@@ -188,27 +188,66 @@ Take note of your `TenantId` if applicable for your situation. The `TenantId` ca
188188
189189### OpenID Connect Provider
190190
191−OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects. This provider was originally built against CoreOS Dex and we will use it as an example.
191+OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects.
192192
193−1. Launch a Dex instance using the [getting started guide](https://github.com/coreos/dex/blob/master/Documentation/getting-started.md).
194−2. Setup oauth2-proxy with the correct provider and using the default ports and callbacks.
195−3. Login with the fixture use in the dex guide and run the oauth2-proxy with the following args:
193+This provider was originally built against CoreOS Dex and we will use it as an example.
194+The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below.
196195
197−```
196+#### Dex
197+
198+To configure the OIDC provider for Dex, perform the following steps:
199+
200+1. Download Dex:
201+
202+ ```
203+ go get github.com/dexidp/dex
204+ ```
205+
206+ See the [getting started guide](https://github.com/coreos/dex/blob/master/Documentation/getting-started.md) for more details.
207+
208+2. Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the `staticClients` section of `examples/config-dev.yaml`:
209+
210+ ```
211+ - id: oauth2-proxy
212+ redirectURIs:
213+ - 'http://127.0.0.1:4180/oauth2/callback'
214+ name: 'oauth2-proxy'
215+ secret: proxy
216+ ```
217+
218+3. Launch Dex: from `$GOPATH/github.com/dexidp/dex`, run:
219+
220+ ```
221+ bin/dex serve examples/config-dev.yaml
222+ ```
223+
224+4. In a second terminal, run the oauth2-proxy with the following args:
225+
226+ ```
198227 -provider oidc
199228 -provider-display-name "My OIDC Provider"
200229 -client-id oauth2-proxy
201230 -client-secret proxy
202231 -redirect-url http://127.0.0.1:4180/oauth2/callback
203− -oidc-issuer-url http://127.0.0.1:5556
232+ -oidc-issuer-url http://127.0.0.1:5556/dex
204233 -cookie-secure=false
205− -email-domain example.com
206−```
234+ -cookie-secret=secret
235+ -email-domain kilgore.trout
236+ ```
237+
238+ To serve the current working directory as a web site under the `/static` endpoint, add:
239+
240+ ```
241+ -upstream file://$PWD/#/static/
242+ ```
243+
244+5. Test the setup by visiting http://127.0.0.1:4180 or http://127.0.0.1:4180/static .
207245
208−The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta. To configure the OIDC provider for Okta, perform
209−the following steps:
246+See also [our local testing environment](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment) for a self-contained example using Docker and etcd as storage for Dex.
210247
211−#### Configuring the OIDC Provider with Okta
248+#### Okta
249+
250+To configure the OIDC provider for Okta, perform the following steps:
212251
2132521. Log in to Okta using an administrative account. It is suggested you try this in preview first, `example.oktapreview.com`
2142532. (OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,
@@ -231,30 +270,31 @@ you may wish to configure an authorization server for each application. Otherwis
231270* Under **Assignments** select the users or groups you wish to access your application.
2322714. Create a configuration file like the following:
233272
234−```
235−provider = "oidc"
236−redirect_url = "https://example.corp.com/oauth2/callback"
237−oidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"
238−upstreams = [
239− "https://example.corp.com"
240−]
241−email_domains = [
242− "corp.com"
243−]
244−client_id = "XXXXX"
245−client_secret = "YYYYY"
246−pass_access_token = true
247−cookie_secret = "ZZZZZ"
248−skip_provider_button = true
249−```
250−
251−The `oidc_issuer_url` is based on URL from your **Authorization Server**'s **Issuer** field in step 2, or simply https://corp.okta.com
273+ ```
274+ provider = "oidc"
275+ redirect_url = "https://example.corp.com/oauth2/callback"
276+ oidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"
277+ upstreams = [
278+ "https://example.corp.com"
279+ ]
280+ email_domains = [
281+ "corp.com"
282+ ]
283+ client_id = "XXXXX"
284+ client_secret = "YYYYY"
285+ pass_access_token = true
286+ cookie_secret = "ZZZZZ"
287+ skip_provider_button = true
288+ ```
289+
290+The `oidc_issuer_url` is based on URL from your **Authorization Server**'s **Issuer** field in step 2, or simply https://corp.okta.com .
252291The `client_id` and `client_secret` are configured in the application settings.
253292Generate a unique `client_secret` to encrypt the cookie.
254293
255294Then you can start the oauth2-proxy with `./oauth2-proxy --config /etc/example.cfg`
256295
257−#### Configuring the OIDC Provider with Okta - localhost
296+#### Okta - localhost
297+
2582981. Signup for developer account: https://developer.okta.com/signup/
2592992. Create New `Web` Application: https://${your-okta-domain}/dev/console/apps/new
2603003. Example Application Settings for localhost:
@@ -267,25 +307,25 @@ Then you can start the oauth2-proxy with `./oauth2-proxy --config /etc/example.c
2673074. Make note of the `Client ID` and `Client secret`, they are needed in a future step
2683085. Make note of the **default** Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as
2693096. Example config file `/etc/localhost.cfg`
270− ```
271− provider = "oidc"
272− redirect_url = "http://localhost:4180/oauth2/callback"
273− oidc_issuer_url = "https://${your-okta-domain}/oauth2/default"
274− upstreams = [
275− "http://0.0.0.0:8080"
276− ]
277− email_domains = [
278− "*"
279− ]
280− client_id = "XXX"
281− client_secret = "YYY"
282− pass_access_token = true
283− cookie_secret = "ZZZ"
284− cookie_secure = false
285− skip_provider_button = true
286− # Note: use the following for testing within a container
287− # http_address = "0.0.0.0:4180"
288− ```
310+ ```
311+ provider = "oidc"
312+ redirect_url = "http://localhost:4180/oauth2/callback"
313+ oidc_issuer_url = "https://${your-okta-domain}/oauth2/default"
314+ upstreams = [
315+ "http://0.0.0.0:8080"
316+ ]
317+ email_domains = [
318+ "*"
319+ ]
320+ client_id = "XXX"
321+ client_secret = "YYY"
322+ pass_access_token = true
323+ cookie_secret = "ZZZ"
324+ cookie_secure = false
325+ skip_provider_button = true
326+ # Note: use the following for testing within a container
327+ # http_address = "0.0.0.0:4180"
328+ ```
2893297. Then you can start the oauth2-proxy with `./oauth2-proxy --config /etc/localhost.cfg`
290330
291331### login.gov Provider