git.iko.soy/typeable/oauth2-proxy
on master help sign in
added jwt-key-file option, update docs
commit1ae62a3343b03a6cc97222bc9bacc65c45917952 authortimothy-spencer <timothy.spencer@gsa.gov> dateWed 20 Mar 2019, 15:15 (8 years ago) parentee4ebe5
7 files changed+62−10
compare with master
unifiedsplit
CHANGELOG.md+2 Dockerfile+8−2 Dockerfile.arm64+8−2 Dockerfile.armv6+8−2 README.md+12−1 main.go+2−1 options.go+22−2
CHANGELOG.md+2
@@ -2,6 +2,8 @@
22
33## Changes since v3.2.0
44
5+- [#111](https://github.com/pusher/oauth2_proxy/pull/111) Add option for telling where to find a login.gov JWT key file (@timothy-spencer)
6+
57# v3.2.0
68
79## Release highlights
Dockerfile+8−2
@@ -11,13 +11,19 @@ COPY . .
1111# Fetch dependencies
1212RUN dep ensure --vendor-only
1313
14−# Build binary
15−RUN ./configure && make build
14+# Build binary and make sure there is at least an empty key file.
15+# This is useful for GCP App Engine custom runtime builds, because
16+# you cannot use multiline variables in their app.yaml, so you have to
17+# build the key into the container and then tell it where it is
18+# by setting OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem
19+# in app.yaml instead.
20+RUN ./configure && make build && touch jwt_signing_key.pem
1621
1722# Copy binary to alpine
1823FROM alpine:3.8
1924COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
2025COPY --from=builder /go/src/github.com/pusher/oauth2_proxy/oauth2_proxy /bin/oauth2_proxy
26+COPY --from=builder /go/src/github.com/pusher/oauth2_proxy/jwt_signing_key.pem /etc/ssl/private/jwt_signing_key.pem
2127
2228RUN addgroup -S -g 2000 oauth2proxy && adduser -S -u 2000 oauth2proxy -G oauth2proxy
2329USER oauth2proxy
Dockerfile.arm64+8−2
@@ -11,13 +11,19 @@ COPY . .
1111# Fetch dependencies
1212RUN dep ensure --vendor-only
1313
14−# Build binary
15−RUN ./configure && GOARCH=arm64 make build
14+# Build binary and make sure there is at least an empty key file.
15+# This is useful for GCP App Engine custom runtime builds, because
16+# you cannot use multiline variables in their app.yaml, so you have to
17+# build the key into the container and then tell it where it is
18+# by setting OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem
19+# in app.yaml instead.
20+RUN ./configure && GOARCH=arm64 make build && touch jwt_signing_key.pem
1621
1722# Copy binary to alpine
1823FROM arm64v8/alpine:3.8
1924COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
2025COPY --from=builder /go/src/github.com/pusher/oauth2_proxy/oauth2_proxy /bin/oauth2_proxy
26+COPY --from=builder /go/src/github.com/pusher/oauth2_proxy/jwt_signing_key.pem /etc/ssl/private/jwt_signing_key.pem
2127
2228RUN addgroup -S -g 2000 oauth2proxy && adduser -S -u 2000 oauth2proxy -G oauth2proxy
2329USER oauth2proxy
Dockerfile.armv6+8−2
@@ -11,13 +11,19 @@ COPY . .
1111# Fetch dependencies
1212RUN dep ensure --vendor-only
1313
14−# Build binary
15−RUN ./configure && GOARCH=arm GOARM=6 make build
14+# Build binary and make sure there is at least an empty key file.
15+# This is useful for GCP App Engine custom runtime builds, because
16+# you cannot use multiline variables in their app.yaml, so you have to
17+# build the key into the container and then tell it where it is
18+# by setting OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem
19+# in app.yaml instead.
20+RUN ./configure && GOARCH=arm GOARM=6 make build && touch jwt_signing_key.pem
1621
1722# Copy binary to alpine
1823FROM arm32v6/alpine:3.8
1924COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
2025COPY --from=builder /go/src/github.com/pusher/oauth2_proxy/oauth2_proxy /bin/oauth2_proxy
26+COPY --from=builder /go/src/github.com/pusher/oauth2_proxy/jwt_signing_key.pem /etc/ssl/private/jwt_signing_key.pem
2127
2228RUN addgroup -S -g 2000 oauth2proxy && adduser -S -u 2000 oauth2proxy -G oauth2proxy
2329USER oauth2proxy
README.md+12−1
@@ -216,6 +216,13 @@ Now start the proxy up with the following options:
216216 -jwt-key="${OAUTH2_PROXY_JWT_KEY}"
217217```
218218You can also set all these options with environment variables, for use in cloud/docker environments.
219+One tricky thing that you may encounter is that some cloud environments will pass in environment
220+variables in a docker env-file, which does not allow multiline variables like a PEM file.
221+If you encounter this, then you can create a `jwt_signing_key.pem` file in the top level
222+directory of the repo which contains the key in PEM format and then do your docker build.
223+The docker build process will copy that file into your image which you can then access by
224+setting the `OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem`
225+environment variable, or by setting `-jwt-key-file=/etc/ssl/private/jwt_signing_key.pem` on the commandline.
219226
220227Once it is running, you should be able to go to `http://localhost:4180/` in your browser,
221228get authenticated by the login.gov integration server, and then get proxied on to your
@@ -261,6 +268,7 @@ An example [oauth2_proxy.cfg](contrib/oauth2_proxy.cfg.example) config file is i
261268
262269```
263270Usage of oauth2_proxy:
271+ -acr-values string: optional, used by login.gov (default "http://idmanagement.gov/ns/assurance/loa/1")
264272 -approval-prompt string: OAuth approval_prompt (default "force")
265273 -authenticated-emails-file string: authenticate against emails via file (one per line)
266274 -azure-tenant string: go to a tenant-specific or common (tenant-independent) endpoint. (default "common")
@@ -269,10 +277,10 @@ Usage of oauth2_proxy:
269277 -client-secret string: the OAuth Client Secret
270278 -config string: path to config file
271279 -cookie-domain string: an optional cookie domain to force cookies to (ie: .yourcompany.com)
272− -cookie-path string: an optional cookie path to force cookies to (ie: /foo)
273280 -cookie-expire duration: expire timeframe for cookie (default 168h0m0s)
274281 -cookie-httponly: set HttpOnly cookie flag (default true)
275282 -cookie-name string: the name of the cookie that the oauth_proxy creates (default "_oauth2_proxy")
283+ -cookie-path string: an optional cookie path to force cookies to (ie: /poc/)* (default "/")
276284 -cookie-refresh duration: refresh the cookie after this duration; 0 to disable
277285 -cookie-secret string: the seed string for secure cookies (optionally base64 encoded)
278286 -cookie-secure: set secure (HTTPS) cookie flag (default true)
@@ -290,6 +298,8 @@ Usage of oauth2_proxy:
290298 -htpasswd-file string: additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption
291299 -http-address string: [http://]<addr>:<port> or unix://<path> to listen on for HTTP clients (default "127.0.0.1:4180")
292300 -https-address string: <addr>:<port> to listen on for HTTPS clients (default ":443")
301+ -jwt-key string: private key in PEM format used to sign JWT, so that you can say something like -jwt-key="${OAUTH2_PROXY_JWT_KEY}": required by login.gov
302+ -jwt-key-file string: path to the private key file in PEM format used to sign the JWT so that you can say something like -jwt-key-file=/etc/ssl/private/jwt_signing_key.pem: required by login.gov
293303 -login-url string: Authentication endpoint
294304 -oidc-issuer-url: the OpenID Connect issuer URL. ie: "https://accounts.google.com"
295305 -oidc-jwks-url string: OIDC JWKS URI for token verification; required if OIDC discovery is disabled
@@ -302,6 +312,7 @@ Usage of oauth2_proxy:
302312 -provider string: OAuth provider (default "google")
303313 -proxy-prefix string: the url root path that this proxy should be nested under (e.g. /<oauth2>/sign_in) (default "/oauth2")
304314 -proxy-websockets: enables WebSocket proxying (default true)
315+ -pubjwk-url string: JWK pubkey access endpoint: required by login.gov
305316 -redeem-url string: Token redemption endpoint
306317 -redirect-url string: the OAuth Redirect URL. ie: "https://internalapp.yourcompany.com/oauth2/callback"
307318 -request-logging: Log requests to stdout (default true)
main.go+2−1
@@ -92,7 +92,8 @@ func main() {
9292
9393 flagSet.String("signature-key", "", "GAP-Signature request signature key (algorithm:secretkey)")
9494 flagSet.String("acr-values", "http://idmanagement.gov/ns/assurance/loa/1", "acr values string: optional, used by login.gov")
95− flagSet.String("jwt-key", "", "private key used to sign JWT: required by login.gov")
95+ flagSet.String("jwt-key", "", "private key in PEM format used to sign JWT, so that you can say something like -jwt-key=\"${OAUTH2_PROXY_JWT_KEY}\": required by login.gov")
96+ flagSet.String("jwt-key-file", "", "path to the private key file in PEM format used to sign the JWT so that you can say something like -jwt-key-file=/etc/ssl/private/jwt_signing_key.pem: required by login.gov")
9697 flagSet.String("pubjwk-url", "", "JWK pubkey access endpoint: required by login.gov")
9798 flagSet.Bool("gcp-healthchecks", false, "Enable GCP/GKE healthcheck endpoints")
9899
options.go+22−2
@@ -6,6 +6,7 @@ import (
66 "crypto/tls"
77 "encoding/base64"
88 "fmt"
9+ "io/ioutil"
910 "net/http"
1011 "net/url"
1112 "os"
@@ -90,6 +91,7 @@ type Options struct {
9091 SignatureKey string `flag:"signature-key" cfg:"signature_key" env:"OAUTH2_PROXY_SIGNATURE_KEY"`
9192 AcrValues string `flag:"acr-values" cfg:"acr_values" env:"OAUTH2_PROXY_ACR_VALUES"`
9293 JWTKey string `flag:"jwt-key" cfg:"jwt_key" env:"OAUTH2_PROXY_JWT_KEY"`
94+ JWTKeyFile string `flag:"jwt-key-file" cfg:"jwt_key_file" env:"OAUTH2_PROXY_JWT_KEY_FILE"`
9395 PubJWKURL string `flag:"pubjwk-url" cfg:"pubjwk_url" env:"OAUTH2_PROXY_PUBJWK_URL"`
9496 GCPHealthChecks bool `flag:"gcp-healthchecks" cfg:"gcp_healthchecks" env:"OAUTH2_PROXY_GCP_HEALTHCHECKS"`
9597
@@ -328,15 +330,33 @@ func parseProviderInfo(o *Options, msgs []string) []string {
328330 case *providers.LoginGovProvider:
329331 p.AcrValues = o.AcrValues
330332 p.PubJWKURL, msgs = parseURL(o.PubJWKURL, "pubjwk", msgs)
331− if o.JWTKey == "" {
333+
334+ // JWT key can be supplied via env variable or file in the filesystem, but not both.
335+ switch {
336+ case o.JWTKey != "" && o.JWTKeyFile != "":
337+ msgs = append(msgs, "cannot set both jwt-key and jwt-key-file options")
338+ case o.JWTKey == "" && o.JWTKeyFile == "":
332339 msgs = append(msgs, "login.gov provider requires a private key for signing JWTs")
333− } else {
340+ case o.JWTKey != "":
341+ // The JWT Key is in the commandline argument
334342 signKey, err := jwt.ParseRSAPrivateKeyFromPEM([]byte(o.JWTKey))
335343 if err != nil {
336344 msgs = append(msgs, "could not parse RSA Private Key PEM")
337345 } else {
338346 p.JWTKey = signKey
339347 }
348+ case o.JWTKeyFile != "":
349+ // The JWT key is in the filesystem
350+ keyData, err := ioutil.ReadFile(o.JWTKeyFile)
351+ if err != nil {
352+ msgs = append(msgs, "could not read key file: "+o.JWTKeyFile)
353+ }
354+ signKey, err := jwt.ParseRSAPrivateKeyFromPEM(keyData)
355+ if err != nil {
356+ msgs = append(msgs, "could not parse private key from PEM file:"+o.JWTKeyFile)
357+ } else {
358+ p.JWTKey = signKey
359+ }
340360 }
341361 }
342362 return msgs