@@ -213,6 +213,7 @@ func NewOAuthProxy(opts *options.Options, validator func(string) bool) (*OAuthPr
213213 trustedIPs: trustedIPs,
214214 Banner: opts.Banner,
215215 Footer: opts.Footer,
216+ SignInMessage: buildSignInMessage(opts),
216217
217218 basicAuthValidator: basicAuthValidator,
218219 displayHtpasswdForm: basicAuthValidator != nil,
@@ -255,6 +256,24 @@ func buildSessionChain(opts *options.Options, sessionStore sessionsapi.SessionSt
255256 return chain
256257}
257258
259+func buildSignInMessage(opts *options.Options) string {
260+ var msg string
261+ if len(opts.Banner) >= 1 {
262+ if opts.Banner == "-" {
263+ msg = ""
264+ } else {
265+ msg = opts.Banner
266+ }
267+ } else if len(opts.EmailDomains) != 0 && opts.AuthenticatedEmailsFile == "" {
268+ if len(opts.EmailDomains) > 1 {
269+ msg = fmt.Sprintf("Authenticate using one of the following domains: %v", strings.Join(opts.EmailDomains, ", "))
270+ } else if opts.EmailDomains[0] != "*" {
271+ msg = fmt.Sprintf("Authenticate using %v", opts.EmailDomains[0])
272+ }
273+ }
274+ return msg
275+}
276+
258277// GetRedirectURI returns the redirectURL that the upstream OAuth Provider will
259278// redirect clients to once authenticated
260279func (p *OAuthProxy) GetRedirectURI(host string) string {