mirror of
https://github.com/oauth2-proxy/oauth2-proxy.git
synced 2025-04-25 12:24:41 +02:00
23 lines
36 KiB
HTML
23 lines
36 KiB
HTML
<!doctype html>
|
|
<html lang="en" dir="ltr" class="docs-wrapper docs-doc-page docs-version-current plugin-docs plugin-id-default docs-doc-id-configuration/providers/openid_connect" data-has-hydrated="false">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="generator" content="Docusaurus v2.4.3">
|
|
<title data-rh="true">OpenID Connect | OAuth2 Proxy</title><meta data-rh="true" name="viewport" content="width=device-width,initial-scale=1"><meta data-rh="true" name="twitter:card" content="summary_large_image"><meta data-rh="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/providers/openid_connect"><meta data-rh="true" name="docusaurus_locale" content="en"><meta data-rh="true" name="docsearch:language" content="en"><meta data-rh="true" name="docusaurus_version" content="current"><meta data-rh="true" name="docusaurus_tag" content="docs-default-current"><meta data-rh="true" name="docsearch:version" content="current"><meta data-rh="true" name="docsearch:docusaurus_tag" content="docs-default-current"><meta data-rh="true" property="og:title" content="OpenID Connect | OAuth2 Proxy"><meta data-rh="true" name="description" content="OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."><meta data-rh="true" property="og:description" content="OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."><link data-rh="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-rh="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/providers/openid_connect"><link data-rh="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/providers/openid_connect" hreflang="en"><link data-rh="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/providers/openid_connect" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.4014daec.css">
|
|
<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.770b5b36.js" as="script">
|
|
<link rel="preload" href="/oauth2-proxy/assets/js/main.43766481.js" as="script">
|
|
</head>
|
|
<body class="navigation-with-keyboard">
|
|
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=new URLSearchParams(window.location.search).get("docusaurus-theme")}catch(t){}return t}()||function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
|
|
<div role="region" aria-label="Skip to main content"><a class="skipToContent_fXgn" href="#__docusaurus_skipToContent_fallback">Skip to main content</a></div><nav aria-label="Main" class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Toggle navigation bar" aria-expanded="false" class="navbar__toggle clean-btn" type="button"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/oauth2-proxy/"><div class="navbar__logo"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_ToTc themedImage--light_HNdA"><img src="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg" alt="OAuth2 Proxy" class="themedImage_ToTc themedImage--dark_i4oU"></div><b class="navbar__title text--truncate">OAuth2 Proxy</b></a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" href="/oauth2-proxy/docs/">Docs</a></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" aria-haspopup="true" aria-expanded="false" role="button" href="/oauth2-proxy/docs/next/">Next</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/oauth2-proxy/docs/next/configuration/providers/openid_connect">Next</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/">7.5.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.4.x/">7.4.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.3.x/">7.3.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.2.x/">7.2.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.1.x/">7.1.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/7.0.x/">7.0.x</a></li><li><a class="dropdown__link" href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></div><a href="https://github.com/oauth2-proxy/oauth2-proxy" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><div class="toggle_vylO colorModeToggle_DEke"><button class="clean-btn toggleButton_gllP toggleButtonDisabled_aARS" type="button" disabled="" title="Switch between dark and light mode (currently light mode)" aria-label="Switch between dark and light mode (currently light mode)" aria-live="polite"><svg viewBox="0 0 24 24" width="24" height="24" class="lightToggleIcon_pyhR"><path fill="currentColor" d="M12,9c1.65,0,3,1.35,3,3s-1.35,3-3,3s-3-1.35-3-3S10.35,9,12,9 M12,7c-2.76,0-5,2.24-5,5s2.24,5,5,5s5-2.24,5-5 S14.76,7,12,7L12,7z M2,13l2,0c0.55,0,1-0.45,1-1s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S1.45,13,2,13z M20,13l2,0c0.55,0,1-0.45,1-1 s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S19.45,13,20,13z M11,2v2c0,0.55,0.45,1,1,1s1-0.45,1-1V2c0-0.55-0.45-1-1-1S11,1.45,11,2z M11,20v2c0,0.55,0.45,1,1,1s1-0.45,1-1v-2c0-0.55-0.45-1-1-1C11.45,19,11,19.45,11,20z M5.99,4.58c-0.39-0.39-1.03-0.39-1.41,0 c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0s0.39-1.03,0-1.41L5.99,4.58z M18.36,16.95 c-0.39-0.39-1.03-0.39-1.41,0c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0c0.39-0.39,0.39-1.03,0-1.41 L18.36,16.95z M19.42,5.99c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06c-0.39,0.39-0.39,1.03,0,1.41 s1.03,0.39,1.41,0L19.42,5.99z M7.05,18.36c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06 c-0.39,0.39-0.39,1.03,0,1.41s1.03,0.39,1.41,0L7.05,18.36z"></path></svg><svg viewBox="0 0 24 24" width="24" height="24" class="darkToggleIcon_wfgR"><path fill="currentColor" d="M9.37,5.51C9.19,6.15,9.1,6.82,9.1,7.5c0,4.08,3.32,7.4,7.4,7.4c0.68,0,1.35-0.09,1.99-0.27C17.45,17.19,14.93,19,12,19 c-3.86,0-7-3.14-7-7C5,9.07,6.81,6.55,9.37,5.51z M12,3c-4.97,0-9,4.03-9,9s4.03,9,9,9s9-4.03,9-9c0-0.46-0.04-0.92-0.1-1.36 c-0.98,1.37-2.58,2.26-4.4,2.26c-2.98,0-5.4-2.42-5.4-5.4c0-1.81,0.89-3.42,2.26-4.4C12.92,3.04,12.46,3,12,3L12,3z"></path></svg></button></div><div class="searchBox_ZlJk"><div class="navbar__search searchBarContainer_NW3z"><input placeholder="Search" aria-label="Search" class="navbar__search-input"><div class="loadingRing_RJI3 searchBarLoadingRing_YnHq"><div></div><div></div><div></div><div></div></div><div class="searchHintContainer_Pkmr"><kbd class="searchHint_iIMx">ctrl</kbd><kbd class="searchHint_iIMx">K</kbd></div></div></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div id="__docusaurus_skipToContent_fallback" class="main-wrapper mainWrapper_z2l0 docsWrapper_BCFX"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_sjWU" type="button"></button><div class="docPage__5DB"><aside class="theme-doc-sidebar-container docSidebarContainer_b6E3"><div class="sidebarViewport_Xe31"><div class="sidebar_njMd"><nav aria-label="Docs sidebar" class="menu thin-scrollbar menu_SIkG"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/">Installation</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/oauth2-proxy/docs/next/behaviour">Behaviour</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active" aria-expanded="true" href="/oauth2-proxy/docs/next/configuration/overview">Configuration</a><button aria-label="Toggle the collapsible sidebar category 'Configuration'" type="button" class="clean-btn menu__caret"></button></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/overview">Overview</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active" aria-expanded="true" tabindex="0" href="/oauth2-proxy/docs/next/configuration/providers/">OAuth Provider Configuration</a><button aria-label="Toggle the collapsible sidebar category 'OAuth Provider Configuration'" type="button" class="clean-btn menu__caret"></button></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/providers/google">Google (default)</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/providers/azure">Azure</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/providers/adfs">ADFS</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/providers/facebook">Facebook</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/providers/github">GitHub</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/providers/gitea">Gitea</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/providers/keycloak">Keycloak</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/providers/keycloak_oidc">Keycloak OIDC</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/providers/gitlab">GitLab</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/providers/linkedin">LinkedIn</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/providers/azure_ad">Microsoft Azure AD</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" tabindex="0" href="/oauth2-proxy/docs/next/configuration/providers/openid_connect">OpenID Connect</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/providers/login_gov">Login.gov</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/providers/nextcloud">NextCloud</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/providers/digitalocean">DigitalOcean</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/providers/bitbucket">BitBucket</a></li></ul></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/session_storage">Session Storage</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/tls">TLS Configuration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/configuration/alpha-config">Alpha Configuration</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="true" href="/oauth2-proxy/docs/next/features/endpoints">Features</a><button aria-label="Toggle the collapsible sidebar category 'Features'" type="button" class="clean-btn menu__caret"></button></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/features/endpoints">Endpoints</a></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="true" href="/oauth2-proxy/docs/next/community/security">Community</a><button aria-label="Toggle the collapsible sidebar category 'Community'" type="button" class="clean-btn menu__caret"></button></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/contribution">Contribution Guide</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/oauth2-proxy/docs/next/community/security">Security</a></li></ul></li></ul></nav></div></div></aside><main class="docMainContainer_gTbr"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_VOVn"><div class="theme-doc-version-banner alert alert--warning margin-bottom--md" role="alert"><div>This is unreleased documentation for <!-- -->OAuth2 Proxy<!-- --> <b>Next</b> version.</div><div class="margin-top--md">For up-to-date documentation, see the <b><a href="/oauth2-proxy/docs/">latest version</a></b> (<!-- -->7.5.x<!-- -->).</div></div><div class="docItemContainer_Djhp"><article><nav class="theme-doc-breadcrumbs breadcrumbsContainer_Z_bl" aria-label="Breadcrumbs"><ul class="breadcrumbs" itemscope="" itemtype="https://schema.org/BreadcrumbList"><li class="breadcrumbs__item"><a aria-label="Home page" class="breadcrumbs__link" href="/oauth2-proxy/"><svg viewBox="0 0 24 24" class="breadcrumbHomeIcon_YNFT"><path d="M10 19v-5h4v5c0 .55.45 1 1 1h3c.55 0 1-.45 1-1v-7h1.7c.46 0 .68-.57.33-.87L12.67 3.6c-.38-.34-.96-.34-1.34 0l-8.36 7.53c-.34.3-.13.87.33.87H5v7c0 .55.45 1 1 1h3c.55 0 1-.45 1-1z" fill="currentColor"></path></svg></a></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item"><a class="breadcrumbs__link" itemprop="item" href="/oauth2-proxy/docs/next/configuration/overview"><span itemprop="name">Configuration</span></a><meta itemprop="position" content="1"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item"><a class="breadcrumbs__link" itemprop="item" href="/oauth2-proxy/docs/next/configuration/providers/"><span itemprop="name">OAuth Provider Configuration</span></a><meta itemprop="position" content="2"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item breadcrumbs__item--active"><span class="breadcrumbs__link" itemprop="name">OpenID Connect</span><meta itemprop="position" content="3"></li></ul></nav><span class="theme-doc-version-badge badge badge--secondary">Version: Next</span><div class="tocCollapsible_ETCw theme-doc-toc-mobile tocMobile_ITEo"><button type="button" class="clean-btn tocCollapsibleButton_TO0P">On this page</button></div><div class="theme-doc-markdown markdown"><header><h1>OpenID Connect</h1></header><p>OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects.</p><p>This provider was originally built against CoreOS Dex, and we will use it as an example.
|
|
The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below.</p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="dex">Dex<a href="#dex" class="hash-link" aria-label="Direct link to Dex" title="Direct link to Dex"></a></h4><p>To configure the OIDC provider for Dex, perform the following steps:</p><ol><li><p>Download Dex:</p><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">go get github.com/dexidp/dex</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>See the <a href="https://dexidp.io/docs/getting-started/" target="_blank" rel="noopener noreferrer">getting started guide</a> for more details.</p></li><li><p>Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to
|
|
the <code>staticClients</code> section of <code>examples/config-dev.yaml</code>:</p><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">- id: oauth2-proxy</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">redirectURIs:</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">- 'http://127.0.0.1:4180/oauth2/callback'</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">name: 'oauth2-proxy'</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">secret: proxy</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></li><li><p>Launch Dex: from <code>$GOPATH/github.com/dexidp/dex</code>, run:</p><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">bin/dex serve examples/config-dev.yaml</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></li><li><p>In a second terminal, run the oauth2-proxy with the following args:</p><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">-provider oidc</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">-provider-display-name "My OIDC Provider"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">-client-id oauth2-proxy</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">-client-secret proxy</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">-redirect-url http://127.0.0.1:4180/oauth2/callback</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">-oidc-issuer-url http://127.0.0.1:5556/dex</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">-cookie-secure=false</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">-cookie-secret=secret</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">-email-domain kilgore.trout</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>To serve the current working directory as a website under the <code>/static</code> endpoint, add:</p><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">-upstream file://$PWD/#/static/</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></li><li><p>Test the setup by visiting <a href="http://127.0.0.1:4180" target="_blank" rel="noopener noreferrer">http://127.0.0.1:4180</a> or <a href="http://127.0.0.1:4180/static" target="_blank" rel="noopener noreferrer">http://127.0.0.1:4180/static</a> .</p></li></ol><p>See also <a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment" target="_blank" rel="noopener noreferrer">our local testing environment</a> for a self-contained example using Docker and etcd as storage for Dex.</p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="okta">Okta<a href="#okta" class="hash-link" aria-label="Direct link to Okta" title="Direct link to Okta"></a></h4><p>To configure the OIDC provider for Okta, perform the following steps:</p><ol><li><p>Log in to Okta using an administrative account. It is suggested you try this in preview first, <code>example.oktapreview.com</code></p></li><li><p>(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,
|
|
you may wish to configure an authorization server for each application. Otherwise, the provided <code>default</code> will work.</p><ul><li>Navigate to <strong>Security</strong> then select <strong>API</strong></li><li>Click <strong>Add Authorization Server</strong>, if this option is not available you may require an additional license for a custom
|
|
authorization server.</li><li>Fill out the <strong>Name</strong> with something to describe the application you are protecting. e.g. 'Example App'.</li><li>For <strong>Audience</strong>, pick the URL of the application you wish to protect: <a href="https://example.corp.com" target="_blank" rel="noopener noreferrer">https://example.corp.com</a></li><li>Fill out a <strong>Description</strong></li><li>Add any <strong>Access Policies</strong> you wish to configure to limit application access.</li><li>The default settings will work for other options.
|
|
<a href="https://developer.okta.com/docs/guides/customize-authz-server/overview/" target="_blank" rel="noopener noreferrer">See Okta documentation for more information on Authorization Servers</a></li></ul></li><li><p>Navigate to <strong>Applications</strong> then select <strong>Add Application</strong>.</p><ul><li>Select <strong>Web</strong> for the <strong>Platform</strong> setting.</li><li>Select <strong>OpenID Connect</strong> and click <strong>Create</strong></li><li>Pick an <strong>Application Name</strong> such as <code>Example App</code>.</li><li>Set the <strong>Login redirect URI</strong> to <code>https://example.corp.com</code>.</li><li>Under <strong>General</strong> set the <strong>Allowed grant types</strong> to <code>Authorization Code</code> and <code>Refresh Token</code>.</li><li>Leave the rest as default, taking note of the <code>Client ID</code> and <code>Client Secret</code>.</li><li>Under <strong>Assignments</strong> select the users or groups you wish to access your application.</li></ul></li><li><p>Create a configuration file like the following:</p><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">provider = "oidc"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">redirect_url = "https://example.corp.com/oauth2/callback"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">oidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">upstreams = [</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> "https://example.corp.com"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">]</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">email_domains = [</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> "corp.com"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">]</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">client_id = "XXXXX"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">client_secret = "YYYYY"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">pass_access_token = true</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">cookie_secret = "ZZZZZ"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">skip_provider_button = true</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></li></ol><p>The <code>oidc_issuer_url</code> is based on URL from your <strong>Authorization Server</strong>'s <strong>Issuer</strong> field in step 2, or simply
|
|
<a href="https://corp.okta.com." target="_blank" rel="noopener noreferrer">https://corp.okta.com.</a> The <code>client_id</code> and <code>client_secret</code> are configured in the application settings.
|
|
Generate a unique <code>cookie_secret</code> to encrypt the cookie.</p><p>Then you can start the oauth2-proxy with <code>./oauth2-proxy --config /etc/example.cfg</code></p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="okta---localhost">Okta - localhost<a href="#okta---localhost" class="hash-link" aria-label="Direct link to Okta - localhost" title="Direct link to Okta - localhost"></a></h4><ol><li>Signup for developer account: <a href="https://developer.okta.com/signup/" target="_blank" rel="noopener noreferrer">https://developer.okta.com/signup/</a></li><li>Create New <code>Web</code> Application: https://${your-okta-domain}/dev/console/apps/new</li><li>Example Application Settings for localhost:<ul><li><strong>Name:</strong> My Web App</li><li><strong>Base URIs:</strong> http://localhost:4180/</li><li><strong>Login redirect URIs:</strong> http://localhost:4180/oauth2/callback</li><li><strong>Logout redirect URIs:</strong> http://localhost:4180/</li><li><strong>Group assignments:</strong> <code>Everyone</code></li><li><strong>Grant type allowed:</strong> <code>Authorization Code</code> and <code>Refresh Token</code></li></ul></li><li>Make note of the <code>Client ID</code> and <code>Client secret</code>, they are needed in a future step</li><li>Make note of the <strong>default</strong> Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as</li><li>Example config file <code>/etc/localhost.cfg</code><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">provider = "oidc"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">redirect_url = "http://localhost:4180/oauth2/callback"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">oidc_issuer_url = "https://${your-okta-domain}/oauth2/default"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">upstreams = [</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> "http://0.0.0.0:8080"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">]</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">email_domains = [</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> "*"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">]</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">client_id = "XXX"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">client_secret = "YYY"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">pass_access_token = true</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">cookie_secret = "ZZZ"</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">cookie_secure = false</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">skip_provider_button = true</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"># Note: use the following for testing within a container</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"># http_address = "0.0.0.0:4180"</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></li><li>Then you can start the oauth2-proxy with <code>./oauth2-proxy --config /etc/localhost.cfg</code></li></ol></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/providers/openid_connect.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_Z9Sw" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_vwxv"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages"><a class="pagination-nav__link pagination-nav__link--prev" href="/oauth2-proxy/docs/next/configuration/providers/azure_ad"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Microsoft Azure AD</div></a><a class="pagination-nav__link pagination-nav__link--next" href="/oauth2-proxy/docs/next/configuration/providers/login_gov"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Login.gov</div></a></nav></div></div><div class="col col--3"><div class="tableOfContents_bqdL thin-scrollbar theme-doc-toc-desktop"></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2023 OAuth2 Proxy.</div></div></div></footer></div>
|
|
<script src="/oauth2-proxy/assets/js/runtime~main.770b5b36.js"></script>
|
|
<script src="/oauth2-proxy/assets/js/main.43766481.js"></script>
|
|
</body>
|
|
</html> |