@@ -1,11 +1,13 @@
1−oauth2_proxy
2−=================
1+# oauth2_proxy
32
43A reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others)
54to validate accounts by email, domain or group.
65
7−[](http://travis-ci.org/bitly/oauth2_proxy)
6+**Note:** This repository was forked from [Bitly/OAuth2_Proxy](https://github.com/bitly/oauth2_proxy) on 27/11/2018.
7+Versions v3.0.0 and up are from this fork and will have diverged from any changes in the original fork.
8+A list of changes can be seen in the [CHANGELOG](CHANGELOG.md).
89
10+[](http://travis-ci.org/bitly/oauth2_proxy)
911
1012
1113
@@ -15,15 +17,17 @@ to validate accounts by email, domain or group.
1517
1618## Installation
1719
18−1. Download [Prebuilt Binary](https://github.com/bitly/oauth2_proxy/releases) (current release is `v2.2`) or build with `$ go get github.com/bitly/oauth2_proxy` which will put the binary in `$GOROOT/bin`
19−Prebuilt binaries can be validated by extracting the file and verifying it against the `sha256sum.txt` checksum file provided for each release starting with version `v2.3`.
20+1. Download [Prebuilt Binary](https://github.com/bitly/oauth2_proxy/releases) (current release is `v2.2`) or build with `$ go get github.com/bitly/oauth2_proxy` which will put the binary in `$GOROOT/bin`
21+ Prebuilt binaries can be validated by extracting the file and verifying it against the `sha256sum.txt` checksum file provided for each release starting with version `v2.3`.
22+
2023```
2124sha256sum -c sha256sum.txt 2>&1 | grep OK
2225oauth2_proxy-2.3.linux-amd64: OK
2326```
24−2. Select a Provider and Register an OAuth Application with a Provider
25−3. Configure OAuth2 Proxy using config file, command line options, or environment variables
26−4. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
27+
28+2. Select a Provider and Register an OAuth Application with a Provider
29+3. Configure OAuth2 Proxy using config file, command line options, or environment variables
30+4. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
2731
2832## OAuth Provider Configuration
2933
@@ -31,12 +35,12 @@ You will need to register an OAuth application with a Provider (Google, GitHub o
3135
3236Valid providers are :
3337
34−* [Google](#google-auth-provider) *default*
35−* [Azure](#azure-auth-provider)
36−* [Facebook](#facebook-auth-provider)
37−* [GitHub](#github-auth-provider)
38−* [GitLab](#gitlab-auth-provider)
39−* [LinkedIn](#linkedin-auth-provider)
38+- [Google](#google-auth-provider) _default_
39+- [Azure](#azure-auth-provider)
40+- [Facebook](#facebook-auth-provider)
41+- [GitHub](#github-auth-provider)
42+- [GitLab](#gitlab-auth-provider)
43+- [LinkedIn](#linkedin-auth-provider)
4044
4145The provider can be selected using the `provider` configuration value.
4246
@@ -44,61 +48,62 @@ The provider can be selected using the `provider` configuration value.
4448
4549For Google, the registration steps are:
4650
47−1. Create a new project: https://console.developers.google.com/project
48−2. Choose the new project from the top right project dropdown (only if another project is selected)
49−3. In the project Dashboard center pane, choose **"API Manager"**
50−4. In the left Nav pane, choose **"Credentials"**
51−5. In the center pane, choose **"OAuth consent screen"** tab. Fill in **"Product name shown to users"** and hit save.
52−6. In the center pane, choose **"Credentials"** tab.
53− * Open the **"New credentials"** drop down
54− * Choose **"OAuth client ID"**
55− * Choose **"Web application"**
56− * Application name is freeform, choose something appropriate
57− * Authorized JavaScript origins is your domain ex: `https://internal.yourcompany.com`
58− * Authorized redirect URIs is the location of oauth2/callback ex: `https://internal.yourcompany.com/oauth2/callback`
59− * Choose **"Create"**
60−4. Take note of the **Client ID** and **Client Secret**
51+1. Create a new project: https://console.developers.google.com/project
52+2. Choose the new project from the top right project dropdown (only if another project is selected)
53+3. In the project Dashboard center pane, choose **"API Manager"**
54+4. In the left Nav pane, choose **"Credentials"**
55+5. In the center pane, choose **"OAuth consent screen"** tab. Fill in **"Product name shown to users"** and hit save.
56+6. In the center pane, choose **"Credentials"** tab.
57+ - Open the **"New credentials"** drop down
58+ - Choose **"OAuth client ID"**
59+ - Choose **"Web application"**
60+ - Application name is freeform, choose something appropriate
61+ - Authorized JavaScript origins is your domain ex: `https://internal.yourcompany.com`
62+ - Authorized redirect URIs is the location of oauth2/callback ex: `https://internal.yourcompany.com/oauth2/callback`
63+ - Choose **"Create"**
64+7. Take note of the **Client ID** and **Client Secret**
6165
6266It's recommended to refresh sessions on a short interval (1h) with `cookie-refresh` setting which validates that the account is still authorized.
6367
6468#### Restrict auth to specific Google groups on your domain. (optional)
6569
66−1. Create a service account: https://developers.google.com/identity/protocols/OAuth2ServiceAccount and make sure to download the json file.
67−2. Make note of the Client ID for a future step.
68−3. Under "APIs & Auth", choose APIs.
69−4. Click on Admin SDK and then Enable API.
70−5. Follow the steps on https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account and give the client id from step 2 the following oauth scopes:
70+1. Create a service account: https://developers.google.com/identity/protocols/OAuth2ServiceAccount and make sure to download the json file.
71+2. Make note of the Client ID for a future step.
72+3. Under "APIs & Auth", choose APIs.
73+4. Click on Admin SDK and then Enable API.
74+5. Follow the steps on https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account and give the client id from step 2 the following oauth scopes:
75+
7176```
7277https://www.googleapis.com/auth/admin.directory.group.readonly
7378https://www.googleapis.com/auth/admin.directory.user.readonly
7479```
75−6. Follow the steps on https://support.google.com/a/answer/60757 to enable Admin API access.
76−7. Create or choose an existing administrative email address on the Gmail domain to assign to the ```google-admin-email``` flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why.
77−8. Create or choose an existing email group and set that email to the ```google-group``` flag. You can pass multiple instances of this flag with different groups
78−and the user will be checked against all the provided groups.
79−9. Lock down the permissions on the json file downloaded from step 1 so only oauth2_proxy is able to read the file and set the path to the file in the ```google-service-account-json``` flag.
80+
81+6. Follow the steps on https://support.google.com/a/answer/60757 to enable Admin API access.
82+7. Create or choose an existing administrative email address on the Gmail domain to assign to the `google-admin-email` flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why.
83+8. Create or choose an existing email group and set that email to the `google-group` flag. You can pass multiple instances of this flag with different groups
84+ and the user will be checked against all the provided groups.
85+9. Lock down the permissions on the json file downloaded from step 1 so only oauth2_proxy is able to read the file and set the path to the file in the `google-service-account-json` flag.
808610. Restart oauth2_proxy.
8187
8288Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour ).
8389
8490### Azure Auth Provider
8591
86−1. [Add an application](https://azure.microsoft.com/en-us/documentation/articles/active-directory-integrating-applications/) to your Azure Active Directory tenant.
87−2. On the App properties page provide the correct Sign-On URL ie `https://internal.yourcompany.com/oauth2/callback`
88−3. If applicable take note of your `TenantID` and provide it via the `--azure-tenant=<YOUR TENANT ID>` commandline option. Default the `common` tenant is used.
92+1. [Add an application](https://azure.microsoft.com/en-us/documentation/articles/active-directory-integrating-applications/) to your Azure Active Directory tenant.
93+2. On the App properties page provide the correct Sign-On URL ie `https://internal.yourcompany.com/oauth2/callback`
94+3. If applicable take note of your `TenantID` and provide it via the `--azure-tenant=<YOUR TENANT ID>` commandline option. Default the `common` tenant is used.
8995
9096The Azure AD auth provider uses `openid` as it default scope. It uses `https://graph.windows.net` as a default protected resource. It call to `https://graph.windows.net/me` to get the email address of the user that logs in.
9197
92−
9398### Facebook Auth Provider
9499
95−1. Create a new FB App from <https://developers.facebook.com/>
96−2. Under FB Login, set your Valid OAuth redirect URIs to `https://internal.yourcompany.com/oauth2/callback`
100+1. Create a new FB App from <https://developers.facebook.com/>
101+2. Under FB Login, set your Valid OAuth redirect URIs to `https://internal.yourcompany.com/oauth2/callback`
97102
98103### GitHub Auth Provider
99104
100−1. Create a new project: https://github.com/settings/developers
101−2. Under `Authorization callback URL` enter the correct url ie `https://internal.yourcompany.com/oauth2/callback`
105+1. Create a new project: https://github.com/settings/developers
106+2. Under `Authorization callback URL` enter the correct url ie `https://internal.yourcompany.com/oauth2/callback`
102107
103108The GitHub auth provider supports two additional parameters to restrict authentication to Organization or Team level access. Restricting by org and team is normally accompanied with `--email-domain=*`
104109
@@ -121,17 +126,16 @@ If you are using self-hosted GitLab, make sure you set the following to the appr
121126 -redeem-url="<your gitlab url>/oauth/token"
122127 -validate-url="<your gitlab url>/api/v4/user"
123128
124−
125129### LinkedIn Auth Provider
126130
127131For LinkedIn, the registration steps are:
128132
129−1. Create a new project: https://www.linkedin.com/secure/developer
130−2. In the OAuth User Agreement section:
131− * In default scope, select r_basicprofile and r_emailaddress.
132− * In "OAuth 2.0 Redirect URLs", enter `https://internal.yourcompany.com/oauth2/callback`
133−3. Fill in the remaining required fields and Save.
134−4. Take note of the **Consumer Key / API Key** and **Consumer Secret / Secret Key**
133+1. Create a new project: https://www.linkedin.com/secure/developer
134+2. In the OAuth User Agreement section:
135+ - In default scope, select r_basicprofile and r_emailaddress.
136+ - In "OAuth 2.0 Redirect URLs", enter `https://internal.yourcompany.com/oauth2/callback`
137+3. Fill in the remaining required fields and Save.
138+4. Take note of the **Consumer Key / API Key** and **Consumer Secret / Secret Key**
135139
136140### Microsoft Azure AD Provider
137141
@@ -143,9 +147,9 @@ Take note of your `TenantId` if applicable for your situation. The `TenantId` ca
143147
144148OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects. This provider was originally built against CoreOS Dex and we will use it as an example.
145149
146−1. Launch a Dex instance using the [getting started guide](https://github.com/coreos/dex/blob/master/Documentation/getting-started.md).
147−2. Setup oauth2_proxy with the correct provider and using the default ports and callbacks.
148−3. Login with the fixture use in the dex guide and run the oauth2_proxy with the following args:
150+1. Launch a Dex instance using the [getting started guide](https://github.com/coreos/dex/blob/master/Documentation/getting-started.md).
151+2. Setup oauth2_proxy with the correct provider and using the default ports and callbacks.
152+3. Login with the fixture use in the dex guide and run the oauth2_proxy with the following args:
149153
150154 -provider oidc
151155 -client-id oauth2_proxy
@@ -253,7 +257,7 @@ The following environment variables can be used in place of the corresponding co
253257
254258There are two recommended configurations.
255259
256−1) Configure SSL Termination with OAuth2 Proxy by providing a `--tls-cert=/path/to/cert.pem` and `--tls-key=/path/to/cert.key`.
260+1. Configure SSL Termination with OAuth2 Proxy by providing a `--tls-cert=/path/to/cert.pem` and `--tls-key=/path/to/cert.key`.
257261
258262The command line to run `oauth2_proxy` in this configuration would look like this:
259263
@@ -270,8 +274,7 @@ The command line to run `oauth2_proxy` in this configuration would look like thi
270274 --client-secret=...
271275```
272276
273−
274−2) Configure SSL Termination with [Nginx](http://nginx.org/) (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ....
277+2. Configure SSL Termination with [Nginx](http://nginx.org/) (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ....
275278
276279Because `oauth2_proxy` listens on `127.0.0.1:4180` by default, to listen on all interfaces (needed when using an
277280external load balancer like Amazon ELB or Google Platform Load Balancing) use `--http-address="0.0.0.0:4180"` or
@@ -321,12 +324,12 @@ The command line to run `oauth2_proxy` in this configuration would look like thi
321324
322325OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The `/oauth2` prefix can be changed with the `--proxy-prefix` config variable.
323326
324−* /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see [robotstxt.org](http://www.robotstxt.org/) for more info
325−* /ping - returns an 200 OK response
326−* /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
327−* /oauth2/start - a URL that will redirect to start the OAuth cycle
328−* /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
329−* /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the [Nginx `auth_request` directive](#nginx-auth-request)
327+- /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see [robotstxt.org](http://www.robotstxt.org/) for more info
328+- /ping - returns an 200 OK response
329+- /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
330+- /oauth2/start - a URL that will redirect to start the OAuth cycle
331+- /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
332+- /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the [Nginx `auth_request` directive](#nginx-auth-request)
330333
331334## Request signatures
332335
@@ -341,9 +344,9 @@ in `oauthproxy.go`](./oauthproxy.go).
341344For more information about HMAC request signature validation, read the
342345following:
343346
344−* [Amazon Web Services: Signing and Authenticating REST
347+- [Amazon Web Services: Signing and Authenticating REST
345348 Requests](https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html)
346−* [rc3.org: Using HMAC to authenticate Web service
349+- [rc3.org: Using HMAC to authenticate Web service
347350 requests](http://rc3.org/2011/12/02/using-hmac-to-authenticate-web-service-requests/)
348351
349352## Logging Format