@@ -359,10 +359,25 @@ server {
359359 }
360360
361361 location /oauth2/ {
362− proxy_pass http://127.0.0.1:4180;
363− proxy_set_header Host $host;
364− proxy_set_header X-Real-IP $remote_addr;
365− proxy_set_header X-Scheme $scheme;
362+ proxy_pass http://127.0.0.1:4180;
363+ proxy_set_header Host $host;
364+ proxy_set_header X-Real-IP $remote_addr;
365+ proxy_set_header X-Scheme $scheme;
366+ proxy_set_header X-Auth-Request-Redirect $request_uri;
367+ }
368+
369+ location /upstream/ {
370+ auth_request /oauth2/auth;
371+ error_page 401 = /oauth2/sign_in;
372+
373+ # pass information via X-User and X-Email headers to backend,
374+ # requires running with --set-xauthrequest flag
375+ auth_request_set $user $upstream_http_x_auth_request_user;
376+ auth_request_set $email $upstream_http_x_auth_request_email;
377+ proxy_set_header X-User $user;
378+ proxy_set_header X-Email $email;
379+
380+ proxy_pass http://backend/;
366381 }
367382
368383 location / {