c186d40 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

on master help sign in

use official upstream yaml library v3

c186d40tuunit2 years ago

docs/docs/configuration/alpha_config.md+107−107

compare with master

unifiedsplit

@@ -148,7 +148,7 @@ You must remove these options before starting OAuth2 Proxy with `--alpha-config`

148

149| Field | Type | Description |

150| ----- | ---- | ----------- |

151−| `skipScope` | _bool_ | Skip adding the scope parameter in login request Default value is 'false' |

151+| `SkipScope` | _bool_ | Skip adding the scope parameter in login request Default value is 'false' |

152

153### AlphaOptions

154

@@ -163,12 +163,12 @@ They may change between releases without notice.

163

164| Field | Type | Description |

165| ----- | ---- | ----------- |

166−| `upstreamConfig` | _[UpstreamConfig](#upstreamconfig)_ | UpstreamConfig is used to configure upstream servers. Once a user is authenticated, requests to the server will be proxied to these upstream servers based on the path mappings defined in this list. |

166+| `UpstreamConfig` | _[UpstreamConfig](#upstreamconfig)_ | UpstreamConfig is used to configure upstream servers. Once a user is authenticated, requests to the server will be proxied to these upstream servers based on the path mappings defined in this list. |

167−| `injectRequestHeaders` | _[[]Header](#header)_ | InjectRequestHeaders is used to configure headers that should be added to requests to upstream servers. Headers may source values from either the authenticated user's session or from a static secret value. |

167+| `InjectRequestHeaders` | _[[]Header](#header)_ | InjectRequestHeaders is used to configure headers that should be added to requests to upstream servers. Headers may source values from either the authenticated user's session or from a static secret value. |

168−| `injectResponseHeaders` | _[[]Header](#header)_ | InjectResponseHeaders is used to configure headers that should be added to responses from the proxy. This is typically used when using the proxy as an external authentication provider in conjunction with another proxy such as NGINX and its auth_request module. Headers may source values from either the authenticated user's session or from a static secret value. |

168+| `InjectResponseHeaders` | _[[]Header](#header)_ | InjectResponseHeaders is used to configure headers that should be added to responses from the proxy. This is typically used when using the proxy as an external authentication provider in conjunction with another proxy such as NGINX and its auth_request module. Headers may source values from either the authenticated user's session or from a static secret value. |

169−| `server` | _[Server](#server)_ | Server is used to configure the HTTP(S) server for the proxy application. You may choose to run both HTTP and HTTPS servers simultaneously. This can be done by setting the BindAddress and the SecureBindAddress simultaneously. To use the secure server you must configure a TLS certificate and key. |

169+| `Server` | _[Server](#server)_ | Server is used to configure the HTTP(S) server for the proxy application. You may choose to run both HTTP and HTTPS servers simultaneously. This can be done by setting the BindAddress and the SecureBindAddress simultaneously. To use the secure server you must configure a TLS certificate and key. |

170−| `metricsServer` | _[Server](#server)_ | MetricsServer is used to configure the HTTP(S) server for metrics. You may choose to run both HTTP and HTTPS servers simultaneously. This can be done by setting the BindAddress and the SecureBindAddress simultaneously. To use the secure server you must configure a TLS certificate and key. |

170+| `MetricsServer` | _[Server](#server)_ | MetricsServer is used to configure the HTTP(S) server for metrics. You may choose to run both HTTP and HTTPS servers simultaneously. This can be done by setting the BindAddress and the SecureBindAddress simultaneously. To use the secure server you must configure a TLS certificate and key. |

171−| `providers` | _[Providers](#providers)_ | Providers is used to configure your provider. **Multiple-providers is not yet working.** [This feature is tracked in #925](https://github.com/oauth2-proxy/oauth2-proxy/issues/926) |

171+| `Providers` | _[Providers](#providers)_ | Providers is used to configure your provider. **Multiple-providers is not yet working.** [This feature is tracked in #925](https://github.com/oauth2-proxy/oauth2-proxy/issues/926) |

172

173### AzureOptions

174

@@ -178,8 +178,8 @@ They may change between releases without notice.

178

179| Field | Type | Description |

180| ----- | ---- | ----------- |

181−| `tenant` | _string_ | Tenant directs to a tenant-specific or common (tenant-independent) endpoint Default value is 'common' |

181+| `Tenant` | _string_ | Tenant directs to a tenant-specific or common (tenant-independent) endpoint Default value is 'common' |

182−| `graphGroupField` | _string_ | GraphGroupField configures the group field to be used when building the groups list from Microsoft Graph Default value is 'id' |

182+| `GraphGroupField` | _string_ | GraphGroupField configures the group field to be used when building the groups list from Microsoft Graph Default value is 'id' |

183

184### BitbucketOptions

185

@@ -189,8 +189,8 @@ They may change between releases without notice.

189

190| Field | Type | Description |

191| ----- | ---- | ----------- |

192−| `team` | _string_ | Team sets restrict logins to members of this team |

192+| `Team` | _string_ | Team sets restrict logins to members of this team |

193−| `repository` | _string_ | Repository sets restrict logins to user with access to this repository |

193+| `Repository` | _string_ | Repository sets restrict logins to user with access to this repository |

194

195### ClaimSource

196

@@ -200,9 +200,9 @@ ClaimSource allows loading a header value from a claim within the session

200

201| Field | Type | Description |

202| ----- | ---- | ----------- |

203−| `claim` | _string_ | Claim is the name of the claim in the session that the value should be loaded from. Available claims: `access_token` `id_token` `created_at` `expires_on` `refresh_token` `email` `user` `groups` `preferred_username`. |

203+| `Claim` | _string_ | Claim is the name of the claim in the session that the value should be loaded from. Available claims: `access_token` `id_token` `created_at` `expires_on` `refresh_token` `email` `user` `groups` `preferred_username`. |

204−| `prefix` | _string_ | Prefix is an optional prefix that will be prepended to the value of the claim if it is non-empty. |

204+| `Prefix` | _string_ | Prefix is an optional prefix that will be prepended to the value of the claim if it is non-empty. |

205−| `basicAuthPassword` | _[SecretSource](#secretsource)_ | BasicAuthPassword converts this claim into a basic auth header. Note the value of claim will become the basic auth username and the basicAuthPassword will be used as the password value. |

205+| `BasicAuthPassword` | _[SecretSource](#secretsource)_ | BasicAuthPassword converts this claim into a basic auth header. Note the value of claim will become the basic auth username and the basicAuthPassword will be used as the password value. |

206

207### GitHubOptions

208

@@ -212,11 +212,11 @@ ClaimSource allows loading a header value from a claim within the session

212

213| Field | Type | Description |

214| ----- | ---- | ----------- |

215−| `org` | _string_ | Org sets restrict logins to members of this organisation |

215+| `Org` | _string_ | Org sets restrict logins to members of this organisation |

216−| `team` | _string_ | Team sets restrict logins to members of this team |

216+| `Team` | _string_ | Team sets restrict logins to members of this team |

217−| `repo` | _string_ | Repo sets restrict logins to collaborators of this repository |

217+| `Repo` | _string_ | Repo sets restrict logins to collaborators of this repository |

218−| `token` | _string_ | Token is the token to use when verifying repository collaborators it must have push access to the repository |

218+| `Token` | _string_ | Token is the token to use when verifying repository collaborators it must have push access to the repository |

219−| `users` | _[]string_ | Users allows users with these usernames to login even if they do not belong to the specified org and team or collaborators |

219+| `Users` | _[]string_ | Users allows users with these usernames to login even if they do not belong to the specified org and team or collaborators |

220

221### GitLabOptions

222

@@ -226,8 +226,8 @@ ClaimSource allows loading a header value from a claim within the session

226

227| Field | Type | Description |

228| ----- | ---- | ----------- |

229−| `group` | _[]string_ | Group sets restrict logins to members of this group |

229+| `Group` | _[]string_ | Group sets restrict logins to members of this group |

230−| `projects` | _[]string_ | Projects restricts logins to members of these projects |

230+| `Projects` | _[]string_ | Projects restricts logins to members of these projects |

231

232### GoogleOptions

233

@@ -237,13 +237,13 @@ ClaimSource allows loading a header value from a claim within the session

237

238| Field | Type | Description |

239| ----- | ---- | ----------- |

240−| `group` | _[]string_ | Groups sets restrict logins to members of this Google group |

240+| `Groups` | _[]string_ | Groups sets restrict logins to members of this Google group |

241−| `adminEmail` | _string_ | AdminEmail is the Google admin to impersonate for api calls |

241+| `AdminEmail` | _string_ | AdminEmail is the Google admin to impersonate for api calls |

242−| `serviceAccountJson` | _string_ | ServiceAccountJSON is the path to the service account json credentials |

242+| `ServiceAccountJSON` | _string_ | ServiceAccountJSON is the path to the service account json credentials |

243−| `useApplicationDefaultCredentials` | _bool_ | UseApplicationDefaultCredentials is a boolean whether to use Application Default Credentials instead of a ServiceAccountJSON |

243+| `UseApplicationDefaultCredentials` | _bool_ | UseApplicationDefaultCredentials is a boolean whether to use Application Default Credentials instead of a ServiceAccountJSON |

244−| `targetPrincipal` | _string_ | TargetPrincipal is the Google Service Account used for Application Default Credentials |

244+| `TargetPrincipal` | _string_ | TargetPrincipal is the Google Service Account used for Application Default Credentials |

245−| `useOrganizationID` | _bool_ | UseOrganizationId indicates whether to use the organization ID as the UserName claim |

245+| `UseOrganizationID` | _bool_ | UseOrganizationId indicates whether to use the organization ID as the UserName claim |

246−| `adminAPIUserScope` | _string_ | admin scope needed for fetching user organization information from admin api, can be one of cloud, user or defaults to readonly |

246+| `AdminAPIUserScope` | _string_ | admin scope needed for fetching user organization information from admin api, can be one of cloud, user or defaults to readonly |

247

248### Header

249

@@ -254,10 +254,10 @@ response header.

254

255| Field | Type | Description |

256| ----- | ---- | ----------- |

257−| `name` | _string_ | Name is the header name to be used for this set of values. Names should be unique within a list of Headers. |

257+| `Name` | _string_ | Name is the header name to be used for this set of values. Names should be unique within a list of Headers. |

258−| `preserveRequestValue` | _bool_ | PreserveRequestValue determines whether any values for this header should be preserved for the request to the upstream server. This option only applies to injected request headers. Defaults to false (headers that match this header will be stripped). |

258+| `PreserveRequestValue` | _bool_ | PreserveRequestValue determines whether any values for this header should be preserved for the request to the upstream server. This option only applies to injected request headers. Defaults to false (headers that match this header will be stripped). |

259| `InsecureSkipHeaderNormalization` | _bool_ | InsecureSkipHeaderNormalization disables normalizing the header name According to RFC 7230 Section 3.2 there aren't any rules about capitalization of header names, but the standard practice is to use Title-Case (e.g. X-Forwarded-For). By default, header names will be normalized to Title-Case and any incoming headers that match will be treated as the same header. Additionally underscores (_) in header names will be converted to dashes (-) when normalizing. Defaults to false (header names will be normalized). |

260−| `values` | _[[]HeaderValue](#headervalue)_ | Values contains the desired values for this header |

260+| `Values` | _[[]HeaderValue](#headervalue)_ | Values contains the desired values for this header |

261

262### HeaderValue

263

@@ -268,12 +268,12 @@ make up the header value

268

269| Field | Type | Description |

270| ----- | ---- | ----------- |

271−| `value` | _string_ | Value expects a base64 encoded string value. |

271+| `Value` | _string_ | Value expects a base64 encoded string value. |

272−| `fromEnv` | _string_ | FromEnv expects the name of an environment variable. |

272+| `FromEnv` | _string_ | FromEnv expects the name of an environment variable. |

273−| `fromFile` | _string_ | FromFile expects a path to a file containing the secret value. |

273+| `FromFile` | _string_ | FromFile expects a path to a file containing the secret value. |

274−| `claim` | _string_ | Claim is the name of the claim in the session that the value should be loaded from. Available claims: `access_token` `id_token` `created_at` `expires_on` `refresh_token` `email` `user` `groups` `preferred_username`. |

274+| `Claim` | _string_ | Claim is the name of the claim in the session that the value should be loaded from. Available claims: `access_token` `id_token` `created_at` `expires_on` `refresh_token` `email` `user` `groups` `preferred_username`. |

275−| `prefix` | _string_ | Prefix is an optional prefix that will be prepended to the value of the claim if it is non-empty. |

275+| `Prefix` | _string_ | Prefix is an optional prefix that will be prepended to the value of the claim if it is non-empty. |

276−| `basicAuthPassword` | _[SecretSource](#secretsource)_ | BasicAuthPassword converts this claim into a basic auth header. Note the value of claim will become the basic auth username and the basicAuthPassword will be used as the password value. |

276+| `BasicAuthPassword` | _[SecretSource](#secretsource)_ | BasicAuthPassword converts this claim into a basic auth header. Note the value of claim will become the basic auth username and the basicAuthPassword will be used as the password value. |

277

278### KeycloakOptions

279

@@ -283,8 +283,8 @@ make up the header value

283

284| Field | Type | Description |

285| ----- | ---- | ----------- |

286−| `groups` | _[]string_ | Group enables to restrict login to members of indicated group |

286+| `Groups` | _[]string_ | Group enables to restrict login to members of indicated group |

287−| `roles` | _[]string_ | Role enables to restrict login to users with role (only available when using the keycloak-oidc provider) |

287+| `Roles` | _[]string_ | Role enables to restrict login to users with role (only available when using the keycloak-oidc provider) |

288

289### LoginGovOptions

290

@@ -294,9 +294,9 @@ make up the header value

294

295| Field | Type | Description |

296| ----- | ---- | ----------- |

297−| `jwtKey` | _string_ | JWTKey is a private key in PEM format used to sign JWT, |

297+| `JWTKey` | _string_ | JWTKey is a private key in PEM format used to sign JWT, |

298−| `jwtKeyFile` | _string_ | JWTKeyFile is a path to the private key file in PEM format used to sign the JWT |

298+| `JWTKeyFile` | _string_ | JWTKeyFile is a path to the private key file in PEM format used to sign the JWT |

299−| `pubjwkURL` | _string_ | PubJWKURL is the JWK pubkey access endpoint |

299+| `PubJWKURL` | _string_ | PubJWKURL is the JWK pubkey access endpoint |

300

301### LoginURLParameter

302

@@ -374,9 +374,9 @@ character.

374

375| Field | Type | Description |

376| ----- | ---- | ----------- |

377−| `name` | _string_ | Name specifies the name of the query parameter. |

377+| `Name` | _string_ | Name specifies the name of the query parameter. |

378−| `default` | _[]string_ | _(Optional)_ Default specifies a default value or values that will be passed to the IdP if not overridden. |

378+| `Default` | _[]string_ | _(Optional)_ Default specifies a default value or values that will be passed to the IdP if not overridden. |

379−| `allow` | _[[]URLParameterRule](#urlparameterrule)_ | _(Optional)_ Allow specifies rules about how the default (if any) may be overridden via the query string to `/oauth2/start`. Only values that match one or more of the allow rules will be forwarded to the IdP. |

379+| `Allow` | _[[]URLParameterRule](#urlparameterrule)_ | _(Optional)_ Allow specifies rules about how the default (if any) may be overridden via the query string to `/oauth2/start`. Only values that match one or more of the allow rules will be forwarded to the IdP. |

380

381### MicrosoftEntraIDOptions

382

@@ -386,8 +386,8 @@ character.

386

387| Field | Type | Description |

388| ----- | ---- | ----------- |

389−| `allowedTenants` | _[]string_ | AllowedTenants is a list of allowed tenants. In case of multi-tenant apps, incoming tokens are issued by different issuers and OIDC issuer verification needs to be disabled. When not specified, all tenants are allowed. Redundant for single-tenant apps (regular ID token validation matches the issuer). |

389+| `AllowedTenants` | _[]string_ | AllowedTenants is a list of allowed tenants. In case of multi-tenant apps, incoming tokens are issued by different issuers and OIDC issuer verification needs to be disabled. When not specified, all tenants are allowed. Redundant for single-tenant apps (regular ID token validation matches the issuer). |

390−| `federatedTokenAuth` | _bool_ | FederatedTokenAuth enable oAuth2 client authentication with federated token projected by Entra Workload Identity plugin, instead of client secret. |

390+| `FederatedTokenAuth` | _bool_ | FederatedTokenAuth enable oAuth2 client authentication with federated token projected by Entra Workload Identity plugin, instead of client secret. |

391

392### OIDCOptions

393

@@ -397,18 +397,18 @@ character.

397

398| Field | Type | Description |

399| ----- | ---- | ----------- |

400−| `issuerURL` | _string_ | IssuerURL is the OpenID Connect issuer URL eg: https://accounts.google.com |

400+| `IssuerURL` | _string_ | IssuerURL is the OpenID Connect issuer URL eg: https://accounts.google.com |

401−| `insecureAllowUnverifiedEmail` | _bool_ | InsecureAllowUnverifiedEmail prevents failures if an email address in an id_token is not verified default set to 'false' |

401+| `InsecureAllowUnverifiedEmail` | _bool_ | InsecureAllowUnverifiedEmail prevents failures if an email address in an id_token is not verified default set to 'false' |

402−| `insecureSkipIssuerVerification` | _bool_ | InsecureSkipIssuerVerification skips verification of ID token issuers. When false, ID Token Issuers must match the OIDC discovery URL default set to 'false' |

402+| `InsecureSkipIssuerVerification` | _bool_ | InsecureSkipIssuerVerification skips verification of ID token issuers. When false, ID Token Issuers must match the OIDC discovery URL default set to 'false' |

403−| `insecureSkipNonce` | _bool_ | InsecureSkipNonce skips verifying the ID Token's nonce claim that must match the random nonce sent in the initial OAuth flow. Otherwise, the nonce is checked after the initial OAuth redeem & subsequent token refreshes. default set to 'true' Warning: In a future release, this will change to 'false' by default for enhanced security. |

403+| `InsecureSkipNonce` | _bool_ | InsecureSkipNonce skips verifying the ID Token's nonce claim that must match the random nonce sent in the initial OAuth flow. Otherwise, the nonce is checked after the initial OAuth redeem & subsequent token refreshes. default set to 'true' Warning: In a future release, this will change to 'false' by default for enhanced security. |

404−| `skipDiscovery` | _bool_ | SkipDiscovery allows to skip OIDC discovery and use manually supplied Endpoints default set to 'false' |

404+| `SkipDiscovery` | _bool_ | SkipDiscovery allows to skip OIDC discovery and use manually supplied Endpoints default set to 'false' |

405−| `jwksURL` | _string_ | JwksURL is the OpenID Connect JWKS URL eg: https://www.googleapis.com/oauth2/v3/certs |

405+| `JwksURL` | _string_ | JwksURL is the OpenID Connect JWKS URL eg: https://www.googleapis.com/oauth2/v3/certs |

406−| `publicKeyFiles` | _[]string_ | PublicKeyFiles is a list of paths pointing to public key files in PEM format to use for verifying JWT tokens |

406+| `PublicKeyFiles` | _[]string_ | PublicKeyFiles is a list of paths pointing to public key files in PEM format to use for verifying JWT tokens |

407−| `emailClaim` | _string_ | EmailClaim indicates which claim contains the user email, default set to 'email' |

407+| `EmailClaim` | _string_ | EmailClaim indicates which claim contains the user email, default set to 'email' |

408−| `groupsClaim` | _string_ | GroupsClaim indicates which claim contains the user groups default set to 'groups' |

408+| `GroupsClaim` | _string_ | GroupsClaim indicates which claim contains the user groups default set to 'groups' |

409−| `userIDClaim` | _string_ | UserIDClaim indicates which claim contains the user ID default set to 'email' |

409+| `UserIDClaim` | _string_ | UserIDClaim indicates which claim contains the user ID default set to 'email' |

410−| `audienceClaims` | _[]string_ | AudienceClaim allows to define any claim that is verified against the client id By default `aud` claim is used for verification. |

410+| `AudienceClaims` | _[]string_ | AudienceClaim allows to define any claim that is verified against the client id By default `aud` claim is used for verification. |

411−| `extraAudiences` | _[]string_ | ExtraAudiences is a list of additional audiences that are allowed to pass verification in addition to the client id. |

411+| `ExtraAudiences` | _[]string_ | ExtraAudiences is a list of additional audiences that are allowed to pass verification in addition to the client id. |

412

413### Provider

414

@@ -418,36 +418,36 @@ Provider holds all configuration for a single provider

418

419| Field | Type | Description |

420| ----- | ---- | ----------- |

421−| `clientID` | _string_ | ClientID is the OAuth Client ID that is defined in the provider This value is required for all providers. |

421+| `ClientID` | _string_ | ClientID is the OAuth Client ID that is defined in the provider This value is required for all providers. |

422−| `clientSecret` | _string_ | ClientSecret is the OAuth Client Secret that is defined in the provider This value is required for all providers. |

422+| `ClientSecret` | _string_ | ClientSecret is the OAuth Client Secret that is defined in the provider This value is required for all providers. |

423−| `clientSecretFile` | _string_ | ClientSecretFile is the name of the file containing the OAuth Client Secret, it will be used if ClientSecret is not set. |

423+| `ClientSecretFile` | _string_ | ClientSecretFile is the name of the file containing the OAuth Client Secret, it will be used if ClientSecret is not set. |

424−| `keycloakConfig` | _[KeycloakOptions](#keycloakoptions)_ | KeycloakConfig holds all configurations for Keycloak provider. |

424+| `KeycloakConfig` | _[KeycloakOptions](#keycloakoptions)_ | KeycloakConfig holds all configurations for Keycloak provider. |

425−| `azureConfig` | _[AzureOptions](#azureoptions)_ | AzureConfig holds all configurations for Azure provider. |

425+| `AzureConfig` | _[AzureOptions](#azureoptions)_ | AzureConfig holds all configurations for Azure provider. |

426−| `microsoftEntraIDConfig` | _[MicrosoftEntraIDOptions](#microsoftentraidoptions)_ | MicrosoftEntraIDConfig holds all configurations for Entra ID provider. |

426+| `MicrosoftEntraIDConfig` | _[MicrosoftEntraIDOptions](#microsoftentraidoptions)_ | MicrosoftEntraIDConfig holds all configurations for Entra ID provider. |

427| `ADFSConfig` | _[ADFSOptions](#adfsoptions)_ | ADFSConfig holds all configurations for ADFS provider. |

428−| `bitbucketConfig` | _[BitbucketOptions](#bitbucketoptions)_ | BitbucketConfig holds all configurations for Bitbucket provider. |

428+| `BitbucketConfig` | _[BitbucketOptions](#bitbucketoptions)_ | BitbucketConfig holds all configurations for Bitbucket provider. |

429−| `githubConfig` | _[GitHubOptions](#githuboptions)_ | GitHubConfig holds all configurations for GitHubC provider. |

429+| `GitHubConfig` | _[GitHubOptions](#githuboptions)_ | GitHubConfig holds all configurations for GitHubC provider. |

430−| `gitlabConfig` | _[GitLabOptions](#gitlaboptions)_ | GitLabConfig holds all configurations for GitLab provider. |

430+| `GitLabConfig` | _[GitLabOptions](#gitlaboptions)_ | GitLabConfig holds all configurations for GitLab provider. |

431−| `googleConfig` | _[GoogleOptions](#googleoptions)_ | GoogleConfig holds all configurations for Google provider. |

431+| `GoogleConfig` | _[GoogleOptions](#googleoptions)_ | GoogleConfig holds all configurations for Google provider. |

432−| `oidcConfig` | _[OIDCOptions](#oidcoptions)_ | OIDCConfig holds all configurations for OIDC provider or providers utilize OIDC configurations. |

432+| `OIDCConfig` | _[OIDCOptions](#oidcoptions)_ | OIDCConfig holds all configurations for OIDC provider or providers utilize OIDC configurations. |

433−| `loginGovConfig` | _[LoginGovOptions](#logingovoptions)_ | LoginGovConfig holds all configurations for LoginGov provider. |

433+| `LoginGovConfig` | _[LoginGovOptions](#logingovoptions)_ | LoginGovConfig holds all configurations for LoginGov provider. |

434−| `id` | _string_ | ID should be a unique identifier for the provider. This value is required for all providers. |

434+| `ID` | _string_ | ID should be a unique identifier for the provider. This value is required for all providers. |

435−| `provider` | _[ProviderType](#providertype)_ | Type is the OAuth provider must be set from the supported providers group, otherwise 'Google' is set as default |

435+| `Type` | _[ProviderType](#providertype)_ | Type is the OAuth provider must be set from the supported providers group, otherwise 'Google' is set as default |

436−| `name` | _string_ | Name is the providers display name if set, it will be shown to the users in the login page. |

436+| `Name` | _string_ | Name is the providers display name if set, it will be shown to the users in the login page. |

437−| `caFiles` | _[]string_ | CAFiles is a list of paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead |

437+| `CAFiles` | _[]string_ | CAFiles is a list of paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead |

438−| `useSystemTrustStore` | _bool_ | UseSystemTrustStore determines if your custom CA files and the system trust store are used If set to true, your custom CA files and the system trust store are used otherwise only your custom CA files. |

438+| `UseSystemTrustStore` | _bool_ | UseSystemTrustStore determines if your custom CA files and the system trust store are used If set to true, your custom CA files and the system trust store are used otherwise only your custom CA files. |

439−| `loginURL` | _string_ | LoginURL is the authentication endpoint |

439+| `LoginURL` | _string_ | LoginURL is the authentication endpoint |

440−| `loginURLParameters` | _[[]LoginURLParameter](#loginurlparameter)_ | LoginURLParameters defines the parameters that can be passed from the start URL to the IdP login URL |

440+| `LoginURLParameters` | _[[]LoginURLParameter](#loginurlparameter)_ | LoginURLParameters defines the parameters that can be passed from the start URL to the IdP login URL |

441−| `authRequestResponseMode` | _string_ | AuthRequestResponseMode defines the response mode to request during authorization request |

441+| `AuthRequestResponseMode` | _string_ | AuthRequestResponseMode defines the response mode to request during authorization request |

442−| `redeemURL` | _string_ | RedeemURL is the token redemption endpoint |

442+| `RedeemURL` | _string_ | RedeemURL is the token redemption endpoint |

443−| `profileURL` | _string_ | ProfileURL is the profile access endpoint |

443+| `ProfileURL` | _string_ | ProfileURL is the profile access endpoint |

444−| `skipClaimsFromProfileURL` | _bool_ | SkipClaimsFromProfileURL allows to skip request to Profile URL for resolving claims not present in id_token default set to 'false' |

444+| `SkipClaimsFromProfileURL` | _bool_ | SkipClaimsFromProfileURL allows to skip request to Profile URL for resolving claims not present in id_token default set to 'false' |

445−| `resource` | _string_ | ProtectedResource is the resource that is protected (Azure AD and ADFS only) |

445+| `ProtectedResource` | _string_ | ProtectedResource is the resource that is protected (Azure AD and ADFS only) |

446−| `validateURL` | _string_ | ValidateURL is the access token validation endpoint |

446+| `ValidateURL` | _string_ | ValidateURL is the access token validation endpoint |

447−| `scope` | _string_ | Scope is the OAuth scope specification |

447+| `Scope` | _string_ | Scope is the OAuth scope specification |

448−| `allowedGroups` | _[]string_ | AllowedGroups is a list of restrict logins to members of this group |

448+| `AllowedGroups` | _[]string_ | AllowedGroups is a list of restrict logins to members of this group |

449−| `code_challenge_method` | _string_ | The code challenge method |

449+| `CodeChallengeMethod` | _string_ | The code challenge method |

450−| `backendLogoutURL` | _string_ | URL to call to perform backend logout, `{id_token}` would be replaced by the actual `id_token` if available in the session |

450+| `BackendLogoutURL` | _string_ | URL to call to perform backend logout, `{id_token}` would be replaced by the actual `id_token` if available in the session |

451

452### ProviderType

453#### (`string` alias)

@@ -480,9 +480,9 @@ Only one source within the struct should be defined at any time.

480

481| Field | Type | Description |

482| ----- | ---- | ----------- |

483−| `value` | _string_ | Value expects a base64 encoded string value. |

483+| `Value` | _string_ | Value expects a base64 encoded string value. |

484−| `fromEnv` | _string_ | FromEnv expects the name of an environment variable. |

484+| `FromEnv` | _string_ | FromEnv expects the name of an environment variable. |

485−| `fromFile` | _string_ | FromFile expects a path to a file containing the secret value. |

485+| `FromFile` | _string_ | FromFile expects a path to a file containing the secret value. |

486

487### Server

488

@@ -521,8 +521,8 @@ login URL. Either Value or Pattern should be supplied, not both.

521

522| Field | Type | Description |

523| ----- | ---- | ----------- |

524−| `value` | _string_ | A Value rule matches just this specific value |

524+| `Value` | _string_ | A Value rule matches just this specific value |

525−| `pattern` | _string_ | A Pattern rule gives a regular expression that must be matched by some substring of the value. The expression is _not_ automatically anchored to the start and end of the value, if you _want_ to restrict the whole parameter value you must anchor it yourself with `^` and `$`. |

525+| `Pattern` | _string_ | A Pattern rule gives a regular expression that must be matched by some substring of the value. The expression is _not_ automatically anchored to the start and end of the value, if you _want_ to restrict the whole parameter value you must anchor it yourself with `^` and `$`. |

526

527### Upstream

528

@@ -533,18 +533,18 @@ Requests will be proxied to this upstream if the path matches the request path.

533

534| Field | Type | Description |

535| ----- | ---- | ----------- |

536−| `id` | _string_ | ID should be a unique identifier for the upstream. This value is required for all upstreams. |

536+| `ID` | _string_ | ID should be a unique identifier for the upstream. This value is required for all upstreams. |

537−| `path` | _string_ | Path is used to map requests to the upstream server. The closest match will take precedence and all Paths must be unique. Path can also take a pattern when used with RewriteTarget. Path segments can be captured and matched using regular experessions. Eg: - `^/foo$`: Match only the explicit path `/foo` - `^/bar/$`: Match any path prefixed with `/bar/` - `^/baz/(.*)$`: Match any path prefixed with `/baz` and capture the remaining path for use with RewriteTarget |

537+| `Path` | _string_ | Path is used to map requests to the upstream server. The closest match will take precedence and all Paths must be unique. Path can also take a pattern when used with RewriteTarget. Path segments can be captured and matched using regular experessions. Eg: - `^/foo$`: Match only the explicit path `/foo` - `^/bar/$`: Match any path prefixed with `/bar/` - `^/baz/(.*)$`: Match any path prefixed with `/baz` and capture the remaining path for use with RewriteTarget |

538−| `rewriteTarget` | _string_ | RewriteTarget allows users to rewrite the request path before it is sent to the upstream server (for an HTTP/HTTPS upstream) or mapped to the filesystem (for a `file:` upstream). Use the Path to capture segments for reuse within the rewrite target. Eg: With a Path of `^/baz/(.*)`, a RewriteTarget of `/foo/$1` would rewrite the request `/baz/abc/123` to `/foo/abc/123` before proxying to the upstream server. Or if the upstream were `file:///app`, a request for `/baz/info.html` would return the contents of the file `/app/foo/info.html`. |

538+| `RewriteTarget` | _string_ | RewriteTarget allows users to rewrite the request path before it is sent to the upstream server (for an HTTP/HTTPS upstream) or mapped to the filesystem (for a `file:` upstream). Use the Path to capture segments for reuse within the rewrite target. Eg: With a Path of `^/baz/(.*)`, a RewriteTarget of `/foo/$1` would rewrite the request `/baz/abc/123` to `/foo/abc/123` before proxying to the upstream server. Or if the upstream were `file:///app`, a request for `/baz/info.html` would return the contents of the file `/app/foo/info.html`. |

539−| `uri` | _string_ | The URI of the upstream server. This may be an HTTP(S) server of a File based URL. It may include a path, in which case all requests will be served under that path. Eg: - http://localhost:8080 - https://service.localhost - https://service.localhost/path - file://host/path If the URI's path is "/base" and the incoming request was for "/dir", the upstream request will be for "/base/dir". |

539+| `URI` | _string_ | The URI of the upstream server. This may be an HTTP(S) server of a File based URL. It may include a path, in which case all requests will be served under that path. Eg: - http://localhost:8080 - https://service.localhost - https://service.localhost/path - file://host/path If the URI's path is "/base" and the incoming request was for "/dir", the upstream request will be for "/base/dir". |

540−| `insecureSkipTLSVerify` | _bool_ | InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts. This option is insecure and will allow potential Man-In-The-Middle attacks between OAuth2 Proxy and the upstream server. Defaults to false. |

540+| `InsecureSkipTLSVerify` | _bool_ | InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts. This option is insecure and will allow potential Man-In-The-Middle attacks between OAuth2 Proxy and the upstream server. Defaults to false. |

541−| `static` | _bool_ | Static will make all requests to this upstream have a static response. The response will have a body of "Authenticated" and a response code matching StaticCode. If StaticCode is not set, the response will return a 200 response. |

541+| `Static` | _bool_ | Static will make all requests to this upstream have a static response. The response will have a body of "Authenticated" and a response code matching StaticCode. If StaticCode is not set, the response will return a 200 response. |

542−| `staticCode` | _int_ | StaticCode determines the response code for the Static response. This option can only be used with Static enabled. |

542+| `StaticCode` | _int_ | StaticCode determines the response code for the Static response. This option can only be used with Static enabled. |

543−| `flushInterval` | _duration_ | FlushInterval is the period between flushing the response buffer when streaming response from the upstream. Defaults to 1 second. |

543+| `FlushInterval` | _duration_ | FlushInterval is the period between flushing the response buffer when streaming response from the upstream. Defaults to 1 second. |

544−| `passHostHeader` | _bool_ | PassHostHeader determines whether the request host header should be proxied to the upstream server. Defaults to true. |

544+| `PassHostHeader` | _bool_ | PassHostHeader determines whether the request host header should be proxied to the upstream server. Defaults to true. |

545−| `proxyWebSockets` | _bool_ | ProxyWebSockets enables proxying of websockets to upstream servers Defaults to true. |

545+| `ProxyWebSockets` | _bool_ | ProxyWebSockets enables proxying of websockets to upstream servers Defaults to true. |

546−| `timeout` | _duration_ | Timeout is the maximum duration the server will wait for a response from the upstream server. Defaults to 30 seconds. |

546+| `Timeout` | _duration_ | Timeout is the maximum duration the server will wait for a response from the upstream server. Defaults to 30 seconds. |

547−| `disableKeepAlives` | _bool_ | DisableKeepAlives disables HTTP keep-alive connections to the upstream server. Defaults to false. |

547+| `DisableKeepAlives` | _bool_ | DisableKeepAlives disables HTTP keep-alive connections to the upstream server. Defaults to false. |

548

549### UpstreamConfig

550

@@ -554,5 +554,5 @@ UpstreamConfig is a collection of definitions for upstream servers.

554

555| Field | Type | Description |

556| ----- | ---- | ----------- |

557−| `proxyRawPath` | _bool_ | ProxyRawPath will pass the raw url path to upstream allowing for urls like: "/%2F/" which would otherwise be redirected to "/" |

557+| `ProxyRawPath` | _bool_ | ProxyRawPath will pass the raw url path to upstream allowing for urls like: "/%2F/" which would otherwise be redirected to "/" |

558−| `upstreams` | _[[]Upstream](#upstream)_ | Upstreams represents the configuration for the upstream servers. Requests will be proxied to this upstream if the path matches the request path. |

558+| `Upstreams` | _[[]Upstream](#upstream)_ | Upstreams represents the configuration for the upstream servers. Requests will be proxied to this upstream if the path matches the request path. |

go.mod+7−8

@@ -12,7 +12,6 @@ require (

12 github.com/coreos/go-oidc/v3 v3.14.1

13 github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf

14 github.com/fsnotify/fsnotify v1.9.0

15− github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344

16 github.com/go-jose/go-jose/v3 v3.0.4

15 github.com/go-jose/go-jose/v3 v3.0.4

17 github.com/go-viper/mapstructure/v2 v2.4.0

16 github.com/go-viper/mapstructure/v2 v2.4.0

18 github.com/golang-jwt/jwt/v5 v5.2.3

17 github.com/golang-jwt/jwt/v5 v5.2.3

@@ -20,9 +19,10 @@ require (

20 github.com/google/uuid v1.6.0

19 github.com/google/uuid v1.6.0

21 github.com/gorilla/mux v1.8.1

20 github.com/gorilla/mux v1.8.1

22 github.com/justinas/alice v1.2.0

21 github.com/justinas/alice v1.2.0

22+ github.com/mitchellh/mapstructure v1.5.0

23 github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25

24 github.com/onsi/ginkgo/v2 v2.23.4

25− github.com/onsi/gomega v1.37.0

25+ github.com/onsi/gomega v1.38.0

26 github.com/pierrec/lz4/v4 v4.1.22

27 github.com/prometheus/client_golang v1.22.0

28 github.com/redis/go-redis/v9 v9.11.0

@@ -35,13 +35,14 @@ require (

35 golang.org/x/net v0.42.0

36 golang.org/x/oauth2 v0.30.0

37 golang.org/x/sync v0.16.0

38− google.golang.org/api v0.242.0

38+ google.golang.org/api v0.243.0

39 gopkg.in/natefinch/lumberjack.v2 v2.2.1

40+ gopkg.in/yaml.v3 v3.0.1

40 k8s.io/apimachinery v0.33.3

41 k8s.io/apimachinery v0.33.3

41)

42)

43require (

44require (

44− cloud.google.com/go/auth v0.16.2 // indirect

45+ cloud.google.com/go/auth v0.16.3 // indirect

45 cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect

46 cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect

46 github.com/beorn7/perks v1.0.1 // indirect

47 github.com/beorn7/perks v1.0.1 // indirect

47 github.com/cespare/xxhash/v2 v2.3.0 // indirect

48 github.com/cespare/xxhash/v2 v2.3.0 // indirect

@@ -80,9 +81,7 @@ require (

80 golang.org/x/sys v0.34.0 // indirect

81 golang.org/x/sys v0.34.0 // indirect

81 golang.org/x/text v0.27.0 // indirect

82 golang.org/x/text v0.27.0 // indirect

82 golang.org/x/tools v0.35.0 // indirect

83 golang.org/x/tools v0.35.0 // indirect

83− google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 // indirect

84+ google.golang.org/genproto/googleapis/rpc v0.0.0-20250721164621-a45f3dfb1074 // indirect

84− google.golang.org/grpc v1.73.0 // indirect

85+ google.golang.org/grpc v1.74.2 // indirect

85 google.golang.org/protobuf v1.36.6 // indirect

86 google.golang.org/protobuf v1.36.6 // indirect

86− gopkg.in/yaml.v2 v2.4.0 // indirect

87− gopkg.in/yaml.v3 v3.0.1 // indirect

88)

87)

go.sum+12−19

@@ -1,5 +1,5 @@

1−cloud.google.com/go/auth v0.16.2 h1:QvBAGFPLrDeoiNjyfVunhQ10HKNYuOwZ5noee0M5df4=

1+cloud.google.com/go/auth v0.16.3 h1:kabzoQ9/bobUmnseYnBO6qQG7q4a/CffFRlJSxv2wCc=

2−cloud.google.com/go/auth v0.16.2/go.mod h1:sRBas2Y1fB1vZTdurouM0AzuYQBMZinrUYL8EufhtEA=

2+cloud.google.com/go/auth v0.16.3/go.mod h1:NucRGjaXfzP1ltpcQ7On/VTZ0H4kWB5Jy+Y9Dnm76fA=

3cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=

4cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=

5cloud.google.com/go/compute/metadata v0.7.0 h1:PBWF+iiAerVNe8UCHxdOt6eHLVc3ydFeOCw78U8ytSU=

@@ -44,8 +44,6 @@ github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHk

44github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=

45github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=

46github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=

47−github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344 h1:Arcl6UOIS/kgO2nW3A65HN+7CMjSDP/gofXL4CZt1V4=

48−github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344/go.mod h1:GIjDIg/heH5DOkXY3YJ/wNhfHsQHoXGjl8G8amsYQ1I=

49github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=

47github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=

50github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=

48github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=

51github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=

49github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=

@@ -93,16 +91,16 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0

93github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=

91github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=

94github.com/matryer/is v1.2.0 h1:92UTHpy8CDwaJ08GqLDzhhuixiBUUD1p3AU6PHddz4A=

92github.com/matryer/is v1.2.0 h1:92UTHpy8CDwaJ08GqLDzhhuixiBUUD1p3AU6PHddz4A=

95github.com/matryer/is v1.2.0/go.mod h1:2fLPjFQM9rhQ15aVEtbuwhJinnOqrmgXPNdZsdwlWXA=

93github.com/matryer/is v1.2.0/go.mod h1:2fLPjFQM9rhQ15aVEtbuwhJinnOqrmgXPNdZsdwlWXA=

96−github.com/mbland/hmacauth v0.0.0-20170912233209-44256dfd4bfa h1:hI1uC2A3vJFjwvBn0G0a7QBRdBUp6Y048BtLAHRTKPo=

94+github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=

97−github.com/mbland/hmacauth v0.0.0-20170912233209-44256dfd4bfa/go.mod h1:8vxFeeg++MqgCHwehSuwTlYCF0ALyDJbYJ1JsKi7v6s=

95+github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=

98github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=

96github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=

99github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=

97github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=

100github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25 h1:9bCMuD3TcnjeqjPT2gSlha4asp8NvgcFRYExCaikCxk=

98github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25 h1:9bCMuD3TcnjeqjPT2gSlha4asp8NvgcFRYExCaikCxk=

101github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25/go.mod h1:eDjgYHYDJbPLBLsyZ6qRaugP0mX8vePOhZ5id1fdzJw=

99github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25/go.mod h1:eDjgYHYDJbPLBLsyZ6qRaugP0mX8vePOhZ5id1fdzJw=

102github.com/onsi/ginkgo/v2 v2.23.4 h1:ktYTpKJAVZnDT4VjxSbiBenUjmlL/5QkBEocaWXiQus=

100github.com/onsi/ginkgo/v2 v2.23.4 h1:ktYTpKJAVZnDT4VjxSbiBenUjmlL/5QkBEocaWXiQus=

103github.com/onsi/ginkgo/v2 v2.23.4/go.mod h1:Bt66ApGPBFzHyR+JO10Zbt0Gsp4uWxu5mIOTusL46e8=

101github.com/onsi/ginkgo/v2 v2.23.4/go.mod h1:Bt66ApGPBFzHyR+JO10Zbt0Gsp4uWxu5mIOTusL46e8=

104−github.com/onsi/gomega v1.37.0 h1:CdEG8g0S133B4OswTDC/5XPSzE1OeP29QOioj2PID2Y=

102+github.com/onsi/gomega v1.38.0 h1:c/WX+w8SLAinvuKKQFh77WEucCnPk4j2OTUr7lt7BeY=

105−github.com/onsi/gomega v1.37.0/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=

103+github.com/onsi/gomega v1.38.0/go.mod h1:OcXcwId0b9QsE7Y49u+BTrL4IdKOBOKnD6VQNTJEB6o=

106github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=

104github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=

107github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=

105github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=

108github.com/pierrec/lz4/v4 v4.1.22 h1:cKFw6uJDK+/gfw5BcDL0JL5aBsAFdsIT18eRtLj7VIU=

106github.com/pierrec/lz4/v4 v4.1.22 h1:cKFw6uJDK+/gfw5BcDL0JL5aBsAFdsIT18eRtLj7VIU=

@@ -138,8 +136,6 @@ github.com/spf13/viper v1.20.1 h1:ZMi+z/lvLyPSCoNtFCpqjy0S4kPbirhpTMwl8BkW9X4=

138github.com/spf13/viper v1.20.1/go.mod h1:P9Mdzt1zoHIG8m2eZQinpiBjo6kCmZSKBClNNqjJvu4=

136github.com/spf13/viper v1.20.1/go.mod h1:P9Mdzt1zoHIG8m2eZQinpiBjo6kCmZSKBClNNqjJvu4=

139github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=

137github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=

140github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=

138github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=

141−github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=

142−github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=

143github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=

139github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=

144github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=

140github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=

145github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=

141github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=

@@ -227,16 +223,16 @@ golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=

227golang.org/x/tools v0.35.0 h1:mBffYraMEf7aa0sB+NuKnuCy8qI/9Bughn8dC2Gu5r0=

223golang.org/x/tools v0.35.0 h1:mBffYraMEf7aa0sB+NuKnuCy8qI/9Bughn8dC2Gu5r0=

228golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=

224golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=

229golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

225golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

230−google.golang.org/api v0.242.0 h1:7Lnb1nfnpvbkCiZek6IXKdJ0MFuAZNAJKQfA1ws62xg=

226+google.golang.org/api v0.243.0 h1:sw+ESIJ4BVnlJcWu9S+p2Z6Qq1PjG77T8IJ1xtp4jZQ=

231−google.golang.org/api v0.242.0/go.mod h1:cOVEm2TpdAGHL2z+UwyS+kmlGr3bVWQQ6sYEqkKje50=

227+google.golang.org/api v0.243.0/go.mod h1:GE4QtYfaybx1KmeHMdBnNnyLzBZCVihGBXAmJu/uUr8=

232google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=

228google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=

233google.golang.org/genproto v0.0.0-20250603155806-513f23925822/go.mod h1:HubltRL7rMh0LfnQPkMH4NPDFEWp0jw3vixw7jEM53s=

229google.golang.org/genproto v0.0.0-20250603155806-513f23925822/go.mod h1:HubltRL7rMh0LfnQPkMH4NPDFEWp0jw3vixw7jEM53s=

234google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 h1:oWVWY3NzT7KJppx2UKhKmzPq4SRe0LdCijVRwvGeikY=

230google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 h1:oWVWY3NzT7KJppx2UKhKmzPq4SRe0LdCijVRwvGeikY=

235google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822/go.mod h1:h3c4v36UTKzUiuaOKQ6gr3S+0hovBtUrXzTG/i3+XEc=

231google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822/go.mod h1:h3c4v36UTKzUiuaOKQ6gr3S+0hovBtUrXzTG/i3+XEc=

236−google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 h1:pFyd6EwwL2TqFf8emdthzeX+gZE1ElRq3iM8pui4KBY=

232+google.golang.org/genproto/googleapis/rpc v0.0.0-20250721164621-a45f3dfb1074 h1:qJW29YvkiJmXOYMu5Tf8lyrTp3dOS+K4z6IixtLaCf8=

237−google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=

233+google.golang.org/genproto/googleapis/rpc v0.0.0-20250721164621-a45f3dfb1074/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=

238−google.golang.org/grpc v1.73.0 h1:VIWSmpI2MegBtTuFt5/JWy2oXxtjJ/e89Z70ImfD2ok=

234+google.golang.org/grpc v1.74.2 h1:WoosgB65DlWVC9FqI82dGsZhWFNBSLjQ84bjROOpMu4=

239−google.golang.org/grpc v1.73.0/go.mod h1:50sbHOUqWoCQGI8V2HQLJM0B+LMlIUjNSZmow7EVBQc=

235+google.golang.org/grpc v1.74.2/go.mod h1:CtQ+BGjaAIXHs/5YS3i473GqwBBa1zGQNevxdeBEXrM=

240google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=

236google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=

241google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=

237google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=

242gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

238gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

@@ -244,9 +240,6 @@ gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntN

244gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

240gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

245gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=

241gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=

246gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=

242gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=

247−gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

248−gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=

249−gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=

250gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

243gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

251gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

244gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

252gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

245gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

main.go+1−1

@@ -5,12 +5,12 @@ import (

5 "os"

6 "runtime"

8− "github.com/ghodss/yaml"

9 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

8 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

10 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"

9 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"

11 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/validation"

10 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/validation"

12 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/version"

11 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/version"

13 "github.com/spf13/pflag"

12 "github.com/spf13/pflag"

13+ "gopkg.in/yaml.v3"

14)

16func main() {

main_test.go+1−3

@@ -2,9 +2,7 @@ package main

3import (

4 "errors"

5− "fmt"

6 "os"

5 "os"

7− "strings"

8 "time"

6 "time"

10 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

8 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

@@ -256,7 +254,7 @@ redirect_url="http://localhost:4180/oauth2/callback"

256 configContent: testCoreConfig,

254 configContent: testCoreConfig,

257 alphaConfigContent: testAlphaConfig + ":",

255 alphaConfigContent: testAlphaConfig + ":",

258 expectedOptions: func() *options.Options { return nil },

256 expectedOptions: func() *options.Options { return nil },

259− expectedErr: fmt.Errorf("failed to load alpha options: error unmarshalling config: error converting YAML to JSON: yaml: line %d: did not find expected key", strings.Count(testAlphaConfig, "\n")),

257+ expectedErr: errors.New("failed to load alpha options: error unmarshalling config: yaml: line 1: did not find expected key"),

260 }),

258 }),

261 Entry("with alpha configuration and bad core configuration", loadConfigurationTableInput{

259 Entry("with alpha configuration and bad core configuration", loadConfigurationTableInput{

262 configContent: testCoreConfig + "unknown_field=\"something\"",

260 configContent: testCoreConfig + "unknown_field=\"something\"",

pkg/apis/options/alpha_options.go+6−6

@@ -12,13 +12,13 @@ type AlphaOptions struct {

12 // UpstreamConfig is used to configure upstream servers.

13 // Once a user is authenticated, requests to the server will be proxied to

14 // these upstream servers based on the path mappings defined in this list.

15− UpstreamConfig UpstreamConfig `json:"upstreamConfig,omitempty"`

15+ UpstreamConfig UpstreamConfig `yaml:"upstreamConfig,omitempty"`

17 // InjectRequestHeaders is used to configure headers that should be added

18 // to requests to upstream servers.

19 // Headers may source values from either the authenticated user's session

20 // or from a static secret value.

21− InjectRequestHeaders []Header `json:"injectRequestHeaders,omitempty"`

21+ InjectRequestHeaders []Header `yaml:"injectRequestHeaders,omitempty"`

23 // InjectResponseHeaders is used to configure headers that should be added

24 // to responses from the proxy.

@@ -27,24 +27,24 @@ type AlphaOptions struct {

27 // auth_request module.

28 // Headers may source values from either the authenticated user's session

29 // or from a static secret value.

30− InjectResponseHeaders []Header `json:"injectResponseHeaders,omitempty"`

30+ InjectResponseHeaders []Header `yaml:"injectResponseHeaders,omitempty"`

32 // Server is used to configure the HTTP(S) server for the proxy application.

33 // You may choose to run both HTTP and HTTPS servers simultaneously.

34 // This can be done by setting the BindAddress and the SecureBindAddress simultaneously.

35 // To use the secure server you must configure a TLS certificate and key.

36− Server Server `json:"server,omitempty"`

36+ Server Server `yaml:"server,omitempty"`

38 // MetricsServer is used to configure the HTTP(S) server for metrics.

39 // You may choose to run both HTTP and HTTPS servers simultaneously.

40 // This can be done by setting the BindAddress and the SecureBindAddress simultaneously.

41 // To use the secure server you must configure a TLS certificate and key.

42− MetricsServer Server `json:"metricsServer,omitempty"`

42+ MetricsServer Server `yaml:"metricsServer,omitempty"`

44 // Providers is used to configure your provider. **Multiple-providers is not

45 // yet working.** [This feature is tracked in

46 // #925](https://github.com/oauth2-proxy/oauth2-proxy/issues/926)

47− Providers Providers `json:"providers,omitempty"`

47+ Providers Providers `yaml:"providers,omitempty"`

48}

50// Initialize alpha options with default values and settings of the core options

pkg/apis/options/duration_test.go+2−2

@@ -7,7 +7,7 @@ import (

8func TestDecode(t *testing.T) {

9 type result struct {

10− Duration time.Duration `json:"duration"`

10+ Duration time.Duration `yaml:"duration"`

11 }

13 tests := []struct {

@@ -64,7 +64,7 @@ func TestDecode(t *testing.T) {

64 for _, tt := range tests {

65 t.Run(tt.name, func(t *testing.T) {

66 var result struct {

67− Duration time.Duration `json:"duration"`

67+ Duration time.Duration `yaml:"duration"`

68 }

70 err := Decode(tt.input, &result)

pkg/apis/options/header.go+8−8

@@ -5,13 +5,13 @@ package options

5type Header struct {

6 // Name is the header name to be used for this set of values.

7 // Names should be unique within a list of Headers.

8− Name string `json:"name,omitempty"`

8+ Name string `yaml:"name,omitempty"`

10 // PreserveRequestValue determines whether any values for this header

11 // should be preserved for the request to the upstream server.

12 // This option only applies to injected request headers.

13 // Defaults to false (headers that match this header will be stripped).

14− PreserveRequestValue bool `json:"preserveRequestValue,omitempty"`

14+ PreserveRequestValue bool `yaml:"preserveRequestValue,omitempty"`

16 // InsecureSkipHeaderNormalization disables normalizing the header name

17 // According to RFC 7230 Section 3.2 there aren't any rules about

@@ -24,17 +24,17 @@ type Header struct {

24 InsecureSkipHeaderNormalization bool `json:"InsecureSkipHeaderNormalization,omitempty"`

26 // Values contains the desired values for this header

27− Values []HeaderValue `json:"values,omitempty"`

27+ Values []HeaderValue `yaml:"values,omitempty"`

28}

30// HeaderValue represents a single header value and the sources that can

31// make up the header value

32type HeaderValue struct {

33 // Allow users to load the value from a secret source

34− *SecretSource `json:"secretSource,omitempty"`

34+ *SecretSource `yaml:"secretSource,omitempty"`

36 // Allow users to load the value from a session claim

37− *ClaimSource `json:"claimSource,omitempty"`

37+ *ClaimSource `yaml:"claimSource,omitempty"`

38}

40// ClaimSource allows loading a header value from a claim within the session

@@ -42,14 +42,14 @@ type ClaimSource struct {

42 // Claim is the name of the claim in the session that the value should be

43 // loaded from. Available claims: `access_token` `id_token` `created_at`

44 // `expires_on` `refresh_token` `email` `user` `groups` `preferred_username`.

45− Claim string `json:"claim,omitempty"`

45+ Claim string `yaml:"claim,omitempty"`

47 // Prefix is an optional prefix that will be prepended to the value of the

48 // claim if it is non-empty.

49− Prefix string `json:"prefix,omitempty"`

49+ Prefix string `yaml:"prefix,omitempty"`

51 // BasicAuthPassword converts this claim into a basic auth header.

52 // Note the value of claim will become the basic auth username and the

53 // basicAuthPassword will be used as the password value.

54− BasicAuthPassword *SecretSource `json:"basicAuthPassword,omitempty"`

54+ BasicAuthPassword *SecretSource `yaml:"basicAuthPassword,omitempty"`

55}

pkg/apis/options/load.go+2−2

@@ -9,10 +9,10 @@ import (

9 "strings"

11 "github.com/a8m/envsubst"

12− "github.com/ghodss/yaml"

13 "github.com/go-viper/mapstructure/v2"

12 "github.com/go-viper/mapstructure/v2"

14 "github.com/spf13/pflag"

13 "github.com/spf13/pflag"

15 "github.com/spf13/viper"

14 "github.com/spf13/viper"

15+ "gopkg.in/yaml.v3"

16)

18// Load reads in the config file at the path given, then merges in environment

@@ -92,7 +92,7 @@ func Decode(input interface{}, result interface{}) error {

92 DecodeHook: mapstructure.ComposeDecodeHookFunc(toDurationHookFunc()),

93 Metadata: nil, // Don't track any metadata

94 Result: result, // Decode the result into the prefilled options

95− TagName: "json", // Parse all fields that use the json tag

95+ TagName: "yaml", // Parse all fields that use the json tag

96 ZeroFields: false, // Don't clean the default values from the result map (options)

97 ErrorUnused: true, // Throw an error if keys have been used that aren't mapped to any struct fields

98 IgnoreUntaggedFields: true, // Ignore fields in structures that aren't tagged with json

pkg/apis/options/load_test.go+5−5

@@ -355,15 +355,15 @@ var _ = Describe("Load", func() {

355var _ = Describe("LoadYAML", func() {

356 Context("with a testOptions structure", func() {

357 type TestOptionSubStruct struct {

358− StringSliceOption []string `json:"stringSliceOption,omitempty"`

358+ StringSliceOption []string `yaml:"stringSliceOption,omitempty"`

359 }

360

361 type TestOptions struct {

362− StringOption string `json:"stringOption,omitempty"`

362+ StringOption string `yaml:"stringOption,omitempty"`

363− Sub TestOptionSubStruct `json:"sub,omitempty"`

363+ Sub TestOptionSubStruct `yaml:"sub,omitempty"`

364

365 // Check that embedded fields can be unmarshalled

366− TestOptionSubStruct `json:",inline,squash"`

366+ TestOptionSubStruct `yaml:",inline,squash"`

367 }

368

369 var testOptionsConfigBytesFull = []byte(`

@@ -445,7 +445,7 @@ sub:

445 configFile: []byte("\tfoo: bar"),

446 input: &TestOptions{},

447 expectedOutput: &TestOptions{},

448− expectedErr: errors.New("error unmarshalling config: error converting YAML to JSON: yaml: found character that cannot start any token"),

448+ expectedErr: errors.New("error unmarshalling config: yaml: found character that cannot start any token"),

449 }),

450 Entry("with extra fields in the YAML", loadYAMLTableInput{

451 configFile: append(testOptionsConfigBytesFull, []byte("foo: bar\n")...),

pkg/apis/options/login_url_parameters.go+5−5

@@ -71,19 +71,19 @@ package options

71// character.

72type LoginURLParameter struct {

73 // Name specifies the name of the query parameter.

74− Name string `json:"name"`

74+ Name string `yaml:"name"`

76 // Default specifies a default value or values that will be

77 // passed to the IdP if not overridden.

78 //+optional

79− Default []string `json:"default,omitempty"`

79+ Default []string `yaml:"default,omitempty"`

81 // Allow specifies rules about how the default (if any) may be

82 // overridden via the query string to `/oauth2/start`. Only

83 // values that match one or more of the allow rules will be

84 // forwarded to the IdP.

85 //+optional

86− Allow []URLParameterRule `json:"allow,omitempty"`

86+ Allow []URLParameterRule `yaml:"allow,omitempty"`

87}

89// URLParameterRule represents a rule by which query parameters

@@ -92,11 +92,11 @@ type LoginURLParameter struct {

92// login URL. Either Value or Pattern should be supplied, not both.

93type URLParameterRule struct {

94 // A Value rule matches just this specific value

95− Value *string `json:"value,omitempty"`

95+ Value *string `yaml:"value,omitempty"`

97 // A Pattern rule gives a regular expression that must be matched by

98 // some substring of the value. The expression is _not_ automatically

99 // anchored to the start and end of the value, if you _want_ to restrict

100 // the whole parameter value you must anchor it yourself with `^` and `$`.

101− Pattern *string `json:"pattern,omitempty"`

101+ Pattern *string `yaml:"pattern,omitempty"`

102}

pkg/apis/options/providers.go+68−68

@@ -22,78 +22,78 @@ type Providers []Provider

22type Provider struct {

23 // ClientID is the OAuth Client ID that is defined in the provider

24 // This value is required for all providers.

25− ClientID string `json:"clientID,omitempty"`

25+ ClientID string `yaml:"clientID,omitempty"`

26 // ClientSecret is the OAuth Client Secret that is defined in the provider

27 // This value is required for all providers.

28− ClientSecret string `json:"clientSecret,omitempty"`

28+ ClientSecret string `yaml:"clientSecret,omitempty"`

29 // ClientSecretFile is the name of the file

30 // containing the OAuth Client Secret, it will be used if ClientSecret is not set.

31− ClientSecretFile string `json:"clientSecretFile,omitempty"`

31+ ClientSecretFile string `yaml:"clientSecretFile,omitempty"`

33 // KeycloakConfig holds all configurations for Keycloak provider.

34− KeycloakConfig KeycloakOptions `json:"keycloakConfig,omitempty"`

34+ KeycloakConfig KeycloakOptions `yaml:"keycloakConfig,omitempty"`

35 // AzureConfig holds all configurations for Azure provider.

36− AzureConfig AzureOptions `json:"azureConfig,omitempty"`

36+ AzureConfig AzureOptions `yaml:"azureConfig,omitempty"`

37 // MicrosoftEntraIDConfig holds all configurations for Entra ID provider.

38− MicrosoftEntraIDConfig MicrosoftEntraIDOptions `json:"microsoftEntraIDConfig,omitempty"`

38+ MicrosoftEntraIDConfig MicrosoftEntraIDOptions `yaml:"microsoftEntraIDConfig,omitempty"`

39 // ADFSConfig holds all configurations for ADFS provider.

40− ADFSConfig ADFSOptions `json:"ADFSConfig,omitempty"`

40+ ADFSConfig ADFSOptions `yaml:"ADFSConfig,omitempty"`

41 // BitbucketConfig holds all configurations for Bitbucket provider.

42− BitbucketConfig BitbucketOptions `json:"bitbucketConfig,omitempty"`

42+ BitbucketConfig BitbucketOptions `yaml:"bitbucketConfig,omitempty"`

43 // GitHubConfig holds all configurations for GitHubC provider.

44− GitHubConfig GitHubOptions `json:"githubConfig,omitempty"`

44+ GitHubConfig GitHubOptions `yaml:"githubConfig,omitempty"`

45 // GitLabConfig holds all configurations for GitLab provider.

46− GitLabConfig GitLabOptions `json:"gitlabConfig,omitempty"`

46+ GitLabConfig GitLabOptions `yaml:"gitlabConfig,omitempty"`

47 // GoogleConfig holds all configurations for Google provider.

48− GoogleConfig GoogleOptions `json:"googleConfig,omitempty"`

48+ GoogleConfig GoogleOptions `yaml:"googleConfig,omitempty"`

49 // OIDCConfig holds all configurations for OIDC provider

50 // or providers utilize OIDC configurations.

51− OIDCConfig OIDCOptions `json:"oidcConfig,omitempty"`

51+ OIDCConfig OIDCOptions `yaml:"oidcConfig,omitempty"`

52 // LoginGovConfig holds all configurations for LoginGov provider.

53− LoginGovConfig LoginGovOptions `json:"loginGovConfig,omitempty"`

53+ LoginGovConfig LoginGovOptions `yaml:"loginGovConfig,omitempty"`

55 // ID should be a unique identifier for the provider.

56 // This value is required for all providers.

57− ID string `json:"id,omitempty"`

57+ ID string `yaml:"id,omitempty"`

58 // Type is the OAuth provider

59 // must be set from the supported providers group,

60 // otherwise 'Google' is set as default

61− Type ProviderType `json:"provider,omitempty"`

61+ Type ProviderType `yaml:"provider,omitempty"`

62 // Name is the providers display name

63 // if set, it will be shown to the users in the login page.

64− Name string `json:"name,omitempty"`

64+ Name string `yaml:"name,omitempty"`

65 // CAFiles is a list of paths to CA certificates that should be used when connecting to the provider.

66 // If not specified, the default Go trust sources are used instead

67− CAFiles []string `json:"caFiles,omitempty"`

67+ CAFiles []string `yaml:"caFiles,omitempty"`

68 // UseSystemTrustStore determines if your custom CA files and the system trust store are used

69 // If set to true, your custom CA files and the system trust store are used otherwise only your custom CA files.

70− UseSystemTrustStore bool `json:"useSystemTrustStore,omitempty"`

70+ UseSystemTrustStore bool `yaml:"useSystemTrustStore,omitempty"`

71 // LoginURL is the authentication endpoint

72− LoginURL string `json:"loginURL,omitempty"`

72+ LoginURL string `yaml:"loginURL,omitempty"`

73 // LoginURLParameters defines the parameters that can be passed from the start URL to the IdP login URL

74− LoginURLParameters []LoginURLParameter `json:"loginURLParameters,omitempty"`

74+ LoginURLParameters []LoginURLParameter `yaml:"loginURLParameters,omitempty"`

75 // AuthRequestResponseMode defines the response mode to request during authorization request

76− AuthRequestResponseMode string `json:"authRequestResponseMode,omitempty"`

76+ AuthRequestResponseMode string `yaml:"authRequestResponseMode,omitempty"`

77 // RedeemURL is the token redemption endpoint

78− RedeemURL string `json:"redeemURL,omitempty"`

78+ RedeemURL string `yaml:"redeemURL,omitempty"`

79 // ProfileURL is the profile access endpoint

80− ProfileURL string `json:"profileURL,omitempty"`

80+ ProfileURL string `yaml:"profileURL,omitempty"`

81 // SkipClaimsFromProfileURL allows to skip request to Profile URL for resolving claims not present in id_token

82 // default set to 'false'

83− SkipClaimsFromProfileURL bool `json:"skipClaimsFromProfileURL,omitempty"`

83+ SkipClaimsFromProfileURL bool `yaml:"skipClaimsFromProfileURL,omitempty"`

84 // ProtectedResource is the resource that is protected (Azure AD and ADFS only)

85− ProtectedResource string `json:"resource,omitempty"`

85+ ProtectedResource string `yaml:"resource,omitempty"`

86 // ValidateURL is the access token validation endpoint

87− ValidateURL string `json:"validateURL,omitempty"`

87+ ValidateURL string `yaml:"validateURL,omitempty"`

88 // Scope is the OAuth scope specification

89− Scope string `json:"scope,omitempty"`

89+ Scope string `yaml:"scope,omitempty"`

90 // AllowedGroups is a list of restrict logins to members of this group

91− AllowedGroups []string `json:"allowedGroups,omitempty"`

91+ AllowedGroups []string `yaml:"allowedGroups,omitempty"`

92 // The code challenge method

93− CodeChallengeMethod string `json:"code_challenge_method,omitempty"`

93+ CodeChallengeMethod string `yaml:"code_challenge_method,omitempty"`

95 // URL to call to perform backend logout, `{id_token}` would be replaced by the actual `id_token` if available in the session

96− BackendLogoutURL string `json:"backendLogoutURL"`

96+ BackendLogoutURL string `yaml:"backendLogoutURL"`

97}

99// ProviderType is used to enumerate the different provider type options

@@ -157,19 +157,19 @@ const (

157

158type KeycloakOptions struct {

159 // Group enables to restrict login to members of indicated group

160− Groups []string `json:"groups,omitempty"`

160+ Groups []string `yaml:"groups,omitempty"`

161

162 // Role enables to restrict login to users with role (only available when using the keycloak-oidc provider)

163− Roles []string `json:"roles,omitempty"`

163+ Roles []string `yaml:"roles,omitempty"`

164}

165

166type AzureOptions struct {

167 // Tenant directs to a tenant-specific or common (tenant-independent) endpoint

168 // Default value is 'common'

169− Tenant string `json:"tenant,omitempty"`

169+ Tenant string `yaml:"tenant,omitempty"`

170 // GraphGroupField configures the group field to be used when building the groups list from Microsoft Graph

171 // Default value is 'id'

172− GraphGroupField string `json:"graphGroupField,omitempty"`

172+ GraphGroupField string `yaml:"graphGroupField,omitempty"`

173}

174

175type MicrosoftEntraIDOptions struct {

@@ -177,114 +177,114 @@ type MicrosoftEntraIDOptions struct {

177 // issued by different issuers and OIDC issuer verification needs to be disabled.

178 // When not specified, all tenants are allowed. Redundant for single-tenant apps

179 // (regular ID token validation matches the issuer).

180− AllowedTenants []string `json:"allowedTenants,omitempty"`

180+ AllowedTenants []string `yaml:"allowedTenants,omitempty"`

181

182 // FederatedTokenAuth enable oAuth2 client authentication with federated token projected

183 // by Entra Workload Identity plugin, instead of client secret.

184− FederatedTokenAuth bool `json:"federatedTokenAuth,omitempty"`

184+ FederatedTokenAuth bool `yaml:"federatedTokenAuth,omitempty"`

185}

186

187type ADFSOptions struct {

188 // Skip adding the scope parameter in login request

189 // Default value is 'false'

190− SkipScope bool `json:"skipScope,omitempty"`

190+ SkipScope bool `yaml:"skipScope,omitempty"`

191}

192

193type BitbucketOptions struct {

194 // Team sets restrict logins to members of this team

195− Team string `json:"team,omitempty"`

195+ Team string `yaml:"team,omitempty"`

196 // Repository sets restrict logins to user with access to this repository

197− Repository string `json:"repository,omitempty"`

197+ Repository string `yaml:"repository,omitempty"`

198}

199

200type GitHubOptions struct {

201 // Org sets restrict logins to members of this organisation

202− Org string `json:"org,omitempty"`

202+ Org string `yaml:"org,omitempty"`

203 // Team sets restrict logins to members of this team

204− Team string `json:"team,omitempty"`

204+ Team string `yaml:"team,omitempty"`

205 // Repo sets restrict logins to collaborators of this repository

206− Repo string `json:"repo,omitempty"`

206+ Repo string `yaml:"repo,omitempty"`

207 // Token is the token to use when verifying repository collaborators

208 // it must have push access to the repository

209− Token string `json:"token,omitempty"`

209+ Token string `yaml:"token,omitempty"`

210 // Users allows users with these usernames to login

211 // even if they do not belong to the specified org and team or collaborators

212− Users []string `json:"users,omitempty"`

212+ Users []string `yaml:"users,omitempty"`

213}

214

215type GitLabOptions struct {

216 // Group sets restrict logins to members of this group

217− Group []string `json:"group,omitempty"`

217+ Group []string `yaml:"group,omitempty"`

218 // Projects restricts logins to members of these projects

219− Projects []string `json:"projects,omitempty"`

219+ Projects []string `yaml:"projects,omitempty"`

220}

221

222type GoogleOptions struct {

223 // Groups sets restrict logins to members of this Google group

224− Groups []string `json:"group,omitempty"`

224+ Groups []string `yaml:"group,omitempty"`

225 // AdminEmail is the Google admin to impersonate for api calls

226− AdminEmail string `json:"adminEmail,omitempty"`

226+ AdminEmail string `yaml:"adminEmail,omitempty"`

227 // ServiceAccountJSON is the path to the service account json credentials

228− ServiceAccountJSON string `json:"serviceAccountJson,omitempty"`

228+ ServiceAccountJSON string `yaml:"serviceAccountJson,omitempty"`

229 // UseApplicationDefaultCredentials is a boolean whether to use Application Default Credentials instead of a ServiceAccountJSON

230− UseApplicationDefaultCredentials bool `json:"useApplicationDefaultCredentials,omitempty"`

230+ UseApplicationDefaultCredentials bool `yaml:"useApplicationDefaultCredentials,omitempty"`

231 // TargetPrincipal is the Google Service Account used for Application Default Credentials

232− TargetPrincipal string `json:"targetPrincipal,omitempty"`

232+ TargetPrincipal string `yaml:"targetPrincipal,omitempty"`

233 // UseOrganizationId indicates whether to use the organization ID as the UserName claim

234− UseOrganizationID bool `json:"useOrganizationID,omitempty"`

234+ UseOrganizationID bool `yaml:"useOrganizationID,omitempty"`

235 // admin scope needed for fetching user organization information from admin api, can be one of cloud, user or defaults to readonly

236− AdminAPIUserScope string `json:"adminAPIUserScope,omitempty"`

236+ AdminAPIUserScope string `yaml:"adminAPIUserScope,omitempty"`

237}

238

239type OIDCOptions struct {

240 // IssuerURL is the OpenID Connect issuer URL

241 // eg: https://accounts.google.com

242− IssuerURL string `json:"issuerURL,omitempty"`

242+ IssuerURL string `yaml:"issuerURL,omitempty"`

243 // InsecureAllowUnverifiedEmail prevents failures if an email address in an id_token is not verified

244 // default set to 'false'

245− InsecureAllowUnverifiedEmail bool `json:"insecureAllowUnverifiedEmail"`

245+ InsecureAllowUnverifiedEmail bool `yaml:"insecureAllowUnverifiedEmail"`

246 // InsecureSkipIssuerVerification skips verification of ID token issuers. When false, ID Token Issuers must match the OIDC discovery URL

247 // default set to 'false'

248− InsecureSkipIssuerVerification bool `json:"insecureSkipIssuerVerification"`

248+ InsecureSkipIssuerVerification bool `yaml:"insecureSkipIssuerVerification"`

249 // InsecureSkipNonce skips verifying the ID Token's nonce claim that must match

250 // the random nonce sent in the initial OAuth flow. Otherwise, the nonce is checked

251 // after the initial OAuth redeem & subsequent token refreshes.

252 // default set to 'true'

253 // Warning: In a future release, this will change to 'false' by default for enhanced security.

254− InsecureSkipNonce bool `json:"insecureSkipNonce"`

254+ InsecureSkipNonce bool `yaml:"insecureSkipNonce"`

255 // SkipDiscovery allows to skip OIDC discovery and use manually supplied Endpoints

256 // default set to 'false'

257− SkipDiscovery bool `json:"skipDiscovery,omitempty"`

257+ SkipDiscovery bool `yaml:"skipDiscovery,omitempty"`

258 // JwksURL is the OpenID Connect JWKS URL

259 // eg: https://www.googleapis.com/oauth2/v3/certs

260− JwksURL string `json:"jwksURL,omitempty"`

260+ JwksURL string `yaml:"jwksURL,omitempty"`

261 // PublicKeyFiles is a list of paths pointing to public key files in PEM format to use

262 // for verifying JWT tokens

263− PublicKeyFiles []string `json:"publicKeyFiles,omitempty"`

263+ PublicKeyFiles []string `yaml:"publicKeyFiles,omitempty"`

264 // EmailClaim indicates which claim contains the user email,

265 // default set to 'email'

266− EmailClaim string `json:"emailClaim,omitempty"`

266+ EmailClaim string `yaml:"emailClaim,omitempty"`

267 // GroupsClaim indicates which claim contains the user groups

268 // default set to 'groups'

269− GroupsClaim string `json:"groupsClaim,omitempty"`

269+ GroupsClaim string `yaml:"groupsClaim,omitempty"`

270 // UserIDClaim indicates which claim contains the user ID

271 // default set to 'email'

272− UserIDClaim string `json:"userIDClaim,omitempty"`

272+ UserIDClaim string `yaml:"userIDClaim,omitempty"`

273 // AudienceClaim allows to define any claim that is verified against the client id

274 // By default `aud` claim is used for verification.

275− AudienceClaims []string `json:"audienceClaims,omitempty"`

275+ AudienceClaims []string `yaml:"audienceClaims,omitempty"`

276 // ExtraAudiences is a list of additional audiences that are allowed

277 // to pass verification in addition to the client id.

278− ExtraAudiences []string `json:"extraAudiences,omitempty"`

278+ ExtraAudiences []string `yaml:"extraAudiences,omitempty"`

279}

280

281type LoginGovOptions struct {

282 // JWTKey is a private key in PEM format used to sign JWT,

283− JWTKey string `json:"jwtKey,omitempty"`

283+ JWTKey string `yaml:"jwtKey,omitempty"`

284 // JWTKeyFile is a path to the private key file in PEM format used to sign the JWT

285− JWTKeyFile string `json:"jwtKeyFile,omitempty"`

285+ JWTKeyFile string `yaml:"jwtKeyFile,omitempty"`

286 // PubJWKURL is the JWK pubkey access endpoint

287− PubJWKURL string `json:"pubjwkURL,omitempty"`

287+ PubJWKURL string `yaml:"pubjwkURL,omitempty"`

288}

289

290func providerDefaults() Providers {

pkg/apis/options/secret_source.go+3−3

@@ -4,11 +4,11 @@ package options

4// Only one source within the struct should be defined at any time.

5type SecretSource struct {

6 // Value expects a base64 encoded string value.

7− Value string `json:"value,omitempty"`

7+ Value string `yaml:"value,omitempty"`

9 // FromEnv expects the name of an environment variable.

10− FromEnv string `json:"fromEnv,omitempty"`

10+ FromEnv string `yaml:"fromEnv,omitempty"`

12 // FromFile expects a path to a file containing the secret value.

13− FromFile string `json:"fromFile,omitempty"`

13+ FromFile string `yaml:"fromFile,omitempty"`

14}

pkg/apis/options/server.go+7−7

@@ -4,15 +4,15 @@ package options

4type Server struct {

5 // BindAddress is the address on which to serve traffic.

6 // Leave blank or set to "-" to disable.

7− BindAddress string

7+ BindAddress string `yaml:"bindAddress,omitempty"`

9 // SecureBindAddress is the address on which to serve secure traffic.

10 // Leave blank or set to "-" to disable.

11− SecureBindAddress string

11+ SecureBindAddress string `yaml:"secureBindAddress,omitempty"`

13 // TLS contains the information for loading the certificate and key for the

14 // secure traffic and further configuration for the TLS server.

15− TLS *TLS

15+ TLS *TLS `yaml:"tls,omitempty"`

16}

18// TLS contains the information for loading a TLS certificate and key

@@ -20,15 +20,15 @@ type Server struct {

20type TLS struct {

21 // Key is the TLS key data to use.

22 // Typically this will come from a file.

23− Key *SecretSource

23+ Key *SecretSource `yaml:"key,omitempty"`

25 // Cert is the TLS certificate data to use.

26 // Typically this will come from a file.

27− Cert *SecretSource

27+ Cert *SecretSource `yaml:"cert,omitempty"`

29 // MinVersion is the minimal TLS version that is acceptable.

30 // E.g. Set to "TLS1.3" to select TLS version 1.3

31− MinVersion string

31+ MinVersion string `yaml:"minVersion,omitempty"`

33 // CipherSuites is a list of TLS cipher suites that are allowed.

34 // E.g.:

@@ -36,5 +36,5 @@ type TLS struct {

36 // - TLS_RSA_WITH_AES_256_GCM_SHA384

37 // If not specified, the default Go safe cipher list is used.

38 // List of valid cipher suites can be found in the [crypto/tls documentation](https://pkg.go.dev/crypto/tls#pkg-constants).

39− CipherSuites []string

39+ CipherSuites []string `yaml:"cipherSuites,omitempty"`

40}

pkg/apis/options/upstreams.go+14−14

@@ -14,11 +14,11 @@ const (

14type UpstreamConfig struct {

15 // ProxyRawPath will pass the raw url path to upstream allowing for urls

16 // like: "/%2F/" which would otherwise be redirected to "/"

17− ProxyRawPath bool `json:"proxyRawPath,omitempty"`

17+ ProxyRawPath bool `yaml:"proxyRawPath,omitempty"`

19 // Upstreams represents the configuration for the upstream servers.

20 // Requests will be proxied to this upstream if the path matches the request path.

21− Upstreams []Upstream `json:"upstreams,omitempty"`

21+ Upstreams []Upstream `yaml:"upstreams,omitempty"`

22}

24// Upstream represents the configuration for an upstream server.

@@ -26,7 +26,7 @@ type UpstreamConfig struct {

26type Upstream struct {

27 // ID should be a unique identifier for the upstream.

28 // This value is required for all upstreams.

29− ID string `json:"id,omitempty"`

29+ ID string `yaml:"id,omitempty"`

31 // Path is used to map requests to the upstream server.

32 // The closest match will take precedence and all Paths must be unique.

@@ -36,7 +36,7 @@ type Upstream struct {

36 // - `^/foo$`: Match only the explicit path `/foo`

37 // - `^/bar/$`: Match any path prefixed with `/bar/`

38 // - `^/baz/(.*)$`: Match any path prefixed with `/baz` and capture the remaining path for use with RewriteTarget

39− Path string `json:"path,omitempty"`

39+ Path string `yaml:"path,omitempty"`

41 // RewriteTarget allows users to rewrite the request path before it is sent to

42 // the upstream server (for an HTTP/HTTPS upstream) or mapped to the filesystem

@@ -46,7 +46,7 @@ type Upstream struct {

46 // the request `/baz/abc/123` to `/foo/abc/123` before proxying to the

47 // upstream server. Or if the upstream were `file:///app`, a request for

48 // `/baz/info.html` would return the contents of the file `/app/foo/info.html`.

49− RewriteTarget string `json:"rewriteTarget,omitempty"`

49+ RewriteTarget string `yaml:"rewriteTarget,omitempty"`

51 // The URI of the upstream server. This may be an HTTP(S) server of a File

52 // based URL. It may include a path, in which case all requests will be served

@@ -58,43 +58,43 @@ type Upstream struct {

58 // - file://host/path

59 // If the URI's path is "/base" and the incoming request was for "/dir",

60 // the upstream request will be for "/base/dir".

61− URI string `json:"uri,omitempty"`

61+ URI string `yaml:"uri,omitempty"`

63 // InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.

64 // This option is insecure and will allow potential Man-In-The-Middle attacks

65 // between OAuth2 Proxy and the upstream server.

66 // Defaults to false.

67− InsecureSkipTLSVerify bool `json:"insecureSkipTLSVerify,omitempty"`

67+ InsecureSkipTLSVerify bool `yaml:"insecureSkipTLSVerify,omitempty"`

69 // Static will make all requests to this upstream have a static response.

70 // The response will have a body of "Authenticated" and a response code

71 // matching StaticCode.

72 // If StaticCode is not set, the response will return a 200 response.

73− Static bool `json:"static,omitempty"`

73+ Static bool `yaml:"static,omitempty"`

75 // StaticCode determines the response code for the Static response.

76 // This option can only be used with Static enabled.

77− StaticCode *int `json:"staticCode,omitempty"`

77+ StaticCode *int `yaml:"staticCode,omitempty"`

79 // FlushInterval is the period between flushing the response buffer when

80 // streaming response from the upstream.

81 // Defaults to 1 second.

82− FlushInterval *time.Duration `json:"flushInterval,omitempty"`

82+ FlushInterval *time.Duration `yaml:"flushInterval,omitempty"`

84 // PassHostHeader determines whether the request host header should be proxied

85 // to the upstream server.

86 // Defaults to true.

87− PassHostHeader *bool `json:"passHostHeader,omitempty"`

87+ PassHostHeader *bool `yaml:"passHostHeader,omitempty"`

89 // ProxyWebSockets enables proxying of websockets to upstream servers

90 // Defaults to true.

91− ProxyWebSockets *bool `json:"proxyWebSockets,omitempty"`

91+ ProxyWebSockets *bool `yaml:"proxyWebSockets,omitempty"`

93 // Timeout is the maximum duration the server will wait for a response from the upstream server.

94 // Defaults to 30 seconds.

95− Timeout *time.Duration `json:"timeout,omitempty"`

95+ Timeout *time.Duration `yaml:"timeout,omitempty"`

97 // DisableKeepAlives disables HTTP keep-alive connections to the upstream server.

98 // Defaults to false.

99− DisableKeepAlives bool `json:"disableKeepAlives,omitempty"`

99+ DisableKeepAlives bool `yaml:"disableKeepAlives,omitempty"`

100}

pkg/requests/result_test.go+2−2

@@ -104,8 +104,8 @@ var _ = Describe("Result suite", func() {

104

105 Context("UnmarshalInto", func() {

106 type testStruct struct {

107− A string `json:"a"`

107+ A string `yaml:"a"`

108− B int `json:"b"`

108+ B int `yaml:"b"`

109 }

110

111 type unmarshalIntoTableInput struct {