git.iko.soy/typeable/oauth2-proxy
on master help sign in
Add support for serving static files from a directory

The path should be provided as a file:// url with the full operating system path. An alias to where the directory is available as can be specified by appending a fragment (ie. "#/static/") at the end of the URL.

commitffeccfe5528b2574f2a60d57cd82f1ef6a328736 authorJeppe Toustrup <jeppe@tenzer.dk> dateWed 23 Sep 2015, 22:00 (11 years ago) parent2a784ae
4 files changed+34−14
README.md+10−2 main.go+1−1 oauthproxy.go+23−8 oauthproxy_test.go−3
README.md+10−2
@@ -3,7 +3,7 @@ oauth2_proxy
33
44<small>(This project was renamed from Google Auth Proxy - May 2015)</small>
55
6−A reverse proxy that provides authentication using Providers (Google, Github, and others)
6+A reverse proxy and static file server that provides authentication using Providers (Google, Github, and others)
77to validate accounts by email, domain or group.
88
99[![Build Status](https://secure.travis-ci.org/bitly/oauth2_proxy.png?branch=master)](http://travis-ci.org/bitly/oauth2_proxy)
@@ -152,13 +152,21 @@ Usage of oauth2_proxy:
152152 -skip-auth-regex=: bypass authentication for requests path's that match (may be given multiple times)
153153 -tls-cert="": path to certificate file
154154 -tls-key="": path to private key file
155− -upstream=: the http url(s) of the upstream endpoint. If multiple, routing is based on path
155+ -upstream=: the http url(s) of the upstream endpoint or file:// paths for static files. Routing is based on the path
156156 -validate-url="": Access token validation endpoint
157157 -version=false: print version string
158158```
159159
160160See below for provider specific options
161161
162+### Upstreams Configuration
163+
164+`oauth2_proxy` supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as `http://127.0.0.1:8080/` for the upstream parameter, that will forward all authenticated requests to be forwarded to the upstream server. If you instead provide `http://127.0.0.1:8080/some/path/` then it will only be requests that start with `/some/path/` which are forwarded to the upstream.
165+
166+Static file paths are configured as a file:// URL. `file:///var/www/static/` will serve the files from that directory at `http://[oauth2_proxy url]/var/www/static/`, which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at. `file:///var/www/static/#/static/` will ie. make `/var/www/static/` available at `http://[oauth2_proxy url]/static/`.
167+
168+Multiple upstreams can either be configured by supplying a comma separated list to the `-upstream` parameter, supplying the parameter multiple times or provinding a list in the [config file](#config-file). When multiple upstreams are used routing to them will be based on the path they are set up with.
169+
162170### Environment variables
163171
164172The environment variables `OAUTH2_PROXY_CLIENT_ID`, `OAUTH2_PROXY_CLIENT_SECRET`, `OAUTH2_PROXY_COOKIE_SECRET`, `OAUTH2_PROXY_COOKIE_DOMAIN` and `OAUTH2_PROXY_COOKIE_EXPIRE` can be used in place of the corresponding command-line arguments.
main.go+1−1
@@ -30,7 +30,7 @@ func main() {
3030 flagSet.String("tls-cert", "", "path to certificate file")
3131 flagSet.String("tls-key", "", "path to private key file")
3232 flagSet.String("redirect-url", "", "the OAuth Redirect URL. ie: \"https://internalapp.yourcompany.com/oauth2/callback\"")
33− flagSet.Var(&upstreams, "upstream", "the http url(s) of the upstream endpoint. If multiple, routing is based on path")
33+ flagSet.Var(&upstreams, "upstream", "the http url(s) of the upstream endpoint or file:// paths for static files. Routing is based on the path")
3434 flagSet.Bool("pass-basic-auth", true, "pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream")
3535 flagSet.String("basic-auth-password", "", "the password to set when passing the HTTP Basic Auth header")
3636 flagSet.Bool("pass-access-token", false, "pass OAuth access_token to upstream via X-Forwarded-Access-Token header")
oauthproxy.go+23−8
@@ -82,20 +82,35 @@ func setProxyDirector(proxy *httputil.ReverseProxy) {
8282 req.URL.RawQuery = ""
8383 }
8484}
85+func NewFileServer(path string, filesystemPath string) (proxy http.Handler) {
86+ return http.StripPrefix(path, http.FileServer(http.Dir(filesystemPath)))
87+}
8588
8689func NewOauthProxy(opts *Options, validator func(string) bool) *OauthProxy {
8790 serveMux := http.NewServeMux()
8891 for _, u := range opts.proxyUrls {
8992 path := u.Path
90− u.Path = ""
91− log.Printf("mapping path %q => upstream %q", path, u)
92− proxy := NewReverseProxy(u)
93− if !opts.PassHostHeader {
94− setProxyUpstreamHostHeader(proxy, u)
95− } else {
96− setProxyDirector(proxy)
93+ switch u.Scheme {
94+ case "http", "https":
95+ u.Path = ""
96+ log.Printf("mapping path %q => upstream %q", path, u)
97+ proxy := NewReverseProxy(u)
98+ if !opts.PassHostHeader {
99+ setProxyUpstreamHostHeader(proxy, u)
100+ } else {
101+ setProxyDirector(proxy)
102+ }
103+ serveMux.Handle(path, &UpstreamProxy{u.Host, proxy})
104+ case "file":
105+ if u.Fragment != "" {
106+ path = u.Fragment
107+ }
108+ log.Printf("mapping path %q => file system %q", path, u.Path)
109+ proxy := NewFileServer(path, u.Path)
110+ serveMux.Handle(path, &UpstreamProxy{path, proxy})
111+ default:
112+ panic(fmt.Sprintf("unknown upstream protocol %s", u.Scheme))
97113 }
98− serveMux.Handle(path, &UpstreamProxy{u.Host, proxy})
99114 }
100115 for _, u := range opts.CompiledRegex {
101116 log.Printf("compiled skip-auth-regex => %q", u)
oauthproxy_test.go−3
@@ -75,7 +75,6 @@ func TestEncodedSlashes(t *testing.T) {
7575
7676func TestRobotsTxt(t *testing.T) {
7777 opts := NewOptions()
78− opts.Upstreams = append(opts.Upstreams, "unused")
7978 opts.ClientID = "bazquux"
8079 opts.ClientSecret = "foobar"
8180 opts.CookieSecret = "xyzzyplugh"
@@ -371,7 +370,6 @@ func NewSignInPageTest() *SignInPageTest {
371370 var sip_test SignInPageTest
372371
373372 sip_test.opts = NewOptions()
374− sip_test.opts.Upstreams = append(sip_test.opts.Upstreams, "unused")
375373 sip_test.opts.CookieSecret = "foobar"
376374 sip_test.opts.ClientID = "bazquux"
377375 sip_test.opts.ClientSecret = "xyzzyplugh"
@@ -443,7 +441,6 @@ func NewProcessCookieTest(opts ProcessCookieTestOpts) *ProcessCookieTest {
443441 var pc_test ProcessCookieTest
444442
445443 pc_test.opts = NewOptions()
446− pc_test.opts.Upstreams = append(pc_test.opts.Upstreams, "unused")
447444 pc_test.opts.ClientID = "bazquux"
448445 pc_test.opts.ClientSecret = "xyzzyplugh"
449446 pc_test.opts.CookieSecret = "0123456789abcdef"