@@ -1,8 +1,6 @@
11oauth2_proxy
22=================
33
4−<small>(This project was renamed from Google Auth Proxy - May 2015)</small>
5−
64A reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others)
75to validate accounts by email, domain or group.
86
@@ -17,7 +15,7 @@ to validate accounts by email, domain or group.
1715
1816## Installation
1917
20−1. Download [Prebuilt Binary](https://github.com/bitly/oauth2_proxy/releases) (current release is `v2.1`) or build with `$ go get github.com/bitly/oauth2_proxy` which will put the binary in `$GOROOT/bin`
18+1. Download [Prebuilt Binary](https://github.com/bitly/oauth2_proxy/releases) (current release is `v2.2`) or build with `$ go get github.com/bitly/oauth2_proxy` which will put the binary in `$GOROOT/bin`
21192. Select a Provider and Register an OAuth Application with a Provider
22203. Configure OAuth2 Proxy using config file, command line options, or environment variables
23214. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
@@ -159,54 +157,56 @@ An example [oauth2_proxy.cfg](contrib/oauth2_proxy.cfg.example) config file is i
159157
160158```
161159Usage of oauth2_proxy:
162− -approval-prompt="force": Oauth approval_prompt
163− -authenticated-emails-file="": authenticate against emails via file (one per line)
164− -azure-tenant="common": go to a tenant-specific or common (tenant-independent) endpoint.
165− -basic-auth-password="": the password to set when passing the HTTP Basic Auth header
166− -client-id="": the OAuth Client ID: ie: "123456.apps.googleusercontent.com"
167− -client-secret="": the OAuth Client Secret
168− -config="": path to config file
169− -cookie-domain="": an optional cookie domain to force cookies to (ie: .yourcompany.com)*
170− -cookie-expire=168h0m0s: expire timeframe for cookie
171− -cookie-httponly=true: set HttpOnly cookie flag
172− -cookie-name="_oauth2_proxy": the name of the cookie that the oauth_proxy creates
173− -cookie-refresh=0: refresh the cookie after this duration; 0 to disable
174− -cookie-secret="": the seed string for secure cookies
175− -cookie-secure=true: set secure (HTTPS) cookie flag
176− -custom-templates-dir="": path to custom html templates
177− -display-htpasswd-form=true: display username / password login form if an htpasswd file is provided
178− -email-domain=: authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email
179− -github-org="": restrict logins to members of this organisation
180− -github-team="": restrict logins to members of this team
181− -google-admin-email="": the google admin to impersonate for api calls
182− -google-group=: restrict logins to members of this google group (may be given multiple times).
183− -google-service-account-json="": the path to the service account json credentials
184− -htpasswd-file="": additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption
185− -http-address="127.0.0.1:4180": [http://]<addr>:<port> or unix://<path> to listen on for HTTP clients
186− -https-address=":443": <addr>:<port> to listen on for HTTPS clients
187− -login-url="": Authentication endpoint
188− -pass-access-token=false: pass OAuth access_token to upstream via X-Forwarded-Access-Token header
189− -pass-basic-auth=true: pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream
190− -pass-user-headers=true: pass X-Forwarded-User and X-Forwarded-Email information to upstream
191− -pass-host-header=true: pass the request Host Header to upstream
192− -profile-url="": Profile access endpoint
193− -provider="google": OAuth provider
194− -proxy-prefix="/oauth2": the url root path that this proxy should be nested under (e.g. /<oauth2>/sign_in)
195− -redeem-url="": Token redemption endpoint
196− -redirect-url="": the OAuth Redirect URL. ie: "https://internalapp.yourcompany.com/oauth2/callback"
197− -resource="": the resource that is being protected. ie: "https://graph.windows.net". Currently only used in the Azure provider.
198− -request-logging=true: Log requests to stdout
199− -scope="": Oauth scope specification
200− -signature-key="": GAP-Signature request signature key (algorithm:secretkey)
201− -skip-auth-regex=: bypass authentication for requests path's that match (may be given multiple times)
202− -skip-auth-preflight=false: bypass authentication for OPTIONAL requests so preflight requests could succeed when using CORS
203− -skip-provider-button=false: will skip sign-in-page to directly reach the next step: oauth/start
160+ -approval-prompt string: OAuth approval_prompt (default "force")
161+ -authenticated-emails-file string: authenticate against emails via file (one per line)
162+ -azure-tenant string: go to a tenant-specific or common (tenant-independent) endpoint. (default "common")
163+ -basic-auth-password string: the password to set when passing the HTTP Basic Auth header
164+ -client-id string: the OAuth Client ID: ie: "123456.apps.googleusercontent.com"
165+ -client-secret string: the OAuth Client Secret
166+ -config string: path to config file
167+ -cookie-domain string: an optional cookie domain to force cookies to (ie: .yourcompany.com)*
168+ -cookie-expire duration: expire timeframe for cookie (default 168h0m0s)
169+ -cookie-httponly: set HttpOnly cookie flag (default true)
170+ -cookie-name string: the name of the cookie that the oauth_proxy creates (default "_oauth2_proxy")
171+ -cookie-refresh duration: refresh the cookie after this duration; 0 to disable
172+ -cookie-secret string: the seed string for secure cookies (optionally base64 encoded)
173+ -cookie-secure: set secure (HTTPS) cookie flag (default true)
174+ -custom-templates-dir string: path to custom html templates
175+ -display-htpasswd-form: display username / password login form if an htpasswd file is provided (default true)
176+ -email-domain value: authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email
177+ -footer string: custom footer string. Use "-" to disable default footer.
178+ -github-org string: restrict logins to members of this organisation
179+ -github-team string: restrict logins to members of this team
180+ -google-admin-email string: the google admin to impersonate for api calls
181+ -google-group value: restrict logins to members of this google group (may be given multiple times).
182+ -google-service-account-json string: the path to the service account json credentials
183+ -htpasswd-file string: additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption
184+ -http-address string: [http://]<addr>:<port> or unix://<path> to listen on for HTTP clients (default "127.0.0.1:4180")
185+ -https-address string: <addr>:<port> to listen on for HTTPS clients (default ":443")
186+ -login-url string: Authentication endpoint
187+ -pass-access-token: pass OAuth access_token to upstream via X-Forwarded-Access-Token header
188+ -pass-basic-auth: pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream (default true)
189+ -pass-host-header: pass the request Host Header to upstream (default true)
190+ -pass-user-headers: pass X-Forwarded-User and X-Forwarded-Email information to upstream (default true)
191+ -profile-url string: Profile access endpoint
192+ -provider string: OAuth provider (default "google")
193+ -proxy-prefix string: the url root path that this proxy should be nested under (e.g. /<oauth2>/sign_in) (default "/oauth2")
194+ -redeem-url string: Token redemption endpoint
195+ -redirect-url string: the OAuth Redirect URL. ie: "https://internalapp.yourcompany.com/oauth2/callback"
196+ -request-logging: Log requests to stdout (default true)
197+ -resource string: The resource that is protected (Azure AD only)
198+ -scope string: OAuth scope specification
199+ -set-xauthrequest: set X-Auth-Request-User and X-Auth-Request-Email response headers (useful in Nginx auth_request mode)
200+ -signature-key string: GAP-Signature request signature key (algorithm:secretkey)
201+ -skip-auth-preflight: will skip authentication for OPTIONS requests
202+ -skip-auth-regex value: bypass authentication for requests path's that match (may be given multiple times)
203+ -skip-provider-button: will skip sign-in-page to directly reach the next step: oauth/start
204204 -ssl-insecure-skip-verify: skip validation of certificates presented when using HTTPS
205− -tls-cert="": path to certificate file
206− -tls-key="": path to private key file
207− -upstream=: the http url(s) of the upstream endpoint or file:// paths for static files. Routing is based on the path
208− -validate-url="": Access token validation endpoint
209− -version=false: print version string
205+ -tls-cert string: path to certificate file
206+ -tls-key string: path to private key file
207+ -upstream value: the http url(s) of the upstream endpoint or file:// paths for static files. Routing is based on the path
208+ -validate-url string: Access token validation endpoint
209+ -version: print version string
210210```
211211
212212See below for provider specific options