@@ -157,54 +157,56 @@ An example [oauth2_proxy.cfg](contrib/oauth2_proxy.cfg.example) config file is i
157157
158158```
159159Usage of oauth2_proxy:
160− -approval-prompt="force": Oauth approval_prompt
161− -authenticated-emails-file="": authenticate against emails via file (one per line)
162− -azure-tenant="common": go to a tenant-specific or common (tenant-independent) endpoint.
163− -basic-auth-password="": the password to set when passing the HTTP Basic Auth header
164− -client-id="": the OAuth Client ID: ie: "123456.apps.googleusercontent.com"
165− -client-secret="": the OAuth Client Secret
166− -config="": path to config file
167− -cookie-domain="": an optional cookie domain to force cookies to (ie: .yourcompany.com)*
168− -cookie-expire=168h0m0s: expire timeframe for cookie
169− -cookie-httponly=true: set HttpOnly cookie flag
170− -cookie-name="_oauth2_proxy": the name of the cookie that the oauth_proxy creates
171− -cookie-refresh=0: refresh the cookie after this duration; 0 to disable
172− -cookie-secret="": the seed string for secure cookies
173− -cookie-secure=true: set secure (HTTPS) cookie flag
174− -custom-templates-dir="": path to custom html templates
175− -display-htpasswd-form=true: display username / password login form if an htpasswd file is provided
176− -email-domain=: authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email
177− -github-org="": restrict logins to members of this organisation
178− -github-team="": restrict logins to members of this team
179− -google-admin-email="": the google admin to impersonate for api calls
180− -google-group=: restrict logins to members of this google group (may be given multiple times).
181− -google-service-account-json="": the path to the service account json credentials
182− -htpasswd-file="": additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption
183− -http-address="127.0.0.1:4180": [http://]<addr>:<port> or unix://<path> to listen on for HTTP clients
184− -https-address=":443": <addr>:<port> to listen on for HTTPS clients
185− -login-url="": Authentication endpoint
186− -pass-access-token=false: pass OAuth access_token to upstream via X-Forwarded-Access-Token header
187− -pass-basic-auth=true: pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream
188− -pass-user-headers=true: pass X-Forwarded-User and X-Forwarded-Email information to upstream
189− -pass-host-header=true: pass the request Host Header to upstream
190− -profile-url="": Profile access endpoint
191− -provider="google": OAuth provider
192− -proxy-prefix="/oauth2": the url root path that this proxy should be nested under (e.g. /<oauth2>/sign_in)
193− -redeem-url="": Token redemption endpoint
194− -redirect-url="": the OAuth Redirect URL. ie: "https://internalapp.yourcompany.com/oauth2/callback"
195− -resource="": the resource that is being protected. ie: "https://graph.windows.net". Currently only used in the Azure provider.
196− -request-logging=true: Log requests to stdout
197− -scope="": Oauth scope specification
198− -signature-key="": GAP-Signature request signature key (algorithm:secretkey)
199− -skip-auth-regex=: bypass authentication for requests path's that match (may be given multiple times)
200− -skip-auth-preflight=false: bypass authentication for OPTIONAL requests so preflight requests could succeed when using CORS
201− -skip-provider-button=false: will skip sign-in-page to directly reach the next step: oauth/start
160+ -approval-prompt string: OAuth approval_prompt (default "force")
161+ -authenticated-emails-file string: authenticate against emails via file (one per line)
162+ -azure-tenant string: go to a tenant-specific or common (tenant-independent) endpoint. (default "common")
163+ -basic-auth-password string: the password to set when passing the HTTP Basic Auth header
164+ -client-id string: the OAuth Client ID: ie: "123456.apps.googleusercontent.com"
165+ -client-secret string: the OAuth Client Secret
166+ -config string: path to config file
167+ -cookie-domain string: an optional cookie domain to force cookies to (ie: .yourcompany.com)*
168+ -cookie-expire duration: expire timeframe for cookie (default 168h0m0s)
169+ -cookie-httponly: set HttpOnly cookie flag (default true)
170+ -cookie-name string: the name of the cookie that the oauth_proxy creates (default "_oauth2_proxy")
171+ -cookie-refresh duration: refresh the cookie after this duration; 0 to disable
172+ -cookie-secret string: the seed string for secure cookies (optionally base64 encoded)
173+ -cookie-secure: set secure (HTTPS) cookie flag (default true)
174+ -custom-templates-dir string: path to custom html templates
175+ -display-htpasswd-form: display username / password login form if an htpasswd file is provided (default true)
176+ -email-domain value: authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email
177+ -footer string: custom footer string. Use "-" to disable default footer.
178+ -github-org string: restrict logins to members of this organisation
179+ -github-team string: restrict logins to members of this team
180+ -google-admin-email string: the google admin to impersonate for api calls
181+ -google-group value: restrict logins to members of this google group (may be given multiple times).
182+ -google-service-account-json string: the path to the service account json credentials
183+ -htpasswd-file string: additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption
184+ -http-address string: [http://]<addr>:<port> or unix://<path> to listen on for HTTP clients (default "127.0.0.1:4180")
185+ -https-address string: <addr>:<port> to listen on for HTTPS clients (default ":443")
186+ -login-url string: Authentication endpoint
187+ -pass-access-token: pass OAuth access_token to upstream via X-Forwarded-Access-Token header
188+ -pass-basic-auth: pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream (default true)
189+ -pass-host-header: pass the request Host Header to upstream (default true)
190+ -pass-user-headers: pass X-Forwarded-User and X-Forwarded-Email information to upstream (default true)
191+ -profile-url string: Profile access endpoint
192+ -provider string: OAuth provider (default "google")
193+ -proxy-prefix string: the url root path that this proxy should be nested under (e.g. /<oauth2>/sign_in) (default "/oauth2")
194+ -redeem-url string: Token redemption endpoint
195+ -redirect-url string: the OAuth Redirect URL. ie: "https://internalapp.yourcompany.com/oauth2/callback"
196+ -request-logging: Log requests to stdout (default true)
197+ -resource string: The resource that is protected (Azure AD only)
198+ -scope string: OAuth scope specification
199+ -set-xauthrequest: set X-Auth-Request-User and X-Auth-Request-Email response headers (useful in Nginx auth_request mode)
200+ -signature-key string: GAP-Signature request signature key (algorithm:secretkey)
201+ -skip-auth-preflight: will skip authentication for OPTIONS requests
202+ -skip-auth-regex value: bypass authentication for requests path's that match (may be given multiple times)
203+ -skip-provider-button: will skip sign-in-page to directly reach the next step: oauth/start
202204 -ssl-insecure-skip-verify: skip validation of certificates presented when using HTTPS
203− -tls-cert="": path to certificate file
204− -tls-key="": path to private key file
205− -upstream=: the http url(s) of the upstream endpoint or file:// paths for static files. Routing is based on the path
206− -validate-url="": Access token validation endpoint
207− -version=false: print version string
205+ -tls-cert string: path to certificate file
206+ -tls-key string: path to private key file
207+ -upstream value: the http url(s) of the upstream endpoint or file:// paths for static files. Routing is based on the path
208+ -validate-url string: Access token validation endpoint
209+ -version: print version string
208210```
209211
210212See below for provider specific options