mirror of
https://github.com/oauth2-proxy/oauth2-proxy.git
synced 2025-04-23 12:18:50 +02:00
68 lines
60 KiB
HTML
68 lines
60 KiB
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width,initial-scale=1">
|
|
<meta name="generator" content="Docusaurus v2.0.0-alpha.66">
|
|
<title data-react-helmet="true">OAuth Provider Configuration | OAuth2 Proxy</title><meta data-react-helmet="true" name="twitter:card" content="summary_large_image"><meta data-react-helmet="true" name="docusaurus_language" content="en"><meta data-react-helmet="true" name="docusaurus_version" content="current"><meta data-react-helmet="true" name="docusaurus_tag" content="docs-default-current"><meta data-react-helmet="true" property="og:title" content="OAuth Provider Configuration | OAuth2 Proxy"><meta data-react-helmet="true" name="description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><meta data-react-helmet="true" property="og:description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><meta data-react-helmet="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider"><link data-react-helmet="true" rel="shortcut icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-react-helmet="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider"><link rel="stylesheet" href="/oauth2-proxy/styles.29b02411.css">
|
|
<link rel="preload" href="/oauth2-proxy/styles.1b985414.js" as="script">
|
|
<link rel="preload" href="/oauth2-proxy/runtime~main.1fddb884.js" as="script">
|
|
<link rel="preload" href="/oauth2-proxy/main.08dca9ee.js" as="script">
|
|
<link rel="preload" href="/oauth2-proxy/1.6bac5299.js" as="script">
|
|
<link rel="preload" href="/oauth2-proxy/2.c97238d2.js" as="script">
|
|
<link rel="preload" href="/oauth2-proxy/16.7939b288.js" as="script">
|
|
<link rel="preload" href="/oauth2-proxy/18.088d12e8.js" as="script">
|
|
<link rel="preload" href="/oauth2-proxy/935f2afb.93f76895.js" as="script">
|
|
<link rel="preload" href="/oauth2-proxy/17896441.66eec2ae.js" as="script">
|
|
<link rel="preload" href="/oauth2-proxy/357fe94d.33b065b1.js" as="script">
|
|
</head>
|
|
<body>
|
|
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
|
|
<nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><div aria-label="Navigation bar toggle" class="navbar__toggle" role="button" tabindex="0"><svg xmlns="http://www.w3.org/2000/svg" width="30" height="30" viewBox="0 0 30 30" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></div><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub</a><div class="react-toggle react-toggle--disabled displayOnlyInLargeViewport_2aTZ"><div class="react-toggle-track"><div class="react-toggle-track-check"><span class="toggle_BsTx">🌜</span></div><div class="react-toggle-track-x"><span class="toggle_BsTx">🌞</span></div></div><div class="react-toggle-thumb"></div><input type="checkbox" disabled="" aria-label="Dark mode toggle" class="react-toggle-screenreader-only"></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div><div class="navbar-sidebar"><div class="navbar-sidebar__brand"><a class="navbar__brand" href="/oauth2-proxy/"><img class="navbar__logo" src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy"><strong class="navbar__title">OAuth2 Proxy</strong></a></div><div class="navbar-sidebar__items"><div class="menu"><ul class="menu__list"><li class="menu__list-item"><a aria-current="page" class="menu__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></li><li class="menu__list-item"><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="menu__link">GitHub</a></li></ul></div></div></div></nav><div class="main-wrapper"><div class="docPage_2gpo"><div class="docSidebarContainer_3_JD" role="complementary"><div class="sidebar_2urC"><div class="menu menu--responsive menu_5FrY"><button aria-label="Open Menu" aria-haspopup="true" class="button button--secondary button--sm menu__button" type="button"><svg aria-label="Menu" class="sidebarMenuIcon_Dm3K" xmlns="http://www.w3.org/2000/svg" height="24" width="24" viewBox="0 0 32 32" role="img" focusable="false"><title>Menu</title><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/">Installation</a></li><li class="menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/behaviour">Behaviour</a></li><li class="menu__list-item"><a class="menu__link menu__link--sublist menu__link--active" href="#!">Configuration</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/overview">Overview</a></li><li class="menu__list-item"><a aria-current="page" class="menu__link menu__link--active active" tabindex="0" href="/oauth2-proxy/docs/configuration/oauth_provider">OAuth Provider Configuration</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/session_storage">Session Storage</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/configuration/tls">TLS Configuration</a></li></ul></li><li class="menu__list-item"><a class="menu__link menu__link--sublist" href="#!">Features</a><ul class="menu__list"><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/features/endpoints">Endpoints</a></li><li class="menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/features/request_signatures">Request Signatures</a></li></ul></li></ul></div></div></div><main class="docMainContainer_3EyW"><div class="container padding-vert--lg docItemWrapper_1EkI"><div class="row"><div class="col docItemCol_2ASc"><div class="docItemContainer_3QWW"><article><header><h1 class="docTitle_1Lrw">OAuth Provider Configuration</h1></header><div class="markdown"><p>You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run <code>oauth2-proxy</code> on.</p><p>Valid providers are :</p><ul><li><a href="#google-auth-provider">Google</a> <em>default</em></li><li><a href="#azure-auth-provider">Azure</a></li><li><a href="#facebook-auth-provider">Facebook</a></li><li><a href="#github-auth-provider">GitHub</a></li><li><a href="#keycloak-auth-provider">Keycloak</a></li><li><a href="#gitlab-auth-provider">GitLab</a></li><li><a href="#linkedin-auth-provider">LinkedIn</a></li><li><a href="#microsoft-azure-ad-provider">Microsoft Azure AD</a></li><li><a href="#openid-connect-provider">OpenID Connect</a></li><li><a href="#logingov-provider">login.gov</a></li><li><a href="#nextcloud-provider">Nextcloud</a></li><li><a href="#digitalocean-auth-provider">DigitalOcean</a></li><li><a href="#bitbucket-auth-provider">Bitbucket</a></li><li><a href="#gitea-auth-provider">Gitea</a></li></ul><p>The provider can be selected using the <code>provider</code> configuration value.</p><p>Please note that not all providers support all claims. The <code>preferred_username</code> claim is currently only supported by the OpenID Connect provider.</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="google-auth-provider"></a>Google Auth Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#google-auth-provider" title="Direct link to heading">#</a></h3><p>For Google, the registration steps are:</p><ol><li>Create a new project: <a href="https://console.developers.google.com/project" target="_blank" rel="noopener noreferrer">https://console.developers.google.com/project</a></li><li>Choose the new project from the top right project dropdown (only if another project is selected)</li><li>In the project Dashboard center pane, choose <strong>"API Manager"</strong></li><li>In the left Nav pane, choose <strong>"Credentials"</strong></li><li>In the center pane, choose <strong>"OAuth consent screen"</strong> tab. Fill in <strong>"Product name shown to users"</strong> and hit save.</li><li>In the center pane, choose <strong>"Credentials"</strong> tab.<ul><li>Open the <strong>"New credentials"</strong> drop down</li><li>Choose <strong>"OAuth client ID"</strong></li><li>Choose <strong>"Web application"</strong></li><li>Application name is freeform, choose something appropriate</li><li>Authorized JavaScript origins is your domain ex: <code>https://internal.yourcompany.com</code></li><li>Authorized redirect URIs is the location of oauth2/callback ex: <code>https://internal.yourcompany.com/oauth2/callback</code></li><li>Choose <strong>"Create"</strong></li></ul></li><li>Take note of the <strong>Client ID</strong> and <strong>Client Secret</strong></li></ol><p>It's recommended to refresh sessions on a short interval (1h) with <code>cookie-refresh</code> setting which validates that the account is still authorized.</p><h4><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="restrict-auth-to-specific-google-groups-on-your-domain-optional"></a>Restrict auth to specific Google groups on your domain. (optional)<a aria-hidden="true" tabindex="-1" class="hash-link" href="#restrict-auth-to-specific-google-groups-on-your-domain-optional" title="Direct link to heading">#</a></h4><ol><li>Create a service account: <a href="https://developers.google.com/identity/protocols/OAuth2ServiceAccount" target="_blank" rel="noopener noreferrer">https://developers.google.com/identity/protocols/OAuth2ServiceAccount</a> and make sure to download the json file.</li><li>Make note of the Client ID for a future step.</li><li>Under "APIs & Auth", choose APIs.</li><li>Click on Admin SDK and then Enable API.</li><li>Follow the steps on <a href="https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account" target="_blank" rel="noopener noreferrer">https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account</a> and give the client id from step 2 the following oauth scopes:</li></ol><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">https://www.googleapis.com/auth/admin.directory.group.readonly</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">https://www.googleapis.com/auth/admin.directory.user.readonly</span></div></div></div></div></div><ol start="6"><li>Follow the steps on <a href="https://support.google.com/a/answer/60757" target="_blank" rel="noopener noreferrer">https://support.google.com/a/answer/60757</a> to enable Admin API access.</li><li>Create or choose an existing administrative email address on the Gmail domain to assign to the <code>google-admin-email</code> flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why.</li><li>Create or choose an existing email group and set that email to the <code>google-group</code> flag. You can pass multiple instances of this flag with different groups
|
|
and the user will be checked against all the provided groups.</li><li>Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the <code>google-service-account-json</code> flag.</li><li>Restart oauth2-proxy.</li></ol><p>Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour ).</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="azure-auth-provider"></a>Azure Auth Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#azure-auth-provider" title="Direct link to heading">#</a></h3><ol><li>Add an application: go to <a href="https://portal.azure.com" target="_blank" rel="noopener noreferrer">https://portal.azure.com</a>, choose <strong>"Azure Active Directory"</strong> in the left menu, select <strong>"App registrations"</strong> and then click on <strong>"New app registration"</strong>.</li><li>Pick a name and choose <strong>"Webapp / API"</strong> as application type. Use <code>https://internal.yourcompany.com</code> as Sign-on URL. Click <strong>"Create"</strong>.</li><li>On the <strong>"Settings"</strong> / <strong>"Properties"</strong> page of the app, pick a logo and select <strong>"Multi-tenanted"</strong> if you want to allow users from multiple organizations to access your app. Note down the application ID. Click <strong>"Save"</strong>.</li><li>On the <strong>"Settings"</strong> / <strong>"Required Permissions"</strong> page of the app, click on <strong>"Windows Azure Active Directory"</strong> and then on <strong>"Access the directory as the signed in user"</strong>. Hit <strong>"Save"</strong> and then then on <strong>"Grant permissions"</strong> (you might need another admin to do this).</li><li>On the <strong>"Settings"</strong> / <strong>"Reply URLs"</strong> page of the app, add <code>https://internal.yourcompanycom/oauth2/callback</code> for each host that you want to protect by the oauth2 proxy. Click <strong>"Save"</strong>.</li><li>On the <strong>"Settings"</strong> / <strong>"Keys"</strong> page of the app, add a new key and note down the value after hitting <strong>"Save"</strong>.</li><li>Configure the proxy with</li></ol><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --provider=azure</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-id=<application ID from step 3></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-secret=<value from step 6></span></div></div></div></div></div><p>Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the <a href="/oauth2-proxy/docs/configuration/session_storage#redis-storage">redis session storage</a> should resolve this.</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="facebook-auth-provider"></a>Facebook Auth Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#facebook-auth-provider" title="Direct link to heading">#</a></h3><ol><li>Create a new FB App from <a href="https://developers.facebook.com/" target="_blank" rel="noopener noreferrer">https://developers.facebook.com/</a></li><li>Under FB Login, set your Valid OAuth redirect URIs to <code>https://internal.yourcompany.com/oauth2/callback</code></li></ol><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="github-auth-provider"></a>GitHub Auth Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#github-auth-provider" title="Direct link to heading">#</a></h3><ol><li>Create a new project: <a href="https://github.com/settings/developers" target="_blank" rel="noopener noreferrer">https://github.com/settings/developers</a></li><li>Under <code>Authorization callback URL</code> enter the correct url ie <code>https://internal.yourcompany.com/oauth2/callback</code></li></ol><p>The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with <code>--email-domain=*</code></p><p>NOTE: When <code>--github-user</code> is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators.</p><p>To restrict by organization only, include the following flag:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">-github-org="": restrict logins to members of this organisation</span></div></div></div></div></div><p>To restrict within an organization to specific teams, include the following flag in addition to <code>-github-org</code>:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">-github-team="": restrict logins to members of any of these teams (slug), separated by a comma</span></div></div></div></div></div><p>If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo</span></div></div></div></div></div><p>If you'd like to allow access to users with <strong>read only</strong> access to a <strong>public</strong> repository you will need to provide a <a href="https://github.com/settings/tokens" target="_blank" rel="noopener noreferrer">token</a> for a user that has write access to the repository. The token must be created with at least the <code>public_repo</code> scope:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">-github-token="": the token to use when verifying repository collaborators</span></div></div></div></div></div><p>To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">-github-user="": allow logins by username, separated by a comma</span></div></div></div></div></div><p>If you are using GitHub enterprise, make sure you set the following to the appropriate url:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">-login-url="http(s)://<enterprise github host>/login/oauth/authorize"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">-redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">-validate-url="http(s)://<enterprise github host>/api/v3"</span></div></div></div></div></div><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="keycloak-auth-provider"></a>Keycloak Auth Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#keycloak-auth-provider" title="Direct link to heading">#</a></h3><ol><li>Create new client in your Keycloak with <strong>Access Type</strong> 'confidental' and <strong>Valid Redirect URIs</strong> '<a href="https://internal.yourcompany.com/oauth2/callback'" target="_blank" rel="noopener noreferrer">https://internal.yourcompany.com/oauth2/callback'</a></li><li>Take note of the Secret in the credential tab of the client</li><li>Create a mapper with <strong>Mapper Type</strong> 'Group Membership' and <strong>Token Claim Name</strong> 'groups'.</li></ol><p>Make sure you set the following to the appropriate url:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">-provider=keycloak</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">-client-id=<client you have created></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">-client-secret=<your client's secret></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">-login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">-redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">-validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">-keycloak-group=<user_group></span></div></div></div></div></div><p>The group management in keycloak is using a tree. If you create a group named admin in keycloak you should define the 'keycloak-group' value to /admin.</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="gitlab-auth-provider"></a>GitLab Auth Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#gitlab-auth-provider" title="Direct link to heading">#</a></h3><p>Whether you are using GitLab.com or self-hosting GitLab, follow <a href="https://docs.gitlab.com/ce/integration/oauth_provider.html" target="_blank" rel="noopener noreferrer">these steps to add an application</a>. Make sure to enable at least the <code>openid</code>, <code>profile</code> and <code>email</code> scopes, and set the redirect url to your application url e.g. <a href="https://myapp.com/oauth2/callback" target="_blank" rel="noopener noreferrer">https://myapp.com/oauth2/callback</a>.</p><p>The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow <a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/docs/configuration/configuration.md#configuration" target="_blank" rel="noopener noreferrer">these steps</a></p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --provider="gitlab"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-id=GITLAB_CLIENT_ID</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-secret=GITLAB_CLIENT_SECRET</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --cookie-secret=COOKIE_SECRET</span></div></div></div></div></div><p>Restricting by group membership is possible with the following option:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma</span></div></div></div></div></div><p>If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">--oidc-issuer-url="<your gitlab url>"</span></div></div></div></div></div><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="linkedin-auth-provider"></a>LinkedIn Auth Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#linkedin-auth-provider" title="Direct link to heading">#</a></h3><p>For LinkedIn, the registration steps are:</p><ol><li>Create a new project: <a href="https://www.linkedin.com/secure/developer" target="_blank" rel="noopener noreferrer">https://www.linkedin.com/secure/developer</a></li><li>In the OAuth User Agreement section:<ul><li>In default scope, select r_basicprofile and r_emailaddress.</li><li>In "OAuth 2.0 Redirect URLs", enter <code>https://internal.yourcompany.com/oauth2/callback</code></li></ul></li><li>Fill in the remaining required fields and Save.</li><li>Take note of the <strong>Consumer Key / API Key</strong> and <strong>Consumer Secret / Secret Key</strong></li></ol><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="microsoft-azure-ad-provider"></a>Microsoft Azure AD Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#microsoft-azure-ad-provider" title="Direct link to heading">#</a></h3><p>For adding an application to the Microsoft Azure AD follow <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app" target="_blank" rel="noopener noreferrer">these steps to add an application</a>.</p><p>Take note of your <code>TenantId</code> if applicable for your situation. The <code>TenantId</code> can be used to override the default <code>common</code> authorization server with a tenant specific server.</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="openid-connect-provider"></a>OpenID Connect Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#openid-connect-provider" title="Direct link to heading">#</a></h3><p>OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects. This provider was originally built against CoreOS Dex and we will use it as an example.</p><ol><li>Launch a Dex instance using the <a href="https://github.com/coreos/dex/blob/master/Documentation/getting-started.md" target="_blank" rel="noopener noreferrer">getting started guide</a>.</li><li>Setup oauth2-proxy with the correct provider and using the default ports and callbacks.</li><li>Login with the fixture use in the dex guide and run the oauth2-proxy with the following args:</li></ol><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -provider oidc</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -provider-display-name "My OIDC Provider"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -client-id oauth2-proxy</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -client-secret proxy</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -redirect-url http://127.0.0.1:4180/oauth2/callback</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -oidc-issuer-url http://127.0.0.1:5556</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -cookie-secure=false</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -email-domain example.com</span></div></div></div></div></div><p>The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta. To configure the OIDC provider for Okta, perform
|
|
the following steps:</p><h4><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="configuring-the-oidc-provider-with-okta"></a>Configuring the OIDC Provider with Okta<a aria-hidden="true" tabindex="-1" class="hash-link" href="#configuring-the-oidc-provider-with-okta" title="Direct link to heading">#</a></h4><ol><li>Log in to Okta using an administrative account. It is suggested you try this in preview first, <code>example.oktapreview.com</code></li><li>(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,
|
|
you may wish to configure an authorization server for each application. Otherwise, the provided <code>default</code> will work.</li></ol><ul><li>Navigate to <strong>Security</strong> then select <strong>API</strong></li><li>Click <strong>Add Authorization Server</strong>, if this option is not available you may require an additional license for a custom authorization server.</li><li>Fill out the <strong>Name</strong> with something to describe the application you are protecting. e.g. 'Example App'.</li><li>For <strong>Audience</strong>, pick the URL of the application you wish to protect: <a href="https://example.corp.com" target="_blank" rel="noopener noreferrer">https://example.corp.com</a></li><li>Fill out a <strong>Description</strong></li><li>Add any <strong>Access Policies</strong> you wish to configure to limit application access.</li><li>The default settings will work for other options.
|
|
<a href="https://developer.okta.com/docs/guides/customize-authz-server/overview/" target="_blank" rel="noopener noreferrer">See Okta documentation for more information on Authorization Servers</a></li></ul><ol start="3"><li>Navigate to <strong>Applications</strong> then select <strong>Add Application</strong>.</li></ol><ul><li>Select <strong>Web</strong> for the <strong>Platform</strong> setting.</li><li>Select <strong>OpenID Connect</strong> and click <strong>Create</strong></li><li>Pick an <strong>Application Name</strong> such as <code>Example App</code>.</li><li>Set the <strong>Login redirect URI</strong> to <code>https://example.corp.com</code>.</li><li>Under <strong>General</strong> set the <strong>Allowed grant types</strong> to <code>Authorization Code</code> and <code>Refresh Token</code>.</li><li>Leave the rest as default, taking note of the <code>Client ID</code> and <code>Client Secret</code>.</li><li>Under <strong>Assignments</strong> select the users or groups you wish to access your application.</li></ul><ol start="4"><li>Create a configuration file like the following:</li></ol><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">provider = "oidc"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">redirect_url = "https://example.corp.com/oauth2/callback"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">oidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">upstreams = [</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> "https://example.corp.com"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">]</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">email_domains = [</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> "corp.com"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">]</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">client_id = "XXXXX"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">client_secret = "YYYYY"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">pass_access_token = true</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">cookie_secret = "ZZZZZ"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">skip_provider_button = true</span></div></div></div></div></div><p>The <code>oidc_issuer_url</code> is based on URL from your <strong>Authorization Server</strong>'s <strong>Issuer</strong> field in step 2, or simply <a href="https://corp.okta.com" target="_blank" rel="noopener noreferrer">https://corp.okta.com</a>
|
|
The <code>client_id</code> and <code>client_secret</code> are configured in the application settings.
|
|
Generate a unique <code>client_secret</code> to encrypt the cookie.</p><p>Then you can start the oauth2-proxy with <code>./oauth2-proxy --config /etc/example.cfg</code></p><h4><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="configuring-the-oidc-provider-with-okta---localhost"></a>Configuring the OIDC Provider with Okta - localhost<a aria-hidden="true" tabindex="-1" class="hash-link" href="#configuring-the-oidc-provider-with-okta---localhost" title="Direct link to heading">#</a></h4><ol><li>Signup for developer account: <a href="https://developer.okta.com/signup/" target="_blank" rel="noopener noreferrer">https://developer.okta.com/signup/</a></li><li>Create New <code>Web</code> Application: https://${your-okta-domain}/dev/console/apps/new</li><li>Example Application Settings for localhost:<ul><li><strong>Name:</strong> My Web App</li><li><strong>Base URIs:</strong> http://localhost:4180/</li><li><strong>Login redirect URIs:</strong> http://localhost:4180/oauth2/callback</li><li><strong>Logout redirect URIs:</strong> http://localhost:4180/</li><li><strong>Group assignments:</strong> <code>Everyone</code></li><li><strong>Grant type allowed:</strong> <code>Authorization Code</code> and <code>Refresh Token</code></li></ul></li><li>Make note of the <code>Client ID</code> and <code>Client secret</code>, they are needed in a future step</li><li>Make note of the <strong>default</strong> Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as</li><li>Example config file <code>/etc/localhost.cfg</code><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">provider = "oidc"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">redirect_url = "http://localhost:4180/oauth2/callback"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">oidc_issuer_url = "https://${your-okta-domain}/oauth2/default"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">upstreams = [</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> "http://0.0.0.0:8080"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">]</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">email_domains = [</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> "*"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">]</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">client_id = "XXX"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">client_secret = "YYY"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">pass_access_token = true</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">cookie_secret = "ZZZ"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">cookie_secure = false</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain">skip_provider_button = true</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"># Note: use the following for testing within a container</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"># http_address = "0.0.0.0:4180"</span></div></div></div></div></div></li><li>Then you can start the oauth2-proxy with <code>./oauth2-proxy --config /etc/localhost.cfg</code></li></ol><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="logingov-provider"></a>login.gov Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#logingov-provider" title="Direct link to heading">#</a></h3><p>login.gov is an OIDC provider for the US Government.
|
|
If you are a US Government agency, you can contact the login.gov team through the contact information
|
|
that you can find on <a href="https://login.gov/developers/" target="_blank" rel="noopener noreferrer">https://login.gov/developers/</a> and work with them to understand how to get login.gov
|
|
accounts for integration/test and production access.</p><p>A developer guide is available here: <a href="https://developers.login.gov/" target="_blank" rel="noopener noreferrer">https://developers.login.gov/</a>, though this proxy handles everything
|
|
but the data you need to create to register your application in the login.gov dashboard.</p><p>As a demo, we will assume that you are running your application that you want to secure locally on
|
|
http://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that
|
|
you have an agency integration account for testing.</p><p>First, register your application in the dashboard. The important bits are:</p><ul><li>Identity protocol: make this <code>Openid connect</code></li><li>Issuer: do what they say for OpenID Connect. We will refer to this string as <code>${LOGINGOV_ISSUER}</code>.</li><li>Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.
|
|
A quick way to do this is <code>openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'</code>,
|
|
The contents of the <code>key.pem</code> shall be referred to as <code>${OAUTH2_PROXY_JWT_KEY}</code>.</li><li>Return to App URL: Make this be <code>http://localhost:4180/</code></li><li>Redirect URIs: Make this be <code>http://localhost:4180/oauth2/callback</code>.</li><li>Attribute Bundle: Make sure that email is selected.</li></ul><p>Now start the proxy up with the following options:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain">./oauth2-proxy -provider login.gov \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -client-id=${LOGINGOV_ISSUER} \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -redirect-url=http://localhost:4180/oauth2/callback \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -cookie-secure=false \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -email-domain=gsa.gov \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -upstream=http://localhost:3000/ \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -cookie-secret=somerandomstring12341234567890AB \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -cookie-domain=localhost \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -skip-provider-button=true \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -jwt-key="${OAUTH2_PROXY_JWT_KEY}"</span></div></div></div></div></div><p>You can also set all these options with environment variables, for use in cloud/docker environments.
|
|
One tricky thing that you may encounter is that some cloud environments will pass in environment
|
|
variables in a docker env-file, which does not allow multiline variables like a PEM file.
|
|
If you encounter this, then you can create a <code>jwt_signing_key.pem</code> file in the top level
|
|
directory of the repo which contains the key in PEM format and then do your docker build.
|
|
The docker build process will copy that file into your image which you can then access by
|
|
setting the <code>OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem</code>
|
|
environment variable, or by setting <code>--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem</code> on the commandline.</p><p>Once it is running, you should be able to go to <code>http://localhost:4180/</code> in your browser,
|
|
get authenticated by the login.gov integration server, and then get proxied on to your
|
|
application running on <code>http://localhost:3000/</code>. In a real deployment, you would secure
|
|
your application with a firewall or something so that it was only accessible from the
|
|
proxy, and you would use real hostnames everywhere.</p><h4><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="skip-oidc-discovery"></a>Skip OIDC discovery<a aria-hidden="true" tabindex="-1" class="hash-link" href="#skip-oidc-discovery" title="Direct link to heading">#</a></h4><p>Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata.</p><p>In this case, you can set the <code>--skip-oidc-discovery</code> option, and supply those required endpoints manually:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -provider oidc</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -client-id oauth2-proxy</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -client-secret proxy</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -redirect-url http://127.0.0.1:4180/oauth2/callback</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -oidc-issuer-url http://127.0.0.1:5556</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -skip-oidc-discovery</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -login-url http://127.0.0.1:5556/authorize</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -redeem-url http://127.0.0.1:5556/token</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -oidc-jwks-url http://127.0.0.1:5556/keys</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -cookie-secure=false</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -email-domain example.com</span></div></div></div></div></div><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="nextcloud-provider"></a>Nextcloud Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#nextcloud-provider" title="Direct link to heading">#</a></h3><p>The Nextcloud provider allows you to authenticate against users in your
|
|
Nextcloud instance.</p><p>When you are using the Nextcloud provider, you must specify the urls via
|
|
configuration, environment variable, or command line argument. Depending
|
|
on whether your Nextcloud instance is using pretty urls your urls may be of the
|
|
form <code>/index.php/apps/oauth2/*</code> or <code>/apps/oauth2/*</code>.</p><p>Refer to the <a href="https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html" target="_blank" rel="noopener noreferrer">OAuth2
|
|
documentation</a>
|
|
to setup the client id and client secret. Your "Redirection URI" will be
|
|
<code>https://internalapp.yourcompany.com/oauth2/callback</code>.</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -provider nextcloud</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -client-id <from nextcloud admin></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -client-secret <from nextcloud admin></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -login-url="<your nextcloud url>/index.php/apps/oauth2/authorize"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -redeem-url="<your nextcloud url>/index.php/apps/oauth2/api/v1/token"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> -validate-url="<your nextcloud url>/ocs/v2.php/cloud/user?format=json"</span></div></div></div></div></div><p>Note: in <em>all</em> cases the validate-url will <em>not</em> have the <code>index.php</code>.</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="digitalocean-auth-provider"></a>DigitalOcean Auth Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#digitalocean-auth-provider" title="Direct link to heading">#</a></h3><ol><li><a href="https://cloud.digitalocean.com/account/api/applications" target="_blank" rel="noopener noreferrer">Create a new OAuth application</a><ul><li>You can fill in the name, homepage, and description however you wish.</li><li>In the "Application callback URL" field, enter: <code>https://oauth-proxy/oauth2/callback</code>, substituting <code>oauth2-proxy</code> with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL.</li></ul></li><li>Note the Client ID and Client Secret.</li></ol><p>To use the provider, pass the following options:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --provider=digitalocean</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-id=<Client ID></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-secret=<Client Secret></span></div></div></div></div></div><p> Alternatively, set the equivalent options in the config file. The redirect URL defaults to <code>https://<requested host header>/oauth2/callback</code>. If you need to change it, you can use the <code>--redirect-url</code> command-line option.</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="bitbucket-auth-provider"></a>Bitbucket Auth Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#bitbucket-auth-provider" title="Direct link to heading">#</a></h3><ol><li><a href="https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html" target="_blank" rel="noopener noreferrer">Add a new OAuth consumer</a><ul><li>In "Callback URL" use <code>https://<oauth2-proxy>/oauth2/callback</code>, substituting <code><oauth2-proxy></code> with the actual hostname that oauth2-proxy is running on.</li><li>In Permissions section select:<ul><li>Account -> Email</li><li>Team membership -> Read</li><li>Repositories -> Read</li></ul></li></ul></li><li>Note the Client ID and Client Secret.</li></ol><p>To use the provider, pass the following options:</p><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --provider=bitbucket</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-id=<Client ID></span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-secret=<Client Secret></span></div></div></div></div></div><p>The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: <code>--bitbucket-team=<Team name></code>. To restrict the access to only these users who has access to one selected repository use <code>--bitbucket-repository=<Repository name></code>.</p><h3><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="gitea-auth-provider"></a>Gitea Auth Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#gitea-auth-provider" title="Direct link to heading">#</a></h3><ol><li>Create a new application: <code>https://< your gitea host >/user/settings/applications</code></li><li>Under <code>Redirect URI</code> enter the correct URL i.e. <code>https://<proxied host>/oauth2/callback</code></li><li>Note the Client ID and Client Secret.</li><li>Pass the following options to the proxy:</li></ol><div class="mdxCodeBlock_1XEh"><div class="codeBlockContent_1u-d"><button tabindex="0" type="button" aria-label="Copy code to clipboard" class="copyButton_10dd">Copy</button><div class="prism-code language-undefined codeBlock_3iAC"><div class="codeBlockLines_b7E3" style="color:#bfc7d5;background-color:#292d3e"><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --provider="github"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --redirect-url="https://<proxied host>/oauth2/callback"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --provider-display-name="Gitea"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-id="< client_id as generated by Gitea >"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --client-secret="< client_secret as generated by Gitea >"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --login-url="https://< your gitea host >/login/oauth/authorize"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --redeem-url="https://< your gitea host >/login/oauth/access_token"</span></div><div class="token-line" style="color:#bfc7d5"><span class="token plain"> --validate-url="https://< your gitea host >/api/v1"</span></div></div></div></div></div><h2><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="email-authentication"></a>Email Authentication<a aria-hidden="true" tabindex="-1" class="hash-link" href="#email-authentication" title="Direct link to heading">#</a></h2><p>To authorize by email domain use <code>--email-domain=yourcompany.com</code>. To authorize individual email addresses use <code>--authenticated-emails-file=/path/to/file</code> with one email per line. To authorize all email addresses use <code>--email-domain=*</code>.</p><h2><a aria-hidden="true" tabindex="-1" class="anchor enhancedAnchor_2cZh" id="adding-a-new-provider"></a>Adding a new Provider<a aria-hidden="true" tabindex="-1" class="hash-link" href="#adding-a-new-provider" title="Direct link to heading">#</a></h2><p>Follow the examples in the <a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/" target="_blank" rel="noopener noreferrer"><code>providers</code> package</a> to define a new
|
|
<code>Provider</code> instance. Add a new <code>case</code> to
|
|
<a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go" target="_blank" rel="noopener noreferrer"><code>providers.New()</code></a> to allow <code>oauth2-proxy</code> to use the
|
|
new <code>Provider</code>.</p></div></article><div class="margin-vert--xl"><div class="row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/auth.md" target="_blank" rel="noreferrer noopener"><svg fill="currentColor" height="1.2em" width="1.2em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 40 40" style="margin-right:0.3em;vertical-align:sub"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div></div></div><div class="margin-vert--lg"><nav class="pagination-nav" aria-label="Blog list page navigation"><div class="pagination-nav__item"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/overview"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">« Overview</div></a></div><div class="pagination-nav__item pagination-nav__item--next"><a class="pagination-nav__link" href="/oauth2-proxy/docs/configuration/session_storage"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Session Storage »</div></a></div></nav></div></div></div><div class="col col--3"><div class="tableOfContents_3SO_"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#google-auth-provider" class="table-of-contents__link">Google Auth Provider</a></li><li><a href="#azure-auth-provider" class="table-of-contents__link">Azure Auth Provider</a></li><li><a href="#facebook-auth-provider" class="table-of-contents__link">Facebook Auth Provider</a></li><li><a href="#github-auth-provider" class="table-of-contents__link">GitHub Auth Provider</a></li><li><a href="#keycloak-auth-provider" class="table-of-contents__link">Keycloak Auth Provider</a></li><li><a href="#gitlab-auth-provider" class="table-of-contents__link">GitLab Auth Provider</a></li><li><a href="#linkedin-auth-provider" class="table-of-contents__link">LinkedIn Auth Provider</a></li><li><a href="#microsoft-azure-ad-provider" class="table-of-contents__link">Microsoft Azure AD Provider</a></li><li><a href="#openid-connect-provider" class="table-of-contents__link">OpenID Connect Provider</a></li><li><a href="#logingov-provider" class="table-of-contents__link">login.gov Provider</a></li><li><a href="#nextcloud-provider" class="table-of-contents__link">Nextcloud Provider</a></li><li><a href="#digitalocean-auth-provider" class="table-of-contents__link">DigitalOcean Auth Provider</a></li><li><a href="#bitbucket-auth-provider" class="table-of-contents__link">Bitbucket Auth Provider</a></li><li><a href="#gitea-auth-provider" class="table-of-contents__link">Gitea Auth Provider</a></li><li><a href="#email-authentication" class="table-of-contents__link">Email Authentication</a></li><li><a href="#adding-a-new-provider" class="table-of-contents__link">Adding a new Provider</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container"><div class="text--center"><div>Copyright © 2020 OAuth2 Proxy.</div></div></div></footer></div>
|
|
<script src="/oauth2-proxy/styles.1b985414.js"></script>
|
|
<script src="/oauth2-proxy/runtime~main.1fddb884.js"></script>
|
|
<script src="/oauth2-proxy/main.08dca9ee.js"></script>
|
|
<script src="/oauth2-proxy/1.6bac5299.js"></script>
|
|
<script src="/oauth2-proxy/2.c97238d2.js"></script>
|
|
<script src="/oauth2-proxy/16.7939b288.js"></script>
|
|
<script src="/oauth2-proxy/18.088d12e8.js"></script>
|
|
<script src="/oauth2-proxy/935f2afb.93f76895.js"></script>
|
|
<script src="/oauth2-proxy/17896441.66eec2ae.js"></script>
|
|
<script src="/oauth2-proxy/357fe94d.33b065b1.js"></script>
|
|
</body>
|
|
</html> |