d247274 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

on master help sign in

Add nginx auth_request config to README

d247274Mike Bland11 years ago

README.md+28−2

compare with master

unifiedsplit

@@ -239,7 +239,6 @@ The command line to run `oauth2_proxy` in this configuration would look like thi

239 --client-secret=...

240```

241

242−

243## Endpoint Documentation

242## Endpoint Documentation

244

243

245OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The `/oauth2` prefix can be changed with the `--proxy-prefix` config variable.

244OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The `/oauth2` prefix can be changed with the `--proxy-prefix` config variable.

@@ -249,7 +248,7 @@ OAuth2 Proxy responds directly to the following endpoints. All other endpoints w

249* /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)

248* /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)

250* /oauth2/start - a URL that will redirect to start the OAuth cycle

249* /oauth2/start - a URL that will redirect to start the OAuth cycle

251* /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.

250* /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.

252−* /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the [Nginx `auth_request` directive](http://nginx.org/en/docs/http/ngx_http_auth_request_module.html)

251+* /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the [Nginx `auth_request` directive](#nginx-auth-request)

253

252

254## Logging Format

253## Logging Format

255

254

@@ -266,3 +265,30 @@ Follow the examples in the [`providers` package](providers/) to define a new

266`Provider` instance. Add a new `case` to

265`Provider` instance. Add a new `case` to

267[`providers.New()`](providers/providers.go) to allow `oauth2_proxy` to use the

266[`providers.New()`](providers/providers.go) to allow `oauth2_proxy` to use the

268new `Provider`.

267new `Provider`.

268+

269+## <a name="nginx-auth-request"></a>Configuring for use with the Nginx `auth_request` directive

270+

271+The [Nginx `auth_request` directive](http://nginx.org/en/docs/http/ngx_http_auth_request_module.html) allows Nginx to authenticate requests via the oauth2_proxy's `/auth` endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:

272+

273+```nginx

274+server {

275+ listen 443 ssl spdy;

276+ server_name ...;

277+ include ssl/ssl.conf;

278+

279+ location = /auth {

280+ internal;

281+ proxy_pass http://127.0.0.1:4180;

282+ }

283+

284+ location / {

285+ auth_request /auth;

286+ error_page 401 = ...;

287+

288+ root /path/to/the/site;

289+ default_type text/html;

290+ charset utf-8;

291+ charset_types application/json utf-8;

292+ }

293+}

294+```