ffeccfe · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

on master help sign in

Add support for serving static files from a directory

ffeccfeJeppe Toustrup11 years ago

README.md+10−2

compare with master

unifiedsplit

@@ -3,7 +3,7 @@ oauth2_proxy

4<small>(This project was renamed from Google Auth Proxy - May 2015)</small>

6−A reverse proxy that provides authentication using Providers (Google, Github, and others)

6+A reverse proxy and static file server that provides authentication using Providers (Google, Github, and others)

7to validate accounts by email, domain or group.

9[![Build Status](https://secure.travis-ci.org/bitly/oauth2_proxy.png?branch=master)](http://travis-ci.org/bitly/oauth2_proxy)

@@ -152,13 +152,21 @@ Usage of oauth2_proxy:

152 -skip-auth-regex=: bypass authentication for requests path's that match (may be given multiple times)

153 -tls-cert="": path to certificate file

154 -tls-key="": path to private key file

155− -upstream=: the http url(s) of the upstream endpoint. If multiple, routing is based on path

155+ -upstream=: the http url(s) of the upstream endpoint or file:// paths for static files. Routing is based on the path

156 -validate-url="": Access token validation endpoint

157 -version=false: print version string

158```

159

160See below for provider specific options

161

162+### Upstreams Configuration

163+

164+`oauth2_proxy` supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as `http://127.0.0.1:8080/` for the upstream parameter, that will forward all authenticated requests to be forwarded to the upstream server. If you instead provide `http://127.0.0.1:8080/some/path/` then it will only be requests that start with `/some/path/` which are forwarded to the upstream.

165+

166+Static file paths are configured as a file:// URL. `file:///var/www/static/` will serve the files from that directory at `http://[oauth2_proxy url]/var/www/static/`, which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at. `file:///var/www/static/#/static/` will ie. make `/var/www/static/` available at `http://[oauth2_proxy url]/static/`.

167+

168+Multiple upstreams can either be configured by supplying a comma separated list to the `-upstream` parameter, supplying the parameter multiple times or provinding a list in the [config file](#config-file). When multiple upstreams are used routing to them will be based on the path they are set up with.

169+

162### Environment variables

170### Environment variables

163

171

164The environment variables `OAUTH2_PROXY_CLIENT_ID`, `OAUTH2_PROXY_CLIENT_SECRET`, `OAUTH2_PROXY_COOKIE_SECRET`, `OAUTH2_PROXY_COOKIE_DOMAIN` and `OAUTH2_PROXY_COOKIE_EXPIRE` can be used in place of the corresponding command-line arguments.

172The environment variables `OAUTH2_PROXY_CLIENT_ID`, `OAUTH2_PROXY_CLIENT_SECRET`, `OAUTH2_PROXY_COOKIE_SECRET`, `OAUTH2_PROXY_COOKIE_DOMAIN` and `OAUTH2_PROXY_COOKIE_EXPIRE` can be used in place of the corresponding command-line arguments.

main.go+1−1

@@ -30,7 +30,7 @@ func main() {

30 flagSet.String("tls-cert", "", "path to certificate file")

31 flagSet.String("tls-key", "", "path to private key file")

32 flagSet.String("redirect-url", "", "the OAuth Redirect URL. ie: \"https://internalapp.yourcompany.com/oauth2/callback\"")

33− flagSet.Var(&upstreams, "upstream", "the http url(s) of the upstream endpoint. If multiple, routing is based on path")

33+ flagSet.Var(&upstreams, "upstream", "the http url(s) of the upstream endpoint or file:// paths for static files. Routing is based on the path")

34 flagSet.Bool("pass-basic-auth", true, "pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream")

35 flagSet.String("basic-auth-password", "", "the password to set when passing the HTTP Basic Auth header")

36 flagSet.Bool("pass-access-token", false, "pass OAuth access_token to upstream via X-Forwarded-Access-Token header")

oauthproxy.go+23−8

@@ -82,20 +82,35 @@ func setProxyDirector(proxy *httputil.ReverseProxy) {

82 req.URL.RawQuery = ""

83 }

84}

85+func NewFileServer(path string, filesystemPath string) (proxy http.Handler) {

86+ return http.StripPrefix(path, http.FileServer(http.Dir(filesystemPath)))

87+}

86func NewOauthProxy(opts *Options, validator func(string) bool) *OauthProxy {

89func NewOauthProxy(opts *Options, validator func(string) bool) *OauthProxy {

87 serveMux := http.NewServeMux()

90 serveMux := http.NewServeMux()

88 for _, u := range opts.proxyUrls {

91 for _, u := range opts.proxyUrls {

89 path := u.Path

92 path := u.Path

93+ switch u.Scheme {

94+ case "http", "https":

90− u.Path = ""

95+ u.Path = ""

91− log.Printf("mapping path %q => upstream %q", path, u)

96+ log.Printf("mapping path %q => upstream %q", path, u)

92− proxy := NewReverseProxy(u)

97+ proxy := NewReverseProxy(u)

93− if !opts.PassHostHeader {

98+ if !opts.PassHostHeader {

94− setProxyUpstreamHostHeader(proxy, u)

99+ setProxyUpstreamHostHeader(proxy, u)

95− } else {

100+ } else {

96− setProxyDirector(proxy)

101+ setProxyDirector(proxy)

102+ }

103+ serveMux.Handle(path, &UpstreamProxy{u.Host, proxy})

104+ case "file":

105+ if u.Fragment != "" {

106+ path = u.Fragment

107+ }

108+ log.Printf("mapping path %q => file system %q", path, u.Path)

109+ proxy := NewFileServer(path, u.Path)

110+ serveMux.Handle(path, &UpstreamProxy{path, proxy})

111+ default:

112+ panic(fmt.Sprintf("unknown upstream protocol %s", u.Scheme))

97 }

113 }

98− serveMux.Handle(path, &UpstreamProxy{u.Host, proxy})

99 }

114 }

100 for _, u := range opts.CompiledRegex {

115 for _, u := range opts.CompiledRegex {

101 log.Printf("compiled skip-auth-regex => %q", u)

116 log.Printf("compiled skip-auth-regex => %q", u)

oauthproxy_test.go−3

@@ -75,7 +75,6 @@ func TestEncodedSlashes(t *testing.T) {

76func TestRobotsTxt(t *testing.T) {

77 opts := NewOptions()

78− opts.Upstreams = append(opts.Upstreams, "unused")

79 opts.ClientID = "bazquux"

78 opts.ClientID = "bazquux"

80 opts.ClientSecret = "foobar"

79 opts.ClientSecret = "foobar"

81 opts.CookieSecret = "xyzzyplugh"

80 opts.CookieSecret = "xyzzyplugh"

@@ -371,7 +370,6 @@ func NewSignInPageTest() *SignInPageTest {

371 var sip_test SignInPageTest

370 var sip_test SignInPageTest

372

371

373 sip_test.opts = NewOptions()

372 sip_test.opts = NewOptions()

374− sip_test.opts.Upstreams = append(sip_test.opts.Upstreams, "unused")

375 sip_test.opts.CookieSecret = "foobar"

373 sip_test.opts.CookieSecret = "foobar"

376 sip_test.opts.ClientID = "bazquux"

374 sip_test.opts.ClientID = "bazquux"

377 sip_test.opts.ClientSecret = "xyzzyplugh"

375 sip_test.opts.ClientSecret = "xyzzyplugh"

@@ -443,7 +441,6 @@ func NewProcessCookieTest(opts ProcessCookieTestOpts) *ProcessCookieTest {

443 var pc_test ProcessCookieTest

441 var pc_test ProcessCookieTest

444

442

445 pc_test.opts = NewOptions()

443 pc_test.opts = NewOptions()

446− pc_test.opts.Upstreams = append(pc_test.opts.Upstreams, "unused")

447 pc_test.opts.ClientID = "bazquux"

444 pc_test.opts.ClientID = "bazquux"

448 pc_test.opts.ClientSecret = "xyzzyplugh"

445 pc_test.opts.ClientSecret = "xyzzyplugh"

449 pc_test.opts.CookieSecret = "0123456789abcdef"

446 pc_test.opts.CookieSecret = "0123456789abcdef"