@@ -22,105 +22,105 @@ type SignatureData struct {
2222// Options holds Configuration Options that can be set by Command Line Flag,
2323// or Config File
2424type Options struct {
25− ProxyPrefix string `flag:"proxy-prefix" cfg:"proxy_prefix" env:"OAUTH2_PROXY_PROXY_PREFIX"`
26− PingPath string `flag:"ping-path" cfg:"ping_path" env:"OAUTH2_PROXY_PING_PATH"`
27− ProxyWebSockets bool `flag:"proxy-websockets" cfg:"proxy_websockets" env:"OAUTH2_PROXY_PROXY_WEBSOCKETS"`
28− HTTPAddress string `flag:"http-address" cfg:"http_address" env:"OAUTH2_PROXY_HTTP_ADDRESS"`
29− HTTPSAddress string `flag:"https-address" cfg:"https_address" env:"OAUTH2_PROXY_HTTPS_ADDRESS"`
30− ReverseProxy bool `flag:"reverse-proxy" cfg:"reverse_proxy" env:"OAUTH2_PROXY_REVERSE_PROXY"`
31− RealClientIPHeader string `flag:"real-client-ip-header" cfg:"real_client_ip_header" env:"OAUTH2_PROXY_REAL_CLIENT_IP_HEADER"`
32− ForceHTTPS bool `flag:"force-https" cfg:"force_https" env:"OAUTH2_PROXY_FORCE_HTTPS"`
33− RawRedirectURL string `flag:"redirect-url" cfg:"redirect_url" env:"OAUTH2_PROXY_REDIRECT_URL"`
34− ClientID string `flag:"client-id" cfg:"client_id" env:"OAUTH2_PROXY_CLIENT_ID"`
35− ClientSecret string `flag:"client-secret" cfg:"client_secret" env:"OAUTH2_PROXY_CLIENT_SECRET"`
36− ClientSecretFile string `flag:"client-secret-file" cfg:"client_secret_file" env:"OAUTH2_PROXY_CLIENT_SECRET_FILE"`
37− TLSCertFile string `flag:"tls-cert-file" cfg:"tls_cert_file" env:"OAUTH2_PROXY_TLS_CERT_FILE"`
38− TLSKeyFile string `flag:"tls-key-file" cfg:"tls_key_file" env:"OAUTH2_PROXY_TLS_KEY_FILE"`
25+ ProxyPrefix string `flag:"proxy-prefix" cfg:"proxy_prefix"`
26+ PingPath string `flag:"ping-path" cfg:"ping_path"`
27+ ProxyWebSockets bool `flag:"proxy-websockets" cfg:"proxy_websockets"`
28+ HTTPAddress string `flag:"http-address" cfg:"http_address"`
29+ HTTPSAddress string `flag:"https-address" cfg:"https_address"`
30+ ReverseProxy bool `flag:"reverse-proxy" cfg:"reverse_proxy"`
31+ RealClientIPHeader string `flag:"real-client-ip-header" cfg:"real_client_ip_header"`
32+ ForceHTTPS bool `flag:"force-https" cfg:"force_https"`
33+ RawRedirectURL string `flag:"redirect-url" cfg:"redirect_url"`
34+ ClientID string `flag:"client-id" cfg:"client_id"`
35+ ClientSecret string `flag:"client-secret" cfg:"client_secret"`
36+ ClientSecretFile string `flag:"client-secret-file" cfg:"client_secret_file"`
37+ TLSCertFile string `flag:"tls-cert-file" cfg:"tls_cert_file"`
38+ TLSKeyFile string `flag:"tls-key-file" cfg:"tls_key_file"`
3939
40− AuthenticatedEmailsFile string `flag:"authenticated-emails-file" cfg:"authenticated_emails_file" env:"OAUTH2_PROXY_AUTHENTICATED_EMAILS_FILE"`
41− KeycloakGroup string `flag:"keycloak-group" cfg:"keycloak_group" env:"OAUTH2_PROXY_KEYCLOAK_GROUP"`
42− AzureTenant string `flag:"azure-tenant" cfg:"azure_tenant" env:"OAUTH2_PROXY_AZURE_TENANT"`
43− BitbucketTeam string `flag:"bitbucket-team" cfg:"bitbucket_team" env:"OAUTH2_PROXY_BITBUCKET_TEAM"`
44− BitbucketRepository string `flag:"bitbucket-repository" cfg:"bitbucket_repository" env:"OAUTH2_PROXY_BITBUCKET_REPOSITORY"`
45− EmailDomains []string `flag:"email-domain" cfg:"email_domains" env:"OAUTH2_PROXY_EMAIL_DOMAINS"`
46− WhitelistDomains []string `flag:"whitelist-domain" cfg:"whitelist_domains" env:"OAUTH2_PROXY_WHITELIST_DOMAINS"`
47− GitHubOrg string `flag:"github-org" cfg:"github_org" env:"OAUTH2_PROXY_GITHUB_ORG"`
48− GitHubTeam string `flag:"github-team" cfg:"github_team" env:"OAUTH2_PROXY_GITHUB_TEAM"`
49− GitHubRepo string `flag:"github-repo" cfg:"github_repo" env:"OAUTH2_PROXY_GITHUB_REPO"`
50− GitHubToken string `flag:"github-token" cfg:"github_token" env:"OAUTH2_PROXY_GITHUB_TOKEN"`
51− GitLabGroup string `flag:"gitlab-group" cfg:"gitlab_group" env:"OAUTH2_PROXY_GITLAB_GROUP"`
52− GoogleGroups []string `flag:"google-group" cfg:"google_group" env:"OAUTH2_PROXY_GOOGLE_GROUPS"`
53− GoogleAdminEmail string `flag:"google-admin-email" cfg:"google_admin_email" env:"OAUTH2_PROXY_GOOGLE_ADMIN_EMAIL"`
54− GoogleServiceAccountJSON string `flag:"google-service-account-json" cfg:"google_service_account_json" env:"OAUTH2_PROXY_GOOGLE_SERVICE_ACCOUNT_JSON"`
55− HtpasswdFile string `flag:"htpasswd-file" cfg:"htpasswd_file" env:"OAUTH2_PROXY_HTPASSWD_FILE"`
56− DisplayHtpasswdForm bool `flag:"display-htpasswd-form" cfg:"display_htpasswd_form" env:"OAUTH2_PROXY_DISPLAY_HTPASSWD_FORM"`
57− CustomTemplatesDir string `flag:"custom-templates-dir" cfg:"custom_templates_dir" env:"OAUTH2_PROXY_CUSTOM_TEMPLATES_DIR"`
58− Banner string `flag:"banner" cfg:"banner" env:"OAUTH2_PROXY_BANNER"`
59− Footer string `flag:"footer" cfg:"footer" env:"OAUTH2_PROXY_FOOTER"`
40+ AuthenticatedEmailsFile string `flag:"authenticated-emails-file" cfg:"authenticated_emails_file"`
41+ KeycloakGroup string `flag:"keycloak-group" cfg:"keycloak_group"`
42+ AzureTenant string `flag:"azure-tenant" cfg:"azure_tenant"`
43+ BitbucketTeam string `flag:"bitbucket-team" cfg:"bitbucket_team"`
44+ BitbucketRepository string `flag:"bitbucket-repository" cfg:"bitbucket_repository"`
45+ EmailDomains []string `flag:"email-domain" cfg:"email_domains"`
46+ WhitelistDomains []string `flag:"whitelist-domain" cfg:"whitelist_domains"`
47+ GitHubOrg string `flag:"github-org" cfg:"github_org"`
48+ GitHubTeam string `flag:"github-team" cfg:"github_team"`
49+ GitHubRepo string `flag:"github-repo" cfg:"github_repo"`
50+ GitHubToken string `flag:"github-token" cfg:"github_token"`
51+ GitLabGroup string `flag:"gitlab-group" cfg:"gitlab_group"`
52+ GoogleGroups []string `flag:"google-group" cfg:"google_group"`
53+ GoogleAdminEmail string `flag:"google-admin-email" cfg:"google_admin_email"`
54+ GoogleServiceAccountJSON string `flag:"google-service-account-json" cfg:"google_service_account_json"`
55+ HtpasswdFile string `flag:"htpasswd-file" cfg:"htpasswd_file"`
56+ DisplayHtpasswdForm bool `flag:"display-htpasswd-form" cfg:"display_htpasswd_form"`
57+ CustomTemplatesDir string `flag:"custom-templates-dir" cfg:"custom_templates_dir"`
58+ Banner string `flag:"banner" cfg:"banner"`
59+ Footer string `flag:"footer" cfg:"footer"`
6060
6161 Cookie CookieOptions `cfg:",squash"`
6262 Session SessionOptions `cfg:",squash"`
6363
64− Upstreams []string `flag:"upstream" cfg:"upstreams" env:"OAUTH2_PROXY_UPSTREAMS"`
65− SkipAuthRegex []string `flag:"skip-auth-regex" cfg:"skip_auth_regex" env:"OAUTH2_PROXY_SKIP_AUTH_REGEX"`
66− SkipJwtBearerTokens bool `flag:"skip-jwt-bearer-tokens" cfg:"skip_jwt_bearer_tokens" env:"OAUTH2_PROXY_SKIP_JWT_BEARER_TOKENS"`
67− ExtraJwtIssuers []string `flag:"extra-jwt-issuers" cfg:"extra_jwt_issuers" env:"OAUTH2_PROXY_EXTRA_JWT_ISSUERS"`
68− PassBasicAuth bool `flag:"pass-basic-auth" cfg:"pass_basic_auth" env:"OAUTH2_PROXY_PASS_BASIC_AUTH"`
69− SetBasicAuth bool `flag:"set-basic-auth" cfg:"set_basic_auth" env:"OAUTH2_PROXY_SET_BASIC_AUTH"`
70− PreferEmailToUser bool `flag:"prefer-email-to-user" cfg:"prefer_email_to_user" env:"OAUTH2_PROXY_PREFER_EMAIL_TO_USER"`
71− BasicAuthPassword string `flag:"basic-auth-password" cfg:"basic_auth_password" env:"OAUTH2_PROXY_BASIC_AUTH_PASSWORD"`
72− PassAccessToken bool `flag:"pass-access-token" cfg:"pass_access_token" env:"OAUTH2_PROXY_PASS_ACCESS_TOKEN"`
73− PassHostHeader bool `flag:"pass-host-header" cfg:"pass_host_header" env:"OAUTH2_PROXY_PASS_HOST_HEADER"`
74− SkipProviderButton bool `flag:"skip-provider-button" cfg:"skip_provider_button" env:"OAUTH2_PROXY_SKIP_PROVIDER_BUTTON"`
75− PassUserHeaders bool `flag:"pass-user-headers" cfg:"pass_user_headers" env:"OAUTH2_PROXY_PASS_USER_HEADERS"`
76− SSLInsecureSkipVerify bool `flag:"ssl-insecure-skip-verify" cfg:"ssl_insecure_skip_verify" env:"OAUTH2_PROXY_SSL_INSECURE_SKIP_VERIFY"`
77− SSLUpstreamInsecureSkipVerify bool `flag:"ssl-upstream-insecure-skip-verify" cfg:"ssl_upstream_insecure_skip_verify" env:"OAUTH2_PROXY_SSL_UPSTREAM_INSECURE_SKIP_VERIFY"`
78− SetXAuthRequest bool `flag:"set-xauthrequest" cfg:"set_xauthrequest" env:"OAUTH2_PROXY_SET_XAUTHREQUEST"`
79− SetAuthorization bool `flag:"set-authorization-header" cfg:"set_authorization_header" env:"OAUTH2_PROXY_SET_AUTHORIZATION_HEADER"`
80− PassAuthorization bool `flag:"pass-authorization-header" cfg:"pass_authorization_header" env:"OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER"`
81− SkipAuthPreflight bool `flag:"skip-auth-preflight" cfg:"skip_auth_preflight" env:"OAUTH2_PROXY_SKIP_AUTH_PREFLIGHT"`
82− FlushInterval time.Duration `flag:"flush-interval" cfg:"flush_interval" env:"OAUTH2_PROXY_FLUSH_INTERVAL"`
64+ Upstreams []string `flag:"upstream" cfg:"upstreams"`
65+ SkipAuthRegex []string `flag:"skip-auth-regex" cfg:"skip_auth_regex"`
66+ SkipJwtBearerTokens bool `flag:"skip-jwt-bearer-tokens" cfg:"skip_jwt_bearer_tokens"`
67+ ExtraJwtIssuers []string `flag:"extra-jwt-issuers" cfg:"extra_jwt_issuers"`
68+ PassBasicAuth bool `flag:"pass-basic-auth" cfg:"pass_basic_auth"`
69+ SetBasicAuth bool `flag:"set-basic-auth" cfg:"set_basic_auth"`
70+ PreferEmailToUser bool `flag:"prefer-email-to-user" cfg:"prefer_email_to_user"`
71+ BasicAuthPassword string `flag:"basic-auth-password" cfg:"basic_auth_password"`
72+ PassAccessToken bool `flag:"pass-access-token" cfg:"pass_access_token"`
73+ PassHostHeader bool `flag:"pass-host-header" cfg:"pass_host_header"`
74+ SkipProviderButton bool `flag:"skip-provider-button" cfg:"skip_provider_button"`
75+ PassUserHeaders bool `flag:"pass-user-headers" cfg:"pass_user_headers"`
76+ SSLInsecureSkipVerify bool `flag:"ssl-insecure-skip-verify" cfg:"ssl_insecure_skip_verify"`
77+ SSLUpstreamInsecureSkipVerify bool `flag:"ssl-upstream-insecure-skip-verify" cfg:"ssl_upstream_insecure_skip_verify"`
78+ SetXAuthRequest bool `flag:"set-xauthrequest" cfg:"set_xauthrequest"`
79+ SetAuthorization bool `flag:"set-authorization-header" cfg:"set_authorization_header"`
80+ PassAuthorization bool `flag:"pass-authorization-header" cfg:"pass_authorization_header"`
81+ SkipAuthPreflight bool `flag:"skip-auth-preflight" cfg:"skip_auth_preflight"`
82+ FlushInterval time.Duration `flag:"flush-interval" cfg:"flush_interval"`
8383
8484 // These options allow for other providers besides Google, with
8585 // potential overrides.
86− ProviderType string `flag:"provider" cfg:"provider" env:"OAUTH2_PROXY_PROVIDER"`
87− ProviderName string `flag:"provider-display-name" cfg:"provider_display_name" env:"OAUTH2_PROXY_PROVIDER_DISPLAY_NAME"`
88− OIDCIssuerURL string `flag:"oidc-issuer-url" cfg:"oidc_issuer_url" env:"OAUTH2_PROXY_OIDC_ISSUER_URL"`
89− InsecureOIDCAllowUnverifiedEmail bool `flag:"insecure-oidc-allow-unverified-email" cfg:"insecure_oidc_allow_unverified_email" env:"OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL"`
90− InsecureOIDCSkipIssuerVerification bool `flag:"insecure-oidc-skip-issuer-verification" cfg:"insecure_oidc_skip_issuer_verification" env:"OAUTH2_PROXY_INSECURE_OIDC_SKIP_ISSUER_VERIFICATION"`
91− SkipOIDCDiscovery bool `flag:"skip-oidc-discovery" cfg:"skip_oidc_discovery" env:"OAUTH2_PROXY_SKIP_OIDC_DISCOVERY"`
92− OIDCJwksURL string `flag:"oidc-jwks-url" cfg:"oidc_jwks_url" env:"OAUTH2_PROXY_OIDC_JWKS_URL"`
93− LoginURL string `flag:"login-url" cfg:"login_url" env:"OAUTH2_PROXY_LOGIN_URL"`
94− RedeemURL string `flag:"redeem-url" cfg:"redeem_url" env:"OAUTH2_PROXY_REDEEM_URL"`
95− ProfileURL string `flag:"profile-url" cfg:"profile_url" env:"OAUTH2_PROXY_PROFILE_URL"`
96− ProtectedResource string `flag:"resource" cfg:"resource" env:"OAUTH2_PROXY_RESOURCE"`
97− ValidateURL string `flag:"validate-url" cfg:"validate_url" env:"OAUTH2_PROXY_VALIDATE_URL"`
98− Scope string `flag:"scope" cfg:"scope" env:"OAUTH2_PROXY_SCOPE"`
99− Prompt string `flag:"prompt" cfg:"prompt" env:"OAUTH2_PROXY_PROMPT"`
100− ApprovalPrompt string `flag:"approval-prompt" cfg:"approval_prompt" env:"OAUTH2_PROXY_APPROVAL_PROMPT"` // Deprecated by OIDC 1.0
101− UserIDClaim string `flag:"user-id-claim" cfg:"user_id_claim" env:"OAUTH2_PROXY_USER_ID_CLAIM"`
86+ ProviderType string `flag:"provider" cfg:"provider"`
87+ ProviderName string `flag:"provider-display-name" cfg:"provider_display_name"`
88+ OIDCIssuerURL string `flag:"oidc-issuer-url" cfg:"oidc_issuer_url"`
89+ InsecureOIDCAllowUnverifiedEmail bool `flag:"insecure-oidc-allow-unverified-email" cfg:"insecure_oidc_allow_unverified_email"`
90+ InsecureOIDCSkipIssuerVerification bool `flag:"insecure-oidc-skip-issuer-verification" cfg:"insecure_oidc_skip_issuer_verification"`
91+ SkipOIDCDiscovery bool `flag:"skip-oidc-discovery" cfg:"skip_oidc_discovery"`
92+ OIDCJwksURL string `flag:"oidc-jwks-url" cfg:"oidc_jwks_url"`
93+ LoginURL string `flag:"login-url" cfg:"login_url"`
94+ RedeemURL string `flag:"redeem-url" cfg:"redeem_url"`
95+ ProfileURL string `flag:"profile-url" cfg:"profile_url"`
96+ ProtectedResource string `flag:"resource" cfg:"resource"`
97+ ValidateURL string `flag:"validate-url" cfg:"validate_url"`
98+ Scope string `flag:"scope" cfg:"scope"`
99+ Prompt string `flag:"prompt" cfg:"prompt"`
100+ ApprovalPrompt string `flag:"approval-prompt" cfg:"approval_prompt"` // Deprecated by OIDC 1.0
101+ UserIDClaim string `flag:"user-id-claim" cfg:"user_id_claim"`
102102
103103 // Configuration values for logging
104− LoggingFilename string `flag:"logging-filename" cfg:"logging_filename" env:"OAUTH2_PROXY_LOGGING_FILENAME"`
105− LoggingMaxSize int `flag:"logging-max-size" cfg:"logging_max_size" env:"OAUTH2_PROXY_LOGGING_MAX_SIZE"`
106− LoggingMaxAge int `flag:"logging-max-age" cfg:"logging_max_age" env:"OAUTH2_PROXY_LOGGING_MAX_AGE"`
107− LoggingMaxBackups int `flag:"logging-max-backups" cfg:"logging_max_backups" env:"OAUTH2_PROXY_LOGGING_MAX_BACKUPS"`
108− LoggingLocalTime bool `flag:"logging-local-time" cfg:"logging_local_time" env:"OAUTH2_PROXY_LOGGING_LOCAL_TIME"`
109− LoggingCompress bool `flag:"logging-compress" cfg:"logging_compress" env:"OAUTH2_PROXY_LOGGING_COMPRESS"`
110− StandardLogging bool `flag:"standard-logging" cfg:"standard_logging" env:"OAUTH2_PROXY_STANDARD_LOGGING"`
111− StandardLoggingFormat string `flag:"standard-logging-format" cfg:"standard_logging_format" env:"OAUTH2_PROXY_STANDARD_LOGGING_FORMAT"`
112− RequestLogging bool `flag:"request-logging" cfg:"request_logging" env:"OAUTH2_PROXY_REQUEST_LOGGING"`
113− RequestLoggingFormat string `flag:"request-logging-format" cfg:"request_logging_format" env:"OAUTH2_PROXY_REQUEST_LOGGING_FORMAT"`
114− ExcludeLoggingPaths string `flag:"exclude-logging-paths" cfg:"exclude_logging_paths" env:"OAUTH2_PROXY_EXCLUDE_LOGGING_PATHS"`
115− SilencePingLogging bool `flag:"silence-ping-logging" cfg:"silence_ping_logging" env:"OAUTH2_PROXY_SILENCE_PING_LOGGING"`
116− AuthLogging bool `flag:"auth-logging" cfg:"auth_logging" env:"OAUTH2_PROXY_LOGGING_AUTH_LOGGING"`
117− AuthLoggingFormat string `flag:"auth-logging-format" cfg:"auth_logging_format" env:"OAUTH2_PROXY_AUTH_LOGGING_FORMAT"`
118− SignatureKey string `flag:"signature-key" cfg:"signature_key" env:"OAUTH2_PROXY_SIGNATURE_KEY"`
119− AcrValues string `flag:"acr-values" cfg:"acr_values" env:"OAUTH2_PROXY_ACR_VALUES"`
120− JWTKey string `flag:"jwt-key" cfg:"jwt_key" env:"OAUTH2_PROXY_JWT_KEY"`
121− JWTKeyFile string `flag:"jwt-key-file" cfg:"jwt_key_file" env:"OAUTH2_PROXY_JWT_KEY_FILE"`
122− PubJWKURL string `flag:"pubjwk-url" cfg:"pubjwk_url" env:"OAUTH2_PROXY_PUBJWK_URL"`
123− GCPHealthChecks bool `flag:"gcp-healthchecks" cfg:"gcp_healthchecks" env:"OAUTH2_PROXY_GCP_HEALTHCHECKS"`
104+ LoggingFilename string `flag:"logging-filename" cfg:"logging_filename"`
105+ LoggingMaxSize int `flag:"logging-max-size" cfg:"logging_max_size"`
106+ LoggingMaxAge int `flag:"logging-max-age" cfg:"logging_max_age"`
107+ LoggingMaxBackups int `flag:"logging-max-backups" cfg:"logging_max_backups"`
108+ LoggingLocalTime bool `flag:"logging-local-time" cfg:"logging_local_time"`
109+ LoggingCompress bool `flag:"logging-compress" cfg:"logging_compress"`
110+ StandardLogging bool `flag:"standard-logging" cfg:"standard_logging"`
111+ StandardLoggingFormat string `flag:"standard-logging-format" cfg:"standard_logging_format"`
112+ RequestLogging bool `flag:"request-logging" cfg:"request_logging"`
113+ RequestLoggingFormat string `flag:"request-logging-format" cfg:"request_logging_format"`
114+ ExcludeLoggingPaths string `flag:"exclude-logging-paths" cfg:"exclude_logging_paths"`
115+ SilencePingLogging bool `flag:"silence-ping-logging" cfg:"silence_ping_logging"`
116+ AuthLogging bool `flag:"auth-logging" cfg:"auth_logging"`
117+ AuthLoggingFormat string `flag:"auth-logging-format" cfg:"auth_logging_format"`
118+ SignatureKey string `flag:"signature-key" cfg:"signature_key"`
119+ AcrValues string `flag:"acr-values" cfg:"acr_values"`
120+ JWTKey string `flag:"jwt-key" cfg:"jwt_key"`
121+ JWTKeyFile string `flag:"jwt-key-file" cfg:"jwt_key_file"`
122+ PubJWKURL string `flag:"pubjwk-url" cfg:"pubjwk_url"`
123+ GCPHealthChecks bool `flag:"gcp-healthchecks" cfg:"gcp_healthchecks"`
124124
125125 // internal values that are set after config validation
126126 redirectURL *url.URL