@@ -2,8 +2,8 @@ google_auth_proxy
22=================
33
44
5−A reverse proxy that provides authentication using Google OAuth2 to validate
6−individual accounts, or a whole google apps domain.
5+A reverse proxy that provides authentication using Google and other OAuth2
6+providers to validate individual accounts, or a whole google apps domain.
77
88[](http://travis-ci.org/bitly/google_auth_proxy)
99
@@ -31,8 +31,10 @@ individual accounts, or a whole google apps domain.
3131
3232## OAuth Configuration
3333
34−You will need to register an OAuth application with google, and configure it with Redirect URI(s) for the domain you
35−intend to run `google_auth_proxy` on.
34+You will need to register an OAuth application with Google (or [another
35+provider](#providers)), and configure it with Redirect URI(s) for the domain
36+you intend to run `google_auth_proxy` on. For Google, the registration steps
37+are:
3638
37391. Create a new project: https://console.developers.google.com/project
38402. Under "APIs & Auth", choose "Credentials"
@@ -73,9 +75,15 @@ Usage of google_auth_proxy:
7375 -google-apps-domain=: authenticate against the given Google apps domain (may be given multiple times)
7476 -htpasswd-file="": additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption
7577 -http-address="127.0.0.1:4180": [http://]<addr>:<port> or unix://<path> to listen on for HTTP clients
78+ -login-url="": Authentication endpoint
7679 -pass-basic-auth=true: pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream
7780 -pass-host-header=true: pass the request Host Header to upstream
81+ -profile-url="": Profile access endpoint
82+ -provider="": Oauth provider (defaults to Google)
83+ -redeem-url="": Token redemption endpoint
7884 -redirect-url="": the OAuth Redirect URL. ie: "https://internalapp.yourcompany.com/oauth2/callback"
85+ -request-logging=true: Log requests to stdout
86+ -scope="": Oauth scope specification
7987 -skip-auth-regex=: bypass authentication for requests path's that match (may be given multiple times)
8088 -upstream=: the http url(s) of the upstream endpoint. If multiple, routing is based on path
8189 -version=false: print version string
@@ -142,4 +150,19 @@ Google Auth Proxy logs requests to stdout in a format similar to Apache Combined
142150
143151```
144152<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] <HOST_HEADER> GET <UPSTREAM_HOST> "/path/" HTTP/1.1 "<USER_AGENT>" <RESPONSE_CODE> <RESPONSE_BYTES> <REQUEST_DURATION>
145−````
153+```
154+
155+## <a name="providers"></a>Providers other than Google
156+
157+Other providers besides Google can be specified by the `providers` flag/config
158+directive. Right now this includes:
159+
160+* `myusa` - The [MyUSA](https://alpha.my.usa.gov) authentication service
161+ ([GitHub](https://github.com/18F/myusa))
162+
163+## Adding a new Provider
164+
165+Follow the examples in the [`providers` package](providers/) to define a new
166+`Provider` instance. Add a new `case` to
167+[`providers.New()`](providers/providers.go) to allow the auth proxy to use the
168+new `Provider`.