git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #764 from lentzi90/patch-1

Document bcrypt encryption for htpasswd

commita87beab1a06a439e0cb9a47d0000032d7eafa1e1 authorJoel Speed <Joel.speed@hotmail.co.uk> dateFri 11 Sep 2020, 14:26 (6 years ago) parentef08d01e14d6ab
4 files changed+5−3
compare with master
unifiedsplit
CHANGELOG.md+2 contrib/oauth2-proxy.cfg.example+1−1 docs/configuration/configuration.md+1−1 pkg/apis/options/options.go+1−1
CHANGELOG.md+2
@@ -8,6 +8,8 @@
88
99## Changes since v6.1.1
1010
11+- [#764](https://github.com/oauth2-proxy/oauth2-proxy/pull/764) Document bcrypt encryption for htpasswd (and hide SHA) (@lentzi90)
12+
1113# v6.1.1
1214
1315## Release Highlights
contrib/oauth2-proxy.cfg.example+1−1
@@ -59,7 +59,7 @@
5959# authenticated_emails_file = ""
6060
6161## Htpasswd File (optional)
62−## Additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption
62+## Additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -B" for bcrypt encryption
6363## enabling exposes a username/login signin form
6464# htpasswd_file = ""
6565
docs/configuration/configuration.md+1−1
@@ -62,7 +62,7 @@ An example [oauth2-proxy.cfg]({{ site.gitweb }}/contrib/oauth2-proxy.cfg.example
6262| `--google-admin-email` | string | the google admin to impersonate for api calls | |
6363| `--google-group` | string | restrict logins to members of this google group (may be given multiple times). | |
6464| `--google-service-account-json` | string | the path to the service account json credentials | |
65−| `--htpasswd-file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -s` for SHA encryption | |
65+| `--htpasswd-file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
6666| `--http-address` | string | `[http://]<addr>:<port>` or `unix://<path>` to listen on for HTTP clients | `"127.0.0.1:4180"` |
6767| `--https-address` | string | `<addr>:<port>` to listen on for HTTPS clients | `":443"` |
6868| `--logging-compress` | bool | Should rotated log files be compressed using gzip | false |
pkg/apis/options/options.go+1−1
@@ -219,7 +219,7 @@ func NewFlagSet() *pflag.FlagSet {
219219 flagSet.String("client-secret", "", "the OAuth Client Secret")
220220 flagSet.String("client-secret-file", "", "the file with OAuth Client Secret")
221221 flagSet.String("authenticated-emails-file", "", "authenticate against emails via file (one per line)")
222− flagSet.String("htpasswd-file", "", "additionally authenticate against a htpasswd file. Entries must be created with \"htpasswd -s\" for SHA encryption or \"htpasswd -B\" for bcrypt encryption")
222+ flagSet.String("htpasswd-file", "", "additionally authenticate against a htpasswd file. Entries must be created with \"htpasswd -B\" for bcrypt encryption")
223223 flagSet.Bool("display-htpasswd-form", true, "display username / password login form if an htpasswd file is provided")
224224 flagSet.String("custom-templates-dir", "", "path to custom html templates")
225225 flagSet.String("banner", "", "custom banner string. Use \"-\" to disable default banner.")