@@ -1,49 +1,44 @@
1−# Reverse proxy to oauth2-proxy
4− server_name oauth2-proxy.localtest.me;
7− proxy_set_header Host $host;
8− proxy_set_header X-Real-IP $remote_addr;
9− proxy_set_header X-Forwarded-Uri $request_uri;
11− proxy_pass http://oauth2-proxy:4180/;
15# Reverse proxy to httpbin
1# Reverse proxy to httpbin
17 listen 8080;
3 listen 8080;
18− server_name httpbin.localtest.me;
4+ server_name oauth2-proxy.localtest.me;
20− auth_request /internal-auth/oauth2/auth;
6+ location /oauth2/ {
7+ proxy_pass http://oauth2-proxy:4180;
8+ proxy_set_header Host $host;
9+ proxy_set_header X-Real-IP $remote_addr;
10+ proxy_set_header X-Forwarded-Uri $request_uri;
11+ proxy_set_header X-Auth-Request-Redirect $request_uri;
22− # On 401, redirect to the sign_in page via a named location
14+ location = /oauth2/auth {
23− # This ensures a proper 302 redirect that browsers will follow
15+ proxy_pass http://oauth2-proxy:4180;
24− error_page 401 = @oauth2_signin;
16+ proxy_set_header Host $host;
17+ proxy_set_header X-Real-IP $remote_addr;
18+ proxy_set_header X-Forwarded-Uri $request_uri;
19+ # nginx auth_request includes headers but not body
20+ proxy_set_header Content-Length "";
21+ proxy_pass_request_body off;
26 location / {
24 location / {
25+ auth_request /oauth2/auth;
26+ error_page 401 = @oauth2_signin;
28+ # pass information via X-User and X-Email headers to backend,
29+ # requires running with --set-xauthrequest flag
30+ auth_request_set $user $upstream_http_x_auth_request_user;
31+ auth_request_set $email $upstream_http_x_auth_request_email;
32+ proxy_set_header X-User $user;
33+ proxy_set_header X-Email $email;
27 proxy_pass http://httpbin/;
35 proxy_pass http://httpbin/;
36+ # or "root /path/to/site;" or "fastcgi_pass ..." etc
30− # Named location for OAuth2 sign-in redirect
39+ # Named location for handling OAuth2 sign-in redirects
31− # Returns a proper 302 that works with --skip-provider-button
40+ # This ensures the browser receives a proper 302 redirect that it will follow
32 location @oauth2_signin {
41 location @oauth2_signin {
33− return 302 http://oauth2-proxy.localtest.me:8080/oauth2/sign_in?rd=$scheme://$host$request_uri;
42+ return 302 /oauth2/sign_in?rd=$scheme://$http_host$request_uri;
36− # auth_request must be a URI so this allows an internal path to then proxy to
37− # the real auth_request path.
38− # The trailing /'s are required so that nginx strips the prefix before proxying.
39− location /internal-auth/ {
40− internal; # Ensure external users can't access this path
42− # Make sure the OAuth2 Proxy knows where the original request came from.
43− proxy_set_header Host $host;
44− proxy_set_header X-Real-IP $remote_addr;
45− proxy_set_header X-Forwarded-Uri $request_uri;
47− proxy_pass http://oauth2-proxy:4180/;