mirror of
https://github.com/oauth2-proxy/oauth2-proxy.git
synced 2025-05-15 22:16:45 +02:00
56 lines
2.3 KiB
Markdown
56 lines
2.3 KiB
Markdown
---
|
|
id: github
|
|
title: GitHub
|
|
---
|
|
|
|
1. Create a new project: https://github.com/settings/developers
|
|
2. Under `Authorization callback URL` enter the correct url ie `https://internal.yourcompany.com/oauth2/callback`
|
|
|
|
The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional
|
|
team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with `--email-domain=*`. Additionally, all the organizations and teams a user belongs to are set as part of the `X-Forwarded-Groups` header. e.g. `org1:team1,org1:team2,org2:team1`
|
|
|
|
NOTE: When `--github-user` is set, the specified users are allowed to log in even if they do not belong to the specified
|
|
org and team or collaborators.
|
|
|
|
To restrict by organization only, include the following flag:
|
|
|
|
```shell
|
|
--github-org="" # restrict logins to members of this organisation
|
|
```
|
|
|
|
To restrict within an organization to specific teams, include the following flag in addition to `-github-org`:
|
|
|
|
```shell
|
|
--github-team="" # restrict logins to members of any of these teams (slug), separated by a comma
|
|
```
|
|
|
|
If you would rather restrict access to collaborators of a repository, those users must either have push access to a
|
|
public repository or any access to a private repository:
|
|
|
|
```shell
|
|
--github-repo="" # restrict logins to collaborators of this repository formatted as orgname/repo
|
|
```
|
|
|
|
If you'd like to allow access to users with **read only** access to a **public** repository you will need to provide a
|
|
[token](https://github.com/settings/tokens) for a user that has write access to the repository. The token must be
|
|
created with at least the `public_repo` scope:
|
|
|
|
```shell
|
|
--github-token="" # the token to use when verifying repository collaborators
|
|
```
|
|
|
|
To allow a user to log in with their username even if they do not belong to the specified org and team or collaborators,
|
|
separated by a comma
|
|
|
|
```shell
|
|
--github-user="" #allow logins by username, separated by a comma
|
|
```
|
|
|
|
If you are using GitHub enterprise, make sure you set the following to the appropriate url:
|
|
|
|
```shell
|
|
--login-url="http(s)://<enterprise github host>/login/oauth/authorize"
|
|
--redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"
|
|
--validate-url="http(s)://<enterprise github host>/api/v3"
|
|
```
|