git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #529 from oauth2-proxy/test-environment
d0cfca4Joel Speed
CHANGELOG.md+1
compare with master
unifiedsplit
@@ -35,6 +35,7 @@
35
35
36## Changes since v5.1.1
36## Changes since v5.1.1
37
37
38+- [#529](https://github.com/oauth2-proxy/oauth2-proxy/pull/529) Add local test environments for testing changes and new features (@JoelSpeed)
38- [#537](https://github.com/oauth2-proxy/oauth2-proxy/pull/537) Drop Fallback to Email if User not set (@JoelSpeed)
39- [#537](https://github.com/oauth2-proxy/oauth2-proxy/pull/537) Drop Fallback to Email if User not set (@JoelSpeed)
39- [#535](https://github.com/oauth2-proxy/oauth2-proxy/pull/535) Drop support for pre v3.1 cookies (@JoelSpeed)
40- [#535](https://github.com/oauth2-proxy/oauth2-proxy/pull/535) Drop support for pre v3.1 cookies (@JoelSpeed)
40- [#533](https://github.com/oauth2-proxy/oauth2-proxy/pull/487) Set up code coverage within Travis for Code Climate (@JoelSpeed)
41- [#533](https://github.com/oauth2-proxy/oauth2-proxy/pull/487) Set up code coverage within Travis for Code Climate (@JoelSpeed)
Makefile+11−1
@@ -76,7 +76,7 @@ release: lint test
76 BINARY=${BINARY} VERSION=${VERSION} ./dist.sh
76 BINARY=${BINARY} VERSION=${VERSION} ./dist.sh
77
77
78.PHONY: validate-go-version
78.PHONY: validate-go-version
79−validate-go-version: ## Validates the installed version of go against Mattermost's minimum requirement.
79+validate-go-version:
80 @if [ $(GO_MAJOR_VERSION) -gt $(MINIMUM_SUPPORTED_GO_MAJOR_VERSION) ]; then \
80 @if [ $(GO_MAJOR_VERSION) -gt $(MINIMUM_SUPPORTED_GO_MAJOR_VERSION) ]; then \
81 exit 0 ;\
81 exit 0 ;\
82 elif [ $(GO_MAJOR_VERSION) -lt $(MINIMUM_SUPPORTED_GO_MAJOR_VERSION) ]; then \
82 elif [ $(GO_MAJOR_VERSION) -lt $(MINIMUM_SUPPORTED_GO_MAJOR_VERSION) ]; then \
@@ -86,3 +86,13 @@ validate-go-version: ## Validates the installed version of go against Mattermost
86 echo '$(GO_VERSION_VALIDATION_ERR_MSG)';\
86 echo '$(GO_VERSION_VALIDATION_ERR_MSG)';\
87 exit 1; \
87 exit 1; \
88 fi
88 fi
89+
90+# local-env can be used to interact with the local development environment
91+# eg:
92+# make local-env-up # Bring up a basic test environment
93+# make local-env-down # Tear down the basic test environment
94+# make local-env-nginx-up # Bring up an nginx based test environment
95+# make local-env-nginx-down # Tead down the nginx based test environment
96+.PHONY: local-env-%
97+local-env-%:
98+ make -C contrib/local-environment $*
contrib/local-environment/Makefilenew file+15
@@ -0,0 +1,15 @@
1+.PHONY: up
2+up:
3+ docker-compose up -d
4+
5+.PHONY: %
6+%:
7+ docker-compose $*
8+
9+.PHONY: nginx-up
10+nginx-up:
11+ docker-compose -f docker-compose.yaml -f docker-compose-nginx.yaml up -d
12+
13+.PHONY: nginx-%
14+nginx-%:
15+ docker-compose -f docker-compose.yaml -f docker-compose-nginx.yaml $*
contrib/local-environment/dex.yamlnew file+32
@@ -0,0 +1,32 @@
1+# This configuration is intended to be used with the docker-compose testing
2+# environment.
3+# This should configure Dex to run on port 4190 and provides a static login
4+issuer: http://dex.localhost:4190/dex
5+storage:
6+ type: etcd
7+ config:
8+ endpoints:
9+ - http://etcd:2379
10+ namespace: dex/
11+web:
12+ http: 0.0.0.0:4190
13+oauth2:
14+ skipApprovalScreen: true
15+expiry:
16+ signingKeys: "4h"
17+ idTokens: "1h"
18+staticClients:
19+- id: oauth2-proxy
20+ redirectURIs:
21+ # These redirect URIs point to the `--redirect-url` for OAuth2 proxy.
22+ - 'http://localhost:4180/oauth2/callback' # For basic proxy example.
23+ - 'http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback' # For nginx example.
24+ name: 'OAuth2 Proxy'
25+ secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK
26+enablePasswordDB: true
27+staticPasswords:
28+- email: "admin@example.com"
29+ # bcrypt hash of the string "password"
30+ hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
31+ username: "admin"
32+ userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
contrib/local-environment/docker-compose-nginx.yamlnew file+43
@@ -0,0 +1,43 @@
1+# This docker-compose file can be used to bring up an example instance of oauth2-proxy
2+# for manual testing and exploration of features.
3+# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,
4+# etcd for storage for Dex, nginx as a reverse proxy and other http services for upstreams
5+#
6+# This file is an extension of the main compose file and must be used with it
7+# docker-compose -f docker-compose.yaml -f docker-compose-nginx.yaml <command>
8+# Alternatively:
9+# make nginx-<command> (eg make nginx-up, make nginx-down)
10+#
11+# Access one of the following URLs to initiate a login flow:
12+# - http://oauth2-proxy.localhost
13+# - http://httpbin.oauth2-proxy.localhost
14+#
15+# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.oauth2-proxy.localhost
16+#
17+# Note, the above URLs should work with Chrome, but you may need to add hosts
18+# entries for other browsers
19+# 127.0.0.1 oauth2-proxy.localhost
20+# 127.0.0.1 httpbin.oauth2-proxy.localhost
21+# 127.0.0.1 oauth2-proxy.oauth2-proxy.localhost
22+version: '3.0'
23+services:
24+ oauth2-proxy:
25+ ports: []
26+ hostname: oauth2-proxy
27+ volumes:
28+ - "./oauth2-proxy-nginx.cfg:/oauth2-proxy.cfg"
29+ networks:
30+ oauth2-proxy: {}
31+ nginx:
32+ container_name: nginx
33+ image: nginx:1.18
34+ ports:
35+ - 80:80/tcp
36+ hostname: nginx
37+ volumes:
38+ - "./nginx.conf:/etc/nginx/conf.d/default.conf"
39+ networks:
40+ oauth2-proxy: {}
41+ httpbin: {}
42+networks:
43+ oauth2-proxy: {}
contrib/local-environment/docker-compose.yamlnew file+64
@@ -0,0 +1,64 @@
1+# This docker-compose file can be used to bring up an example instance of oauth2-proxy
2+# for manual testing and exploration of features.
3+# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,
4+# etcd for storage for Dex and HTTPBin as an example upstream.
5+#
6+# This can either be created using docker-compose
7+# docker-compose -f docker-compose.yaml <command>
8+# Or:
9+# make <command> (eg. make up, make down)
10+#
11+# Access http://localhost:4180 to initiate a login cycle
12+version: '3.0'
13+services:
14+ oauth2-proxy:
15+ container_name: oauth2-proxy
16+ image: quay.io/oauth2-proxy/oauth2-proxy:v5.1.1
17+ command: --config /oauth2-proxy.cfg
18+ ports:
19+ - 4180:4180/tcp
20+ hostname: oauth2-proxy
21+ volumes:
22+ - "./oauth2-proxy.cfg:/oauth2-proxy.cfg"
23+ restart: unless-stopped
24+ networks:
25+ dex: {}
26+ httpbin: {}
27+ depends_on:
28+ - dex
29+ - httpbin
30+ dex:
31+ container_name: dex
32+ image: quay.io/dexidp/dex:v2.23.0
33+ command: serve /dex.yaml
34+ ports:
35+ - 4190:4190/tcp
36+ hostname: dex
37+ volumes:
38+ - "./dex.yaml:/dex.yaml"
39+ restart: unless-stopped
40+ networks:
41+ dex:
42+ aliases:
43+ - dex.localhost
44+ etcd: {}
45+ depends_on:
46+ - etcd
47+ httpbin:
48+ container_name: httpbin
49+ image: kennethreitz/httpbin
50+ networks:
51+ httpbin: {}
52+ etcd:
53+ container_name: etcd
54+ image: gcr.io/etcd-development/etcd:v3.4.7
55+ entrypoint: /usr/local/bin/etcd
56+ command:
57+ - --listen-client-urls=http://0.0.0.0:2379
58+ - --advertise-client-urls=http://etcd:2379
59+ networks:
60+ etcd: {}
61+networks:
62+ dex: {}
63+ etcd: {}
64+ httpbin: {}
contrib/local-environment/nginx.confnew file+84
@@ -0,0 +1,84 @@
1+# Reverse proxy to oauth2-proxy
2+server {
3+ listen 80;
4+ server_name oauth2-proxy.oauth2-proxy.localhost;
5+
6+ location / {
7+ proxy_set_header Host $host;
8+ proxy_set_header X-Real-IP $remote_addr;
9+
10+ proxy_pass http://oauth2-proxy:4180/;
11+ }
12+}
13+
14+# Reverse proxy to httpbin
15+server {
16+ listen 80;
17+ server_name httpbin.oauth2-proxy.localhost;
18+
19+ auth_request /internal-auth/oauth2/auth;
20+
21+ # If the auth_request denies the request (401), redirect to the sign_in page
22+ # and include the final rd URL back to the user's original request.
23+ error_page 401 = http://oauth2-proxy.oauth2-proxy.localhost/oauth2/sign_in?rd=$scheme://$host$request_uri;
24+
25+ # Alternatively send the request to `start` to skip the provider button
26+ # error_page 401 = http://oauth2-proxy.oauth2-proxy.localhost/oauth2/start?rd=$scheme://$host$request_uri;
27+
28+ location / {
29+ proxy_pass http://httpbin/;
30+ }
31+
32+ # auth_request must be a URI so this allows an internal path to then proxy to
33+ # the real auth_request path.
34+ # The trailing /'s are required so that nginx strips the prefix before proxying.
35+ location /internal-auth/ {
36+ internal; # Ensure external users can't access this path
37+
38+ # Make sure the OAuth2 Proxy knows where the original request came from.
39+ proxy_set_header Host $host;
40+ proxy_set_header X-Real-IP $remote_addr;
41+
42+ proxy_pass http://oauth2-proxy:4180/;
43+ }
44+}
45+
46+# Statically serve the nginx welcome
47+server {
48+ listen 80;
49+ server_name oauth2-proxy.localhost;
50+
51+ location / {
52+ auth_request /internal-auth/oauth2/auth;
53+
54+ # If the auth_request denies the request (401), redirect to the sign_in page
55+ # and include the final rd URL back to the user's original request.
56+ error_page 401 = http://oauth2-proxy.oauth2-proxy.localhost/oauth2/sign_in?rd=$scheme://$host$request_uri;
57+
58+ # Alternatively send the request to `start` to skip the provider button
59+ # error_page 401 = http://oauth2-proxy.oauth2-proxy.localhost/oauth2/start?rd=$scheme://$host$request_uri;
60+
61+
62+ root /usr/share/nginx/html;
63+ index index.html index.htm;
64+ }
65+
66+ # redirect server error pages to the static page /50x.html
67+ error_page 500 502 503 504 /50x.html;
68+ location = /50x.html {
69+ root /usr/share/nginx/html;
70+ }
71+
72+ # auth_request must be a URI so this allows an internal path to then proxy to
73+ # the real auth_request path.
74+ # The trailing /'s are required so that nginx strips the prefix before proxying.
75+ location /internal-auth/ {
76+ internal; # Ensure external users can't access this path
77+
78+ # Make sure the OAuth2 Proxy knows where the original request came from.
79+ proxy_set_header Host $host;
80+ proxy_set_header X-Real-IP $remote_addr;
81+
82+ proxy_pass http://oauth2-proxy:4180/;
83+ }
84+}
contrib/local-environment/oauth2-proxy-nginx.cfgnew file+12
@@ -0,0 +1,12 @@
1+http_address="0.0.0.0:4180"
2+cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="
3+provider="oidc"
4+email_domains="example.com"
5+oidc_issuer_url="http://dex.localhost:4190/dex"
6+client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"
7+client_id="oauth2-proxy"
8+cookie_secure="false"
9+
10+redirect_url="http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback"
11+cookie_domain=".oauth2-proxy.localhost" # Required so cookie can be read on all subdomains.
12+whitelist_domains=".oauth2-proxy.localhost" # Required to allow redirection back to original requested target.
contrib/local-environment/oauth2-proxy.cfgnew file+11
@@ -0,0 +1,11 @@
1+http_address="0.0.0.0:4180"
2+cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="
3+provider="oidc"
4+email_domains="example.com"
5+oidc_issuer_url="http://dex.localhost:4190/dex"
6+client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"
7+client_id="oauth2-proxy"
8+cookie_secure="false"
9+
10+redirect_url="http://localhost:4180/oauth2/callback"
11+upstreams="http://httpbin"