@@ -47,7 +47,7 @@ Usage of ./google_auth_proxy:
4747 -cookie-secret="": the seed string for secure cookies
4848 -google-apps-domain="": authenticate against the given google apps domain
4949 -htpasswd-file="": additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption
50− -http-address="0.0.0.0:4180": <addr>:<port> to listen on for HTTP clients
50+ -http-address="127.0.0.1:4180": <addr>:<port> to listen on for HTTP clients
5151 -pass-basic-auth=true: pass HTTP Basic Auth information to upstream
5252 -redirect-url="": the OAuth Redirect URL. ie: "https://internalapp.yourcompany.com/oauth2/callback"
5353 -upstream=[]: the http url(s) of the upstream endpoint. If multiple, routing is based on path
@@ -57,20 +57,12 @@ Usage of ./google_auth_proxy:
5757
5858## Example Configuration
5959
60−To run `google_auth_proxy` as a reverse proxy on port `4180` authenticating requests for an application running
61−on port `8080` at `http://internal.yourcompany.com/` you would use
60+This example has a [Nginx](http://nginx.org/) SSL endpoint proxying to `google_auth_proxy` on port `4180`.
61+`google_auth_proxy` then authenticates requests for an upstream application running on port `8080`. The external
62+endpoint for this example would be `https://internal.yourcompany.com/`.
6263
63−```bash
64−./google_auth_proxy \
65− --redirect-url="https://internal.yourcompany.com/oauth2/callback" \
66− --google-apps-domain="yourcompany.com" \
67− --upstream=http://127.0.0.1:8080/ \
68− --cookie-secret=... \
69− --client-id=... \
70− --client-secret=...
71−```
72−
73−An example Nginx config to listen on ssl (port 443) and forward requests to port google_auth_proxy on port 4180 would be
64+An example Nginx config follows. Note the use of `Strict-Transport-Security` header to pin requests to SSL
65+via [HSTS](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security):
7466
7567```
7668server {
@@ -92,6 +84,20 @@ server {
9284}
9385```
9486
87+The command line to run `google_auth_proxy` would look like this:
88+
89+```bash
90+./google_auth_proxy \
91+ --redirect-url="https://internal.yourcompany.com/oauth2/callback" \
92+ --google-apps-domain="yourcompany.com" \
93+ --upstream=http://127.0.0.1:8080/ \
94+ --cookie-secret=... \
95+ --client-id=... \
96+ --client-secret=...
97+```
98+
99+
100+
95101## Endpoint Documentation
96102
97103Google auth proxy responds directly to the following endpoints. All other endpoints will be authenticated.