@@ -23,6 +23,7 @@ Valid providers are :
2323- [login.gov](#logingov-provider)
2424- [Nextcloud](#nextcloud-provider)
2525- [DigitalOcean](#digitalocean-auth-provider)
26+- [Bitbucket](#bitbucket-auth-provider)
2627
2728The provider can be selected using the `provider` configuration value.
2829
@@ -342,6 +343,27 @@ To use the provider, pass the following options:
342343
343344 Alternatively, set the equivalent options in the config file. The redirect URL defaults to `https://<requested host header>/oauth2/callback`. If you need to change it, you can use the `--redirect-url` command-line option.
344345
346+### Bitbucket Auth Provider
347+
348+1. [Add a new OAuth consumer](https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html)
349+ * In "Callback URL" use `https://<oauth2-proxy>/oauth2/callback`, substituting `<oauth2-proxy>` with the actual hostname that oauth2_proxy is running on.
350+ * In Permissions section select:
351+ * Account -> Email
352+ * Team membership -> Read
353+ * Repositories -> Read
354+2. Note the Client ID and Client Secret.
355+
356+To use the provider, pass the following options:
357+
358+```
359+ --provider=bitbucket
360+ --client-id=<Client ID>
361+ --client-secret=<Client Secret>
362+```
363+
364+The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: `--bitbucket-team=<Team name>`. To restrict the access to only these users who has access to one selected repository use `--bitbucket-repository=<Repository name>`.
365+
366+
345367## Email Authentication
346368
347369To authorize by email domain use `--email-domain=yourcompany.com`. To authorize individual email addresses use `--authenticated-emails-file=/path/to/file` with one email per line. To authorize all email addresses use `--email-domain=*`.