git.iko.soy/typeable/oauth2-proxy
on master help sign in
Refactored docs (#2284)
76bc2cfKoen van Zuijlen
docs/docs/configuration/alpha_config.md+5−5
compare with master
unifiedsplit
@@ -23,13 +23,13 @@ When using alpha configuration, your config file will look something like below:
23```yaml
23```yaml
24upstreams:
24upstreams:
25 - id: ...
25 - id: ...
26− ...
26+ ...: ...
27injectRequestHeaders:
27injectRequestHeaders:
28 - name: ...
28 - name: ...
29− ...
29+ ...: ...
30injectResponseHeaders:
30injectResponseHeaders:
31 - name: ...
31 - name: ...
32− ...
32+ ...: ...
33```
33```
34
34
35Please browse the [reference](#configuration-reference) below for the structure
35Please browse the [reference](#configuration-reference) below for the structure
@@ -512,7 +512,7 @@ Requests will be proxied to this upstream if the path matches the request path.
512| `path` | _string_ | Path is used to map requests to the upstream server.<br/>The closest match will take precedence and all Paths must be unique.<br/>Path can also take a pattern when used with RewriteTarget.<br/>Path segments can be captured and matched using regular experessions.<br/>Eg:<br/>- `^/foo$`: Match only the explicit path `/foo`<br/>- `^/bar/$`: Match any path prefixed with `/bar/`<br/>- `^/baz/(.*)$`: Match any path prefixed with `/baz` and capture the remaining path for use with RewriteTarget |
512| `path` | _string_ | Path is used to map requests to the upstream server.<br/>The closest match will take precedence and all Paths must be unique.<br/>Path can also take a pattern when used with RewriteTarget.<br/>Path segments can be captured and matched using regular experessions.<br/>Eg:<br/>- `^/foo$`: Match only the explicit path `/foo`<br/>- `^/bar/$`: Match any path prefixed with `/bar/`<br/>- `^/baz/(.*)$`: Match any path prefixed with `/baz` and capture the remaining path for use with RewriteTarget |
513| `rewriteTarget` | _string_ | RewriteTarget allows users to rewrite the request path before it is sent to<br/>the upstream server.<br/>Use the Path to capture segments for reuse within the rewrite target.<br/>Eg: With a Path of `^/baz/(.*)`, a RewriteTarget of `/foo/$1` would rewrite<br/>the request `/baz/abc/123` to `/foo/abc/123` before proxying to the<br/>upstream server. |
513| `rewriteTarget` | _string_ | RewriteTarget allows users to rewrite the request path before it is sent to<br/>the upstream server.<br/>Use the Path to capture segments for reuse within the rewrite target.<br/>Eg: With a Path of `^/baz/(.*)`, a RewriteTarget of `/foo/$1` would rewrite<br/>the request `/baz/abc/123` to `/foo/abc/123` before proxying to the<br/>upstream server. |
514| `uri` | _string_ | The URI of the upstream server. This may be an HTTP(S) server of a File<br/>based URL. It may include a path, in which case all requests will be served<br/>under that path.<br/>Eg:<br/>- http://localhost:8080<br/>- https://service.localhost<br/>- https://service.localhost/path<br/>- file://host/path<br/>If the URI's path is "/base" and the incoming request was for "/dir",<br/>the upstream request will be for "/base/dir". |
514| `uri` | _string_ | The URI of the upstream server. This may be an HTTP(S) server of a File<br/>based URL. It may include a path, in which case all requests will be served<br/>under that path.<br/>Eg:<br/>- http://localhost:8080<br/>- https://service.localhost<br/>- https://service.localhost/path<br/>- file://host/path<br/>If the URI's path is "/base" and the incoming request was for "/dir",<br/>the upstream request will be for "/base/dir". |
515−| `insecureSkipTLSVerify` | _bool_ | InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.<br/>This option is insecure and will allow potential Man-In-The-Middle attacks<br/>betweem OAuth2 Proxy and the usptream server.<br/>Defaults to false. |
515+| `insecureSkipTLSVerify` | _bool_ | InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.<br/>This option is insecure and will allow potential Man-In-The-Middle attacks<br/>between OAuth2 Proxy and the upstream server.<br/>Defaults to false. |
516| `static` | _bool_ | Static will make all requests to this upstream have a static response.<br/>The response will have a body of "Authenticated" and a response code<br/>matching StaticCode.<br/>If StaticCode is not set, the response will return a 200 response. |
516| `static` | _bool_ | Static will make all requests to this upstream have a static response.<br/>The response will have a body of "Authenticated" and a response code<br/>matching StaticCode.<br/>If StaticCode is not set, the response will return a 200 response. |
517| `staticCode` | _int_ | StaticCode determines the response code for the Static response.<br/>This option can only be used with Static enabled. |
517| `staticCode` | _int_ | StaticCode determines the response code for the Static response.<br/>This option can only be used with Static enabled. |
518| `flushInterval` | _[Duration](#duration)_ | FlushInterval is the period between flushing the response buffer when<br/>streaming response from the upstream.<br/>Defaults to 1 second. |
518| `flushInterval` | _[Duration](#duration)_ | FlushInterval is the period between flushing the response buffer when<br/>streaming response from the upstream.<br/>Defaults to 1 second. |
@@ -528,5 +528,5 @@ UpstreamConfig is a collection of definitions for upstream servers.
528
528
529| Field | Type | Description |
529| Field | Type | Description |
530| ----- | ---- | ----------- |
530| ----- | ---- | ----------- |
531−| `proxyRawPath` | _bool_ | ProxyRawPath will pass the raw url path to upstream allowing for url's<br/>like: "/%2F/" which would otherwise be redirected to "/" |
531+| `proxyRawPath` | _bool_ | ProxyRawPath will pass the raw url path to upstream allowing for urls<br/>like: "/%2F/" which would otherwise be redirected to "/" |
532| `upstreams` | _[[]Upstream](#upstream)_ | Upstreams represents the configuration for the upstream servers.<br/>Requests will be proxied to this upstream if the path matches the request path. |
532| `upstreams` | _[[]Upstream](#upstream)_ | Upstreams represents the configuration for the upstream servers.<br/>Requests will be proxied to this upstream if the path matches the request path. |
docs/docs/configuration/alpha_config.md.tmpl+3−3
@@ -23,13 +23,13 @@ When using alpha configuration, your config file will look something like below:
23```yaml
23```yaml
24upstreams:
24upstreams:
25 - id: ...
25 - id: ...
26− ...
26+ ...: ...
27injectRequestHeaders:
27injectRequestHeaders:
28 - name: ...
28 - name: ...
29− ...
29+ ...: ...
30injectResponseHeaders:
30injectResponseHeaders:
31 - name: ...
31 - name: ...
32− ...
32+ ...: ...
33```
33```
34
34
35Please browse the [reference](#configuration-reference) below for the structure
35Please browse the [reference](#configuration-reference) below for the structure
docs/docs/configuration/auth.mddeleted−692
@@ -1,692 +0,0 @@
1−---
2−id: oauth_provider
3−title: OAuth Provider Configuration
4−---
5−
6−You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run `oauth2-proxy` on.
7−
8−Valid providers are :
9−
10−- [Google](#google-auth-provider) _default_
11−- [Azure](#azure-auth-provider)
12−- [ADFS](#adfs-auth-provider)
13−- [Facebook](#facebook-auth-provider)
14−- [GitHub](#github-auth-provider)
15−- [Gitea](#gitea-auth-provider)
16−- [Keycloak](#keycloak-auth-provider)
17−- [GitLab](#gitlab-auth-provider)
18−- [LinkedIn](#linkedin-auth-provider)
19−- [Microsoft Azure AD](#microsoft-azure-ad-provider)
20−- [OpenID Connect](#openid-connect-provider)
21−- [login.gov](#logingov-provider)
22−- [Nextcloud](#nextcloud-provider)
23−- [DigitalOcean](#digitalocean-auth-provider)
24−- [Bitbucket](#bitbucket-auth-provider)
25−
26−The provider can be selected using the `provider` configuration value.
27−
28−Please note that not all providers support all claims. The `preferred_username` claim is currently only supported by the OpenID Connect provider.
29−
30−### Google Auth Provider
31−
32−For Google, the registration steps are:
33−
34−1. Create a new project: https://console.developers.google.com/project
35−2. Choose the new project from the top right project dropdown (only if another project is selected)
36−3. In the project Dashboard center pane, choose **"APIs & Services"**
37−4. In the left Nav pane, choose **"Credentials"**
38−5. In the center pane, choose **"OAuth consent screen"** tab. Fill in **"Product name shown to users"** and hit save.
39−6. In the center pane, choose **"Credentials"** tab.
40− - Open the **"New credentials"** drop down
41− - Choose **"OAuth client ID"**
42− - Choose **"Web application"**
43− - Application name is freeform, choose something appropriate
44− - Authorized JavaScript origins is your domain ex: `https://internal.yourcompany.com`
45− - Authorized redirect URIs is the location of oauth2/callback ex: `https://internal.yourcompany.com/oauth2/callback`
46− - Choose **"Create"**
47−7. Take note of the **Client ID** and **Client Secret**
48−
49−It's recommended to refresh sessions on a short interval (1h) with `cookie-refresh` setting which validates that the account is still authorized.
50−
51−#### Restrict auth to specific Google groups on your domain. (optional)
52−
53−1. Create a [service account](https://developers.google.com/identity/protocols/OAuth2ServiceAccount) and download the json
54−file if you're not using [Application Default Credentials / Workload Identity / Workload Identity Federation (recommended)](#using-application-default-credentials-adc--workload-identity--workload-identity-federation-recommended).
55−2. Make note of the Client ID for a future step.
56−3. Under "APIs & Auth", choose APIs.
57−4. Click on Admin SDK and then Enable API.
58−5. Follow the steps on https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account and give the client id from step 2 the following oauth scopes:
59−
60−
61−##### Using Application Default Credentials (ADC) / Workload Identity / Workload Identity Federation (recommended)
62−oauth2-proxy can make use of [Application Default Credentials](https://cloud.google.com/docs/authentication/application-default-credentials).
63−When deployed within GCP, this means that it can automatically use the service account attached to the resource. When deployed to GKE, ADC
64−can be leveraged through a feature called Workload Identity. Follow Google's [guide](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity)
65−to set up Workload Identity.
66−
67−When deployed outside of GCP, [Workload Identity Federation](https://cloud.google.com/docs/authentication/provide-credentials-adc#wlif) might be an option.
68−
69−```
70−https://www.googleapis.com/auth/admin.directory.group.readonly
71−https://www.googleapis.com/auth/admin.directory.user.readonly
72−```
73−
74−6. Follow the steps on https://support.google.com/a/answer/60757 to enable Admin API access.
75−7. Create or choose an existing administrative email address on the Gmail domain to assign to the `google-admin-email` flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why.
76−8. Create or choose an existing email group and set that email to the `google-group` flag. You can pass multiple instances of this flag with different groups
77− and the user will be checked against all the provided groups.
78−9. Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the `google-service-account-json` flag.
79−10. Restart oauth2-proxy.
80−
81−Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour ).
82−
83−### Azure Auth Provider
84−
85−1. Add an application: go to [https://portal.azure.com](https://portal.azure.com), choose **Azure Active Directory**, select
86−**App registrations** and then click on **New registration**.
87−2. Pick a name, check the supported account type(single-tenant, multi-tenant, etc). In the **Redirect URI** section create a new
88−**Web** platform entry for each app that you want to protect by the oauth2 proxy(e.g.
89−https://internal.yourcompanycom/oauth2/callback). Click **Register**.
90−3. Next we need to add group read permissions for the app registration, on the **API Permissions** page of the app, click on
91−**Add a permission**, select **Microsoft Graph**, then select **Application permissions**, then click on **Group** and select
92−**Group.Read.All**. Hit **Add permissions** and then on **Grant admin consent** (you might need an admin to do this).
93−<br/>**IMPORTANT**: Even if this permission is listed with **"Admin consent required=No"** the consent might actually be required, due to AAD policies you won't be able to see. If you get a **"Need admin approval"** during login, most likely this is what you're missing!
94−4. Next, if you are planning to use v2.0 Azure Auth endpoint, go to the **Manifest** page and set `"accessTokenAcceptedVersion": 2`
95−in the App registration manifest file.
96−5. On the **Certificates & secrets** page of the app, add a new client secret and note down the value after hitting **Add**.
97−6. Configure the proxy with:
98−- for V1 Azure Auth endpoint (Azure Active Directory Endpoints - https://login.microsoftonline.com/common/oauth2/authorize)
99−
100−```
101− --provider=azure
102− --client-id=<application ID from step 3>
103− --client-secret=<value from step 5>
104− --azure-tenant={tenant-id}
105− --oidc-issuer-url=https://sts.windows.net/{tenant-id}/
106−```
107−
108−- for V2 Azure Auth endpoint (Microsoft Identity Platform Endpoints - https://login.microsoftonline.com/common/oauth2/v2.0/authorize)
109−```
110− --provider=azure
111− --client-id=<application ID from step 3>
112− --client-secret=<value from step 5>
113− --azure-tenant={tenant-id}
114− --oidc-issuer-url=https://login.microsoftonline.com/{tenant-id}/v2.0
115−```
116−
117−***Notes***:
118−- When using v2.0 Azure Auth endpoint (`https://login.microsoftonline.com/{tenant-id}/v2.0`) as `--oidc_issuer_url`, in conjunction
119−with `--resource` flag, be sure to append `/.default` at the end of the resource name. See
120−https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#the-default-scope for more details.
121−- When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't
122−get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the [redis session storage](sessions.md#redis-storage)
123−should resolve this.
124−
125−### ADFS Auth Provider
126−
127−1. Open the ADFS administration console on your Windows Server and add a new Application Group
128−2. Provide a name for the integration, select Server Application from the Standalone applications section and click Next
129−3. Follow the wizard to get the client-id, client-secret and configure the application credentials
130−4. Configure the proxy with
131−
132−```
133− --provider=adfs
134− --client-id=<application ID from step 3>
135− --client-secret=<value from step 3>
136−```
137−
138−Note: When using the ADFS Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the [redis session storage](sessions.md#redis-storage) should resolve this.
139−
140−### Facebook Auth Provider
141−
142−1. Create a new FB App from <https://developers.facebook.com/>
143−2. Under FB Login, set your Valid OAuth redirect URIs to `https://internal.yourcompany.com/oauth2/callback`
144−
145−### GitHub Auth Provider
146−
147−1. Create a new project: https://github.com/settings/developers
148−2. Under `Authorization callback URL` enter the correct url ie `https://internal.yourcompany.com/oauth2/callback`
149−
150−The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with `--email-domain=*`
151−
152−NOTE: When `--github-user` is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators.
153−
154−To restrict by organization only, include the following flag:
155−
156− -github-org="": restrict logins to members of this organisation
157−
158−To restrict within an organization to specific teams, include the following flag in addition to `-github-org`:
159−
160− -github-team="": restrict logins to members of any of these teams (slug), separated by a comma
161−
162−If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:
163−
164− -github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo
165−
166−If you'd like to allow access to users with **read only** access to a **public** repository you will need to provide a [token](https://github.com/settings/tokens) for a user that has write access to the repository. The token must be created with at least the `public_repo` scope:
167−
168− -github-token="": the token to use when verifying repository collaborators
169−
170−To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma
171−
172− -github-user="": allow logins by username, separated by a comma
173−
174−If you are using GitHub enterprise, make sure you set the following to the appropriate url:
175−
176− -login-url="http(s)://<enterprise github host>/login/oauth/authorize"
177− -redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"
178− -validate-url="http(s)://<enterprise github host>/api/v3"
179−
180−### Gitea Auth Provider
181−
182−1. Create a new application: `https://< your gitea host >/user/settings/applications`
183−2. Under `Redirect URI` enter the correct URL i.e. `https://<proxied host>/oauth2/callback`
184−3. Note the Client ID and Client Secret.
185−4. Pass the following options to the proxy:
186−
187−```
188− --provider="github"
189− --redirect-url="https://<proxied host>/oauth2/callback"
190− --provider-display-name="Gitea"
191− --client-id="< client_id as generated by Gitea >"
192− --client-secret="< client_secret as generated by Gitea >"
193− --login-url="https://< your gitea host >/login/oauth/authorize"
194− --redeem-url="https://< your gitea host >/login/oauth/access_token"
195− --validate-url="https://< your gitea host >/api/v1/user/emails"
196−```
197−
198−
199−### Keycloak Auth Provider
200−
201−:::note
202−This is the legacy provider for Keycloak, use [Keycloak OIDC Auth Provider](#keycloak-oidc-auth-provider) if possible.
203−:::
204−
205−1. Create new client in your Keycloak realm with **Access Type** 'confidental' and **Valid Redirect URIs** 'https://internal.yourcompany.com/oauth2/callback'
206−2. Take note of the Secret in the credential tab of the client
207−3. Create a mapper with **Mapper Type** 'Group Membership' and **Token Claim Name** 'groups'.
208−
209−Make sure you set the following to the appropriate url:
210−
211−```
212− --provider=keycloak
213− --client-id=<client you have created>
214− --client-secret=<your client's secret>
215− --login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"
216− --redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"
217− --profile-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
218− --validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
219− --keycloak-group=<first_allowed_user_group>
220− --keycloak-group=<second_allowed_user_group>
221−```
222−
223−For group based authorization, the optional `--keycloak-group` (legacy) or `--allowed-group` (global standard)
224−flags can be used to specify which groups to limit access to.
225−
226−If these are unset but a `groups` mapper is set up above in step (3), the provider will still
227−populate the `X-Forwarded-Groups` header to your upstream server with the `groups` data in the
228−Keycloak userinfo endpoint response.
229−
230−The group management in keycloak is using a tree. If you create a group named admin in keycloak
231−you should define the 'keycloak-group' value to /admin.
232−
233−### Keycloak OIDC Auth Provider
234−
235−```
236− --provider=keycloak-oidc
237− --client-id=<your client's id>
238− --client-secret=<your client's secret>
239− --redirect-url=https://internal.yourcompany.com/oauth2/callback
240− --oidc-issuer-url=https://<keycloak host>/realms/<your realm> // For Keycloak versions <17: --oidc-issuer-url=https://<keycloak host>/auth/realms/<your realm>
241− --email-domain=<yourcompany.com> // Validate email domain for users, see option documentation
242− --allowed-role=<realm role name> // Optional, required realm role
243− --allowed-role=<client id>:<client role name> // Optional, required client role
244− --allowed-group=</group name> // Optional, requires group client scope
245− --code-challenge-method=S256 // PKCE
246−```
247−
248−:::note
249−Keycloak has updated its admin console and as of version 19.0.0, the new admin console is enabled by default. The legacy admin console has been announced for removal with the release of version 21.0.0.
250−:::
251−
252−**Keycloak legacy admin console**
253−
254−1. Create new client in your Keycloak realm with **Access Type** 'confidential', **Client protocol** 'openid-connect' and **Valid Redirect URIs** 'https://internal.yourcompany.com/oauth2/callback'
255−2. Take note of the Secret in the credential tab of the client
256−3. Create a mapper with **Mapper Type** 'Group Membership' and **Token Claim Name** 'groups'.
257−4. Create a mapper with **Mapper Type** 'Audience' and **Included Client Audience** and **Included Custom Audience** set to your client name.
258−
259−**Keycloak new admin console (default as of v19.0.0)**
260−
261−The following example shows how to create a simple OIDC client using the new Keycloak admin2 console. However, for best practices, it is recommended to consult the Keycloak documentation.
262−
263−The OIDC client must be configured with an _audience mapper_ to include the client's name in the `aud` claim of the JWT token.
264−The `aud` claim specifies the intended recipient of the token, and OAuth2 Proxy expects a match against the values of either `--client-id` or `--oidc-extra-audience`.
265−
266−_In Keycloak, claims are added to JWT tokens through the use of mappers at either the realm level using "client scopes" or through "dedicated" client mappers._
267−
268−**Creating the client**
269−
270−1. Create a new OIDC client in your Keycloak realm by navigating to:
271− **Clients** -> **Create client**
272−* **Client Type** 'OpenID Connect'
273−* **Client ID** `<your client's id>`, please complete the remaining fields as appropriate and click **Next**.
274− * **Client authentication** 'On'
275− * **Authentication flow**
276− * **Standard flow** 'selected'
277− * **Direct access grants** 'deselect'
278− * _Save the configuration._
279− * **Settings / Access settings**:
280− * **Valid redirect URIs** `https://internal.yourcompany.com/oauth2/callback`
281− * _Save the configuration._
282− * Under the **Credentials** tab you will now be able to locate `<your client's secret>`.
283−2. Configure a dedicated *audience mapper* for your client by navigating to **Clients** -> **<your client's id>** -> **Client scopes**.
284−* Access the dedicated mappers pane by clicking **<your client's id>-dedicated**, located under *Assigned client scope*.
285− _(It should have a description of "Dedicated scope and mappers for this client")_
286− * Click **Configure a new mapper** and select **Audience**
287− * **Name** 'aud-mapper-<your client's id>'
288− * **Included Client Audience** select `<your client's id>` from the dropdown.
289− * _OAuth2 proxy can be set up to pass both the access and ID JWT tokens to your upstream services.
290− If you require additional audience entries, you can use the **Included Custom Audience** field in addition to the "Included Client Audience" dropdown. Note that the "aud" claim of a JWT token should be limited and only specify its intended recipients._
291− * **Add to ID token** 'On'
292− * **Add to access token** 'On' - [#1916](https://github.com/oauth2-proxy/oauth2-proxy/pull/1916)
293− * _Save the configuration._
294−* Any subsequent dedicated client mappers can be defined by clicking **Dedicated scopes** -> **Add mapper** -> **By configuration** -> *Select mapper*
295−
296−You should now be able to create a test user in Keycloak and get access to the OAuth2 Proxy instance, make sure to set an email address matching `<yourcompany.com>` and select _Email verified_.
297−
298−**Authorization**
299−
300−_OAuth2 Proxy will perform authorization by requiring a valid user, this authorization can be extended to take into account a user's membership in Keycloak `groups`, `realm roles`, and `client roles` using the keycloak-oidc provider options
301−`--allowed-role` or `--allowed-group`_
302−
303−**Roles**
304−
305−_A standard Keycloak installation comes with the required mappers for **realm roles** and **client roles** through the pre-defined client scope "roles".
306−This ensures that any roles assigned to a user are included in the `JWT` tokens when using an OIDC client that has the "Full scope allowed" feature activated, the feature is enabled by default._
307−
308−_Creating a realm role_
309−* Navigate to **Realm roles** -> **Create role**
310− * **Role name**, *`<realm role name>`* -> **save**
311−
312−_Creating a client role_
313−* Navigate to **Clients** -> `<your client's id>` -> **Roles** -> **Create role**
314− * **Role name**, *`<client role name>`* -> **save**
315−
316−
317−_Assign a role to a user_
318−
319−**Users** -> _Username_ -> **Role mapping** -> **Assign role** -> _filter by roles or clients and select_ -> **Assign**.
320−
321−Keycloak "realm roles" can be authorized using the `--allowed-role=<realm role name>` option, while "client roles" can be evaluated using `--allowed-role=<your client's id>:<client role name>`.
322−
323−You may limit the _realm roles_ included in the JWT tokens for any given client by navigating to:
324−**Clients** -> `<your client's id>` -> **Client scopes** -> _<your client's id>-dedicated_ -> **Scope**
325−Disabling **Full scope allowed** activates the **Assign role** option, allowing you to select which roles, if assigned to a user, will be included in the user's JWT tokens. This can be useful when a user has many associated roles, and you want to reduce the size and impact of the JWT token.
326−
327−
328−**Groups**
329−
330−You may also do authorization on group memberships by using the OAuth2 Proxy option `--allowed-group`.
331−We will only do a brief description of creating the required _client scope_ **groups** and refer you to read the Keycloak documentation.
332−
333−To summarize, the steps required to authorize Keycloak group membership with OAuth2 Proxy are as follows:
334−
335−* Create a new Client Scope with the name **groups** in Keycloak.
336− * Include a mapper of type **Group Membership**.
337− * Set the "Token Claim Name" to **groups** or customize by matching it to the `--oidc-groups-claim` option of OAuth2 Proxy.
338− * If the "Full group path" option is selected, you need to include a "/" separator in the group names defined in the `--allowed-group` option of OAuth2 Proxy. Example: "/groupname" or "/groupname/childgroup".
339−
340−After creating the _Client Scope_ named _groups_ you will need to attach it to your client.
341−**Clients** -> `<your client's id>` -> **Client scopes** -> **Add client scope** -> Select **groups** and choose Optional and you should now have a client that maps group memberships into the JWT tokens so that Oauth2 Proxy may evaluate them.
342−
343−Create a group by navigating to **Groups** -> **Create group** and _add_ your test user as a member.
344−
345−The OAuth2 Proxy option `--allowed-group=/groupname` will now allow you to filter on group membership
346−
347−Keycloak also has the option of attaching roles to groups, please refer to the Keycloak documentation for more information.
348−
349−**Tip**
350−
351−To check if roles or groups are added to JWT tokens, you can preview a users token in the Keycloak console by following these steps:
352−**Clients** -> `<your client's id>` -> **Client scopes** -> **Evaluate**.
353−Select a _realm user_ and optional _scope parameters_ such as groups, and generate the JSON representation of an access or id token to examine its contents.
354−
355−
356−### GitLab Auth Provider
357−
358−This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see [994](https://github.com/oauth2-proxy/oauth2-proxy/issues/994)).
359−
360−Whether you are using GitLab.com or self-hosting GitLab, follow [these steps to add an application](https://docs.gitlab.com/ce/integration/oauth_provider.html). Make sure to enable at least the `openid`, `profile` and `email` scopes, and set the redirect url to your application url e.g. https://myapp.com/oauth2/callback.
361−
362−If you need projects filtering, add the extra `read_api` scope to your application.
363−
364−The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow [these steps](./overview.md#generating-a-cookie-secret)
365−
366−```
367− --provider="gitlab"
368− --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab
369− --client-id=GITLAB_CLIENT_ID
370− --client-secret=GITLAB_CLIENT_SECRET
371− --cookie-secret=COOKIE_SECRET
372−```
373−
374−Restricting by group membership is possible with the following option:
375−
376− --gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma
377−
378−If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:
379−
380− --oidc-issuer-url="<your gitlab url>"
381−
382−If your self-hosted GitLab is on a sub-directory (e.g. domain.tld/gitlab), as opposed to its own sub-domain (e.g. gitlab.domain.tld), you may need to add a redirect from domain.tld/oauth pointing at e.g. domain.tld/gitlab/oauth.
383−
384−### LinkedIn Auth Provider
385−
386−For LinkedIn, the registration steps are:
387−
388−1. Create a new project: https://www.linkedin.com/secure/developer
389−2. In the OAuth User Agreement section:
390− - In default scope, select r_basicprofile and r_emailaddress.
391− - In "OAuth 2.0 Redirect URLs", enter `https://internal.yourcompany.com/oauth2/callback`
392−3. Fill in the remaining required fields and Save.
393−4. Take note of the **Consumer Key / API Key** and **Consumer Secret / Secret Key**
394−
395−### Microsoft Azure AD Provider
396−
397−For adding an application to the Microsoft Azure AD follow [these steps to add an application](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app).
398−
399−Take note of your `TenantId` if applicable for your situation. The `TenantId` can be used to override the default `common` authorization server with a tenant specific server.
400−
401−### OpenID Connect Provider
402−
403−OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects.
404−
405−This provider was originally built against CoreOS Dex and we will use it as an example.
406−The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below.
407−
408−#### Dex
409−
410−To configure the OIDC provider for Dex, perform the following steps:
411−
412−1. Download Dex:
413−
414− ```
415− go get github.com/dexidp/dex
416− ```
417−
418− See the [getting started guide](https://dexidp.io/docs/getting-started/) for more details.
419−
420−2. Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the `staticClients` section of `examples/config-dev.yaml`:
421−
422− ```
423− - id: oauth2-proxy
424− redirectURIs:
425− - 'http://127.0.0.1:4180/oauth2/callback'
426− name: 'oauth2-proxy'
427− secret: proxy
428− ```
429−
430−3. Launch Dex: from `$GOPATH/github.com/dexidp/dex`, run:
431−
432− ```
433− bin/dex serve examples/config-dev.yaml
434− ```
435−
436−4. In a second terminal, run the oauth2-proxy with the following args:
437−
438− ```
439− -provider oidc
440− -provider-display-name "My OIDC Provider"
441− -client-id oauth2-proxy
442− -client-secret proxy
443− -redirect-url http://127.0.0.1:4180/oauth2/callback
444− -oidc-issuer-url http://127.0.0.1:5556/dex
445− -cookie-secure=false
446− -cookie-secret=secret
447− -email-domain kilgore.trout
448− ```
449−
450− To serve the current working directory as a web site under the `/static` endpoint, add:
451−
452− ```
453− -upstream file://$PWD/#/static/
454− ```
455−
456−5. Test the setup by visiting http://127.0.0.1:4180 or http://127.0.0.1:4180/static .
457−
458−See also [our local testing environment](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment) for a self-contained example using Docker and etcd as storage for Dex.
459−
460−#### Okta
461−
462−To configure the OIDC provider for Okta, perform the following steps:
463−
464−1. Log in to Okta using an administrative account. It is suggested you try this in preview first, `example.oktapreview.com`
465−2. (OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,
466−you may wish to configure an authorization server for each application. Otherwise, the provided `default` will work.
467−* Navigate to **Security** then select **API**
468−* Click **Add Authorization Server**, if this option is not available you may require an additional license for a custom authorization server.
469−* Fill out the **Name** with something to describe the application you are protecting. e.g. 'Example App'.
470−* For **Audience**, pick the URL of the application you wish to protect: https://example.corp.com
471−* Fill out a **Description**
472−* Add any **Access Policies** you wish to configure to limit application access.
473−* The default settings will work for other options.
474−[See Okta documentation for more information on Authorization Servers](https://developer.okta.com/docs/guides/customize-authz-server/overview/)
475−3. Navigate to **Applications** then select **Add Application**.
476−* Select **Web** for the **Platform** setting.
477−* Select **OpenID Connect** and click **Create**
478−* Pick an **Application Name** such as `Example App`.
479−* Set the **Login redirect URI** to `https://example.corp.com`.
480−* Under **General** set the **Allowed grant types** to `Authorization Code` and `Refresh Token`.
481−* Leave the rest as default, taking note of the `Client ID` and `Client Secret`.
482−* Under **Assignments** select the users or groups you wish to access your application.
483−4. Create a configuration file like the following:
484−
485− ```
486− provider = "oidc"
487− redirect_url = "https://example.corp.com/oauth2/callback"
488− oidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"
489− upstreams = [
490− "https://example.corp.com"
491− ]
492− email_domains = [
493− "corp.com"
494− ]
495− client_id = "XXXXX"
496− client_secret = "YYYYY"
497− pass_access_token = true
498− cookie_secret = "ZZZZZ"
499− skip_provider_button = true
500− ```
501−
502−The `oidc_issuer_url` is based on URL from your **Authorization Server**'s **Issuer** field in step 2, or simply https://corp.okta.com .
503−The `client_id` and `client_secret` are configured in the application settings.
504−Generate a unique `cookie_secret` to encrypt the cookie.
505−
506−Then you can start the oauth2-proxy with `./oauth2-proxy --config /etc/example.cfg`
507−
508−#### Okta - localhost
509−
510−1. Signup for developer account: https://developer.okta.com/signup/
511−2. Create New `Web` Application: https://${your-okta-domain}/dev/console/apps/new
512−3. Example Application Settings for localhost:
513− * **Name:** My Web App
514− * **Base URIs:** http://localhost:4180/
515− * **Login redirect URIs:** http://localhost:4180/oauth2/callback
516− * **Logout redirect URIs:** http://localhost:4180/
517− * **Group assignments:** `Everyone`
518− * **Grant type allowed:** `Authorization Code` and `Refresh Token`
519−4. Make note of the `Client ID` and `Client secret`, they are needed in a future step
520−5. Make note of the **default** Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as
521−6. Example config file `/etc/localhost.cfg`
522− ```
523− provider = "oidc"
524− redirect_url = "http://localhost:4180/oauth2/callback"
525− oidc_issuer_url = "https://${your-okta-domain}/oauth2/default"
526− upstreams = [
527− "http://0.0.0.0:8080"
528− ]
529− email_domains = [
530− "*"
531− ]
532− client_id = "XXX"
533− client_secret = "YYY"
534− pass_access_token = true
535− cookie_secret = "ZZZ"
536− cookie_secure = false
537− skip_provider_button = true
538− # Note: use the following for testing within a container
539− # http_address = "0.0.0.0:4180"
540− ```
541−7. Then you can start the oauth2-proxy with `./oauth2-proxy --config /etc/localhost.cfg`
542−
543−### login.gov Provider
544−
545−login.gov is an OIDC provider for the US Government.
546−If you are a US Government agency, you can contact the login.gov team through the contact information
547−that you can find on https://login.gov/developers/ and work with them to understand how to get login.gov
548−accounts for integration/test and production access.
549−
550−A developer guide is available here: https://developers.login.gov/, though this proxy handles everything
551−but the data you need to create to register your application in the login.gov dashboard.
552−
553−As a demo, we will assume that you are running your application that you want to secure locally on
554−http://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that
555−you have an agency integration account for testing.
556−
557−First, register your application in the dashboard. The important bits are:
558− * Identity protocol: make this `Openid connect`
559− * Issuer: do what they say for OpenID Connect. We will refer to this string as `${LOGINGOV_ISSUER}`.
560− * Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.
561− A quick way to do this is `openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'`,
562− The contents of the `key.pem` shall be referred to as `${OAUTH2_PROXY_JWT_KEY}`.
563− * Return to App URL: Make this be `http://localhost:4180/`
564− * Redirect URIs: Make this be `http://localhost:4180/oauth2/callback`.
565− * Attribute Bundle: Make sure that email is selected.
566−
567−Now start the proxy up with the following options:
568−```
569−./oauth2-proxy -provider login.gov \
570− -client-id=${LOGINGOV_ISSUER} \
571− -redirect-url=http://localhost:4180/oauth2/callback \
572− -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \
573− -cookie-secure=false \
574− -email-domain=gsa.gov \
575− -upstream=http://localhost:3000/ \
576− -cookie-secret=somerandomstring12341234567890AB \
577− -cookie-domain=localhost \
578− -skip-provider-button=true \
579− -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \
580− -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \
581− -jwt-key="${OAUTH2_PROXY_JWT_KEY}"
582−```
583−You can also set all these options with environment variables, for use in cloud/docker environments.
584−One tricky thing that you may encounter is that some cloud environments will pass in environment
585−variables in a docker env-file, which does not allow multiline variables like a PEM file.
586−If you encounter this, then you can create a `jwt_signing_key.pem` file in the top level
587−directory of the repo which contains the key in PEM format and then do your docker build.
588−The docker build process will copy that file into your image which you can then access by
589−setting the `OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem`
590−environment variable, or by setting `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem` on the commandline.
591−
592−Once it is running, you should be able to go to `http://localhost:4180/` in your browser,
593−get authenticated by the login.gov integration server, and then get proxied on to your
594−application running on `http://localhost:3000/`. In a real deployment, you would secure
595−your application with a firewall or something so that it was only accessible from the
596−proxy, and you would use real hostnames everywhere.
597−
598−#### Skip OIDC discovery
599−
600−Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata.
601−
602−In this case, you can set the `--skip-oidc-discovery` option, and supply those required endpoints manually:
603−
604−```
605− -provider oidc
606− -client-id oauth2-proxy
607− -client-secret proxy
608− -redirect-url http://127.0.0.1:4180/oauth2/callback
609− -oidc-issuer-url http://127.0.0.1:5556
610− -skip-oidc-discovery
611− -login-url http://127.0.0.1:5556/authorize
612− -redeem-url http://127.0.0.1:5556/token
613− -oidc-jwks-url http://127.0.0.1:5556/keys
614− -cookie-secure=false
615− -email-domain example.com
616−```
617−
618−### Nextcloud Provider
619−
620−The Nextcloud provider allows you to authenticate against users in your
621−Nextcloud instance.
622−
623−When you are using the Nextcloud provider, you must specify the urls via
624−configuration, environment variable, or command line argument. Depending
625−on whether your Nextcloud instance is using pretty urls your urls may be of the
626−form `/index.php/apps/oauth2/*` or `/apps/oauth2/*`.
627−
628−Refer to the [OAuth2
629−documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html)
630−to setup the client id and client secret. Your "Redirection URI" will be
631−`https://internalapp.yourcompany.com/oauth2/callback`.
632−
633−```
634− -provider nextcloud
635− -client-id <from nextcloud admin>
636− -client-secret <from nextcloud admin>
637− -login-url="<your nextcloud url>/index.php/apps/oauth2/authorize"
638− -redeem-url="<your nextcloud url>/index.php/apps/oauth2/api/v1/token"
639− -validate-url="<your nextcloud url>/ocs/v2.php/cloud/user?format=json"
640−```
641−
642−Note: in *all* cases the validate-url will *not* have the `index.php`.
643−
644−### DigitalOcean Auth Provider
645−
646−1. [Create a new OAuth application](https://cloud.digitalocean.com/account/api/applications)
647− * You can fill in the name, homepage, and description however you wish.
648− * In the "Application callback URL" field, enter: `https://oauth-proxy/oauth2/callback`, substituting `oauth2-proxy` with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL.
649−2. Note the Client ID and Client Secret.
650−
651−To use the provider, pass the following options:
652−
653−```
654− --provider=digitalocean
655− --client-id=<Client ID>
656− --client-secret=<Client Secret>
657−```
658−
659− Alternatively, set the equivalent options in the config file. The redirect URL defaults to `https://<requested host header>/oauth2/callback`. If you need to change it, you can use the `--redirect-url` command-line option.
660−
661−### Bitbucket Auth Provider
662−
663−1. [Add a new OAuth consumer](https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html)
664− * In "Callback URL" use `https://<oauth2-proxy>/oauth2/callback`, substituting `<oauth2-proxy>` with the actual hostname that oauth2-proxy is running on.
665− * In Permissions section select:
666− * Account -> Email
667− * Team membership -> Read
668− * Repositories -> Read
669−2. Note the Client ID and Client Secret.
670−
671−To use the provider, pass the following options:
672−
673−```
674− --provider=bitbucket
675− --client-id=<Client ID>
676− --client-secret=<Client Secret>
677−```
678−
679−The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: `--bitbucket-team=<Team name>`. To restrict the access to only these users who has access to one selected repository use `--bitbucket-repository=<Repository name>`.
680−
681−
682−
683−## Email Authentication
684−
685−To authorize by email domain use `--email-domain=yourcompany.com`. To authorize individual email addresses use `--authenticated-emails-file=/path/to/file` with one email per line. To authorize all email addresses use `--email-domain=*`.
686−
687−## Adding a new Provider
688−
689−Follow the examples in the [`providers` package](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/) to define a new
690−`Provider` instance. Add a new `case` to
691−[`providers.New()`](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go) to allow `oauth2-proxy` to use the
692−new `Provider`.
docs/docs/configuration/overview.md+106−115
@@ -12,48 +12,40 @@ To generate a strong cookie secret use one of the below commands:
12import Tabs from '@theme/Tabs';
12import Tabs from '@theme/Tabs';
13import TabItem from '@theme/TabItem';
13import TabItem from '@theme/TabItem';
14
14
15−<Tabs
16− defaultValue="python"
15+<Tabs defaultValue="python">
17− values={[
18− {label: 'Python', value: 'python'},
19− {label: 'Bash', value: 'bash'},
20− {label: 'OpenSSL', value: 'openssl'},
21− {label: 'PowerShell', value: 'powershell'},
22− {label: 'Terraform', value: 'terraform'},
23− ]}>
24− <TabItem value="python">
16+ <TabItem value="python" label="Python">
25
17
26 ```shell
18 ```shell
27 python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'
19 python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'
28 ```
20 ```
29−
21+
30 </TabItem>
22 </TabItem>
31− <TabItem value="bash">
23+ <TabItem value="bash" label="Bash">
32
24
33 ```shell
25 ```shell
34− dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\n' | tr -- '+/' '-_'; echo
26+ dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\n' | tr -- '+/' '-_' ; echo
35 ```
27 ```
36−
28+
37 </TabItem>
29 </TabItem>
38− <TabItem value="openssl">
30+ <TabItem value="openssl" label="OpenSSL">
39
31
40 ```shell
32 ```shell
41 openssl rand -base64 32 | tr -- '+/' '-_'
33 openssl rand -base64 32 | tr -- '+/' '-_'
42 ```
34 ```
43
35
44 </TabItem>
36 </TabItem>
45− <TabItem value="powershell">
37+ <TabItem value="powershell" label="PowerShell">
46
38
47− ```shell
39+ ```powershell
48 # Add System.Web assembly to session, just in case
40 # Add System.Web assembly to session, just in case
49 Add-Type -AssemblyName System.Web
41 Add-Type -AssemblyName System.Web
50 [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")
42 [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")
51 ```
43 ```
52
44
53 </TabItem>
45 </TabItem>
54− <TabItem value="terraform">
46+ <TabItem value="terraform" label="Terraform">
55
47
56− ```shell
48+ ```hcl
57 # Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret
49 # Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret
58 resource "random_password" "cookie_secret" {
50 resource "random_password" "cookie_secret" {
59 length = 32
51 length = 32
@@ -72,36 +64,36 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
72
64
73### Command Line Options
65### Command Line Options
74
66
75−| Option | Type | Description | Default |
67+| Option | Type | Description | Default |
76−| ------ | ---- | ----------- |------------------------------------------------------------------|
68+| ------ | ---- | ----------- | ------- |
77−| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
69+| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
78−| `--api-route` | string \| list | return HTTP 401 instead of redirecting to authentication server if token is not valid. Format: path_regex | |
70+| `--api-route` | string \| list | return HTTP 401 instead of redirecting to authentication server if token is not valid. Format: path_regex | |
79−| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
71+| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
80−| `--auth-logging` | bool | Log authentication attempts | true |
72+| `--auth-logging` | bool | Log authentication attempts | true |
81−| `--auth-logging-format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
73+| `--auth-logging-format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
82−| `--authenticated-emails-file` | string | authenticate against emails via file (one per line) | |
74+| `--authenticated-emails-file` | string | authenticate against emails via file (one per line) | |
83−| `--azure-tenant` | string | go to a tenant-specific or common (tenant-independent) endpoint. | `"common"` |
75+| `--azure-tenant` | string | go to a tenant-specific or common (tenant-independent) endpoint. | `"common"` |
84−| `--basic-auth-password` | string | the password to set when passing the HTTP Basic Auth header | |
76+| `--basic-auth-password` | string | the password to set when passing the HTTP Basic Auth header | |
85−| `--client-id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
77+| `--client-id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
86−| `--client-secret` | string | the OAuth Client Secret | |
78+| `--client-secret` | string | the OAuth Client Secret | |
87−| `--client-secret-file` | string | the file with OAuth Client Secret | |
79+| `--client-secret-file` | string | the file with OAuth Client Secret | |
88−| `--code-challenge-method` | string | use PKCE code challenges with the specified method. Either 'plain' or 'S256' (recommended) | |
80+| `--code-challenge-method` | string | use PKCE code challenges with the specified method. Either 'plain' or 'S256' (recommended) | |
89−| `--config` | string | path to config file | |
81+| `--config` | string | path to config file | |
90−| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
82+| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
91−| `--cookie-expire` | duration | expire timeframe for cookie. If set to 0, cookie becomes a session-cookie which will expire when the browser is closed. | 168h0m0s |
83+| `--cookie-expire` | duration | expire timeframe for cookie. If set to 0, cookie becomes a session-cookie which will expire when the browser is closed. | 168h0m0s |
92−| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
84+| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
93−| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
85+| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
94−| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
86+| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
95−| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;\[[1](#footnote1)\] | |
87+| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;\[[1](#footnote1)\] | |
96−| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
88+| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
97−| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
89+| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
98−| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
90+| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
99−| `--cookie-csrf-per-request` | bool | Enable having different CSRF cookies per request, making it possible to have parallel requests. | false |
91+| `--cookie-csrf-per-request` | bool | Enable having different CSRF cookies per request, making it possible to have parallel requests. | false |
100−| `--cookie-csrf-expire` | duration | expire timeframe for CSRF cookie | 15m |
92+| `--cookie-csrf-expire` | duration | expire timeframe for CSRF cookie | 15m |
101−| `--custom-templates-dir` | string | path to custom html templates | |
93+| `--custom-templates-dir` | string | path to custom html templates | |
102| `--custom-sign-in-logo` | string | path or a URL to an custom image for the sign_in page logo. Use `"-"` to disable default logo. |
94| `--custom-sign-in-logo` | string | path or a URL to an custom image for the sign_in page logo. Use `"-"` to disable default logo. |
103| `--display-htpasswd-form` | bool | display username / password login form if an htpasswd file is provided | true |
95| `--display-htpasswd-form` | bool | display username / password login form if an htpasswd file is provided | true |
104−| `--email-domain` | string \| list | authenticate emails with the specified domain (may be given multiple times). Use `*` to authenticate any email | |
96+| `--email-domain` | string \| list | authenticate emails with the specified domain (may be given multiple times). Use `*` to authenticate any email | |
105| `--errors-to-info-log` | bool | redirects error-level logging to default log channel instead of stderr | false |
97| `--errors-to-info-log` | bool | redirects error-level logging to default log channel instead of stderr | false |
106| `--extra-jwt-issuers` | string | if `--skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` (see a token's `iss`, `aud` fields) pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
98| `--extra-jwt-issuers` | string | if `--skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` (see a token's `iss`, `aud` fields) pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
107| `--exclude-logging-path` | string | comma separated list of paths to exclude from logging, e.g. `"/ping,/path2"` |`""` (no paths excluded) |
99| `--exclude-logging-path` | string | comma separated list of paths to exclude from logging, e.g. `"/ping,/path2"` |`""` (no paths excluded) |
@@ -121,7 +113,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
121| `--google-group` | string | restrict logins to members of this google group (may be given multiple times). | |
113| `--google-group` | string | restrict logins to members of this google group (may be given multiple times). | |
122| `--google-service-account-json` | string | the path to the service account json credentials | |
114| `--google-service-account-json` | string | the path to the service account json credentials | |
123| `--google-use-application-default-credentials` | bool | use application default credentials instead of service account json (i.e. GKE Workload Identity) | |
115| `--google-use-application-default-credentials` | bool | use application default credentials instead of service account json (i.e. GKE Workload Identity) | |
124−| `--google-target-principal` | bool | the targetprincipal to impersonate when using ADC | defaults to the service account configured for ADC |
116+| `--google-target-principal` | bool | the target principal to impersonate when using ADC | defaults to the service account configured for ADC |
125| `--htpasswd-file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
117| `--htpasswd-file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
126| `--htpasswd-user-group` | string \| list | the groups to be set on sessions for htpasswd users | |
118| `--htpasswd-user-group` | string \| list | the groups to be set on sessions for htpasswd users | |
127| `--http-address` | string | `[http://]<addr>:<port>` or `unix://<path>` to listen on for HTTP clients. Square brackets are required for ipv6 address, e.g. `http://[::1]:4180` | `"127.0.0.1:4180"` |
119| `--http-address` | string | `[http://]<addr>:<port>` or `unix://<path>` to listen on for HTTP clients. Square brackets are required for ipv6 address, e.g. `http://[::1]:4180` | `"127.0.0.1:4180"` |
@@ -130,7 +122,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
130| `--logging-filename` | string | File to log requests to, empty for `stdout` | `""` (stdout) |
122| `--logging-filename` | string | File to log requests to, empty for `stdout` | `""` (stdout) |
131| `--logging-local-time` | bool | Use local time in log files and backup filenames instead of UTC | true (local time) |
123| `--logging-local-time` | bool | Use local time in log files and backup filenames instead of UTC | true (local time) |
132| `--logging-max-age` | int | Maximum number of days to retain old log files | 7 |
124| `--logging-max-age` | int | Maximum number of days to retain old log files | 7 |
133−| `--logging-max-backups` | int | Maximum number of old log files to retain; 0 to disable | 0 |
125+| `--logging-max-backups` | int | Maximum number of old log files to retain; 0 to disable | 0 |
134| `--logging-max-size` | int | Maximum size in megabytes of the log file before rotation | 100 |
126| `--logging-max-size` | int | Maximum size in megabytes of the log file before rotation | 100 |
135| `--jwt-key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |
127| `--jwt-key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |
136| `--jwt-key-file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |
128| `--jwt-key-file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |
@@ -153,71 +145,70 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
153| `--profile-url` | string | Profile access endpoint | |
145| `--profile-url` | string | Profile access endpoint | |
154| `--prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
146| `--prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
155| `--provider` | string | OAuth provider | google |
147| `--provider` | string | OAuth provider | google |
156−| `--provider-ca-file` | string \| list | Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead. |
148+| `--provider-ca-file` | string \| list | Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead. |
157| `--use-system-trust-store` | bool | Determines if `provider-ca-file` files and the system trust store are used. If set to true, your custom CA files and the system trust store are used otherwise only your custom CA files. | false |
149| `--use-system-trust-store` | bool | Determines if `provider-ca-file` files and the system trust store are used. If set to true, your custom CA files and the system trust store are used otherwise only your custom CA files. | false |
158−| `--provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
150+| `--provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
159−| `--ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
151+| `--ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
160−| `--ping-user-agent` | string | a User-Agent that can be used for basic health checks | `""` (don't check user agent) |
152+| `--ping-user-agent` | string | a User-Agent that can be used for basic health checks | `""` (don't check user agent) |
161−| `--ready-path` | string | the ready endpoint that can be used for deep health checks | `"/ready"` |
153+| `--ready-path` | string | the ready endpoint that can be used for deep health checks | `"/ready"` |
162−| `--metrics-address` | string | the address prometheus metrics will be scraped from | `""` |
154+| `--metrics-address` | string | the address prometheus metrics will be scraped from | `""` |
163−| `--proxy-prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
155+| `--proxy-prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
164−| `--proxy-websockets` | bool | enables WebSocket proxying | true |
156+| `--proxy-websockets` | bool | enables WebSocket proxying | true |
165−| `--pubjwk-url` | string | JWK pubkey access endpoint: required by login.gov | |
157+| `--pubjwk-url` | string | JWK pubkey access endpoint: required by login.gov | |
166−| `--real-client-ip-header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
158+| `--real-client-ip-header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
167−| `--redeem-url` | string | Token redemption endpoint | |
159+| `--redeem-url` | string | Token redemption endpoint | |
168−| `--redirect-url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
160+| `--redirect-url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
169−| `--relative-redirect-url` | bool | allow relative OAuth Redirect URL.` | |
161+| `--relative-redirect-url` | bool | allow relative OAuth Redirect URL.` | |
170−| `--redis-cluster-connection-urls` | string \| list | List of Redis cluster connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-cluster` | |
162+| `--redis-cluster-connection-urls` | string \| list | List of Redis cluster connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-cluster` | |
171−| `--redis-connection-url` | string | URL of redis server for redis session storage (e.g. `redis://HOST[:PORT]`) | |
163+| `--redis-connection-url` | string | URL of redis server for redis session storage (e.g. `redis://HOST[:PORT]`) | |
172−| `--redis-insecure-skip-tls-verify` | bool | skip TLS verification when connecting to Redis | false |
164+| `--redis-insecure-skip-tls-verify` | bool | skip TLS verification when connecting to Redis | false |
173−| `--redis-password` | string | Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url` | |
165+| `--redis-password` | string | Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url` | |
174−| `--redis-sentinel-password` | string | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password` | |
166+| `--redis-sentinel-password` | string | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password` | |
175−| `--redis-sentinel-master-name` | string | Redis sentinel master name. Used in conjunction with `--redis-use-sentinel` | |
167+| `--redis-sentinel-master-name` | string | Redis sentinel master name. Used in conjunction with `--redis-use-sentinel` | |
176−| `--redis-sentinel-connection-urls` | string \| list | List of Redis sentinel connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-sentinel` | |
168+| `--redis-sentinel-connection-urls` | string \| list | List of Redis sentinel connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-sentinel` | |
177−| `--redis-use-cluster` | bool | Connect to redis cluster. Must set `--redis-cluster-connection-urls` to use this feature | false |
169+| `--redis-use-cluster` | bool | Connect to redis cluster. Must set `--redis-cluster-connection-urls` to use this feature | false |
178−| `--redis-use-sentinel` | bool | Connect to redis via sentinels. Must set `--redis-sentinel-master-name` and `--redis-sentinel-connection-urls` to use this feature | false |
170+| `--redis-use-sentinel` | bool | Connect to redis via sentinels. Must set `--redis-sentinel-master-name` and `--redis-sentinel-connection-urls` to use this feature | false |
179−| `--redis-connection-idle-timeout` | int | Redis connection idle timeout seconds. If Redis [timeout](https://redis.io/docs/reference/clients/#client-timeouts) option is set to non-zero, the `--redis-connection-idle-timeout` must be less than Redis timeout option. Exmpale: if either redis.conf includes `timeout 15` or using `CONFIG SET timeout 15` the `--redis-connection-idle-timeout` must be at least `--redis-connection-idle-timeout=14` | 0 |
171+| `--redis-connection-idle-timeout` | int | Redis connection idle timeout seconds. If Redis [timeout](https://redis.io/docs/reference/clients/#client-timeouts) option is set to non-zero, the `--redis-connection-idle-timeout` must be less than Redis timeout option. Example: if either redis.conf includes `timeout 15` or using `CONFIG SET timeout 15` the `--redis-connection-idle-timeout` must be at least `--redis-connection-idle-timeout=14` | 0 |
180−| `--request-id-header` | string | Request header to use as the request ID in logging | X-Request-Id |
172+| `--request-id-header` | string | Request header to use as the request ID in logging | X-Request-Id |
181−| `--request-logging` | bool | Log requests | true |
173+| `--request-logging` | bool | Log requests | true |
182−| `--request-logging-format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
174+| `--request-logging-format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
183−| `--resource` | string | The resource that is protected (Azure AD only) | |
175+| `--resource` | string | The resource that is protected (Azure AD only) | |
184−| `--reverse-proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection | false |
176+| `--reverse-proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection | false |
185−| `--scope` | string | OAuth scope specification | |
177+| `--scope` | string | OAuth scope specification | |
186−| `--session-cookie-minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
178+| `--session-cookie-minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
187−| `--session-store-type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
179+| `--session-store-type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
188−| `--set-xauthrequest` | bool | set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with `--pass-access-token`, X-Auth-Request-Access-Token is added to response headers. | false |
180+| `--set-xauthrequest` | bool | set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with `--pass-access-token`, X-Auth-Request-Access-Token is added to response headers. | false |
189−| `--set-authorization-header` | bool | set Authorization Bearer response header (useful in Nginx auth_request mode) | false |
181+| `--set-authorization-header` | bool | set Authorization Bearer response header (useful in Nginx auth_request mode) | false |
190−| `--set-basic-auth` | bool | set HTTP Basic Auth information in response (useful in Nginx auth_request mode) | false |
182+| `--set-basic-auth` | bool | set HTTP Basic Auth information in response (useful in Nginx auth_request mode) | false |
191−| `--show-debug-on-error` | bool | show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production) | false |
183+| `--show-debug-on-error` | bool | show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production) | false |
192−| `--signature-key` | string | GAP-Signature request signature key (algorithm:secretkey) | |
184+| `--signature-key` | string | GAP-Signature request signature key (algorithm:secretkey) | |
193−| `--silence-ping-logging` | bool | disable logging of requests to ping & ready endpoints | false |
185+| `--silence-ping-logging` | bool | disable logging of requests to ping & ready endpoints | false |
194−| `--skip-auth-preflight` | bool | will skip authentication for OPTIONS requests | false |
186+| `--skip-auth-preflight` | bool | will skip authentication for OPTIONS requests | false |
195−| `--skip-auth-regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times) | |
187+| `--skip-auth-regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times) | |
196−| `--skip-auth-route` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR method!=path_regex. For all methods: path_regex OR !=path_regex | |
188+| `--skip-auth-route` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR method!=path_regex. For all methods: path_regex OR !=path_regex | |
197−| `--skip-auth-strip-headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy | true |
189+| `--skip-auth-strip-headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy | true |
198−| `--skip-jwt-bearer-tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
190+| `--skip-jwt-bearer-tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
199−| `--skip-oidc-discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
191+| `--skip-oidc-discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
200−| `--skip-provider-button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
192+| `--skip-provider-button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
201−| `--ssl-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS providers | false |
193+| `--ssl-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS providers | false |
202−| `--ssl-upstream-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS upstreams | false |
194+| `--ssl-upstream-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS upstreams | false |
203−| `--standard-logging` | bool | Log standard runtime information | true |
195+| `--standard-logging` | bool | Log standard runtime information | true |
204−| `--standard-logging-format` | string | Template for standard log lines | see [Logging Configuration](#logging-configuration) |
196+| `--standard-logging-format` | string | Template for standard log lines | see [Logging Configuration](#logging-configuration) |
205−| `--tls-cert-file` | string | path to certificate file | |
197+| `--tls-cert-file` | string | path to certificate file | |
206−| `--tls-cipher-suite` | string \| list | Restricts TLS cipher suites used by server to those listed (e.g. TLS_RSA_WITH_RC4_128_SHA) (may be given multiple times). If not specified, the default Go safe cipher list is used. List of valid cipher suites can be found in the [crypto/tls documentation](https://pkg.go.dev/crypto/tls#pkg-constants). | |
198+| `--tls-cipher-suite` | string \| list | Restricts TLS cipher suites used by server to those listed (e.g. TLS_RSA_WITH_RC4_128_SHA) (may be given multiple times). If not specified, the default Go safe cipher list is used. List of valid cipher suites can be found in the [crypto/tls documentation](https://pkg.go.dev/crypto/tls#pkg-constants). | |
207−| `--tls-key-file` | string | path to private key file | |
199+| `--tls-key-file` | string | path to private key file | |
208−| `--tls-min-version` | string | minimum TLS version that is acceptable, either `"TLS1.2"` or `"TLS1.3"` | `"TLS1.2"` |
200+| `--tls-min-version` | string | minimum TLS version that is acceptable, either `"TLS1.2"` or `"TLS1.3"` | `"TLS1.2"` |
209−| `--upstream` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
201+| `--upstream` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
210−| `--upstream-timeout` | duration | maximum amount of time the server will wait for a response from the upstream | 30s |
202+| `--upstream-timeout` | duration | maximum amount of time the server will wait for a response from the upstream | 30s |
211−| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
203+| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
212−| `--allowed-role` | string \| list | restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider. | |
204+| `--allowed-role` | string \| list | restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider. | |
213−| `--validate-url` | string | Access token validation endpoint | |
205+| `--validate-url` | string | Access token validation endpoint | |
214−| `--version` | n/a | print version string | |
206+| `--version` | n/a | print version string | |
215−| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` or a `*.` to allow subdomains (e.g. `.example.com`, `*.example.com`)&nbsp;\[[2](#footnote2)\] | |
207+| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` or a `*.` to allow subdomains (e.g. `.example.com`, `*.example.com`)&nbsp;\[[2](#footnote2)\] | |
216−| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
208+| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
217−
209+
218−\[<a name="footnote1">1</a>\]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
210+> ###### 1. Only these providers support `--cookie-refresh`: GitLab, Google and OIDC {#footnote1}
219−
220−\[<a name="footnote2">2</a>\]: When using the `whitelist-domain` option, any domain prefixed with a `.` or a `*.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
211+> ###### 2. When using the `whitelist-domain` option, any domain prefixed with a `.` or a `*.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URLs protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`. {#footnote2}
221
212
222See below for provider specific options
213See below for provider specific options
223
214
@@ -240,7 +231,7 @@ prefixing it with `OAUTH2_PROXY_`, capitalising it, and replacing hyphens (`-`)
240with underscores (`_`). If the argument can be specified multiple times, the
231with underscores (`_`). If the argument can be specified multiple times, the
241environment variable should be plural (trailing `S`).
232environment variable should be plural (trailing `S`).
242
233
243−This is particularly useful for storing secrets outside of a configuration file
234+This is particularly useful for storing secrets outside a configuration file
244or the command line.
235or the command line.
245
236
246For example, the `--cookie-secret` flag becomes `OAUTH2_PROXY_COOKIE_SECRET`,
237For example, the `--cookie-secret` flag becomes `OAUTH2_PROXY_COOKIE_SECRET`,
@@ -254,7 +245,7 @@ If logging to a file you can also configure the maximum file size (`--logging-ma
254
245
255There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with `--standard-logging`, `--auth-logging`, and `--request-logging`.
246There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with `--standard-logging`, `--auth-logging`, and `--request-logging`.
256
247
257−Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log.
248+Each type of logging has its own configurable format and variables. By default, these formats are similar to the Apache Combined Log.
258
249
259Logging of requests to the `/ping` endpoint (or using `--ping-user-agent`) and the `/ready` endpoint can be disabled with `--silence-ping-logging` reducing log volume.
250Logging of requests to the `/ping` endpoint (or using `--ping-user-agent`) and the `/ready` endpoint can be disabled with `--silence-ping-logging` reducing log volume.
260
251
docs/docs/configuration/providers/adfs.mdnew file+19
@@ -0,0 +1,19 @@
1+---
2+id: adfs
3+title: ADFS
4+---
5+
6+1. Open the ADFS administration console on your Windows Server and add a new Application Group
7+2. Provide a name for the integration, select Server Application from the Standalone applications section and click Next
8+3. Follow the wizard to get the client-id, client-secret and configure the application credentials
9+4. Configure the proxy with
10+
11+```
12+ --provider=adfs
13+ --client-id=<application ID from step 3>
14+ --client-secret=<value from step 3>
15+```
16+
17+Note: When using the ADFS Auth provider with nginx and the cookie session store you may find the cookie is too large and
18+doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the
19+[redis session storage](../sessions.md#redis-storage) should resolve this.
docs/docs/configuration/providers/azure.mdnew file+46
@@ -0,0 +1,46 @@
1+---
2+id: azure
3+title: Azure
4+---
5+
6+1. Add an application: go to [https://portal.azure.com](https://portal.azure.com), choose **Azure Active Directory**, select
7+ **App registrations** and then click on **New registration**.
8+2. Pick a name, check the supported account type(single-tenant, multi-tenant, etc). In the **Redirect URI** section create a new
9+ **Web** platform entry for each app that you want to protect by the oauth2 proxy(e.g.
10+ https://internal.yourcompanycom/oauth2/callback). Click **Register**.
11+3. Next we need to add group read permissions for the app registration, on the **API Permissions** page of the app, click on
12+ **Add a permission**, select **Microsoft Graph**, then select **Application permissions**, then click on **Group** and select
13+ **Group.Read.All**. Hit **Add permissions** and then on **Grant admin consent** (you might need an admin to do this).
14+ <br/>**IMPORTANT**: Even if this permission is listed with **"Admin consent required=No"** the consent might actually
15+ be required, due to AAD policies you won't be able to see. If you get a **"Need admin approval"** during login,
16+ most likely this is what you're missing!
17+4. Next, if you are planning to use v2.0 Azure Auth endpoint, go to the **Manifest** page and set `"accessTokenAcceptedVersion": 2`
18+ in the App registration manifest file.
19+5. On the **Certificates & secrets** page of the app, add a new client secret and note down the value after hitting **Add**.
20+6. Configure the proxy with:
21+- for V1 Azure Auth endpoint (Azure Active Directory Endpoints - https://login.microsoftonline.com/common/oauth2/authorize)
22+
23+```
24+ --provider=azure
25+ --client-id=<application ID from step 3>
26+ --client-secret=<value from step 5>
27+ --azure-tenant={tenant-id}
28+ --oidc-issuer-url=https://sts.windows.net/{tenant-id}/
29+```
30+
31+- for V2 Azure Auth endpoint (Microsoft Identity Platform Endpoints - https://login.microsoftonline.com/common/oauth2/v2.0/authorize)
32+```
33+ --provider=azure
34+ --client-id=<application ID from step 3>
35+ --client-secret=<value from step 5>
36+ --azure-tenant={tenant-id}
37+ --oidc-issuer-url=https://login.microsoftonline.com/{tenant-id}/v2.0
38+```
39+
40+***Notes***:
41+- When using v2.0 Azure Auth endpoint (`https://login.microsoftonline.com/{tenant-id}/v2.0`) as `--oidc_issuer_url`, in conjunction
42+ with `--resource` flag, be sure to append `/.default` at the end of the resource name. See
43+ https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#the-default-scope for more details.
44+- When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't
45+ get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the
46+ [redis session storage](../sessions.md#redis-storage) should resolve this.
docs/docs/configuration/providers/azure_ad.mdnew file+9
@@ -0,0 +1,9 @@
1+---
2+id: azure_ad
3+title: Microsoft Azure AD
4+---
5+
6+For adding an application to the Microsoft Azure AD follow [these steps to add an application](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app).
7+
8+Take note of your `TenantId` if applicable for your situation. The `TenantId` can be used to override the default
9+`common` authorization server with a tenant specific server.
docs/docs/configuration/providers/bitbucket.mdnew file+25
@@ -0,0 +1,25 @@
1+---
2+id: bitbucket
3+title: BitBucket
4+---
5+
6+1. [Add a new OAuth consumer](https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html)
7+ * In "Callback URL" use `https://<oauth2-proxy>/oauth2/callback`, substituting `<oauth2-proxy>` with the actual
8+ hostname that oauth2-proxy is running on.
9+ * In Permissions section select:
10+ * Account -> Email
11+ * Team membership -> Read
12+ * Repositories -> Read
13+2. Note the Client ID and Client Secret.
14+
15+To use the provider, pass the following options:
16+
17+```
18+ --provider=bitbucket
19+ --client-id=<Client ID>
20+ --client-secret=<Client Secret>
21+```
22+
23+The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team
24+members use additional configuration option: `--bitbucket-team=<Team name>`. To restrict the access to only these users
25+who have access to one selected repository use `--bitbucket-repository=<Repository name>`.
docs/docs/configuration/providers/digitalocean.mdnew file+21
@@ -0,0 +1,21 @@
1+---
2+id: digitalocean
3+title: DigitalOcean
4+---
5+
6+1. [Create a new OAuth application](https://cloud.digitalocean.com/account/api/applications)
7+ * You can fill in the name, homepage, and description however you wish.
8+ * In the "Application callback URL" field, enter: `https://oauth-proxy/oauth2/callback`, substituting `oauth2-proxy`
9+ with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL.
10+2. Note the Client ID and Client Secret.
11+
12+To use the provider, pass the following options:
13+
14+```
15+ --provider=digitalocean
16+ --client-id=<Client ID>
17+ --client-secret=<Client Secret>
18+```
19+
20+Alternatively, set the equivalent options in the config file. The redirect URL defaults to
21+`https://<requested host header>/oauth2/callback`. If you need to change it, you can use the `--redirect-url` command-line option.
docs/docs/configuration/providers/facebook.mdnew file+7
@@ -0,0 +1,7 @@
1+---
2+id: facebook
3+title: Facebook
4+---
5+
6+1. Create a new FB App from <https://developers.facebook.com/>
7+2. Under FB Login, set your Valid OAuth redirect URIs to `https://internal.yourcompany.com/oauth2/callback`
docs/docs/configuration/providers/gitea.mdnew file+20
@@ -0,0 +1,20 @@
1+---
2+id: gitea
3+title: Gitea
4+---
5+
6+1. Create a new application: `https://< your gitea host >/user/settings/applications`
7+2. Under `Redirect URI` enter the correct URL i.e. `https://<proxied host>/oauth2/callback`
8+3. Note the Client ID and Client Secret.
9+4. Pass the following options to the proxy:
10+
11+```
12+ --provider="github"
13+ --redirect-url="https://<proxied host>/oauth2/callback"
14+ --provider-display-name="Gitea"
15+ --client-id="< client_id as generated by Gitea >"
16+ --client-secret="< client_secret as generated by Gitea >"
17+ --login-url="https://< your gitea host >/login/oauth/authorize"
18+ --redeem-url="https://< your gitea host >/login/oauth/access_token"
19+ --validate-url="https://< your gitea host >/api/v1/user/emails"
20+```
docs/docs/configuration/providers/github.mdnew file+43
@@ -0,0 +1,43 @@
1+---
2+id: github
3+title: GitHub
4+---
5+
6+1. Create a new project: https://github.com/settings/developers
7+2. Under `Authorization callback URL` enter the correct url ie `https://internal.yourcompany.com/oauth2/callback`
8+
9+The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional
10+team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with `--email-domain=*`
11+
12+NOTE: When `--github-user` is set, the specified users are allowed to log in even if they do not belong to the specified
13+org and team or collaborators.
14+
15+To restrict by organization only, include the following flag:
16+
17+ -github-org="": restrict logins to members of this organisation
18+
19+To restrict within an organization to specific teams, include the following flag in addition to `-github-org`:
20+
21+ -github-team="": restrict logins to members of any of these teams (slug), separated by a comma
22+
23+If you would rather restrict access to collaborators of a repository, those users must either have push access to a
24+public repository or any access to a private repository:
25+
26+ -github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo
27+
28+If you'd like to allow access to users with **read only** access to a **public** repository you will need to provide a
29+[token](https://github.com/settings/tokens) for a user that has write access to the repository. The token must be
30+created with at least the `public_repo` scope:
31+
32+ -github-token="": the token to use when verifying repository collaborators
33+
34+To allow a user to log in with their username even if they do not belong to the specified org and team or collaborators,
35+separated by a comma
36+
37+ -github-user="": allow logins by username, separated by a comma
38+
39+If you are using GitHub enterprise, make sure you set the following to the appropriate url:
40+
41+ -login-url="http(s)://<enterprise github host>/login/oauth/authorize"
42+ -redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"
43+ -validate-url="http(s)://<enterprise github host>/api/v3"
docs/docs/configuration/providers/gitlab.mdnew file+36
@@ -0,0 +1,36 @@
1+---
2+id: gitlab
3+title: GitLab
4+---
5+
6+This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version
7+prior to 12.X (see [994](https://github.com/oauth2-proxy/oauth2-proxy/issues/994)).
8+
9+Whether you are using GitLab.com or self-hosting GitLab, follow
10+[these steps to add an application](https://docs.gitlab.com/ce/integration/oauth_provider.html). Make sure to enable at
11+least the `openid`, `profile` and `email` scopes, and set the redirect url to your application url e.g.
12+https://myapp.com/oauth2/callback.
13+
14+If you need projects filtering, add the extra `read_api` scope to your application.
15+
16+The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow
17+[these steps](../overview.md#generating-a-cookie-secret)
18+
19+```
20+ --provider="gitlab"
21+ --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab
22+ --client-id=GITLAB_CLIENT_ID
23+ --client-secret=GITLAB_CLIENT_SECRET
24+ --cookie-secret=COOKIE_SECRET
25+```
26+
27+Restricting by group membership is possible with the following option:
28+
29+ --gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma
30+
31+If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:
32+
33+ --oidc-issuer-url="<your gitlab url>"
34+
35+If your self-hosted GitLab is on a subdirectory (e.g. domain.tld/gitlab), as opposed to its own subdomain
36+(e.g. gitlab.domain.tld), you may need to add a redirect from domain.tld/oauth pointing at e.g. domain.tld/gitlab/oauth.
docs/docs/configuration/providers/google.mdnew file+63
@@ -0,0 +1,63 @@
1+---
2+id: google
3+title: Google (default)
4+---
5+
6+For Google, the registration steps are:
7+
8+1. Create a new project: https://console.developers.google.com/project
9+2. Choose the new project from the top right project dropdown (only if another project is selected)
10+3. In the project Dashboard center pane, choose **"APIs & Services"**
11+4. In the left Nav pane, choose **"Credentials"**
12+5. In the center pane, choose **"OAuth consent screen"** tab. Fill in **"Product name shown to users"** and hit save.
13+6. In the center pane, choose **"Credentials"** tab.
14+ - Open the **"New credentials"** drop down
15+ - Choose **"OAuth client ID"**
16+ - Choose **"Web application"**
17+ - Application name is freeform, choose something appropriate
18+ - Authorized JavaScript origins is your domain ex: `https://internal.yourcompany.com`
19+ - Authorized redirect URIs is the location of oauth2/callback ex: `https://internal.yourcompany.com/oauth2/callback`
20+ - Choose **"Create"**
21+7. Take note of the **Client ID** and **Client Secret**
22+
23+It's recommended to refresh sessions on a short interval (1h) with `cookie-refresh` setting which validates that the
24+account is still authorized.
25+
26+#### Restrict auth to specific Google groups on your domain. (optional)
27+
28+1. Create a [service account](https://developers.google.com/identity/protocols/OAuth2ServiceAccount) and configure it
29+ to use [Application Default Credentials / Workload Identity / Workload Identity Federation (recommended)](#using-application-default-credentials-adc--workload-identity--workload-identity-federation-recommended) or,
30+ alternatively download the JSON.
31+2. Make note of the Client ID for a future step.
32+3. Under "APIs & Auth", choose APIs.
33+4. Click on Admin SDK and then Enable API.
34+5. Follow the steps on https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account
35+ and give the client id from step 2 the following oauth scopes:
36+
37+ ```
38+ https://www.googleapis.com/auth/admin.directory.group.readonly
39+ https://www.googleapis.com/auth/admin.directory.user.readonly
40+ ```
41+
42+6. Follow the steps on https://support.google.com/a/answer/60757 to enable Admin API access.
43+7. Create or choose an existing administrative email address on the Gmail domain to assign to the `google-admin-email`
44+ flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from
45+ step 5 for the reason why.
46+8. Create or choose an existing email group and set that email to the `google-group` flag. You can pass multiple instances
47+ of this flag with different groups and the user will be checked against all the provided groups.
48+
49+(Only if using a JSON file (see step 1))
50+9. Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and
51+ set the path to the file in the `google-service-account-json` flag.
52+10. Restart oauth2-proxy.
53+
54+Note: The user is checked against the group members list on initial authentication and every time the token is
55+refreshed ( about once an hour ).
56+
57+##### Using Application Default Credentials (ADC) / Workload Identity / Workload Identity Federation (recommended)
58+oauth2-proxy can make use of [Application Default Credentials](https://cloud.google.com/docs/authentication/application-default-credentials).
59+When deployed within GCP, this means that it can automatically use the service account attached to the resource. When deployed to GKE, ADC
60+can be leveraged through a feature called Workload Identity. Follow Google's [guide](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity)
61+to set up Workload Identity.
62+
63+When deployed outside of GCP, [Workload Identity Federation](https://cloud.google.com/docs/authentication/provide-credentials-adc#wlif) might be an option.
docs/docs/configuration/providers/index.mdnew file+42
@@ -0,0 +1,42 @@
1+---
2+id: index
3+title: OAuth Provider Configuration
4+---
5+
6+You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it
7+with Redirect URI(s) for the domain you intend to run `oauth2-proxy` on.
8+
9+Valid providers are :
10+
11+- [Google](google.md) _default_
12+- [Azure](azure.md)
13+- [ADFS](adfs.md)
14+- [Facebook](facebook.md)
15+- [GitHub](github.md)
16+- [Gitea](gitea.md)
17+- [Keycloak](keycloak.md)/[Keycloak OIDC](keycloak_oidc.md)
18+- [GitLab](gitlab.md)
19+- [LinkedIn](linkedin.md)
20+- [Microsoft Azure AD](azure_ad.md)
21+- [OpenID Connect](openid_connect.md)
22+- [login.gov](login_gov.md)
23+- [Nextcloud](nextcloud.md)
24+- [DigitalOcean](digitalocean.md)
25+- [Bitbucket](bitbucket.md)
26+
27+The provider can be selected using the `provider` configuration value.
28+
29+Please note that not all providers support all claims. The `preferred_username` claim is currently only supported by the
30+OpenID Connect provider.
31+
32+## Email Authentication
33+
34+To authorize a specific email-domain use `--email-domain=yourcompany.com`. To authorize individual email addresses use
35+`--authenticated-emails-file=/path/to/file` with one email per line. To authorize all email addresses use `--email-domain=*`.
36+
37+## Adding a new Provider
38+
39+Follow the examples in the [`providers` package](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/) to define a new
40+`Provider` instance. Add a new `case` to
41+[`providers.New()`](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go) to allow `oauth2-proxy` to use the
42+new `Provider`.
docs/docs/configuration/providers/keycloak.mdnew file+36
@@ -0,0 +1,36 @@
1+---
2+id: keycloak
3+title: Keycloak
4+---
5+
6+:::note
7+This is the legacy provider for Keycloak, use [Keycloak OIDC Auth Provider](keycloak_oidc.md) if possible.
8+:::
9+
10+1. Create new client in your Keycloak realm with **Access Type** 'confidential' and **Valid Redirect URIs** 'https://internal.yourcompany.com/oauth2/callback'
11+2. Take note of the Secret in the credential tab of the client
12+3. Create a mapper with **Mapper Type** 'Group Membership' and **Token Claim Name** 'groups'.
13+
14+Make sure you set the following to the appropriate url:
15+
16+```
17+ --provider=keycloak
18+ --client-id=<client you have created>
19+ --client-secret=<your client's secret>
20+ --login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"
21+ --redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"
22+ --profile-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
23+ --validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
24+ --keycloak-group=<first_allowed_user_group>
25+ --keycloak-group=<second_allowed_user_group>
26+```
27+
28+For group based authorization, the optional `--keycloak-group` (legacy) or `--allowed-group` (global standard)
29+flags can be used to specify which groups to limit access to.
30+
31+If these are unset but a `groups` mapper is set up above in step (3), the provider will still
32+populate the `X-Forwarded-Groups` header to your upstream server with the `groups` data in the
33+Keycloak userinfo endpoint response.
34+
35+The group management in keycloak is using a tree. If you create a group named admin in keycloak
36+you should define the 'keycloak-group' value to /admin.
docs/docs/configuration/providers/keycloak_oidc.mdnew file+143
@@ -0,0 +1,143 @@
1+---
2+id: keycloak_oidc
3+title: Keycloak OIDC
4+---
5+
6+```
7+ --provider=keycloak-oidc
8+ --client-id=<your client's id>
9+ --client-secret=<your client's secret>
10+ --redirect-url=https://internal.yourcompany.com/oauth2/callback
11+ --oidc-issuer-url=https://<keycloak host>/realms/<your realm> // For Keycloak versions <17: --oidc-issuer-url=https://<keycloak host>/auth/realms/<your realm>
12+ --email-domain=<yourcompany.com> // Validate email domain for users, see option documentation
13+ --allowed-role=<realm role name> // Optional, required realm role
14+ --allowed-role=<client id>:<client role name> // Optional, required client role
15+ --allowed-group=</group name> // Optional, requires group client scope
16+ --code-challenge-method=S256 // PKCE
17+```
18+
19+:::note
20+Keycloak has updated its admin console and as of version 19.0.0, the new admin console is enabled by default. The
21+legacy admin console has been announced for removal with the release of version 21.0.0.
22+:::
23+
24+**Keycloak legacy admin console**
25+
26+1. Create new client in your Keycloak realm with **Access Type** 'confidential', **Client protocol** 'openid-connect'
27+ and **Valid Redirect URIs** 'https://internal.yourcompany.com/oauth2/callback'
28+2. Take note of the Secret in the credential tab of the client
29+3. Create a mapper with **Mapper Type** 'Group Membership' and **Token Claim Name** 'groups'.
30+4. Create a mapper with **Mapper Type** 'Audience' and **Included Client Audience** and **Included Custom Audience** set
31+ to your client name.
32+
33+**Keycloak new admin console (default as of v19.0.0)**
34+
35+The following example shows how to create a simple OIDC client using the new Keycloak admin2 console. However, for best
36+practices, it is recommended to consult the Keycloak documentation.
37+
38+The OIDC client must be configured with an _audience mapper_ to include the client's name in the `aud` claim of the JWT token.
39+The `aud` claim specifies the intended recipient of the token, and OAuth2 Proxy expects a match against the values of
40+either `--client-id` or `--oidc-extra-audience`.
41+
42+_In Keycloak, claims are added to JWT tokens through the use of mappers at either the realm level using "client scopes" or
43+through "dedicated" client mappers._
44+
45+**Creating the client**
46+
47+1. Create a new OIDC client in your Keycloak realm by navigating to:
48+ **Clients** -> **Create client**
49+ * **Client Type** 'OpenID Connect'
50+ * **Client ID** `<your client's id>`, please complete the remaining fields as appropriate and click **Next**.
51+ * **Client authentication** 'On'
52+ * **Authentication flow**
53+ * **Standard flow** 'selected'
54+ * **Direct access grants** 'deselect'
55+ * _Save the configuration._
56+ * **Settings / Access settings**:
57+ * **Valid redirect URIs** `https://internal.yourcompany.com/oauth2/callback`
58+ * _Save the configuration._
59+ * Under the **Credentials** tab you will now be able to locate `<your client's secret>`.
60+2. Configure a dedicated *audience mapper* for your client by navigating to **Clients** -> **<your client's id>** -> **Client scopes**.
61+* Access the dedicated mappers pane by clicking **<your client's id>-dedicated**, located under *Assigned client scope*.
62+ _(It should have a description of "Dedicated scope and mappers for this client")_
63+ * Click **Configure a new mapper** and select **Audience**
64+ * **Name** 'aud-mapper-<your client's id>'
65+ * **Included Client Audience** select `<your client's id>` from the dropdown.
66+ * _OAuth2 proxy can be set up to pass both the access and ID JWT tokens to your upstream services.
67+ If you require additional audience entries, you can use the **Included Custom Audience** field in addition
68+ to the "Included Client Audience" dropdown. Note that the "aud" claim of a JWT token should be limited and
69+ only specify its intended recipients._
70+ * **Add to ID token** 'On'
71+ * **Add to access token** 'On' - [#1916](https://github.com/oauth2-proxy/oauth2-proxy/pull/1916)
72+ * _Save the configuration._
73+* Any subsequent dedicated client mappers can be defined by clicking **Dedicated scopes** -> **Add mapper** ->
74+ **By configuration** -> *Select mapper*
75+
76+You should now be able to create a test user in Keycloak and get access to the OAuth2 Proxy instance, make sure to set
77+an email address matching `<yourcompany.com>` and select _Email verified_.
78+
79+**Authorization**
80+
81+_OAuth2 Proxy will perform authorization by requiring a valid user, this authorization can be extended to take into
82+account a user's membership in Keycloak `groups`, `realm roles`, and `client roles` using the keycloak-oidc provider options
83+`--allowed-role` or `--allowed-group`_
84+
85+**Roles**
86+
87+_A standard Keycloak installation comes with the required mappers for **realm roles** and **client roles** through the
88+pre-defined client scope "roles". This ensures that any roles assigned to a user are included in the `JWT` tokens when
89+using an OIDC client that has the "Full scope allowed" feature activated, the feature is enabled by default._
90+
91+_Creating a realm role_
92+* Navigate to **Realm roles** -> **Create role**
93+ * **Role name**, *`<realm role name>`* -> **save**
94+
95+_Creating a client role_
96+* Navigate to **Clients** -> `<your client's id>` -> **Roles** -> **Create role**
97+ * **Role name**, *`<client role name>`* -> **save**
98+
99+
100+_Assign a role to a user_
101+
102+**Users** -> _Username_ -> **Role mapping** -> **Assign role** -> _filter by roles or clients and select_ -> **Assign**.
103+
104+Keycloak "realm roles" can be authorized using the `--allowed-role=<realm role name>` option, while "client roles" can be
105+evaluated using `--allowed-role=<your client's id>:<client role name>`.
106+
107+You may limit the _realm roles_ included in the JWT tokens for any given client by navigating to:
108+**Clients** -> `<your client's id>` -> **Client scopes** -> _<your client's id>-dedicated_ -> **Scope**
109+Disabling **Full scope allowed** activates the **Assign role** option, allowing you to select which roles, if assigned
110+to a user, will be included in the user's JWT tokens. This can be useful when a user has many associated roles, and you
111+want to reduce the size and impact of the JWT token.
112+
113+
114+**Groups**
115+
116+You may also do authorization on group memberships by using the OAuth2 Proxy option `--allowed-group`.
117+We will only do a brief description of creating the required _client scope_ **groups** and refer you to read the Keycloak
118+documentation.
119+
120+To summarize, the steps required to authorize Keycloak group membership with OAuth2 Proxy are as follows:
121+
122+* Create a new Client Scope with the name **groups** in Keycloak.
123+ * Include a mapper of type **Group Membership**.
124+ * Set the "Token Claim Name" to **groups** or customize by matching it to the `--oidc-groups-claim` option of OAuth2 Proxy.
125+ * If the "Full group path" option is selected, you need to include a "/" separator in the group names defined in the
126+ `--allowed-group` option of OAuth2 Proxy. Example: "/groupname" or "/groupname/child_group".
127+
128+After creating the _Client Scope_ named _groups_ you will need to attach it to your client.
129+**Clients** -> `<your client's id>` -> **Client scopes** -> **Add client scope** -> Select **groups** and choose Optional
130+and you should now have a client that maps group memberships into the JWT tokens so that Oauth2 Proxy may evaluate them.
131+
132+Create a group by navigating to **Groups** -> **Create group** and _add_ your test user as a member.
133+
134+The OAuth2 Proxy option `--allowed-group=/groupname` will now allow you to filter on group membership
135+
136+Keycloak also has the option of attaching roles to groups, please refer to the Keycloak documentation for more information.
137+
138+**Tip**
139+
140+To check if roles or groups are added to JWT tokens, you can preview a users token in the Keycloak console by following
141+these steps: **Clients** -> `<your client's id>` -> **Client scopes** -> **Evaluate**.
142+Select a _realm user_ and optional _scope parameters_ such as groups, and generate the JSON representation of an access
143+or id token to examine its contents.
docs/docs/configuration/providers/linkedin.mdnew file+13
@@ -0,0 +1,13 @@
1+---
2+id: linkedin
3+title: LinkedIn
4+---
5+
6+For LinkedIn, the registration steps are:
7+
8+1. Create a new project: https://www.linkedin.com/secure/developer
9+2. In the OAuth User Agreement section:
10+ - In default scope, select r_basicprofile and r_emailaddress.
11+ - In "OAuth 2.0 Redirect URLs", enter `https://internal.yourcompany.com/oauth2/callback`
12+3. Fill in the remaining required fields and Save.
13+4. Take note of the **Consumer Key / API Key** and **Consumer Secret / Secret Key**
docs/docs/configuration/providers/login_gov.mdnew file+79
@@ -0,0 +1,79 @@
1+---
2+id: login_gov
3+title: Login.gov
4+---
5+
6+login.gov is an OIDC provider for the US Government.
7+If you are a US Government agency, you can contact the login.gov team through the contact information
8+that you can find on https://login.gov/developers/ and work with them to understand how to get login.gov
9+accounts for integration/test and production access.
10+
11+A developer guide is available here: https://developers.login.gov/, though this proxy handles everything
12+but the data you need to create to register your application in the login.gov dashboard.
13+
14+As a demo, we will assume that you are running your application that you want to secure locally on
15+http://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that
16+you have an agency integration account for testing.
17+
18+First, register your application in the dashboard. The important bits are:
19+* Identity protocol: make this `Openid connect`
20+* Issuer: do what they say for OpenID Connect. We will refer to this string as `${LOGINGOV_ISSUER}`.
21+* Public key: This is a self-signed certificate in .pem format generated from a 2048-bit RSA private key.
22+ A quick way to do this is
23+ `openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'`.
24+ The contents of the `key.pem` shall be referred to as `${OAUTH2_PROXY_JWT_KEY}`.
25+* Return to App URL: Make this be `http://localhost:4180/`
26+* Redirect URIs: Make this be `http://localhost:4180/oauth2/callback`.
27+* Attribute Bundle: Make sure that email is selected.
28+
29+Now start the proxy up with the following options:
30+```
31+./oauth2-proxy -provider login.gov \
32+ -client-id=${LOGINGOV_ISSUER} \
33+ -redirect-url=http://localhost:4180/oauth2/callback \
34+ -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \
35+ -cookie-secure=false \
36+ -email-domain=gsa.gov \
37+ -upstream=http://localhost:3000/ \
38+ -cookie-secret=somerandomstring12341234567890AB \
39+ -cookie-domain=localhost \
40+ -skip-provider-button=true \
41+ -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \
42+ -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \
43+ -jwt-key="${OAUTH2_PROXY_JWT_KEY}"
44+```
45+You can also set all these options with environment variables, for use in cloud/docker environments.
46+One tricky thing that you may encounter is that some cloud environments will pass in environment
47+variables in a docker env-file, which does not allow multiline variables like a PEM file.
48+If you encounter this, then you can create a `jwt_signing_key.pem` file in the top level
49+directory of the repo which contains the key in PEM format and then do your docker build.
50+The docker build process will copy that file into your image which you can then access by
51+setting the `OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem`
52+environment variable, or by setting `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem` on the commandline.
53+
54+Once it is running, you should be able to go to `http://localhost:4180/` in your browser,
55+get authenticated by the login.gov integration server, and then get proxied on to your
56+application running on `http://localhost:3000/`. In a real deployment, you would secure
57+your application with a firewall or something so that it was only accessible from the
58+proxy, and you would use real hostnames everywhere.
59+
60+#### Skip OIDC discovery
61+
62+Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization,
63+token and jwks URI endpoints from the provider's metadata.
64+
65+In this case, you can set the `--skip-oidc-discovery` option, and supply those required endpoints manually:
66+
67+```
68+ -provider oidc
69+ -client-id oauth2-proxy
70+ -client-secret proxy
71+ -redirect-url http://127.0.0.1:4180/oauth2/callback
72+ -oidc-issuer-url http://127.0.0.1:5556
73+ -skip-oidc-discovery
74+ -login-url http://127.0.0.1:5556/authorize
75+ -redeem-url http://127.0.0.1:5556/token
76+ -oidc-jwks-url http://127.0.0.1:5556/keys
77+ -cookie-secure=false
78+ -email-domain example.com
79+```
docs/docs/configuration/providers/nextcloud.mdnew file+28
@@ -0,0 +1,28 @@
1+---
2+id: nextcloud
3+title: NextCloud
4+---
5+
6+The Nextcloud provider allows you to authenticate against users in your
7+Nextcloud instance.
8+
9+When you are using the Nextcloud provider, you must specify the urls via
10+configuration, environment variable, or command line argument. Depending
11+on whether your Nextcloud instance is using pretty urls your urls may be of the
12+form `/index.php/apps/oauth2/*` or `/apps/oauth2/*`.
13+
14+Refer to the [OAuth2
15+documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html)
16+to set up the client id and client secret. Your "Redirection URI" will be
17+`https://internalapp.yourcompany.com/oauth2/callback`.
18+
19+```
20+ -provider nextcloud
21+ -client-id <from nextcloud admin>
22+ -client-secret <from nextcloud admin>
23+ -login-url="<your nextcloud url>/index.php/apps/oauth2/authorize"
24+ -redeem-url="<your nextcloud url>/index.php/apps/oauth2/api/v1/token"
25+ -validate-url="<your nextcloud url>/ocs/v2.php/cloud/user?format=json"
26+```
27+
28+Note: in *all* cases the validate-url will *not* have the `index.php`.
docs/docs/configuration/providers/openid_connect.mdnew file+146
@@ -0,0 +1,146 @@
1+---
2+id: openid_connect
3+title: OpenID Connect
4+---
5+
6+OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects.
7+
8+This provider was originally built against CoreOS Dex, and we will use it as an example.
9+The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below.
10+
11+#### Dex
12+
13+To configure the OIDC provider for Dex, perform the following steps:
14+
15+1. Download Dex:
16+
17+ ```
18+ go get github.com/dexidp/dex
19+ ```
20+
21+ See the [getting started guide](https://dexidp.io/docs/getting-started/) for more details.
22+
23+2. Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to
24+ the `staticClients` section of `examples/config-dev.yaml`:
25+
26+ ```
27+ - id: oauth2-proxy
28+ redirectURIs:
29+ - 'http://127.0.0.1:4180/oauth2/callback'
30+ name: 'oauth2-proxy'
31+ secret: proxy
32+ ```
33+
34+3. Launch Dex: from `$GOPATH/github.com/dexidp/dex`, run:
35+
36+ ```
37+ bin/dex serve examples/config-dev.yaml
38+ ```
39+
40+4. In a second terminal, run the oauth2-proxy with the following args:
41+
42+ ```
43+ -provider oidc
44+ -provider-display-name "My OIDC Provider"
45+ -client-id oauth2-proxy
46+ -client-secret proxy
47+ -redirect-url http://127.0.0.1:4180/oauth2/callback
48+ -oidc-issuer-url http://127.0.0.1:5556/dex
49+ -cookie-secure=false
50+ -cookie-secret=secret
51+ -email-domain kilgore.trout
52+ ```
53+
54+ To serve the current working directory as a website under the `/static` endpoint, add:
55+
56+ ```
57+ -upstream file://$PWD/#/static/
58+ ```
59+
60+5. Test the setup by visiting http://127.0.0.1:4180 or http://127.0.0.1:4180/static .
61+
62+See also [our local testing environment](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment) for a self-contained example using Docker and etcd as storage for Dex.
63+
64+#### Okta
65+
66+To configure the OIDC provider for Okta, perform the following steps:
67+
68+1. Log in to Okta using an administrative account. It is suggested you try this in preview first, `example.oktapreview.com`
69+2. (OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,
70+ you may wish to configure an authorization server for each application. Otherwise, the provided `default` will work.
71+ * Navigate to **Security** then select **API**
72+ * Click **Add Authorization Server**, if this option is not available you may require an additional license for a custom
73+ authorization server.
74+ * Fill out the **Name** with something to describe the application you are protecting. e.g. 'Example App'.
75+ * For **Audience**, pick the URL of the application you wish to protect: https://example.corp.com
76+ * Fill out a **Description**
77+ * Add any **Access Policies** you wish to configure to limit application access.
78+ * The default settings will work for other options.
79+ [See Okta documentation for more information on Authorization Servers](https://developer.okta.com/docs/guides/customize-authz-server/overview/)
80+3. Navigate to **Applications** then select **Add Application**.
81+ * Select **Web** for the **Platform** setting.
82+ * Select **OpenID Connect** and click **Create**
83+ * Pick an **Application Name** such as `Example App`.
84+ * Set the **Login redirect URI** to `https://example.corp.com`.
85+ * Under **General** set the **Allowed grant types** to `Authorization Code` and `Refresh Token`.
86+ * Leave the rest as default, taking note of the `Client ID` and `Client Secret`.
87+ * Under **Assignments** select the users or groups you wish to access your application.
88+4. Create a configuration file like the following:
89+
90+ ```
91+ provider = "oidc"
92+ redirect_url = "https://example.corp.com/oauth2/callback"
93+ oidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"
94+ upstreams = [
95+ "https://example.corp.com"
96+ ]
97+ email_domains = [
98+ "corp.com"
99+ ]
100+ client_id = "XXXXX"
101+ client_secret = "YYYYY"
102+ pass_access_token = true
103+ cookie_secret = "ZZZZZ"
104+ skip_provider_button = true
105+ ```
106+
107+The `oidc_issuer_url` is based on URL from your **Authorization Server**'s **Issuer** field in step 2, or simply
108+https://corp.okta.com. The `client_id` and `client_secret` are configured in the application settings.
109+Generate a unique `cookie_secret` to encrypt the cookie.
110+
111+Then you can start the oauth2-proxy with `./oauth2-proxy --config /etc/example.cfg`
112+
113+#### Okta - localhost
114+
115+1. Signup for developer account: https://developer.okta.com/signup/
116+2. Create New `Web` Application: https://${your-okta-domain}/dev/console/apps/new
117+3. Example Application Settings for localhost:
118+ * **Name:** My Web App
119+ * **Base URIs:** http://localhost:4180/
120+ * **Login redirect URIs:** http://localhost:4180/oauth2/callback
121+ * **Logout redirect URIs:** http://localhost:4180/
122+ * **Group assignments:** `Everyone`
123+ * **Grant type allowed:** `Authorization Code` and `Refresh Token`
124+4. Make note of the `Client ID` and `Client secret`, they are needed in a future step
125+5. Make note of the **default** Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as
126+6. Example config file `/etc/localhost.cfg`
127+ ```
128+ provider = "oidc"
129+ redirect_url = "http://localhost:4180/oauth2/callback"
130+ oidc_issuer_url = "https://${your-okta-domain}/oauth2/default"
131+ upstreams = [
132+ "http://0.0.0.0:8080"
133+ ]
134+ email_domains = [
135+ "*"
136+ ]
137+ client_id = "XXX"
138+ client_secret = "YYY"
139+ pass_access_token = true
140+ cookie_secret = "ZZZ"
141+ cookie_secure = false
142+ skip_provider_button = true
143+ # Note: use the following for testing within a container
144+ # http_address = "0.0.0.0:4180"
145+ ```
146+7. Then you can start the oauth2-proxy with `./oauth2-proxy --config /etc/localhost.cfg`
docs/docs/configuration/sessions.md+7−8
@@ -32,7 +32,7 @@ users to re-authenticate
32
32
33### Redis Storage
33### Redis Storage
34
34
35−The Redis Storage backend stores sessions, encrypted, in redis. Instead sending all the information
35+The Redis Storage backend stores encrypted sessions in redis. Instead of sending all the information
36back the client for storage, as in the [Cookie storage](#cookie-storage), a ticket is sent back
36back the client for storage, as in the [Cookie storage](#cookie-storage), a ticket is sent back
37to the user as the cookie value instead.
37to the user as the cookie value instead.
38
38
@@ -43,16 +43,15 @@ A ticket is composed as the following:
43Where:
43Where:
44
44
45- The `CookieName` is the OAuth2 cookie name (_oauth2_proxy by default)
45- The `CookieName` is the OAuth2 cookie name (_oauth2_proxy by default)
46−- The `ticketID` is a 128 bit random number, hex-encoded
46+- The `ticketID` is a 128-bit random number, hex-encoded
47−- The `secret` is a 128 bit random number, base64url encoded (no padding). The secret is unique for every session.
47+- The `secret` is a 128-bit random number, base64url encoded (no padding). The secret is unique for every session.
48- The pair of `{CookieName}-{ticketID}` comprises a ticket handle, and thus, the redis key
48- The pair of `{CookieName}-{ticketID}` comprises a ticket handle, and thus, the redis key
49to which the session is stored. The encoded session is encrypted with the secret and stored
49to which the session is stored. The encoded session is encrypted with the secret and stored
50in redis via the `SETEX` command.
50in redis via the `SETEX` command.
51
51
52Encrypting every session uniquely protects the refresh/access/id tokens stored in the session from
52Encrypting every session uniquely protects the refresh/access/id tokens stored in the session from
53−disclosure.
54−
55−Additionally the browser only has to send a short Cookie with every request and not the whole JWT, which can get quite big.
53+disclosure. Additionally, the browser only has to send a short Cookie with every request and not the whole JWT,
54+which can get quite big.
56
55
57Two settings are used to configure the OAuth2 Proxy cookie lifetime:
56Two settings are used to configure the OAuth2 Proxy cookie lifetime:
58
57
@@ -76,8 +75,8 @@ For this reason, it's advised to set the cookie-refresh a couple of seconds less
76
75
77Recommended settings:
76Recommended settings:
78
77
79−* cookie\_refresh := Access-Token lifespan - 1m
78+* cookie_refresh := Access-Token lifespan - 1m
80−* cookie\_expire := Refresh-Token lifespan (i.e. Keycloak's client\_session\_idle)
79+* cookie_expire := Refresh-Token lifespan (i.e. Keycloak client_session_idle)
81
80
82#### Usage
81#### Usage
83
82
docs/docs/features/endpoints.md+4−4
@@ -9,7 +9,7 @@ OAuth2 Proxy responds directly to the following endpoints. All other endpoints w
9- /ping - returns a 200 OK response, which is intended for use with health checks
9- /ping - returns a 200 OK response, which is intended for use with health checks
10- /ready - returns a 200 OK response if all the underlying connections (e.g., Redis store) are connected
10- /ready - returns a 200 OK response if all the underlying connections (e.g., Redis store) are connected
11- /metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by `--metrics-address`, disabled by default
11- /metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by `--metrics-address`, disabled by default
12−- /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
12+- /oauth2/sign_in - the login page, which also doubles as a sign-out page (it clears cookies)
13- /oauth2/sign_out - this URL is used to clear the session cookie
13- /oauth2/sign_out - this URL is used to clear the session cookie
14- /oauth2/start - a URL that will redirect to start the OAuth cycle
14- /oauth2/start - a URL that will redirect to start the OAuth cycle
15- /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
15- /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
@@ -19,7 +19,7 @@ OAuth2 Proxy responds directly to the following endpoints. All other endpoints w
19
19
20### Sign out
20### Sign out
21
21
22−To sign the user out, redirect them to `/oauth2/sign_out`. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the `rd` query parameter, i.e. redirect the user to something like (notice the url-encoding!):
22+To sign the user out, redirect them to `/oauth2/sign_out`. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign-out page afterward using the `rd` query parameter, i.e. redirect the user to something like (notice the url-encoding!):
23
23
24```
24```
25/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page
25/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page
@@ -41,7 +41,7 @@ BEWARE that the domain you want to redirect to (`my-oidc-provider.example.com` i
41
41
42This endpoint returns 202 Accepted response or a 401 Unauthorized response.
42This endpoint returns 202 Accepted response or a 401 Unauthorized response.
43
43
44−It can be configured using the following query parameters query parameters:
44+It can be configured using the following query parameters:
45- `allowed_groups`: comma separated list of allowed groups
45- `allowed_groups`: comma separated list of allowed groups
46- `allowed_email_domains`: comma separated list of allowed email domains
46- `allowed_email_domains`: comma separated list of allowed email domains
47−- `allowed_emails`: comma separated list of allowed emails
47+- `allowed_emails`: comma separated list of allowed emails
docs/docs/installation.md+9−9
@@ -14,13 +14,13 @@ slug: /
14
14
15 d. Using a [Kubernetes manifest](https://github.com/oauth2-proxy/manifests) (Helm)
15 d. Using a [Kubernetes manifest](https://github.com/oauth2-proxy/manifests) (Helm)
16
16
17−Prebuilt binaries can be validated by extracting the file and verifying it against the `sha256sum.txt` checksum file provided for each release starting with version `v3.0.0`.
17+ Prebuilt binaries can be validated by extracting the file and verifying it against the `sha256sum.txt` checksum file provided for each release starting with version `v3.0.0`.
18−
18+
19−```
19+ ```
20−$ sha256sum -c sha256sum.txt
20+ $ sha256sum -c sha256sum.txt
21−oauth2-proxy-x.y.z.linux-amd64: OK
21+ oauth2-proxy-x.y.z.linux-amd64: OK
22−```
22+ ```
23−
23+
24−2. [Select a Provider and Register an OAuth Application with a Provider](configuration/auth.md)
24+2. [Select a Provider and Register an OAuth Application with a Provider](configuration/providers/index.md)
253. [Configure OAuth2 Proxy using config file, command line options, or environment variables](configuration/overview.md)
253. [Configure OAuth2 Proxy using config file, command line options, or environment variables](configuration/overview.md)
26−4. [Configure SSL or Deploy behind a SSL endpoint](configuration/tls.md) (example provided for Nginx)
26+4. [Configure SSL or Deploy behind an SSL endpoint](configuration/tls.md) (example provided for Nginx)
docs/docusaurus.config.js+3
@@ -37,6 +37,9 @@ module.exports = {
37 style: 'dark',
37 style: 'dark',
38 copyright: `Copyright © ${new Date().getFullYear()} OAuth2 Proxy.`,
38 copyright: `Copyright © ${new Date().getFullYear()} OAuth2 Proxy.`,
39 },
39 },
40+ prism: {
41+ additionalLanguages: ['hcl', 'powershell'],
42+ },
40 },
43 },
41 presets: [
44 presets: [
42 [
45 [
docs/package-lock.json+540−536
@@ -8,8 +8,8 @@
8 "name": "docusaurus",
8 "name": "docusaurus",
9 "version": "0.0.0",
9 "version": "0.0.0",
10 "dependencies": {
10 "dependencies": {
11− "@docusaurus/core": "^2.0.0-beta.15",
11+ "@docusaurus/core": "^2.4.3",
12− "@docusaurus/preset-classic": "^2.0.0-beta.15",
12+ "@docusaurus/preset-classic": "^2.4.3",
13 "@easyops-cn/docusaurus-search-local": "^0.29.0",
13 "@easyops-cn/docusaurus-search-local": "^0.29.0",
14 "@mdx-js/react": "^1.6.22",
14 "@mdx-js/react": "^1.6.22",
15 "clsx": "^1.1.1",
15 "clsx": "^1.1.1",
@@ -59,74 +59,74 @@
59 }
59 }
60 },
60 },
61 "node_modules/@algolia/cache-browser-local-storage": {
61 "node_modules/@algolia/cache-browser-local-storage": {
62− "version": "4.19.1",
62+ "version": "4.20.0",
63− "resolved": "https://registry.npmjs.org/@algolia/cache-browser-local-storage/-/cache-browser-local-storage-4.19.1.tgz",
63+ "resolved": "https://registry.npmjs.org/@algolia/cache-browser-local-storage/-/cache-browser-local-storage-4.20.0.tgz",
64− "integrity": "sha512-FYAZWcGsFTTaSAwj9Std8UML3Bu8dyWDncM7Ls8g+58UOe4XYdlgzXWbrIgjaguP63pCCbMoExKr61B+ztK3tw==",
64+ "integrity": "sha512-uujahcBt4DxduBTvYdwO3sBfHuJvJokiC3BP1+O70fglmE1ShkH8lpXqZBac1rrU3FnNYSUs4pL9lBdTKeRPOQ==",
65 "dependencies": {
65 "dependencies": {
66− "@algolia/cache-common": "4.19.1"
66+ "@algolia/cache-common": "4.20.0"
67 }
67 }
68 },
68 },
69 "node_modules/@algolia/cache-common": {
69 "node_modules/@algolia/cache-common": {
70− "version": "4.19.1",
70+ "version": "4.20.0",
71− "resolved": "https://registry.npmjs.org/@algolia/cache-common/-/cache-common-4.19.1.tgz",
71+ "resolved": "https://registry.npmjs.org/@algolia/cache-common/-/cache-common-4.20.0.tgz",
72− "integrity": "sha512-XGghi3l0qA38HiqdoUY+wvGyBsGvKZ6U3vTiMBT4hArhP3fOGLXpIINgMiiGjTe4FVlTa5a/7Zf2bwlIHfRqqg=="
72+ "integrity": "sha512-vCfxauaZutL3NImzB2G9LjLt36vKAckc6DhMp05An14kVo8F1Yofb6SIl6U3SaEz8pG2QOB9ptwM5c+zGevwIQ=="
73 },
73 },
74 "node_modules/@algolia/cache-in-memory": {
74 "node_modules/@algolia/cache-in-memory": {
75− "version": "4.19.1",
75+ "version": "4.20.0",
76− "resolved": "https://registry.npmjs.org/@algolia/cache-in-memory/-/cache-in-memory-4.19.1.tgz",
76+ "resolved": "https://registry.npmjs.org/@algolia/cache-in-memory/-/cache-in-memory-4.20.0.tgz",
77− "integrity": "sha512-+PDWL+XALGvIginigzu8oU6eWw+o76Z8zHbBovWYcrtWOEtinbl7a7UTt3x3lthv+wNuFr/YD1Gf+B+A9V8n5w==",
77+ "integrity": "sha512-Wm9ak/IaacAZXS4mB3+qF/KCoVSBV6aLgIGFEtQtJwjv64g4ePMapORGmCyulCFwfePaRAtcaTbMcJF+voc/bg==",
78 "dependencies": {
78 "dependencies": {
79− "@algolia/cache-common": "4.19.1"
79+ "@algolia/cache-common": "4.20.0"
80 }
80 }
81 },
81 },
82 "node_modules/@algolia/client-account": {
82 "node_modules/@algolia/client-account": {
83− "version": "4.19.1",
83+ "version": "4.20.0",
84− "resolved": "https://registry.npmjs.org/@algolia/client-account/-/client-account-4.19.1.tgz",
84+ "resolved": "https://registry.npmjs.org/@algolia/client-account/-/client-account-4.20.0.tgz",
85− "integrity": "sha512-Oy0ritA2k7AMxQ2JwNpfaEcgXEDgeyKu0V7E7xt/ZJRdXfEpZcwp9TOg4TJHC7Ia62gIeT2Y/ynzsxccPw92GA==",
85+ "integrity": "sha512-GGToLQvrwo7am4zVkZTnKa72pheQeez/16sURDWm7Seyz+HUxKi3BM6fthVVPUEBhtJ0reyVtuK9ArmnaKl10Q==",
86 "dependencies": {
86 "dependencies": {
87− "@algolia/client-common": "4.19.1",
87+ "@algolia/client-common": "4.20.0",
88− "@algolia/client-search": "4.19.1",
88+ "@algolia/client-search": "4.20.0",
89− "@algolia/transporter": "4.19.1"
89+ "@algolia/transporter": "4.20.0"
90 }
90 }
91 },
91 },
92 "node_modules/@algolia/client-analytics": {
92 "node_modules/@algolia/client-analytics": {
93− "version": "4.19.1",
93+ "version": "4.20.0",
94− "resolved": "https://registry.npmjs.org/@algolia/client-analytics/-/client-analytics-4.19.1.tgz",
94+ "resolved": "https://registry.npmjs.org/@algolia/client-analytics/-/client-analytics-4.20.0.tgz",
95− "integrity": "sha512-5QCq2zmgdZLIQhHqwl55ZvKVpLM3DNWjFI4T+bHr3rGu23ew2bLO4YtyxaZeChmDb85jUdPDouDlCumGfk6wOg==",
95+ "integrity": "sha512-EIr+PdFMOallRdBTHHdKI3CstslgLORQG7844Mq84ib5oVFRVASuuPmG4bXBgiDbcsMLUeOC6zRVJhv1KWI0ug==",
96 "dependencies": {
96 "dependencies": {
97− "@algolia/client-common": "4.19.1",
97+ "@algolia/client-common": "4.20.0",
98− "@algolia/client-search": "4.19.1",
98+ "@algolia/client-search": "4.20.0",
99− "@algolia/requester-common": "4.19.1",
99+ "@algolia/requester-common": "4.20.0",
100− "@algolia/transporter": "4.19.1"
100+ "@algolia/transporter": "4.20.0"
101 }
101 }
102 },
102 },
103 "node_modules/@algolia/client-common": {
103 "node_modules/@algolia/client-common": {
104− "version": "4.19.1",
104+ "version": "4.20.0",
105− "resolved": "https://registry.npmjs.org/@algolia/client-common/-/client-common-4.19.1.tgz",
105+ "resolved": "https://registry.npmjs.org/@algolia/client-common/-/client-common-4.20.0.tgz",
106− "integrity": "sha512-3kAIVqTcPrjfS389KQvKzliC559x+BDRxtWamVJt8IVp7LGnjq+aVAXg4Xogkur1MUrScTZ59/AaUd5EdpyXgA==",
106+ "integrity": "sha512-P3WgMdEss915p+knMMSd/fwiHRHKvDu4DYRrCRaBrsfFw7EQHon+EbRSm4QisS9NYdxbS04kcvNoavVGthyfqQ==",
107 "dependencies": {
107 "dependencies": {
108− "@algolia/requester-common": "4.19.1",
108+ "@algolia/requester-common": "4.20.0",
109− "@algolia/transporter": "4.19.1"
109+ "@algolia/transporter": "4.20.0"
110 }
110 }
111 },
111 },
112 "node_modules/@algolia/client-personalization": {
112 "node_modules/@algolia/client-personalization": {
113− "version": "4.19.1",
113+ "version": "4.20.0",
114− "resolved": "https://registry.npmjs.org/@algolia/client-personalization/-/client-personalization-4.19.1.tgz",
114+ "resolved": "https://registry.npmjs.org/@algolia/client-personalization/-/client-personalization-4.20.0.tgz",
115− "integrity": "sha512-8CWz4/H5FA+krm9HMw2HUQenizC/DxUtsI5oYC0Jxxyce1vsr8cb1aEiSJArQT6IzMynrERif1RVWLac1m36xw==",
115+ "integrity": "sha512-N9+zx0tWOQsLc3K4PVRDV8GUeOLAY0i445En79Pr3zWB+m67V+n/8w4Kw1C5LlbHDDJcyhMMIlqezh6BEk7xAQ==",
116 "dependencies": {
116 "dependencies": {
117− "@algolia/client-common": "4.19.1",
117+ "@algolia/client-common": "4.20.0",
118− "@algolia/requester-common": "4.19.1",
118+ "@algolia/requester-common": "4.20.0",
119− "@algolia/transporter": "4.19.1"
119+ "@algolia/transporter": "4.20.0"
120 }
120 }
121 },
121 },
122 "node_modules/@algolia/client-search": {
122 "node_modules/@algolia/client-search": {
123− "version": "4.19.1",
123+ "version": "4.20.0",
124− "resolved": "https://registry.npmjs.org/@algolia/client-search/-/client-search-4.19.1.tgz",
124+ "resolved": "https://registry.npmjs.org/@algolia/client-search/-/client-search-4.20.0.tgz",
125− "integrity": "sha512-mBecfMFS4N+yK/p0ZbK53vrZbL6OtWMk8YmnOv1i0LXx4pelY8TFhqKoTit3NPVPwoSNN0vdSN9dTu1xr1XOVw==",
125+ "integrity": "sha512-zgwqnMvhWLdpzKTpd3sGmMlr4c+iS7eyyLGiaO51zDZWGMkpgoNVmltkzdBwxOVXz0RsFMznIxB9zuarUv4TZg==",
126 "dependencies": {
126 "dependencies": {
127− "@algolia/client-common": "4.19.1",
127+ "@algolia/client-common": "4.20.0",
128− "@algolia/requester-common": "4.19.1",
128+ "@algolia/requester-common": "4.20.0",
129− "@algolia/transporter": "4.19.1"
129+ "@algolia/transporter": "4.20.0"
130 }
130 }
131 },
131 },
132 "node_modules/@algolia/events": {
132 "node_modules/@algolia/events": {
@@ -135,47 +135,47 @@
135 "integrity": "sha512-FQzvOCgoFXAbf5Y6mYozw2aj5KCJoA3m4heImceldzPSMbdyS4atVjJzXKMsfX3wnZTFYwkkt8/z8UesLHlSBQ=="
135 "integrity": "sha512-FQzvOCgoFXAbf5Y6mYozw2aj5KCJoA3m4heImceldzPSMbdyS4atVjJzXKMsfX3wnZTFYwkkt8/z8UesLHlSBQ=="
136 },
136 },
137 "node_modules/@algolia/logger-common": {
137 "node_modules/@algolia/logger-common": {
138− "version": "4.19.1",
138+ "version": "4.20.0",
139− "resolved": "https://registry.npmjs.org/@algolia/logger-common/-/logger-common-4.19.1.tgz",
139+ "resolved": "https://registry.npmjs.org/@algolia/logger-common/-/logger-common-4.20.0.tgz",
140− "integrity": "sha512-i6pLPZW/+/YXKis8gpmSiNk1lOmYCmRI6+x6d2Qk1OdfvX051nRVdalRbEcVTpSQX6FQAoyeaui0cUfLYW5Elw=="
140+ "integrity": "sha512-xouigCMB5WJYEwvoWW5XDv7Z9f0A8VoXJc3VKwlHJw/je+3p2RcDXfksLI4G4lIVncFUYMZx30tP/rsdlvvzHQ=="
141 },
141 },
142 "node_modules/@algolia/logger-console": {
142 "node_modules/@algolia/logger-console": {
143− "version": "4.19.1",
143+ "version": "4.20.0",
144− "resolved": "https://registry.npmjs.org/@algolia/logger-console/-/logger-console-4.19.1.tgz",
144+ "resolved": "https://registry.npmjs.org/@algolia/logger-console/-/logger-console-4.20.0.tgz",
145− "integrity": "sha512-jj72k9GKb9W0c7TyC3cuZtTr0CngLBLmc8trzZlXdfvQiigpUdvTi1KoWIb2ZMcRBG7Tl8hSb81zEY3zI2RlXg==",
145+ "integrity": "sha512-THlIGG1g/FS63z0StQqDhT6bprUczBI8wnLT3JWvfAQDZX5P6fCg7dG+pIrUBpDIHGszgkqYEqECaKKsdNKOUA==",
146 "dependencies": {
146 "dependencies": {
147− "@algolia/logger-common": "4.19.1"
147+ "@algolia/logger-common": "4.20.0"
148 }
148 }
149 },
149 },
150 "node_modules/@algolia/requester-browser-xhr": {
150 "node_modules/@algolia/requester-browser-xhr": {
151− "version": "4.19.1",
151+ "version": "4.20.0",
152− "resolved": "https://registry.npmjs.org/@algolia/requester-browser-xhr/-/requester-browser-xhr-4.19.1.tgz",
152+ "resolved": "https://registry.npmjs.org/@algolia/requester-browser-xhr/-/requester-browser-xhr-4.20.0.tgz",
153− "integrity": "sha512-09K/+t7lptsweRTueHnSnmPqIxbHMowejAkn9XIcJMLdseS3zl8ObnS5GWea86mu3vy4+8H+ZBKkUN82Zsq/zg==",
153+ "integrity": "sha512-HbzoSjcjuUmYOkcHECkVTwAelmvTlgs48N6Owt4FnTOQdwn0b8pdht9eMgishvk8+F8bal354nhx/xOoTfwiAw==",
154 "dependencies": {
154 "dependencies": {
155− "@algolia/requester-common": "4.19.1"
155+ "@algolia/requester-common": "4.20.0"
156 }
156 }
157 },
157 },
158 "node_modules/@algolia/requester-common": {
158 "node_modules/@algolia/requester-common": {
159− "version": "4.19.1",
159+ "version": "4.20.0",
160− "resolved": "https://registry.npmjs.org/@algolia/requester-common/-/requester-common-4.19.1.tgz",
160+ "resolved": "https://registry.npmjs.org/@algolia/requester-common/-/requester-common-4.20.0.tgz",
161− "integrity": "sha512-BisRkcWVxrDzF1YPhAckmi2CFYK+jdMT60q10d7z3PX+w6fPPukxHRnZwooiTUrzFe50UBmLItGizWHP5bDzVQ=="
161+ "integrity": "sha512-9h6ye6RY/BkfmeJp7Z8gyyeMrmmWsMOCRBXQDs4mZKKsyVlfIVICpcSibbeYcuUdurLhIlrOUkH3rQEgZzonng=="
162 },
162 },
163 "node_modules/@algolia/requester-node-http": {
163 "node_modules/@algolia/requester-node-http": {
164− "version": "4.19.1",
164+ "version": "4.20.0",
165− "resolved": "https://registry.npmjs.org/@algolia/requester-node-http/-/requester-node-http-4.19.1.tgz",
165+ "resolved": "https://registry.npmjs.org/@algolia/requester-node-http/-/requester-node-http-4.20.0.tgz",
166− "integrity": "sha512-6DK52DHviBHTG2BK/Vv2GIlEw7i+vxm7ypZW0Z7vybGCNDeWzADx+/TmxjkES2h15+FZOqVf/Ja677gePsVItA==",
166+ "integrity": "sha512-ocJ66L60ABSSTRFnCHIEZpNHv6qTxsBwJEPfYaSBsLQodm0F9ptvalFkHMpvj5DfE22oZrcrLbOYM2bdPJRHng==",
167 "dependencies": {
167 "dependencies": {
168− "@algolia/requester-common": "4.19.1"
168+ "@algolia/requester-common": "4.20.0"
169 }
169 }
170 },
170 },
171 "node_modules/@algolia/transporter": {
171 "node_modules/@algolia/transporter": {
172− "version": "4.19.1",
172+ "version": "4.20.0",
173− "resolved": "https://registry.npmjs.org/@algolia/transporter/-/transporter-4.19.1.tgz",
173+ "resolved": "https://registry.npmjs.org/@algolia/transporter/-/transporter-4.20.0.tgz",
174− "integrity": "sha512-nkpvPWbpuzxo1flEYqNIbGz7xhfhGOKGAZS7tzC+TELgEmi7z99qRyTfNSUlW7LZmB3ACdnqAo+9A9KFBENviQ==",
174+ "integrity": "sha512-Lsii1pGWOAISbzeyuf+r/GPhvHMPHSPrTDWNcIzOE1SG1inlJHICaVe2ikuoRjcpgxZNU54Jl+if15SUCsaTUg==",
175 "dependencies": {
175 "dependencies": {
176− "@algolia/cache-common": "4.19.1",
176+ "@algolia/cache-common": "4.20.0",
177− "@algolia/logger-common": "4.19.1",
177+ "@algolia/logger-common": "4.20.0",
178− "@algolia/requester-common": "4.19.1"
178+ "@algolia/requester-common": "4.20.0"
179 }
179 }
180 },
180 },
181 "node_modules/@ampproject/remapping": {
181 "node_modules/@ampproject/remapping": {
@@ -2159,9 +2159,9 @@
2159 }
2159 }
2160 },
2160 },
2161 "node_modules/@docusaurus/core": {
2161 "node_modules/@docusaurus/core": {
2162− "version": "2.4.1",
2162+ "version": "2.4.3",
2163− "resolved": "https://registry.npmjs.org/@docusaurus/core/-/core-2.4.1.tgz",
2163+ "resolved": "https://registry.npmjs.org/@docusaurus/core/-/core-2.4.3.tgz",
2164− "integrity": "sha512-SNsY7PshK3Ri7vtsLXVeAJGS50nJN3RgF836zkyUfAD01Fq+sAk5EwWgLw+nnm5KVNGDu7PRR2kRGDsWvqpo0g==",
2164+ "integrity": "sha512-dWH5P7cgeNSIg9ufReX6gaCl/TmrGKD38Orbwuz05WPhAQtFXHd5B8Qym1TiXfvUNvwoYKkAJOJuGe8ou0Z7PA==",
2165 "dependencies": {
2165 "dependencies": {
2166 "@babel/core": "^7.18.6",
2166 "@babel/core": "^7.18.6",
2167 "@babel/generator": "^7.18.7",
2167 "@babel/generator": "^7.18.7",
@@ -2173,13 +2173,13 @@
2173 "@babel/runtime": "^7.18.6",
2173 "@babel/runtime": "^7.18.6",
2174 "@babel/runtime-corejs3": "^7.18.6",
2174 "@babel/runtime-corejs3": "^7.18.6",
2175 "@babel/traverse": "^7.18.8",
2175 "@babel/traverse": "^7.18.8",
2176− "@docusaurus/cssnano-preset": "2.4.1",
2176+ "@docusaurus/cssnano-preset": "2.4.3",
2177− "@docusaurus/logger": "2.4.1",
2177+ "@docusaurus/logger": "2.4.3",
2178− "@docusaurus/mdx-loader": "2.4.1",
2178+ "@docusaurus/mdx-loader": "2.4.3",
2179 "@docusaurus/react-loadable": "5.5.2",
2179 "@docusaurus/react-loadable": "5.5.2",
2180− "@docusaurus/utils": "2.4.1",
2180+ "@docusaurus/utils": "2.4.3",
2181− "@docusaurus/utils-common": "2.4.1",
2181+ "@docusaurus/utils-common": "2.4.3",
2182− "@docusaurus/utils-validation": "2.4.1",
2182+ "@docusaurus/utils-validation": "2.4.3",
2183 "@slorber/static-site-generator-webpack-plugin": "^4.0.7",
2183 "@slorber/static-site-generator-webpack-plugin": "^4.0.7",
2184 "@svgr/webpack": "^6.2.1",
2184 "@svgr/webpack": "^6.2.1",
2185 "autoprefixer": "^10.4.7",
2185 "autoprefixer": "^10.4.7",
@@ -2382,9 +2382,9 @@
2382 }
2382 }
2383 },
2383 },
2384 "node_modules/@docusaurus/cssnano-preset": {
2384 "node_modules/@docusaurus/cssnano-preset": {
2385− "version": "2.4.1",
2385+ "version": "2.4.3",
2386− "resolved": "https://registry.npmjs.org/@docusaurus/cssnano-preset/-/cssnano-preset-2.4.1.tgz",
2386+ "resolved": "https://registry.npmjs.org/@docusaurus/cssnano-preset/-/cssnano-preset-2.4.3.tgz",
2387− "integrity": "sha512-ka+vqXwtcW1NbXxWsh6yA1Ckii1klY9E53cJ4O9J09nkMBgrNX3iEFED1fWdv8wf4mJjvGi5RLZ2p9hJNjsLyQ==",
2387+ "integrity": "sha512-ZvGSRCi7z9wLnZrXNPG6DmVPHdKGd8dIn9pYbEOFiYihfv4uDR3UtxogmKf+rT8ZlKFf5Lqne8E8nt08zNM8CA==",
2388 "dependencies": {
2388 "dependencies": {
2389 "cssnano-preset-advanced": "^5.3.8",
2389 "cssnano-preset-advanced": "^5.3.8",
2390 "postcss": "^8.4.14",
2390 "postcss": "^8.4.14",
@@ -2401,9 +2401,9 @@
2401 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2401 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2402 },
2402 },
2403 "node_modules/@docusaurus/logger": {
2403 "node_modules/@docusaurus/logger": {
2404− "version": "2.4.1",
2404+ "version": "2.4.3",
2405− "resolved": "https://registry.npmjs.org/@docusaurus/logger/-/logger-2.4.1.tgz",
2405+ "resolved": "https://registry.npmjs.org/@docusaurus/logger/-/logger-2.4.3.tgz",
2406− "integrity": "sha512-5h5ysIIWYIDHyTVd8BjheZmQZmEgWDR54aQ1BX9pjFfpyzFo5puKXKYrYJXbjEHGyVhEzmB9UXwbxGfaZhOjcg==",
2406+ "integrity": "sha512-Zxws7r3yLufk9xM1zq9ged0YHs65mlRmtsobnFkdZTxWXdTYlWWLWdKyNKAsVC+D7zg+pv2fGbyabdOnyZOM3w==",
2407 "dependencies": {
2407 "dependencies": {
2408 "chalk": "^4.1.2",
2408 "chalk": "^4.1.2",
2409 "tslib": "^2.4.0"
2409 "tslib": "^2.4.0"
@@ -2418,14 +2418,14 @@
2418 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2418 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2419 },
2419 },
2420 "node_modules/@docusaurus/mdx-loader": {
2420 "node_modules/@docusaurus/mdx-loader": {
2421− "version": "2.4.1",
2421+ "version": "2.4.3",
2422− "resolved": "https://registry.npmjs.org/@docusaurus/mdx-loader/-/mdx-loader-2.4.1.tgz",
2422+ "resolved": "https://registry.npmjs.org/@docusaurus/mdx-loader/-/mdx-loader-2.4.3.tgz",
2423− "integrity": "sha512-4KhUhEavteIAmbBj7LVFnrVYDiU51H5YWW1zY6SmBSte/YLhDutztLTBE0PQl1Grux1jzUJeaSvAzHpTn6JJDQ==",
2423+ "integrity": "sha512-b1+fDnWtl3GiqkL0BRjYtc94FZrcDDBV1j8446+4tptB9BAOlePwG2p/pK6vGvfL53lkOsszXMghr2g67M0vCw==",
2424 "dependencies": {
2424 "dependencies": {
2425 "@babel/parser": "^7.18.8",
2425 "@babel/parser": "^7.18.8",
2426 "@babel/traverse": "^7.18.8",
2426 "@babel/traverse": "^7.18.8",
2427− "@docusaurus/logger": "2.4.1",
2427+ "@docusaurus/logger": "2.4.3",
2428− "@docusaurus/utils": "2.4.1",
2428+ "@docusaurus/utils": "2.4.3",
2429 "@mdx-js/mdx": "^1.6.22",
2429 "@mdx-js/mdx": "^1.6.22",
2430 "escape-html": "^1.0.3",
2430 "escape-html": "^1.0.3",
2431 "file-loader": "^6.2.0",
2431 "file-loader": "^6.2.0",
@@ -2454,12 +2454,12 @@
2454 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2454 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2455 },
2455 },
2456 "node_modules/@docusaurus/module-type-aliases": {
2456 "node_modules/@docusaurus/module-type-aliases": {
2457− "version": "2.4.1",
2457+ "version": "2.4.3",
2458− "resolved": "https://registry.npmjs.org/@docusaurus/module-type-aliases/-/module-type-aliases-2.4.1.tgz",
2458+ "resolved": "https://registry.npmjs.org/@docusaurus/module-type-aliases/-/module-type-aliases-2.4.3.tgz",
2459− "integrity": "sha512-gLBuIFM8Dp2XOCWffUDSjtxY7jQgKvYujt7Mx5s4FCTfoL5dN1EVbnrn+O2Wvh8b0a77D57qoIDY7ghgmatR1A==",
2459+ "integrity": "sha512-cwkBkt1UCiduuvEAo7XZY01dJfRn7UR/75mBgOdb1hKknhrabJZ8YH+7savd/y9kLExPyrhe0QwdS9GuzsRRIA==",
2460 "dependencies": {
2460 "dependencies": {
2461 "@docusaurus/react-loadable": "5.5.2",
2461 "@docusaurus/react-loadable": "5.5.2",
2462− "@docusaurus/types": "2.4.1",
2462+ "@docusaurus/types": "2.4.3",
2463 "@types/history": "^4.7.11",
2463 "@types/history": "^4.7.11",
2464 "@types/react": "*",
2464 "@types/react": "*",
2465 "@types/react-router-config": "*",
2465 "@types/react-router-config": "*",
@@ -2473,17 +2473,17 @@
2473 }
2473 }
2474 },
2474 },
2475 "node_modules/@docusaurus/plugin-content-blog": {
2475 "node_modules/@docusaurus/plugin-content-blog": {
2476− "version": "2.4.1",
2476+ "version": "2.4.3",
2477− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-content-blog/-/plugin-content-blog-2.4.1.tgz",
2477+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-content-blog/-/plugin-content-blog-2.4.3.tgz",
2478− "integrity": "sha512-E2i7Knz5YIbE1XELI6RlTnZnGgS52cUO4BlCiCUCvQHbR+s1xeIWz4C6BtaVnlug0Ccz7nFSksfwDpVlkujg5Q==",
2478+ "integrity": "sha512-PVhypqaA0t98zVDpOeTqWUTvRqCEjJubtfFUQ7zJNYdbYTbS/E/ytq6zbLVsN/dImvemtO/5JQgjLxsh8XLo8Q==",
2479− "dependencies": {
2479+ "dependencies": {
2480− "@docusaurus/core": "2.4.1",
2480+ "@docusaurus/core": "2.4.3",
2481− "@docusaurus/logger": "2.4.1",
2481+ "@docusaurus/logger": "2.4.3",
2482− "@docusaurus/mdx-loader": "2.4.1",
2482+ "@docusaurus/mdx-loader": "2.4.3",
2483− "@docusaurus/types": "2.4.1",
2483+ "@docusaurus/types": "2.4.3",
2484− "@docusaurus/utils": "2.4.1",
2484+ "@docusaurus/utils": "2.4.3",
2485− "@docusaurus/utils-common": "2.4.1",
2485+ "@docusaurus/utils-common": "2.4.3",
2486− "@docusaurus/utils-validation": "2.4.1",
2486+ "@docusaurus/utils-validation": "2.4.3",
2487 "cheerio": "^1.0.0-rc.12",
2487 "cheerio": "^1.0.0-rc.12",
2488 "feed": "^4.2.2",
2488 "feed": "^4.2.2",
2489 "fs-extra": "^10.1.0",
2489 "fs-extra": "^10.1.0",
@@ -2508,17 +2508,17 @@
2508 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2508 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2509 },
2509 },
2510 "node_modules/@docusaurus/plugin-content-docs": {
2510 "node_modules/@docusaurus/plugin-content-docs": {
2511− "version": "2.4.1",
2511+ "version": "2.4.3",
2512− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-content-docs/-/plugin-content-docs-2.4.1.tgz",
2512+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-content-docs/-/plugin-content-docs-2.4.3.tgz",
2513− "integrity": "sha512-Lo7lSIcpswa2Kv4HEeUcGYqaasMUQNpjTXpV0N8G6jXgZaQurqp7E8NGYeGbDXnb48czmHWbzDL4S3+BbK0VzA==",
2513+ "integrity": "sha512-N7Po2LSH6UejQhzTCsvuX5NOzlC+HiXOVvofnEPj0WhMu1etpLEXE6a4aTxrtg95lQ5kf0xUIdjX9sh3d3G76A==",
2514− "dependencies": {
2514+ "dependencies": {
2515− "@docusaurus/core": "2.4.1",
2515+ "@docusaurus/core": "2.4.3",
2516− "@docusaurus/logger": "2.4.1",
2516+ "@docusaurus/logger": "2.4.3",
2517− "@docusaurus/mdx-loader": "2.4.1",
2517+ "@docusaurus/mdx-loader": "2.4.3",
2518− "@docusaurus/module-type-aliases": "2.4.1",
2518+ "@docusaurus/module-type-aliases": "2.4.3",
2519− "@docusaurus/types": "2.4.1",
2519+ "@docusaurus/types": "2.4.3",
2520− "@docusaurus/utils": "2.4.1",
2520+ "@docusaurus/utils": "2.4.3",
2521− "@docusaurus/utils-validation": "2.4.1",
2521+ "@docusaurus/utils-validation": "2.4.3",
2522 "@types/react-router-config": "^5.0.6",
2522 "@types/react-router-config": "^5.0.6",
2523 "combine-promises": "^1.1.0",
2523 "combine-promises": "^1.1.0",
2524 "fs-extra": "^10.1.0",
2524 "fs-extra": "^10.1.0",
@@ -2543,15 +2543,15 @@
2543 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2543 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2544 },
2544 },
2545 "node_modules/@docusaurus/plugin-content-pages": {
2545 "node_modules/@docusaurus/plugin-content-pages": {
2546− "version": "2.4.1",
2546+ "version": "2.4.3",
2547− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-content-pages/-/plugin-content-pages-2.4.1.tgz",
2547+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-content-pages/-/plugin-content-pages-2.4.3.tgz",
2548− "integrity": "sha512-/UjuH/76KLaUlL+o1OvyORynv6FURzjurSjvn2lbWTFc4tpYY2qLYTlKpTCBVPhlLUQsfyFnshEJDLmPneq2oA==",
2548+ "integrity": "sha512-txtDVz7y3zGk67q0HjG0gRttVPodkHqE0bpJ+7dOaTH40CQFLSh7+aBeGnPOTl+oCPG+hxkim4SndqPqXjQ8Bg==",
2549− "dependencies": {
2549+ "dependencies": {
2550− "@docusaurus/core": "2.4.1",
2550+ "@docusaurus/core": "2.4.3",
2551− "@docusaurus/mdx-loader": "2.4.1",
2551+ "@docusaurus/mdx-loader": "2.4.3",
2552− "@docusaurus/types": "2.4.1",
2552+ "@docusaurus/types": "2.4.3",
2553− "@docusaurus/utils": "2.4.1",
2553+ "@docusaurus/utils": "2.4.3",
2554− "@docusaurus/utils-validation": "2.4.1",
2554+ "@docusaurus/utils-validation": "2.4.3",
2555 "fs-extra": "^10.1.0",
2555 "fs-extra": "^10.1.0",
2556 "tslib": "^2.4.0",
2556 "tslib": "^2.4.0",
2557 "webpack": "^5.73.0"
2557 "webpack": "^5.73.0"
@@ -2570,13 +2570,13 @@
2570 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2570 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2571 },
2571 },
2572 "node_modules/@docusaurus/plugin-debug": {
2572 "node_modules/@docusaurus/plugin-debug": {
2573− "version": "2.4.1",
2573+ "version": "2.4.3",
2574− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-debug/-/plugin-debug-2.4.1.tgz",
2574+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-debug/-/plugin-debug-2.4.3.tgz",
2575− "integrity": "sha512-7Yu9UPzRShlrH/G8btOpR0e6INFZr0EegWplMjOqelIwAcx3PKyR8mgPTxGTxcqiYj6hxSCRN0D8R7YrzImwNA==",
2575+ "integrity": "sha512-LkUbuq3zCmINlFb+gAd4ZvYr+bPAzMC0hwND4F7V9bZ852dCX8YoWyovVUBKq4er1XsOwSQaHmNGtObtn8Av8Q==",
2576 "dependencies": {
2576 "dependencies": {
2577− "@docusaurus/core": "2.4.1",
2577+ "@docusaurus/core": "2.4.3",
2578− "@docusaurus/types": "2.4.1",
2578+ "@docusaurus/types": "2.4.3",
2579− "@docusaurus/utils": "2.4.1",
2579+ "@docusaurus/utils": "2.4.3",
2580 "fs-extra": "^10.1.0",
2580 "fs-extra": "^10.1.0",
2581 "react-json-view": "^1.21.3",
2581 "react-json-view": "^1.21.3",
2582 "tslib": "^2.4.0"
2582 "tslib": "^2.4.0"
@@ -2595,13 +2595,13 @@
2595 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2595 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2596 },
2596 },
2597 "node_modules/@docusaurus/plugin-google-analytics": {
2597 "node_modules/@docusaurus/plugin-google-analytics": {
2598− "version": "2.4.1",
2598+ "version": "2.4.3",
2599− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-google-analytics/-/plugin-google-analytics-2.4.1.tgz",
2599+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-google-analytics/-/plugin-google-analytics-2.4.3.tgz",
2600− "integrity": "sha512-dyZJdJiCoL+rcfnm0RPkLt/o732HvLiEwmtoNzOoz9MSZz117UH2J6U2vUDtzUzwtFLIf32KkeyzisbwUCgcaQ==",
2600+ "integrity": "sha512-KzBV3k8lDkWOhg/oYGxlK5o9bOwX7KpPc/FTWoB+SfKhlHfhq7qcQdMi1elAaVEIop8tgK6gD1E58Q+XC6otSQ==",
2601 "dependencies": {
2601 "dependencies": {
2602− "@docusaurus/core": "2.4.1",
2602+ "@docusaurus/core": "2.4.3",
2603− "@docusaurus/types": "2.4.1",
2603+ "@docusaurus/types": "2.4.3",
2604− "@docusaurus/utils-validation": "2.4.1",
2604+ "@docusaurus/utils-validation": "2.4.3",
2605 "tslib": "^2.4.0"
2605 "tslib": "^2.4.0"
2606 },
2606 },
2607 "engines": {
2607 "engines": {
@@ -2618,13 +2618,13 @@
2618 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2618 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2619 },
2619 },
2620 "node_modules/@docusaurus/plugin-google-gtag": {
2620 "node_modules/@docusaurus/plugin-google-gtag": {
2621− "version": "2.4.1",
2621+ "version": "2.4.3",
2622− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-google-gtag/-/plugin-google-gtag-2.4.1.tgz",
2622+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-google-gtag/-/plugin-google-gtag-2.4.3.tgz",
2623− "integrity": "sha512-mKIefK+2kGTQBYvloNEKtDmnRD7bxHLsBcxgnbt4oZwzi2nxCGjPX6+9SQO2KCN5HZbNrYmGo5GJfMgoRvy6uA==",
2623+ "integrity": "sha512-5FMg0rT7sDy4i9AGsvJC71MQrqQZwgLNdDetLEGDHLfSHLvJhQbTCUGbGXknUgWXQJckcV/AILYeJy+HhxeIFA==",
2624 "dependencies": {
2624 "dependencies": {
2625− "@docusaurus/core": "2.4.1",
2625+ "@docusaurus/core": "2.4.3",
2626− "@docusaurus/types": "2.4.1",
2626+ "@docusaurus/types": "2.4.3",
2627− "@docusaurus/utils-validation": "2.4.1",
2627+ "@docusaurus/utils-validation": "2.4.3",
2628 "tslib": "^2.4.0"
2628 "tslib": "^2.4.0"
2629 },
2629 },
2630 "engines": {
2630 "engines": {
@@ -2641,13 +2641,13 @@
2641 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2641 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2642 },
2642 },
2643 "node_modules/@docusaurus/plugin-google-tag-manager": {
2643 "node_modules/@docusaurus/plugin-google-tag-manager": {
2644− "version": "2.4.1",
2644+ "version": "2.4.3",
2645− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-google-tag-manager/-/plugin-google-tag-manager-2.4.1.tgz",
2645+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-google-tag-manager/-/plugin-google-tag-manager-2.4.3.tgz",
2646− "integrity": "sha512-Zg4Ii9CMOLfpeV2nG74lVTWNtisFaH9QNtEw48R5QE1KIwDBdTVaiSA18G1EujZjrzJJzXN79VhINSbOJO/r3g==",
2646+ "integrity": "sha512-1jTzp71yDGuQiX9Bi0pVp3alArV0LSnHXempvQTxwCGAEzUWWaBg4d8pocAlTpbP9aULQQqhgzrs8hgTRPOM0A==",
2647 "dependencies": {
2647 "dependencies": {
2648− "@docusaurus/core": "2.4.1",
2648+ "@docusaurus/core": "2.4.3",
2649− "@docusaurus/types": "2.4.1",
2649+ "@docusaurus/types": "2.4.3",
2650− "@docusaurus/utils-validation": "2.4.1",
2650+ "@docusaurus/utils-validation": "2.4.3",
2651 "tslib": "^2.4.0"
2651 "tslib": "^2.4.0"
2652 },
2652 },
2653 "engines": {
2653 "engines": {
@@ -2664,16 +2664,16 @@
2664 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2664 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2665 },
2665 },
2666 "node_modules/@docusaurus/plugin-sitemap": {
2666 "node_modules/@docusaurus/plugin-sitemap": {
2667− "version": "2.4.1",
2667+ "version": "2.4.3",
2668− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-sitemap/-/plugin-sitemap-2.4.1.tgz",
2668+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-sitemap/-/plugin-sitemap-2.4.3.tgz",
2669− "integrity": "sha512-lZx+ijt/+atQ3FVE8FOHV/+X3kuok688OydDXrqKRJyXBJZKgGjA2Qa8RjQ4f27V2woaXhtnyrdPop/+OjVMRg==",
2669+ "integrity": "sha512-LRQYrK1oH1rNfr4YvWBmRzTL0LN9UAPxBbghgeFRBm5yloF6P+zv1tm2pe2hQTX/QP5bSKdnajCvfnScgKXMZQ==",
2670− "dependencies": {
2670+ "dependencies": {
2671− "@docusaurus/core": "2.4.1",
2671+ "@docusaurus/core": "2.4.3",
2672− "@docusaurus/logger": "2.4.1",
2672+ "@docusaurus/logger": "2.4.3",
2673− "@docusaurus/types": "2.4.1",
2673+ "@docusaurus/types": "2.4.3",
2674− "@docusaurus/utils": "2.4.1",
2674+ "@docusaurus/utils": "2.4.3",
2675− "@docusaurus/utils-common": "2.4.1",
2675+ "@docusaurus/utils-common": "2.4.3",
2676− "@docusaurus/utils-validation": "2.4.1",
2676+ "@docusaurus/utils-validation": "2.4.3",
2677 "fs-extra": "^10.1.0",
2677 "fs-extra": "^10.1.0",
2678 "sitemap": "^7.1.1",
2678 "sitemap": "^7.1.1",
2679 "tslib": "^2.4.0"
2679 "tslib": "^2.4.0"
@@ -2692,23 +2692,23 @@
2692 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2692 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2693 },
2693 },
2694 "node_modules/@docusaurus/preset-classic": {
2694 "node_modules/@docusaurus/preset-classic": {
2695− "version": "2.4.1",
2695+ "version": "2.4.3",
2696− "resolved": "https://registry.npmjs.org/@docusaurus/preset-classic/-/preset-classic-2.4.1.tgz",
2696+ "resolved": "https://registry.npmjs.org/@docusaurus/preset-classic/-/preset-classic-2.4.3.tgz",
2697− "integrity": "sha512-P4//+I4zDqQJ+UDgoFrjIFaQ1MeS9UD1cvxVQaI6O7iBmiHQm0MGROP1TbE7HlxlDPXFJjZUK3x3cAoK63smGQ==",
2697+ "integrity": "sha512-tRyMliepY11Ym6hB1rAFSNGwQDpmszvWYJvlK1E+md4SW8i6ylNHtpZjaYFff9Mdk3i/Pg8ItQq9P0daOJAvQw==",
2698− "dependencies": {
2698+ "dependencies": {
2699− "@docusaurus/core": "2.4.1",
2699+ "@docusaurus/core": "2.4.3",
2700− "@docusaurus/plugin-content-blog": "2.4.1",
2700+ "@docusaurus/plugin-content-blog": "2.4.3",
2701− "@docusaurus/plugin-content-docs": "2.4.1",
2701+ "@docusaurus/plugin-content-docs": "2.4.3",
2702− "@docusaurus/plugin-content-pages": "2.4.1",
2702+ "@docusaurus/plugin-content-pages": "2.4.3",
2703− "@docusaurus/plugin-debug": "2.4.1",
2703+ "@docusaurus/plugin-debug": "2.4.3",
2704− "@docusaurus/plugin-google-analytics": "2.4.1",
2704+ "@docusaurus/plugin-google-analytics": "2.4.3",
2705− "@docusaurus/plugin-google-gtag": "2.4.1",
2705+ "@docusaurus/plugin-google-gtag": "2.4.3",
2706− "@docusaurus/plugin-google-tag-manager": "2.4.1",
2706+ "@docusaurus/plugin-google-tag-manager": "2.4.3",
2707− "@docusaurus/plugin-sitemap": "2.4.1",
2707+ "@docusaurus/plugin-sitemap": "2.4.3",
2708− "@docusaurus/theme-classic": "2.4.1",
2708+ "@docusaurus/theme-classic": "2.4.3",
2709− "@docusaurus/theme-common": "2.4.1",
2709+ "@docusaurus/theme-common": "2.4.3",
2710− "@docusaurus/theme-search-algolia": "2.4.1",
2710+ "@docusaurus/theme-search-algolia": "2.4.3",
2711− "@docusaurus/types": "2.4.1"
2711+ "@docusaurus/types": "2.4.3"
2712 },
2712 },
2713 "engines": {
2713 "engines": {
2714 "node": ">=16.14"
2714 "node": ">=16.14"
@@ -2731,22 +2731,22 @@
2731 }
2731 }
2732 },
2732 },
2733 "node_modules/@docusaurus/theme-classic": {
2733 "node_modules/@docusaurus/theme-classic": {
2734− "version": "2.4.1",
2734+ "version": "2.4.3",
2735− "resolved": "https://registry.npmjs.org/@docusaurus/theme-classic/-/theme-classic-2.4.1.tgz",
2735+ "resolved": "https://registry.npmjs.org/@docusaurus/theme-classic/-/theme-classic-2.4.3.tgz",
2736− "integrity": "sha512-Rz0wKUa+LTW1PLXmwnf8mn85EBzaGSt6qamqtmnh9Hflkc+EqiYMhtUJeLdV+wsgYq4aG0ANc+bpUDpsUhdnwg==",
2736+ "integrity": "sha512-QKRAJPSGPfDY2yCiPMIVyr+MqwZCIV2lxNzqbyUW0YkrlmdzzP3WuQJPMGLCjWgQp/5c9kpWMvMxjhpZx1R32Q==",
2737− "dependencies": {
2737+ "dependencies": {
2738− "@docusaurus/core": "2.4.1",
2738+ "@docusaurus/core": "2.4.3",
2739− "@docusaurus/mdx-loader": "2.4.1",
2739+ "@docusaurus/mdx-loader": "2.4.3",
2740− "@docusaurus/module-type-aliases": "2.4.1",
2740+ "@docusaurus/module-type-aliases": "2.4.3",
2741− "@docusaurus/plugin-content-blog": "2.4.1",
2741+ "@docusaurus/plugin-content-blog": "2.4.3",
2742− "@docusaurus/plugin-content-docs": "2.4.1",
2742+ "@docusaurus/plugin-content-docs": "2.4.3",
2743− "@docusaurus/plugin-content-pages": "2.4.1",
2743+ "@docusaurus/plugin-content-pages": "2.4.3",
2744− "@docusaurus/theme-common": "2.4.1",
2744+ "@docusaurus/theme-common": "2.4.3",
2745− "@docusaurus/theme-translations": "2.4.1",
2745+ "@docusaurus/theme-translations": "2.4.3",
2746− "@docusaurus/types": "2.4.1",
2746+ "@docusaurus/types": "2.4.3",
2747− "@docusaurus/utils": "2.4.1",
2747+ "@docusaurus/utils": "2.4.3",
2748− "@docusaurus/utils-common": "2.4.1",
2748+ "@docusaurus/utils-common": "2.4.3",
2749− "@docusaurus/utils-validation": "2.4.1",
2749+ "@docusaurus/utils-validation": "2.4.3",
2750 "@mdx-js/react": "^1.6.22",
2750 "@mdx-js/react": "^1.6.22",
2751 "clsx": "^1.2.1",
2751 "clsx": "^1.2.1",
2752 "copy-text-to-clipboard": "^3.0.1",
2752 "copy-text-to-clipboard": "^3.0.1",
@@ -2775,17 +2775,17 @@
2775 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2775 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2776 },
2776 },
2777 "node_modules/@docusaurus/theme-common": {
2777 "node_modules/@docusaurus/theme-common": {
2778− "version": "2.4.1",
2778+ "version": "2.4.3",
2779− "resolved": "https://registry.npmjs.org/@docusaurus/theme-common/-/theme-common-2.4.1.tgz",
2779+ "resolved": "https://registry.npmjs.org/@docusaurus/theme-common/-/theme-common-2.4.3.tgz",
2780− "integrity": "sha512-G7Zau1W5rQTaFFB3x3soQoZpkgMbl/SYNG8PfMFIjKa3M3q8n0m/GRf5/H/e5BqOvt8c+ZWIXGCiz+kUCSHovA==",
2780+ "integrity": "sha512-7KaDJBXKBVGXw5WOVt84FtN8czGWhM0lbyWEZXGp8AFfL6sZQfRTluFp4QriR97qwzSyOfQb+nzcDZZU4tezUw==",
2781− "dependencies": {
2781+ "dependencies": {
2782− "@docusaurus/mdx-loader": "2.4.1",
2782+ "@docusaurus/mdx-loader": "2.4.3",
2783− "@docusaurus/module-type-aliases": "2.4.1",
2783+ "@docusaurus/module-type-aliases": "2.4.3",
2784− "@docusaurus/plugin-content-blog": "2.4.1",
2784+ "@docusaurus/plugin-content-blog": "2.4.3",
2785− "@docusaurus/plugin-content-docs": "2.4.1",
2785+ "@docusaurus/plugin-content-docs": "2.4.3",
2786− "@docusaurus/plugin-content-pages": "2.4.1",
2786+ "@docusaurus/plugin-content-pages": "2.4.3",
2787− "@docusaurus/utils": "2.4.1",
2787+ "@docusaurus/utils": "2.4.3",
2788− "@docusaurus/utils-common": "2.4.1",
2788+ "@docusaurus/utils-common": "2.4.3",
2789 "@types/history": "^4.7.11",
2789 "@types/history": "^4.7.11",
2790 "@types/react": "*",
2790 "@types/react": "*",
2791 "@types/react-router-config": "*",
2791 "@types/react-router-config": "*",
@@ -2810,18 +2810,18 @@
2810 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2810 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2811 },
2811 },
2812 "node_modules/@docusaurus/theme-search-algolia": {
2812 "node_modules/@docusaurus/theme-search-algolia": {
2813− "version": "2.4.1",
2813+ "version": "2.4.3",
2814− "resolved": "https://registry.npmjs.org/@docusaurus/theme-search-algolia/-/theme-search-algolia-2.4.1.tgz",
2814+ "resolved": "https://registry.npmjs.org/@docusaurus/theme-search-algolia/-/theme-search-algolia-2.4.3.tgz",
2815− "integrity": "sha512-6BcqW2lnLhZCXuMAvPRezFs1DpmEKzXFKlYjruuas+Xy3AQeFzDJKTJFIm49N77WFCTyxff8d3E4Q9pi/+5McQ==",
2815+ "integrity": "sha512-jziq4f6YVUB5hZOB85ELATwnxBz/RmSLD3ksGQOLDPKVzat4pmI8tddNWtriPpxR04BNT+ZfpPUMFkNFetSW1Q==",
2816 "dependencies": {
2816 "dependencies": {
2817 "@docsearch/react": "^3.1.1",
2817 "@docsearch/react": "^3.1.1",
2818− "@docusaurus/core": "2.4.1",
2818+ "@docusaurus/core": "2.4.3",
2819− "@docusaurus/logger": "2.4.1",
2819+ "@docusaurus/logger": "2.4.3",
2820− "@docusaurus/plugin-content-docs": "2.4.1",
2820+ "@docusaurus/plugin-content-docs": "2.4.3",
2821− "@docusaurus/theme-common": "2.4.1",
2821+ "@docusaurus/theme-common": "2.4.3",
2822− "@docusaurus/theme-translations": "2.4.1",
2822+ "@docusaurus/theme-translations": "2.4.3",
2823− "@docusaurus/utils": "2.4.1",
2823+ "@docusaurus/utils": "2.4.3",
2824− "@docusaurus/utils-validation": "2.4.1",
2824+ "@docusaurus/utils-validation": "2.4.3",
2825 "algoliasearch": "^4.13.1",
2825 "algoliasearch": "^4.13.1",
2826 "algoliasearch-helper": "^3.10.0",
2826 "algoliasearch-helper": "^3.10.0",
2827 "clsx": "^1.2.1",
2827 "clsx": "^1.2.1",
@@ -2845,9 +2845,9 @@
2845 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2845 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2846 },
2846 },
2847 "node_modules/@docusaurus/theme-translations": {
2847 "node_modules/@docusaurus/theme-translations": {
2848− "version": "2.4.1",
2848+ "version": "2.4.3",
2849− "resolved": "https://registry.npmjs.org/@docusaurus/theme-translations/-/theme-translations-2.4.1.tgz",
2849+ "resolved": "https://registry.npmjs.org/@docusaurus/theme-translations/-/theme-translations-2.4.3.tgz",
2850− "integrity": "sha512-T1RAGP+f86CA1kfE8ejZ3T3pUU3XcyvrGMfC/zxCtc2BsnoexuNI9Vk2CmuKCb+Tacvhxjv5unhxXce0+NKyvA==",
2850+ "integrity": "sha512-H4D+lbZbjbKNS/Zw1Lel64PioUAIT3cLYYJLUf3KkuO/oc9e0QCVhIYVtUI2SfBCF2NNdlyhBDQEEMygsCedIg==",
2851 "dependencies": {
2851 "dependencies": {
2852 "fs-extra": "^10.1.0",
2852 "fs-extra": "^10.1.0",
2853 "tslib": "^2.4.0"
2853 "tslib": "^2.4.0"
@@ -2862,9 +2862,9 @@
2862 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2862 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2863 },
2863 },
2864 "node_modules/@docusaurus/types": {
2864 "node_modules/@docusaurus/types": {
2865− "version": "2.4.1",
2865+ "version": "2.4.3",
2866− "resolved": "https://registry.npmjs.org/@docusaurus/types/-/types-2.4.1.tgz",
2866+ "resolved": "https://registry.npmjs.org/@docusaurus/types/-/types-2.4.3.tgz",
2867− "integrity": "sha512-0R+cbhpMkhbRXX138UOc/2XZFF8hiZa6ooZAEEJFp5scytzCw4tC1gChMFXrpa3d2tYE6AX8IrOEpSonLmfQuQ==",
2867+ "integrity": "sha512-W6zNLGQqfrp/EoPD0bhb9n7OobP+RHpmvVzpA+Z/IuU3Q63njJM24hmT0GYboovWcDtFmnIJC9wcyx4RVPQscw==",
2868 "dependencies": {
2868 "dependencies": {
2869 "@types/history": "^4.7.11",
2869 "@types/history": "^4.7.11",
2870 "@types/react": "*",
2870 "@types/react": "*",
@@ -2881,11 +2881,11 @@
2881 }
2881 }
2882 },
2882 },
2883 "node_modules/@docusaurus/utils": {
2883 "node_modules/@docusaurus/utils": {
2884− "version": "2.4.1",
2884+ "version": "2.4.3",
2885− "resolved": "https://registry.npmjs.org/@docusaurus/utils/-/utils-2.4.1.tgz",
2885+ "resolved": "https://registry.npmjs.org/@docusaurus/utils/-/utils-2.4.3.tgz",
2886− "integrity": "sha512-1lvEZdAQhKNht9aPXPoh69eeKnV0/62ROhQeFKKxmzd0zkcuE/Oc5Gpnt00y/f5bIsmOsYMY7Pqfm/5rteT5GA==",
2886+ "integrity": "sha512-fKcXsjrD86Smxv8Pt0TBFqYieZZCPh4cbf9oszUq/AMhZn3ujwpKaVYZACPX8mmjtYx0JOgNx52CREBfiGQB4A==",
2887 "dependencies": {
2887 "dependencies": {
2888− "@docusaurus/logger": "2.4.1",
2888+ "@docusaurus/logger": "2.4.3",
2889 "@svgr/webpack": "^6.2.1",
2889 "@svgr/webpack": "^6.2.1",
2890 "escape-string-regexp": "^4.0.0",
2890 "escape-string-regexp": "^4.0.0",
2891 "file-loader": "^6.2.0",
2891 "file-loader": "^6.2.0",
@@ -2915,9 +2915,9 @@
2915 }
2915 }
2916 },
2916 },
2917 "node_modules/@docusaurus/utils-common": {
2917 "node_modules/@docusaurus/utils-common": {
2918− "version": "2.4.1",
2918+ "version": "2.4.3",
2919− "resolved": "https://registry.npmjs.org/@docusaurus/utils-common/-/utils-common-2.4.1.tgz",
2919+ "resolved": "https://registry.npmjs.org/@docusaurus/utils-common/-/utils-common-2.4.3.tgz",
2920− "integrity": "sha512-bCVGdZU+z/qVcIiEQdyx0K13OC5mYwxhSuDUR95oFbKVuXYRrTVrwZIqQljuo1fyJvFTKHiL9L9skQOPokuFNQ==",
2920+ "integrity": "sha512-/jascp4GbLQCPVmcGkPzEQjNaAk3ADVfMtudk49Ggb+131B1WDD6HqlSmDf8MxGdy7Dja2gc+StHf01kiWoTDQ==",
2921 "dependencies": {
2921 "dependencies": {
2922 "tslib": "^2.4.0"
2922 "tslib": "^2.4.0"
2923 },
2923 },
@@ -2939,12 +2939,12 @@
2939 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2939 "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q=="
2940 },
2940 },
2941 "node_modules/@docusaurus/utils-validation": {
2941 "node_modules/@docusaurus/utils-validation": {
2942− "version": "2.4.1",
2942+ "version": "2.4.3",
2943− "resolved": "https://registry.npmjs.org/@docusaurus/utils-validation/-/utils-validation-2.4.1.tgz",
2943+ "resolved": "https://registry.npmjs.org/@docusaurus/utils-validation/-/utils-validation-2.4.3.tgz",
2944− "integrity": "sha512-unII3hlJlDwZ3w8U+pMO3Lx3RhI4YEbY3YNsQj4yzrkZzlpqZOLuAiZK2JyULnD+TKbceKU0WyWkQXtYbLNDFA==",
2944+ "integrity": "sha512-G2+Vt3WR5E/9drAobP+hhZQMaswRwDlp6qOMi7o7ZypB+VO7N//DZWhZEwhcRGepMDJGQEwtPv7UxtYwPL9PBw==",
2945 "dependencies": {
2945 "dependencies": {
2946− "@docusaurus/logger": "2.4.1",
2946+ "@docusaurus/logger": "2.4.3",
2947− "@docusaurus/utils": "2.4.1",
2947+ "@docusaurus/utils": "2.4.3",
2948 "joi": "^17.6.0",
2948 "joi": "^17.6.0",
2949 "js-yaml": "^4.1.0",
2949 "js-yaml": "^4.1.0",
2950 "tslib": "^2.4.0"
2950 "tslib": "^2.4.0"
@@ -4019,9 +4019,9 @@
4019 "integrity": "sha512-wWKOClTTiizcZhXnPY4wikVAwmdYHp8q6DmC+EJUzAMsycb7HB32Kh9RN4+0gExjmPmZSAQjgURXIGATPegAvA=="
4019 "integrity": "sha512-wWKOClTTiizcZhXnPY4wikVAwmdYHp8q6DmC+EJUzAMsycb7HB32Kh9RN4+0gExjmPmZSAQjgURXIGATPegAvA=="
4020 },
4020 },
4021 "node_modules/@types/sax": {
4021 "node_modules/@types/sax": {
4022− "version": "1.2.4",
4022+ "version": "1.2.6",
4023− "resolved": "https://registry.npmjs.org/@types/sax/-/sax-1.2.4.tgz",
4023+ "resolved": "https://registry.npmjs.org/@types/sax/-/sax-1.2.6.tgz",
4024− "integrity": "sha512-pSAff4IAxJjfAXUG6tFkO7dsSbTmf8CtUpfhhZ5VhkRpC4628tJhh3+V6H1E+/Gs9piSzYKT5yzHO5M4GG9jkw==",
4024+ "integrity": "sha512-A1mpYCYu1aHFayy8XKN57ebXeAbh9oQIZ1wXcno6b1ESUAfMBDMx7mf/QGlYwcMRaFryh9YBuH03i/3FlPGDkQ==",
4025 "dependencies": {
4025 "dependencies": {
4026 "@types/node": "*"
4026 "@types/node": "*"
4027 }
4027 }
@@ -4352,30 +4352,30 @@
4352 }
4352 }
4353 },
4353 },
4354 "node_modules/algoliasearch": {
4354 "node_modules/algoliasearch": {
4355− "version": "4.19.1",
4355+ "version": "4.20.0",
4356− "resolved": "https://registry.npmjs.org/algoliasearch/-/algoliasearch-4.19.1.tgz",
4356+ "resolved": "https://registry.npmjs.org/algoliasearch/-/algoliasearch-4.20.0.tgz",
4357− "integrity": "sha512-IJF5b93b2MgAzcE/tuzW0yOPnuUyRgGAtaPv5UUywXM8kzqfdwZTO4sPJBzoGz1eOy6H9uEchsJsBFTELZSu+g==",
4357+ "integrity": "sha512-y+UHEjnOItoNy0bYO+WWmLWBlPwDjKHW6mNHrPi0NkuhpQOOEbrkwQH/wgKFDLh7qlKjzoKeiRtlpewDPDG23g==",
4358− "dependencies": {
4358+ "dependencies": {
4359− "@algolia/cache-browser-local-storage": "4.19.1",
4359+ "@algolia/cache-browser-local-storage": "4.20.0",
4360− "@algolia/cache-common": "4.19.1",
4360+ "@algolia/cache-common": "4.20.0",
4361− "@algolia/cache-in-memory": "4.19.1",
4361+ "@algolia/cache-in-memory": "4.20.0",
4362− "@algolia/client-account": "4.19.1",
4362+ "@algolia/client-account": "4.20.0",
4363− "@algolia/client-analytics": "4.19.1",
4363+ "@algolia/client-analytics": "4.20.0",
4364− "@algolia/client-common": "4.19.1",
4364+ "@algolia/client-common": "4.20.0",
4365− "@algolia/client-personalization": "4.19.1",
4365+ "@algolia/client-personalization": "4.20.0",
4366− "@algolia/client-search": "4.19.1",
4366+ "@algolia/client-search": "4.20.0",
4367− "@algolia/logger-common": "4.19.1",
4367+ "@algolia/logger-common": "4.20.0",
4368− "@algolia/logger-console": "4.19.1",
4368+ "@algolia/logger-console": "4.20.0",
4369− "@algolia/requester-browser-xhr": "4.19.1",
4369+ "@algolia/requester-browser-xhr": "4.20.0",
4370− "@algolia/requester-common": "4.19.1",
4370+ "@algolia/requester-common": "4.20.0",
4371− "@algolia/requester-node-http": "4.19.1",
4371+ "@algolia/requester-node-http": "4.20.0",
4372− "@algolia/transporter": "4.19.1"
4372+ "@algolia/transporter": "4.20.0"
4373 }
4373 }
4374 },
4374 },
4375 "node_modules/algoliasearch-helper": {
4375 "node_modules/algoliasearch-helper": {
4376− "version": "3.14.0",
4376+ "version": "3.15.0",
4377− "resolved": "https://registry.npmjs.org/algoliasearch-helper/-/algoliasearch-helper-3.14.0.tgz",
4377+ "resolved": "https://registry.npmjs.org/algoliasearch-helper/-/algoliasearch-helper-3.15.0.tgz",
4378− "integrity": "sha512-gXDXzsSS0YANn5dHr71CUXOo84cN4azhHKUbg71vAWnH+1JBiR4jf7to3t3JHXknXkbV0F7f055vUSBKrltHLQ==",
4378+ "integrity": "sha512-DGUnK3TGtDQsaUE4ayF/LjSN0DGsuYThB8WBgnnDY0Wq04K6lNVruO3LfqJOgSfDiezp+Iyt8Tj4YKHi+/ivSA==",
4379 "dependencies": {
4379 "dependencies": {
4380 "@algolia/events": "^4.0.1"
4380 "@algolia/events": "^4.0.1"
4381 },
4381 },
@@ -4473,9 +4473,9 @@
4473 }
4473 }
4474 },
4474 },
4475 "node_modules/autoprefixer": {
4475 "node_modules/autoprefixer": {
4476− "version": "10.4.15",
4476+ "version": "10.4.16",
4477− "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.15.tgz",
4477+ "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.16.tgz",
4478− "integrity": "sha512-KCuPB8ZCIqFdA4HwKXsvz7j6gvSDNhDP7WnUjBleRkKjPdvCmHFuQ77ocavI8FT6NdvlBnE2UFr2H4Mycn8Vew==",
4478+ "integrity": "sha512-7vd3UC6xKp0HLfua5IjZlcXvGAGy7cBAXTg2lyQ/8WpNhd6SiZ8Be+xm3FyBSYJx5GKcpRCzBh7RH4/0dnY+uQ==",
4479 "funding": [
4479 "funding": [
4480 {
4480 {
4481 "type": "opencollective",
4481 "type": "opencollective",
@@ -4492,8 +4492,8 @@
4492 ],
4492 ],
4493 "dependencies": {
4493 "dependencies": {
4494 "browserslist": "^4.21.10",
4494 "browserslist": "^4.21.10",
4495− "caniuse-lite": "^1.0.30001520",
4495+ "caniuse-lite": "^1.0.30001538",
4496− "fraction.js": "^4.2.0",
4496+ "fraction.js": "^4.3.6",
4497 "normalize-range": "^0.1.2",
4497 "normalize-range": "^0.1.2",
4498 "picocolors": "^1.0.0",
4498 "picocolors": "^1.0.0",
4499 "postcss-value-parser": "^4.2.0"
4499 "postcss-value-parser": "^4.2.0"
@@ -4921,9 +4921,9 @@
4921 }
4921 }
4922 },
4922 },
4923 "node_modules/caniuse-lite": {
4923 "node_modules/caniuse-lite": {
4924− "version": "1.0.30001529",
4924+ "version": "1.0.30001554",
4925− "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001529.tgz",
4925+ "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001554.tgz",
4926− "integrity": "sha512-n2pUQYGAkrLG4QYj2desAh+NqsJpHbNmVZz87imptDdxLAtjxary7Df/psdfyDGmskJK/9Dt9cPnx5RZ3CU4Og==",
4926+ "integrity": "sha512-A2E3U//MBwbJVzebddm1YfNp7Nud5Ip+IPn4BozBmn4KqVX7AvluoIDFWjsv5OkGnKUXQVmMSoMKLa3ScCblcQ==",
4927 "funding": [
4927 "funding": [
4928 {
4928 {
4929 "type": "opencollective",
4929 "type": "opencollective",
@@ -6956,9 +6956,9 @@
6956 }
6956 }
6957 },
6957 },
6958 "node_modules/fraction.js": {
6958 "node_modules/fraction.js": {
6959− "version": "4.3.6",
6959+ "version": "4.3.7",
6960− "resolved": "https://registry.npmjs.org/fraction.js/-/fraction.js-4.3.6.tgz",
6960+ "resolved": "https://registry.npmjs.org/fraction.js/-/fraction.js-4.3.7.tgz",
6961− "integrity": "sha512-n2aZ9tNfYDwaHhvFTkhFErqOMIb8uyzSQ+vGJBjZyanAKZVbGUQ1sngfk9FdkBw7G26O7AgNjLcecLffD1c7eg==",
6961+ "integrity": "sha512-ZsDfxO51wGAXREY55a7la9LScWpwv9RxIrYABrlvOFBlH/ShPnrtsXeuUIfXKKOVicNxQ+o8JTbJvjS4M89yew==",
6962 "engines": {
6962 "engines": {
6963 "node": "*"
6963 "node": "*"
6964 },
6964 },
@@ -11076,9 +11076,9 @@
11076 }
11076 }
11077 },
11077 },
11078 "node_modules/search-insights": {
11078 "node_modules/search-insights": {
11079− "version": "2.8.2",
11079+ "version": "2.9.0",
11080− "resolved": "https://registry.npmjs.org/search-insights/-/search-insights-2.8.2.tgz",
11080+ "resolved": "https://registry.npmjs.org/search-insights/-/search-insights-2.9.0.tgz",
11081− "integrity": "sha512-PxA9M5Q2bpBelVvJ3oDZR8nuY00Z6qwOxL53wNpgzV28M/D6u9WUbImDckjLSILBF8F1hn/mgyuUaOPtjow4Qw==",
11081+ "integrity": "sha512-bkWW9nIHOFkLwjQ1xqVaMbjjO5vhP26ERsH9Y3pKr8imthofEFIxlnOabkmGcw6ksRj9jWidcI65vvjJH/nTGg==",
11082 "peer": true
11082 "peer": true
11083 },
11083 },
11084 "node_modules/section-matter": {
11084 "node_modules/section-matter": {
@@ -11954,9 +11954,9 @@
11954 }
11954 }
11955 },
11955 },
11956 "node_modules/ua-parser-js": {
11956 "node_modules/ua-parser-js": {
11957− "version": "1.0.35",
11957+ "version": "1.0.36",
11958− "resolved": "https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-1.0.35.tgz",
11958+ "resolved": "https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-1.0.36.tgz",
11959− "integrity": "sha512-fKnGuqmTBnIE+/KXSzCn4db8RTigUzw1AN0DmdU6hJovUTbYJKyqj+8Mt1c4VfRDnOVJnENmfYkIPZ946UrSAA==",
11959+ "integrity": "sha512-znuyCIXzl8ciS3+y3fHJI/2OhQIXbXw9MWC/o3qwyR+RGppjZHrM27CGFSKCJXi2Kctiz537iOu2KnXs1lMQhw==",
11960 "funding": [
11960 "funding": [
11961 {
11961 {
11962 "type": "opencollective",
11962 "type": "opencollective",
@@ -11965,6 +11965,10 @@
11965 {
11965 {
11966 "type": "paypal",
11966 "type": "paypal",
11967 "url": "https://paypal.me/faisalman"
11967 "url": "https://paypal.me/faisalman"
11968+ },
11969+ {
11970+ "type": "github",
11971+ "url": "https://github.com/sponsors/faisalman"
11968 }
11972 }
11969 ],
11973 ],
11970 "engines": {
11974 "engines": {
@@ -13012,74 +13016,74 @@
13012 "requires": {}
13016 "requires": {}
13013 },
13017 },
13014 "@algolia/cache-browser-local-storage": {
13018 "@algolia/cache-browser-local-storage": {
13015− "version": "4.19.1",
13019+ "version": "4.20.0",
13016− "resolved": "https://registry.npmjs.org/@algolia/cache-browser-local-storage/-/cache-browser-local-storage-4.19.1.tgz",
13020+ "resolved": "https://registry.npmjs.org/@algolia/cache-browser-local-storage/-/cache-browser-local-storage-4.20.0.tgz",
13017− "integrity": "sha512-FYAZWcGsFTTaSAwj9Std8UML3Bu8dyWDncM7Ls8g+58UOe4XYdlgzXWbrIgjaguP63pCCbMoExKr61B+ztK3tw==",
13021+ "integrity": "sha512-uujahcBt4DxduBTvYdwO3sBfHuJvJokiC3BP1+O70fglmE1ShkH8lpXqZBac1rrU3FnNYSUs4pL9lBdTKeRPOQ==",
13018 "requires": {
13022 "requires": {
13019− "@algolia/cache-common": "4.19.1"
13023+ "@algolia/cache-common": "4.20.0"
13020 }
13024 }
13021 },
13025 },
13022 "@algolia/cache-common": {
13026 "@algolia/cache-common": {
13023− "version": "4.19.1",
13027+ "version": "4.20.0",
13024− "resolved": "https://registry.npmjs.org/@algolia/cache-common/-/cache-common-4.19.1.tgz",
13028+ "resolved": "https://registry.npmjs.org/@algolia/cache-common/-/cache-common-4.20.0.tgz",
13025− "integrity": "sha512-XGghi3l0qA38HiqdoUY+wvGyBsGvKZ6U3vTiMBT4hArhP3fOGLXpIINgMiiGjTe4FVlTa5a/7Zf2bwlIHfRqqg=="
13029+ "integrity": "sha512-vCfxauaZutL3NImzB2G9LjLt36vKAckc6DhMp05An14kVo8F1Yofb6SIl6U3SaEz8pG2QOB9ptwM5c+zGevwIQ=="
13026 },
13030 },
13027 "@algolia/cache-in-memory": {
13031 "@algolia/cache-in-memory": {
13028− "version": "4.19.1",
13032+ "version": "4.20.0",
13029− "resolved": "https://registry.npmjs.org/@algolia/cache-in-memory/-/cache-in-memory-4.19.1.tgz",
13033+ "resolved": "https://registry.npmjs.org/@algolia/cache-in-memory/-/cache-in-memory-4.20.0.tgz",
13030− "integrity": "sha512-+PDWL+XALGvIginigzu8oU6eWw+o76Z8zHbBovWYcrtWOEtinbl7a7UTt3x3lthv+wNuFr/YD1Gf+B+A9V8n5w==",
13034+ "integrity": "sha512-Wm9ak/IaacAZXS4mB3+qF/KCoVSBV6aLgIGFEtQtJwjv64g4ePMapORGmCyulCFwfePaRAtcaTbMcJF+voc/bg==",
13031 "requires": {
13035 "requires": {
13032− "@algolia/cache-common": "4.19.1"
13036+ "@algolia/cache-common": "4.20.0"
13033 }
13037 }
13034 },
13038 },
13035 "@algolia/client-account": {
13039 "@algolia/client-account": {
13036− "version": "4.19.1",
13040+ "version": "4.20.0",
13037− "resolved": "https://registry.npmjs.org/@algolia/client-account/-/client-account-4.19.1.tgz",
13041+ "resolved": "https://registry.npmjs.org/@algolia/client-account/-/client-account-4.20.0.tgz",
13038− "integrity": "sha512-Oy0ritA2k7AMxQ2JwNpfaEcgXEDgeyKu0V7E7xt/ZJRdXfEpZcwp9TOg4TJHC7Ia62gIeT2Y/ynzsxccPw92GA==",
13042+ "integrity": "sha512-GGToLQvrwo7am4zVkZTnKa72pheQeez/16sURDWm7Seyz+HUxKi3BM6fthVVPUEBhtJ0reyVtuK9ArmnaKl10Q==",
13039 "requires": {
13043 "requires": {
13040− "@algolia/client-common": "4.19.1",
13044+ "@algolia/client-common": "4.20.0",
13041− "@algolia/client-search": "4.19.1",
13045+ "@algolia/client-search": "4.20.0",
13042− "@algolia/transporter": "4.19.1"
13046+ "@algolia/transporter": "4.20.0"
13043 }
13047 }
13044 },
13048 },
13045 "@algolia/client-analytics": {
13049 "@algolia/client-analytics": {
13046− "version": "4.19.1",
13050+ "version": "4.20.0",
13047− "resolved": "https://registry.npmjs.org/@algolia/client-analytics/-/client-analytics-4.19.1.tgz",
13051+ "resolved": "https://registry.npmjs.org/@algolia/client-analytics/-/client-analytics-4.20.0.tgz",
13048− "integrity": "sha512-5QCq2zmgdZLIQhHqwl55ZvKVpLM3DNWjFI4T+bHr3rGu23ew2bLO4YtyxaZeChmDb85jUdPDouDlCumGfk6wOg==",
13052+ "integrity": "sha512-EIr+PdFMOallRdBTHHdKI3CstslgLORQG7844Mq84ib5oVFRVASuuPmG4bXBgiDbcsMLUeOC6zRVJhv1KWI0ug==",
13049 "requires": {
13053 "requires": {
13050− "@algolia/client-common": "4.19.1",
13054+ "@algolia/client-common": "4.20.0",
13051− "@algolia/client-search": "4.19.1",
13055+ "@algolia/client-search": "4.20.0",
13052− "@algolia/requester-common": "4.19.1",
13056+ "@algolia/requester-common": "4.20.0",
13053− "@algolia/transporter": "4.19.1"
13057+ "@algolia/transporter": "4.20.0"
13054 }
13058 }
13055 },
13059 },
13056 "@algolia/client-common": {
13060 "@algolia/client-common": {
13057− "version": "4.19.1",
13061+ "version": "4.20.0",
13058− "resolved": "https://registry.npmjs.org/@algolia/client-common/-/client-common-4.19.1.tgz",
13062+ "resolved": "https://registry.npmjs.org/@algolia/client-common/-/client-common-4.20.0.tgz",
13059− "integrity": "sha512-3kAIVqTcPrjfS389KQvKzliC559x+BDRxtWamVJt8IVp7LGnjq+aVAXg4Xogkur1MUrScTZ59/AaUd5EdpyXgA==",
13063+ "integrity": "sha512-P3WgMdEss915p+knMMSd/fwiHRHKvDu4DYRrCRaBrsfFw7EQHon+EbRSm4QisS9NYdxbS04kcvNoavVGthyfqQ==",
13060 "requires": {
13064 "requires": {
13061− "@algolia/requester-common": "4.19.1",
13065+ "@algolia/requester-common": "4.20.0",
13062− "@algolia/transporter": "4.19.1"
13066+ "@algolia/transporter": "4.20.0"
13063 }
13067 }
13064 },
13068 },
13065 "@algolia/client-personalization": {
13069 "@algolia/client-personalization": {
13066− "version": "4.19.1",
13070+ "version": "4.20.0",
13067− "resolved": "https://registry.npmjs.org/@algolia/client-personalization/-/client-personalization-4.19.1.tgz",
13071+ "resolved": "https://registry.npmjs.org/@algolia/client-personalization/-/client-personalization-4.20.0.tgz",
13068− "integrity": "sha512-8CWz4/H5FA+krm9HMw2HUQenizC/DxUtsI5oYC0Jxxyce1vsr8cb1aEiSJArQT6IzMynrERif1RVWLac1m36xw==",
13072+ "integrity": "sha512-N9+zx0tWOQsLc3K4PVRDV8GUeOLAY0i445En79Pr3zWB+m67V+n/8w4Kw1C5LlbHDDJcyhMMIlqezh6BEk7xAQ==",
13069 "requires": {
13073 "requires": {
13070− "@algolia/client-common": "4.19.1",
13074+ "@algolia/client-common": "4.20.0",
13071− "@algolia/requester-common": "4.19.1",
13075+ "@algolia/requester-common": "4.20.0",
13072− "@algolia/transporter": "4.19.1"
13076+ "@algolia/transporter": "4.20.0"
13073 }
13077 }
13074 },
13078 },
13075 "@algolia/client-search": {
13079 "@algolia/client-search": {
13076− "version": "4.19.1",
13080+ "version": "4.20.0",
13077− "resolved": "https://registry.npmjs.org/@algolia/client-search/-/client-search-4.19.1.tgz",
13081+ "resolved": "https://registry.npmjs.org/@algolia/client-search/-/client-search-4.20.0.tgz",
13078− "integrity": "sha512-mBecfMFS4N+yK/p0ZbK53vrZbL6OtWMk8YmnOv1i0LXx4pelY8TFhqKoTit3NPVPwoSNN0vdSN9dTu1xr1XOVw==",
13082+ "integrity": "sha512-zgwqnMvhWLdpzKTpd3sGmMlr4c+iS7eyyLGiaO51zDZWGMkpgoNVmltkzdBwxOVXz0RsFMznIxB9zuarUv4TZg==",
13079 "requires": {
13083 "requires": {
13080− "@algolia/client-common": "4.19.1",
13084+ "@algolia/client-common": "4.20.0",
13081− "@algolia/requester-common": "4.19.1",
13085+ "@algolia/requester-common": "4.20.0",
13082− "@algolia/transporter": "4.19.1"
13086+ "@algolia/transporter": "4.20.0"
13083 }
13087 }
13084 },
13088 },
13085 "@algolia/events": {
13089 "@algolia/events": {
@@ -13088,47 +13092,47 @@
13088 "integrity": "sha512-FQzvOCgoFXAbf5Y6mYozw2aj5KCJoA3m4heImceldzPSMbdyS4atVjJzXKMsfX3wnZTFYwkkt8/z8UesLHlSBQ=="
13092 "integrity": "sha512-FQzvOCgoFXAbf5Y6mYozw2aj5KCJoA3m4heImceldzPSMbdyS4atVjJzXKMsfX3wnZTFYwkkt8/z8UesLHlSBQ=="
13089 },
13093 },
13090 "@algolia/logger-common": {
13094 "@algolia/logger-common": {
13091− "version": "4.19.1",
13095+ "version": "4.20.0",
13092− "resolved": "https://registry.npmjs.org/@algolia/logger-common/-/logger-common-4.19.1.tgz",
13096+ "resolved": "https://registry.npmjs.org/@algolia/logger-common/-/logger-common-4.20.0.tgz",
13093− "integrity": "sha512-i6pLPZW/+/YXKis8gpmSiNk1lOmYCmRI6+x6d2Qk1OdfvX051nRVdalRbEcVTpSQX6FQAoyeaui0cUfLYW5Elw=="
13097+ "integrity": "sha512-xouigCMB5WJYEwvoWW5XDv7Z9f0A8VoXJc3VKwlHJw/je+3p2RcDXfksLI4G4lIVncFUYMZx30tP/rsdlvvzHQ=="
13094 },
13098 },
13095 "@algolia/logger-console": {
13099 "@algolia/logger-console": {
13096− "version": "4.19.1",
13100+ "version": "4.20.0",
13097− "resolved": "https://registry.npmjs.org/@algolia/logger-console/-/logger-console-4.19.1.tgz",
13101+ "resolved": "https://registry.npmjs.org/@algolia/logger-console/-/logger-console-4.20.0.tgz",
13098− "integrity": "sha512-jj72k9GKb9W0c7TyC3cuZtTr0CngLBLmc8trzZlXdfvQiigpUdvTi1KoWIb2ZMcRBG7Tl8hSb81zEY3zI2RlXg==",
13102+ "integrity": "sha512-THlIGG1g/FS63z0StQqDhT6bprUczBI8wnLT3JWvfAQDZX5P6fCg7dG+pIrUBpDIHGszgkqYEqECaKKsdNKOUA==",
13099 "requires": {
13103 "requires": {
13100− "@algolia/logger-common": "4.19.1"
13104+ "@algolia/logger-common": "4.20.0"
13101 }
13105 }
13102 },
13106 },
13103 "@algolia/requester-browser-xhr": {
13107 "@algolia/requester-browser-xhr": {
13104− "version": "4.19.1",
13108+ "version": "4.20.0",
13105− "resolved": "https://registry.npmjs.org/@algolia/requester-browser-xhr/-/requester-browser-xhr-4.19.1.tgz",
13109+ "resolved": "https://registry.npmjs.org/@algolia/requester-browser-xhr/-/requester-browser-xhr-4.20.0.tgz",
13106− "integrity": "sha512-09K/+t7lptsweRTueHnSnmPqIxbHMowejAkn9XIcJMLdseS3zl8ObnS5GWea86mu3vy4+8H+ZBKkUN82Zsq/zg==",
13110+ "integrity": "sha512-HbzoSjcjuUmYOkcHECkVTwAelmvTlgs48N6Owt4FnTOQdwn0b8pdht9eMgishvk8+F8bal354nhx/xOoTfwiAw==",
13107 "requires": {
13111 "requires": {
13108− "@algolia/requester-common": "4.19.1"
13112+ "@algolia/requester-common": "4.20.0"
13109 }
13113 }
13110 },
13114 },
13111 "@algolia/requester-common": {
13115 "@algolia/requester-common": {
13112− "version": "4.19.1",
13116+ "version": "4.20.0",
13113− "resolved": "https://registry.npmjs.org/@algolia/requester-common/-/requester-common-4.19.1.tgz",
13117+ "resolved": "https://registry.npmjs.org/@algolia/requester-common/-/requester-common-4.20.0.tgz",
13114− "integrity": "sha512-BisRkcWVxrDzF1YPhAckmi2CFYK+jdMT60q10d7z3PX+w6fPPukxHRnZwooiTUrzFe50UBmLItGizWHP5bDzVQ=="
13118+ "integrity": "sha512-9h6ye6RY/BkfmeJp7Z8gyyeMrmmWsMOCRBXQDs4mZKKsyVlfIVICpcSibbeYcuUdurLhIlrOUkH3rQEgZzonng=="
13115 },
13119 },
13116 "@algolia/requester-node-http": {
13120 "@algolia/requester-node-http": {
13117− "version": "4.19.1",
13121+ "version": "4.20.0",
13118− "resolved": "https://registry.npmjs.org/@algolia/requester-node-http/-/requester-node-http-4.19.1.tgz",
13122+ "resolved": "https://registry.npmjs.org/@algolia/requester-node-http/-/requester-node-http-4.20.0.tgz",
13119− "integrity": "sha512-6DK52DHviBHTG2BK/Vv2GIlEw7i+vxm7ypZW0Z7vybGCNDeWzADx+/TmxjkES2h15+FZOqVf/Ja677gePsVItA==",
13123+ "integrity": "sha512-ocJ66L60ABSSTRFnCHIEZpNHv6qTxsBwJEPfYaSBsLQodm0F9ptvalFkHMpvj5DfE22oZrcrLbOYM2bdPJRHng==",
13120 "requires": {
13124 "requires": {
13121− "@algolia/requester-common": "4.19.1"
13125+ "@algolia/requester-common": "4.20.0"
13122 }
13126 }
13123 },
13127 },
13124 "@algolia/transporter": {
13128 "@algolia/transporter": {
13125− "version": "4.19.1",
13129+ "version": "4.20.0",
13126− "resolved": "https://registry.npmjs.org/@algolia/transporter/-/transporter-4.19.1.tgz",
13130+ "resolved": "https://registry.npmjs.org/@algolia/transporter/-/transporter-4.20.0.tgz",
13127− "integrity": "sha512-nkpvPWbpuzxo1flEYqNIbGz7xhfhGOKGAZS7tzC+TELgEmi7z99qRyTfNSUlW7LZmB3ACdnqAo+9A9KFBENviQ==",
13131+ "integrity": "sha512-Lsii1pGWOAISbzeyuf+r/GPhvHMPHSPrTDWNcIzOE1SG1inlJHICaVe2ikuoRjcpgxZNU54Jl+if15SUCsaTUg==",
13128 "requires": {
13132 "requires": {
13129− "@algolia/cache-common": "4.19.1",
13133+ "@algolia/cache-common": "4.20.0",
13130− "@algolia/logger-common": "4.19.1",
13134+ "@algolia/logger-common": "4.20.0",
13131− "@algolia/requester-common": "4.19.1"
13135+ "@algolia/requester-common": "4.20.0"
13132 }
13136 }
13133 },
13137 },
13134 "@ampproject/remapping": {
13138 "@ampproject/remapping": {
@@ -14471,9 +14475,9 @@
14471 }
14475 }
14472 },
14476 },
14473 "@docusaurus/core": {
14477 "@docusaurus/core": {
14474− "version": "2.4.1",
14478+ "version": "2.4.3",
14475− "resolved": "https://registry.npmjs.org/@docusaurus/core/-/core-2.4.1.tgz",
14479+ "resolved": "https://registry.npmjs.org/@docusaurus/core/-/core-2.4.3.tgz",
14476− "integrity": "sha512-SNsY7PshK3Ri7vtsLXVeAJGS50nJN3RgF836zkyUfAD01Fq+sAk5EwWgLw+nnm5KVNGDu7PRR2kRGDsWvqpo0g==",
14480+ "integrity": "sha512-dWH5P7cgeNSIg9ufReX6gaCl/TmrGKD38Orbwuz05WPhAQtFXHd5B8Qym1TiXfvUNvwoYKkAJOJuGe8ou0Z7PA==",
14477 "requires": {
14481 "requires": {
14478 "@babel/core": "^7.18.6",
14482 "@babel/core": "^7.18.6",
14479 "@babel/generator": "^7.18.7",
14483 "@babel/generator": "^7.18.7",
@@ -14485,13 +14489,13 @@
14485 "@babel/runtime": "^7.18.6",
14489 "@babel/runtime": "^7.18.6",
14486 "@babel/runtime-corejs3": "^7.18.6",
14490 "@babel/runtime-corejs3": "^7.18.6",
14487 "@babel/traverse": "^7.18.8",
14491 "@babel/traverse": "^7.18.8",
14488− "@docusaurus/cssnano-preset": "2.4.1",
14492+ "@docusaurus/cssnano-preset": "2.4.3",
14489− "@docusaurus/logger": "2.4.1",
14493+ "@docusaurus/logger": "2.4.3",
14490− "@docusaurus/mdx-loader": "2.4.1",
14494+ "@docusaurus/mdx-loader": "2.4.3",
14491 "@docusaurus/react-loadable": "5.5.2",
14495 "@docusaurus/react-loadable": "5.5.2",
14492− "@docusaurus/utils": "2.4.1",
14496+ "@docusaurus/utils": "2.4.3",
14493− "@docusaurus/utils-common": "2.4.1",
14497+ "@docusaurus/utils-common": "2.4.3",
14494− "@docusaurus/utils-validation": "2.4.1",
14498+ "@docusaurus/utils-validation": "2.4.3",
14495 "@slorber/static-site-generator-webpack-plugin": "^4.0.7",
14499 "@slorber/static-site-generator-webpack-plugin": "^4.0.7",
14496 "@svgr/webpack": "^6.2.1",
14500 "@svgr/webpack": "^6.2.1",
14497 "autoprefixer": "^10.4.7",
14501 "autoprefixer": "^10.4.7",
@@ -14632,9 +14636,9 @@
14632 }
14636 }
14633 },
14637 },
14634 "@docusaurus/cssnano-preset": {
14638 "@docusaurus/cssnano-preset": {
14635− "version": "2.4.1",
14639+ "version": "2.4.3",
14636− "resolved": "https://registry.npmjs.org/@docusaurus/cssnano-preset/-/cssnano-preset-2.4.1.tgz",
14640+ "resolved": "https://registry.npmjs.org/@docusaurus/cssnano-preset/-/cssnano-preset-2.4.3.tgz",
14637− "integrity": "sha512-ka+vqXwtcW1NbXxWsh6yA1Ckii1klY9E53cJ4O9J09nkMBgrNX3iEFED1fWdv8wf4mJjvGi5RLZ2p9hJNjsLyQ==",
14641+ "integrity": "sha512-ZvGSRCi7z9wLnZrXNPG6DmVPHdKGd8dIn9pYbEOFiYihfv4uDR3UtxogmKf+rT8ZlKFf5Lqne8E8nt08zNM8CA==",
14638 "requires": {
14642 "requires": {
14639 "cssnano-preset-advanced": "^5.3.8",
14643 "cssnano-preset-advanced": "^5.3.8",
14640 "postcss": "^8.4.14",
14644 "postcss": "^8.4.14",
@@ -14650,9 +14654,9 @@
14650 }
14654 }
14651 },
14655 },
14652 "@docusaurus/logger": {
14656 "@docusaurus/logger": {
14653− "version": "2.4.1",
14657+ "version": "2.4.3",
14654− "resolved": "https://registry.npmjs.org/@docusaurus/logger/-/logger-2.4.1.tgz",
14658+ "resolved": "https://registry.npmjs.org/@docusaurus/logger/-/logger-2.4.3.tgz",
14655− "integrity": "sha512-5h5ysIIWYIDHyTVd8BjheZmQZmEgWDR54aQ1BX9pjFfpyzFo5puKXKYrYJXbjEHGyVhEzmB9UXwbxGfaZhOjcg==",
14659+ "integrity": "sha512-Zxws7r3yLufk9xM1zq9ged0YHs65mlRmtsobnFkdZTxWXdTYlWWLWdKyNKAsVC+D7zg+pv2fGbyabdOnyZOM3w==",
14656 "requires": {
14660 "requires": {
14657 "chalk": "^4.1.2",
14661 "chalk": "^4.1.2",
14658 "tslib": "^2.4.0"
14662 "tslib": "^2.4.0"
@@ -14666,14 +14670,14 @@
14666 }
14670 }
14667 },
14671 },
14668 "@docusaurus/mdx-loader": {
14672 "@docusaurus/mdx-loader": {
14669− "version": "2.4.1",
14673+ "version": "2.4.3",
14670− "resolved": "https://registry.npmjs.org/@docusaurus/mdx-loader/-/mdx-loader-2.4.1.tgz",
14674+ "resolved": "https://registry.npmjs.org/@docusaurus/mdx-loader/-/mdx-loader-2.4.3.tgz",
14671− "integrity": "sha512-4KhUhEavteIAmbBj7LVFnrVYDiU51H5YWW1zY6SmBSte/YLhDutztLTBE0PQl1Grux1jzUJeaSvAzHpTn6JJDQ==",
14675+ "integrity": "sha512-b1+fDnWtl3GiqkL0BRjYtc94FZrcDDBV1j8446+4tptB9BAOlePwG2p/pK6vGvfL53lkOsszXMghr2g67M0vCw==",
14672 "requires": {
14676 "requires": {
14673 "@babel/parser": "^7.18.8",
14677 "@babel/parser": "^7.18.8",
14674 "@babel/traverse": "^7.18.8",
14678 "@babel/traverse": "^7.18.8",
14675− "@docusaurus/logger": "2.4.1",
14679+ "@docusaurus/logger": "2.4.3",
14676− "@docusaurus/utils": "2.4.1",
14680+ "@docusaurus/utils": "2.4.3",
14677 "@mdx-js/mdx": "^1.6.22",
14681 "@mdx-js/mdx": "^1.6.22",
14678 "escape-html": "^1.0.3",
14682 "escape-html": "^1.0.3",
14679 "file-loader": "^6.2.0",
14683 "file-loader": "^6.2.0",
@@ -14697,12 +14701,12 @@
14697 }
14701 }
14698 },
14702 },
14699 "@docusaurus/module-type-aliases": {
14703 "@docusaurus/module-type-aliases": {
14700− "version": "2.4.1",
14704+ "version": "2.4.3",
14701− "resolved": "https://registry.npmjs.org/@docusaurus/module-type-aliases/-/module-type-aliases-2.4.1.tgz",
14705+ "resolved": "https://registry.npmjs.org/@docusaurus/module-type-aliases/-/module-type-aliases-2.4.3.tgz",
14702− "integrity": "sha512-gLBuIFM8Dp2XOCWffUDSjtxY7jQgKvYujt7Mx5s4FCTfoL5dN1EVbnrn+O2Wvh8b0a77D57qoIDY7ghgmatR1A==",
14706+ "integrity": "sha512-cwkBkt1UCiduuvEAo7XZY01dJfRn7UR/75mBgOdb1hKknhrabJZ8YH+7savd/y9kLExPyrhe0QwdS9GuzsRRIA==",
14703 "requires": {
14707 "requires": {
14704 "@docusaurus/react-loadable": "5.5.2",
14708 "@docusaurus/react-loadable": "5.5.2",
14705− "@docusaurus/types": "2.4.1",
14709+ "@docusaurus/types": "2.4.3",
14706 "@types/history": "^4.7.11",
14710 "@types/history": "^4.7.11",
14707 "@types/react": "*",
14711 "@types/react": "*",
14708 "@types/react-router-config": "*",
14712 "@types/react-router-config": "*",
@@ -14712,17 +14716,17 @@
14712 }
14716 }
14713 },
14717 },
14714 "@docusaurus/plugin-content-blog": {
14718 "@docusaurus/plugin-content-blog": {
14715− "version": "2.4.1",
14719+ "version": "2.4.3",
14716− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-content-blog/-/plugin-content-blog-2.4.1.tgz",
14720+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-content-blog/-/plugin-content-blog-2.4.3.tgz",
14717− "integrity": "sha512-E2i7Knz5YIbE1XELI6RlTnZnGgS52cUO4BlCiCUCvQHbR+s1xeIWz4C6BtaVnlug0Ccz7nFSksfwDpVlkujg5Q==",
14721+ "integrity": "sha512-PVhypqaA0t98zVDpOeTqWUTvRqCEjJubtfFUQ7zJNYdbYTbS/E/ytq6zbLVsN/dImvemtO/5JQgjLxsh8XLo8Q==",
14718− "requires": {
14722+ "requires": {
14719− "@docusaurus/core": "2.4.1",
14723+ "@docusaurus/core": "2.4.3",
14720− "@docusaurus/logger": "2.4.1",
14724+ "@docusaurus/logger": "2.4.3",
14721− "@docusaurus/mdx-loader": "2.4.1",
14725+ "@docusaurus/mdx-loader": "2.4.3",
14722− "@docusaurus/types": "2.4.1",
14726+ "@docusaurus/types": "2.4.3",
14723− "@docusaurus/utils": "2.4.1",
14727+ "@docusaurus/utils": "2.4.3",
14724− "@docusaurus/utils-common": "2.4.1",
14728+ "@docusaurus/utils-common": "2.4.3",
14725− "@docusaurus/utils-validation": "2.4.1",
14729+ "@docusaurus/utils-validation": "2.4.3",
14726 "cheerio": "^1.0.0-rc.12",
14730 "cheerio": "^1.0.0-rc.12",
14727 "feed": "^4.2.2",
14731 "feed": "^4.2.2",
14728 "fs-extra": "^10.1.0",
14732 "fs-extra": "^10.1.0",
@@ -14742,17 +14746,17 @@
14742 }
14746 }
14743 },
14747 },
14744 "@docusaurus/plugin-content-docs": {
14748 "@docusaurus/plugin-content-docs": {
14745− "version": "2.4.1",
14749+ "version": "2.4.3",
14746− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-content-docs/-/plugin-content-docs-2.4.1.tgz",
14750+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-content-docs/-/plugin-content-docs-2.4.3.tgz",
14747− "integrity": "sha512-Lo7lSIcpswa2Kv4HEeUcGYqaasMUQNpjTXpV0N8G6jXgZaQurqp7E8NGYeGbDXnb48czmHWbzDL4S3+BbK0VzA==",
14751+ "integrity": "sha512-N7Po2LSH6UejQhzTCsvuX5NOzlC+HiXOVvofnEPj0WhMu1etpLEXE6a4aTxrtg95lQ5kf0xUIdjX9sh3d3G76A==",
14748− "requires": {
14752+ "requires": {
14749− "@docusaurus/core": "2.4.1",
14753+ "@docusaurus/core": "2.4.3",
14750− "@docusaurus/logger": "2.4.1",
14754+ "@docusaurus/logger": "2.4.3",
14751− "@docusaurus/mdx-loader": "2.4.1",
14755+ "@docusaurus/mdx-loader": "2.4.3",
14752− "@docusaurus/module-type-aliases": "2.4.1",
14756+ "@docusaurus/module-type-aliases": "2.4.3",
14753− "@docusaurus/types": "2.4.1",
14757+ "@docusaurus/types": "2.4.3",
14754− "@docusaurus/utils": "2.4.1",
14758+ "@docusaurus/utils": "2.4.3",
14755− "@docusaurus/utils-validation": "2.4.1",
14759+ "@docusaurus/utils-validation": "2.4.3",
14756 "@types/react-router-config": "^5.0.6",
14760 "@types/react-router-config": "^5.0.6",
14757 "combine-promises": "^1.1.0",
14761 "combine-promises": "^1.1.0",
14758 "fs-extra": "^10.1.0",
14762 "fs-extra": "^10.1.0",
@@ -14772,15 +14776,15 @@
14772 }
14776 }
14773 },
14777 },
14774 "@docusaurus/plugin-content-pages": {
14778 "@docusaurus/plugin-content-pages": {
14775− "version": "2.4.1",
14779+ "version": "2.4.3",
14776− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-content-pages/-/plugin-content-pages-2.4.1.tgz",
14780+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-content-pages/-/plugin-content-pages-2.4.3.tgz",
14777− "integrity": "sha512-/UjuH/76KLaUlL+o1OvyORynv6FURzjurSjvn2lbWTFc4tpYY2qLYTlKpTCBVPhlLUQsfyFnshEJDLmPneq2oA==",
14781+ "integrity": "sha512-txtDVz7y3zGk67q0HjG0gRttVPodkHqE0bpJ+7dOaTH40CQFLSh7+aBeGnPOTl+oCPG+hxkim4SndqPqXjQ8Bg==",
14778− "requires": {
14782+ "requires": {
14779− "@docusaurus/core": "2.4.1",
14783+ "@docusaurus/core": "2.4.3",
14780− "@docusaurus/mdx-loader": "2.4.1",
14784+ "@docusaurus/mdx-loader": "2.4.3",
14781− "@docusaurus/types": "2.4.1",
14785+ "@docusaurus/types": "2.4.3",
14782− "@docusaurus/utils": "2.4.1",
14786+ "@docusaurus/utils": "2.4.3",
14783− "@docusaurus/utils-validation": "2.4.1",
14787+ "@docusaurus/utils-validation": "2.4.3",
14784 "fs-extra": "^10.1.0",
14788 "fs-extra": "^10.1.0",
14785 "tslib": "^2.4.0",
14789 "tslib": "^2.4.0",
14786 "webpack": "^5.73.0"
14790 "webpack": "^5.73.0"
@@ -14794,13 +14798,13 @@
14794 }
14798 }
14795 },
14799 },
14796 "@docusaurus/plugin-debug": {
14800 "@docusaurus/plugin-debug": {
14797− "version": "2.4.1",
14801+ "version": "2.4.3",
14798− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-debug/-/plugin-debug-2.4.1.tgz",
14802+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-debug/-/plugin-debug-2.4.3.tgz",
14799− "integrity": "sha512-7Yu9UPzRShlrH/G8btOpR0e6INFZr0EegWplMjOqelIwAcx3PKyR8mgPTxGTxcqiYj6hxSCRN0D8R7YrzImwNA==",
14803+ "integrity": "sha512-LkUbuq3zCmINlFb+gAd4ZvYr+bPAzMC0hwND4F7V9bZ852dCX8YoWyovVUBKq4er1XsOwSQaHmNGtObtn8Av8Q==",
14800 "requires": {
14804 "requires": {
14801− "@docusaurus/core": "2.4.1",
14805+ "@docusaurus/core": "2.4.3",
14802− "@docusaurus/types": "2.4.1",
14806+ "@docusaurus/types": "2.4.3",
14803− "@docusaurus/utils": "2.4.1",
14807+ "@docusaurus/utils": "2.4.3",
14804 "fs-extra": "^10.1.0",
14808 "fs-extra": "^10.1.0",
14805 "react-json-view": "^1.21.3",
14809 "react-json-view": "^1.21.3",
14806 "tslib": "^2.4.0"
14810 "tslib": "^2.4.0"
@@ -14814,13 +14818,13 @@
14814 }
14818 }
14815 },
14819 },
14816 "@docusaurus/plugin-google-analytics": {
14820 "@docusaurus/plugin-google-analytics": {
14817− "version": "2.4.1",
14821+ "version": "2.4.3",
14818− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-google-analytics/-/plugin-google-analytics-2.4.1.tgz",
14822+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-google-analytics/-/plugin-google-analytics-2.4.3.tgz",
14819− "integrity": "sha512-dyZJdJiCoL+rcfnm0RPkLt/o732HvLiEwmtoNzOoz9MSZz117UH2J6U2vUDtzUzwtFLIf32KkeyzisbwUCgcaQ==",
14823+ "integrity": "sha512-KzBV3k8lDkWOhg/oYGxlK5o9bOwX7KpPc/FTWoB+SfKhlHfhq7qcQdMi1elAaVEIop8tgK6gD1E58Q+XC6otSQ==",
14820 "requires": {
14824 "requires": {
14821− "@docusaurus/core": "2.4.1",
14825+ "@docusaurus/core": "2.4.3",
14822− "@docusaurus/types": "2.4.1",
14826+ "@docusaurus/types": "2.4.3",
14823− "@docusaurus/utils-validation": "2.4.1",
14827+ "@docusaurus/utils-validation": "2.4.3",
14824 "tslib": "^2.4.0"
14828 "tslib": "^2.4.0"
14825 },
14829 },
14826 "dependencies": {
14830 "dependencies": {
@@ -14832,13 +14836,13 @@
14832 }
14836 }
14833 },
14837 },
14834 "@docusaurus/plugin-google-gtag": {
14838 "@docusaurus/plugin-google-gtag": {
14835− "version": "2.4.1",
14839+ "version": "2.4.3",
14836− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-google-gtag/-/plugin-google-gtag-2.4.1.tgz",
14840+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-google-gtag/-/plugin-google-gtag-2.4.3.tgz",
14837− "integrity": "sha512-mKIefK+2kGTQBYvloNEKtDmnRD7bxHLsBcxgnbt4oZwzi2nxCGjPX6+9SQO2KCN5HZbNrYmGo5GJfMgoRvy6uA==",
14841+ "integrity": "sha512-5FMg0rT7sDy4i9AGsvJC71MQrqQZwgLNdDetLEGDHLfSHLvJhQbTCUGbGXknUgWXQJckcV/AILYeJy+HhxeIFA==",
14838 "requires": {
14842 "requires": {
14839− "@docusaurus/core": "2.4.1",
14843+ "@docusaurus/core": "2.4.3",
14840− "@docusaurus/types": "2.4.1",
14844+ "@docusaurus/types": "2.4.3",
14841− "@docusaurus/utils-validation": "2.4.1",
14845+ "@docusaurus/utils-validation": "2.4.3",
14842 "tslib": "^2.4.0"
14846 "tslib": "^2.4.0"
14843 },
14847 },
14844 "dependencies": {
14848 "dependencies": {
@@ -14850,13 +14854,13 @@
14850 }
14854 }
14851 },
14855 },
14852 "@docusaurus/plugin-google-tag-manager": {
14856 "@docusaurus/plugin-google-tag-manager": {
14853− "version": "2.4.1",
14857+ "version": "2.4.3",
14854− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-google-tag-manager/-/plugin-google-tag-manager-2.4.1.tgz",
14858+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-google-tag-manager/-/plugin-google-tag-manager-2.4.3.tgz",
14855− "integrity": "sha512-Zg4Ii9CMOLfpeV2nG74lVTWNtisFaH9QNtEw48R5QE1KIwDBdTVaiSA18G1EujZjrzJJzXN79VhINSbOJO/r3g==",
14859+ "integrity": "sha512-1jTzp71yDGuQiX9Bi0pVp3alArV0LSnHXempvQTxwCGAEzUWWaBg4d8pocAlTpbP9aULQQqhgzrs8hgTRPOM0A==",
14856 "requires": {
14860 "requires": {
14857− "@docusaurus/core": "2.4.1",
14861+ "@docusaurus/core": "2.4.3",
14858− "@docusaurus/types": "2.4.1",
14862+ "@docusaurus/types": "2.4.3",
14859− "@docusaurus/utils-validation": "2.4.1",
14863+ "@docusaurus/utils-validation": "2.4.3",
14860 "tslib": "^2.4.0"
14864 "tslib": "^2.4.0"
14861 },
14865 },
14862 "dependencies": {
14866 "dependencies": {
@@ -14868,16 +14872,16 @@
14868 }
14872 }
14869 },
14873 },
14870 "@docusaurus/plugin-sitemap": {
14874 "@docusaurus/plugin-sitemap": {
14871− "version": "2.4.1",
14875+ "version": "2.4.3",
14872− "resolved": "https://registry.npmjs.org/@docusaurus/plugin-sitemap/-/plugin-sitemap-2.4.1.tgz",
14876+ "resolved": "https://registry.npmjs.org/@docusaurus/plugin-sitemap/-/plugin-sitemap-2.4.3.tgz",
14873− "integrity": "sha512-lZx+ijt/+atQ3FVE8FOHV/+X3kuok688OydDXrqKRJyXBJZKgGjA2Qa8RjQ4f27V2woaXhtnyrdPop/+OjVMRg==",
14877+ "integrity": "sha512-LRQYrK1oH1rNfr4YvWBmRzTL0LN9UAPxBbghgeFRBm5yloF6P+zv1tm2pe2hQTX/QP5bSKdnajCvfnScgKXMZQ==",
14874− "requires": {
14878+ "requires": {
14875− "@docusaurus/core": "2.4.1",
14879+ "@docusaurus/core": "2.4.3",
14876− "@docusaurus/logger": "2.4.1",
14880+ "@docusaurus/logger": "2.4.3",
14877− "@docusaurus/types": "2.4.1",
14881+ "@docusaurus/types": "2.4.3",
14878− "@docusaurus/utils": "2.4.1",
14882+ "@docusaurus/utils": "2.4.3",
14879− "@docusaurus/utils-common": "2.4.1",
14883+ "@docusaurus/utils-common": "2.4.3",
14880− "@docusaurus/utils-validation": "2.4.1",
14884+ "@docusaurus/utils-validation": "2.4.3",
14881 "fs-extra": "^10.1.0",
14885 "fs-extra": "^10.1.0",
14882 "sitemap": "^7.1.1",
14886 "sitemap": "^7.1.1",
14883 "tslib": "^2.4.0"
14887 "tslib": "^2.4.0"
@@ -14891,23 +14895,23 @@
14891 }
14895 }
14892 },
14896 },
14893 "@docusaurus/preset-classic": {
14897 "@docusaurus/preset-classic": {
14894− "version": "2.4.1",
14898+ "version": "2.4.3",
14895− "resolved": "https://registry.npmjs.org/@docusaurus/preset-classic/-/preset-classic-2.4.1.tgz",
14899+ "resolved": "https://registry.npmjs.org/@docusaurus/preset-classic/-/preset-classic-2.4.3.tgz",
14896− "integrity": "sha512-P4//+I4zDqQJ+UDgoFrjIFaQ1MeS9UD1cvxVQaI6O7iBmiHQm0MGROP1TbE7HlxlDPXFJjZUK3x3cAoK63smGQ==",
14900+ "integrity": "sha512-tRyMliepY11Ym6hB1rAFSNGwQDpmszvWYJvlK1E+md4SW8i6ylNHtpZjaYFff9Mdk3i/Pg8ItQq9P0daOJAvQw==",
14897− "requires": {
14901+ "requires": {
14898− "@docusaurus/core": "2.4.1",
14902+ "@docusaurus/core": "2.4.3",
14899− "@docusaurus/plugin-content-blog": "2.4.1",
14903+ "@docusaurus/plugin-content-blog": "2.4.3",
14900− "@docusaurus/plugin-content-docs": "2.4.1",
14904+ "@docusaurus/plugin-content-docs": "2.4.3",
14901− "@docusaurus/plugin-content-pages": "2.4.1",
14905+ "@docusaurus/plugin-content-pages": "2.4.3",
14902− "@docusaurus/plugin-debug": "2.4.1",
14906+ "@docusaurus/plugin-debug": "2.4.3",
14903− "@docusaurus/plugin-google-analytics": "2.4.1",
14907+ "@docusaurus/plugin-google-analytics": "2.4.3",
14904− "@docusaurus/plugin-google-gtag": "2.4.1",
14908+ "@docusaurus/plugin-google-gtag": "2.4.3",
14905− "@docusaurus/plugin-google-tag-manager": "2.4.1",
14909+ "@docusaurus/plugin-google-tag-manager": "2.4.3",
14906− "@docusaurus/plugin-sitemap": "2.4.1",
14910+ "@docusaurus/plugin-sitemap": "2.4.3",
14907− "@docusaurus/theme-classic": "2.4.1",
14911+ "@docusaurus/theme-classic": "2.4.3",
14908− "@docusaurus/theme-common": "2.4.1",
14912+ "@docusaurus/theme-common": "2.4.3",
14909− "@docusaurus/theme-search-algolia": "2.4.1",
14913+ "@docusaurus/theme-search-algolia": "2.4.3",
14910− "@docusaurus/types": "2.4.1"
14914+ "@docusaurus/types": "2.4.3"
14911 }
14915 }
14912 },
14916 },
14913 "@docusaurus/react-loadable": {
14917 "@docusaurus/react-loadable": {
@@ -14920,22 +14924,22 @@
14920 }
14924 }
14921 },
14925 },
14922 "@docusaurus/theme-classic": {
14926 "@docusaurus/theme-classic": {
14923− "version": "2.4.1",
14927+ "version": "2.4.3",
14924− "resolved": "https://registry.npmjs.org/@docusaurus/theme-classic/-/theme-classic-2.4.1.tgz",
14928+ "resolved": "https://registry.npmjs.org/@docusaurus/theme-classic/-/theme-classic-2.4.3.tgz",
14925− "integrity": "sha512-Rz0wKUa+LTW1PLXmwnf8mn85EBzaGSt6qamqtmnh9Hflkc+EqiYMhtUJeLdV+wsgYq4aG0ANc+bpUDpsUhdnwg==",
14929+ "integrity": "sha512-QKRAJPSGPfDY2yCiPMIVyr+MqwZCIV2lxNzqbyUW0YkrlmdzzP3WuQJPMGLCjWgQp/5c9kpWMvMxjhpZx1R32Q==",
14926− "requires": {
14930+ "requires": {
14927− "@docusaurus/core": "2.4.1",
14931+ "@docusaurus/core": "2.4.3",
14928− "@docusaurus/mdx-loader": "2.4.1",
14932+ "@docusaurus/mdx-loader": "2.4.3",
14929− "@docusaurus/module-type-aliases": "2.4.1",
14933+ "@docusaurus/module-type-aliases": "2.4.3",
14930− "@docusaurus/plugin-content-blog": "2.4.1",
14934+ "@docusaurus/plugin-content-blog": "2.4.3",
14931− "@docusaurus/plugin-content-docs": "2.4.1",
14935+ "@docusaurus/plugin-content-docs": "2.4.3",
14932− "@docusaurus/plugin-content-pages": "2.4.1",
14936+ "@docusaurus/plugin-content-pages": "2.4.3",
14933− "@docusaurus/theme-common": "2.4.1",
14937+ "@docusaurus/theme-common": "2.4.3",
14934− "@docusaurus/theme-translations": "2.4.1",
14938+ "@docusaurus/theme-translations": "2.4.3",
14935− "@docusaurus/types": "2.4.1",
14939+ "@docusaurus/types": "2.4.3",
14936− "@docusaurus/utils": "2.4.1",
14940+ "@docusaurus/utils": "2.4.3",
14937− "@docusaurus/utils-common": "2.4.1",
14941+ "@docusaurus/utils-common": "2.4.3",
14938− "@docusaurus/utils-validation": "2.4.1",
14942+ "@docusaurus/utils-validation": "2.4.3",
14939 "@mdx-js/react": "^1.6.22",
14943 "@mdx-js/react": "^1.6.22",
14940 "clsx": "^1.2.1",
14944 "clsx": "^1.2.1",
14941 "copy-text-to-clipboard": "^3.0.1",
14945 "copy-text-to-clipboard": "^3.0.1",
@@ -14959,17 +14963,17 @@
14959 }
14963 }
14960 },
14964 },
14961 "@docusaurus/theme-common": {
14965 "@docusaurus/theme-common": {
14962− "version": "2.4.1",
14966+ "version": "2.4.3",
14963− "resolved": "https://registry.npmjs.org/@docusaurus/theme-common/-/theme-common-2.4.1.tgz",
14967+ "resolved": "https://registry.npmjs.org/@docusaurus/theme-common/-/theme-common-2.4.3.tgz",
14964− "integrity": "sha512-G7Zau1W5rQTaFFB3x3soQoZpkgMbl/SYNG8PfMFIjKa3M3q8n0m/GRf5/H/e5BqOvt8c+ZWIXGCiz+kUCSHovA==",
14968+ "integrity": "sha512-7KaDJBXKBVGXw5WOVt84FtN8czGWhM0lbyWEZXGp8AFfL6sZQfRTluFp4QriR97qwzSyOfQb+nzcDZZU4tezUw==",
14965− "requires": {
14969+ "requires": {
14966− "@docusaurus/mdx-loader": "2.4.1",
14970+ "@docusaurus/mdx-loader": "2.4.3",
14967− "@docusaurus/module-type-aliases": "2.4.1",
14971+ "@docusaurus/module-type-aliases": "2.4.3",
14968− "@docusaurus/plugin-content-blog": "2.4.1",
14972+ "@docusaurus/plugin-content-blog": "2.4.3",
14969− "@docusaurus/plugin-content-docs": "2.4.1",
14973+ "@docusaurus/plugin-content-docs": "2.4.3",
14970− "@docusaurus/plugin-content-pages": "2.4.1",
14974+ "@docusaurus/plugin-content-pages": "2.4.3",
14971− "@docusaurus/utils": "2.4.1",
14975+ "@docusaurus/utils": "2.4.3",
14972− "@docusaurus/utils-common": "2.4.1",
14976+ "@docusaurus/utils-common": "2.4.3",
14973 "@types/history": "^4.7.11",
14977 "@types/history": "^4.7.11",
14974 "@types/react": "*",
14978 "@types/react": "*",
14975 "@types/react-router-config": "*",
14979 "@types/react-router-config": "*",
@@ -14989,18 +14993,18 @@
14989 }
14993 }
14990 },
14994 },
14991 "@docusaurus/theme-search-algolia": {
14995 "@docusaurus/theme-search-algolia": {
14992− "version": "2.4.1",
14996+ "version": "2.4.3",
14993− "resolved": "https://registry.npmjs.org/@docusaurus/theme-search-algolia/-/theme-search-algolia-2.4.1.tgz",
14997+ "resolved": "https://registry.npmjs.org/@docusaurus/theme-search-algolia/-/theme-search-algolia-2.4.3.tgz",
14994− "integrity": "sha512-6BcqW2lnLhZCXuMAvPRezFs1DpmEKzXFKlYjruuas+Xy3AQeFzDJKTJFIm49N77WFCTyxff8d3E4Q9pi/+5McQ==",
14998+ "integrity": "sha512-jziq4f6YVUB5hZOB85ELATwnxBz/RmSLD3ksGQOLDPKVzat4pmI8tddNWtriPpxR04BNT+ZfpPUMFkNFetSW1Q==",
14995 "requires": {
14999 "requires": {
14996 "@docsearch/react": "^3.1.1",
15000 "@docsearch/react": "^3.1.1",
14997− "@docusaurus/core": "2.4.1",
15001+ "@docusaurus/core": "2.4.3",
14998− "@docusaurus/logger": "2.4.1",
15002+ "@docusaurus/logger": "2.4.3",
14999− "@docusaurus/plugin-content-docs": "2.4.1",
15003+ "@docusaurus/plugin-content-docs": "2.4.3",
15000− "@docusaurus/theme-common": "2.4.1",
15004+ "@docusaurus/theme-common": "2.4.3",
15001− "@docusaurus/theme-translations": "2.4.1",
15005+ "@docusaurus/theme-translations": "2.4.3",
15002− "@docusaurus/utils": "2.4.1",
15006+ "@docusaurus/utils": "2.4.3",
15003− "@docusaurus/utils-validation": "2.4.1",
15007+ "@docusaurus/utils-validation": "2.4.3",
15004 "algoliasearch": "^4.13.1",
15008 "algoliasearch": "^4.13.1",
15005 "algoliasearch-helper": "^3.10.0",
15009 "algoliasearch-helper": "^3.10.0",
15006 "clsx": "^1.2.1",
15010 "clsx": "^1.2.1",
@@ -15019,9 +15023,9 @@
15019 }
15023 }
15020 },
15024 },
15021 "@docusaurus/theme-translations": {
15025 "@docusaurus/theme-translations": {
15022− "version": "2.4.1",
15026+ "version": "2.4.3",
15023− "resolved": "https://registry.npmjs.org/@docusaurus/theme-translations/-/theme-translations-2.4.1.tgz",
15027+ "resolved": "https://registry.npmjs.org/@docusaurus/theme-translations/-/theme-translations-2.4.3.tgz",
15024− "integrity": "sha512-T1RAGP+f86CA1kfE8ejZ3T3pUU3XcyvrGMfC/zxCtc2BsnoexuNI9Vk2CmuKCb+Tacvhxjv5unhxXce0+NKyvA==",
15028+ "integrity": "sha512-H4D+lbZbjbKNS/Zw1Lel64PioUAIT3cLYYJLUf3KkuO/oc9e0QCVhIYVtUI2SfBCF2NNdlyhBDQEEMygsCedIg==",
15025 "requires": {
15029 "requires": {
15026 "fs-extra": "^10.1.0",
15030 "fs-extra": "^10.1.0",
15027 "tslib": "^2.4.0"
15031 "tslib": "^2.4.0"
@@ -15035,9 +15039,9 @@
15035 }
15039 }
15036 },
15040 },
15037 "@docusaurus/types": {
15041 "@docusaurus/types": {
15038− "version": "2.4.1",
15042+ "version": "2.4.3",
15039− "resolved": "https://registry.npmjs.org/@docusaurus/types/-/types-2.4.1.tgz",
15043+ "resolved": "https://registry.npmjs.org/@docusaurus/types/-/types-2.4.3.tgz",
15040− "integrity": "sha512-0R+cbhpMkhbRXX138UOc/2XZFF8hiZa6ooZAEEJFp5scytzCw4tC1gChMFXrpa3d2tYE6AX8IrOEpSonLmfQuQ==",
15044+ "integrity": "sha512-W6zNLGQqfrp/EoPD0bhb9n7OobP+RHpmvVzpA+Z/IuU3Q63njJM24hmT0GYboovWcDtFmnIJC9wcyx4RVPQscw==",
15041 "requires": {
15045 "requires": {
15042 "@types/history": "^4.7.11",
15046 "@types/history": "^4.7.11",
15043 "@types/react": "*",
15047 "@types/react": "*",
@@ -15050,11 +15054,11 @@
15050 }
15054 }
15051 },
15055 },
15052 "@docusaurus/utils": {
15056 "@docusaurus/utils": {
15053− "version": "2.4.1",
15057+ "version": "2.4.3",
15054− "resolved": "https://registry.npmjs.org/@docusaurus/utils/-/utils-2.4.1.tgz",
15058+ "resolved": "https://registry.npmjs.org/@docusaurus/utils/-/utils-2.4.3.tgz",
15055− "integrity": "sha512-1lvEZdAQhKNht9aPXPoh69eeKnV0/62ROhQeFKKxmzd0zkcuE/Oc5Gpnt00y/f5bIsmOsYMY7Pqfm/5rteT5GA==",
15059+ "integrity": "sha512-fKcXsjrD86Smxv8Pt0TBFqYieZZCPh4cbf9oszUq/AMhZn3ujwpKaVYZACPX8mmjtYx0JOgNx52CREBfiGQB4A==",
15056 "requires": {
15060 "requires": {
15057− "@docusaurus/logger": "2.4.1",
15061+ "@docusaurus/logger": "2.4.3",
15058 "@svgr/webpack": "^6.2.1",
15062 "@svgr/webpack": "^6.2.1",
15059 "escape-string-regexp": "^4.0.0",
15063 "escape-string-regexp": "^4.0.0",
15060 "file-loader": "^6.2.0",
15064 "file-loader": "^6.2.0",
@@ -15080,9 +15084,9 @@
15080 }
15084 }
15081 },
15085 },
15082 "@docusaurus/utils-common": {
15086 "@docusaurus/utils-common": {
15083− "version": "2.4.1",
15087+ "version": "2.4.3",
15084− "resolved": "https://registry.npmjs.org/@docusaurus/utils-common/-/utils-common-2.4.1.tgz",
15088+ "resolved": "https://registry.npmjs.org/@docusaurus/utils-common/-/utils-common-2.4.3.tgz",
15085− "integrity": "sha512-bCVGdZU+z/qVcIiEQdyx0K13OC5mYwxhSuDUR95oFbKVuXYRrTVrwZIqQljuo1fyJvFTKHiL9L9skQOPokuFNQ==",
15089+ "integrity": "sha512-/jascp4GbLQCPVmcGkPzEQjNaAk3ADVfMtudk49Ggb+131B1WDD6HqlSmDf8MxGdy7Dja2gc+StHf01kiWoTDQ==",
15086 "requires": {
15090 "requires": {
15087 "tslib": "^2.4.0"
15091 "tslib": "^2.4.0"
15088 },
15092 },
@@ -15095,12 +15099,12 @@
15095 }
15099 }
15096 },
15100 },
15097 "@docusaurus/utils-validation": {
15101 "@docusaurus/utils-validation": {
15098− "version": "2.4.1",
15102+ "version": "2.4.3",
15099− "resolved": "https://registry.npmjs.org/@docusaurus/utils-validation/-/utils-validation-2.4.1.tgz",
15103+ "resolved": "https://registry.npmjs.org/@docusaurus/utils-validation/-/utils-validation-2.4.3.tgz",
15100− "integrity": "sha512-unII3hlJlDwZ3w8U+pMO3Lx3RhI4YEbY3YNsQj4yzrkZzlpqZOLuAiZK2JyULnD+TKbceKU0WyWkQXtYbLNDFA==",
15104+ "integrity": "sha512-G2+Vt3WR5E/9drAobP+hhZQMaswRwDlp6qOMi7o7ZypB+VO7N//DZWhZEwhcRGepMDJGQEwtPv7UxtYwPL9PBw==",
15101 "requires": {
15105 "requires": {
15102− "@docusaurus/logger": "2.4.1",
15106+ "@docusaurus/logger": "2.4.3",
15103− "@docusaurus/utils": "2.4.1",
15107+ "@docusaurus/utils": "2.4.3",
15104 "joi": "^17.6.0",
15108 "joi": "^17.6.0",
15105 "js-yaml": "^4.1.0",
15109 "js-yaml": "^4.1.0",
15106 "tslib": "^2.4.0"
15110 "tslib": "^2.4.0"
@@ -15848,9 +15852,9 @@
15848 "integrity": "sha512-wWKOClTTiizcZhXnPY4wikVAwmdYHp8q6DmC+EJUzAMsycb7HB32Kh9RN4+0gExjmPmZSAQjgURXIGATPegAvA=="
15852 "integrity": "sha512-wWKOClTTiizcZhXnPY4wikVAwmdYHp8q6DmC+EJUzAMsycb7HB32Kh9RN4+0gExjmPmZSAQjgURXIGATPegAvA=="
15849 },
15853 },
15850 "@types/sax": {
15854 "@types/sax": {
15851− "version": "1.2.4",
15855+ "version": "1.2.6",
15852− "resolved": "https://registry.npmjs.org/@types/sax/-/sax-1.2.4.tgz",
15856+ "resolved": "https://registry.npmjs.org/@types/sax/-/sax-1.2.6.tgz",
15853− "integrity": "sha512-pSAff4IAxJjfAXUG6tFkO7dsSbTmf8CtUpfhhZ5VhkRpC4628tJhh3+V6H1E+/Gs9piSzYKT5yzHO5M4GG9jkw==",
15857+ "integrity": "sha512-A1mpYCYu1aHFayy8XKN57ebXeAbh9oQIZ1wXcno6b1ESUAfMBDMx7mf/QGlYwcMRaFryh9YBuH03i/3FlPGDkQ==",
15854 "requires": {
15858 "requires": {
15855 "@types/node": "*"
15859 "@types/node": "*"
15856 }
15860 }
@@ -16145,30 +16149,30 @@
16145 "requires": {}
16149 "requires": {}
16146 },
16150 },
16147 "algoliasearch": {
16151 "algoliasearch": {
16148− "version": "4.19.1",
16152+ "version": "4.20.0",
16149− "resolved": "https://registry.npmjs.org/algoliasearch/-/algoliasearch-4.19.1.tgz",
16153+ "resolved": "https://registry.npmjs.org/algoliasearch/-/algoliasearch-4.20.0.tgz",
16150− "integrity": "sha512-IJF5b93b2MgAzcE/tuzW0yOPnuUyRgGAtaPv5UUywXM8kzqfdwZTO4sPJBzoGz1eOy6H9uEchsJsBFTELZSu+g==",
16154+ "integrity": "sha512-y+UHEjnOItoNy0bYO+WWmLWBlPwDjKHW6mNHrPi0NkuhpQOOEbrkwQH/wgKFDLh7qlKjzoKeiRtlpewDPDG23g==",
16151− "requires": {
16155+ "requires": {
16152− "@algolia/cache-browser-local-storage": "4.19.1",
16156+ "@algolia/cache-browser-local-storage": "4.20.0",
16153− "@algolia/cache-common": "4.19.1",
16157+ "@algolia/cache-common": "4.20.0",
16154− "@algolia/cache-in-memory": "4.19.1",
16158+ "@algolia/cache-in-memory": "4.20.0",
16155− "@algolia/client-account": "4.19.1",
16159+ "@algolia/client-account": "4.20.0",
16156− "@algolia/client-analytics": "4.19.1",
16160+ "@algolia/client-analytics": "4.20.0",
16157− "@algolia/client-common": "4.19.1",
16161+ "@algolia/client-common": "4.20.0",
16158− "@algolia/client-personalization": "4.19.1",
16162+ "@algolia/client-personalization": "4.20.0",
16159− "@algolia/client-search": "4.19.1",
16163+ "@algolia/client-search": "4.20.0",
16160− "@algolia/logger-common": "4.19.1",
16164+ "@algolia/logger-common": "4.20.0",
16161− "@algolia/logger-console": "4.19.1",
16165+ "@algolia/logger-console": "4.20.0",
16162− "@algolia/requester-browser-xhr": "4.19.1",
16166+ "@algolia/requester-browser-xhr": "4.20.0",
16163− "@algolia/requester-common": "4.19.1",
16167+ "@algolia/requester-common": "4.20.0",
16164− "@algolia/requester-node-http": "4.19.1",
16168+ "@algolia/requester-node-http": "4.20.0",
16165− "@algolia/transporter": "4.19.1"
16169+ "@algolia/transporter": "4.20.0"
16166 }
16170 }
16167 },
16171 },
16168 "algoliasearch-helper": {
16172 "algoliasearch-helper": {
16169− "version": "3.14.0",
16173+ "version": "3.15.0",
16170− "resolved": "https://registry.npmjs.org/algoliasearch-helper/-/algoliasearch-helper-3.14.0.tgz",
16174+ "resolved": "https://registry.npmjs.org/algoliasearch-helper/-/algoliasearch-helper-3.15.0.tgz",
16171− "integrity": "sha512-gXDXzsSS0YANn5dHr71CUXOo84cN4azhHKUbg71vAWnH+1JBiR4jf7to3t3JHXknXkbV0F7f055vUSBKrltHLQ==",
16175+ "integrity": "sha512-DGUnK3TGtDQsaUE4ayF/LjSN0DGsuYThB8WBgnnDY0Wq04K6lNVruO3LfqJOgSfDiezp+Iyt8Tj4YKHi+/ivSA==",
16172 "requires": {
16176 "requires": {
16173 "@algolia/events": "^4.0.1"
16177 "@algolia/events": "^4.0.1"
16174 }
16178 }
@@ -16239,13 +16243,13 @@
16239 "integrity": "sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg=="
16243 "integrity": "sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg=="
16240 },
16244 },
16241 "autoprefixer": {
16245 "autoprefixer": {
16242− "version": "10.4.15",
16246+ "version": "10.4.16",
16243− "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.15.tgz",
16247+ "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.16.tgz",
16244− "integrity": "sha512-KCuPB8ZCIqFdA4HwKXsvz7j6gvSDNhDP7WnUjBleRkKjPdvCmHFuQ77ocavI8FT6NdvlBnE2UFr2H4Mycn8Vew==",
16248+ "integrity": "sha512-7vd3UC6xKp0HLfua5IjZlcXvGAGy7cBAXTg2lyQ/8WpNhd6SiZ8Be+xm3FyBSYJx5GKcpRCzBh7RH4/0dnY+uQ==",
16245 "requires": {
16249 "requires": {
16246 "browserslist": "^4.21.10",
16250 "browserslist": "^4.21.10",
16247− "caniuse-lite": "^1.0.30001520",
16251+ "caniuse-lite": "^1.0.30001538",
16248− "fraction.js": "^4.2.0",
16252+ "fraction.js": "^4.3.6",
16249 "normalize-range": "^0.1.2",
16253 "normalize-range": "^0.1.2",
16250 "picocolors": "^1.0.0",
16254 "picocolors": "^1.0.0",
16251 "postcss-value-parser": "^4.2.0"
16255 "postcss-value-parser": "^4.2.0"
@@ -16567,9 +16571,9 @@
16567 }
16571 }
16568 },
16572 },
16569 "caniuse-lite": {
16573 "caniuse-lite": {
16570− "version": "1.0.30001529",
16574+ "version": "1.0.30001554",
16571− "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001529.tgz",
16575+ "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001554.tgz",
16572− "integrity": "sha512-n2pUQYGAkrLG4QYj2desAh+NqsJpHbNmVZz87imptDdxLAtjxary7Df/psdfyDGmskJK/9Dt9cPnx5RZ3CU4Og=="
16576+ "integrity": "sha512-A2E3U//MBwbJVzebddm1YfNp7Nud5Ip+IPn4BozBmn4KqVX7AvluoIDFWjsv5OkGnKUXQVmMSoMKLa3ScCblcQ=="
16573 },
16577 },
16574 "ccount": {
16578 "ccount": {
16575 "version": "1.1.0",
16579 "version": "1.1.0",
@@ -18016,9 +18020,9 @@
18016 "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow=="
18020 "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow=="
18017 },
18021 },
18018 "fraction.js": {
18022 "fraction.js": {
18019− "version": "4.3.6",
18023+ "version": "4.3.7",
18020− "resolved": "https://registry.npmjs.org/fraction.js/-/fraction.js-4.3.6.tgz",
18024+ "resolved": "https://registry.npmjs.org/fraction.js/-/fraction.js-4.3.7.tgz",
18021− "integrity": "sha512-n2aZ9tNfYDwaHhvFTkhFErqOMIb8uyzSQ+vGJBjZyanAKZVbGUQ1sngfk9FdkBw7G26O7AgNjLcecLffD1c7eg=="
18025+ "integrity": "sha512-ZsDfxO51wGAXREY55a7la9LScWpwv9RxIrYABrlvOFBlH/ShPnrtsXeuUIfXKKOVicNxQ+o8JTbJvjS4M89yew=="
18022 },
18026 },
18023 "fresh": {
18027 "fresh": {
18024 "version": "0.5.2",
18028 "version": "0.5.2",
@@ -20932,9 +20936,9 @@
20932 }
20936 }
20933 },
20937 },
20934 "search-insights": {
20938 "search-insights": {
20935− "version": "2.8.2",
20939+ "version": "2.9.0",
20936− "resolved": "https://registry.npmjs.org/search-insights/-/search-insights-2.8.2.tgz",
20940+ "resolved": "https://registry.npmjs.org/search-insights/-/search-insights-2.9.0.tgz",
20937− "integrity": "sha512-PxA9M5Q2bpBelVvJ3oDZR8nuY00Z6qwOxL53wNpgzV28M/D6u9WUbImDckjLSILBF8F1hn/mgyuUaOPtjow4Qw==",
20941+ "integrity": "sha512-bkWW9nIHOFkLwjQ1xqVaMbjjO5vhP26ERsH9Y3pKr8imthofEFIxlnOabkmGcw6ksRj9jWidcI65vvjJH/nTGg==",
20938 "peer": true
20942 "peer": true
20939 },
20943 },
20940 "section-matter": {
20944 "section-matter": {
@@ -21600,9 +21604,9 @@
21600 "peer": true
21604 "peer": true
21601 },
21605 },
21602 "ua-parser-js": {
21606 "ua-parser-js": {
21603− "version": "1.0.35",
21607+ "version": "1.0.36",
21604− "resolved": "https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-1.0.35.tgz",
21608+ "resolved": "https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-1.0.36.tgz",
21605− "integrity": "sha512-fKnGuqmTBnIE+/KXSzCn4db8RTigUzw1AN0DmdU6hJovUTbYJKyqj+8Mt1c4VfRDnOVJnENmfYkIPZ946UrSAA=="
21609+ "integrity": "sha512-znuyCIXzl8ciS3+y3fHJI/2OhQIXbXw9MWC/o3qwyR+RGppjZHrM27CGFSKCJXi2Kctiz537iOu2KnXs1lMQhw=="
21606 },
21610 },
21607 "unherit": {
21611 "unherit": {
21608 "version": "1.1.3",
21612 "version": "1.1.3",
docs/package.json+2−2
@@ -12,8 +12,8 @@
12 "serve": "docusaurus serve"
12 "serve": "docusaurus serve"
13 },
13 },
14 "dependencies": {
14 "dependencies": {
15− "@docusaurus/core": "^2.0.0-beta.15",
15+ "@docusaurus/core": "^2.4.3",
16− "@docusaurus/preset-classic": "^2.0.0-beta.15",
16+ "@docusaurus/preset-classic": "^2.4.3",
17 "@easyops-cn/docusaurus-search-local": "^0.29.0",
17 "@easyops-cn/docusaurus-search-local": "^0.29.0",
18 "@mdx-js/react": "^1.6.22",
18 "@mdx-js/react": "^1.6.22",
19 "clsx": "^1.1.1",
19 "clsx": "^1.1.1",
docs/sidebars.js+44−1
@@ -11,18 +11,61 @@ module.exports = {
11 {
11 {
12 type: 'category',
12 type: 'category',
13 label: 'Configuration',
13 label: 'Configuration',
14+ link: {
15+ type: 'doc',
16+ id: 'configuration/overview',
17+ },
14 collapsed: false,
18 collapsed: false,
15− items: ['configuration/overview', 'configuration/oauth_provider', 'configuration/session_storage', 'configuration/tls', 'configuration/alpha-config'],
19+ items: [
20+ 'configuration/overview',
21+ {
22+ type: 'category',
23+ label: 'OAuth Provider Configuration',
24+ link: {
25+ type: 'doc',
26+ id: 'configuration/providers/index',
27+ },
28+ items: [
29+ 'configuration/providers/google',
30+ 'configuration/providers/azure',
31+ 'configuration/providers/adfs',
32+ 'configuration/providers/facebook',
33+ 'configuration/providers/github',
34+ 'configuration/providers/gitea',
35+ 'configuration/providers/keycloak',
36+ 'configuration/providers/keycloak_oidc',
37+ 'configuration/providers/gitlab',
38+ 'configuration/providers/linkedin',
39+ 'configuration/providers/azure_ad',
40+ 'configuration/providers/openid_connect',
41+ 'configuration/providers/login_gov',
42+ 'configuration/providers/nextcloud',
43+ 'configuration/providers/digitalocean',
44+ 'configuration/providers/bitbucket',
45+ ],
46+ },
47+ 'configuration/session_storage',
48+ 'configuration/tls',
49+ 'configuration/alpha-config',
50+ ],
16 },
51 },
17 {
52 {
18 type: 'category',
53 type: 'category',
19 label: 'Features',
54 label: 'Features',
55+ link: {
56+ type: 'doc',
57+ id: 'features/endpoints',
58+ },
20 collapsed: false,
59 collapsed: false,
21 items: ['features/endpoints'],
60 items: ['features/endpoints'],
22 },
61 },
23 {
62 {
24 type: 'category',
63 type: 'category',
25 label: 'Community',
64 label: 'Community',
65+ link: {
66+ type: 'doc',
67+ id: 'community/security',
68+ },
26 collapsed: false,
69 collapsed: false,
27 items: ['community/security'],
70 items: ['community/security'],
28 },
71 },
pkg/apis/options/legacy_options.go+1−1
@@ -605,7 +605,7 @@ func legacyGoogleFlagSet() *pflag.FlagSet {
605 flagSet.String("google-admin-email", "", "the google admin to impersonate for api calls")
605 flagSet.String("google-admin-email", "", "the google admin to impersonate for api calls")
606 flagSet.String("google-service-account-json", "", "the path to the service account json credentials")
606 flagSet.String("google-service-account-json", "", "the path to the service account json credentials")
607 flagSet.String("google-use-application-default-credentials", "", "use application default credentials instead of service account json (i.e. GKE Workload Identity)")
607 flagSet.String("google-use-application-default-credentials", "", "use application default credentials instead of service account json (i.e. GKE Workload Identity)")
608− flagSet.String("google-target-principal", "", "the targetprincipal to impersonate when using ADC")
608+ flagSet.String("google-target-principal", "", "the target principal to impersonate when using ADC")
609
609
610 return flagSet
610 return flagSet
611}
611}
pkg/apis/options/upstreams.go+2−2
@@ -12,7 +12,7 @@ const (
12
12
13// UpstreamConfig is a collection of definitions for upstream servers.
13// UpstreamConfig is a collection of definitions for upstream servers.
14type UpstreamConfig struct {
14type UpstreamConfig struct {
15− // ProxyRawPath will pass the raw url path to upstream allowing for url's
15+ // ProxyRawPath will pass the raw url path to upstream allowing for urls
16 // like: "/%2F/" which would otherwise be redirected to "/"
16 // like: "/%2F/" which would otherwise be redirected to "/"
17 ProxyRawPath bool `json:"proxyRawPath,omitempty"`
17 ProxyRawPath bool `json:"proxyRawPath,omitempty"`
18
18
@@ -60,7 +60,7 @@ type Upstream struct {
60
60
61 // InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.
61 // InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.
62 // This option is insecure and will allow potential Man-In-The-Middle attacks
62 // This option is insecure and will allow potential Man-In-The-Middle attacks
63− // betweem OAuth2 Proxy and the usptream server.
63+ // between OAuth2 Proxy and the upstream server.
64 // Defaults to false.
64 // Defaults to false.
65 InsecureSkipTLSVerify bool `json:"insecureSkipTLSVerify,omitempty"`
65 InsecureSkipTLSVerify bool `json:"insecureSkipTLSVerify,omitempty"`
66
66