"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[3782],{3905:function(e,t,o){o.d(t,{Zo:function(){return c},kt:function(){return h}});var a=o(7294);function n(e,t,o){return t in e?Object.defineProperty(e,t,{value:o,enumerable:!0,configurable:!0,writable:!0}):e[t]=o,e}function r(e,t){var o=Object.keys(e);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);t&&(a=a.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),o.push.apply(o,a)}return o}function i(e){for(var t=1;t<arguments.length;t++){var o=null!=arguments[t]?arguments[t]:{};t%2?r(Object(o),!0).forEach((function(t){n(e,t,o[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(o)):r(Object(o)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(o,t))}))}return e}function l(e,t){if(null==e)return{};var o,a,n=function(e,t){if(null==e)return{};var o,a,n={},r=Object.keys(e);for(a=0;a<r.length;a++)o=r[a],t.indexOf(o)>=0||(n[o]=e[o]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(a=0;a<r.length;a++)o=r[a],t.indexOf(o)>=0||Object.prototype.propertyIsEnumerable.call(e,o)&&(n[o]=e[o])}return n}var p=a.createContext({}),s=function(e){var t=a.useContext(p),o=t;return e&&(o="function"==typeof e?e(t):i(i({},t),e)),o},c=function(e){var t=s(e.components);return a.createElement(p.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return a.createElement(a.Fragment,{},t)}},d=a.forwardRef((function(e,t){var o=e.components,n=e.mdxType,r=e.originalType,p=e.parentName,c=l(e,["components","mdxType","originalType","parentName"]),d=s(o),h=n,m=d["".concat(p,".").concat(h)]||d[h]||u[h]||r;return o?a.createElement(m,i(i({ref:t},c),{},{components:o})):a.createElement(m,i({ref:t},c))}));function h(e,t){var o=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var r=o.length,i=new Array(r);i[0]=d;var l={};for(var p in t)hasOwnProperty.call(t,p)&&(l[p]=t[p]);l.originalType=e,l.mdxType="string"==typeof e?e:n,i[1]=l;for(var s=2;s<r;s++)i[s]=o[s];return a.createElement.apply(null,i)}return a.createElement.apply(null,o)}d.displayName="MDXCreateElement"},861:function(e,t,o){o.r(t),o.d(t,{frontMatter:function(){return l},contentTitle:function(){return p},metadata:function(){return s},toc:function(){return c},default:function(){return d}});var a=o(7462),n=o(3366),r=(o(7294),o(3905)),i=["components"],l={id:"oauth_provider",title:"OAuth Provider Configuration"},p=void 0,s={unversionedId:"configuration/oauth_provider",id:"version-7.2.x/configuration/oauth_provider",title:"OAuth Provider Configuration",description:"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on.",source:"@site/versioned_docs/version-7.2.x/configuration/auth.md",sourceDirName:"configuration",slug:"/configuration/oauth_provider",permalink:"/oauth2-proxy/docs/7.2.x/configuration/oauth_provider",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.2.x/configuration/auth.md",tags:[],version:"7.2.x",frontMatter:{id:"oauth_provider",title:"OAuth Provider Configuration"},sidebar:"version-7.2.x/docs",previous:{title:"Overview",permalink:"/oauth2-proxy/docs/7.2.x/configuration/overview"},next:{title:"Session Storage",permalink:"/oauth2-proxy/docs/7.2.x/configuration/session_storage"}},c=[{value:"Google Auth Provider",id:"google-auth-provider",children:[{value:"Restrict auth to specific Google groups on your domain. (optional)",id:"restrict-auth-to-specific-google-groups-on-your-domain-optional",children:[],level:4}],level:3},{value:"Azure Auth Provider",id:"azure-auth-provider",children:[],level:3},{value:"ADFS Auth Provider",id:"adfs-auth-provider",children:[],level:3},{value:"Facebook Auth Provider",id:"facebook-auth-provider",children:[],level:3},{value:"GitHub Auth Provider",id:"github-auth-provider",children:[],level:3},{value:"Keycloak Auth Provider",id:"keycloak-auth-provider",children:[],level:3},{value:"Keycloak OIDC Auth Provider",id:"keycloak-oidc-auth-provider",children:[],level:3},{value:"GitLab Auth Provider",id:"gitlab-auth-provider",children:[],level:3},{value:"LinkedIn Auth Provider",id:"linkedin-auth-provider",children:[],level:3},{value:"OpenID Connect Provider",id:"openid-connect-provider",children:[{value:"Dex",id:"dex",children:[],level:4},{value:"Okta",id:"okta",children:[],level:4},{value:"Okta - localhost",id:"okta---localhost",children:[],level:4}],level:3},{value:"login.gov Provider",id:"logingov-provider",children:[{value:"Skip OIDC discovery",id:"skip-oidc-discovery",children:[],level:4}],level:3},{value:"Nextcloud Provider",id:"nextcloud-provider",children:[],level:3},{value:"DigitalOcean Auth Provider",id:"digitalocean-auth-provider",children:[],level:3},{value:"Bitbucket Auth Provider",id:"bitbucket-auth-provider",children:[],level:3},{value:"Gitea Auth Provider",id:"gitea-auth-provider",children:[],level:3},{value:"Email Authentication",id:"email-authentication",children:[],level:2},{value:"Adding a new Provider",id:"adding-a-new-provider",children:[],level:2}],u={toc:c};function d(e){var t=e.components,o=(0,n.Z)(e,i);return(0,r.kt)("wrapper",(0,a.Z)({},u,o,{components:t,mdxType:"MDXLayout"}),(0,r.kt)("p",null,"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run ",(0,r.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," on."),(0,r.kt)("p",null,"Valid providers are :"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#google-auth-provider"},"Google")," ",(0,r.kt)("em",{parentName:"li"},"default")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#azure-auth-provider"},"Azure")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#adfs-auth-provider"},"ADFS")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#facebook-auth-provider"},"Facebook")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#github-auth-provider"},"GitHub")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#keycloak-auth-provider"},"Keycloak")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#gitlab-auth-provider"},"GitLab")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#linkedin-auth-provider"},"LinkedIn")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#openid-connect-provider"},"OpenID Connect")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#logingov-provider"},"login.gov")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#nextcloud-provider"},"Nextcloud")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#digitalocean-auth-provider"},"DigitalOcean")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#bitbucket-auth-provider"},"Bitbucket")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"#gitea-auth-provider"},"Gitea"))),(0,r.kt)("p",null,"The provider can be selected using the ",(0,r.kt)("inlineCode",{parentName:"p"},"provider")," configuration value."),(0,r.kt)("p",null,"Please note that not all providers support all claims. The ",(0,r.kt)("inlineCode",{parentName:"p"},"preferred_username")," claim is currently only supported by the OpenID Connect provider."),(0,r.kt)("h3",{id:"google-auth-provider"},"Google Auth Provider"),(0,r.kt)("p",null,"For Google, the registration steps are:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://console.developers.google.com/project"},"https://console.developers.google.com/project")),(0,r.kt)("li",{parentName:"ol"},"Choose the new project from the top right project dropdown (only if another project is selected)"),(0,r.kt)("li",{parentName:"ol"},"In the project Dashboard center pane, choose ",(0,r.kt)("strong",{parentName:"li"},'"API Manager"')),(0,r.kt)("li",{parentName:"ol"},"In the left Nav pane, choose ",(0,r.kt)("strong",{parentName:"li"},'"Credentials"')),(0,r.kt)("li",{parentName:"ol"},"In the center pane, choose ",(0,r.kt)("strong",{parentName:"li"},'"OAuth consent screen"')," tab. Fill in ",(0,r.kt)("strong",{parentName:"li"},'"Product name shown to users"')," and hit save."),(0,r.kt)("li",{parentName:"ol"},"In the center pane, choose ",(0,r.kt)("strong",{parentName:"li"},'"Credentials"')," tab.",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"Open the ",(0,r.kt)("strong",{parentName:"li"},'"New credentials"')," drop down"),(0,r.kt)("li",{parentName:"ul"},"Choose ",(0,r.kt)("strong",{parentName:"li"},'"OAuth client ID"')),(0,r.kt)("li",{parentName:"ul"},"Choose ",(0,r.kt)("strong",{parentName:"li"},'"Web application"')),(0,r.kt)("li",{parentName:"ul"},"Application name is freeform, choose something appropriate"),(0,r.kt)("li",{parentName:"ul"},"Authorized JavaScript origins is your domain ex: ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com")),(0,r.kt)("li",{parentName:"ul"},"Authorized redirect URIs is the location of oauth2/callback ex: ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")),(0,r.kt)("li",{parentName:"ul"},"Choose ",(0,r.kt)("strong",{parentName:"li"},'"Create"')))),(0,r.kt)("li",{parentName:"ol"},"Take note of the ",(0,r.kt)("strong",{parentName:"li"},"Client ID")," and ",(0,r.kt)("strong",{parentName:"li"},"Client Secret"))),(0,r.kt)("p",null,"It's recommended to refresh sessions on a short interval (1h) with ",(0,r.kt)("inlineCode",{parentName:"p"},"cookie-refresh")," setting which validates that the account is still authorized."),(0,r.kt)("h4",{id:"restrict-auth-to-specific-google-groups-on-your-domain-optional"},"Restrict auth to specific Google groups on your domain. (optional)"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a service account: ",(0,r.kt)("a",{parentName:"li",href:"https://developers.google.com/identity/protocols/OAuth2ServiceAccount"},"https://developers.google.com/identity/protocols/OAuth2ServiceAccount")," and make sure to download the json file."),(0,r.kt)("li",{parentName:"ol"},"Make note of the Client ID for a future step."),(0,r.kt)("li",{parentName:"ol"},'Under "APIs & Auth", choose APIs.'),(0,r.kt)("li",{parentName:"ol"},"Click on Admin SDK and then Enable API."),(0,r.kt)("li",{parentName:"ol"},"Follow the steps on ",(0,r.kt)("a",{parentName:"li",href:"https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account"},"https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account")," and give the client id from step 2 the following oauth scopes:")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},"https://www.googleapis.com/auth/admin.directory.group.readonly\nhttps://www.googleapis.com/auth/admin.directory.user.readonly\n")),(0,r.kt)("ol",{start:6},(0,r.kt)("li",{parentName:"ol"},"Follow the steps on ",(0,r.kt)("a",{parentName:"li",href:"https://support.google.com/a/answer/60757"},"https://support.google.com/a/answer/60757")," to enable Admin API access."),(0,r.kt)("li",{parentName:"ol"},"Create or choose an existing administrative email address on the Gmail domain to assign to the ",(0,r.kt)("inlineCode",{parentName:"li"},"google-admin-email")," flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why."),(0,r.kt)("li",{parentName:"ol"},"Create or choose an existing email group and set that email to the ",(0,r.kt)("inlineCode",{parentName:"li"},"google-group")," flag. You can pass multiple instances of this flag with different groups\nand the user will be checked against all the provided groups."),(0,r.kt)("li",{parentName:"ol"},"Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the ",(0,r.kt)("inlineCode",{parentName:"li"},"google-service-account-json")," flag."),(0,r.kt)("li",{parentName:"ol"},"Restart oauth2-proxy.")),(0,r.kt)("p",null,"Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour )."),(0,r.kt)("h3",{id:"azure-auth-provider"},"Azure Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Add an application: go to ",(0,r.kt)("a",{parentName:"li",href:"https://portal.azure.com"},"https://portal.azure.com"),", choose ",(0,r.kt)("strong",{parentName:"li"},'"Azure Active Directory"')," in the left menu, select ",(0,r.kt)("strong",{parentName:"li"},'"App registrations"')," and then click on ",(0,r.kt)("strong",{parentName:"li"},'"New app registration"'),"."),(0,r.kt)("li",{parentName:"ol"},"Pick a name and choose ",(0,r.kt)("strong",{parentName:"li"},'"Webapp / API"')," as application type. Use ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com")," as Sign-on URL. Click ",(0,r.kt)("strong",{parentName:"li"},'"Create"'),"."),(0,r.kt)("li",{parentName:"ol"},"On the ",(0,r.kt)("strong",{parentName:"li"},'"Settings"')," / ",(0,r.kt)("strong",{parentName:"li"},'"Properties"')," page of the app, pick a logo and select ",(0,r.kt)("strong",{parentName:"li"},'"Multi-tenanted"')," if you want to allow users from multiple organizations to access your app. Note down the application ID. Click ",(0,r.kt)("strong",{parentName:"li"},'"Save"'),"."),(0,r.kt)("li",{parentName:"ol"},"On the ",(0,r.kt)("strong",{parentName:"li"},'"Settings"')," / ",(0,r.kt)("strong",{parentName:"li"},'"Required Permissions"')," page of the app, click on ",(0,r.kt)("strong",{parentName:"li"},'"Windows Azure Active Directory"')," and then on ",(0,r.kt)("strong",{parentName:"li"},'"Access the directory as the signed in user"'),". Hit ",(0,r.kt)("strong",{parentName:"li"},'"Save"')," and then then on ",(0,r.kt)("strong",{parentName:"li"},'"Grant permissions"')," (you might need another admin to do this)."),(0,r.kt)("li",{parentName:"ol"},"On the ",(0,r.kt)("strong",{parentName:"li"},'"Settings"')," / ",(0,r.kt)("strong",{parentName:"li"},'"Reply URLs"')," page of the app, add ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompanycom/oauth2/callback")," for each host that you want to protect by the oauth2 proxy. Click ",(0,r.kt)("strong",{parentName:"li"},'"Save"'),"."),(0,r.kt)("li",{parentName:"ol"},"On the ",(0,r.kt)("strong",{parentName:"li"},'"Settings"')," / ",(0,r.kt)("strong",{parentName:"li"},'"Keys"')," page of the app, add a new key and note down the value after hitting ",(0,r.kt)("strong",{parentName:"li"},'"Save"'),"."),(0,r.kt)("li",{parentName:"ol"},"Configure the proxy with")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},"   --provider=azure\n   --client-id=<application ID from step 3>\n   --client-secret=<value from step 6>\n   --oidc-issuer-url=https://sts.windows.net/{tenant-id}/\n")),(0,r.kt)("p",null,"Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the ",(0,r.kt)("inlineCode",{parentName:"p"},"proxy_buffer_size")," in nginx or implementing the ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/7.2.x/configuration/session_storage#redis-storage"},"redis session storage")," should resolve this."),(0,r.kt)("h3",{id:"adfs-auth-provider"},"ADFS Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Open the ADFS administration console on your Windows Server and add a new Application Group"),(0,r.kt)("li",{parentName:"ol"},"Provide a name for the integration, select Server Application from the Standalone applications section and click Next"),(0,r.kt)("li",{parentName:"ol"},"Follow the wizard to get the client-id, client-secret and configure the application credentials"),(0,r.kt)("li",{parentName:"ol"},"Configure the proxy with")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},"   --provider=adfs\n   --client-id=<application ID from step 3>\n   --client-secret=<value from step 3>\n")),(0,r.kt)("p",null,"Note: When using the ADFS Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/7.2.x/configuration/session_storage#redis-storage"},"redis session storage")," should resolve this."),(0,r.kt)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new FB App from ",(0,r.kt)("a",{parentName:"li",href:"https://developers.facebook.com/"},"https://developers.facebook.com/")),(0,r.kt)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),(0,r.kt)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://github.com/settings/developers"},"https://github.com/settings/developers")),(0,r.kt)("li",{parentName:"ol"},"Under ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),(0,r.kt)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=*")),(0,r.kt)("p",null,"NOTE: When ",(0,r.kt)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),(0,r.kt)("p",null,"To restrict by organization only, include the following flag:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-org="": restrict logins to members of this organisation\n')),(0,r.kt)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",(0,r.kt)("inlineCode",{parentName:"p"},"-github-org"),":"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),(0,r.kt)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),(0,r.kt)("p",null,"If you'd like to allow access to users with ",(0,r.kt)("strong",{parentName:"p"},"read only")," access to a ",(0,r.kt)("strong",{parentName:"p"},"public")," repository you will need to provide a ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/settings/tokens"},"token")," for a user that has write access to the repository. The token must be created with at least the ",(0,r.kt)("inlineCode",{parentName:"p"},"public_repo")," scope:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-token="": the token to use when verifying repository collaborators\n')),(0,r.kt)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-user="": allow logins by username, separated by a comma\n')),(0,r.kt)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-login-url="http(s)://<enterprise github host>/login/oauth/authorize"\n-redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"\n-validate-url="http(s)://<enterprise github host>/api/v3"\n')),(0,r.kt)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),(0,r.kt)("div",{className:"admonition admonition-note alert alert--secondary"},(0,r.kt)("div",{parentName:"div",className:"admonition-heading"},(0,r.kt)("h5",{parentName:"div"},(0,r.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,r.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,r.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"}))),"note")),(0,r.kt)("div",{parentName:"div",className:"admonition-content"},(0,r.kt)("p",{parentName:"div"},"This is the legacy provider for Keycloak, use ",(0,r.kt)("a",{parentName:"p",href:"#keycloak-oidc-auth-provider"},"Keycloak OIDC Auth Provider")," if possible."))),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",(0,r.kt)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",(0,r.kt)("strong",{parentName:"li"},"Valid Redirect URIs")," '",(0,r.kt)("a",{parentName:"li",href:"https://internal.yourcompany.com/oauth2/callback'"},"https://internal.yourcompany.com/oauth2/callback'")),(0,r.kt)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",(0,r.kt)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),(0,r.kt)("p",null,"Make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'    --provider=keycloak\n    --client-id=<client you have created>\n    --client-secret=<your client\'s secret>\n    --login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"\n    --redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"\n    --profile-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"\n    --validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"\n    --keycloak-group=<first_allowed_user_group>\n    --keycloak-group=<second_allowed_user_group>\n')),(0,r.kt)("p",null,"For group based authorization, the optional ",(0,r.kt)("inlineCode",{parentName:"p"},"--keycloak-group")," (legacy) or ",(0,r.kt)("inlineCode",{parentName:"p"},"--allowed-group")," (global standard)\nflags can be used to specify which groups to limit access to."),(0,r.kt)("p",null,"If these are unset but a ",(0,r.kt)("inlineCode",{parentName:"p"},"groups")," mapper is set up above in step (3), the provider will still\npopulate the ",(0,r.kt)("inlineCode",{parentName:"p"},"X-Forwarded-Groups")," header to your upstream server with the ",(0,r.kt)("inlineCode",{parentName:"p"},"groups")," data in the\nKeycloak userinfo endpoint response."),(0,r.kt)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak\nyou should define the 'keycloak-group' value to /admin."),(0,r.kt)("h3",{id:"keycloak-oidc-auth-provider"},"Keycloak OIDC Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",(0,r.kt)("strong",{parentName:"li"},"Access Type")," 'confidental', ",(0,r.kt)("strong",{parentName:"li"},"Client protocol"),"  'openid-connect' and ",(0,r.kt)("strong",{parentName:"li"},"Valid Redirect URIs")," '",(0,r.kt)("a",{parentName:"li",href:"https://internal.yourcompany.com/oauth2/callback'"},"https://internal.yourcompany.com/oauth2/callback'")),(0,r.kt)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",(0,r.kt)("strong",{parentName:"li"},"Token Claim Name")," 'groups'."),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Audience' and ",(0,r.kt)("strong",{parentName:"li"},"Included Client Audience")," and ",(0,r.kt)("strong",{parentName:"li"},"Included Custom Audience")," set to your client name.")),(0,r.kt)("p",null,"Make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},"    --provider=keycloak-oidc\n    --client-id=<your client's id>\n    --client-secret=<your client's secret>\n    --redirect-url=https://myapp.com/oauth2/callback\n    --oidc-issuer-url=https://<keycloak host>/auth/realms/<your realm>\n    --allowed-role=<realm role name> // Optional, required realm role\n    --allowed-role=<client id>:<client role name> // Optional, required client role\n")),(0,r.kt)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),(0,r.kt)("p",null,"This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/issues/994"},"994"),")."),(0,r.kt)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",(0,r.kt)("a",{parentName:"p",href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"},"these steps to add an application"),". Make sure to enable at least the ",(0,r.kt)("inlineCode",{parentName:"p"},"openid"),", ",(0,r.kt)("inlineCode",{parentName:"p"},"profile")," and ",(0,r.kt)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",(0,r.kt)("a",{parentName:"p",href:"https://myapp.com/oauth2/callback"},"https://myapp.com/oauth2/callback"),"."),(0,r.kt)("p",null,"If you need projects filtering, add the extra ",(0,r.kt)("inlineCode",{parentName:"p"},"read_api")," scope to your application."),(0,r.kt)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/7.2.x/configuration/overview#generating-a-cookie-secret"},"these steps")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'    --provider="gitlab"\n    --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n    --client-id=GITLAB_CLIENT_ID\n    --client-secret=GITLAB_CLIENT_SECRET\n    --cookie-secret=COOKIE_SECRET\n')),(0,r.kt)("p",null,"Restricting by group membership is possible with the following option:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),(0,r.kt)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--oidc-issuer-url="<your gitlab url>"\n')),(0,r.kt)("p",null,"If your self-hosted GitLab is on a sub-directory (e.g. domain.tld/gitlab), as opposed to its own sub-domain (e.g. gitlab.domain.tld), you may need to add a redirect from domain.tld/oauth pointing at e.g. domain.tld/gitlab/oauth."),(0,r.kt)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),(0,r.kt)("p",null,"For LinkedIn, the registration steps are:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://www.linkedin.com/secure/developer"},"https://www.linkedin.com/secure/developer")),(0,r.kt)("li",{parentName:"ol"},"In the OAuth User Agreement section:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),(0,r.kt)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),(0,r.kt)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),(0,r.kt)("li",{parentName:"ol"},"Take note of the ",(0,r.kt)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",(0,r.kt)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),(0,r.kt)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),(0,r.kt)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."),(0,r.kt)("p",null,"This provider was originally built against CoreOS Dex and we will use it as an example.\nThe OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below."),(0,r.kt)("h4",{id:"dex"},"Dex"),(0,r.kt)("p",null,"To configure the OIDC provider for Dex, perform the following steps:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Download Dex:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"go get github.com/dexidp/dex\n")),(0,r.kt)("p",{parentName:"li"},"See the ",(0,r.kt)("a",{parentName:"p",href:"https://dexidp.io/docs/getting-started/"},"getting started guide")," for more details.")),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the ",(0,r.kt)("inlineCode",{parentName:"p"},"staticClients")," section of ",(0,r.kt)("inlineCode",{parentName:"p"},"examples/config-dev.yaml"),":"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"- id: oauth2-proxy\nredirectURIs:\n- 'http://127.0.0.1:4180/oauth2/callback'\nname: 'oauth2-proxy'\nsecret: proxy\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Launch Dex: from ",(0,r.kt)("inlineCode",{parentName:"p"},"$GOPATH/github.com/dexidp/dex"),", run:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"bin/dex serve examples/config-dev.yaml\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"In a second terminal, run the oauth2-proxy with the following args:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'-provider oidc\n-provider-display-name "My OIDC Provider"\n-client-id oauth2-proxy\n-client-secret proxy\n-redirect-url http://127.0.0.1:4180/oauth2/callback\n-oidc-issuer-url http://127.0.0.1:5556/dex\n-cookie-secure=false\n-cookie-secret=secret\n-email-domain kilgore.trout\n')),(0,r.kt)("p",{parentName:"li"},"To serve the current working directory as a web site under the ",(0,r.kt)("inlineCode",{parentName:"p"},"/static")," endpoint, add:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"-upstream file://$PWD/#/static/\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Test the setup by visiting ",(0,r.kt)("a",{parentName:"p",href:"http://127.0.0.1:4180"},"http://127.0.0.1:4180")," or ",(0,r.kt)("a",{parentName:"p",href:"http://127.0.0.1:4180/static"},"http://127.0.0.1:4180/static")," ."))),(0,r.kt)("p",null,"See also ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment"},"our local testing environment")," for a self-contained example using Docker and etcd as storage for Dex."),(0,r.kt)("h4",{id:"okta"},"Okta"),(0,r.kt)("p",null,"To configure the OIDC provider for Okta, perform the following steps:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",(0,r.kt)("inlineCode",{parentName:"li"},"example.oktapreview.com")),(0,r.kt)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",(0,r.kt)("inlineCode",{parentName:"li"},"default")," will work.")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Security")," then select ",(0,r.kt)("strong",{parentName:"li"},"API")),(0,r.kt)("li",{parentName:"ul"},"Click ",(0,r.kt)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),(0,r.kt)("li",{parentName:"ul"},"Fill out the ",(0,r.kt)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),(0,r.kt)("li",{parentName:"ul"},"For ",(0,r.kt)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",(0,r.kt)("a",{parentName:"li",href:"https://example.corp.com"},"https://example.corp.com")),(0,r.kt)("li",{parentName:"ul"},"Fill out a ",(0,r.kt)("strong",{parentName:"li"},"Description")),(0,r.kt)("li",{parentName:"ul"},"Add any ",(0,r.kt)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),(0,r.kt)("li",{parentName:"ul"},"The default settings will work for other options.\n",(0,r.kt)("a",{parentName:"li",href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"},"See Okta documentation for more information on Authorization Servers"))),(0,r.kt)("ol",{start:3},(0,r.kt)("li",{parentName:"ol"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Applications")," then select ",(0,r.kt)("strong",{parentName:"li"},"Add Application"),".")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Select ",(0,r.kt)("strong",{parentName:"li"},"Web")," for the ",(0,r.kt)("strong",{parentName:"li"},"Platform")," setting."),(0,r.kt)("li",{parentName:"ul"},"Select ",(0,r.kt)("strong",{parentName:"li"},"OpenID Connect")," and click ",(0,r.kt)("strong",{parentName:"li"},"Create")),(0,r.kt)("li",{parentName:"ul"},"Pick an ",(0,r.kt)("strong",{parentName:"li"},"Application Name")," such as ",(0,r.kt)("inlineCode",{parentName:"li"},"Example App"),"."),(0,r.kt)("li",{parentName:"ul"},"Set the ",(0,r.kt)("strong",{parentName:"li"},"Login redirect URI")," to ",(0,r.kt)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),(0,r.kt)("li",{parentName:"ul"},"Under ",(0,r.kt)("strong",{parentName:"li"},"General")," set the ",(0,r.kt)("strong",{parentName:"li"},"Allowed grant types")," to ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization Code")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Refresh Token"),"."),(0,r.kt)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",(0,r.kt)("inlineCode",{parentName:"li"},"Client ID")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Client Secret"),"."),(0,r.kt)("li",{parentName:"ul"},"Under ",(0,r.kt)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),(0,r.kt)("ol",{start:4},(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Create a configuration file like the following:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n    "https://example.corp.com"\n]\nemail_domains = [\n    "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')))),(0,r.kt)("p",null,"The ",(0,r.kt)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",(0,r.kt)("strong",{parentName:"p"},"Authorization Server"),"'s ",(0,r.kt)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",(0,r.kt)("a",{parentName:"p",href:"https://corp.okta.com"},"https://corp.okta.com")," .\nThe ",(0,r.kt)("inlineCode",{parentName:"p"},"client_id")," and ",(0,r.kt)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",(0,r.kt)("inlineCode",{parentName:"p"},"cookie_secret")," to encrypt the cookie."),(0,r.kt)("p",null,"Then you can start the oauth2-proxy with ",(0,r.kt)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),(0,r.kt)("h4",{id:"okta---localhost"},"Okta - localhost"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Signup for developer account: ",(0,r.kt)("a",{parentName:"li",href:"https://developer.okta.com/signup/"},"https://developer.okta.com/signup/")),(0,r.kt)("li",{parentName:"ol"},"Create New ",(0,r.kt)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),(0,r.kt)("li",{parentName:"ol"},"Example Application Settings for localhost:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Name:")," My Web App"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Group assignments:")," ",(0,r.kt)("inlineCode",{parentName:"li"},"Everyone")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Grant type allowed:")," ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization Code")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Refresh Token")))),(0,r.kt)("li",{parentName:"ol"},"Make note of the ",(0,r.kt)("inlineCode",{parentName:"li"},"Client ID")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),(0,r.kt)("li",{parentName:"ol"},"Make note of the ",(0,r.kt)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),(0,r.kt)("li",{parentName:"ol"},"Example config file ",(0,r.kt)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n    "http://0.0.0.0:8080"\n]\nemail_domains = [\n    "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),(0,r.kt)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",(0,r.kt)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),(0,r.kt)("h3",{id:"logingov-provider"},"login.gov Provider"),(0,r.kt)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",(0,r.kt)("a",{parentName:"p",href:"https://login.gov/developers/"},"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),(0,r.kt)("p",null,"A developer guide is available here: ",(0,r.kt)("a",{parentName:"p",href:"https://developers.login.gov/"},"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),(0,r.kt)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),(0,r.kt)("p",null,"First, register your application in the dashboard.  The important bits are:"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Identity protocol:  make this ",(0,r.kt)("inlineCode",{parentName:"li"},"Openid connect")),(0,r.kt)("li",{parentName:"ul"},"Issuer:  do what they say for OpenID Connect.  We will refer to this string as ",(0,r.kt)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),(0,r.kt)("li",{parentName:"ul"},"Public key:  This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",(0,r.kt)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",(0,r.kt)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",(0,r.kt)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),(0,r.kt)("li",{parentName:"ul"},"Return to App URL:  Make this be ",(0,r.kt)("inlineCode",{parentName:"li"},"http://localhost:4180/")),(0,r.kt)("li",{parentName:"ul"},"Redirect URIs:  Make this be ",(0,r.kt)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),(0,r.kt)("li",{parentName:"ul"},"Attribute Bundle:  Make sure that email is selected.")),(0,r.kt)("p",null,"Now start the proxy up with the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'./oauth2-proxy -provider login.gov \\\n  -client-id=${LOGINGOV_ISSUER} \\\n  -redirect-url=http://localhost:4180/oauth2/callback \\\n  -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n  -cookie-secure=false \\\n  -email-domain=gsa.gov \\\n  -upstream=http://localhost:3000/ \\\n  -cookie-secret=somerandomstring12341234567890AB \\\n  -cookie-domain=localhost \\\n  -skip-provider-button=true \\\n  -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n  -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n  -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),(0,r.kt)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",(0,r.kt)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",(0,r.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",(0,r.kt)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),(0,r.kt)("p",null,"Once it is running, you should be able to go to ",(0,r.kt)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",(0,r.kt)("inlineCode",{parentName:"p"},"http://localhost:3000/"),".  In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),(0,r.kt)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),(0,r.kt)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),(0,r.kt)("p",null,"In this case, you can set the ",(0,r.kt)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},"    -provider oidc\n    -client-id oauth2-proxy\n    -client-secret proxy\n    -redirect-url http://127.0.0.1:4180/oauth2/callback\n    -oidc-issuer-url http://127.0.0.1:5556\n    -skip-oidc-discovery\n    -login-url http://127.0.0.1:5556/authorize\n    -redeem-url http://127.0.0.1:5556/token\n    -oidc-jwks-url http://127.0.0.1:5556/keys\n    -cookie-secure=false\n    -email-domain example.com\n")),(0,r.kt)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),(0,r.kt)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),(0,r.kt)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",(0,r.kt)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",(0,r.kt)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),(0,r.kt)("p",null,"Refer to the ",(0,r.kt)("a",{parentName:"p",href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"},"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',(0,r.kt)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'    -provider nextcloud\n    -client-id <from nextcloud admin>\n    -client-secret <from nextcloud admin>\n    -login-url="<your nextcloud url>/index.php/apps/oauth2/authorize"\n    -redeem-url="<your nextcloud url>/index.php/apps/oauth2/api/v1/token"\n    -validate-url="<your nextcloud url>/ocs/v2.php/cloud/user?format=json"\n')),(0,r.kt)("p",null,"Note: in ",(0,r.kt)("em",{parentName:"p"},"all")," cases the validate-url will ",(0,r.kt)("em",{parentName:"p"},"not")," have the ",(0,r.kt)("inlineCode",{parentName:"p"},"index.php"),"."),(0,r.kt)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("a",{parentName:"li",href:"https://cloud.digitalocean.com/account/api/applications"},"Create a new OAuth application"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),(0,r.kt)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',(0,r.kt)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",(0,r.kt)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),(0,r.kt)("p",null,"To use the provider, pass the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},"   --provider=digitalocean\n   --client-id=<Client ID>\n   --client-secret=<Client Secret>\n")),(0,r.kt)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",(0,r.kt)("inlineCode",{parentName:"p"},"https://<requested host header>/oauth2/callback"),". If you need to change it, you can use the ",(0,r.kt)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),(0,r.kt)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("a",{parentName:"li",href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"},"Add a new OAuth consumer"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},'In "Callback URL" use ',(0,r.kt)("inlineCode",{parentName:"li"},"https://<oauth2-proxy>/oauth2/callback"),", substituting ",(0,r.kt)("inlineCode",{parentName:"li"},"<oauth2-proxy>")," with the actual hostname that oauth2-proxy is running on."),(0,r.kt)("li",{parentName:"ul"},"In Permissions section select:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"Account -> Email"),(0,r.kt)("li",{parentName:"ul"},"Team membership -> Read"),(0,r.kt)("li",{parentName:"ul"},"Repositories -> Read"))))),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),(0,r.kt)("p",null,"To use the provider, pass the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},"   --provider=bitbucket\n   --client-id=<Client ID>\n   --client-secret=<Client Secret>\n")),(0,r.kt)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",(0,r.kt)("inlineCode",{parentName:"p"},"--bitbucket-team=<Team name>"),". To restrict the access to only these users who has access to one selected repository use ",(0,r.kt)("inlineCode",{parentName:"p"},"--bitbucket-repository=<Repository name>"),"."),(0,r.kt)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new application: ",(0,r.kt)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),(0,r.kt)("li",{parentName:"ol"},"Under ",(0,r.kt)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",(0,r.kt)("inlineCode",{parentName:"li"},"https://<proxied host>/oauth2/callback")),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),(0,r.kt)("li",{parentName:"ol"},"Pass the following options to the proxy:")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'    --provider="github"\n    --redirect-url="https://<proxied host>/oauth2/callback"\n    --provider-display-name="Gitea"\n    --client-id="< client_id as generated by Gitea >"\n    --client-secret="< client_secret as generated by Gitea >"\n    --login-url="https://< your gitea host >/login/oauth/authorize"\n    --redeem-url="https://< your gitea host >/login/oauth/access_token"\n    --validate-url="https://< your gitea host >/api/v1"\n')),(0,r.kt)("h2",{id:"email-authentication"},"Email Authentication"),(0,r.kt)("p",null,"To authorize by email domain use ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",(0,r.kt)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),(0,r.kt)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),(0,r.kt)("p",null,"Follow the examples in the ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"},(0,r.kt)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",(0,r.kt)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",(0,r.kt)("inlineCode",{parentName:"p"},"case")," to\n",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"},(0,r.kt)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",(0,r.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",(0,r.kt)("inlineCode",{parentName:"p"},"Provider"),"."))}d.isMDXComponent=!0}}]);