5788beb · typeable/oauth2-proxy

CHANGELOG.md+1

@@ -36,6 +36,7 @@

36- [#1039](https://github.com/oauth2-proxy/oauth2-proxy/pull/1039) Ensure errors in tests are logged to the GinkgoWriter (@JoelSpeed)

37- [#980](https://github.com/oauth2-proxy/oauth2-proxy/pull/980) Add Prometheus metrics endpoint

38- [#1023](https://github.com/oauth2-proxy/oauth2-proxy/pull/1023) Update docs on Traefik ForwardAuth support without the use of Traefik 'errors' middleware

39+- [#1091](https://github.com/oauth2-proxy/oauth2-proxy/pull/1091) Add an example with Traefik (configuration without Traefik 'errors' middleware)

39

40

40# V7.0.1

41# V7.0.1

41

42

contrib/local-environment/Makefile+8

@@ -38,3 +38,11 @@ kubernetes-up:

38.PHONY: kubernetes-down

39kubernetes-down:

40 make -C kubernetes delete-cluster

41+

42+.PHONY: traefik-up

43+traefik-up:

44+ docker-compose -f docker-compose.yaml -f docker-compose-traefik.yaml up -d

45+

46+.PHONY: traefik-%

47+traefik-%:

48+ docker-compose -f docker-compose.yaml -f docker-compose-traefik.yaml $*

contrib/local-environment/dex.yaml+1−1

@@ -20,7 +20,7 @@ staticClients:

20 redirectURIs:

21 # These redirect URIs point to the `--redirect-url` for OAuth2 proxy.

22 - 'http://localhost:4180/oauth2/callback' # For basic proxy example.

23− - 'http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback' # For nginx example.

23+ - 'http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback' # For nginx and traefik example.

24 name: 'OAuth2 Proxy'

25 secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK

26enablePasswordDB: true

contrib/local-environment/docker-compose-traefik.yamlnew file+49

@@ -0,0 +1,49 @@

1+# This docker-compose file can be used to bring up an example instance of oauth2-proxy

2+# for manual testing and exploration of features.

3+# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4+# HTTPBin as an example upstream.

5+#

6+# This can either be created using docker-compose

7+# docker-compose -f docker-compose-traefik.yaml <command>

8+# Or:

9+# make traefik-<command> (eg. make traefik-up, make traefik-down)

10+#

11+# Access one of the following URLs to initiate a login flow:

12+# - http://oauth2-proxy.localhost

13+# - http://httpbin.oauth2-proxy.localhost

14+#

15+# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.oauth2-proxy.localhost

16+#

17+# Note, the above URLs should work with Chrome, but you may need to add hosts

18+# entries for other browsers

19+# 127.0.0.1 oauth2-proxy.localhost

20+# 127.0.0.1 httpbin.oauth2-proxy.localhost

21+# 127.0.0.1 oauth2-proxy.oauth2-proxy.localhost

22+version: '3.0'

23+services:

24+

25+ oauth2-proxy:

26+ ports: []

27+ hostname: oauth2-proxy

28+ volumes:

29+ - "./oauth2-proxy-traefik.cfg:/oauth2-proxy.cfg"

30+ networks:

31+ oauth2-proxy:

32+

33+ # Reverse proxy

34+ gateway:

35+ container_name: traefik

36+ image: traefik:2.4.2

37+ volumes:

38+ - "./traefik:/etc/traefik"

39+ ports:

40+ - "80:80"

41+ - "9090:8080"

42+ depends_on:

43+ - oauth2-proxy

44+ networks:

45+ oauth2-proxy:

46+ httpbin:

47+

48+networks:

49+ oauth2-proxy:

contrib/local-environment/oauth2-proxy-traefik.cfgnew file+22

@@ -0,0 +1,22 @@

1+http_address="0.0.0.0:4180"

2+cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="

3+provider="oidc"

4+email_domains=["example.com"]

5+oidc_issuer_url="http://dex.localhost:4190/dex"

6+client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"

7+client_id="oauth2-proxy"

8+cookie_secure="false"

9+

10+redirect_url="http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback"

11+cookie_domains=".oauth2-proxy.localhost" # Required so cookie can be read on all subdomains.

12+whitelist_domains=".oauth2-proxy.localhost" # Required to allow redirection back to original requested target.

13+

14+# Mandatory option when using oauth2-proxy with traefik

15+reverse_proxy="true"

16+# Required for traefik with ForwardAuth and static upstream configuration

17+upstreams="static://202"

18+# The following option skip the page requesting the user

19+# to click on a button to be redirected to the identity provider

20+# It can be activated only when traefik is not configure with

21+# the error redirection middleware as this example.

22+skip_provider_button="true"

contrib/local-environment/traefik/dynamic.yamlnew file+57

@@ -0,0 +1,57 @@

1+http:

2+ routers:

3+ oauth2-proxy-route:

4+ rule: "Host(`oauth2-proxy.oauth2-proxy.localhost`)"

5+ middlewares:

6+ - auth-headers

7+ service: oauth-backend

8+ httpbin-route:

9+ rule: "Host(`httpbin.oauth2-proxy.localhost`)"

10+ service: httpbin-service

11+ middlewares:

12+ - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin

13+ httpbin-route-2:

14+ rule: "Host(`httpbin.oauth2-proxy.localhost`) && PathPrefix(`/no-auto-redirect`)"

15+ service: httpbin-service

16+ middlewares:

17+ - oauth-auth-wo-redirect # unauthenticated session will return a 401

18+ services-oauth2-route:

19+ rule: "Host(`httpbin.oauth2-proxy.localhost`) && PathPrefix(`/oauth2/`)"

20+ middlewares:

21+ - auth-headers

22+ service: oauth-backend

23+

24+ services:

25+ httpbin-service:

26+ loadBalancer:

27+ servers:

28+ - url: http://httpbin

29+ oauth-backend:

30+ loadBalancer:

31+ servers:

32+ - url: http://oauth2-proxy:4180

33+

34+ middlewares:

35+ auth-headers:

36+ headers:

37+ stsSeconds: 315360000

38+ browserXssFilter: true

39+ contentTypeNosniff: true

40+ forceSTSHeader: true

41+ stsIncludeSubdomains: true

42+ stsPreload: true

43+ frameDeny: true

44+ oauth-auth-redirect:

45+ forwardAuth:

46+ address: http://oauth2-proxy:4180

47+ trustForwardHeader: true

48+ authResponseHeaders:

49+ - X-Auth-Request-Access-Token

50+ - Authorization

51+ oauth-auth-wo-redirect:

52+ forwardAuth:

53+ address: http://oauth2-proxy:4180/oauth2/auth

54+ trustForwardHeader: true

55+ authResponseHeaders:

56+ - X-Auth-Request-Access-Token

57+ - Authorization

contrib/local-environment/traefik/traefik.yamlnew file+7

@@ -0,0 +1,7 @@

1+api:

2+ insecure: true

3+log:

4+ level: INFO

5+providers:

6+ file:

7+ filename: /etc/traefik/dynamic.yaml