76269a1 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Support Traefik ForwardAuth without a 401 handler (#1023)

* GH-1015 Adds support for Traefik to OauthStart on '/oauth2/auth' endpoint * Fix incorrect reference to signout path and point to signin path - remove commented out alternative solutions and debug log statements * Remove skip provider button check as SignIn method already does this * Updated traefik example to match existing file configuration reference, updated tests * Update doc and refactor nested conditional statements * Revert code changes as static upstream provides the same functionality - Add doc on using static upstream with Traefik ForwardAuth middleware * update changelog * Move the doc changes to 7.0.x versioned docs * Re-add traefik docs update in the main docs overview.md * add missing oauth2-proxy routing Co-authored-by: Praveen Chinthala <PraveenChinthala@hollandandbarrett.com>

commit76269a13b72afa1e46be799e2d835cfab406c1cf authorPraveen Chinthala <pcneo83@users.noreply.github.com> dateMon 15 Feb 2021, 19:31 (6 years ago) parent8452351

3 files changed+201

compare with master

unifiedsplit

CHANGELOG.md+1 docs/docs/configuration/overview.md+100 docs/versioned_docs/version-7.0.x/configuration/overview.md+100

CHANGELOG.md+1

@@ -13,6 +13,7 @@

1313- [#1028](https://github.com/oauth2-proxy/oauth2-proxy/pull/1028) Refactor templates, update theme and provide styled error pages (@JoelSpeed)

1414- [#1039](https://github.com/oauth2-proxy/oauth2-proxy/pull/1039) Ensure errors in tests are logged to the GinkgoWriter (@JoelSpeed)

1515- [#980](https://github.com/oauth2-proxy/oauth2-proxy/pull/980) Add Prometheus metrics endpoint

16+- [#1023](https://github.com/oauth2-proxy/oauth2-proxy/pull/1023) Update docs on Traefik ForwardAuth support without the use of Traefik 'errors' middleware

1617

1718# V7.0.1

1819

docs/docs/configuration/overview.md+100

@@ -362,6 +362,8 @@ You have to substitute *name* with the actual cookie name you configured via --c

362362

363363**This option requires `--reverse-proxy` option to be set.**

364364

365+### ForwardAuth with 401 errors middleware

366+

365367The [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/forwardauth/) allows Traefik to authenticate requests via the oauth2-proxy's `/oauth2/auth` endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:

366368

367369```yaml

@@ -425,6 +427,104 @@ http:

425427 query: "/oauth2/sign_in"

426428```

427429

430+### ForwardAuth with static upstreams configuration

431+

432+Redirect to sign_in functionality provided without the use of `errors` middleware with [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/forwardauth/) pointing to oauth2-proxy service's `/` endpoint

433+

434+**Following options need to be set on `oauth2-proxy`:**

435+- `--upstream=static://202`: Configures a static response for authenticated sessions

436+- `--reverseproxy=true`: Enables the use of `X-Forwarded-*` headers to determine redirects correctly

437+

438+```yaml

439+http:

440+ routers:

441+ a-service-route-1:

442+ rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"

443+ service: a-service-backend

444+ middlewares:

445+ - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin

446+ tls:

447+ certResolver: default

448+ domains:

449+ - main: "example.com"

450+ sans:

451+ - "*.example.com"

452+ a-service-route-2:

453+ rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"

454+ service: a-service-backend

455+ middlewares:

456+ - oauth-auth-wo-redirect # unauthenticated session will return a 401

457+ tls:

458+ certResolver: default

459+ domains:

460+ - main: "example.com"

461+ sans:

462+ - "*.example.com"

463+ services-oauth2-route:

464+ rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"

465+ middlewares:

466+ - auth-headers

467+ service: oauth-backend

468+ tls:

469+ certResolver: default

470+ domains:

471+ - main: "example.com"

472+ sans:

473+ - "*.example.com"

474+ oauth2-proxy-route:

475+ rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"

476+ middlewares:

477+ - auth-headers

478+ service: oauth-backend

479+ tls:

480+ certResolver: default

481+ domains:

482+ - main: "example.com"

483+ sans:

484+ - "*.example.com"

485+

486+ services:

487+ a-service-backend:

488+ loadBalancer:

489+ servers:

490+ - url: http://172.16.0.2:7555

491+ b-service-backend:

492+ loadBalancer:

493+ servers:

494+ - url: http://172.16.0.3:7555

495+ oauth-backend:

496+ loadBalancer:

497+ servers:

498+ - url: http://172.16.0.1:4180

499+

500+ middlewares:

501+ auth-headers:

502+ headers:

503+ sslRedirect: true

504+ stsSeconds: 315360000

505+ browserXssFilter: true

506+ contentTypeNosniff: true

507+ forceSTSHeader: true

508+ sslHost: example.com

509+ stsIncludeSubdomains: true

510+ stsPreload: true

511+ frameDeny: true

512+ oauth-auth-redirect:

513+ forwardAuth:

514+ address: https://oauth.example.com/

515+ trustForwardHeader: true

516+ authResponseHeaders:

517+ - X-Auth-Request-Access-Token

518+ - Authorization

519+ oauth-auth-wo-redirect:

520+ forwardAuth:

521+ address: https://oauth.example.com/oauth2/auth

522+ trustForwardHeader: true

523+ authResponseHeaders:

524+ - X-Auth-Request-Access-Token

525+ - Authorization

526+```

527+

428528:::note

429529If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.

430530:::

docs/versioned_docs/version-7.0.x/configuration/overview.md+100

@@ -360,6 +360,8 @@ You have to substitute *name* with the actual cookie name you configured via --c

360360

361361**This option requires `--reverse-proxy` option to be set.**

362362

363+### ForwardAuth with 401 errors middleware

364+

363365The [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/forwardauth/) allows Traefik to authenticate requests via the oauth2-proxy's `/oauth2/auth` endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:

364366

365367```yaml

@@ -423,6 +425,104 @@ http:

423425 query: "/oauth2/sign_in"

424426```

425427

428+### ForwardAuth with static upstreams configuration

429+

430+Redirect to sign_in functionality provided without the use of `errors` middleware with [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/forwardauth/) pointing to oauth2-proxy service's `/` endpoint

431+

432+**Following options need to be set on `oauth2-proxy`:**

433+- `--upstream=static://202`: Configures a static response for authenticated sessions

434+- `--reverseproxy=true`: Enables the use of `X-Forwarded-*` headers to determine redirects correctly

435+

436+```yaml

437+http:

438+ routers:

439+ a-service-route-1:

440+ rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"

441+ service: a-service-backend

442+ middlewares:

443+ - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin

444+ tls:

445+ certResolver: default

446+ domains:

447+ - main: "example.com"

448+ sans:

449+ - "*.example.com"

450+ a-service-route-2:

451+ rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"

452+ service: a-service-backend

453+ middlewares:

454+ - oauth-auth-wo-redirect # unauthenticated session will return a 401

455+ tls:

456+ certResolver: default

457+ domains:

458+ - main: "example.com"

459+ sans:

460+ - "*.example.com"

461+ services-oauth2-route:

462+ rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"

463+ middlewares:

464+ - auth-headers

465+ service: oauth-backend

466+ tls:

467+ certResolver: default

468+ domains:

469+ - main: "example.com"

470+ sans:

471+ - "*.example.com"

472+ oauth2-proxy-route:

473+ rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"

474+ middlewares:

475+ - auth-headers

476+ service: oauth-backend

477+ tls:

478+ certResolver: default

479+ domains:

480+ - main: "example.com"

481+ sans:

482+ - "*.example.com"

483+

484+ services:

485+ a-service-backend:

486+ loadBalancer:

487+ servers:

488+ - url: http://172.16.0.2:7555

489+ b-service-backend:

490+ loadBalancer:

491+ servers:

492+ - url: http://172.16.0.3:7555

493+ oauth-backend:

494+ loadBalancer:

495+ servers:

496+ - url: http://172.16.0.1:4180

497+

498+ middlewares:

499+ auth-headers:

500+ headers:

501+ sslRedirect: true

502+ stsSeconds: 315360000

503+ browserXssFilter: true

504+ contentTypeNosniff: true

505+ forceSTSHeader: true

506+ sslHost: example.com

507+ stsIncludeSubdomains: true

508+ stsPreload: true

509+ frameDeny: true

510+ oauth-auth-redirect:

511+ forwardAuth:

512+ address: https://oauth.example.com/

513+ trustForwardHeader: true

514+ authResponseHeaders:

515+ - X-Auth-Request-Access-Token

516+ - Authorization

517+ oauth-auth-wo-redirect:

518+ forwardAuth:

519+ address: https://oauth.example.com/oauth2/auth

520+ trustForwardHeader: true

521+ authResponseHeaders:

522+ - X-Auth-Request-Access-Token

523+ - Authorization

524+```

525+

426526:::note

427527If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.

428528:::