "version": "0.0.0",
+  "private": true,
+  "scripts": {
+    "docusaurus": "docusaurus",
+    "start": "docusaurus start",
+    "build": "docusaurus build",
+    "swizzle": "docusaurus swizzle",
+    "deploy": "docusaurus deploy",
+    "serve": "docusaurus serve"
+  },
+  "dependencies": {
+    "@docusaurus/core": "2.0.0-alpha.66",
+    "@docusaurus/preset-classic": "2.0.0-alpha.66",
+    "@mdx-js/react": "^1.5.8",
+    "clsx": "^1.1.1",
+    "react": "^16.8.4",
+    "react-dom": "^16.8.4"
+  },
+  "browserslist": {
+    "production": [
+      ">0.2%",
+      "not dead",
+      "not op_mini all"
+    ],
+    "development": [
+      "last 1 chrome version",
+      "last 1 firefox version",
+      "last 1 safari version"
+    ]
+  }
+}

docs/sidebars.js

@@ -0,0 +1,30 @@
+module.exports = {
+  docs: [
+    {
+      type: 'doc',
+      id: 'installation',
+    },
+    {
+      type: 'doc',
+      id: 'behaviour',
+    },
+    {
+      type: 'category',
+      label: 'Configuration',
+      collapsed: false,
+      items: ['configuration/overview', 'configuration/oauth_provider', 'configuration/session_storage', 'configuration/tls', 'configuration/alpha-config'],
+    },
+    {
+      type: 'category',
+      label: 'Features',
+      collapsed: false,
+      items: ['features/endpoints'],
+    },
+    {
+      type: 'category',
+      label: 'Community',
+      collapsed: false,
+      items: ['community/security'],
+    },
+  ],
+};

docs/src/css/custom.css

@@ -0,0 +1,25 @@
+/* stylelint-disable docusaurus/copyright-header */
+/**
+ * Any CSS included here will be global. The classic template
+ * bundles Infima by default. Infima is a CSS framework designed to
+ * work well for content-centric websites.
+ */
+
+/* You can override the default Infima variables here. */
+:root {
+  --ifm-color-primary: #25c2a0;
+  --ifm-color-primary-dark: rgb(33, 175, 144);
+  --ifm-color-primary-darker: rgb(31, 165, 136);
+  --ifm-color-primary-darkest: rgb(26, 136, 112);
+  --ifm-color-primary-light: rgb(70, 203, 174);
+  --ifm-color-primary-lighter: rgb(102, 212, 189);
+  --ifm-color-primary-lightest: rgb(146, 224, 208);
+  --ifm-code-font-size: 95%;
+}
+
+.docusaurus-highlight-code-line {
+  background-color: rgb(72, 77, 91);
+  display: block;
+  margin: 0 calc(-1 * var(--ifm-pre-padding));
+  padding: 0 var(--ifm-pre-padding);
+}

docs/src/pages/index.md

@@ -0,0 +1,21 @@
+---
+title: Welcome to OAuth2 Proxy
+hide_table_of_contents: true
+---
+
+![OAuth2 Proxy](../../static/img/logos/OAuth2_Proxy_horizontal.svg)
+
+A reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others)
+to validate accounts by email, domain or group.
+
+:::note
+This repository was forked from [bitly/OAuth2_Proxy](https://github.com/bitly/oauth2_proxy) on 27/11/2018.
+Versions v3.0.0 and up are from this fork and will have diverged from any changes in the original fork.
+A list of changes can be seen in the [CHANGELOG](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/CHANGELOG.md).
+:::
+
+![Sign In Page](../../static/img/sign-in-page.png)
+
+## Architecture
+
+![OAuth2 Proxy Architecture](../../static/img/architecture.png)

docs/src/pages/styles.module.css

@@ -0,0 +1,37 @@
+/* stylelint-disable docusaurus/copyright-header */
+
+/**
+ * CSS files with the .module.css suffix will be treated as CSS modules
+ * and scoped locally.
+ */
+
+.heroBanner {
+  padding: 4rem 0;
+  text-align: center;
+  position: relative;
+  overflow: hidden;
+}
+
+@media screen and (max-width: 966px) {
+  .heroBanner {
+    padding: 2rem;
+  }
+}
+
+.buttons {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+
+.features {
+  display: flex;
+  align-items: center;
+  padding: 2rem 0;
+  width: 100%;
+}
+
+.featureImage {
+  height: 200px;
+  width: 200px;
+}

docs/static/img/logos/OAuth2_Proxy_icon.svg

@@ -0,0 +1 @@
+<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 360 360"><defs><style>.cls-1{fill:#06ed94;}.cls-2{fill:#059b61;}.cls-3{fill:#1957ba;}.cls-4{fill:#6ca8ff;}</style></defs><title>OAuth2_Proxy_logo_v3</title><path class="cls-1" d="M179.00205,349.728c-93.69483,0-169.921-76.22687-169.921-169.9217S85.30722,9.88462,179.00205,9.88462c93.69408,0,169.92021,76.22687,169.92021,169.9217S272.69613,349.728,179.00205,349.728Zm0-327.81581c-87.06238,0-157.89338,70.831-157.89338,157.89411s70.831,157.89411,157.89338,157.89411,157.89411-70.831,157.89411-157.89411S266.06442,21.91221,179.00205,21.91221Z"/><polygon class="cls-2" points="208.628 90.373 203.724 108.705 243.153 141.064 280.21 136.494 208.628 90.373"/><polygon class="cls-1" points="304.604 167.593 304.604 133.558 250.778 87.759 208.628 90.373 260.02 131.65 53.401 131.65 53.401 169.893 304.604 167.593"/><polygon class="cls-3" points="149.376 261.504 154.28 243.172 113.684 209.179 77.795 215.382 149.376 261.504"/><polygon class="cls-4" points="53.401 184.283 53.401 218.319 107.226 264.118 149.376 261.504 97.984 220.226 304.604 220.226 304.604 181.984 53.401 184.283"/></svg>

docs/versioned_docs/version-6.1.x/behaviour.md

@@ -0,0 +1,11 @@
+---
+id: behaviour
+title: Behaviour
+---
+
+1. Any request passing through the proxy (and not matched by `--skip-auth-regex`) is checked for the proxy's session cookie (`--cookie-name`) (or, if allowed, a JWT token - see `--skip-jwt-bearer-tokens`).
+2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with `Accept: application/json`, in which case 401 Unauthorized is returned)
+3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
+4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)
+
+Notice that the proxy also provides a number of useful [endpoints](features/endpoints.md).

docs/versioned_docs/version-6.1.x/community/security.md

@@ -0,0 +1,49 @@
+---
+id: security
+title: Security
+---
+
+:::note
+OAuth2 Proxy is a community project.
+Maintainers do not work on this project full time, and as such,
+while we endeavour to respond to disclosures as quickly as possible,
+this may take longer than in projects with corporate sponsorship.
+:::
+
+## Security Disclosures
+
+:::important
+If you believe you have found a vulnerability within OAuth2 Proxy or any of its
+dependencies, please do NOT open an issue or PR on GitHub, please do NOT post any
+details publicly.
+:::
+
+Security disclosures MUST be done in private.
+If you have found an issue that you would like to bring to the attention of the
+maintenance team for OAuth2 Proxy, please compose an email and send it to the
+list of maintainers in our [MAINTAINERS](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/MAINTAINERS) file.
+
+Please include as much detail as possible.
+Ideally, your disclosure should include:
+- A reproducible case that can be used to demonstrate the exploit
+- How you discovered this vulnerability
+- A potential fix for the issue (if you have thought of one)
+- Versions affected (if not present in master)
+- Your GitHub ID
+
+### How will we respond to disclosures?
+
+We use [GitHub Security Advisories](https://docs.github.com/en/github/managing-security-vulnerabilities/about-github-security-advisories)
+to privately discuss fixes for disclosed vulnerabilities.
+If you include a GitHub ID with your disclosure we will add you as a collaborator
+for the advisory so that you can join the discussion and validate any fixes
+we may propose.
+
+For minor issues and previously disclosed vulnerabilities (typically for
+dependencies), we may use regular PRs for fixes and forego the security advisory.
+
+Once a fix has been agreed upon, we will merge the fix and create a new release.
+If we have multiple security issues in flight simultaneously, we may delay
+merging fixes until all patches are ready.
+We may also backport the fix to previous releases,
+but this will be at the discretion of the maintainers.

docs/versioned_docs/version-6.1.x/configuration/auth.md

@@ -0,0 +1,456 @@
+---
+id: oauth_provider
+title: OAuth Provider Configuration
+---
+
+You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run `oauth2-proxy` on.
+
+Valid providers are :
+
+- [Google](#google-auth-provider) _default_
+- [Azure](#azure-auth-provider)
+- [Facebook](#facebook-auth-provider)
+- [GitHub](#github-auth-provider)
+- [Keycloak](#keycloak-auth-provider)
+- [GitLab](#gitlab-auth-provider)
+- [LinkedIn](#linkedin-auth-provider)
+- [Microsoft Azure AD](#microsoft-azure-ad-provider)
+- [OpenID Connect](#openid-connect-provider)
+- [login.gov](#logingov-provider)
+- [Nextcloud](#nextcloud-provider)
+- [DigitalOcean](#digitalocean-auth-provider)
+- [Bitbucket](#bitbucket-auth-provider)
+- [Gitea](#gitea-auth-provider)
+
+The provider can be selected using the `provider` configuration value.
+
+Please note that not all providers support all claims. The `preferred_username` claim is currently only supported by the OpenID Connect provider.
+
+### Google Auth Provider
+
+For Google, the registration steps are:
+
+1.  Create a new project: https://console.developers.google.com/project
+2.  Choose the new project from the top right project dropdown (only if another project is selected)
+3.  In the project Dashboard center pane, choose **"API Manager"**
+4.  In the left Nav pane, choose **"Credentials"**
+5.  In the center pane, choose **"OAuth consent screen"** tab. Fill in **"Product name shown to users"** and hit save.
+6.  In the center pane, choose **"Credentials"** tab.
+    - Open the **"New credentials"** drop down
+    - Choose **"OAuth client ID"**
+    - Choose **"Web application"**
+    - Application name is freeform, choose something appropriate
+    - Authorized JavaScript origins is your domain ex: `https://internal.yourcompany.com`
+    - Authorized redirect URIs is the location of oauth2/callback ex: `https://internal.yourcompany.com/oauth2/callback`
+    - Choose **"Create"**
+7.  Take note of the **Client ID** and **Client Secret**
+
+It's recommended to refresh sessions on a short interval (1h) with `cookie-refresh` setting which validates that the account is still authorized.
+
+#### Restrict auth to specific Google groups on your domain. (optional)
+
+1.  Create a service account: https://developers.google.com/identity/protocols/OAuth2ServiceAccount and make sure to download the json file.
+2.  Make note of the Client ID for a future step.
+3.  Under "APIs & Auth", choose APIs.
+4.  Click on Admin SDK and then Enable API.
+5.  Follow the steps on https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account and give the client id from step 2 the following oauth scopes:
+
+```
+https://www.googleapis.com/auth/admin.directory.group.readonly
+https://www.googleapis.com/auth/admin.directory.user.readonly
+```
+
+6.  Follow the steps on https://support.google.com/a/answer/60757 to enable Admin API access.
+7.  Create or choose an existing administrative email address on the Gmail domain to assign to the `google-admin-email` flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why.
+8.  Create or choose an existing email group and set that email to the `google-group` flag. You can pass multiple instances of this flag with different groups
+    and the user will be checked against all the provided groups.
+9.  Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the `google-service-account-json` flag.
+10. Restart oauth2-proxy.
+
+Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour ).
+
+### Azure Auth Provider
+
+1. Add an application: go to [https://portal.azure.com](https://portal.azure.com), choose **"Azure Active Directory"** in the left menu, select **"App registrations"** and then click on **"New app registration"**.
+2. Pick a name and choose **"Webapp / API"** as application type. Use `https://internal.yourcompany.com` as Sign-on URL. Click **"Create"**.
+3. On the **"Settings"** / **"Properties"** page of the app, pick a logo and select **"Multi-tenanted"** if you want to allow users from multiple organizations to access your app. Note down the application ID. Click **"Save"**.
+4. On the **"Settings"** / **"Required Permissions"** page of the app, click on **"Windows Azure Active Directory"** and then on **"Access the directory as the signed in user"**. Hit **"Save"** and then then on **"Grant permissions"** (you might need another admin to do this).
+5. On the **"Settings"** / **"Reply URLs"** page of the app, add `https://internal.yourcompanycom/oauth2/callback` for each host that you want to protect by the oauth2 proxy. Click **"Save"**.
+6. On the **"Settings"** / **"Keys"** page of the app, add a new key and note down the value after hitting **"Save"**.
+7. Configure the proxy with
+
+```
+   --provider=azure
+   --client-id=<application ID from step 3>
+   --client-secret=<value from step 6>
+```
+
+Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the [redis session storage](sessions.md#redis-storage) should resolve this.
+
+### Facebook Auth Provider
+
+1.  Create a new FB App from <https://developers.facebook.com/>
+2.  Under FB Login, set your Valid OAuth redirect URIs to `https://internal.yourcompany.com/oauth2/callback`
+
+### GitHub Auth Provider
+
+1.  Create a new project: https://github.com/settings/developers
+2.  Under `Authorization callback URL` enter the correct url ie `https://internal.yourcompany.com/oauth2/callback`
+
+The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with `--email-domain=*`
+
+NOTE: When `--github-user` is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators.
+
+To restrict by organization only, include the following flag:
+
+    -github-org="": restrict logins to members of this organisation
+
+To restrict within an organization to specific teams, include the following flag in addition to `-github-org`:
+
+    -github-team="": restrict logins to members of any of these teams (slug), separated by a comma
+
+If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:
+
+    -github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo
+
+If you'd like to allow access to users with **read only** access to a **public** repository you will need to provide a [token](https://github.com/settings/tokens) for a user that has write access to the repository. The token must be created with at least the `public_repo` scope:
+
+    -github-token="": the token to use when verifying repository collaborators
+
+To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma
+
+    -github-user="": allow logins by username, separated by a comma
+
+If you are using GitHub enterprise, make sure you set the following to the appropriate url:
+
+    -login-url="http(s)://<enterprise github host>/login/oauth/authorize"
+    -redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"
+    -validate-url="http(s)://<enterprise github host>/api/v3"
+
+### Keycloak Auth Provider
+
+1.  Create new client in your Keycloak with **Access Type** 'confidental' and **Valid Redirect URIs** 'https://internal.yourcompany.com/oauth2/callback'
+2.  Take note of the Secret in the credential tab of the client
+3.  Create a mapper with **Mapper Type** 'Group Membership' and **Token Claim Name** 'groups'.
+
+Make sure you set the following to the appropriate url:
+
+    -provider=keycloak
+    -client-id=<client you have created>
+    -client-secret=<your client's secret>
+    -login-url="http(s)://<keycloak host>/realms/<your realm>/protocol/openid-connect/auth"
+    -redeem-url="http(s)://<keycloak host>/realms/<your realm>/protocol/openid-connect/token"
+    -validate-url="http(s)://<keycloak host>/realms/<your realm>/protocol/openid-connect/userinfo"
+    -keycloak-group=<user_group>
+
+The group management in keycloak is using a tree. If you create a group named admin in keycloak you should define the 'keycloak-group' value to /admin.
+
+### GitLab Auth Provider
+
+Whether you are using GitLab.com or self-hosting GitLab, follow [these steps to add an application](https://docs.gitlab.com/ce/integration/oauth_provider.html). Make sure to enable at least the `openid`, `profile` and `email` scopes, and set the redirect url to your application url e.g. https://myapp.com/oauth2/callback.
+
+The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow [these steps](./overview.md#generating-a-cookie-secret)
+
+```
+    --provider="gitlab"
+    --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab
+    --client-id=GITLAB_CLIENT_ID
+    --client-secret=GITLAB_CLIENT_SECRET
+    --cookie-secret=COOKIE_SECRET
+```
+
+Restricting by group membership is possible with the following option:
+
+    --gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma
+
+If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:
+
+    --oidc-issuer-url="<your gitlab url>"
+
+### LinkedIn Auth Provider
+
+For LinkedIn, the registration steps are:
+
+1.  Create a new project: https://www.linkedin.com/secure/developer
+2.  In the OAuth User Agreement section:
+    - In default scope, select r_basicprofile and r_emailaddress.
+    - In "OAuth 2.0 Redirect URLs", enter `https://internal.yourcompany.com/oauth2/callback`
+3.  Fill in the remaining required fields and Save.
+4.  Take note of the **Consumer Key / API Key** and **Consumer Secret / Secret Key**
+
+### Microsoft Azure AD Provider
+
+For adding an application to the Microsoft Azure AD follow [these steps to add an application](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app).
+
+Take note of your `TenantId` if applicable for your situation. The `TenantId` can be used to override the default `common` authorization server with a tenant specific server.
+
+### OpenID Connect Provider
+
+OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects. This provider was originally built against CoreOS Dex and we will use it as an example.
+
+1. Launch a Dex instance using the [getting started guide](https://github.com/coreos/dex/blob/master/Documentation/getting-started.md).
+2. Setup oauth2-proxy with the correct provider and using the default ports and callbacks.
+3. Login with the fixture use in the dex guide and run the oauth2-proxy with the following args:
+
+```
+    -provider oidc
+    -provider-display-name "My OIDC Provider"
+    -client-id oauth2-proxy
+    -client-secret proxy
+    -redirect-url http://127.0.0.1:4180/oauth2/callback
+    -oidc-issuer-url http://127.0.0.1:5556
+    -cookie-secure=false
+    -email-domain example.com
+```
+
+The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta. To configure the OIDC provider for Okta, perform
+the following steps:
+
+#### Configuring the OIDC Provider with Okta
+
+1. Log in to Okta using an administrative account. It is suggested you try this in preview first, `example.oktapreview.com`
+2. (OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,
+you may wish to configure an authorization server for each application. Otherwise, the provided `default` will work.
+* Navigate to **Security** then select **API**
+* Click **Add Authorization Server**, if this option is not available you may require an additional license for a custom authorization server.
+* Fill out the **Name** with something to describe the application you are protecting. e.g. 'Example App'.
+* For **Audience**, pick the URL of the application you wish to protect: https://example.corp.com
+* Fill out a **Description**
+* Add any **Access Policies** you wish to configure to limit application access.
+* The default settings will work for other options.
+[See Okta documentation for more information on Authorization Servers](https://developer.okta.com/docs/guides/customize-authz-server/overview/)
+3. Navigate to **Applications** then select **Add Application**.
+* Select **Web** for the **Platform** setting.
+* Select **OpenID Connect** and click **Create**
+* Pick an **Application Name** such as `Example App`.
+* Set the **Login redirect URI** to `https://example.corp.com`.
+* Under **General** set the **Allowed grant types** to `Authorization Code` and `Refresh Token`.
+* Leave the rest as default, taking note of the `Client ID` and `Client Secret`.
+* Under **Assignments** select the users or groups you wish to access your application.
+4. Create a configuration file like the following:
+
+```
+provider = "oidc"
+redirect_url = "https://example.corp.com/oauth2/callback"
+oidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"
+upstreams = [
+    "https://example.corp.com"
+]
+email_domains = [
+    "corp.com"
+]
+client_id = "XXXXX"
+client_secret = "YYYYY"
+pass_access_token = true
+cookie_secret = "ZZZZZ"
+skip_provider_button = true
+```
+
+The `oidc_issuer_url` is based on URL from your **Authorization Server**'s **Issuer** field in step 2, or simply https://corp.okta.com
+The `client_id` and `client_secret` are configured in the application settings.
+Generate a unique `client_secret` to encrypt the cookie.
+
+Then you can start the oauth2-proxy with `./oauth2-proxy --config /etc/example.cfg`
+
+#### Configuring the OIDC Provider with Okta - localhost
+1. Signup for developer account: https://developer.okta.com/signup/
+2. Create New `Web` Application: https://${your-okta-domain}/dev/console/apps/new
+3. Example Application Settings for localhost:
+   * **Name:** My Web App
+   * **Base URIs:** http://localhost:4180/
+   * **Login redirect URIs:** http://localhost:4180/oauth2/callback
+   * **Logout redirect URIs:** http://localhost:4180/
+   * **Group assignments:** `Everyone`
+   * **Grant type allowed:** `Authorization Code` and `Refresh Token`
+4. Make note of the `Client ID` and `Client secret`, they are needed in a future step
+5. Make note of the **default** Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as
+6. Example config file `/etc/localhost.cfg`
+   ```
+   provider = "oidc"
+   redirect_url = "http://localhost:4180/oauth2/callback"
+   oidc_issuer_url = "https://${your-okta-domain}/oauth2/default"
+   upstreams = [
+       "http://0.0.0.0:8080"
+   ]
+   email_domains = [
+       "*"
+   ]
+   client_id = "XXX"
+   client_secret = "YYY"
+   pass_access_token = true
+   cookie_secret = "ZZZ"
+   cookie_secure = false
+   skip_provider_button = true
+   # Note: use the following for testing within a container
+   # http_address = "0.0.0.0:4180"
+   ```
+7. Then you can start the oauth2-proxy with `./oauth2-proxy --config /etc/localhost.cfg`
+
+### login.gov Provider
+
+login.gov is an OIDC provider for the US Government.
+If you are a US Government agency, you can contact the login.gov team through the contact information
+that you can find on https://login.gov/developers/ and work with them to understand how to get login.gov
+accounts for integration/test and production access.
+
+A developer guide is available here: https://developers.login.gov/, though this proxy handles everything
+but the data you need to create to register your application in the login.gov dashboard.
+
+As a demo, we will assume that you are running your application that you want to secure locally on
+http://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that
+you have an agency integration account for testing.
+
+First, register your application in the dashboard.  The important bits are:
+  * Identity protocol:  make this `Openid connect`
+  * Issuer:  do what they say for OpenID Connect.  We will refer to this string as `${LOGINGOV_ISSUER}`.
+  * Public key:  This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.
+    A quick way to do this is `openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'`,
+    The contents of the `key.pem` shall be referred to as `${OAUTH2_PROXY_JWT_KEY}`.
+  * Return to App URL:  Make this be `http://localhost:4180/`
+  * Redirect URIs:  Make this be `http://localhost:4180/oauth2/callback`.
+  * Attribute Bundle:  Make sure that email is selected.
+
+Now start the proxy up with the following options:
+```
+./oauth2-proxy -provider login.gov \
+  -client-id=${LOGINGOV_ISSUER} \
+  -redirect-url=http://localhost:4180/oauth2/callback \
+  -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \
+  -cookie-secure=false \
+  -email-domain=gsa.gov \
+  -upstream=http://localhost:3000/ \
+  -cookie-secret=somerandomstring12341234567890AB \
+  -cookie-domain=localhost \
+  -skip-provider-button=true \
+  -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \
+  -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \
+  -jwt-key="${OAUTH2_PROXY_JWT_KEY}"
+```
+You can also set all these options with environment variables, for use in cloud/docker environments.
+One tricky thing that you may encounter is that some cloud environments will pass in environment
+variables in a docker env-file, which does not allow multiline variables like a PEM file.
+If you encounter this, then you can create a `jwt_signing_key.pem` file in the top level
+directory of the repo which contains the key in PEM format and then do your docker build.
+The docker build process will copy that file into your image which you can then access by
+setting the `OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem`
+environment variable, or by setting `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem` on the commandline.
+
+Once it is running, you should be able to go to `http://localhost:4180/` in your browser,
+get authenticated by the login.gov integration server, and then get proxied on to your
+application running on `http://localhost:3000/`.  In a real deployment, you would secure
+your application with a firewall or something so that it was only accessible from the
+proxy, and you would use real hostnames everywhere.
+
+#### Skip OIDC discovery
+
+Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata.
+
+In this case, you can set the `--skip-oidc-discovery` option, and supply those required endpoints manually:
+
+```
+    -provider oidc
+    -client-id oauth2-proxy
+    -client-secret proxy
+    -redirect-url http://127.0.0.1:4180/oauth2/callback
+    -oidc-issuer-url http://127.0.0.1:5556
+    -skip-oidc-discovery
+    -login-url http://127.0.0.1:5556/authorize
+    -redeem-url http://127.0.0.1:5556/token
+    -oidc-jwks-url http://127.0.0.1:5556/keys
+    -cookie-secure=false
+    -email-domain example.com
+```
+
+### Nextcloud Provider
+
+The Nextcloud provider allows you to authenticate against users in your
+Nextcloud instance.
+
+When you are using the Nextcloud provider, you must specify the urls via
+configuration, environment variable, or command line argument. Depending
+on whether your Nextcloud instance is using pretty urls your urls may be of the
+form `/index.php/apps/oauth2/*` or `/apps/oauth2/*`.
+
+Refer to the [OAuth2
+documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html)
+to setup the client id and client secret. Your "Redirection URI" will be
+`https://internalapp.yourcompany.com/oauth2/callback`.
+
+```
+    -provider nextcloud
+    -client-id <from nextcloud admin>
+    -client-secret <from nextcloud admin>
+    -login-url="<your nextcloud url>/index.php/apps/oauth2/authorize"
+    -redeem-url="<your nextcloud url>/index.php/apps/oauth2/api/v1/token"
+    -validate-url="<your nextcloud url>/ocs/v2.php/cloud/user?format=json"
+```
+
+Note: in *all* cases the validate-url will *not* have the `index.php`.
+
+### DigitalOcean Auth Provider
+
+1. [Create a new OAuth application](https://cloud.digitalocean.com/account/api/applications)
+    * You can fill in the name, homepage, and description however you wish.
+    * In the "Application callback URL" field, enter: `https://oauth-proxy/oauth2/callback`, substituting `oauth2-proxy` with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL.
+2. Note the Client ID and Client Secret.
+
+To use the provider, pass the following options:
+
+```
+   --provider=digitalocean
+   --client-id=<Client ID>
+   --client-secret=<Client Secret>
+```
+
+ Alternatively, set the equivalent options in the config file. The redirect URL defaults to `https://<requested host header>/oauth2/callback`. If you need to change it, you can use the `--redirect-url` command-line option.
+
+### Bitbucket Auth Provider
+
+1. [Add a new OAuth consumer](https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html)
+    * In "Callback URL" use `https://<oauth2-proxy>/oauth2/callback`, substituting `<oauth2-proxy>` with the actual hostname that oauth2-proxy is running on.
+    * In Permissions section select:
+        * Account -> Email
+        * Team membership -> Read
+        * Repositories -> Read
+2. Note the Client ID and Client Secret.
+
+To use the provider, pass the following options:
+
+```
+   --provider=bitbucket
+   --client-id=<Client ID>
+   --client-secret=<Client Secret>
+```
+
+The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: `--bitbucket-team=<Team name>`. To restrict the access to only these users who has access to one selected repository use `--bitbucket-repository=<Repository name>`.
+
+
+### Gitea Auth Provider
+
+1. Create a new application: `https://< your gitea host >/user/settings/applications`
+2. Under `Redirect URI` enter the correct URL i.e. `https://<proxied host>/oauth2/callback`
+3. Note the Client ID and Client Secret.
+4. Pass the following options to the proxy:
+
+```
+    --provider="github"
+    --redirect-url="https://<proxied host>/oauth2/callback"
+    --provider-display-name="Gitea"
+    --client-id="< client_id as generated by Gitea >"
+    --client-secret="< client_secret as generated by Gitea >"
+    --login-url="https://< your gitea host >/login/oauth/authorize"
+    --redeem-url="https://< your gitea host >/login/oauth/access_token"
+    --validate-url="https://< your gitea host >/api/v1"
+```
+
+
+## Email Authentication
+
+To authorize by email domain use `--email-domain=yourcompany.com`. To authorize individual email addresses use `--authenticated-emails-file=/path/to/file` with one email per line. To authorize all email addresses use `--email-domain=*`.
+
+## Adding a new Provider
+
+Follow the examples in the [`providers` package](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/) to define a new
+`Provider` instance. Add a new `case` to
+[`providers.New()`](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go) to allow `oauth2-proxy` to use the
+new `Provider`.

docs/versioned_docs/version-6.1.x/configuration/overview.md

@@ -0,0 +1,357 @@
+---
+id: overview
+title: Overview
+---
+
+`oauth2-proxy` can be configured via [config file](#config-file), [command line options](#command-line-options) or [environment variables](#environment-variables).
+
+### Generating a Cookie Secret
+
+To generate a strong cookie secret use `python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(16)).decode())'`
+
+### Config File
+
+Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (\_). If the argument can be specified multiple times, the config option should be plural (trailing s).
+
+An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example) config file is in the contrib directory. It can be used by specifying `--config=/etc/oauth2-proxy.cfg`
+
+### Command Line Options
+
+| Option | Type | Description | Default |
+| ------ | ---- | ----------- | ------- |
+| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
+| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
+| `--auth-logging` | bool | Log authentication attempts | true |
+| `--auth-logging-format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
+| `--authenticated-emails-file` | string | authenticate against emails via file (one per line) | |
+| `--azure-tenant` | string | go to a tenant-specific or common (tenant-independent) endpoint. | `"common"` |
+| `--basic-auth-password` | string | the password to set when passing the HTTP Basic Auth header | |
+| `--client-id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
+| `--client-secret` | string | the OAuth Client Secret | |
+| `--client-secret-file` | string | the file with OAuth Client Secret | |
+| `--config` | string | path to config file | |
+| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
+| `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s |
+| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
+| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates | `"_oauth2_proxy"` |
+| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
+| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers \[[1](#footnote1)\] | |
+| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
+| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
+| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
+| `--custom-templates-dir` | string | path to custom html templates | |
+| `--display-htpasswd-form` | bool | display username / password login form if an htpasswd file is provided | true |
+| `--email-domain` | string \| list  | authenticate emails with the specified domain (may be given multiple times). Use `*` to authenticate any email | |
+| `--errors-to-info-log` | bool | redirects error-level logging to default log channel instead of stderr | |
+| `--extra-jwt-issuers` | string | if `--skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` (see a token's `iss`, `aud` fields) pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
+| `--exclude-logging-paths` | string | comma separated list of paths to exclude from logging, e.g. `"/ping,/path2"` |`""` (no paths excluded) |
+| `--flush-interval` | duration | period between flushing response buffers when streaming responses | `"1s"` |
+| `--force-https` | bool | enforce https redirect | `false` |
+| `--banner` | string | custom (html) banner string. Use `"-"` to disable default banner. | |
+| `--footer` | string | custom (html) footer string. Use `"-"` to disable default footer. | |
+| `--gcp-healthchecks` | bool | will enable `/liveness_check`, `/readiness_check`, and `/` (with the proper user-agent) endpoints that will make it work well with GCP App Engine and GKE Ingresses | false |
+| `--github-org` | string | restrict logins to members of this organisation | |
+| `--github-team` | string | restrict logins to members of any of these teams (slug), separated by a comma | |
+| `--github-repo` | string | restrict logins to collaborators of this repository formatted as `orgname/repo` | |
+| `--github-token` | string | the token to use when verifying repository collaborators (must have push access to the repository) | |
+| `--github-user` | string \| list | To allow users to login by username even if they do not belong to the specified org and team or collaborators | |
+| `--gitlab-group` | string \| list | restrict logins to members of any of these groups (slug), separated by a comma | |
+| `--google-admin-email` | string | the google admin to impersonate for api calls | |
+| `--google-group` | string | restrict logins to members of this google group (may be given multiple times). | |
+| `--google-service-account-json` | string | the path to the service account json credentials | |
+| `--htpasswd-file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -s` for SHA encryption | |
+| `--http-address` | string | `[http://]<addr>:<port>` or `unix://<path>` to listen on for HTTP clients | `"127.0.0.1:4180"` |
+| `--https-address` | string | `<addr>:<port>` to listen on for HTTPS clients | `":443"` |
+| `--logging-compress` | bool | Should rotated log files be compressed using gzip | false |
+| `--logging-filename` | string | File to log requests to, empty for `stdout` | `""` (stdout) |
+| `--logging-local-time` | bool | Use local time in log files and backup filenames instead of UTC | true (local time) |
+| `--logging-max-age` | int | Maximum number of days to retain old log files | 7 |
+| `--logging-max-backups` | int | Maximum number of old log files to retain; 0 to disable | 0  |
+| `--logging-max-size` | int | Maximum size in megabytes of the log file before rotation | 100 |
+| `--jwt-key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |
+| `--jwt-key-file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |
+| `--login-url` | string | Authentication endpoint | |
+| `--insecure-oidc-allow-unverified-email` | bool | don't fail if an email address in an id_token is not verified | false |
+| `--insecure-oidc-skip-issuer-verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
+| `--oidc-issuer-url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
+| `--oidc-jwks-url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled | |
+| `--pass-access-token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
+| `--pass-authorization-header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
+| `--pass-basic-auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
+| `--prefer-email-to-user` | bool | Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with `--pass-basic-auth` and `--pass-user-headers` | false |
+| `--pass-host-header` | bool | pass the request Host Header to upstream | true |
+| `--pass-user-headers` | bool | pass X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
+| `--profile-url` | string | Profile access endpoint | |
+| `--prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
+| `--provider` | string | OAuth provider | google |
+| `--provider-ca-file` |  string \| list |  Paths to CA certificates that should be used when connecting to the provider.  If not specified, the default Go trust sources are used instead. |
+| `--provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
+| `--ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
+| `--ping-user-agent` | string | a User-Agent that can be used for basic health checks | `""` (don't check user agent) |
+| `--proxy-prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
+| `--proxy-websockets` | bool | enables WebSocket proxying | true |
+| `--pubjwk-url` | string | JWK pubkey access endpoint: required by login.gov | |
+| `--real-client-ip-header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
+| `--redeem-url` | string | Token redemption endpoint | |
+| `--redirect-url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
+| `--redis-cluster-connection-urls` | string \| list | List of Redis cluster connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-cluster` | |
+| `--redis-connection-url` | string | URL of redis server for redis session storage (e.g. `redis://HOST[:PORT]`) | |
+| `--redis-password` | string | Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url` | |
+| `--redis-sentinel-password` | string | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password` | |
+| `--redis-sentinel-master-name` | string | Redis sentinel master name. Used in conjunction with `--redis-use-sentinel` | |
+| `--redis-sentinel-connection-urls` | string \| list | List of Redis sentinel connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-sentinel` | |
+| `--redis-use-cluster` | bool | Connect to redis cluster. Must set `--redis-cluster-connection-urls` to use this feature | false |
+| `--redis-use-sentinel` | bool | Connect to redis via sentinels. Must set `--redis-sentinel-master-name` and `--redis-sentinel-connection-urls` to use this feature | false |
+| `--request-logging` | bool | Log requests | true |
+| `--request-logging-format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
+| `--resource` | string | The resource that is protected (Azure AD only) | |
+| `--reverse-proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted | false |
+| `--scope` | string | OAuth scope specification | |
+| `--session-cookie-minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
+| `--session-store-type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
+| `--set-xauthrequest` | bool | set X-Auth-Request-User, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with `--pass-access-token`, X-Auth-Request-Access-Token is added to response headers.  | false |
+| `--set-authorization-header` | bool | set Authorization Bearer response header (useful in Nginx auth_request mode) | false |
+| `--set-basic-auth` | bool | set HTTP Basic Auth information in response (useful in Nginx auth_request mode) | false |
+| `--signature-key` | string | GAP-Signature request signature key (algorithm:secretkey) | |
+| `--silence-ping-logging` | bool | disable logging of requests to ping endpoint | false |
+| `--skip-auth-preflight` | bool | will skip authentication for OPTIONS requests | false |
+| `--skip-auth-regex` | string | bypass authentication for requests paths that match (may be given multiple times) | |
+| `--skip-auth-strip-headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy for request paths in `--skip-auth-regex` | false |
+| `--skip-jwt-bearer-tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
+| `--skip-oidc-discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
+| `--skip-provider-button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
+| `--ssl-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS providers | false |
+| `--ssl-upstream-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS upstreams | false |
+| `--standard-logging` | bool | Log standard runtime information | true |
+| `--standard-logging-format` | string | Template for standard log lines | see [Logging Configuration](#logging-configuration) |
+| `--tls-cert-file` | string | path to certificate file | |
+| `--tls-key-file` | string | path to private key file | |
+| `--upstream` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
+| `--user-id-claim` | string | which claim contains the user ID | \["email"\] |
+| `--validate-url` | string | Access token validation endpoint | |
+| `--version` | n/a | print version string | |
+| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` to allow subdomains (e.g. `.example.com`)&nbsp;\[[2](#footnote2)\] | |
+| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
+
+\[<a name="footnote1">1</a>\]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
+
+\[<a name="footnote2">2</a>\]: When using the `whitelist-domain` option, any domain prefixed with a `.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
+
+See below for provider specific options
+
+### Upstreams Configuration
+
+`oauth2-proxy` supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as `http://127.0.0.1:8080/` for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide `http://127.0.0.1:8080/some/path/` then it will only be requests that start with `/some/path/` which are forwarded to the upstream.
+
+Static file paths are configured as a file:// URL. `file:///var/www/static/` will serve the files from that directory at `http://[oauth2-proxy url]/var/www/static/`, which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. `file:///var/www/static/#/static/` will make `/var/www/static/` available at `http://[oauth2-proxy url]/static/`.
+
+Multiple upstreams can either be configured by supplying a comma separated list to the `--upstream` parameter, supplying the parameter multiple times or providing a list in the [config file](#config-file). When multiple upstreams are used routing to them will be based on the path they are set up with.
+
+### Environment variables
+
+Every command line argument can be specified as an environment variable by
+prefixing it with `OAUTH2_PROXY_`, capitalising it, and replacing hyphens (`-`)
+with underscores (`_`). If the argument can be specified multiple times, the
+environment variable should be plural (trailing `S`).
+
+This is particularly useful for storing secrets outside of a configuration file
+or the command line.
+
+For example, the `--cookie-secret` flag becomes `OAUTH2_PROXY_COOKIE_SECRET`,
+and the `--email-domain` flag becomes `OAUTH2_PROXY_EMAIL_DOMAINS`.
+
+## Logging Configuration
+
+By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the `--logging-filename` command.
+
+If logging to a file you can also configure the maximum file size (`--logging-max-size`), age (`--logging-max-age`), max backup logs (`--logging-max-backups`), and if backup logs should be compressed (`--logging-compress`).
+
+There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with `--standard-logging`, `--auth-logging`, and `--request-logging`.
+
+Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log.
+
+Logging of requests to the `/ping` endpoint (or using `--ping-user-agent`) can be disabled with `--silence-ping-logging` reducing log volume. This flag appends the `--ping-path` to `--exclude-logging-paths`.
+
+### Auth Log Format
+Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:
+
+```
+<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] [<STATUS>] <MESSAGE>
+```
+
+The status block will contain one of the below strings:
+
+- `AuthSuccess` If a user has authenticated successfully by any method
+- `AuthFailure` If the user failed to authenticate explicitly
+- `AuthError` If there was an unexpected error during authentication
+
+If you require a different format than that, you can configure it with the `--auth-logging-format` flag.
+The default format is configured as follows:
+
+```
+{{.Client}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}
+```
+
+Available variables for auth logging:
+
+| Variable | Example | Description |
+| --- | --- | --- |
+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
+| Host  | domain.com | The value of the Host header. |
+| Protocol | HTTP/1.0 | The request protocol. |
+| RequestMethod | GET | The request method. |
+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
+| UserAgent | - | The full user agent as reported by the requesting client. |
+| Username | username@email.com | The email or username of the auth request. |
+| Status | AuthSuccess | The status of the auth request. See above for details. |
+| Message | Authenticated via OAuth2 | The details of the auth attempt. |
+
+### Request Log Format
+HTTP request logs will output by default in the below format:
+
+```
+<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] <HOST_HEADER> GET <UPSTREAM_HOST> "/path/" HTTP/1.1 "<USER_AGENT>" <RESPONSE_CODE> <RESPONSE_BYTES> <REQUEST_DURATION>
+```
+
+If you require a different format than that, you can configure it with the `--request-logging-format` flag.
+The default format is configured as follows:
+
+```
+{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}
+```
+
+Available variables for request logging:
+
+| Variable | Example | Description |
+| --- | --- | --- |
+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
+| Host  | domain.com | The value of the Host header. |
+| Protocol | HTTP/1.0 | The request protocol. |
+| RequestDuration | 0.001 | The time in seconds that a request took to process. |
+| RequestMethod | GET | The request method. |
+| RequestURI | "/oauth2/auth" | The URI path of the request. |
+| ResponseSize | 12 | The size in bytes of the response. |
+| StatusCode | 200 | The HTTP status code of the response. |
+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
+| Upstream | - | The upstream data of the HTTP request. |
+| UserAgent | - | The full user agent as reported by the requesting client. |
+| Username | username@email.com | The email or username of the auth request. |
+
+### Standard Log Format
+All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:
+
+```
+[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE>
+```
+
+If you require a different format than that, you can configure it with the `--standard-logging-format` flag. The default format is configured as follows:
+
+```
+[{{.Timestamp}}] [{{.File}}] {{.Message}}
+```
+
+Available variables for standard logging:
+
+| Variable | Example | Description |
+| --- | --- | --- |
+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
+| File | main.go:40 | The file and line number of the logging statement. |
+| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
+
+## Configuring for use with the Nginx `auth_request` directive
+
+The [Nginx `auth_request` directive](http://nginx.org/en/docs/http/ngx_http_auth_request_module.html) allows Nginx to authenticate requests via the oauth2-proxy's `/auth` endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:
+
+```nginx
+server {
+  listen 443 ssl;
+  server_name ...;
+  include ssl/ssl.conf;
+
+  location /oauth2/ {
+    proxy_pass       http://127.0.0.1:4180;
+    proxy_set_header Host                    $host;
+    proxy_set_header X-Real-IP               $remote_addr;
+    proxy_set_header X-Scheme                $scheme;
+    proxy_set_header X-Auth-Request-Redirect $request_uri;
+    # or, if you are handling multiple domains:
+    # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
+  }
+  location = /oauth2/auth {
+    proxy_pass       http://127.0.0.1:4180;
+    proxy_set_header Host             $host;
+    proxy_set_header X-Real-IP        $remote_addr;
+    proxy_set_header X-Scheme         $scheme;
+    # nginx auth_request includes headers but not body
+    proxy_set_header Content-Length   "";
+    proxy_pass_request_body           off;
+  }
+
+  location / {
+    auth_request /oauth2/auth;
+    error_page 401 = /oauth2/sign_in;
+
+    # pass information via X-User and X-Email headers to backend,
+    # requires running with --set-xauthrequest flag
+    auth_request_set $user   $upstream_http_x_auth_request_user;
+    auth_request_set $email  $upstream_http_x_auth_request_email;
+    proxy_set_header X-User  $user;
+    proxy_set_header X-Email $email;
+
+    # if you enabled --pass-access-token, this will pass the token to the backend
+    auth_request_set $token  $upstream_http_x_auth_request_access_token;
+    proxy_set_header X-Access-Token $token;
+
+    # if you enabled --cookie-refresh, this is needed for it to work with auth_request
+    auth_request_set $auth_cookie $upstream_http_set_cookie;
+    add_header Set-Cookie $auth_cookie;
+
+    # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
+    # limit and so the OAuth2 Proxy splits these into multiple parts.
+    # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
+    # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
+    auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;
+
+    # Extract the Cookie attributes from the first Set-Cookie header and append them
+    # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
+    if ($auth_cookie ~* "(; .*)") {
+        set $auth_cookie_name_0 $auth_cookie;
+        set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
+    }
+
+    # Send both Set-Cookie headers now if there was a second part
+    if ($auth_cookie_name_upstream_1) {
+        add_header Set-Cookie $auth_cookie_name_0;
+        add_header Set-Cookie $auth_cookie_name_1;
+    }
+
+    proxy_pass http://backend/;
+    # or "root /path/to/site;" or "fastcgi_pass ..." etc
+  }
+}
+```
+
+When you use ingress-nginx in Kubernetes, you MUST use `kubernetes/ingress-nginx` (which includes the Lua module) and the following configuration snippet for your `Ingress`.
+Variables set with `auth_request_set` are not `set`-able in plain nginx config when the location is processed via `proxy_pass` and then may only be processed by Lua.
+Note that `nginxinc/kubernetes-ingress` does not include the Lua module.
+
+```yaml
+nginx.ingress.kubernetes.io/auth-response-headers: Authorization
+nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
+nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
+nginx.ingress.kubernetes.io/configuration-snippet: |
+  auth_request_set $name_upstream_1 $upstream_cookie_name_1;
+
+  access_by_lua_block {
+    if ngx.var.name_upstream_1 ~= "" then
+      ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")
+    end
+  }
+```
+It is recommended to use `--session-store-type=redis` when expecting large sessions/OIDC tokens (_e.g._ with MS Azure).
+
+You have to substitute *name* with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable  should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".
+
+:::note
+If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.
+:::

docs/versioned_docs/version-6.1.x/configuration/sessions.md

@@ -0,0 +1,67 @@
+---
+id: session_storage
+title: Session Storage
+---
+
+Sessions allow a user's authentication to be tracked between multiple HTTP
+requests to a service.
+
+The OAuth2 Proxy uses a Cookie to track user sessions and will store the session
+data in one of the available session storage backends.
+
+At present the available backends are (as passed to `--session-store-type`):
+- [cookie](#cookie-storage) (default)
+- [redis](#redis-storage)
+
+### Cookie Storage
+
+The Cookie storage backend is the default backend implementation and has
+been used in the OAuth2 Proxy historically.
+
+With the Cookie storage backend, all session information is stored in client
+side cookies and transferred with each and every request.
+
+The following should be known when using this implementation:
+- Since all state is stored client side, this storage backend means that the OAuth2 Proxy is completely stateless
+- Cookies are signed server side to prevent modification client-side
+- It is mandatory to set a `cookie-secret` which will ensure data is encrypted within the cookie data.
+- Since multiple requests can be made concurrently to the OAuth2 Proxy, this session implementation
+cannot lock sessions and while updating and refreshing sessions, there can be conflicts which force
+users to re-authenticate
+
+
+### Redis Storage
+
+The Redis Storage backend stores sessions, encrypted, in redis. Instead sending all the information
+back the the client for storage, as in the [Cookie storage](#cookie-storage), a ticket is sent back
+to the user as the cookie value instead.
+
+A ticket is composed as the following:
+
+`{CookieName}-{ticketID}.{secret}`
+
+Where:
+
+- The `CookieName` is the OAuth2 cookie name (_oauth2_proxy by default)
+- The `ticketID` is a 128 bit random number, hex-encoded
+- The `secret` is a 128 bit random number, base64url encoded (no padding). The secret is unique for every session.
+- The pair of `{CookieName}-{ticketID}` comprises a ticket handle, and thus, the redis key
+to which the session is stored. The encoded session is encrypted with the secret and stored
+in redis via the `SETEX` command.
+
+Encrypting every session uniquely protects the refresh/access/id tokens stored in the session from
+disclosure.
+
+#### Usage
+
+When using the redis store, specify `--session-store-type=redis` as well as the Redis connection URL, via
+`--redis-connection-url=redis://host[:port][/db-number]`.
+
+You may also configure the store for Redis Sentinel. In this case, you will want to use the
+`--redis-use-sentinel=true` flag, as well as configure the flags `--redis-sentinel-master-name`
+and `--redis-sentinel-connection-urls` appropriately.
+
+Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the
+`--redis-use-cluster=true` flag, and configure the flags `--redis-cluster-connection-urls` appropriately.
+
+Note that flags `--redis-use-sentinel=true` and `--redis-use-cluster=true` are mutually exclusive.

docs/versioned_docs/version-6.1.x/configuration/tls.md

@@ -0,0 +1,70 @@
+---
+id: tls
+title: TLS Configuration
+---
+
+There are two recommended configurations.
+
+1.  Configure SSL Termination with OAuth2 Proxy by providing a `--tls-cert-file=/path/to/cert.pem` and `--tls-key-file=/path/to/cert.key`.
+
+    The command line to run `oauth2-proxy` in this configuration would look like this:
+
+    ```bash
+    ./oauth2-proxy \
+        --email-domain="yourcompany.com"  \
+        --upstream=http://127.0.0.1:8080/ \
+        --tls-cert-file=/path/to/cert.pem \
+        --tls-key-file=/path/to/cert.key \
+        --cookie-secret=... \
+        --cookie-secure=true \
+        --provider=... \
+        --client-id=... \
+        --client-secret=...
+    ```
+
+2.  Configure SSL Termination with [Nginx](http://nginx.org/) (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ....
+
+    Because `oauth2-proxy` listens on `127.0.0.1:4180` by default, to listen on all interfaces (needed when using an
+    external load balancer like Amazon ELB or Google Platform Load Balancing) use `--http-address="0.0.0.0:4180"` or
+    `--http-address="http://:4180"`.
+
+    Nginx will listen on port `443` and handle SSL connections while proxying to `oauth2-proxy` on port `4180`.
+    `oauth2-proxy` will then authenticate requests for an upstream application. The external endpoint for this example
+    would be `https://internal.yourcompany.com/`.
+
+    An example Nginx config follows. Note the use of `Strict-Transport-Security` header to pin requests to SSL
+    via [HSTS](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security):
+
+    ```
+    server {
+        listen 443 default ssl;
+        server_name internal.yourcompany.com;
+        ssl_certificate /path/to/cert.pem;
+        ssl_certificate_key /path/to/cert.key;
+        add_header Strict-Transport-Security max-age=2592000;
+
+        location / {
+            proxy_pass http://127.0.0.1:4180;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Scheme $scheme;
+            proxy_connect_timeout 1;
+            proxy_send_timeout 30;
+            proxy_read_timeout 30;
+        }
+    }
+    ```
+
+    The command line to run `oauth2-proxy` in this configuration would look like this:
+
+    ```bash
+    ./oauth2-proxy \
+       --email-domain="yourcompany.com"  \
+       --upstream=http://127.0.0.1:8080/ \
+       --cookie-secret=... \
+       --cookie-secure=true \
+       --provider=... \
+       --reverse-proxy=true \
+       --client-id=... \
+       --client-secret=...
+    ```

docs/versioned_docs/version-6.1.x/features/endpoints.md

@@ -0,0 +1,35 @@
+---
+id: endpoints
+title: Endpoints
+---
+
+OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The `/oauth2` prefix can be changed with the `--proxy-prefix` config variable.
+
+- /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see [robotstxt.org](http://www.robotstxt.org/) for more info
+- /ping - returns a 200 OK response, which is intended for use with health checks
+- /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
+- /oauth2/sign_out - this URL is used to clear the session cookie
+- /oauth2/start - a URL that will redirect to start the OAuth cycle
+- /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
+- /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
+- /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the [Nginx `auth_request` directive](../configuration/overview.md#configuring-for-use-with-the-nginx-auth_request-directive)
+
+### Sign out
+
+To sign the user out, redirect them to `/oauth2/sign_out`. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the `rd` query parameter, i.e. redirect the user to something like (notice the url-encoding!):
+
+```
+/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page
+```
+
+Alternatively, include the redirect URL in the `X-Auth-Request-Redirect` header:
+
+```
+GET /oauth2/sign_out HTTP/1.1
+X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
+...
+```
+
+(The "sign_out_page" should be the [`end_session_endpoint`](https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1) from [the metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig) if your OIDC provider supports Session Management and Discovery.)
+
+BEWARE that the domain you want to redirect to (`my-oidc-provider.example.com` in the example) must be added to the [`--whitelist-domain`](../configuration/overview) configuration option otherwise the redirect will be ignored.

docs/versioned_docs/version-6.1.x/features/request_signatures.md

@@ -0,0 +1,20 @@
+---
+id: request_signatures
+title: Request Signatures
+---
+
+If `signature_key` is defined, proxied requests will be signed with the
+`GAP-Signature` header, which is a [Hash-based Message Authentication Code
+(HMAC)](https://en.wikipedia.org/wiki/Hash-based_message_authentication_code)
+of selected request information and the request body [see `SIGNATURE_HEADERS`
+in `oauthproxy.go`](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/oauthproxy.go).
+
+`signature_key` must be of the form `algorithm:secretkey`, (ie: `signature_key = "sha1:secret0"`)
+
+For more information about HMAC request signature validation, read the
+following:
+
+- [Amazon Web Services: Signing and Authenticating REST
+  Requests](https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html)
+- [rc3.org: Using HMAC to authenticate Web service
+  requests](http://rc3.org/2011/12/02/using-hmac-to-authenticate-web-service-requests/)

docs/versioned_docs/version-6.1.x/installation.md

@@ -0,0 +1,24 @@
+---
+id: installation
+title: Installation
+slug: /
+---
+
+1.  Choose how to deploy:
+
+    a. Download [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v6.1.1`)
+
+    b. Build with `$ go get github.com/oauth2-proxy/oauth2-proxy` which will put the binary in `$GOPATH/bin`
+
+    c. Using the prebuilt docker image [quay.io/oauth2-proxy/oauth2-proxy](https://quay.io/oauth2-proxy/oauth2-proxy) (AMD64, ARMv6 and ARM64 tags available)
+
+Prebuilt binaries can be validated by extracting the file and verifying it against the `sha256sum.txt` checksum file provided for each release starting with version `v3.0.0`.
+
+```
+$ sha256sum -c sha256sum.txt 2>&1 | grep OK
+oauth2-proxy-x.y.z.linux-amd64: OK
+```
+
+2.  [Select a Provider and Register an OAuth Application with a Provider](configuration/auth.md)
+3.  [Configure OAuth2 Proxy using config file, command line options, or environment variables](configuration/overview.md)
+4.  [Configure SSL or Deploy behind a SSL endpoint](configuration/tls.md) (example provided for Nginx)

docs/versioned_docs/version-7.0.x/behaviour.md

@@ -0,0 +1,11 @@
+---
+id: behaviour
+title: Behaviour
+---
+
+1. Any request passing through the proxy (and not matched by `--skip-auth-regex`) is checked for the proxy's session cookie (`--cookie-name`) (or, if allowed, a JWT token - see `--skip-jwt-bearer-tokens`).
+2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with `Accept: application/json`, in which case 401 Unauthorized is returned)
+3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
+4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)
+
+Notice that the proxy also provides a number of useful [endpoints](features/endpoints.md).

docs/versioned_docs/version-7.0.x/community/security.md

@@ -0,0 +1,49 @@
+---
+id: security
+title: Security
+---
+
+:::note
+OAuth2 Proxy is a community project.
+Maintainers do not work on this project full time, and as such,
+while we endeavour to respond to disclosures as quickly as possible,
+this may take longer than in projects with corporate sponsorship.
+:::
+
+## Security Disclosures
+
+:::important
+If you believe you have found a vulnerability within OAuth2 Proxy or any of its
+dependencies, please do NOT open an issue or PR on GitHub, please do NOT post
+any details publicly.
+:::
+
+Security disclosures MUST be done in private.
+If you have found an issue that you would like to bring to the attention of the
+maintenance team for OAuth2 Proxy, please compose an email and send it to the
+list of maintainers in our [MAINTAINERS](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/MAINTAINERS) file.
+
+Please include as much detail as possible.
+Ideally, your disclosure should include:
+- A reproducible case that can be used to demonstrate the exploit
+- How you discovered this vulnerability
+- A potential fix for the issue (if you have thought of one)
+- Versions affected (if not present in master)
+- Your GitHub ID
+
+### How will we respond to disclosures?
+
+We use [GitHub Security Advisories](https://docs.github.com/en/github/managing-security-vulnerabilities/about-github-security-advisories)
+to privately discuss fixes for disclosed vulnerabilities.
+If you include a GitHub ID with your disclosure we will add you as a collaborator
+for the advisory so that you can join the discussion and validate any fixes
+we may propose.
+
+For minor issues and previously disclosed vulnerabilities (typically for
+dependencies), we may use regular PRs for fixes and forego the security advisory.
+
+Once a fix has been agreed upon, we will merge the fix and create a new release.
+If we have multiple security issues in flight simultaneously, we may delay
+merging fixes until all patches are ready.
+We may also backport the fix to previous releases,
+but this will be at the discretion of the maintainers.

docs/versioned_docs/version-7.0.x/configuration/alpha_config.md

@@ -0,0 +1,212 @@
+---
+id: alpha-config
+title: Alpha Configuration
+---
+
+:::warning
+This page contains documentation for alpha features.
+We reserve the right to make breaking changes to the features detailed within this page with no notice.
+
+Options described in this page may be changed, removed, renamed or moved without prior warning.
+Please beware of this before you use alpha configuration options.
+:::
+
+This page details a set of **alpha** configuration options in a new format.
+Going forward we are intending to add structured configuration in YAML format to
+replace the existing TOML based configuration file and flags.
+
+Below is a reference for the structure of the configuration, with
+[AlphaOptions](#alphaoptions) as the root of the configuration.
+
+When using alpha configuration, your config file will look something like below:
+
+```yaml
+upstreams:
+  - id: ...
+    ...
+injectRequestHeaders:
+  - name: ...
+    ...
+injectResponseHeaders:
+  - name: ...
+    ...
+```
+
+Please browse the [reference](#configuration-reference) below for the structure
+of the new configuration format.
+
+## Using Alpha Configuration
+
+To use the new **alpha** configuration, generate a YAML file based on the format
+described in the [reference](#configuration-reference) below.
+
+Provide the path to this file using the `--alpha-config` flag.
+
+:::note
+When using the `--alpha-config` flag, some options are no longer available.
+See [removed options](#removed-options) below for more information.
+:::
+
+### Converting configuration to the new structure
+
+Before adding the new `--alpha-config` option, start OAuth2 Proxy using the
+`convert-config-to-alpha` flag to convert existing configuration to the new format.
+
+```bash
+oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg
+```
+
+This will convert any options supported by the new format to YAML and print the
+new configuration to `STDOUT`.
+
+Copy this to a new file, remove any options from your existing configuration
+noted in [removed options](#removed-options) and then start OAuth2 Proxy using
+the new config.
+
+```bash
+oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg
+```
+
+## Removed options
+
+The following flags/options and their respective environment variables are no
+longer available when using alpha configuration:
+
+<!-- Legacy Upstream FlagSet -->
+- `flush-interval`/`flush_interval`
+- `pass-host-header`/`pass_host_header`
+- `proxy-websockets`/`proxy_websockets`
+- `ssl-upstream-insecure-skip-verify`/`ssl_upstream_insecure_skip_verify`
+- `upstream`/`upstreams`
+
+<!-- Legacy Headers FlagSet -->
+- `pass-basic-auth`/`pass_basic_auth`
+- `pass-access-token`/`pass_access_token`
+- `pass-user-headers`/`pass_user_headers`
+- `pass-authorization-header`/`pass_authorization_header`
+- `set-basic-auth`/`set_basic_auth`
+- `set-xauthrequest`/`set_xauthrequest`
+- `set-authorization-header`/`set_authorization_header`
+- `prefer-email-to-user`/`prefer_email_to_user`
+- `basic-auth-password`/`basic_auth_password`
+- `skip-auth-strip-headers`/`skip_auth_strip_headers`
+
+Attempting to use these options via flags or via config when `--alpha-config`
+set will result in an error.
+
+:::important
+You must remove these options before starting OAuth2 Proxy with `--alpha-config`
+:::
+
+## Configuration Reference
+<!--- THIS FILE IS AUTOGENERATED!!! DO NOT EDIT!!! -->
+
+### AlphaOptions
+
+AlphaOptions contains alpha structured configuration options.
+Usage of these options allows users to access alpha features that are not
+available as part of the primary configuration structure for OAuth2 Proxy.
+
+:::warning
+The options within this structure are considered alpha.
+They may change between releases without notice.
+:::
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `upstreams` | _[Upstreams](#upstreams)_ | Upstreams is used to configure upstream servers.<br/>Once a user is authenticated, requests to the server will be proxied to<br/>these upstream servers based on the path mappings defined in this list. |
+| `injectRequestHeaders` | _[[]Header](#header)_ | InjectRequestHeaders is used to configure headers that should be added<br/>to requests to upstream servers.<br/>Headers may source values from either the authenticated user's session<br/>or from a static secret value. |
+| `injectResponseHeaders` | _[[]Header](#header)_ | InjectResponseHeaders is used to configure headers that should be added<br/>to responses from the proxy.<br/>This is typically used when using the proxy as an external authentication<br/>provider in conjunction with another proxy such as NGINX and its<br/>auth_request module.<br/>Headers may source values from either the authenticated user's session<br/>or from a static secret value. |
+
+### ClaimSource
+
+(**Appears on:** [HeaderValue](#headervalue))
+
+ClaimSource allows loading a header value from a claim within the session
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `claim` | _string_ | Claim is the name of the claim in the session that the value should be<br/>loaded from. |
+| `prefix` | _string_ | Prefix is an optional prefix that will be prepended to the value of the<br/>claim if it is non-empty. |
+| `basicAuthPassword` | _[SecretSource](#secretsource)_ | BasicAuthPassword converts this claim into a basic auth header.<br/>Note the value of claim will become the basic auth username and the<br/>basicAuthPassword will be used as the password value. |
+
+### Duration
+#### (`string` alias)
+
+(**Appears on:** [Upstream](#upstream))
+
+Duration is as string representation of a period of time.
+A duration string is a is a possibly signed sequence of decimal numbers,
+each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".
+Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
+
+
+### Header
+
+(**Appears on:** [AlphaOptions](#alphaoptions))
+
+Header represents an individual header that will be added to a request or
+response header.
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `name` | _string_ | Name is the header name to be used for this set of values.<br/>Names should be unique within a list of Headers. |
+| `preserveRequestValue` | _bool_ | PreserveRequestValue determines whether any values for this header<br/>should be preserved for the request to the upstream server.<br/>This option only takes effet on injected request headers.<br/>Defaults to false (headers that match this header will be stripped). |
+| `values` | _[[]HeaderValue](#headervalue)_ | Values contains the desired values for this header |
+
+### HeaderValue
+
+(**Appears on:** [Header](#header))
+
+HeaderValue represents a single header value and the sources that can
+make up the header value
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `value` | _[]byte_ | Value expects a base64 encoded string value. |
+| `fromEnv` | _string_ | FromEnv expects the name of an environment variable. |
+| `fromFile` | _string_ | FromFile expects a path to a file containing the secret value. |
+| `claim` | _string_ | Claim is the name of the claim in the session that the value should be<br/>loaded from. |
+| `prefix` | _string_ | Prefix is an optional prefix that will be prepended to the value of the<br/>claim if it is non-empty. |
+| `basicAuthPassword` | _[SecretSource](#secretsource)_ | BasicAuthPassword converts this claim into a basic auth header.<br/>Note the value of claim will become the basic auth username and the<br/>basicAuthPassword will be used as the password value. |
+
+### SecretSource
+
+(**Appears on:** [ClaimSource](#claimsource), [HeaderValue](#headervalue))
+
+SecretSource references an individual secret value.
+Only one source within the struct should be defined at any time.
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `value` | _[]byte_ | Value expects a base64 encoded string value. |
+| `fromEnv` | _string_ | FromEnv expects the name of an environment variable. |
+| `fromFile` | _string_ | FromFile expects a path to a file containing the secret value. |
+
+### Upstream
+
+(**Appears on:** [Upstreams](#upstreams))
+
+Upstream represents the configuration for an upstream server.
+Requests will be proxied to this upstream if the path matches the request path.
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `id` | _string_ | ID should be a unique identifier for the upstream.<br/>This value is required for all upstreams. |
+| `path` | _string_ | Path is used to map requests to the upstream server.<br/>The closest match will take precedence and all Paths must be unique. |
+| `uri` | _string_ | The URI of the upstream server. This may be an HTTP(S) server of a File<br/>based URL. It may include a path, in which case all requests will be served<br/>under that path.<br/>Eg:<br/>- http://localhost:8080<br/>- https://service.localhost<br/>- https://service.localhost/path<br/>- file://host/path<br/>If the URI's path is "/base" and the incoming request was for "/dir",<br/>the upstream request will be for "/base/dir". |
+| `insecureSkipTLSVerify` | _bool_ | InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.<br/>This option is insecure and will allow potential Man-In-The-Middle attacks<br/>betweem OAuth2 Proxy and the usptream server.<br/>Defaults to false. |
+| `static` | _bool_ | Static will make all requests to this upstream have a static response.<br/>The response will have a body of "Authenticated" and a response code<br/>matching StaticCode.<br/>If StaticCode is not set, the response will return a 200 response. |
+| `staticCode` | _int_ | StaticCode determines the response code for the Static response.<br/>This option can only be used with Static enabled. |
+| `flushInterval` | _[Duration](#duration)_ | FlushInterval is the period between flushing the response buffer when<br/>streaming response from the upstream.<br/>Defaults to 1 second. |
+| `passHostHeader` | _bool_ | PassHostHeader determines whether the request host header should be proxied<br/>to the upstream server.<br/>Defaults to true. |
+| `proxyWebSockets` | _bool_ | ProxyWebSockets enables proxying of websockets to upstream servers<br/>Defaults to true. |
+
+### Upstreams
+
+#### ([[]Upstream](#upstream) alias)
+
+(**Appears on:** [AlphaOptions](#alphaoptions))
+
+Upstreams is a collection of definitions for upstream servers.
+