git.iko.soy/typeable/oauth2-proxy
on master help sign in
typeable/oauth2-proxy/contrib/oauth2-proxy.cfg.example
108 lines 3.9 kB history raw
1## OAuth2 Proxy Config File
2## https://github.com/oauth2-proxy/oauth2-proxy
4## <addr>:<port> to listen on for HTTP/HTTPS clients
5# http_address = "127.0.0.1:4180"
6# https_address = ":443"
8## Are we running behind a reverse proxy? Will not accept headers like X-Real-Ip unless this is set.
9# reverse_proxy = true
11## TLS Settings
12# tls_cert_file = ""
13# tls_key_file = ""
15## the OAuth Redirect URL.
16# defaults to the "https://" + requested host header + "/oauth2/callback"
17# redirect_url = "https://internalapp.yourcompany.com/oauth2/callback"
19## the http url(s) of the upstream endpoint. If multiple, routing is based on path
20# upstreams = [
21# "http://127.0.0.1:8080/"
22# ]
24## Logging configuration
25#logging_filename = ""
26#logging_max_size = 100
27#logging_max_age = 7
28#logging_local_time = true
29#logging_compress = false
30#standard_logging = true
31#standard_logging_format = "[{{.Timestamp}}] [{{.File}}] {{.Message}}"
32#request_logging = true
33#request_logging_format = "{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}"
34#auth_logging = true
35#auth_logging_format = "{{.Client}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}"
37## pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream
38# pass_basic_auth = true
39# pass_user_headers = true
40## pass the request Host Header to upstream
41## when disabled the upstream Host is used as the Host Header
42# pass_host_header = true
44## Email Domains to allow authentication for (this authorizes any email on this domain)
45## for more granular authorization use `authenticated_emails_file`
46## To authorize any email addresses use "*"
47# email_domains = [
48# "yourcompany.com"
49# ]
51## The OAuth Client ID, Secret
52# client_id = "123456.apps.googleusercontent.com"
53# client_secret = ""
55## Scopes Added to the request
56## It has the same behavior as the --scope flag
57# scope = "openid email profile"
59## Pass OAuth Access token to upstream via "X-Forwarded-Access-Token"
60# pass_access_token = false
62## Authenticated Email Addresses File (one email per line)
63# authenticated_emails_file = ""
65## Htpasswd File (optional)
66## Additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -B" for bcrypt encryption
67## enabling exposes a username/login signin form
68# htpasswd_file = ""
70## bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods
71# skip_auth_routes = [
72# "GET=^/probe",
73# "^/metrics"
74# ]
76## mark paths as API routes to get HTTP Status code 401 instead of redirect to login page
77# api_routes = [
78# "^/api"
79# ]
81## Templates
82## optional directory with custom sign_in.html and error.html
83# custom_templates_dir = ""
85## skip SSL checking for HTTPS requests
86# ssl_insecure_skip_verify = false
89## Cookie Settings
90## Name - the cookie name
91## Secret - the seed string for secure cookies; should be 16, 24, or 32 bytes
92## for use with an AES cipher when cookie_refresh or pass_access_token
93## is set
94## Domain - (optional) cookie domain to force cookies to (ie: .yourcompany.com)
95## Expire - (duration) expire timeframe for cookie
96## Refresh - (duration) refresh the cookie when duration has elapsed after cookie was initially set.
97## Should be less than cookie_expire; set to 0 to disable.
98## On refresh, OAuth token is re-validated.
99## (ie: 1h means tokens are refreshed on request 1hr+ after it was set)
100## Secure - secure cookies are only sent by the browser of a HTTPS connection (recommended)
101## HttpOnly - httponly cookies are not readable by javascript (recommended)
102# cookie_name = "_oauth2_proxy"
103# cookie_secret = ""
104# cookie_domains = ""
105# cookie_expire = "168h"
106# cookie_refresh = ""
107# cookie_secure = true
108# cookie_httponly = true