git.iko.soy/typeable/oauth2-proxy
on master help sign in
Update Keycloak documentation
commitf07a5630f1138ce8364edda3de585a907c44d210 authorNick Meves <nick.meves@greenhouse.io> dateSat 12 Dec 2020, 13:50 (6 years ago) parent138a6b1
3 files changed+25−12
compare with master
unifiedsplit
CHANGELOG.md+5 docs/docs/configuration/auth.md+19−9 providers/keycloak.go+1−3
CHANGELOG.md+5
@@ -4,6 +4,8 @@
44
55## Important Notes
66
7+- [#953](https://github.com/oauth2-proxy/oauth2-proxy/pull/953) Keycloak will now use `--profile-url` if set for the userinfo endpoint
8+ instead of `--validate-url`. `--validate-url` will still work for backwards compatibility.
79- [#936](https://github.com/oauth2-proxy/oauth2-proxy/pull/936) `--user-id-claim` option is deprecated and replaced by `--oidc-email-claim`
810- [#630](https://github.com/oauth2-proxy/oauth2-proxy/pull/630) Gitlab projects needs a Gitlab application with the extra `read_api` enabled
911- [#849](https://github.com/oauth2-proxy/oauth2-proxy/pull/849) `/oauth2/auth` `allowed_groups` querystring parameter can be paired with the `allowed-groups` configuration option.
@@ -33,6 +35,8 @@
3335
3436## Breaking Changes
3537
38+- [#953](https://github.com/oauth2-proxy/oauth2-proxy/pull/953) In config files & envvar configs, `keycloak_group` is now the plural `keycloak_groups`.
39+ Flag configs are still `--keycloak-group` but it can be passed multiple times.
3640- [#911](https://github.com/oauth2-proxy/oauth2-proxy/pull/911) Specifying a non-existent provider will cause OAuth2-Proxy to fail on startup instead of defaulting to "google".
3741- [#797](https://github.com/oauth2-proxy/oauth2-proxy/pull/797) Security changes to Google provider group authorization flow
3842 - If you change the list of allowed groups, existing sessions that now don't have a valid group will be logged out immediately.
@@ -54,6 +58,7 @@
5458
5559## Changes since v6.1.1
5660
61+- [#953](https://github.com/oauth2-proxy/oauth2-proxy/pull/953) Migrate Keycloak to EnrichSession & support multiple groups for authorization (@NickMeves)
5762- [#630](https://github.com/oauth2-proxy/oauth2-proxy/pull/630) Add support for Gitlab project based authentication (@factorysh)
5863- [#907](https://github.com/oauth2-proxy/oauth2-proxy/pull/907) Introduce alpha configuration option to enable testing of structured configuration (@JoelSpeed)
5964- [#938](https://github.com/oauth2-proxy/oauth2-proxy/pull/938) Cleanup missed provider renaming refactor methods (@NickMeves)
docs/docs/configuration/auth.md+19−9
@@ -135,15 +135,25 @@ If you are using GitHub enterprise, make sure you set the following to the appro
135135
136136Make sure you set the following to the appropriate url:
137137
138− -provider=keycloak
139− -client-id=<client you have created>
140− -client-secret=<your client's secret>
141− -login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"
142− -redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"
143− -validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
144− -keycloak-group=<user_group>
145−
146−The group management in keycloak is using a tree. If you create a group named admin in keycloak you should define the 'keycloak-group' value to /admin.
138+ --provider=keycloak
139+ --client-id=<client you have created>
140+ --client-secret=<your client's secret>
141+ --login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"
142+ --redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"
143+ --profile-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
144+ --validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
145+ --keycloak-group=<first_allowed_user_group>
146+ --keycloak-group=<second_allowed_user_group>
147+
148+For group based authorization, the optional `--keycloak-group` (legacy) or `--allowed-group` (global standard)
149+flags can be used to specify which groups to limit access to.
150+
151+If these are unset but a `groups` mapper is set up above in step (3), the provider will still
152+populate the `X-Forwarded-Groups` header to your upstream server with the `groups` data in the
153+Keycloak userinfo endpoint response.
154+
155+The group management in keycloak is using a tree. If you create a group named admin in keycloak
156+you should define the 'keycloak-group' value to /admin.
147157
148158### GitLab Auth Provider
149159
providers/keycloak.go+1−3
@@ -80,9 +80,7 @@ func (p *KeycloakProvider) EnrichSession(ctx context.Context, s *sessions.Sessio
8080 }
8181
8282 groups, err := json.Get("groups").StringArray()
83− if err != nil {
84− logger.Errorf("Warning: unable to extract groups from userinfo endpoint: %v", err)
85− } else {
83+ if err == nil {
8684 for _, group := range groups {
8785 if group != "" {
8886 s.Groups = append(s.Groups, group)