git.iko.soy/typeable/oauth2-proxy
on master help sign in
swap
20d4e9c2376 ahead, 0 behind
.devcontainer/Dockerfilenew file+14
since splitsnapshots
unifiedsplit
@@ -0,0 +1,14 @@
1+FROM mcr.microsoft.com/vscode/devcontainers/go:1-1.26
2+
3+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
4+
5+RUN apt-get update \
6+ && apt-get install -y --no-install-recommends \
7+ pre-commit \
8+ vim \
9+ && apt-get clean \
10+ && rm -rf /var/lib/apt/lists/* \
11+ && mkdir -p /go/pkg \
12+ && chmod -R a+w /go/pkg
13+
14+WORKDIR /workspace
.devcontainer/devcontainer.jsonnew file+45
@@ -0,0 +1,45 @@
1+{
2+ "name": "oauth2-proxy Dev",
3+ "context": "..",
4+ "dockerFile": "./Dockerfile",
5+ "postCreateCommand": "pre-commit install && go mod download",
6+ "containerEnv": { "DEVCONTAINER": "1" },
7+ "appPort": ["4180:4180"],
8+ "runArgs": ["-e", "GIT_EDITOR=code --wait"],
9+ "customizations": {
10+ "vscode": {
11+ "extensions": [
12+ "golang.go",
13+ "ms-vscode.makefile-tools",
14+ "visualstudioexptteam.vscodeintellicode",
15+ "redhat.vscode-yaml",
16+ "esbenp.prettier-vscode",
17+ "GitHub.vscode-pull-request-github"
18+ ],
19+ "settings": {
20+ "editor.formatOnPaste": false,
21+ "editor.formatOnSave": true,
22+ "editor.formatOnType": true,
23+ "files.trimTrailingWhitespace": true,
24+ "yaml.customTags": [
25+ "!input scalar",
26+ "!secret scalar",
27+ "!include_dir_named scalar",
28+ "!include_dir_list scalar",
29+ "!include_dir_merge_list scalar",
30+ "!include_dir_merge_named scalar"
31+ ]
32+ }
33+ }
34+ },
35+ "features": {
36+ "ghcr.io/devcontainers/features/docker-in-docker": {},
37+ "ghcr.io/devcontainers/features/common-utils": {
38+ "configureZshAsDefaultShell": true,
39+ "username": "vscode",
40+ "userUid": 1000,
41+ "userGid": 1000
42+ },
43+ "ghcr.io/devcontainers/features/kubectl-helm-minikube": {}
44+ }
45+}
.dockerignorenew file+6
@@ -0,0 +1,6 @@
1+Dockerfile.dev
2+Dockerfile
3+docs
4+vendor
5+.git
6+oauth2-proxy
.github/CODEOWNERSnew file+23
@@ -0,0 +1,23 @@
1+# Default owner should be a core org reviewers unless overridden by later rules in this file
2+* @oauth2-proxy/reviewers
3+
4+# login.gov provider
5+# Note: If @timothy-spencer terms out of his appointment, your best bet
6+# for finding somebody who can test the oauth2-proxy would be to ask somebody
7+# in the login.gov team (https://login.gov/developers/), the cloud.gov team
8+# (https://cloud.gov/docs/help/), or the 18F org (https://18f.gsa.gov/contact/
9+# or the public devops channel at https://chat.18f.gov/).
10+providers/logingov.go @timothy-spencer
11+providers/logingov_test.go @timothy-spencer
12+
13+# Bitbucket provider
14+providers/bitbucket.go @aledeganopix4d
15+providers/bitbucket_test.go @aledeganopix4d
16+
17+# Nextcloud provider
18+providers/nextcloud.go @Ramblurr
19+providers/nextcloud_test.go @Ramblurr
20+
21+# DigitalOcean provider
22+providers/digitalocean.go @kamaln7
23+providers/digitalocean_test.go @kamaln7
.github/FUNDING.ymlnew file+15
@@ -0,0 +1,15 @@
1+# These are supported funding model platforms
2+
3+github: tuunit # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
4+patreon: # Replace with a single Patreon username
5+open_collective: oauth2-proxy # Replace with a single Open Collective username
6+ko_fi: # Replace with a single Ko-fi username
7+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
8+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
9+liberapay: # Replace with a single Liberapay username
10+issuehunt: # Replace with a single IssueHunt username
11+lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
12+polar: # Replace with a single Polar username
13+buy_me_a_coffee: # Replace with a single Buy Me a Coffee username
14+thanks_dev: # Replace with a single thanks.dev username
15+custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']
.github/ISSUE_TEMPLATE/bug-report.ymlnew file+73
@@ -0,0 +1,73 @@
1+name: Bug report
2+description: Bug descriptions or unexpected behaviour
3+title: "[Bug]: <Short description>"
4+labels: ["bug","help wanted"]
5+body:
6+ - type: input
7+ attributes:
8+ label: OAuth2-Proxy Version
9+ description: Which version of oauth2-proxy are you using?
10+ validations:
11+ required: true
12+ - type: dropdown
13+ attributes:
14+ label: Provider
15+ description: Which identity provider are you using?
16+ options:
17+ - adfs
18+ - azure
19+ - bitbucket
20+ - digitalocean
21+ - entra-id
22+ - facebook
23+ - gitea
24+ - github
25+ - gitlab
26+ - google
27+ - keycloak
28+ - keycloak-oidc
29+ - linkedin
30+ - logingov
31+ - nextcloud
32+ - oidc
33+ validations:
34+ required: false
35+ - type: textarea
36+ attributes:
37+ label: Expected Behaviour
38+ description: Tell us what you expect to happen.
39+ validations:
40+ required: true
41+ - type: textarea
42+ attributes:
43+ label: Current Behaviour
44+ description: Tell us what happens instead of the expected behavior.
45+ validations:
46+ required: true
47+ - type: textarea
48+ attributes:
49+ label: Steps To Reproduce
50+ description: Steps to reproduce the behavior.
51+ placeholder: |
52+ 1. In this environment...
53+ 1. With this config...
54+ 1. Run '...'
55+ 1. See error...
56+ validations:
57+ required: true
58+ - type: textarea
59+ attributes:
60+ label: Possible Solutions
61+ description: Not obligatory, but suggest a fix/reason for the bug.
62+ validations:
63+ required: false
64+ - type: textarea
65+ attributes:
66+ label: Configuration details or additional information
67+ description: |
68+ Please share more details about your environment and how you configured oauth2-proxy.
69+
70+ Tip: You can attach images or log files by clicking this area to highlight it and then dragging files in.
71+ validations:
72+ required: false
73+
.github/ISSUE_TEMPLATE/config.ymlnew file+6
@@ -0,0 +1,6 @@
1+blank_issues_enabled: false
2+contact_links:
3+ - name: OAuth2 Proxy Slack
4+ url: https://cloud-native.slack.com/archives/C098Y5URZ2N
5+ about: Feel free to ask any questions here.
6+
.github/ISSUE_TEMPLATE/configuration-support.ymlnew file+61
@@ -0,0 +1,61 @@
1+name: Configuration support
2+description: Configuration problems and overall requests on how to properly use oauth2-proxy.
3+title: "[Support]: <Short description>"
4+labels: ["configuration", "help wanted"]
5+body:
6+ - type: input
7+ attributes:
8+ label: OAuth2-Proxy Version
9+ description: Which version of oauth2-proxy are you using?
10+ validations:
11+ required: true
12+ - type: dropdown
13+ attributes:
14+ label: Provider
15+ description: Which identity provider are you using?
16+ options:
17+ - adfs
18+ - azure
19+ - bitbucket
20+ - digitalocean
21+ - entra-id
22+ - facebook
23+ - gitea
24+ - github
25+ - gitlab
26+ - google
27+ - keycloak
28+ - keycloak-oidc
29+ - linkedin
30+ - logingov
31+ - nextcloud
32+ - oidc
33+ validations:
34+ required: true
35+ - type: textarea
36+ attributes:
37+ label: Current Behaviour of your Problem
38+ description: Tell us what you expect to happen and what happens instead.
39+ validations:
40+ required: true
41+ - type: textarea
42+ attributes:
43+ label: Configuration details or additional information
44+ description: |
45+ Please share more details about your environment and how you configured oauth2-proxy.
46+
47+ Tip: You can attach images or log files by clicking this area to highlight it and then dragging files in.
48+ validations:
49+ required: true
50+ - type: textarea
51+ attributes:
52+ label: Steps To Reproduce
53+ description: Steps to reproduce the behavior.
54+ placeholder: |
55+ 1. In this environment...
56+ 1. With this config...
57+ 1. Run '...'
58+ 1. See error...
59+ validations:
60+ required: false
61+
.github/ISSUE_TEMPLATE/feature-request.ymlnew file+51
@@ -0,0 +1,51 @@
1+name: Feature request
2+description: Feature requests or proposals related to the overall project or specific providers
3+title: "[Feature]: <Short description>"
4+labels: ["enhancement"]
5+body:
6+ - type: textarea
7+ attributes:
8+ label: Motivation
9+ description: Tell us the motivation behind your feature request or proposal.
10+ validations:
11+ required: true
12+ - type: textarea
13+ attributes:
14+ label: Possible solution
15+ description: |
16+ If you already have a possible solution in mind. Write some more details about it or add some pseudo code.
17+
18+ Tip 1: You can attach images or log files by clicking this area to highlight it and then dragging files in.
19+ Tip 2: You can add code snippets in triple backtiks like so:
20+ \`\`\`golang
21+ func hello() {
22+ fmt.Println("world")
23+ }
24+ \`\`\`
25+ validations:
26+ required: false
27+ - type: dropdown
28+ attributes:
29+ label: Provider
30+ description: Is it a feature request for a specific provider. Not mandatory.
31+ options:
32+ - new provider
33+ - adfs
34+ - azure
35+ - bitbucket
36+ - digitalocean
37+ - entra-id
38+ - facebook
39+ - gitea
40+ - github
41+ - gitlab
42+ - google
43+ - keycloak
44+ - keycloak-oidc
45+ - linkedin
46+ - logingov
47+ - nextcloud
48+ - oidc
49+ validations:
50+ required: false
51+
.github/PULL_REQUEST_TEMPLATE.mdnew file+27
@@ -0,0 +1,27 @@
1+<!--- Provide a general summary of your changes in the Title above -->
2+
3+## Description
4+
5+<!--- Describe your changes in detail -->
6+
7+## Motivation and Context
8+
9+<!--- Why is this change required? What problem does it solve? -->
10+<!--- If it fixes an open issue, please link to the issue here. -->
11+
12+## How Has This Been Tested?
13+
14+<!--- Please describe in detail how you tested your changes. -->
15+<!--- Include details of your testing environment, and the tests you ran to -->
16+<!--- see how your change affects other areas of the code, etc. -->
17+
18+## Checklist:
19+
20+<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
21+<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
22+
23+- [ ] I have added an entry for my changes to the [CHANGELOG.md](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/CHANGELOG.md).
24+- [ ] I have [signed off](https://github.com/apps/dco) all my commits.
25+- [ ] I have created a feature (non-master) branch for my PR.
26+- [ ] I have used [conventional commits](https://www.conventionalcommits.org/en/v1.0.0/#examples) for the PR title.
27+- [ ] I have written tests for my code changes.
.github/labeler.ymlnew file+35
@@ -0,0 +1,35 @@
1+go:
2+ - changed-files:
3+ - any-glob-to-any-file:
4+ - '**/*.go'
5+
6+docs:
7+ - changed-files:
8+ - any-glob-to-any-file:
9+ - '**/*.md'
10+
11+changelog:
12+ - changed-files:
13+ - any-glob-to-any-file:
14+ - 'CHAGELOG.md'
15+
16+tests:
17+ - changed-files:
18+ - any-glob-to-any-file:
19+ - '**/*_test.go'
20+
21+provider:
22+ - changed-files:
23+ - any-glob-to-any-file:
24+ - 'providers/**/*'
25+
26+dependencies:
27+- changed-files:
28+ - any-glob-to-any-file:
29+ - 'go.mod'
30+ - 'go.sum'
31+
32+docker:
33+ - changed-files:
34+ - any-glob-to-any-file:
35+ - '**/Dockerfile'
.github/renovate.json5new file+67
@@ -0,0 +1,67 @@
1+{
2+ $schema: "https://docs.renovatebot.com/renovate-schema.json",
3+ semanticCommits: "enabled",
4+ schedule: [
5+ "after 8am on sunday"
6+ ],
7+ prConcurrentLimit: 0,
8+ prHourlyLimit: 0,
9+ enabledManagers: [
10+ "dockerfile",
11+ "docker-compose",
12+ "gomod",
13+ "github-actions",
14+ "helmv3",
15+ "npm",
16+ "regex",
17+ ],
18+ packageRules: [
19+ {
20+ matchManagers: [
21+ "dockerfile",
22+ "docker-compose",
23+ "gomod",
24+ "helmv3",
25+ "npm",
26+ ],
27+ groupName: "{{{manager}}}",
28+ },
29+ {
30+ matchDepNames: [
31+ "docker.io/library/golang",
32+ "mcr.microsoft.com/vscode/devcontainers/go",
33+ ],
34+ groupName: "golang",
35+ },
36+ ],
37+ customManagers: [
38+ {
39+ customType: "regex",
40+ fileMatch: [
41+ "^Makefile",
42+ ],
43+ matchStrings: [
44+ "DOCKER_BUILD_RUNTIME_IMAGE_ALPINE\\s+?\\?= alpine:(?<currentValue>.*)\\s"
45+ ],
46+ depNameTemplate: "alpine",
47+ datasourceTemplate: "docker",
48+ },
49+ {
50+ customType: "regex",
51+ fileMatch: [
52+ "^Makefile",
53+ ],
54+ matchStrings: [
55+ "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+?GOLANGCILINT_VERSION \\?= (?<currentValue>.*)\\s",
56+ ],
57+ },
58+ {
59+ customType: "regex",
60+ fileMatch: ["(^|/)\\.github/workflows/[^/]+\\.ya?ml$"],
61+ matchStrings: [
62+ "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)( versioning=(?<versioning>.*?))?\\s+?[\\w\\s-]*?version: (?<currentValue>.*)\\s",
63+ "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)( versioning=(?<versioning>.*?))?\\s+?[\\w\\s]*?_VERSION: (?<currentValue>.*)\\s",
64+ ],
65+ },
66+ ],
67+}
.github/workflows/ci.ymlnew file+118
@@ -0,0 +1,118 @@
1+name: Continuous Integration
2+
3+on:
4+ push:
5+ branches:
6+ - '**'
7+ pull_request:
8+ branches:
9+ - '**'
10+ workflow_dispatch:
11+
12+permissions:
13+ contents: read
14+ id-token: write
15+ security-events: write
16+
17+jobs:
18+ build:
19+ runs-on: ubuntu-latest
20+ steps:
21+ - name: Check out code
22+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
23+ with:
24+ fetch-depth: 0
25+
26+ - name: Get Go version
27+ run: |
28+ version=$(grep "^go " go.mod | cut -d' ' -f2 | cut -d. -f1,2)
29+ echo "version=${version}" >> "$GITHUB_OUTPUT"
30+ id: go-version
31+
32+ - name: Set up Go
33+ uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
34+ with:
35+ go-version: ${{ steps.go-version.outputs.version }}
36+ check-latest: true
37+
38+ - name: Verify Code Generation
39+ run: |
40+ make verify-generate
41+
42+ - name: Lint
43+ run: |
44+ make lint
45+
46+ - name: Build
47+ if: (!startsWith(github.head_ref, 'release'))
48+ run: |
49+ make build
50+
51+ # For release testing
52+ - name: Build All
53+ if: github.base_ref == 'master' && startsWith(github.head_ref, 'release')
54+ run: |
55+ make release
56+
57+ - name: Test
58+ env:
59+ COVER: true
60+ run: |
61+ make test
62+
63+ - name: Generate Coverage Report
64+ if: github.event_name == 'push'
65+ run: |
66+ go install github.com/jandelgado/gcov2lcov@25681830fb515e3d4c117e136b4f049e21efb4d0
67+ gcov2lcov -infile=c.out -outfile=lcov.info
68+
69+ - name: Upload Coverage Report
70+ if: github.event_name == 'push'
71+ uses: qltysh/qlty-action/coverage@08a0a862c159eae9b9003081da6663d96efef637 # v2.3.0
72+ with:
73+ oidc: true
74+ files: lcov.info
75+
76+ - name: Run Trivy vulnerability scanner
77+ if: (!startsWith(github.head_ref, 'release'))
78+ uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
79+ with:
80+ scan-type: 'rootfs'
81+ scan-ref: './oauth2-proxy'
82+ severity: 'CRITICAL,HIGH'
83+ hide-progress: true
84+ format: 'sarif'
85+ output: 'trivy-results.sarif'
86+ exit-code: '0'
87+
88+ - name: Upload Trivy scan results
89+ if: (!startsWith(github.head_ref, 'release'))
90+ uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
91+ with:
92+ sarif_file: 'trivy-results.sarif'
93+
94+ docker:
95+ runs-on: ubuntu-latest
96+ steps:
97+ - name: Check out code
98+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
99+ with:
100+ fetch-depth: 0
101+
102+ - name: Set up QEMU
103+ uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
104+
105+ - name: Set up Docker Buildx
106+ id: buildx
107+ uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
108+
109+ - name: Docker Build
110+ if: (!startsWith(github.head_ref, 'release'))
111+ run: |
112+ make build-docker
113+
114+ # For release testing
115+ - name: Docker Build All
116+ if: github.base_ref == 'master' && startsWith(github.head_ref, 'release')
117+ run: |
118+ make build-docker-all
.github/workflows/codeql.ymlnew file+60
@@ -0,0 +1,60 @@
1+name: "Code scanning - action"
2+
3+on:
4+ push:
5+ branches:
6+ - master
7+ paths-ignore:
8+ - '.devcontainer/**'
9+ - '.vscode/**'
10+ - 'contrib/**'
11+ - 'docs/**'
12+ pull_request:
13+ # The branches below must be a subset of the branches above
14+ branches:
15+ - master
16+ paths-ignore:
17+ - '.devcontainer/**'
18+ - '.vscode/**'
19+ - 'contrib/**'
20+ - 'docs/**'
21+ schedule:
22+ - cron: '0 15 * * 2'
23+
24+jobs:
25+ CodeQL-Build:
26+
27+ strategy:
28+ fail-fast: false
29+
30+ # CodeQL runs on ubuntu-latest and windows-latest
31+ runs-on: ubuntu-latest
32+
33+ steps:
34+ - name: Checkout repository
35+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
36+
37+ # Initializes the CodeQL tools for scanning.
38+ - name: Initialize CodeQL
39+ uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
40+ with:
41+ languages: go
42+
43+ # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
44+ # If this step fails, then you should remove it and run the build manually (see below)
45+ - name: Autobuild
46+ uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
47+
48+ # ℹ️ Command-line programs to run using the OS shell.
49+ # 📚 https://git.io/JvXDl
50+
51+ # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
52+ # and modify them (or add more) to build your code if your project
53+ # uses a compiled language
54+
55+ #- run: |
56+ # make bootstrap
57+ # make release
58+
59+ - name: Perform CodeQL Analysis
60+ uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
.github/workflows/create-release.ymlnew file+119
@@ -0,0 +1,119 @@
1+name: Create Release
2+run-name: Create release ${{ inputs.version }}
3+
4+on:
5+ workflow_dispatch:
6+ inputs:
7+ version:
8+ description: 'Version for new release'
9+ required: true
10+
11+permissions:
12+ contents: write
13+ pull-requests: write
14+
15+jobs:
16+ release:
17+ runs-on: ubuntu-latest
18+ steps:
19+ - name: Check out code
20+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
21+ with:
22+ ref: master
23+ fetch-depth: 0
24+ fetch-tags: true
25+
26+ - name: Validate version
27+ id: validate
28+ run: |
29+ function ver { printf "%03d%03d%03d%03d" $(echo "$1" | tr '.' ' '); }
30+
31+ NEW_VERSION=${{ inputs.version }}
32+ NEW_VERSION=${NEW_VERSION#v} # Remove v prefix
33+
34+ LATEST_VERSION=$(git describe --abbrev=0 --tags)
35+ LATEST_VERSION=${LATEST_VERSION#v} # Remove v prefix
36+
37+ # check that new version can be parsed
38+ if [ ! $(ver $NEW_VERSION ) -gt $(ver 0) ]; then
39+ echo "::error::Entered version '${{ inputs.version }}' cannot be parsed"
40+ exit 1
41+ fi
42+
43+ # check version continuity
44+ if [ ! $(ver $LATEST_VERSION) -lt $(ver $NEW_VERSION) ]; then
45+ echo "::error::Entered version '${{ inputs.version }}' is smaller then latest version $LATEST_VERSION"
46+ exit 1
47+ fi
48+
49+ echo "version=${NEW_VERSION}" >> "$GITHUB_OUTPUT"
50+
51+ - name: Prepare Github Actions Bot
52+ run: |
53+ git config --local user.name "github-actions[bot]"
54+ git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
55+
56+ - name: Setup node
57+ uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
58+ with:
59+ node-version-file: docs/package.json
60+
61+ - name: Update documentation
62+ run: |
63+ cd docs
64+
65+ FULL_VERSION=${{ steps.validate.outputs.version }}
66+ VERSION=${FULL_VERSION%.*}.x
67+
68+ if [ ! -d "versioned_docs/version-${VERSION}" ]; then
69+ npm install
70+ npm run docusaurus docs:version ${VERSION}
71+
72+ git add .
73+ git commit -m "add new docs version ${VERSION}"
74+ fi
75+
76+ sed -i "s/(current release is .*)/(current release is \`v${FULL_VERSION}\`)/g" docs/installation.md
77+ sed -i "s/(current release is .*)/(current release is \`v${FULL_VERSION}\`)/g" versioned_docs/version-${VERSION}/installation.md
78+
79+ - name: Update Changelog
80+ run: |
81+ VERSION=${{ steps.validate.outputs.version }}
82+
83+ sed -i "s/#.*(Pre-release)/# V${VERSION}/g" CHANGELOG.md
84+
85+ cat << EOF > /tmp/CHANGELOG.prepend
86+ # Vx.x.x (Pre-release)
87+
88+ ## Release Highlights
89+
90+ ## Important Notes
91+
92+ ## Breaking Changes
93+
94+ ## Changes since v${VERSION}
95+ EOF
96+
97+ echo -e "$(cat /tmp/CHANGELOG.prepend)\n\n$(cat CHANGELOG.md)" > CHANGELOG.md
98+
99+ - name: Update development files
100+ run: |
101+ VERSION=${{ steps.validate.outputs.version }}
102+ cd contrib
103+ grep -rl "quay.io/oauth2-proxy/oauth2-proxy:" | \
104+ xargs sed -i "s#quay.io/oauth2-proxy/oauth2-proxy:v[0-9]\+\.[0-9]\+\.[0-9]\+#quay.io/oauth2-proxy/oauth2-proxy:v${VERSION}#g"
105+
106+ - name: Commit and push
107+ run: |
108+ VERSION=${{ steps.validate.outputs.version }}
109+
110+ git checkout -b release/v${VERSION}
111+ git commit -am "update to release version v${VERSION}"
112+ git push -u origin release/v${VERSION}
113+
114+ - name: Create PR
115+ env:
116+ GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
117+ run: |
118+ VERSION=v${{ steps.validate.outputs.version }}
119+ gh pr create -B master -H release/${VERSION} --title "release ${VERSION}" --body "Release branch and changes created by GitHub Actions. This PR should include changes to the docs, CHANGELOG and local environment files."
.github/workflows/docs.ymlnew file+68
@@ -0,0 +1,68 @@
1+name: documentation
2+
3+on:
4+ pull_request:
5+ branches: [master]
6+ paths: ['docs/**']
7+ push:
8+ branches: [master]
9+ paths: ['docs/**']
10+ workflow_dispatch:
11+
12+jobs:
13+ pull-request-check:
14+ if: github.event_name == 'pull_request'
15+ runs-on: ubuntu-latest
16+ steps:
17+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
18+
19+ - name: Setup Pages
20+ id: pages
21+ uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
22+
23+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
24+ with:
25+ # renovate: datasource=node-version depName=node
26+ node-version: 24
27+
28+ - name: Test Build
29+ working-directory: ./docs
30+ run: |
31+ npm install
32+ npm run build
33+
34+ build-docs:
35+ if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
36+ runs-on: ubuntu-latest
37+ steps:
38+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
39+
40+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
41+ with:
42+ # renovate: datasource=node-version depName=node
43+ node-version: 24
44+
45+ - name: Build docusaurus
46+ working-directory: ./docs
47+ run: |
48+ npm install
49+ npm run build
50+
51+ - name: Upload artifact
52+ uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
53+ with:
54+ path: ./docs/build
55+
56+ deploy-docs:
57+ needs: build-docs
58+ runs-on: ubuntu-latest
59+ permissions:
60+ pages: write # to deploy to Pages
61+ id-token: write # to verify the deployment originates from an appropriate source
62+ environment:
63+ name: github-pages
64+ url: ${{ steps.deployment.outputs.page_url }}
65+ steps:
66+ - name: Deploy to GitHub Pages
67+ id: deployment
68+ uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
.github/workflows/e2e.ymlnew file+14
@@ -0,0 +1,14 @@
1+name: E2E
2+
3+on:
4+ issue_comment:
5+ types: [created]
6+
7+jobs:
8+ e2e:
9+ uses: oauth2-proxy/e2e-suite/.github/workflows/e2e.yml@main
10+ permissions:
11+ contents: read
12+ statuses: write
13+ issues: write
14+ pull-requests: write
.github/workflows/labeler.ymlnew file+15
@@ -0,0 +1,15 @@
1+name: "Pull Request Labeler"
2+on:
3+ pull_request_target:
4+
5+jobs:
6+ triage:
7+ permissions:
8+ contents: read
9+ pull-requests: write
10+ runs-on: ubuntu-latest
11+ steps:
12+ - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
13+ with:
14+ sync-labels: true
15+ dot: true
.github/workflows/nightly.ymlnew file+41
@@ -0,0 +1,41 @@
1+name: Nightly builds
2+
3+on:
4+ schedule: # Run every day at 03:00 UTC
5+ - cron: '0 3 * * *'
6+ workflow_dispatch:
7+
8+jobs:
9+ build:
10+ runs-on: ubuntu-latest
11+ # only run this build in the main repository, not in forks
12+ if: github.repository == 'oauth2-proxy/oauth2-proxy'
13+ steps:
14+ - name: Check out code
15+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
16+ with:
17+ ref: master
18+ fetch-depth: 0
19+ fetch-tags: true
20+
21+ - name: Set up QEMU
22+ uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
23+
24+ - name: Set up Docker Buildx
25+ id: buildx
26+ uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
27+
28+ - name: Login to quay.io
29+ uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
30+ with:
31+ registry: quay.io/oauth2-proxy
32+ username: ${{ secrets.REGISTRY_USERNAME_NIGHTLY }}
33+ password: ${{ secrets.REGISTRY_PASSWORD_NIGHTLY }}
34+
35+ - name: Build images
36+ run: |
37+ make nightly-build
38+
39+ - name: Push images
40+ run: |
41+ make nightly-push
.github/workflows/publish-release.ymlnew file+129
@@ -0,0 +1,129 @@
1+name: Publish Release
2+run-name: ${{ github.event.pull_request.head.ref }}
3+
4+on:
5+ pull_request_target:
6+ branches:
7+ - master
8+ types:
9+ - closed
10+
11+permissions:
12+ contents: write
13+ pull-requests: write
14+
15+jobs:
16+ publish:
17+ if: github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/') && github.event.pull_request.head.repo.full_name == github.repository
18+ runs-on: ubuntu-latest
19+ outputs:
20+ tag: ${{ steps.tag.outputs.version }}
21+ steps:
22+ - name: Check out code
23+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
24+ with:
25+ ref: ${{ github.event.pull_request.merge_commit_sha }}
26+ fetch-depth: 0
27+ fetch-tags: true
28+
29+ - name: Tag release
30+ env:
31+ BRANCH: ${{ github.event.pull_request.head.ref }}
32+ run: |
33+ # Set up github-actions[bot] user
34+ git config --local user.name "github-actions[bot]"
35+ git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
36+
37+ # Get the version from the branch name
38+ version="${BRANCH#release/}"
39+ echo ${version}
40+
41+ # Tag and create release
42+ git tag -a "${version}" -m "Release ${version}"
43+ echo "version=${version}" >> $GITHUB_OUTPUT
44+ id: tag
45+
46+ - name: Get Go version
47+ run: |
48+ version=$(grep "^go " go.mod | cut -d' ' -f2 | cut -d. -f1,2)
49+ echo "version=${version}" >> "$GITHUB_OUTPUT"
50+ id: go-version
51+
52+ - name: Set up Go
53+ uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
54+ with:
55+ go-version: ${{ steps.go-version.outputs.version }}
56+ check-latest: true
57+
58+ - name: Get go dependencies
59+ run: |
60+ go mod download
61+
62+ - name: Build Artifacts
63+ run: make release
64+
65+ # Upload artifacts in case of workflow failure
66+ - name: Upload Artifacts
67+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
68+ with:
69+ name: oauth2-proxy-artifacts
70+ path: |
71+ release/*.tar.gz
72+ release/*.txt
73+
74+ - name: Create release
75+ env:
76+ GH_TOKEN: ${{ github.token }}
77+ run: |
78+ # Get version from tag
79+ version=$(git describe --tags --abbrev=0)
80+
81+ # Extract CHANGELOG
82+ numericVersion="${version#v}"
83+ notes=$(sed -E "/^# (v|V)$numericVersion$/,/^# (v|V)/!d;//d" CHANGELOG.md)
84+
85+ # Publish release tag
86+ git push origin "${version}"
87+
88+ # Create github release
89+ gh release create "${version}" \
90+ --title "${version}" \
91+ --notes "${notes}" \
92+ --prerelease
93+
94+ # Upload artifacts
95+ gh release upload "${version}" release/*.tar.gz
96+ gh release upload "${version}" release/*.txt
97+
98+ docker:
99+ needs: publish
100+ runs-on: ubuntu-latest
101+ steps:
102+ - name: Check out code
103+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
104+ with:
105+ ref: ${{ needs.publish.outputs.tag }}
106+ fetch-depth: 0
107+ fetch-tags: true
108+
109+ - name: Set up QEMU
110+ uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
111+
112+ - name: Set up Docker Buildx
113+ id: buildx
114+ uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
115+
116+ - name: Login to quay.io
117+ uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
118+ with:
119+ registry: quay.io/oauth2-proxy
120+ username: ${{ secrets.REGISTRY_USERNAME }}
121+ password: ${{ secrets.REGISTRY_PASSWORD }}
122+
123+ - name: Build images
124+ run: |
125+ make build-docker-all
126+
127+ - name: Push images
128+ run: |
129+ make push-docker-all
.github/workflows/stale.ymlnew file+21
@@ -0,0 +1,21 @@
1+name: Mark stale issues and pull requests
2+
3+on:
4+ schedule:
5+ - cron: "0 0 * * *"
6+
7+jobs:
8+ stale:
9+
10+ runs-on: ubuntu-latest
11+
12+ steps:
13+ - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
14+ with:
15+ repo-token: ${{ secrets.GITHUB_TOKEN }}
16+ days-before-stale: 180
17+ days-before-close: 14
18+ stale-issue-message: 'This issue has been inactive for 180 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 14 days, the issue will be marked closed.'
19+ stale-pr-message: 'This pull request has been inactive for 180 days. If the pull request is still relevant please comment to re-activate the pull request. If no action is taken within 14 days, the pull request will be marked closed.'
20+ exempt-issue-labels: bug,high-priority
21+ exempt-pr-labels: bug,high-priority
.gitignorenew file+45
@@ -0,0 +1,45 @@
1+oauth2-proxy
2+vendor
3+dist
4+release
5+.godeps
6+*.exe
7+.env
8+.bundle
9+c.out
10+
11+# Go.gitignore
12+# Compiled Object files, Static and Dynamic libs (Shared Objects)
13+*.o
14+*.a
15+*.so
16+
17+# Folders
18+_obj
19+_test
20+.DS_Store
21+.idea/
22+.vscode/*
23+!/.vscode/tasks.json
24+
25+# Architecture specific extensions/prefixes
26+*.[568vq]
27+[568vq].out
28+
29+*.cgo1.go
30+*.cgo2.c
31+_cgo_defun.c
32+_cgo_gotypes.go
33+_cgo_export.*
34+
35+_testmain.go
36+
37+# Editor swap/temp files
38+.*.swp
39+
40+# Dockerfile.dev is ignored by both git and docker
41+# for faster development cycle of docker build
42+# cp Dockerfile Dockerfile.dev
43+# vi Dockerfile.dev
44+# docker build -f Dockerfile.dev .
45+Dockerfile.dev
.golangci.ymlnew file+77
@@ -0,0 +1,77 @@
1+version: "2"
2+linters:
3+ default: none
4+ enable:
5+ - bodyclose
6+ - copyloopvar
7+ - dogsled
8+ - goconst
9+ - gocritic
10+ - goprintffuncname
11+ - gosec
12+ - govet
13+ - ineffassign
14+ - misspell
15+ - prealloc
16+ - revive
17+ - staticcheck
18+ - unconvert
19+ - unused
20+ exclusions:
21+ generated: lax
22+ presets:
23+ - comments
24+ - common-false-positives
25+ - legacy
26+ - std-error-handling
27+ rules:
28+ - linters:
29+ - bodyclose
30+ - goconst
31+ - gocritic
32+ - gosec
33+ - revive
34+ - scopelint
35+ - unconvert
36+ path: _test\.go
37+ - linters:
38+ - revive
39+ path: _test\.go
40+ text: "dot-imports:"
41+ # # If we have tests in shared test folders, these can be less strictly linted
42+ - linters:
43+ - bodyclose
44+ - revive
45+ - staticcheck
46+ path: tests/.*_tests\.go
47+ # See https://github.com/oauth2-proxy/oauth2-proxy/issues/3060
48+ # https://staticcheck.dev/docs/checks/#QF1008
49+ - linters:
50+ - staticcheck
51+ text: QF1008
52+ - linters:
53+ - revive
54+ path: util/.*\.go$
55+ text: "var-naming: avoid meaningless package names"
56+ # pkg/version conflicts with go/version (added in Go 1.22)
57+ - linters:
58+ - revive
59+ path: pkg/version/.*\.go$
60+ text: "var-naming: avoid package names that conflict with"
61+ - linters:
62+ - prealloc
63+ path: _test\.go
64+ paths:
65+ - third_party$
66+ - builtin$
67+ - examples$
68+formatters:
69+ enable:
70+ - gofmt
71+ - goimports
72+ exclusions:
73+ generated: lax
74+ paths:
75+ - third_party$
76+ - builtin$
77+ - examples$
.pre-commit-config.yamlnew file+13
@@ -0,0 +1,13 @@
1+repos:
2+ - repo: https://github.com/pre-commit/pre-commit-hooks
3+ rev: v4.3.0
4+ hooks:
5+ - id: trailing-whitespace
6+ - id: end-of-file-fixer
7+ - id: check-yaml
8+ - id: check-added-large-files
9+ - repo: https://github.com/dnephin/pre-commit-golang
10+ rev: v0.5.0
11+ hooks:
12+ - id: golangci-lint
13+ - id: go-build
.vscode/launch.jsonnew file+36
@@ -0,0 +1,36 @@
1+{
2+ "version": "0.2.0",
3+ "configurations": [
4+ {
5+ "name": "OAuth2 Proxy for Dex",
6+ "type": "go",
7+ "request": "launch",
8+ "mode": "auto",
9+ "program": "${workspaceFolder}",
10+ "args": [
11+ "--config", "contrib/local-environment/oauth2-proxy.cfg"
12+ ]
13+ },
14+ {
15+ "name": "OAuth2 Proxy for Keycloak",
16+ "type": "go",
17+ "request": "launch",
18+ "mode": "auto",
19+ "program": "${workspaceFolder}",
20+ "args": [
21+ "--config", "contrib/local-environment/oauth2-proxy-keycloak.cfg"
22+ ]
23+ },
24+ {
25+ "name": "OAuth2 Proxy with Alpha Config",
26+ "type": "go",
27+ "request": "launch",
28+ "mode": "auto",
29+ "program": "${workspaceFolder}",
30+ "args": [
31+ "--config", "contrib/local-environment/oauth2-proxy-alpha-config.cfg",
32+ "--alpha-config", "contrib/local-environment/oauth2-proxy-alpha-config.yaml"
33+ ]
34+ }
35+ ]
36+}
.vscode/tasks.jsonnew file+76
@@ -0,0 +1,76 @@
1+{
2+ "version": "2.0.0",
3+ "tasks": [
4+ {
5+ "label": "Run oauth2-proxy",
6+ "type": "shell",
7+ "command": "./oauth2-proxy --config contrib/local-environment/oauth2-proxy.cfg --alpha-config contrib/local-environment/oauth2-proxy-alpha0config.cfg",
8+ "dependsOn": ["Build"],
9+ "group": {
10+ "kind": "test",
11+ "isDefault": true
12+ },
13+ "presentation": {
14+ "reveal": "always",
15+ "panel": "new"
16+ },
17+ "problemMatcher": []
18+ },
19+ {
20+ "label": "Test",
21+ "type": "shell",
22+ "command": "make test",
23+ "group": {
24+ "kind": "test",
25+ "isDefault": true
26+ },
27+ "presentation": {
28+ "reveal": "always",
29+ "panel": "new"
30+ },
31+ "problemMatcher": []
32+ },
33+ {
34+ "label": "Ruff",
35+ "type": "shell",
36+ "command": "pre-commit run ruff --all-files",
37+ "group": {
38+ "kind": "test",
39+ "isDefault": true
40+ },
41+ "presentation": {
42+ "reveal": "always",
43+ "panel": "new"
44+ },
45+ "problemMatcher": []
46+ },
47+ {
48+ "label": "golint",
49+ "type": "shell",
50+ "command": "make lint",
51+ "group": {
52+ "kind": "test",
53+ "isDefault": true
54+ },
55+ "presentation": {
56+ "reveal": "always",
57+ "panel": "new"
58+ },
59+ "problemMatcher": []
60+ },
61+ {
62+ "label": "Build",
63+ "type": "shell",
64+ "command": "make build",
65+ "group": {
66+ "kind": "test",
67+ "isDefault": true
68+ },
69+ "presentation": {
70+ "reveal": "always",
71+ "panel": "new"
72+ },
73+ "problemMatcher": []
74+ }
75+ ]
76+}
CHANGELOG.mdnew file+1700
@@ -0,0 +1,1700 @@
1+# Vx.x.x (Pre-release)
2+
3+## Release Highlights
4+
5+## Important Notes
6+
7+## Breaking Changes
8+
9+## Changes since v7.15.4
10+
11+# V7.15.4
12+
13+## Release Highlights
14+
15+- 🔵 Golang version upgrade to v1.26.7
16+ - Upgrade of all dependencies to their latest versions
17+- 🕵️‍♀️ Vulnerabilities have been addressed
18+ - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818)
19+ - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821)
20+ - [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822)
21+ - [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505)
22+ - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600)
23+ - [CVE-2026-56852](https://nvd.nist.gov/vuln/detail/CVE-2026-56852)
24+ - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853)
25+ - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858)
26+ - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859)
27+ - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860)
28+ - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862)
29+
30+## Important Notes
31+
32+## Breaking Changes
33+
34+## Changes since v7.15.3
35+
36+- [#3493](https://github.com/oauth2-proxy/oauth2-proxy/pull/3493) chore(deps): update gomod @tuunit
37+
38+# V7.15.3
39+
40+## Release Highlights
41+
42+- 🔵 Golang version upgrade to v1.26.4
43+ - Upgrade of all dependencies to their latest versions
44+- 🕵️‍♀️ Vulnerabilities have ben addressed
45+ - [CVE-2026-33811](https://nvd.nist.gov/vuln/detail/)
46+ - [CVE-2026-33814](https://nvd.nist.gov/vuln/detail/)
47+ - [CVE-2026-39820](https://nvd.nist.gov/vuln/detail/)
48+ - [CVE-2026-39836](https://nvd.nist.gov/vuln/detail/)
49+ - [CVE-2026-42499](https://nvd.nist.gov/vuln/detail/)
50+ - [CVE-2026-42504](https://nvd.nist.gov/vuln/detail/)
51+ - [CVE-2026-39823](https://nvd.nist.gov/vuln/detail/)
52+ - [CVE-2026-39826](https://nvd.nist.gov/vuln/detail/)
53+ - [CVE-2026-39825](https://nvd.nist.gov/vuln/detail/)
54+ - [CVE-2026-27145](https://nvd.nist.gov/vuln/detail/)
55+ - [CVE-2026-42507](https://nvd.nist.gov/vuln/detail/)
56+
57+## Important Notes
58+
59+## Breaking Changes
60+
61+## Changes since v7.15.2
62+
63+- [#3477](https://github.com/oauth2-proxy/oauth2-proxy/pull/3477) chore(dep): bump go to 1.26 and migrate of reverse proxy handling
64+
65+# V7.15.2
66+
67+## Release Highlights
68+
69+- 🔵 Golang version upgrade to v1.25.9
70+ - Upgrade of all dependencies to their latest versions
71+ - [CVE-2026-34986](https://nvd.nist.gov/vuln/detail/CVE-2026-34986)
72+ - [CVE-2026-32281](https://nvd.nist.gov/vuln/detail/CVE-2026-32281)
73+ - [CVE-2026-32289](https://nvd.nist.gov/vuln/detail/CVE-2026-32289)
74+ - [CVE-2026-32288](https://nvd.nist.gov/vuln/detail/CVE-2026-32288)
75+ - [CVE-2026-32280](https://nvd.nist.gov/vuln/detail/CVE-2026-32280)
76+ - [CVE-2026-32282](https://nvd.nist.gov/vuln/detail/CVE-2026-32282)
77+ - [CVE-2026-32283](https://nvd.nist.gov/vuln/detail/CVE-2026-32283)
78+- 🕵️‍♀️ Vulnerabilities have been addressed
79+
80+## Important Notes
81+
82+We have had security audits performed on OAuth2 Proxy in the past couple of weeks and as a result we have fixed
83+several CRITICAL vulnerabilities.
84+
85+The security vulnerabilities include multiple authentication bypasses and a potential session fixation attack.
86+For more details and to identify if you are effects, we urge all users of OAuth2 Proxy to read the security
87+disclosures.
88+
89+- (Critical) [GHSA-5hvv-m4w4-gf6v](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5hvv-m4w4-gf6v) fix: health check user-agent authentication bypass
90+- (Critical) [GHSA-7x63-xv5r-3p2x](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x) fix: authentication bypass via X-Forwarded-Uri header spoofing
91+- (High) [GHSA-pxq7-h93f-9jrg](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-pxq7-h93f-9jrg) fix: fragment evaluation as part of the allowed routes
92+- (Moderate) [GHSA-c5c4-8r6x-56w3](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-c5c4-8r6x-56w3) fix: email validation bypass via malformed multi-@ email claims
93+
94+Furthermore, for improving the security of OAuth2 Proxy we introduced a new flag `--trusted-proxy-ip` that allows users
95+to explicitly specify trusted reverse proxy IPs for the `X-Forwarded-*` headers. This is an important step to prevent
96+potential header spoofing attacks and to ensure that OAuth2 Proxy only trusts headers from known and trusted sources.
97+We highly recommend users to review their deployment architecture and consider using this flag to enhance the security
98+of their OAuth2 Proxy instances. Check the docs for more details: https://oauth2-proxy.github.io/oauth2-proxy/configuration/overview#proxy-options
99+
100+Furthermore, we want to thank everyone who contributed to the audits and reported potential issues to make open source
101+software like OAuth2 Proxy more secure for everyone.
102+
103+## Breaking Changes
104+
105+## Changes since v7.15.1
106+
107+- [#3411](https://github.com/oauth2-proxy/oauth2-proxy/pull/3411) chore(deps): update gomod dependencies (@tuunit)
108+- [#3333](https://github.com/oauth2-proxy/oauth2-proxy/pull/3333) fix: invalidate session on fatal OAuth2 refresh errors (@frhack)
109+- [GHSA-f24x-5g9q-753f](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-f24x-5g9q-753f) fix: clear session cookie at beginning of signinpage handler (@fnoehWM / @bella-WI / @tuunit)
110+- [GHSA-5hvv-m4w4-gf6v](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5hvv-m4w4-gf6v) fix: health check user-agent authentication bypass (@tuunit)
111+- [GHSA-7x63-xv5r-3p2x](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x) fix: authentication bypass via X-Forwarded-Uri header spoofing (@tuunit)
112+- [GHSA-pxq7-h93f-9jrg](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-pxq7-h93f-9jrg) fix: fragment evaluation as part of the allowed routes (@tuunit)
113+- [GHSA-c5c4-8r6x-56w3](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-c5c4-8r6x-56w3) fix: email validation bypass via malformed multi-@ email claims (@tuunit)
114+
115+# V7.15.1
116+
117+## Release Highlights
118+
119+- 🐛 Squashed some bugs
120+- 🕵️‍♀️ Vulnerabilities have been addressed
121+ - [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186)
122+ OAuth2 Proxy was not impacted by this vulnerability as it isn't in the path of execution
123+
124+## Important Notes
125+
126+## Breaking Changes
127+
128+## Changes since v7.15.0
129+
130+- [#3382](https://github.com/oauth2-proxy/oauth2-proxy/pull/3382) chore(deps): update gomod and golangci/golangci-lint to v2.11.4 (@tuunit)
131+- [#3374](https://github.com/oauth2-proxy/oauth2-proxy/pull/3374) fix: handle Unix socket RemoteAddr in IP resolution (@H1net)
132+- [#3381](https://github.com/oauth2-proxy/oauth2-proxy/pull/3381) fix: do not log error for backend logout 204 (@artificiosus)
133+- [#3327](https://github.com/oauth2-proxy/oauth2-proxy/pull/3327) fix: improve logging when session refresh token is missing (@yosri-brh)
134+- [#2767](https://github.com/oauth2-proxy/oauth2-proxy/pull/2767) fix: propagate errors during route building (@sybereal)
135+
136+# V7.15.0
137+
138+## Release Highlights
139+
140+- 🔒 OIDC JWT signing algorithms can now be configured
141+- 🍪 CSRF cookie improvements (SameSite option, proper expiration validation)
142+- 🧪 Configuration validation flag: --config-test
143+- 🔌 Unix socket file mode support
144+- 👤 Session state can now be extend with arbitrary claims from ID Token and upstream IDP user profiles endpoint
145+ - This opens the door for multiple features like:
146+ - Additional arbitrary header values for any claims your IDP provides
147+ - Extended OAuth2 Proxy UserInfo endpoint with all additional claims
148+ - Read the docs [here](https://oauth2-proxy.github.io/oauth2-proxy/configuration/alpha-config#how-to-utilize-arbitrary-claims-provided-by-your-identity-provider)
149+
150+## Important Notes
151+
152+CSRF cookie validation now correctly uses `CSRFExpire` instead of `Expire`. If you relied on the previous behavior, review your session timeout configuration.
153+Check the [documentation(https://oauth2-proxy.github.io/oauth2-proxy/configuration/overview#cookie-options) for `cookie-csrf-expire`.
154+
155+## Breaking Changes
156+
157+## Changes since v7.14.3
158+
159+- [#3352](https://github.com/oauth2-proxy/oauth2-proxy/pull/3352) fix: backend logout URL call on sign out (#3172)(@vsejpal)
160+- [#3332](https://github.com/oauth2-proxy/oauth2-proxy/pull/3332) ci: distribute windows binary with .exe extension (@igitur)
161+- [#2685](https://github.com/oauth2-proxy/oauth2-proxy/pull/2685) feat: allow arbitrary claims from the IDToken and IdentityProvider UserInfo endpoint to be added to the session state (@vegetablest)
162+- [#3278](https://github.com/oauth2-proxy/oauth2-proxy/pull/3278) feat: possibility to inject id_token in redirect url during sign out (@albanf)
163+- [#2851](https://github.com/oauth2-proxy/oauth2-proxy/pull/2851) feat: add support for specifying allowed OIDC JWT signing algorithms (#2753) (@andoks / @tuunit)
164+- [#3369](https://github.com/oauth2-proxy/oauth2-proxy/pull/3369) fix: use CSRFExpire instead of Expire for CSRF cookie validation (@Br1an67)
165+- [#3365](https://github.com/oauth2-proxy/oauth2-proxy/pull/3365) fix: filter empty strings from allowed groups (@Br1an67)
166+- [#3338](https://github.com/oauth2-proxy/oauth2-proxy/pull/3338) feat: add --config-test flag for validating configuration (@MayorFaj)
167+- [#3347](https://github.com/oauth2-proxy/oauth2-proxy/pull/3347) feat: add same site option for csrf cookies (@jvnoije)
168+- [#3376](https://github.com/oauth2-proxy/oauth2-proxy/pull/3376) feat: allow setting unix socket file mode when declaring listener (@Tristan971 / @tuunit)
169+
170+# V7.14.3
171+
172+## Release Highlights
173+
174+- 🔵 Go1.25.7 and upgrade of dependencies to latest versions
175+ - Fixes [CVE-2025-68121](https://nvd.nist.gov/vuln/detail/cve-2025-68121)
176+- 🐛 Bug fixes
177+ - Allow Redis URL parameters to configure username, password and max idle connection timeout if the matching configuration is empty.
178+
179+## Important Notes
180+
181+We improved our supply chain security by added additional checks to prevent potential command injection in the publish release workflow and to ensure that it can only be triggered from branches originating in the local repository. This potential issue was reported by automated systems as well as a couple of security researchers, and we want to thank everyone for their diligence in looking out for the security of the project. Especially Aastha Aggarwal for her detailed report and follow-up. @Aastha2602
182+
183+
184+## Breaking Changes
185+
186+## Changes since v7.14.2
187+
188+- [#3183](https://github.com/oauth2-proxy/oauth2-proxy/pull/3183) fix: allow URL parameters to configure username, password and max idle connection timeout if the matching configuration is empty.
189+
190+# V7.14.2
191+
192+## Release Highlights
193+
194+- Revert AuthOnly endpoint change from v7.14.1 that caused issues when using `skip-provider-button` enabled
195+
196+## Important Notes
197+
198+- This release reverts the change made in v7.14.1 that caused issues when using the `skip-provider-button` enabled. Now, when a session does not exist, the AuthOnly endpoint will send a 401 status code as expected instead of a 302 redirect. And instead we extended the documentation to clarify the behavior when using `nginx` with `auth_request` and `skip-provider-button` and how to properly configure redirects for browser and API routes.
199+
200+## Breaking Changes
201+
202+## Changes since v7.14.1
203+
204+- [#3314](https://github.com/oauth2-proxy/oauth2-proxy/pull/3314) revert: fix: skip provider button auth only redirect (#3309) (@StefanMarkmann / @tuunit)
205+- [#3315](https://github.com/oauth2-proxy/oauth2-proxy/pull/3315) docs: clarify browser vs API routes for nginx auth_request redirects (@StefanMarkmann)
206+
207+# V7.14.1
208+
209+## Release Highlights
210+
211+- 🔵 Go1.25.6 and upgrade of dependencies to latest versions
212+- 🐛 Bug fixes
213+ - AuthOnly now starts the auth flow and send status code 302 if no session exists and skip-provider-button is true
214+ - Fixed static upstream validation issue due to incorrect defaults
215+
216+## Important Notes
217+
218+## Breaking Changes
219+
220+## Changes since v7.14.0
221+
222+- [#3309](https://github.com/oauth2-proxy/oauth2-proxy/pull/3309) fix: Return 302 redirect from AuthOnly endpoint when skip-provider-button is true (@StefanMarkmann)
223+- [#3302](https://github.com/oauth2-proxy/oauth2-proxy/pull/3302) fix: static upstreams failing validation due to `passHostHeader` and `proxyWebSockets` defaults being set incorrectly (@sourava01 / @tuunit)
224+- [#3312](https://github.com/oauth2-proxy/oauth2-proxy/pull/3312) chore(deps): upgrade to go1.25.6 and latest dependencies (@tuunit)
225+
226+# V7.14.0
227+
228+## Release Highlights
229+
230+- 🕵️‍♀️ Vulnerabilities have been addressed
231+ - [CVE-2025-61729](https://access.redhat.com/security/cve/cve-2025-61729)
232+ - [CVE-2025-61727](https://access.redhat.com/security/cve/cve-2025-61727)
233+ - [CVE-2025-47914](https://access.redhat.com/security/cve/cve-2025-47914)
234+ - [CVE-2025-58181](https://access.redhat.com/security/cve/cve-2025-58181)
235+- 🗂️ AMajor Alpha Config YAML parsing revamped for better extensibility and preparing v8
236+- 🐛 Squashed some bugs
237+
238+## Important Notes
239+
240+This release introduces a breaking change for Alpha Config users and moves us significantly
241+closer to removing legacy configuration parameters, making the codebase of OAuth2 Proxy more
242+future proof and extensible.
243+
244+From v7.14.0 onward, header injection sources must be explicitly nested. If you
245+previously relied on squashed fields, update to the new structure before upgrading:
246+
247+```yaml
248+# before v7.14.0
249+injectRequestHeaders:
250+- name: X-Forwarded-User
251+ values:
252+ - claim: user
253+- name: X-Custom-Secret-header
254+ values:
255+ - value: my-super-secret
256+
257+# v7.14.0 and later
258+injectRequestHeaders:
259+- name: X-Forwarded-User
260+ values:
261+ - claimSource:
262+ claim: user
263+- name: X-Custom-Secret-header
264+ values:
265+ - secretSource:
266+ value: my-super-secret
267+```
268+
269+Furthermore, Alpha Config now fully supports configuring the `Server` struct using YAML.
270+
271+```yaml
272+// Server represents the configuration for the Proxy HTTP(S) configuration.
273+type Server struct {
274+ // BindAddress is the address on which to serve traffic.
275+ BindAddress string `yaml:"bindAddress,omitempty"`
276+
277+ // SecureBindAddress is the address on which to serve secure traffic.
278+ SecureBindAddress string `yaml:"secureBindAddress,omitempty"`
279+
280+ // TLS contains the information for loading the certificate and key for the
281+ // secure traffic and further configuration for the TLS server.
282+ TLS *TLS `yaml:"tls,omitempty"`
283+}
284+
285+// TLS contains the information for loading a TLS certificate and key
286+// as well as an optional minimal TLS version that is acceptable.
287+type TLS struct {
288+ // Key is the TLS key data to use.
289+ Key *SecretSource `yaml:"key,omitempty"`
290+ // Cert is the TLS certificate data to use.
291+ Cert *SecretSource `yaml:"cert,omitempty"`
292+ // MinVersion is the minimal TLS version that is acceptable.
293+ MinVersion string `yaml:"minVersion,omitempty"`
294+ // CipherSuites is a list of TLS cipher suites that are allowed.
295+ CipherSuites []string `yaml:"cipherSuites,omitempty"`
296+}
297+```
298+
299+More about how to use Alpha Config can be found in the [documentation](https://oauth2-proxy.github.io/oauth2-proxy/configuration/alpha-config#server).
300+
301+We are committed to Semantic Versioning and usually avoid breaking changes without a major version release.
302+Advancing Alpha Config toward its Beta stage required this exception, and even for the Alpha Config we try
303+to keep breaking changes in v7 to a minium. Thank you for understanding the need for this step to prepare
304+the project for future maintainability and future improvements like structured logging.
305+
306+## Breaking Changes
307+
308+- Alpha Config: header injection no longer supports squashed claim/secret sources; they must now be set explicitly (see example above).
309+
310+## Changes since v7.13.0
311+
312+- [#2628](https://github.com/oauth2-proxy/oauth2-proxy/pull/2628) feat(structured config): revamp of yaml parsing using mapstructure decoder and custom decoders (@tuunit)
313+- [#3197](https://github.com/oauth2-proxy/oauth2-proxy/pull/3197) fix: NewRemoteKeySet is not using DefaultHTTPClient (@rsrdesarrollo / @tuunit)
314+- [#3292](https://github.com/oauth2-proxy/oauth2-proxy/pull/3292) chore(deps): upgrade gomod and bump to golang v1.25.5 (@tuunit)
315+- [#3304](https://github.com/oauth2-proxy/oauth2-proxy/pull/3304) fix: added conditional so default is not always set and env vars are honored fixes 3303 (@pixeldrew)
316+- [#3264](https://github.com/oauth2-proxy/oauth2-proxy/pull/3264) fix: more aggressively truncate logged access_token (@MartinNowak / @tuunit)
317+- [#3267](https://github.com/oauth2-proxy/oauth2-proxy/pull/3267) fix: Session refresh handling in OIDC provider (@gysel)
318+- [#3290](https://github.com/oauth2-proxy/oauth2-proxy/pull/3290) fix: WebSocket proxy to respect PassHostHeader setting (@UnsignedLong)
319+
320+# V7.13.0
321+
322+## Release Highlights
323+
324+- 🕵️‍♀️ Vulnerabilities have been addressd
325+ - [CVE-2025-47912](https://nvd.nist.gov/vuln/detail/CVE-2025-47912)
326+ - [CVE-2025-58183](https://nvd.nist.gov/vuln/detail/CVE-2025-58183)
327+ - [CVE-2025-58186](https://nvd.nist.gov/vuln/detail/CVE-2025-58186)
328+ - [CVE-2025-64484](https://nvd.nist.gov/vuln/detail/CVE-2025-64484)
329+- 🐛 Squashed some bugs
330+
331+## Important Notes
332+
333+By default all specified headers will now be normalized, meaning that both capitalization and the use of underscores (_) versus dashes (-) will be ignored when matching headers to be stripped. For example, both `X-Forwarded-For` and `X_Forwarded-for` will now be treated as equivalent and stripped away.
334+
335+Please read our security advisory for CVE-2025-64484: [GHSA-vjrc-mh2v-45x6](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6)
336+
337+Furthermore, we now use the access_token for validating refreshed sessions in OIDC providers instead of the id_token. This is to align with the [OIDC specification](https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokens) which states that id_tokens are not guaranteed to be issued when using refresh tokens. In future releases we might remove the id_token validation for sessions completely.
338+
339+## Breaking Changes
340+
341+## Changes since v7.12.0
342+
343+- [#3228](https://github.com/oauth2-proxy/oauth2-proxy/pull/3228) fix: use GetSecret() in ticket.go makeCookie to respect cookie-secret-file (@stagswtf)
344+- [#3244](https://github.com/oauth2-proxy/oauth2-proxy/pull/3244) chore(deps): upgrade to latest go1.25.3 (@tuunit)
345+- [#3238](https://github.com/oauth2-proxy/oauth2-proxy/pull/3238) chore: Replace pkg/clock with narrowly targeted stub clocks (@dsymonds)
346+- [#3237](https://github.com/oauth2-proxy/oauth2-proxy/pull/3237) - feat: add option to use organization id for preferred username in Google Provider (@pixeldrew)
347+- [GHSA-vjrc-mh2v-45x6](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6) fix: request header smuggling by stripping all normalized header variants (@tuunit)
348+- [#1933](https://github.com/oauth2-proxy/oauth2-proxy/pull/1933) fix: validation of refreshed sessions using the access_token in the OIDC provider (@gysel / @tuunit)
349+- [#2841](https://github.com/oauth2-proxy/oauth2-proxy/pull/2841) feat: add allowed_* constraint option to proxy endpoint query string (@jacobalberty)
350+
351+# V7.12.0
352+
353+## Release Highlights
354+
355+- 🕵️‍♀️ Vulnerabilities have been addressed
356+ - [CVE-2025-47907](https://pkg.go.dev/vuln/GO-2025-3849)
357+- 🦸 Support for Cidaas IDP
358+- 🐛 Squashed some bugs
359+
360+
361+## Important Notes
362+
363+## Breaking Changes
364+
365+## Changes since v7.11.0
366+
367+- [#2273](https://github.com/oauth2-proxy/oauth2-proxy/pull/2273) feat: add Cidaas provider (@Bibob7, @Teko012)
368+- [#3166](https://github.com/oauth2-proxy/oauth2-proxy/pull/3166) chore(dep): upgrade to latest golang 1.24.6 (@tuunit)
369+- [#3156](https://github.com/oauth2-proxy/oauth2-proxy/pull/3156) feat: allow disable-keep-alives configuration for upstream (@jet-go)
370+- [#3150](https://github.com/oauth2-proxy/oauth2-proxy/pull/3150) fix: Gitea team membership (@MagicRB, @tuunit)
371+
372+# V7.11.0
373+
374+## Release Highlights
375+
376+- 🏢 Support for SourceHut (sr.ht) provider
377+- 🔍️ Support for more fine-grained control over the google admin-sdk scopes and optional google groups
378+- 🐛 Squashed some bugs
379+
380+
381+## Important Notes
382+
383+Firstly, fixed critical vulnerability where `skip_auth_routes` regex patterns matched against the full request URI (path + query parameters) instead of just the path, allowing authentication bypass attacks.
384+
385+Secondly, fixed double-escaping of `$` in regexes for Alpha Config upstreams path and rewriteTargets:
386+
387+```yaml
388+# Before
389+upstreams:
390+ - id: web
391+ path: ^/(.*)$$
392+ rewriteTarget: /$$1
393+
394+# After
395+upstreams:
396+ - id: web
397+ path: ^/(.*)$
398+ rewriteTarget: /$1
399+```
400+
401+
402+## Breaking Changes
403+
404+If your configuration relies on matching query parameters in `skip_auth_routes` patterns, you must update your regex patterns to match paths only. Review all `skip_auth_routes` entries for potential impact.
405+
406+**Example of affected configuration:**
407+```yaml
408+# This pattern previously matched both:
409+# - /api/foo/status (intended)
410+# - /api/private/sensitive?path=/status (bypass - now fixed)
411+skip_auth_routes: ["^/api/.*/status"]
412+```
413+
414+For detailed information, migration guidance, and security implications, see the [security advisory](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7rh7-c77v-6434).
415+
416+## Changes since v7.10.0
417+
418+- [#2615](https://github.com/oauth2-proxy/oauth2-proxy/pull/2615) feat(cookies): add option to set a limit on the number of per-request CSRF cookies oauth2-proxy sets (@bh-tt)
419+- [#2605](https://github.com/oauth2-proxy/oauth2-proxy/pull/2605) fix: show login page on broken cookie (@Primexz)
420+- [#2743](https://github.com/oauth2-proxy/oauth2-proxy/pull/2743) feat: allow use more possible google admin-sdk api scopes (@BobDu)
421+- [#2359](https://github.com/oauth2-proxy/oauth2-proxy/pull/2359) feat: add SourceHut (sr.ht) provider(@bitfehler)
422+- [#2524](https://github.com/oauth2-proxy/oauth2-proxy/pull/2524) fix: regex substitution for $ signs in upstream path handling before running envsubst (@dashkan / @tuunit)
423+- [#3104](https://github.com/oauth2-proxy/oauth2-proxy/pull/3104) feat(cookie): add feature support for cookie-secret-file (@sandy2008)
424+- [#3055](https://github.com/oauth2-proxy/oauth2-proxy/pull/3055) feat: support non-default authorization request response mode also for OIDC providers (@stieler-it)
425+- [#3138](https://github.com/oauth2-proxy/oauth2-proxy/pull/3138) feat: make google_groups argument optional when using google provider (@sourava01)
426+- [#3093](https://github.com/oauth2-proxy/oauth2-proxy/pull/3093) feat: differentiate between "no available key" and error for redis sessions (@nobletrout)
427+- [GHSA-7rh7-c77v-6434](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7rh7-c77v-6434) fix: skip_auth_routes bypass through query parameter inclusion
428+
429+
430+# V7.10.0
431+
432+## Release Highlights
433+- 🏢 Support for multiple orgs using the GitHub / Gitea provider
434+- 🔵 Golang version upgrade to v1.24.5
435+- 🕵️‍♀️ Vulnerabilities have been addressed
436+ - [CVE-2025-4673](https://access.redhat.com/security/cve/CVE-2025-4673)
437+ - [CVE-2025-22872](https://access.redhat.com/security/cve/CVE-2025-22872)
438+ - [CVE-2025-09130](https://nvd.nist.gov/vuln/detail/CVE-2025-09130)
439+ - [CVE-2025-22871](https://access.redhat.com/security/cve/CVE-2025-22871)
440+- 🐛 Squashed some bugs
441+
442+## Important Notes
443+
444+## Breaking Changes
445+
446+## Changes since v7.9.0
447+
448+- [#3072](https://github.com/oauth2-proxy/oauth2-proxy/pull/3072) feat: support for multiple github orgs #3072 (@daniel-mersch)
449+- [#3116](https://github.com/oauth2-proxy/oauth2-proxy/pull/3116) feat: bump to go1.24.5 and full dependency update (@wardviaene / @dolmen)
450+- [#3097](https://github.com/oauth2-proxy/oauth2-proxy/pull/3097) chore(deps): update alpine base image to v3.22.0
451+- [#3101](https://github.com/oauth2-proxy/oauth2-proxy/pull/3101) fix: return error for empty Redis URL list (@dgivens)
452+
453+# V7.9.0
454+
455+## Release Highlights
456+- 📨 OAuth 2.0 Multiple Response Type Encoding
457+- 📦️ Support for JWT encoded profile claims
458+- 🔵 Golang version upgrade to v1.23.8
459+- 🕵️‍♀️ Vulnerabilities have been addressed
460+ - [CVE-2025-22871](https://github.com/advisories/GHSA-g9pc-8g42-g6vq)
461+- 🐛 Squashed some bugs
462+
463+## Important Notes
464+
465+## Breaking Changes
466+
467+## Changes since v7.8.2
468+
469+- [#3031](https://github.com/oauth2-proxy/oauth2-proxy/pull/3031) Fixes Refresh Token bug with Entra ID and Workload Identity (#3027)[https://github.com/oauth2-proxy/oauth2-proxy/issues/3028] by using client assertion when redeeming the token (@richard87)
470+- [#3001](https://github.com/oauth2-proxy/oauth2-proxy/pull/3001) Allow to set non-default authorization request response mode (@stieler-it)
471+- [#3041](https://github.com/oauth2-proxy/oauth2-proxy/pull/3041) chore(deps): upgrade to latest golang v1.23.x release (@TheImplementer)
472+- [#1916](https://github.com/oauth2-proxy/oauth2-proxy/pull/1916) fix: role extraction from access token in keycloak oidc (@Elektordi / @tuunit)
473+- [#3014](https://github.com/oauth2-proxy/oauth2-proxy/pull/3014) feat: ability to parse JWT encoded profile claims (@ikarius)
474+
475+# V7.8.2
476+
477+## Release Highlights
478+- 🐛 Cookie Expiration bug has been squashed
479+- 🔵 Golang version upgrade to v1.23.7
480+- 🕵️‍♀️ Vulnerabilities have been addressed
481+ - CVE-2025-30204
482+ - CVE-2025-27144
483+ - CVE-2024-45336
484+ - CVE-2025-22866
485+ - CVE-2025-22870
486+ - CVE-2024-45341
487+ - CVE-2025-29923
488+ - CVE-2025-22866
489+ - CVE-2024-34156
490+
491+## Important Notes
492+
493+## Breaking Changes
494+
495+## Changes since v7.8.1
496+
497+- [#2918](https://github.com/oauth2-proxy/oauth2-proxy/issues/2918) feat: add --bearer-token-login-fallback (@carillonator)
498+- [#2927](https://github.com/oauth2-proxy/oauth2-proxy/pull/2927) chore(deps/build): bump golang to 1.23 and use go.mod as single point of truth for all build files (@tuunit)
499+- [#2697](https://github.com/oauth2-proxy/oauth2-proxy/pull/2697) Use `Max-Age` instead of `Expires` for cookie expiration (@matpen-wi)
500+- [#2969](https://github.com/oauth2-proxy/oauth2-proxy/pull/2969) Update golang.org/x/oauth2 to v0.27.0 to address CVE-2025-22868 (@dsymonds)
501+- [#2977](https://github.com/oauth2-proxy/oauth2-proxy/pull/2977) Update golang.org/x/net to v0.36.0 to address CVE-2025-22870 (@dsymonds)
502+- [#2982](https://github.com/oauth2-proxy/oauth2-proxy/pull/2982) chore(deps): remove go:generate tool from go.mod (@dolmen)
503+- [#3011](https://github.com/oauth2-proxy/oauth2-proxy/pull/3011) chore(deps): update golang dependencies and pin to latest golang v1.23.x release (@tuunit)
504+- [#2967](https://github.com/oauth2-proxy/oauth2-proxy/pull/2967) Update HashNonce to use crypto/sha256 (@egibs)
505+
506+# V7.8.1
507+
508+## Release Highlights
509+
510+- 🐛 Two bugs have been squashed
511+
512+## Important Notes
513+
514+## Breaking Changes
515+
516+## Changes since v7.8.0
517+
518+- [#2887](https://github.com/oauth2-proxy/oauth2-proxy/issues/2887) fix: jwt regex validation error during skip-jwt-bearer-tokens flow
519+- [#2920](https://github.com/oauth2-proxy/oauth2-proxy/pull/2920) fix: missing oauth2-proxy version for docker builds
520+
521+# V7.8.0
522+
523+## Release Highlights
524+
525+- ☁️ Introducing support for Microsoft Entra ID
526+ - Including Support for Azure Workload Identity as well
527+ - Including full e2e testing using Azure Credits from MS sponsoring
528+ - Deprecated old Azure AD provider
529+- 🪪 Static local JWKS file support
530+- Support for systemd sockets
531+- 🐛 Several bugs have been squashed
532+- 🕵️‍♀️ Vulnerabilities have been addressed
533+ - CVE-2024-45338
534+
535+## Important Notes
536+
537+## Breaking Changes
538+
539+## Changes since v7.7.1
540+
541+- [#2390](https://github.com/oauth2-proxy/oauth2-proxy/pull/2390) feat: add Microsoft Entra ID provider (@jjlakis / @tuunit)
542+- [#2902](https://github.com/oauth2-proxy/oauth2-proxy/pull/2902) feat(entra): add Workload Identity support for Entra ID (@jjlakis)
543+- [#2800](https://github.com/oauth2-proxy/oauth2-proxy/pull/2800) doc: add some opencontainer labels to docker image (@halkeye)
544+- [#2755](https://github.com/oauth2-proxy/oauth2-proxy/pull/2755) feat: add X-Envoy-External-Address as supported header (@bjencks)
545+- [#1985](https://github.com/oauth2-proxy/oauth2-proxy/pull/1985) feat: add support for systemd socket (@isodude)
546+- [#2916](https://github.com/oauth2-proxy/oauth2-proxy/pull/2916) fix: systemd socket support build handling for windows (@tuunit)
547+- [#2300](https://github.com/oauth2-proxy/oauth2-proxy/pull/2300) fix: add fix for websocket path rewrite (@rekup)
548+- [#2821](https://github.com/oauth2-proxy/oauth2-proxy/pull/2821) feat: add CF-Connecting-IP as supported real ip header (@ondrejsika)
549+- [#2620](https://github.com/oauth2-proxy/oauth2-proxy/pull/2620) fix: update code_verifier to use recommended method (@vishvananda)
550+- [#2376](https://github.com/oauth2-proxy/oauth2-proxy/pull/2376) feat: static public keys file support for oidc provider (@axel7083 / @jjlakis)
551+- [#2392](https://github.com/oauth2-proxy/oauth2-proxy/pull/2392) chore: extend test cases for oidc provider and documentation regarding implicit setting of the groups scope when no scope was specified in the config (@jjlakis / @tuunit)
552+
553+# V7.7.1
554+
555+## Release Highlights
556+
557+- 🐛 Several bugs have been squashed
558+
559+## Important Notes
560+
561+## Breaking Changes
562+
563+## Changes since v7.7.0
564+
565+- [#2803](https://github.com/oauth2-proxy/oauth2-proxy/pull/2803) fix: self signed certificate handling in v7.7.0 (@tuunit)
566+- [#2619](https://github.com/oauth2-proxy/oauth2-proxy/pull/2619) fix: unable to use hyphen in JSON path for oidc-groups-claim option (@rd-danny-fleer)
567+- [#2311](https://github.com/oauth2-proxy/oauth2-proxy/pull/2311) fix: runtime error: index out of range (0) with length 0 (@miguelborges99 / @tuunit)
568+
569+# V7.7.0
570+
571+## Release Highlights
572+
573+- 🌐 Custom user agent "oauth2-proxy/<version>"
574+- 💾 Added s390x architecture support
575+- 🕵️‍♀️ Vulnerabilities have been addressed
576+ - CVE-2024-24786
577+ - CVE-2024-24791
578+ - CVE-2024-24790
579+ - CVE-2024-24784
580+- 📖 Improved docs
581+
582+## Important Notes
583+- Remove support of arm/v6 for distroless image runtime. Alpine tags still support arm/v6.
584+
585+## Breaking Changes
586+
587+## Changes since v7.6.0
588+
589+- [#2539](https://github.com/oauth2-proxy/oauth2-proxy/pull/2539) pkg/http: Fix leaky test (@isodude)
590+- [#4917](https://github.com/oauth2-proxy/oauth2-proxy/pull/4917) Upgraded all modules to the latest version (@pierluigilenoci)
591+- [#2570](https://github.com/oauth2-proxy/oauth2-proxy/pull/2570) Set default user agent to oauth2-proxy/$version (from default Golang one)
592+- [#2674](https://github.com/oauth2-proxy/oauth2-proxy/pull/2674) docs: additional notes about available claims for HeaderValue (@vegetablest)
593+- [#2459](https://github.com/oauth2-proxy/oauth2-proxy/pull/2459) chore(deps): Updated to ginkgo v2 (@kvanzuijlen, @tuunit)
594+- [#2112](https://github.com/oauth2-proxy/oauth2-proxy/pull/2112) docs: update list of providers which support refresh tokens (@mikefab-msf)
595+- [#2734](https://github.com/oauth2-proxy/oauth2-proxy/pull/2734) Added s390x architecture option support (@priby05)
596+- [#2589](https://github.com/oauth2-proxy/oauth2-proxy/pull/2589) Added support for regex path matching and rewriting when using a static `file:` upstream (@ianroberts)
597+- [#2790](https://github.com/oauth2-proxy/oauth2-proxy/pull/2790) chore(deps): update all golang dependencies (@tuunit)
598+- [#2607](https://github.com/oauth2-proxy/oauth2-proxy/pull/2607) fix(csrf): fix possible infinite loop (@Primexz)
599+
600+# V7.6.0
601+
602+## Release Highlights
603+
604+## Important Notes
605+
606+## Breaking Changes
607+
608+## Changes since v7.5.1
609+
610+- [#2381](https://github.com/oauth2-proxy/oauth2-proxy/pull/2381) Allow username authentication to Redis cluster (@rossigee)
611+- [#2345](https://github.com/oauth2-proxy/oauth2-proxy/pull/2345) Log error details when failed loading CSRF cookie (@charvadzo)
612+- [#2128](https://github.com/oauth2-proxy/oauth2-proxy/pull/2128) Update dependencies (@vllvll)
613+- [#2269](https://github.com/oauth2-proxy/oauth2-proxy/pull/2269) Added Azure China (and other air gaped cloud) support (@mblaschke)
614+- [#2237](https://github.com/oauth2-proxy/oauth2-proxy/pull/2237) adds an option to append CA certificates (@emsixteeen)
615+- [#2128](https://github.com/oauth2-proxy/oauth2-proxy/pull/2128) Update dependencies (@vllvll)
616+- [#2239](https://github.com/oauth2-proxy/oauth2-proxy/pull/2312) Add possibility to encode the state param as UrlEncodedBase64 (@brezinajn)
617+- [#2274](https://github.com/oauth2-proxy/oauth2-proxy/pull/2274) Upgrade golang.org/x/net to v0.17.0 (@pierluigilenoci)
618+- [#2278](https://github.com/oauth2-proxy/oauth2-proxy/pull/2278) Improve the Nginx auth_request example (@akunzai)
619+- [#2282](https://github.com/oauth2-proxy/oauth2-proxy/pull/2282) Fixed checking Google Groups membership using Google Application Credentials (@kvanzuijlen)
620+- [#2183](https://github.com/oauth2-proxy/oauth2-proxy/pull/2183) Allowing relative redirect url though an option (@axel7083)
621+- [#1866](https://github.com/oauth2-proxy/oauth2-proxy/pull/1866) Add support for unix socker as upstream (@babs)
622+- [#1876](https://github.com/oauth2-proxy/oauth2-proxy/pull/1876) Add `--backend-logout-url` with `{id_token}` placeholder (@babs)
623+- [#1949](https://github.com/oauth2-proxy/oauth2-proxy/pull/1949) Allow cookie names with dots in redis sessions (@miguelborges99)
624+- [#2297](https://github.com/oauth2-proxy/oauth2-proxy/pull/2297) Add nightly build and push (@tuunit)
625+- [#2329](https://github.com/oauth2-proxy/oauth2-proxy/pull/2329) Add an option to skip request to profile URL for resolving missing claims in id_token (@nilsgstrabo)
626+- [#2299](https://github.com/oauth2-proxy/oauth2-proxy/pull/2299) bugfix: OIDCConfig based providers are not respecting flags and configs (@tuunit)
627+- [#2343](https://github.com/oauth2-proxy/oauth2-proxy/pull/2343) chore: Added checksums for .tar.gz (@kvanzuijlen)
628+- [#2248](https://github.com/oauth2-proxy/oauth2-proxy/pull/2248) Added support for semicolons in query strings. (@timwsuqld)
629+- [#2196](https://github.com/oauth2-proxy/oauth2-proxy/pull/2196) Add GitHub groups (orgs/teams) support. Including `X-Forwarded-Groups` header (@tuunit)
630+- [#2371](https://github.com/oauth2-proxy/oauth2-proxy/pull/2371) Remove nsswitch DNS resolution workaround (@tuunit)
631+- [#2295](https://github.com/oauth2-proxy/oauth2-proxy/pull/2295) Change base-image to [GoogleContainerTools/distroless](https://github.com/GoogleContainerTools/distroless) (@kvanzuijlen)
632+- [#2356](https://github.com/oauth2-proxy/oauth2-proxy/pull/2356) Update go-jose dependency (@dasvh)
633+- [#2357](https://github.com/oauth2-proxy/oauth2-proxy/pull/2357) Update ojg to latest release (@bitfehler)
634+- [#1922](https://github.com/oauth2-proxy/oauth2-proxy/pull/1922) Added support for env variables in the alpha struct (@hevans-dglcom)
635+- [#2235](https://github.com/oauth2-proxy/oauth2-proxy/pull/2235) Bump golang to 1.21 and min allowed version to 1.20 (@tuunit)
636+
637+# V7.5.1
638+
639+## Release Highlights
640+- 🐛 Several bugs have been squashed
641+- 🕵️‍♀️ Vulnerabilities have been addressed
642+- 📖Improved docs
643+
644+## Important Notes
645+
646+- This release includes fixes for a number of CVEs, we recommend to upgrade as soon as possible.
647+- The environment variable OAUTH2_PROXY_GOOGLE_GROUP has been deprecated in favor of OAUTH2_PROXY_GOOGLE_GROUPS. Next major release
648+will remove this option. This change makes sure that the configuration options follow the documentation.
649+
650+## Breaking Changes
651+
652+N/A
653+
654+## Changes since v7.5.0
655+- [#2220](https://github.com/oauth2-proxy/oauth2-proxy/pull/2220) Added binary and docker release platforms (@kvanzuijlen)
656+- [#2221](https://github.com/oauth2-proxy/oauth2-proxy/pull/2221) Backwards compatible fix for wrong environment variable name (OAUTH2_PROXY_GOOGLE_GROUPS) (@kvanzuijlen)
657+- [#1989](https://github.com/oauth2-proxy/oauth2-proxy/pull/1989) Fix default scope for keycloak-oidc provider (@tuunit)
658+- [#2217](https://github.com/oauth2-proxy/oauth2-proxy/pull/2217) Upgrade alpine to version 3.18 (@polarctos)
659+- [#2208](https://github.com/oauth2-proxy/oauth2-proxy/pull/2208) Improved session documentation (@lathspell)
660+- [#2229](https://github.com/oauth2-proxy/oauth2-proxy/pull/2229) bugfix: default scopes for OIDCProvider based providers (@tuunit)
661+- [#2194](https://github.com/oauth2-proxy/oauth2-proxy/pull/2194) Fix Gitea token validation (@tuunit)
662+
663+# V7.5.0
664+
665+## Release Highlights
666+- 🐛 Several bugs have been squashed
667+- 🕵️‍♀️ Vulnerabilities have been addressed
668+- ⭐️ Added a readiness endpoint to check if the application is ready to receive traffic
669+- ⭐️ Google Application Default Credentials support (i.e. for running on Google Cloud Platform)
670+- ⭐ Session cookie support
671+
672+## Important Notes
673+
674+- This release includes fixes for a number of CVEs, we recommend to upgrade as soon as possible.
675+- This release was pushed with the wrong Docker platform type for arm64/armv8. Use v7.5.1 instead.
676+- This release introduced a bug with the Keycloak OIDC provider causing no scopes to be send along with the request. Use v7.5.1 instead.
677+
678+## Breaking Changes
679+The following PR introduces a change to how auth routes are evaluated using the flags `skip-auth-route`/`skip-auth-regex`. The new behaviour uses the regex you specify to evaluate the full path including query parameters. For more details please read the detailed description [#2271](https://github.com/oauth2-proxy/oauth2-proxy/issues/2271)
680+- [#2192](https://github.com/oauth2-proxy/oauth2-proxy/pull/2192) Use X-Forwarded-Uri if it exists for pathRegex match (@mzndr / @jawys)
681+
682+## Changes since v7.4.0
683+- [#2028](https://github.com/oauth2-proxy/oauth2-proxy/pull/2028) Update golang.org/x/net to v0.7.0 ato address GHSA-vvpx-j8f3-3w6h (@amrmahdi)
684+- [#1873](https://github.com/oauth2-proxy/oauth2-proxy/pull/1873) Fix empty users with some OIDC providers (@babs)
685+- [#1882](https://github.com/oauth2-proxy/oauth2-proxy/pull/1882) Make `htpasswd.GetUsers` racecondition safe (@babs)
686+- [#1883](https://github.com/oauth2-proxy/oauth2-proxy/pull/1883) Ensure v8 manifest variant is set on docker images (@braunsonm)
687+- [#1906](https://github.com/oauth2-proxy/oauth2-proxy/pull/1906) Fix PKCE code verifier generation to never use UTF-8 characters (@braunsonm)
688+- [#1839](https://github.com/oauth2-proxy/oauth2-proxy/pull/1839) Add readiness checks for deeper health checks (@kobim)
689+- [#1927](https://github.com/oauth2-proxy/oauth2-proxy/pull/1927) Fix default scope settings for none oidc providers (@tuunit)
690+- [#1713](https://github.com/oauth2-proxy/oauth2-proxy/pull/1713) Add session cookie support (@t-katsumura @tanuki884)
691+- [#1951](https://github.com/oauth2-proxy/oauth2-proxy/pull/1951) Fix validate URL, check if query string marker (?) or separator (&) needs to be appended (@miguelborges99)
692+- [#1920](https://github.com/oauth2-proxy/oauth2-proxy/pull/1920) Make sure emailClaim is not overriden if userIDClaim is not set (@mdreem)
693+- [#2010](https://github.com/oauth2-proxy/oauth2-proxy/pull/2010) Log the difference between invalid email and not authorized session (@omBratteng)
694+- [#1988](https://github.com/oauth2-proxy/oauth2-proxy/pull/1988) Ensure sign-in page background is uniform throughout the page (@corybolar)
695+- [#2013](https://github.com/oauth2-proxy/oauth2-proxy/pull/2013) Upgrade alpine to version 3.17.2 and library dependencies (@miguelborges99)
696+- [#2047](https://github.com/oauth2-proxy/oauth2-proxy/pull/2047) CVE-2022-41717: DoS in Go net/http may lead to DoS (@miguelborges99)
697+- [#2126](https://github.com/oauth2-proxy/oauth2-proxy/pull/2126) Added support for GKE Workload Identity (@kvanzuijlen)
698+- [#1921](https://github.com/oauth2-proxy/oauth2-proxy/pull/1921) Check jsonpath syntax before interpretation (@eloo-abi)
699+- [#2025](https://github.com/oauth2-proxy/oauth2-proxy/pull/2025) Embed static stylesheets and dependencies (@corybolar)
700+
701+# V7.4.0
702+
703+## Release Highlights
704+
705+- New Azure groups support for Azure OAuth2 v2.0
706+- Option to configure API routes - paths that will not redirect to login when unauthenticated
707+- CSRF and session cookies now have different timeouts
708+
709+## Important Notes
710+
711+- [#1708](https://github.com/oauth2-proxy/oauth2-proxy/pull/1708) Enable different CSRF cookies per request (@miguelborges99)
712+ - Since the CSRF cookie name is now longer it could potentially break long cookie names (around 1000 characters).
713+ - Having a unique CSRF cookie per request can lead to quite a number of cookies, in case an application performs a high number of parallel authentication requests. Each call will redirect to /oauth2/start, if the user is not authenticated, and a new cookie will be set. The successfully authenticated requests will have its CSRF cookies immediatly expired, however the failed ones will mantain its CSRF cookies until they expire (by default in 15 minutes).
714+ - The user may redefine the CSRF cookie expiration time using flag "--cookie-csrf-expire" (e.g. --cookie-csrf-expire=5m). By default, it is 15 minutes, but you can fine tune to your environment.
715+- [#1574](https://github.com/oauth2-proxy/oauth2-proxy/pull/1574) Add Azure groups support and Azure OAuth v2.0 (@adriananeci)
716+ - group membership check is now validated while using the the azure provider.
717+ - Azure OAuth v2.0 (https://login.microsoftonline.com/{tenant_id}/v2.0) is now available along with Azure OAuth v1.0. See https://github.com/oauth2-proxy/oauth2-proxy/blob/master/docs/docs/configuration/auth.md#azure-auth-provider for more details
718+ - When using v2.0 Azure Auth endpoint (`https://login.microsoftonline.com/{tenant-id}/v2.0`) as `--oidc_issuer_url`, in conjunction with `--resource` flag, be sure to append `/.default` at the end of the resource name. See https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#the-default-scope for more details.
719+- This release includes fixes for a number of CVEs, we recommend to upgrade as soon as possible.
720+
721+## Breaking Changes
722+
723+N/A
724+
725+## Changes since v7.3.0
726+
727+- [#1862](https://github.com/oauth2-proxy/oauth2-proxy/pull/1862) Update dependencies (@JoelSpeed)
728+- [#1828](https://github.com/oauth2-proxy/oauth2-proxy/pull/1828) call providerData.setProviderDefaults for oidc provider to achieve consistent behaviour (@centzilius)
729+ - UserClaim will be set to sub instead of beeing empty from now on.
730+- [#1691](https://github.com/oauth2-proxy/oauth2-proxy/pull/1691) Fix Redis IdleTimeout when Redis timeout option is set to non-zero (@dimss)
731+- [#1669](https://github.com/oauth2-proxy/oauth2-proxy/pull/1699) Fix method deprecated error in lint (@t-katsumura)
732+- [#1701](https://github.com/oauth2-proxy/oauth2-proxy/pull/1701) Watch the htpasswd file for changes and update the htpasswdMap (@aiciobanu)
733+- [#1709](https://github.com/oauth2-proxy/oauth2-proxy/pull/1709) Show an alert message when basic auth credentials are invalid (@aiciobanu)
734+- [#1723](https://github.com/oauth2-proxy/oauth2-proxy/pull/1723) Added ability to specify allowed TLS cipher suites. (@crbednarz)
735+- [#1720](https://github.com/oauth2-proxy/oauth2-proxy/pull/1720) Extract roles from authToken, to allow using allowed roles with Keycloak. (@MrDeerly )
736+- [#1774](https://github.com/oauth2-proxy/oauth2-proxy/pull/1774) Fix vulnerabilities CVE-2022-27191, CVE-2021-44716 and CVE-2022-29526. (@felipeconti)
737+- [#1667](https://github.com/oauth2-proxy/oauth2-proxy/issues/1667) Rename configuration file flag for PKCE (@ChrisEke)
738+to remain consistent with CLI flags. You should specify `code_challenge_method` in your configuration instead of
739+`force_code_challenge_method`.
740+- [#1708](https://github.com/oauth2-proxy/oauth2-proxy/pull/1708) Enable different CSRF cookies per request (@miguelborges99)
741+ - Add flag "--cookie-csrf-per-request" which activates an algorithm to name CSRF cookies differently per request.
742+ This feature allows parallel callbacks and by default it is disabled.
743+ - Add flag "--cookie-csrf-expire" to define a different expiration time for the CSRF cookie. By default, it is 15 minutes.
744+- [#1762](https://github.com/oauth2-proxy/oauth2-proxy/pull/1762) Support negating for skip auth routes (@ianldge)
745+- [#1788](https://github.com/oauth2-proxy/oauth2-proxy/pull/1788) Update base docker image to alpine 3.16 (@tooptoop4)
746+- [#1760](https://github.com/oauth2-proxy/oauth2-proxy/pull/1760) Option to configure API routes (@segfault16)
747+- [#1825](https://github.com/oauth2-proxy/oauth2-proxy/pull/1825) Fix vulnerabilities CVE-2022-32149 and CVE-2022-27664. (@crbednarz)
748+- [#1750](https://github.com/oauth2-proxy/oauth2-proxy/pull/1750) Fix Nextcloud provider (@n1tehawk)
749+- [#1574](https://github.com/oauth2-proxy/oauth2-proxy/pull/1574) Add Azure groups support and Azure OAuth v2.0 (@adriananeci)
750+- [#1851](https://github.com/oauth2-proxy/oauth2-proxy/pull/1851) Bump golang to 1.19 and min allowed version to 1.18 (@adriananeci)
751+- [#1815](https://github.com/oauth2-proxy/oauth2-proxy/pull/1815) Keycloak: save user and preferredUsername in session to populate headers for the backend (@babs)
752+- [#1847](https://github.com/oauth2-proxy/oauth2-proxy/pull/1847) Update go-redis/redis to v9 (@arhamGH)
753+-
754+# V7.3.0
755+
756+## Release Highlights
757+
758+- [#1361](https://github.com/oauth2-proxy/oauth2-proxy/pull/1541) PKCE Code Challenge Support - RFC-7636 (@braunsonm)
759+ - At this time the `--code-challenge-method` flag can be used to enable it with the method of your choice.
760+- Parital support for OAuth2 Authorization Server Metadata for detecting code challenge methods (@braunsonm)
761+ - A warning will be displayed when your provider advertises support for PKCE but you have not enabled it.
762+- Support for the ARMv8 and ppc64le architectures
763+- Configurable upstream request timeouts
764+
765+## Important Notes
766+
767+- [oauth2-proxy](https://quay.io/repository/oauth2-proxy/oauth2-proxy?tab=tags&tag=latest) separate image tags for each architecture is deprecated. Instead, images are cross compiled and pushed as the same tag for every platform.
768+If you are using an architecture specific tag (ex: v7.2.1-arm64) you should move to the generic tag instead (ex: v7.2.1 )
769+- [#1478](https://github.com/oauth2-proxy/oauth2-proxy/pull/1478) Changes the UID and GID of the runtime user to `65532`.
770+ Which also is known as `nonroot` user in [distroless images](https://github.com/GoogleContainerTools/distroless).
771+- This release includes fixes for a number of CVEs, we recomend to upgrade as soon as possible.
772+
773+## Breaking Changes
774+
775+- [#1666](https://github.com/oauth2-proxy/oauth2-proxy/issues/1666) Azure provider breaks after upgrading to this version. Please see the issue for more details.
776+
777+## Changes since v7.2.1
778+
779+- [#1662](https://github.com/oauth2-proxy/oauth2-proxy/pull/1662) Discover signature algorithms from OIDC provider (@JoelSpeed)
780+- [#1651](https://github.com/oauth2-proxy/oauth2-proxy/pull/1651) Updated go-lang's text, crypto and prometheus dependencies to fix reported security vulnerabilities. (@rkkris75)
781+- [#1595](https://github.com/oauth2-proxy/oauth2-proxy/pull/1595) Add optional `allowed_emails` query parameter to the `auth_request`. (@zv0n)
782+- [#1478](https://github.com/oauth2-proxy/oauth2-proxy/pull/1478) Parameterise the runtime image (@omBratteng)
783+- [#1583](https://github.com/oauth2-proxy/oauth2-proxy/pull/1583) Add groups to session too when creating session from bearer token (@adriananeci)
784+- [#1418](https://github.com/oauth2-proxy/oauth2-proxy/pull/1418) Support for passing arbitrary query parameters through from `/oauth2/start` to the identity provider's login URL. Configuration settings control which parameters are passed by default and precisely which values can be overridden per-request (@ianroberts)
785+- [#1559](https://github.com/oauth2-proxy/oauth2-proxy/pull/1559) Introduce ProviderVerifier to clean up OIDC discovery code (@JoelSpeed)
786+- [#1561](https://github.com/oauth2-proxy/oauth2-proxy/pull/1561) Add ppc64le support (@mgiessing)
787+- [#1563](https://github.com/oauth2-proxy/oauth2-proxy/pull/1563) Ensure claim extractor does not attempt profile call when URL is empty (@JoelSpeed)
788+- [#1560](https://github.com/oauth2-proxy/oauth2-proxy/pull/1560) Fix provider data initialisation (@JoelSpeed)
789+- [#1555](https://github.com/oauth2-proxy/oauth2-proxy/pull/1555) Refactor provider configuration into providers package (@JoelSpeed)
790+- [#1394](https://github.com/oauth2-proxy/oauth2-proxy/pull/1394) Add generic claim extractor to get claims from ID Tokens (@JoelSpeed)
791+- [#1468](https://github.com/oauth2-proxy/oauth2-proxy/pull/1468) Implement session locking with session state lock (@JoelSpeed, @Bibob7)
792+- [#1489](https://github.com/oauth2-proxy/oauth2-proxy/pull/1489) Fix Docker Buildx push to include build version (@JoelSpeed)
793+- [#1477](https://github.com/oauth2-proxy/oauth2-proxy/pull/1477) Remove provider documentation for `Microsoft Azure AD` (@omBratteng)
794+- [#1204](https://github.com/oauth2-proxy/oauth2-proxy/pull/1204) Added configuration for audience claim (`--oidc-extra-audience`) and ability to specify extra audiences (`--oidc-extra-audience`) allowed passing audience verification. This enables support for AWS Cognito and other issuers that have custom audience claims. Also, this adds the ability to allow multiple audiences. (@kschu91)
795+- [#1509](https://github.com/oauth2-proxy/oauth2-proxy/pull/1509) Update LoginGovProvider ValidateSession to pass access_token in Header (@pksheldon4)
796+- [#1474](https://github.com/oauth2-proxy/oauth2-proxy/pull/1474) Support configuration of minimal acceptable TLS version (@polarctos)
797+- [#1545](https://github.com/oauth2-proxy/oauth2-proxy/pull/1545) Fix issue with query string allowed group panic on skip methods (@andytson)
798+- [#1286](https://github.com/oauth2-proxy/oauth2-proxy/pull/1286) Add the `allowed_email_domains` and the `allowed_groups` on the `auth_request` + support standard wildcard char for validation with sub-domain and email-domain. (@w3st3ry @armandpicard)
799+- [#1361](https://github.com/oauth2-proxy/oauth2-proxy/pull/1541) PKCE Code Challenge Support - RFC-7636 (@braunsonm)
800+- [#1594](https://github.com/oauth2-proxy/oauth2-proxy/pull/1594) Release ARMv8 docker images (@braunsonm)
801+- [#1649](https://github.com/oauth2-proxy/oauth2-proxy/pull/1649) Return a 400 instead of a 500 when a request contains an invalid redirect target (@niksko)
802+- [#1638](https://github.com/oauth2-proxy/oauth2-proxy/pull/1638) Implement configurable upstream timeout (@jacksgt)
803+- [#1650](https://github.com/oauth2-proxy/oauth2-proxy/pull/1650) Fixed 500 when checking if user has repo (@adamsong)
804+- [#1635](https://github.com/oauth2-proxy/oauth2-proxy/pull/1635) Added description and unit tests for ipv6 address (@t-katsumura)
805+- [#1502](https://github.com/oauth2-proxy/oauth2-proxy/pull/1502) Unbreak oauth2-proxy for keycloak provider after 2c668a (@ckwalsh)
806+
807+# V7.2.1
808+
809+## Release Highlights
810+
811+This release contains a number of bug and security fixes, but has no feature additions.
812+
813+## Important Notes
814+
815+N/A
816+
817+## Breaking Changes
818+
819+N/A
820+
821+## Changes since v7.2.0
822+
823+- [#1247](https://github.com/oauth2-proxy/oauth2-proxy/pull/1247) Use `upn` claim consistently in ADFSProvider (@NickMeves)
824+- [#1447](https://github.com/oauth2-proxy/oauth2-proxy/pull/1447) Fix docker build/push issues found during last release (@JoelSpeed)
825+- [#1433](https://github.com/oauth2-proxy/oauth2-proxy/pull/1433) Let authentication fail when session validation fails (@stippi2)
826+- [#1445](https://github.com/oauth2-proxy/oauth2-proxy/pull/1445) Fix docker container multi arch build issue by passing GOARCH details to make build (@jkandasa)
827+- [#1444](https://github.com/oauth2-proxy/oauth2-proxy/pull/1444) Update LinkedIn provider validate URL (@jkandasa)
828+- [#1471](https://github.com/oauth2-proxy/oauth2-proxy/pull/1471) Update alpine to 3.15 (@AlexanderBabel)
829+- [#1479](https://github.com/oauth2-proxy/oauth2-proxy/pull/1479) Update to Go 1.17 (@polarctos)
830+
831+# V7.2.0
832+
833+## Release Highlights
834+
835+- LinkedIn provider updated to support the new v2 API
836+- Introduce `--force-json-errors` to allow OAuth2 Proxy to protect JSON APIs and disable authentication redirection
837+- Add URL rewrite capabilities to the upstream proxy
838+- New ADFS provider integration
839+- New Keycloak OIDC provider integration
840+- Introduced Multiarch Docker images on the standard image tags
841+
842+## Important Notes
843+
844+- [#1086](https://github.com/oauth2-proxy/oauth2-proxy/pull/1086) The extra validation to protect invalid session
845+ deserialization from v6.0.0 (only) has been removed to improve performance. If you are on v6.0.0, either upgrade
846+ to a version before this first and allow legacy sessions to expire gracefully or change your `cookie-secret`
847+ value and force all sessions to reauthenticate.
848+- [#1210](https://github.com/oauth2-proxy/oauth2-proxy/pull/1210) A new `keycloak-oidc` provider has been added with support for role based authentication. The existing keycloak auth provider will eventually be deprecated and removed. Please switch to the new provider `keycloak-oidc`.
849+
850+## Breaking Changes
851+
852+- [#1239](https://github.com/oauth2-proxy/oauth2-proxy/pull/1239) GitLab groups sent in the `X-Forwarded-Groups` header
853+ to the upstream server will no longer be prefixed with `group:`
854+
855+## Changes since v7.1.3
856+
857+- [#1391](https://github.com/oauth2-proxy/oauth2-proxy/pull/1391) Improve build times by sharing cache and allowing platform selection (@JoelSpeed)
858+- [#1404](https://github.com/oauth2-proxy/oauth2-proxy/pull/1404) Improve error message when no cookie is found (@JoelSpeed)
859+- [#1315](https://github.com/oauth2-proxy/oauth2-proxy/pull/1315) linkedin: Update provider to v2 (@wuurrd)
860+- [#1348](https://github.com/oauth2-proxy/oauth2-proxy/pull/1348) Using the native httputil proxy code for websockets rather than yhat/wsutil to properly handle HTTP-level failures (@thetrime)
861+- [#1379](https://github.com/oauth2-proxy/oauth2-proxy/pull/1379) Fix the manual sign in with --htpasswd-user-group switch (@janrotter)
862+- [#1375](https://github.com/oauth2-proxy/oauth2-proxy/pull/1375) Added `--force-json-errors` flag (@bancek)
863+- [#1337](https://github.com/oauth2-proxy/oauth2-proxy/pull/1337) Changing user field type to text when using htpasswd (@pburgisser)
864+- [#1239](https://github.com/oauth2-proxy/oauth2-proxy/pull/1239) Base GitLab provider implementation on OIDCProvider (@NickMeves)
865+- [#1276](https://github.com/oauth2-proxy/oauth2-proxy/pull/1276) Update crypto and switched to new github.com/golang-jwt/jwt (@JVecsei)
866+- [#1264](https://github.com/oauth2-proxy/oauth2-proxy/pull/1264) Update go-oidc to v3 (@NickMeves)
867+- [#1233](https://github.com/oauth2-proxy/oauth2-proxy/pull/1233) Extend email-domain validation with sub-domain capability (@morarucostel)
868+- [#1060](https://github.com/oauth2-proxy/oauth2-proxy/pull/1060) Implement RewriteTarget to allow requests to be rewritten before proxying to upstream servers (@JoelSpeed)
869+- [#1086](https://github.com/oauth2-proxy/oauth2-proxy/pull/1086) Refresh sessions before token expiration if configured (@NickMeves)
870+- [#1226](https://github.com/oauth2-proxy/oauth2-proxy/pull/1226) Move app redirection logic to its own package (@JoelSpeed)
871+- [#1128](https://github.com/oauth2-proxy/oauth2-proxy/pull/1128) Use gorilla mux for OAuth Proxy routing (@JoelSpeed)
872+- [#1238](https://github.com/oauth2-proxy/oauth2-proxy/pull/1238) Added ADFS provider (@samirachoadi)
873+- [#1227](https://github.com/oauth2-proxy/oauth2-proxy/pull/1227) Fix Refresh Session not working for multiple cookies (@rishi1111)
874+- [#1063](https://github.com/oauth2-proxy/oauth2-proxy/pull/1063) Add Redis lock feature to lock persistent sessions (@Bibob7)
875+- [#1108](https://github.com/oauth2-proxy/oauth2-proxy/pull/1108) Add alternative ways to generate cookie secrets to docs (@JoelSpeed)
876+- [#1142](https://github.com/oauth2-proxy/oauth2-proxy/pull/1142) Add pagewriter to upstream proxy (@JoelSpeed)
877+- [#1181](https://github.com/oauth2-proxy/oauth2-proxy/pull/1181) Fix incorrect `cfg` name in show-debug-on-error flag (@iTaybb)
878+- [#1207](https://github.com/oauth2-proxy/oauth2-proxy/pull/1207) Fix URI fragment handling on sign-in page, regression introduced in 7.1.0 (@tarvip)
879+- [#1210](https://github.com/oauth2-proxy/oauth2-proxy/pull/1210) New Keycloak OIDC Provider (@pb82)
880+- [#1244](https://github.com/oauth2-proxy/oauth2-proxy/pull/1244) Update Alpine image version to 3.14 (@ahovgaard)
881+- [#1317](https://github.com/oauth2-proxy/oauth2-proxy/pull/1317) Fix incorrect `</form>` tag on the sing_in page when *not* using a custom template (@jord1e)
882+- [#1330](https://github.com/oauth2-proxy/oauth2-proxy/pull/1330) Allow specifying URL as input for custom sign in logo (@MaikuMori)
883+- [#1357](https://github.com/oauth2-proxy/oauth2-proxy/pull/1357) Fix unsafe access to session variable (@harzallah)
884+- [#997](https://github.com/oauth2-proxy/oauth2-proxy/pull/997) Allow passing the raw url path when proxying upstream requests - e.g. /%2F/ (@FStelzer)
885+- [#1147](https://github.com/oauth2-proxy/oauth2-proxy/pull/1147) Multiarch support for docker image (@goshlanguage)
886+- [#1296](https://github.com/oauth2-proxy/oauth2-proxy/pull/1296) Fixed `panic` when connecting to Redis with TLS (@mstrzele)
887+- [#1403](https://github.com/oauth2-proxy/oauth2-proxy/pull/1403) Improve TLS handling for Redis to support non-standalone mode with TLS (@wadahiro)
888+
889+# V7.1.3
890+
891+## Release Highlights
892+
893+- Fixed typos in the metrics server TLS config names
894+
895+## Important Notes
896+
897+- [#967](https://github.com/oauth2-proxy/oauth2-proxy/pull/967) `--insecure-oidc-skip-nonce` is currently `true` by default in case
898+ any existing OIDC Identity Providers don't support it. The default will switch to `false` in a future version.
899+
900+## Breaking Changes
901+
902+## Changes since v7.1.2
903+
904+- [#1168](https://github.com/oauth2-proxy/oauth2-proxy/pull/1168) Fix incorrect `cfg` name in Metrics TLS flags (@NickMeves)
905+- [#967](https://github.com/oauth2-proxy/oauth2-proxy/pull/967) Set & verify a nonce with OIDC providers (@NickMeves)
906+- [#1136](https://github.com/oauth2-proxy/oauth2-proxy/pull/1136) Add clock package for better time mocking in tests (@NickMeves)
907+- [#947](https://github.com/oauth2-proxy/oauth2-proxy/pull/947) Multiple provider ingestion and validation in alpha options (first stage: [#926](https://github.com/oauth2-proxy/oauth2-proxy/issues/926)) (@yanasega)
908+
909+# V7.1.2
910+
911+## Release Highlights
912+
913+- Metrics bind address initialisation was broken in config files
914+
915+## Important Notes
916+
917+N/A
918+
919+## Breaking Changes
920+
921+N/A
922+
923+## Changes since v7.1.1
924+
925+- [#1129](https://github.com/oauth2-proxy/oauth2-proxy/pull/1129) Rewrite OpenRedirect tests in ginkgo (@JoelSpeed)
926+- [#1127](https://github.com/oauth2-proxy/oauth2-proxy/pull/1127) Remove unused fields from OAuthProxy (@JoelSpeed)
927+- [#1141](https://github.com/oauth2-proxy/oauth2-proxy/pull/1141) Fix metrics server bind address initialization (@oliver006)
928+
929+# V7.1.1
930+
931+## Release Highlights
932+
933+- The metrics server could not be started in v7.1.0, this is now fixed.
934+
935+## Important Notes
936+
937+N/A
938+
939+## Breaking Changes
940+
941+N/A
942+
943+## Changes since v7.1.0
944+
945+- [#1133](https://github.com/oauth2-proxy/oauth2-proxy/pull/1133) Metrics server should be constructed with secure bind address for TLS (@JoelSpeed)
946+
947+# V7.1.0
948+
949+## Release Highlights
950+
951+- New improved design for sign in and error pages based on bulma framework
952+- Refactored templates loading
953+ - `robots.txt`, `sign_in.html` and `error.html` can now be provided individually in `--custom-templates-dir`
954+ - If any of the above are not provided, defaults are used
955+ - Defaults templates be found in [pkg/app/pagewriter](https://github.com/oauth2-proxy/oauth2-proxy/tree/v7.1.0/pkg/app/pagewriter)
956+- Introduction of basic prometheus metrics
957+- Introduction of Traefik based local testing/example environment
958+- Support for request IDs to allow request co-ordination of log lines
959+
960+## Important Notes
961+
962+- [GHSA-652x-m2gr-hppm](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-652x-m2gr-hppm) GitLab group authorization stopped working in v7.0.0, the functionality has now been restored, please see the linked advisory for details
963+- [#1103](https://github.com/oauth2-proxy/oauth2-proxy/pull/1103) Upstream request signatures via `--signature-key` is
964+ deprecated. Support will be removed completely in v8.0.0.
965+- [1087](https://github.com/oauth2-proxy/oauth2-proxy/pull/1087) The default logging templates have been updated to include {{.RequestID}}
966+- [#1117](https://github.com/oauth2-proxy/oauth2-proxy/pull/1117) The `--gcp-healthchecks` option is now deprecated. It will be removed in a future release.
967+ - To migrate, you can change your application health checks for OAuth2 Proxy to point to
968+ the `--ping-path` value.
969+ - You can also migrate the user agent based health check using the `--ping-user-agent` option. Set it to `GoogleHC/1.0` to allow health checks on the path `/` from the Google health checker.
970+
971+## Breaking Changes
972+
973+N/A
974+
975+## Changes since v7.0.1
976+
977+- [GHSA-652x-m2gr-hppm](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-652x-m2gr-hppm) `--gitlab-group` GitLab Group Authorization config flag stopped working in v7.0.0 (@NickMeves, @papey)
978+- [#1113](https://github.com/oauth2-proxy/oauth2-proxy/pull/1113) Panic with GitLab project repository auth (@piersharding)
979+- [#1116](https://github.com/oauth2-proxy/oauth2-proxy/pull/1116) Reinstate preferEmailToUser behaviour for basic auth sessions (@JoelSpeed)
980+- [#1115](https://github.com/oauth2-proxy/oauth2-proxy/pull/1115) Fix upstream proxy appending ? to requests (@JoelSpeed)
981+- [#1117](https://github.com/oauth2-proxy/oauth2-proxy/pull/1117) Deprecate GCP HealthCheck option (@JoelSpeed)
982+- [#1104](https://github.com/oauth2-proxy/oauth2-proxy/pull/1104) Allow custom robots text pages (@JoelSpeed)
983+- [#1045](https://github.com/oauth2-proxy/oauth2-proxy/pull/1045) Ensure redirect URI always has a scheme (@JoelSpeed)
984+- [#1103](https://github.com/oauth2-proxy/oauth2-proxy/pull/1103) Deprecate upstream request signatures (@NickMeves)
985+- [#1087](https://github.com/oauth2-proxy/oauth2-proxy/pull/1087) Support Request ID in logging (@NickMeves)
986+- [#914](https://github.com/oauth2-proxy/oauth2-proxy/pull/914) Extract email from id_token for azure provider when oidc is configured (@weinong)
987+- [#1047](https://github.com/oauth2-proxy/oauth2-proxy/pull/1047) Refactor HTTP Server and add ServerGroup to handle graceful shutdown of multiple servers (@JoelSpeed)
988+- [#1070](https://github.com/oauth2-proxy/oauth2-proxy/pull/1070) Refactor logging middleware to middleware package (@NickMeves)
989+- [#1064](https://github.com/oauth2-proxy/oauth2-proxy/pull/1064) Add support for setting groups on session when using basic auth (@stefansedich)
990+- [#1056](https://github.com/oauth2-proxy/oauth2-proxy/pull/1056) Add option for custom logos on the sign in page (@JoelSpeed)
991+- [#1054](https://github.com/oauth2-proxy/oauth2-proxy/pull/1054) Update to Go 1.16 (@JoelSpeed)
992+- [#1052](https://github.com/oauth2-proxy/oauth2-proxy/pull/1052) Update golangci-lint to latest version (v1.36.0) (@JoelSpeed)
993+- [#1043](https://github.com/oauth2-proxy/oauth2-proxy/pull/1043) Refactor Sign In Page rendering and capture all page rendering code in pagewriter package (@JoelSpeed)
994+- [#1029](https://github.com/oauth2-proxy/oauth2-proxy/pull/1029) Refactor error page rendering and allow debug messages on error (@JoelSpeed)
995+- [#1028](https://github.com/oauth2-proxy/oauth2-proxy/pull/1028) Refactor templates, update theme and provide styled error pages (@JoelSpeed)
996+- [#1039](https://github.com/oauth2-proxy/oauth2-proxy/pull/1039) Ensure errors in tests are logged to the GinkgoWriter (@JoelSpeed)
997+- [#980](https://github.com/oauth2-proxy/oauth2-proxy/pull/980) Add Prometheus metrics endpoint (@neuralsandwich)
998+- [#1023](https://github.com/oauth2-proxy/oauth2-proxy/pull/1023) Update docs on Traefik ForwardAuth support without the use of Traefik 'errors' middleware (@pcneo83)
999+- [#1091](https://github.com/oauth2-proxy/oauth2-proxy/pull/1091) Add an example with Traefik (configuration without Traefik 'errors' middleware) (@fcollonval)
1000+
1001+# V7.0.1
1002+
1003+## Release Highlights
1004+
1005+- Fixed a bug that meant that flag ordering mattered
1006+- Fixed a bug where response headers for groups were not being flattened
1007+
1008+## Important Notes
1009+
1010+N/A
1011+
1012+## Breaking Changes
1013+
1014+N/A
1015+
1016+## Changes since v7.0.0
1017+
1018+- [#1020](https://github.com/oauth2-proxy/oauth2-proxy/pull/1020) Flatten array-based response headers (@NickMeves)
1019+- [#1026](https://github.com/oauth2-proxy/oauth2-proxy/pull/1026) Ensure config flags get parsed correctly when other flags precede them (@JoelSpeed)
1020+
1021+# V7.0.0
1022+
1023+## Release Highlights
1024+
1025+- Major internal improvements to provider interfaces
1026+- Added group authorization support
1027+- Improved support for external auth for Traefik
1028+- Introduced alpha configuration format to allow users to trial new configuration format and alpha features
1029+- GitLab provider now supports restricting to members of a project
1030+- Keycloak provider now supports restricting users to members of a set of groups
1031+- (Alpha) Flexible header configuration allowing user defined mapping of session claims to header values
1032+
1033+
1034+## Important Notes
1035+
1036+- [GHSA-4mf2-f3wh-gvf2](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-4mf2-f3wh-gvf2) The whitelist domain feature has been updated to fix a vulnerability that was identified, please see the linked advisory for details
1037+- [#964](https://github.com/oauth2-proxy/oauth2-proxy/pull/964) Redirect URL generation will attempt secondary strategies
1038+ in the priority chain if any fail the `IsValidRedirect` security check. Previously any failures fell back to `/`.
1039+- [#953](https://github.com/oauth2-proxy/oauth2-proxy/pull/953) Keycloak will now use `--profile-url` if set for the userinfo endpoint
1040+ instead of `--validate-url`. `--validate-url` will still work for backwards compatibility.
1041+- [#957](https://github.com/oauth2-proxy/oauth2-proxy/pull/957) To use X-Forwarded-{Proto,Host,Uri} on redirect detection, `--reverse-proxy` must be `true`.
1042+- [#936](https://github.com/oauth2-proxy/oauth2-proxy/pull/936) `--user-id-claim` option is deprecated and replaced by `--oidc-email-claim`
1043+- [#630](https://github.com/oauth2-proxy/oauth2-proxy/pull/630) Gitlab projects needs a Gitlab application with the extra `read_api` enabled
1044+- [#849](https://github.com/oauth2-proxy/oauth2-proxy/pull/849) `/oauth2/auth` `allowed_groups` querystring parameter can be paired with the `allowed-groups` configuration option.
1045+ - The `allowed_groups` querystring parameter can specify multiple comma delimited groups.
1046+ - In this scenario, the user must have a group (from their multiple groups) present in both lists to not get a 401 or 403 response code.
1047+ - Example:
1048+ - OAuth2-Proxy globally sets the `allowed_groups` as `engineering`.
1049+ - An application using Kubernetes ingress uses the `/oauth2/auth` endpoint with `allowed_groups` querystring set to `backend`.
1050+ - A user must have a session with the groups `["engineering", "backend"]` to pass authorization.
1051+ - Another user with the groups `["engineering", "frontend"]` would fail the querystring authorization portion.
1052+- [#905](https://github.com/oauth2-proxy/oauth2-proxy/pull/905) Existing sessions from v6.0.0 or earlier are no longer valid. They will trigger a reauthentication.
1053+- [#826](https://github.com/oauth2-proxy/oauth2-proxy/pull/826) `skip-auth-strip-headers` now applies to all requests, not just those where authentication would be skipped.
1054+- [#797](https://github.com/oauth2-proxy/oauth2-proxy/pull/797) The behavior of the Google provider Groups restriction changes with this
1055+ - Either `--google-group` or the new `--allowed-group` will work for Google now (`--google-group` will be used if both are set)
1056+ - Group membership lists will be passed to the backend with the `X-Forwarded-Groups` header
1057+ - If you change the list of allowed groups, existing sessions that now don't have a valid group will be logged out immediately.
1058+ - Previously, group membership was only checked on session creation and refresh.
1059+- [#789](https://github.com/oauth2-proxy/oauth2-proxy/pull/789) `--skip-auth-route` is (almost) backwards compatible with `--skip-auth-regex`
1060+ - We are marking `--skip-auth-regex` as DEPRECATED and will remove it in the next major version.
1061+ - If your regex contains an `=` and you want it for all methods, you will need to add a leading `=` (this is the area where `--skip-auth-regex` doesn't port perfectly)
1062+- [#575](https://github.com/oauth2-proxy/oauth2-proxy/pull/575) Sessions from v5.1.1 or earlier will no longer validate since they were not signed with SHA1.
1063+ - Sessions from v6.0.0 or later had a graceful conversion to SHA256 that resulted in no reauthentication
1064+ - Upgrading from v5.1.1 or earlier will result in a reauthentication
1065+- [#616](https://github.com/oauth2-proxy/oauth2-proxy/pull/616) Ensure you have configured oauth2-proxy to use the `groups` scope.
1066+ - The user may be logged out initially as they may not currently have the `groups` claim however after going back through login process wil be authenticated.
1067+- [#839](https://github.com/oauth2-proxy/oauth2-proxy/pull/839) Enables complex data structures for group claim entries, which are output as Json by default.
1068+
1069+## Breaking Changes
1070+
1071+- [#964](https://github.com/oauth2-proxy/oauth2-proxy/pull/964) `--reverse-proxy` must be true to trust `X-Forwarded-*` headers as canonical.
1072+ These are used throughout the application in redirect URLs, cookie domains and host logging logic. These are the headers:
1073+ - `X-Forwarded-Proto` instead of `req.URL.Scheme`
1074+ - `X-Forwarded-Host` instead of `req.Host`
1075+ - `X-Forwarded-Uri` instead of `req.URL.RequestURI()`
1076+- [#953](https://github.com/oauth2-proxy/oauth2-proxy/pull/953) In config files & envvar configs, `keycloak_group` is now the plural `keycloak_groups`.
1077+ Flag configs are still `--keycloak-group` but it can be passed multiple times.
1078+- [#911](https://github.com/oauth2-proxy/oauth2-proxy/pull/911) Specifying a non-existent provider will cause OAuth2-Proxy to fail on startup instead of defaulting to "google".
1079+- [#797](https://github.com/oauth2-proxy/oauth2-proxy/pull/797) Security changes to Google provider group authorization flow
1080+ - If you change the list of allowed groups, existing sessions that now don't have a valid group will be logged out immediately.
1081+ - Previously, group membership was only checked on session creation and refresh.
1082+- [#722](https://github.com/oauth2-proxy/oauth2-proxy/pull/722) When a Redis session store is configured, OAuth2-Proxy will fail to start up unless connection and health checks to Redis pass
1083+- [#800](https://github.com/oauth2-proxy/oauth2-proxy/pull/800) Fix import path for v7. The import path has changed to support the go get installation.
1084+ - You can now `go get github.com/oauth2-proxy/oauth2-proxy/v7` to get the latest `v7` version of OAuth2 Proxy
1085+ - Import paths for package are now under `v7`, eg `github.com/oauth2-proxy/oauth2-proxy/v7/pkg/<module>`
1086+- [#753](https://github.com/oauth2-proxy/oauth2-proxy/pull/753) A bug in the Azure provider prevented it from properly passing the configured protected `--resource`
1087+ via the login url. If this option was used in the past, behavior will change with this release as it will
1088+ affect the tokens returned by Azure. In the past, the tokens were always for `https://graph.microsoft.com` (the default)
1089+ and will now be for the configured resource (if it exists, otherwise it will run into errors)
1090+- [#754](https://github.com/oauth2-proxy/oauth2-proxy/pull/754) The Azure provider now has token refresh functionality implemented. This means that there won't
1091+ be any redirects in the browser anymore when tokens expire, but instead a token refresh is initiated
1092+ in the background, which leads to new tokens being returned in the cookies.
1093+ - Please note that `--cookie-refresh` must be 0 (the default) or equal to the token lifespan configured in Azure AD to make
1094+ Azure token refresh reliable. Setting this value to 0 means that it relies on the provider implementation
1095+ to decide if a refresh is required.
1096+
1097+## Changes since v6.1.1
1098+
1099+- [GHSA-4mf2-f3wh-gvf2](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-4mf2-f3wh-gvf2) Subdomain checking of whitelisted domains could allow unintended redirects (@NickMeves)
1100+- [#1002](https://github.com/oauth2-proxy/oauth2-proxy/pull/1002) Use logger for logging refreshed session in azure and gitlab provider (@Bibob7)
1101+- [#799](https://github.com/oauth2-proxy/oauth2-proxy/pull/799) Use comma separated multiple values for header (@lilida)
1102+- [#903](https://github.com/oauth2-proxy/oauth2-proxy/pull/903) Add docs and generated reference for Alpha configuration (@JoelSpeed)
1103+- [#995](https://github.com/oauth2-proxy/oauth2-proxy/pull/995) Add Security Policy (@JoelSpeed)
1104+- [#964](https://github.com/oauth2-proxy/oauth2-proxy/pull/964) Require `--reverse-proxy` true to trust `X-Forwareded-*` type headers (@NickMeves)
1105+- [#970](https://github.com/oauth2-proxy/oauth2-proxy/pull/970) Fix joined cookie name for those containing underline in the suffix (@peppered)
1106+- [#953](https://github.com/oauth2-proxy/oauth2-proxy/pull/953) Migrate Keycloak to EnrichSession & support multiple groups for authorization (@NickMeves)
1107+- [#957](https://github.com/oauth2-proxy/oauth2-proxy/pull/957) Use X-Forwarded-{Proto,Host,Uri} on redirect as last resort (@linuxgemini)
1108+- [#630](https://github.com/oauth2-proxy/oauth2-proxy/pull/630) Add support for Gitlab project based authentication (@factorysh)
1109+- [#907](https://github.com/oauth2-proxy/oauth2-proxy/pull/907) Introduce alpha configuration option to enable testing of structured configuration (@JoelSpeed)
1110+- [#938](https://github.com/oauth2-proxy/oauth2-proxy/pull/938) Cleanup missed provider renaming refactor methods (@NickMeves)
1111+- [#816](https://github.com/oauth2-proxy/oauth2-proxy/pull/816) (via [#936](https://github.com/oauth2-proxy/oauth2-proxy/pull/936)) Support non-list group claims (@loafoe)
1112+- [#936](https://github.com/oauth2-proxy/oauth2-proxy/pull/936) Refactor OIDC Provider and support groups from Profile URL (@NickMeves)
1113+- [#869](https://github.com/oauth2-proxy/oauth2-proxy/pull/869) Streamline provider interface method names and signatures (@NickMeves)
1114+- [#849](https://github.com/oauth2-proxy/oauth2-proxy/pull/849) Support group authorization on `oauth2/auth` endpoint via `allowed_groups` querystring (@NickMeves)
1115+- [#925](https://github.com/oauth2-proxy/oauth2-proxy/pull/925) Fix basic auth legacy header conversion (@JoelSpeed)
1116+- [#916](https://github.com/oauth2-proxy/oauth2-proxy/pull/916) Add AlphaOptions struct to prepare for alpha config loading (@JoelSpeed)
1117+- [#923](https://github.com/oauth2-proxy/oauth2-proxy/pull/923) Support TLS 1.3 (@aajisaka)
1118+- [#918](https://github.com/oauth2-proxy/oauth2-proxy/pull/918) Fix log header output (@JoelSpeed)
1119+- [#911](https://github.com/oauth2-proxy/oauth2-proxy/pull/911) Validate provider type on startup. (@arcivanov)
1120+- [#906](https://github.com/oauth2-proxy/oauth2-proxy/pull/906) Set up v6.1.x versioned documentation as default documentation (@JoelSpeed)
1121+- [#905](https://github.com/oauth2-proxy/oauth2-proxy/pull/905) Remove v5 legacy sessions support (@NickMeves)
1122+- [#904](https://github.com/oauth2-proxy/oauth2-proxy/pull/904) Set `skip-auth-strip-headers` to `true` by default (@NickMeves)
1123+- [#826](https://github.com/oauth2-proxy/oauth2-proxy/pull/826) Integrate new header injectors into project (@JoelSpeed)
1124+- [#797](https://github.com/oauth2-proxy/oauth2-proxy/pull/797) Create universal Authorization behavior across providers (@NickMeves)
1125+- [#898](https://github.com/oauth2-proxy/oauth2-proxy/pull/898) Migrate documentation to Docusaurus (@JoelSpeed)
1126+- [#754](https://github.com/oauth2-proxy/oauth2-proxy/pull/754) Azure token refresh (@codablock)
1127+- [#850](https://github.com/oauth2-proxy/oauth2-proxy/pull/850) Increase session fields in `/oauth2/userinfo` endpoint (@NickMeves)
1128+- [#825](https://github.com/oauth2-proxy/oauth2-proxy/pull/825) Fix code coverage reporting on GitHub actions(@JoelSpeed)
1129+- [#796](https://github.com/oauth2-proxy/oauth2-proxy/pull/796) Deprecate GetUserName & GetEmailAdress for EnrichSessionState (@NickMeves)
1130+- [#705](https://github.com/oauth2-proxy/oauth2-proxy/pull/705) Add generic Header injectors for upstream request and response headers (@JoelSpeed)
1131+- [#753](https://github.com/oauth2-proxy/oauth2-proxy/pull/753) Pass resource parameter in login url (@codablock)
1132+- [#789](https://github.com/oauth2-proxy/oauth2-proxy/pull/789) Add `--skip-auth-route` configuration option for `METHOD=pathRegex` based allowlists (@NickMeves)
1133+- [#575](https://github.com/oauth2-proxy/oauth2-proxy/pull/575) Stop accepting legacy SHA1 signed cookies (@NickMeves)
1134+- [#722](https://github.com/oauth2-proxy/oauth2-proxy/pull/722) Validate Redis configuration options at startup (@NickMeves)
1135+- [#791](https://github.com/oauth2-proxy/oauth2-proxy/pull/791) Remove GetPreferredUsername method from provider interface (@NickMeves)
1136+- [#764](https://github.com/oauth2-proxy/oauth2-proxy/pull/764) Document bcrypt encryption for htpasswd (and hide SHA) (@lentzi90)
1137+- [#778](https://github.com/oauth2-proxy/oauth2-proxy/pull/778) Use display-htpasswd-form flag
1138+- [#616](https://github.com/oauth2-proxy/oauth2-proxy/pull/616) Add support to ensure user belongs in required groups when using the OIDC provider (@stefansedich)
1139+- [#800](https://github.com/oauth2-proxy/oauth2-proxy/pull/800) Fix import path for v7 (@johejo)
1140+- [#783](https://github.com/oauth2-proxy/oauth2-proxy/pull/783) Update Go to 1.15 (@johejo)
1141+- [#813](https://github.com/oauth2-proxy/oauth2-proxy/pull/813) Fix build (@thiagocaiubi)
1142+- [#801](https://github.com/oauth2-proxy/oauth2-proxy/pull/801) Update go-redis/redis to v8 (@johejo)
1143+- [#750](https://github.com/oauth2-proxy/oauth2-proxy/pull/750) ci: Migrate to Github Actions (@shinebayar-g)
1144+- [#829](https://github.com/oauth2-proxy/oauth2-proxy/pull/820) Rename test directory to testdata (@johejo)
1145+- [#819](https://github.com/oauth2-proxy/oauth2-proxy/pull/819) Improve CI (@johejo)
1146+- [#989](https://github.com/oauth2-proxy/oauth2-proxy/pull/989) Adapt isAjax to support mimetype lists (@rassie)
1147+- [#1013](https://github.com/oauth2-proxy/oauth2-proxy/pull/1013) Update alpine version to 3.13 (@nishanth-pinnapareddy)
1148+
1149+# v6.1.1
1150+
1151+## Release Highlights
1152+
1153+- Fixed a bug which prevented static upstreams from being used
1154+- Fixed a bug which prevented file based upstreams from being used
1155+- Ensure that X-Forwarded-Host is respected consistently
1156+
1157+## Important Notes
1158+
1159+N/A
1160+
1161+## Breaking
1162+
1163+N/A
1164+
1165+## Changes since v6.1.0
1166+
1167+- [#729](https://github.com/oauth2-proxy/oauth2-proxy/pull/729) Use X-Forwarded-Host consistently when set (@NickMeves)
1168+- [#746](https://github.com/oauth2-proxy/oauth2-proxy/pull/746) Fix conversion of static responses in upstreams (@JoelSpeed)
1169+
1170+# v6.1.0
1171+
1172+## Release Highlights
1173+
1174+- Redis session stores now support authenticated connections
1175+- Error logging can now be separated from info logging by directing error logs to stderr
1176+- Added --session-cookie-minimal flag which helps prevent large session cookies
1177+- Improvements to force-https behaviour
1178+- Allow requests to skip authentication based on their source IP
1179+
1180+## Important Notes
1181+
1182+- [#632](https://github.com/oauth2-proxy/oauth2-proxy/pull/632) There is backwards compatibility to sessions from v5
1183+ - Any unencrypted sessions from before v5 that only contained a Username & Email will trigger a reauthentication
1184+
1185+## Breaking Changes
1186+
1187+## Changes since v6.0.0
1188+
1189+- [#742](https://github.com/oauth2-proxy/oauth2-proxy/pull/742) Only log no cookie match if cookie domains specified (@JoelSpeed)
1190+- [#562](https://github.com/oauth2-proxy/oauth2-proxy/pull/562) Create generic Authorization Header constructor (@JoelSpeed)
1191+- [#715](https://github.com/oauth2-proxy/oauth2-proxy/pull/715) Ensure session times are not nil before printing them (@JoelSpeed)
1192+- [#714](https://github.com/oauth2-proxy/oauth2-proxy/pull/714) Support passwords with Redis session stores (@NickMeves)
1193+- [#719](https://github.com/oauth2-proxy/oauth2-proxy/pull/719) Add Gosec fixes to areas that are intermittently flagged on PRs (@NickMeves)
1194+- [#718](https://github.com/oauth2-proxy/oauth2-proxy/pull/718) Allow Logging to stdout with separate Error Log Channel
1195+- [#690](https://github.com/oauth2-proxy/oauth2-proxy/pull/690) Address GoSec security findings & remediate (@NickMeves)
1196+- [#689](https://github.com/oauth2-proxy/oauth2-proxy/pull/689) Fix finicky logging_handler_test from time drift (@NickMeves)
1197+- [#700](https://github.com/oauth2-proxy/oauth2-proxy/pull/700) Allow OIDC Bearer auth IDTokens to have empty email claim & profile URL (@NickMeves)
1198+- [#699](https://github.com/oauth2-proxy/oauth2-proxy/pull/699) Align persistence ginkgo tests with conventions (@NickMeves)
1199+- [#696](https://github.com/oauth2-proxy/oauth2-proxy/pull/696) Preserve query when building redirect
1200+- [#561](https://github.com/oauth2-proxy/oauth2-proxy/pull/561) Refactor provider URLs to package level vars (@JoelSpeed)
1201+- [#682](https://github.com/oauth2-proxy/oauth2-proxy/pull/682) Refactor persistent session store session ticket management (@NickMeves)
1202+- [#688](https://github.com/oauth2-proxy/oauth2-proxy/pull/688) Refactor session loading to make use of middleware pattern (@JoelSpeed)
1203+- [#593](https://github.com/oauth2-proxy/oauth2-proxy/pull/593) Integrate upstream package with OAuth2 Proxy (@JoelSpeed)
1204+- [#687](https://github.com/oauth2-proxy/oauth2-proxy/pull/687) Refactor HTPasswd Validator (@JoelSpeed)
1205+- [#624](https://github.com/oauth2-proxy/oauth2-proxy/pull/624) Allow stripping authentication headers from whitelisted requests with `--skip-auth-strip-headers` (@NickMeves)
1206+- [#673](https://github.com/oauth2-proxy/oauth2-proxy/pull/673) Add --session-cookie-minimal option to create session cookies with no tokens (@NickMeves)
1207+- [#632](https://github.com/oauth2-proxy/oauth2-proxy/pull/632) Reduce session size by encoding with MessagePack and using LZ4 compression (@NickMeves)
1208+- [#675](https://github.com/oauth2-proxy/oauth2-proxy/pull/675) Fix required ruby version and deprecated option for building docs (@mkontani)
1209+- [#669](https://github.com/oauth2-proxy/oauth2-proxy/pull/669) Reduce docker context to improve build times (@JoelSpeed)
1210+- [#668](https://github.com/oauth2-proxy/oauth2-proxy/pull/668) Use req.Host in --force-https when req.URL.Host is empty (@zucaritask)
1211+- [#660](https://github.com/oauth2-proxy/oauth2-proxy/pull/660) Use builder pattern to simplify requests to external endpoints (@JoelSpeed)
1212+- [#591](https://github.com/oauth2-proxy/oauth2-proxy/pull/591) Introduce upstream package with new reverse proxy implementation (@JoelSpeed)
1213+- [#576](https://github.com/oauth2-proxy/oauth2-proxy/pull/576) Separate Cookie validation out of main options validation (@JoelSpeed)
1214+- [#656](https://github.com/oauth2-proxy/oauth2-proxy/pull/656) Split long session cookies more precisely (@NickMeves)
1215+- [#619](https://github.com/oauth2-proxy/oauth2-proxy/pull/619) Improve Redirect to HTTPs behaviour (@JoelSpeed)
1216+- [#654](https://github.com/oauth2-proxy/oauth2-proxy/pull/654) Close client connections after each redis test (@JoelSpeed)
1217+- [#542](https://github.com/oauth2-proxy/oauth2-proxy/pull/542) Move SessionStore tests to independent package (@JoelSpeed)
1218+- [#577](https://github.com/oauth2-proxy/oauth2-proxy/pull/577) Move Cipher and Session Store initialisation out of Validation (@JoelSpeed)
1219+- [#635](https://github.com/oauth2-proxy/oauth2-proxy/pull/635) Support specifying alternative provider TLS trust source(s) (@k-wall)
1220+- [#649](https://github.com/oauth2-proxy/oauth2-proxy/pull/650) Resolve an issue where an empty healthcheck URL and ping-user-agent returns the healthcheck response (@jordancrawfordnz)
1221+- [#662](https://github.com/oauth2-proxy/oauth2-proxy/pull/662) Do not add Cache-Control header to response from auth only endpoint (@johejo)
1222+- [#552](https://github.com/oauth2-proxy/oauth2-proxy/pull/522) Implements --trusted-ip option to allow clients behind specified IPs or CIDR ranges to bypass authentication (@Izzette)
1223+- [#733](https://github.com/oauth2-proxy/oauth2-proxy/pull/733) dist.sh: remove go version from asset links (@syscll)
1224+
1225+# v6.0.0
1226+
1227+## Release Highlights
1228+
1229+- Migrated to an independent GitHub organisation
1230+- Added local test environment examples using docker-compose and kind
1231+- Error pages will now be rendered when upstream connections fail
1232+- Non-Existent options in config files will now return errors on startup
1233+- Sessions are now always encrypted, independent of configuration
1234+
1235+## Important Notes
1236+
1237+- (Security) Fix for [open redirect vulnerability](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5m6c-jp6f-2vcv).
1238+ - More invalid redirects that lead to open-redirects were reported
1239+ - An extensive test suite has been added to prevent future regressions
1240+- [#453](https://github.com/oauth2-proxy/oauth2-proxy/pull/453) Responses to endpoints with a proxy prefix will now return headers for preventing browser caching.
1241+
1242+## Breaking Changes
1243+
1244+- [#464](https://github.com/oauth2-proxy/oauth2-proxy/pull/464) Migration from Pusher to independent org may have introduced breaking changes for your environment.
1245+ - See the changes listed below for PR [#464](https://github.com/oauth2-proxy/oauth2-proxy/pull/464) for full details
1246+ - Binaries renamed from `oauth2_proxy` to `oauth2-proxy`
1247+- [#440](https://github.com/oauth2-proxy/oauth2-proxy/pull/440) Switch Azure AD Graph API to Microsoft Graph API
1248+ - The Azure AD Graph API has been [deprecated](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-graph-api) and is being replaced by the Microsoft Graph API.
1249+ If your application relies on the access token being passed to it to access the Azure AD Graph API, you should migrate your application to use the Microsoft Graph API.
1250+ Existing behaviour can be retained by setting `-resource=https://graph.windows.net`.
1251+- [#484](https://github.com/oauth2-proxy/oauth2-proxy/pull/484) Configuration loading has been replaced with Viper and PFlag
1252+ - Flags now require a `--` prefix before the option
1253+ - Previously flags allowed either `-` or `--` to prefix the option name
1254+ - Eg `-provider` must now be `--provider`
1255+- [#487](https://github.com/oauth2-proxy/oauth2-proxy/pull/487) Switch flags to StringSlice instead of StringArray
1256+ - Options that take multiple arguments now split strings on commas if present
1257+ - Eg `--foo=a,b,c,d` would result in the values `a`, `b`, `c` and `d` instead of a single `a,b,c,d` value as before
1258+- [#535](https://github.com/oauth2-proxy/oauth2-proxy/pull/535) Drop support for pre v3.1 cookies
1259+ - The encoding for session cookies was changed starting in v3.1.0, support for the previous encoding is now dropped
1260+ - If you are upgrading from a version earlier than this, please upgrade via a version between v3.1.0 and v5.1.1
1261+- [#537](https://github.com/oauth2-proxy/oauth2-proxy/pull/537) Drop Fallback to Email if User not set
1262+ - Previously, when a session was loaded, if the User was not set, it would be replaced by the Email.
1263+ This behaviour was inconsistent as it required the session to be stored and then loaded to function properly.
1264+ - This behaviour has now been removed and the User field will remain empty if it was not set when the session was saved.
1265+ - In some scenarios `X-Forwarded-User` will now be empty. Use `X-Forwarded-Email` instead.
1266+ - In some scenarios, this may break setting Basic Auth on upstream or responses.
1267+ Use `--prefer-email-to-user` to restore falling back to the Email in these cases.
1268+- [#556](https://github.com/oauth2-proxy/oauth2-proxy/pull/556) Remove unintentional auto-padding of secrets that were too short
1269+ - Previously, after cookie-secrets were opportunistically base64 decoded to raw bytes,
1270+ they were padded to have a length divisible by 4.
1271+ - This led to wrong sized secrets being valid AES lengths of 16, 24, or 32 bytes. Or it led to confusing errors
1272+ reporting an invalid length of 20 or 28 when the user input cookie-secret was not that length.
1273+ - Now we will only base64 decode a cookie-secret to raw bytes if it is 16, 24, or 32 bytes long. Otherwise, we will convert
1274+ the direct cookie-secret to bytes without silent padding added.
1275+- [#412](https://github.com/oauth2-proxy/oauth2-proxy/pull/412)/[#559](https://github.com/oauth2-proxy/oauth2-proxy/pull/559) Allow multiple cookie domains to be specified
1276+ - Multiple cookie domains may now be configured. The longest domain that matches will be used.
1277+ - The config options `cookie_domain` is now `cookie_domains`
1278+ - The environment variable `OAUTH2_PROXY_COOKIE_DOMAIN` is now `OAUTH2_PROXY_COOKIE_DOMAINS`
1279+- [#414](https://github.com/oauth2-proxy/oauth2-proxy/pull/414) Always encrypt sessions regardless of config
1280+ - Previously, sessions were encrypted only when certain options were configured.
1281+ This lead to confusion and misconfiguration as it was not obvious when a session should be encrypted.
1282+ - Cookie Secrets must now be 16, 24 or 32 bytes.
1283+ - If you need to change your secret, this will force users to reauthenticate.
1284+- [#548](https://github.com/oauth2-proxy/oauth2-proxy/pull/548) Separate logging options out of main options structure
1285+ - Fixes an inconsistency in the `--exclude-logging-paths` option by renaming it to `--exclude-logging-option`.
1286+ - This flag may now be given multiple times as with other list options
1287+ - This flag also accepts comma separated values
1288+- [#639](https://github.com/oauth2-proxy/oauth2-proxy/pull/639) Change how gitlab-group is parsed on options
1289+ - Previously, the flag gitlab-group used comma seperated values, while the config option used space seperated values.
1290+ - This fixes the config value to use slices internally.
1291+ - The config option `gitlab_group` is now `gitlab_groups`
1292+ - The environment variable `OAUTH2_PROXY_GITLAB_GROUP` is now `OAUTH2_PROXY_GITLAB_GROUPS`
1293+
1294+## Changes since v5.1.1
1295+
1296+- [GHSA-5m6c-jp6f-2vcv](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5m6c-jp6f-2vcv) New OpenRedirect cases have been found (@JoelSpeed)
1297+- [#639](https://github.com/oauth2-proxy/oauth2-proxy/pull/639) Change how gitlab-group is parsed on options (@linuxgemini)
1298+- [#615](https://github.com/oauth2-proxy/oauth2-proxy/pull/615) Kubernetes example based on Kind cluster and Nginx ingress (@EvgeniGordeev)
1299+- [#596](https://github.com/oauth2-proxy/oauth2-proxy/pull/596) Validate Bearer IDTokens in headers with correct provider/extra JWT Verifier (@NickMeves)
1300+- [#620](https://github.com/oauth2-proxy/oauth2-proxy/pull/620) Add HealthCheck middleware (@JoelSpeed)
1301+- [#597](https://github.com/oauth2-proxy/oauth2-proxy/pull/597) Don't log invalid redirect if redirect is empty (@JoelSpeed)
1302+- [#604](https://github.com/oauth2-proxy/oauth2-proxy/pull/604) Add Keycloak local testing environment (@EvgeniGordeev)
1303+- [#539](https://github.com/oauth2-proxy/oauth2-proxy/pull/539) Refactor encryption ciphers and add AES-GCM support (@NickMeves)
1304+- [#601](https://github.com/oauth2-proxy/oauth2-proxy/pull/601) Ensure decrypted user/email are valid UTF8 (@JoelSpeed)
1305+- [#560](https://github.com/oauth2-proxy/oauth2-proxy/pull/560) Fallback to UserInfo is User ID claim not present (@JoelSpeed)
1306+- [#598](https://github.com/oauth2-proxy/oauth2-proxy/pull/598) acr_values no longer sent to IdP when empty (@ScottGuymer)
1307+- [#548](https://github.com/oauth2-proxy/oauth2-proxy/pull/548) Separate logging options out of main options structure (@JoelSpeed)
1308+- [#567](https://github.com/oauth2-proxy/oauth2-proxy/pull/567) Allow health/ping request to be identified via User-Agent (@chkohner)
1309+- [#536](https://github.com/oauth2-proxy/oauth2-proxy/pull/536) Improvements to Session State code (@JoelSpeed)
1310+- [#573](https://github.com/oauth2-proxy/oauth2-proxy/pull/573) Properly parse redis urls for cluster and sentinel connections (@amnay-mo)
1311+- [#574](https://github.com/oauth2-proxy/oauth2-proxy/pull/574) render error page on 502 proxy status (@amnay-mo)
1312+- [#559](https://github.com/oauth2-proxy/oauth2-proxy/pull/559) Rename cookie-domain config to cookie-domains (@JoelSpeed)
1313+- [#569](https://github.com/oauth2-proxy/oauth2-proxy/pull/569) Updated autocompletion for `--` long options. (@Izzette)
1314+- [#489](https://github.com/oauth2-proxy/oauth2-proxy/pull/489) Move Options and Validation to separate packages (@JoelSpeed)
1315+- [#556](https://github.com/oauth2-proxy/oauth2-proxy/pull/556) Remove unintentional auto-padding of secrets that were too short (@NickMeves)
1316+- [#538](https://github.com/oauth2-proxy/oauth2-proxy/pull/538) Refactor sessions/utils.go functionality to other areas (@NickMeves)
1317+- [#503](https://github.com/oauth2-proxy/oauth2-proxy/pull/503) Implements --real-client-ip-header option to select the header from which to obtain a proxied client's IP (@Izzette)
1318+- [#529](https://github.com/oauth2-proxy/oauth2-proxy/pull/529) Add local test environments for testing changes and new features (@JoelSpeed)
1319+- [#537](https://github.com/oauth2-proxy/oauth2-proxy/pull/537) Drop Fallback to Email if User not set (@JoelSpeed)
1320+- [#535](https://github.com/oauth2-proxy/oauth2-proxy/pull/535) Drop support for pre v3.1 cookies (@JoelSpeed)
1321+- [#533](https://github.com/oauth2-proxy/oauth2-proxy/pull/487) Set up code coverage within Travis for Code Climate (@JoelSpeed)
1322+- [#514](https://github.com/oauth2-proxy/oauth2-proxy/pull/514) Add basic string functions to templates (@n-i-x)
1323+- [#524](https://github.com/oauth2-proxy/oauth2-proxy/pull/524) Sign cookies with SHA256 (@NickMeves)
1324+- [#515](https://github.com/oauth2-proxy/oauth2-proxy/pull/515) Drop configure script in favour of native Makefile env and checks (@JoelSpeed)
1325+- [#519](https://github.com/oauth2-proxy/oauth2-proxy/pull/519) Support context in providers (@johejo)
1326+- [#487](https://github.com/oauth2-proxy/oauth2-proxy/pull/487) Switch flags to PFlag to remove StringArray (@JoelSpeed)
1327+- [#484](https://github.com/oauth2-proxy/oauth2-proxy/pull/484) Replace configuration loading with Viper (@JoelSpeed)
1328+- [#499](https://github.com/oauth2-proxy/oauth2-proxy/pull/499) Add `-user-id-claim` to support generic claims in addition to email (@holyjak)
1329+- [#486](https://github.com/oauth2-proxy/oauth2-proxy/pull/486) Add new linters (@johejo)
1330+- [#440](https://github.com/oauth2-proxy/oauth2-proxy/pull/440) Switch Azure AD Graph API to Microsoft Graph API (@johejo)
1331+- [#453](https://github.com/oauth2-proxy/oauth2-proxy/pull/453) Prevent browser caching during auth flow (@johejo)
1332+- [#467](https://github.com/oauth2-proxy/oauth2-proxy/pull/467) Allow OIDC issuer verification to be skipped (@chkohner)
1333+- [#481](https://github.com/oauth2-proxy/oauth2-proxy/pull/481) Update Okta docs (@trevorbox)
1334+- [#474](https://github.com/oauth2-proxy/oauth2-proxy/pull/474) Always log hasMember request error object (@jbielick)
1335+- [#468](https://github.com/oauth2-proxy/oauth2-proxy/pull/468) Implement graceful shutdown and propagate request context (@johejo)
1336+- [#464](https://github.com/oauth2-proxy/oauth2-proxy/pull/464) Migrate to oauth2-proxy/oauth2-proxy (@JoelSpeed)
1337+ - Project renamed from `pusher/oauth2_proxy` to `oauth2-proxy`
1338+ - Move Go import path from `github.com/pusher/oauth2_proxy` to `github.com/oauth2-proxy/oauth2-proxy`
1339+ - Remove Pusher Cloud Team from CODEOWNERS
1340+ - Release images moved to `quay.io/oauth2-proxy/oauth2-proxy`
1341+ - Binaries renamed from `oauth2_proxy` to `oauth2-proxy`
1342+- [#432](https://github.com/oauth2-proxy/oauth2-proxy/pull/432) Update ruby dependencies for documentation (@theobarberbany)
1343+- [#471](https://github.com/oauth2-proxy/oauth2-proxy/pull/471) Add logging in case of invalid redirects (@gargath)
1344+- [#462](https://github.com/oauth2-proxy/oauth2-proxy/pull/462) Allow HTML in banner message (@eritikass)
1345+- [#412](https://github.com/oauth2-proxy/oauth2-proxy/pull/412) Allow multiple cookie domains to be specified (@edahlseng)
1346+- [#413](https://github.com/oauth2-proxy/oauth2-proxy/pull/413) Add -set-basic-auth param to set the Basic Authorization header for upstreams (@morarucostel)
1347+- [#483](https://github.com/oauth2-proxy/oauth2-proxy/pull/483) Warn users when session cookies are split (@JoelSpeed)
1348+- [#488](https://github.com/oauth2-proxy/oauth2-proxy/pull/488) Set-Basic-Auth should default to false (@JoelSpeed)
1349+- [#494](https://github.com/oauth2-proxy/oauth2-proxy/pull/494) Upstream websockets TLS certificate validation now depends on ssl-upstream-insecure-skip-verify (@yaroslavros)
1350+- [#497](https://github.com/oauth2-proxy/oauth2-proxy/pull/497) Restrict access using Github collaborators (@jsclayton)
1351+- [#414](https://github.com/oauth2-proxy/oauth2-proxy/pull/414) Always encrypt sessions regardless of config (@ti-mo)
1352+- [#421](https://github.com/oauth2-proxy/oauth2-proxy/pull/421) Allow logins by usernames even if they do not belong to the specified org and team or collaborators (@yyoshiki41)
1353+
1354+# v5.1.1
1355+
1356+## Release Highlights
1357+
1358+N/A
1359+
1360+## Important Notes
1361+
1362+- (Security) Fix for [open redirect vulnerability](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-j7px-6hwj-hpjg).
1363+ - A bad actor using encoded whitespace in redirect URIs can redirect a session to another domain
1364+
1365+## Breaking Changes
1366+
1367+N/A
1368+
1369+## Changes since v5.1.0
1370+
1371+- [GHSA-j7px-6hwj-hpjg](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-j7px-6hwj-hpjg) Fix Open Redirect Vulnerability with encoded Whitespace characters (@JoelSpeed)
1372+
1373+# v5.1.0
1374+
1375+## Release Highlights
1376+
1377+- Bump to Go 1.14
1378+- Reduced number of Google API requests for group validation
1379+- Support for Redis Cluster
1380+- Support for overriding hosts in hosts file
1381+
1382+## Important Notes
1383+
1384+- [#335] The session expiry for the OIDC provider is now taken from the Token Response (expires_in) rather than from the id_token (exp)
1385+
1386+## Breaking Changes
1387+
1388+N/A
1389+
1390+## Changes since v5.0.0
1391+
1392+- [#450](https://github.com/oauth2-proxy/oauth2-proxy/pull/450) Fix http.Cookie SameSite is not copied (@johejo)
1393+- [#445](https://github.com/oauth2-proxy/oauth2-proxy/pull/445) Expose `acr_values` to all providers (@holyjak)
1394+- [#419](https://github.com/oauth2-proxy/oauth2-proxy/pull/419) Support Go 1.14, upgrade dependencies, upgrade golangci-lint to 1.23.6 (@johejo)
1395+- [#444](https://github.com/oauth2-proxy/oauth2-proxy/pull/444) Support prompt in addition to approval-prompt (@holyjak)
1396+- [#435](https://github.com/oauth2-proxy/oauth2-proxy/pull/435) Fix issue with group validation calling google directory API on every HTTP request (@ericofusco)
1397+- [#400](https://github.com/oauth2-proxy/oauth2-proxy/pull/400) Add `nsswitch.conf` to Docker image to allow hosts file to work (@luketainton)
1398+- [#385](https://github.com/oauth2-proxy/oauth2-proxy/pull/385) Use the `Authorization` header instead of `access_token` for refreshing GitHub Provider sessions (@ibuclaw)
1399+- [#372](https://github.com/oauth2-proxy/oauth2-proxy/pull/372) Allow fallback to secondary verified email address in GitHub provider (@dmnemec)
1400+- [#335](https://github.com/oauth2-proxy/oauth2-proxy/pull/335) OIDC Provider support for empty id_tokens in the access token refresh response (@howzat)
1401+- [#363](https://github.com/oauth2-proxy/oauth2-proxy/pull/363) Extension of Redis Session Store to Support Redis Cluster (@yan-dblinf)
1402+- [#353](https://github.com/oauth2-proxy/oauth2-proxy/pull/353) Fix login page fragment handling after soft reload on Firefox (@ffdybuster)
1403+- [#355](https://github.com/oauth2-proxy/oauth2-proxy/pull/355) Add Client Secret File support for providers that rotate client secret via file system (@pasha-r)
1404+- [#401](https://github.com/oauth2-proxy/oauth2-proxy/pull/401) Give the option to pass email address in the Basic auth header instead of upstream usernames. (@Spindel)
1405+- [#405](https://github.com/oauth2-proxy/oauth2-proxy/pull/405) The `/sign_in` page now honors the `rd` query parameter, fixing the redirect after a successful authentication (@ti-mo)
1406+- [#434](https://github.com/oauth2-proxy/oauth2-proxy/pull/434) Give the option to prefer email address in the username header when using the -pass-user-headers option (@jordancrawfordnz)
1407+
1408+# v5.0.0
1409+
1410+## Release Highlights
1411+
1412+- Disabled CGO (binaries will work regardless og glibc/musl)
1413+- Allow whitelisted redirect ports
1414+- Nextcloud provider support added
1415+- DigitalOcean provider support added
1416+
1417+## Important Notes
1418+
1419+- (Security) Fix for [open redirect vulnerability](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-qqxw-m5fj-f7gv).. a bad actor using `/\` in redirect URIs can redirect a session to another domain
1420+
1421+## Breaking Changes
1422+
1423+- [#321](https://github.com/oauth2-proxy/oauth2-proxy/pull/331) Add reverse proxy boolean flag to control whether headers like `X-Real-Ip` are accepted.
1424+ This defaults to false. **Usage behind a reverse proxy will require this flag to be set to avoid logging the reverse proxy IP address**.
1425+
1426+## Changes since v4.1.0
1427+
1428+- [#331](https://github.com/oauth2-proxy/oauth2-proxy/pull/331) Add reverse proxy setting (@martin-css)
1429+- [#365](https://github.com/oauth2-proxy/oauth2-proxy/pull/365) Build with CGO=0 (@tomelliff)
1430+- [#339](https://github.com/oauth2-proxy/oauth2-proxy/pull/339) Add configuration for cookie 'SameSite' value. (@pgroudas)
1431+- [#347](https://github.com/oauth2-proxy/oauth2-proxy/pull/347) Update keycloak provider configuration documentation. (@sushiMix)
1432+- [#325](https://github.com/oauth2-proxy/oauth2-proxy/pull/325) dist.sh: use sha256sum (@syscll)
1433+- [#179](https://github.com/oauth2-proxy/oauth2-proxy/pull/179) Add Nextcloud provider (@Ramblurr)
1434+- [#280](https://github.com/oauth2-proxy/oauth2-proxy/pull/280) whitelisted redirect domains: add support for whitelisting specific ports or allowing wildcard ports (@kamaln7)
1435+- [#351](https://github.com/oauth2-proxy/oauth2-proxy/pull/351) Add DigitalOcean Auth provider (@kamaln7)
1436+
1437+# v4.1.0
1438+
1439+## Release Highlights
1440+
1441+- Added Keycloak provider
1442+- Build on Go 1.13
1443+- Upgrade Docker image to use Debian Buster
1444+- Added support for FreeBSD builds
1445+- Added new logo
1446+- Added support for GitHub teams
1447+
1448+## Important Notes
1449+
1450+N/A
1451+
1452+## Breaking Changes
1453+
1454+N/A
1455+
1456+## Changes since v4.0.0
1457+
1458+- [#292](https://github.com/oauth2-proxy/oauth2-proxy/pull/292) Added bash >= 4.0 dependency to configure script (@jmfrank63)
1459+- [#227](https://github.com/oauth2-proxy/oauth2-proxy/pull/227) Add Keycloak provider (@Ofinka)
1460+- [#259](https://github.com/oauth2-proxy/oauth2-proxy/pull/259) Redirect to HTTPS (@jmickey)
1461+- [#273](https://github.com/oauth2-proxy/oauth2-proxy/pull/273) Support Go 1.13 (@dio)
1462+- [#275](https://github.com/oauth2-proxy/oauth2-proxy/pull/275) docker: build from debian buster (@syscll)
1463+- [#258](https://github.com/oauth2-proxy/oauth2-proxy/pull/258) Add IDToken for Azure provider (@leyshon)
1464+ - This PR adds the IDToken into the session for the Azure provider allowing requests to a backend to be identified as a specific user. As a consequence, if you are using a cookie to store the session the cookie will now exceed the 4kb size limit and be split into multiple cookies. This can cause problems when using nginx as a proxy, resulting in no cookie being passed at all. Either increase the proxy_buffer_size in nginx or implement the redis session storage (see https://oauth2-proxy.github.io/oauth2-proxy/configuration#redis-storage)
1465+- [#286](https://github.com/oauth2-proxy/oauth2-proxy/pull/286) Requests.go updated with useful error messages (@biotom)
1466+- [#274](https://github.com/oauth2-proxy/oauth2-proxy/pull/274) Supports many github teams with api pagination support (@toshi-miura, @apratina)
1467+- [#302](https://github.com/oauth2-proxy/oauth2-proxy/pull/302) Rewrite dist script (@syscll)
1468+- [#304](https://github.com/oauth2-proxy/oauth2-proxy/pull/304) Add new Logo! :tada: (@JoelSpeed)
1469+- [#300](https://github.com/oauth2-proxy/oauth2-proxy/pull/300) Added userinfo endpoint (@kbabuadze)
1470+- [#309](https://github.com/oauth2-proxy/oauth2-proxy/pull/309) Added support for custom CA when connecting to Redis cache (@lleszczu)
1471+- [#248](https://github.com/oauth2-proxy/oauth2-proxy/pull/248) Fix issue with X-Auth-Request-Redirect header being ignored (@webnard)
1472+- [#314](https://github.com/oauth2-proxy/oauth2-proxy/pull/314) Add redirect capability to sign_out (@costelmoraru)
1473+- [#265](https://github.com/oauth2-proxy/oauth2-proxy/pull/265) Add upstream with static response (@cgroschupp)
1474+- [#317](https://github.com/oauth2-proxy/oauth2-proxy/pull/317) Add build for FreeBSD (@fnkr)
1475+- [#296](https://github.com/oauth2-proxy/oauth2-proxy/pull/296) Allow to override provider's name for sign-in page (@ffdybuster)
1476+
1477+# v4.0.0
1478+
1479+## Release Highlights
1480+
1481+- Documentation is now on a [microsite](https://oauth2-proxy.github.io/oauth2-proxy/)
1482+- Health check logging can now be disabled for quieter logs
1483+- Authorization Header JWTs can now be verified by the proxy to skip authentication for machine users
1484+- Sessions can now be stored in Redis. This reduces refresh failures and uses smaller cookies (Recommended for those using OIDC refreshing)
1485+- Logging overhaul allows customisable logging formats
1486+
1487+## Important Notes
1488+
1489+- This release includes a number of breaking changes that will require users to
1490+ reconfigure their proxies. Please read the Breaking Changes below thoroughly.
1491+
1492+## Breaking Changes
1493+
1494+- [#231](https://github.com/oauth2-proxy/oauth2-proxy/pull/231) Rework GitLab provider
1495+ - This PR changes the configuration options for the GitLab provider to use
1496+ a self-hosted instance. You now need to specify a `-oidc-issuer-url` rather than
1497+ explicit `-login-url`, `-redeem-url` and `-validate-url` parameters.
1498+- [#186](https://github.com/oauth2-proxy/oauth2-proxy/pull/186) Make config consistent
1499+ - This PR changes configuration options so that all flags have a config counterpart
1500+ of the same name but with underscores (`_`) in place of hyphens (`-`).
1501+ This change affects the following flags:
1502+ - The `--tls-key` flag is now `--tls-key-file` to be consistent with existing
1503+ file flags and the existing config and environment settings
1504+ - The `--tls-cert` flag is now `--tls-cert-file` to be consistent with existing
1505+ file flags and the existing config and environment settings
1506+ This change affects the following existing configuration options:
1507+ - The `proxy-prefix` option is now `proxy_prefix`.
1508+ This PR changes environment variables so that all flags have an environment
1509+ counterpart of the same name but capitalised, with underscores (`_`) in place
1510+ of hyphens (`-`) and with the prefix `OAUTH2_PROXY_`.
1511+ This change affects the following existing environment variables:
1512+ - The `OAUTH2_SKIP_OIDC_DISCOVERY` environment variable is now `OAUTH2_PROXY_SKIP_OIDC_DISCOVERY`.
1513+ - The `OAUTH2_OIDC_JWKS_URL` environment variable is now `OAUTH2_PROXY_OIDC_JWKS_URL`.
1514+- [#146](https://github.com/oauth2-proxy/oauth2-proxy/pull/146) Use full email address as `User` if the auth response did not contain a `User` field
1515+ - This change modifies the contents of the `X-Forwarded-User` header supplied by the proxy for users where the auth response from the IdP did not contain
1516+ a username.
1517+ In that case, this header used to only contain the local part of the user's email address (e.g. `john.doe` for `john.doe@example.com`) but now contains
1518+ the user's full email address instead.
1519+- [#170](https://github.com/oauth2-proxy/oauth2-proxy/pull/170) Pre-built binary tarballs changed format
1520+ - The pre-built binary tarballs again match the format of the [bitly](https://github.com/bitly/oauth2_proxy) repository, where the unpacked directory
1521+ has the same name as the tarball and the binary is always named `oauth2_proxy`. This was done to restore compatibility with third-party automation
1522+ recipes like https://github.com/jhoblitt/puppet-oauth2_proxy.
1523+
1524+## Changes since v3.2.0
1525+
1526+- [#234](https://github.com/oauth2-proxy/oauth2-proxy/pull/234) Added option `-ssl-upstream-insecure-skip-validation` to skip validation of upstream SSL certificates (@jansinger)
1527+- [#224](https://github.com/oauth2-proxy/oauth2-proxy/pull/224) Check Google group membership using hasMember to support nested groups and external users (@jpalpant)
1528+- [#231](https://github.com/oauth2-proxy/oauth2-proxy/pull/231) Add optional group membership and email domain checks to the GitLab provider (@Overv)
1529+- [#226](https://github.com/oauth2-proxy/oauth2-proxy/pull/226) Made setting of proxied headers deterministic based on configuration alone (@aeijdenberg)
1530+- [#178](https://github.com/oauth2-proxy/oauth2-proxy/pull/178) Add Silence Ping Logging and Exclude Logging Paths flags (@kskewes)
1531+- [#209](https://github.com/oauth2-proxy/oauth2-proxy/pull/209) Improve docker build caching of layers (@dekimsey)
1532+- [#186](https://github.com/oauth2-proxy/oauth2-proxy/pull/186) Make config consistent (@JoelSpeed)
1533+- [#187](https://github.com/oauth2-proxy/oauth2-proxy/pull/187) Move root packages to pkg folder (@JoelSpeed)
1534+- [#65](https://github.com/oauth2-proxy/oauth2-proxy/pull/65) Improvements to authenticate requests with a JWT bearer token in the `Authorization` header via
1535+ the `-skip-jwt-bearer-token` options. (@brianv0)
1536+ - Additional verifiers can be configured via the `-extra-jwt-issuers` flag if the JWT issuers is either an OpenID provider or has a JWKS URL
1537+ (e.g. `https://example.com/.well-known/jwks.json`).
1538+- [#180](https://github.com/oauth2-proxy/oauth2-proxy/pull/180) Minor refactor of core proxying path (@aeijdenberg).
1539+- [#175](https://github.com/oauth2-proxy/oauth2-proxy/pull/175) Bump go-oidc to v2.0.0 (@aeijdenberg).
1540+ - Includes fix for potential signature checking issue when OIDC discovery is skipped.
1541+- [#155](https://github.com/oauth2-proxy/oauth2-proxy/pull/155) Add RedisSessionStore implementation (@brianv0, @JoelSpeed)
1542+ - Implement flags to configure the redis session store
1543+ - `-session-store-type=redis` Sets the store type to redis
1544+ - `-redis-connection-url` Sets the Redis connection URL
1545+ - `-redis-use-sentinel=true` Enables Redis Sentinel support
1546+ - `-redis-sentinel-master-name` Sets the Sentinel master name, if sentinel is enabled
1547+ - `-redis-sentinel-connection-urls` Defines the Redis Sentinel Connection URLs, if sentinel is enabled
1548+ - Introduces the concept of a session ticket. Tickets are composed of the cookie name, a session ID, and a secret.
1549+ - Redis Sessions are stored encrypted with a per-session secret
1550+ - Added tests for server based session stores
1551+- [#168](https://github.com/oauth2-proxy/oauth2-proxy/pull/168) Drop Go 1.11 support in Travis (@JoelSpeed)
1552+- [#169](https://github.com/oauth2-proxy/oauth2-proxy/pull/169) Update Alpine to 3.9 (@kskewes)
1553+- [#148](https://github.com/oauth2-proxy/oauth2-proxy/pull/148) Implement SessionStore interface within proxy (@JoelSpeed)
1554+- [#147](https://github.com/oauth2-proxy/oauth2-proxy/pull/147) Add SessionStore interfaces and initial implementation (@JoelSpeed)
1555+ - Allows for multiple different session storage implementations including client and server side
1556+ - Adds tests suite for interface to ensure consistency across implementations
1557+ - Refactor some configuration options (around cookies) into packages
1558+- [#114](https://github.com/oauth2-proxy/oauth2-proxy/pull/114), [#154](https://github.com/oauth2-proxy/oauth2-proxy/pull/154) Documentation is now available live at our [docs website](https://oauth2-proxy.github.io/oauth2-proxy/) (@JoelSpeed, @icelynjennings)
1559+- [#146](https://github.com/oauth2-proxy/oauth2-proxy/pull/146) Use full email address as `User` if the auth response did not contain a `User` field (@gargath)
1560+- [#144](https://github.com/oauth2-proxy/oauth2-proxy/pull/144) Use GO 1.12 for ARM builds (@kskewes)
1561+- [#142](https://github.com/oauth2-proxy/oauth2-proxy/pull/142) ARM Docker USER fix (@kskewes)
1562+- [#52](https://github.com/oauth2-proxy/oauth2-proxy/pull/52) Logging Improvements (@MisterWil)
1563+ - Implement flags to configure file logging
1564+ - `-logging-filename` Defines the filename to log to
1565+ - `-logging-max-size` Defines the maximum
1566+ - `-logging-max-age` Defines the maximum age of backups to retain
1567+ - `-logging-max-backups` Defines the maximum number of rollover log files to retain
1568+ - `-logging-compress` Defines if rollover log files should be compressed
1569+ - `-logging-local-time` Defines if logging date and time should be local or UTC
1570+ - Implement two new flags to enable or disable specific logging types
1571+ - `-standard-logging` Enables or disables standard (not request or auth) logging
1572+ - `-auth-logging` Enables or disables auth logging
1573+ - Implement two new flags to customize the logging format
1574+ - `-standard-logging-format` Sets the format for standard logging
1575+ - `-auth-logging-format` Sets the format for auth logging
1576+- [#111](https://github.com/oauth2-proxy/oauth2-proxy/pull/111) Add option for telling where to find a login.gov JWT key file (@timothy-spencer)
1577+- [#170](https://github.com/oauth2-proxy/oauth2-proxy/pull/170) Restore binary tarball contents to be compatible with bitlys original tarballs (@zeha)
1578+- [#185](https://github.com/oauth2-proxy/oauth2-proxy/pull/185) Fix an unsupported protocol scheme error during token validation when using the Azure provider (@jonas)
1579+- [#141](https://github.com/oauth2-proxy/oauth2-proxy/pull/141) Check google group membership based on email address (@bchess)
1580+ - Google Group membership is additionally checked via email address, allowing users outside a GSuite domain to be authorized.
1581+- [#195](https://github.com/oauth2-proxy/oauth2-proxy/pull/195) Add `-banner` flag for overriding the banner line that is displayed (@steakunderscore)
1582+- [#198](https://github.com/oauth2-proxy/oauth2-proxy/pull/198) Switch from gometalinter to golangci-lint (@steakunderscore)
1583+- [#159](https://github.com/oauth2-proxy/oauth2-proxy/pull/159) Add option to skip the OIDC provider verified email check: `--insecure-oidc-allow-unverified-email` (@djfinlay)
1584+- [#210](https://github.com/oauth2-proxy/oauth2-proxy/pull/210) Update base image from Alpine 3.9 to 3.10 (@steakunderscore)
1585+- [#201](https://github.com/oauth2-proxy/oauth2-proxy/pull/201) Add Bitbucket as new OAuth2 provider, accepts email, team and repository permissions to determine authorization (@aledeganopix4d)
1586+ - Implement flags to enable Bitbucket authentication:
1587+ - `-bitbucket-repository` Restrict authorization to users that can access this repository
1588+ - `-bitbucket-team` Restrict authorization to users that are part of this Bitbucket team
1589+- [#211](https://github.com/oauth2-proxy/oauth2-proxy/pull/211) Switch from dep to go modules (@steakunderscore)
1590+- [#145](https://github.com/oauth2-proxy/oauth2-proxy/pull/145) Add support for OIDC UserInfo endpoint email verification (@rtluckie)
1591+
1592+# v3.2.0
1593+
1594+## Release highlights
1595+
1596+- Internal restructure of session state storage to use JSON rather than proprietary scheme
1597+- Added health check options for running on GCP behind a load balancer
1598+- Improved support for protecting websockets
1599+- Added provider for login.gov
1600+- Allow manual configuration of OIDC providers
1601+
1602+## Important notes
1603+
1604+- Dockerfile user is now non-root, this may break your existing deployment
1605+- In the OIDC provider, when no email is returned, the ID Token subject will be used
1606+ instead of returning an error
1607+- GitHub user emails must now be primary and verified before authenticating
1608+
1609+## Changes since v3.1.0
1610+
1611+- [#96](https://github.com/bitly/oauth2_proxy/pull/96) Check if email is verified on GitHub (@caarlos0)
1612+- [#110](https://github.com/oauth2-proxy/oauth2-proxy/pull/110) Added GCP healthcheck option (@timothy-spencer)
1613+- [#112](https://github.com/oauth2-proxy/oauth2-proxy/pull/112) Improve websocket support (@gyson)
1614+- [#63](https://github.com/oauth2-proxy/oauth2-proxy/pull/63) Use encoding/json for SessionState serialization (@yaegashi)
1615+ - Use JSON to encode session state to be stored in browser cookies
1616+ - Implement legacy decode function to support existing cookies generated by older versions
1617+ - Add detailed table driven tests in session_state_test.go
1618+- [#120](https://github.com/oauth2-proxy/oauth2-proxy/pull/120) Encrypting user/email from cookie (@costelmoraru)
1619+- [#55](https://github.com/oauth2-proxy/oauth2-proxy/pull/55) Added login.gov provider (@timothy-spencer)
1620+- [#55](https://github.com/oauth2-proxy/oauth2-proxy/pull/55) Added environment variables for all config options (@timothy-spencer)
1621+- [#70](https://github.com/oauth2-proxy/oauth2-proxy/pull/70) Fix handling of splitted cookies (@einfachchr)
1622+- [#92](https://github.com/oauth2-proxy/oauth2-proxy/pull/92) Merge websocket proxy feature from openshift/oauth-proxy (@butzist)
1623+- [#57](https://github.com/oauth2-proxy/oauth2-proxy/pull/57) Fall back to using OIDC Subject instead of Email (@aigarius)
1624+- [#85](https://github.com/oauth2-proxy/oauth2-proxy/pull/85) Use non-root user in docker images (@kskewes)
1625+- [#68](https://github.com/oauth2-proxy/oauth2-proxy/pull/68) forward X-Auth-Access-Token header (@davidholsgrove)
1626+- [#41](https://github.com/oauth2-proxy/oauth2-proxy/pull/41) Added option to manually specify OIDC endpoints instead of relying on discovery
1627+- [#83](https://github.com/oauth2-proxy/oauth2-proxy/pull/83) Add `id_token` refresh to Google provider (@leki75)
1628+- [#10](https://github.com/oauth2-proxy/oauth2-proxy/pull/10) fix redirect url param handling (@dt-rush)
1629+- [#122](https://github.com/oauth2-proxy/oauth2-proxy/pull/122) Expose -cookie-path as configuration parameter (@costelmoraru)
1630+- [#124](https://github.com/oauth2-proxy/oauth2-proxy/pull/124) Use Go 1.12 for testing and build environments (@syscll)
1631+
1632+# v3.1.0
1633+
1634+## Release highlights
1635+
1636+- Introduction of ARM releases and and general improvements to Docker builds
1637+- Improvements to OIDC provider allowing pass-through of ID Tokens
1638+- Multiple redirect domains can now be whitelisted
1639+- Streamed responses are now flushed periodically
1640+
1641+## Important notes
1642+
1643+- If you have been using [#bitly/621](https://github.com/bitly/oauth2_proxy/pull/621)
1644+ and have cookies larger than the 4kb limit,
1645+ the cookie splitting pattern has changed and now uses `_` in place of `-` when
1646+ indexing cookies.
1647+ This will force users to reauthenticate the first time they use `v3.1.0`.
1648+- Streamed responses will now be flushed every 1 second by default.
1649+ Previously streamed responses were flushed only when the buffer was full.
1650+ To retain the old behaviour set `--flush-interval=0`.
1651+ See [#23](https://github.com/oauth2-proxy/oauth2-proxy/pull/23) for further details.
1652+
1653+## Changes since v3.0.0
1654+
1655+- [#14](https://github.com/oauth2-proxy/oauth2-proxy/pull/14) OIDC ID Token, Authorization Headers, Refreshing and Verification (@joelspeed)
1656+ - Implement `pass-authorization-header` and `set-authorization-header` flags
1657+ - Implement token refreshing in OIDC provider
1658+ - Split cookies larger than 4k limit into multiple cookies
1659+ - Implement token validation in OIDC provider
1660+- [#15](https://github.com/oauth2-proxy/oauth2-proxy/pull/15) WhitelistDomains (@joelspeed)
1661+ - Add `--whitelist-domain` flag to allow redirection to approved domains after OAuth flow
1662+- [#21](https://github.com/oauth2-proxy/oauth2-proxy/pull/21) Docker Improvement (@yaegashi)
1663+ - Move Docker base image from debian to alpine
1664+ - Install ca-certificates in docker image
1665+- [#23](https://github.com/oauth2-proxy/oauth2-proxy/pull/23) Flushed streaming responses
1666+ - Long-running upstream responses will get flushed every <timeperiod> (1 second by default)
1667+- [#24](https://github.com/oauth2-proxy/oauth2-proxy/pull/24) Redirect fix (@agentgonzo)
1668+ - After a successful login, you will be redirected to your original URL rather than /
1669+- [#35](https://github.com/oauth2-proxy/oauth2-proxy/pull/35) arm and arm64 binary releases (@kskewes)
1670+ - Add armv6 and arm64 to Makefile `release` target
1671+- [#37](https://github.com/oauth2-proxy/oauth2-proxy/pull/37) cross build arm and arm64 docker images (@kskewes)
1672+
1673+# v3.0.0
1674+
1675+Adoption of OAuth2_Proxy by Pusher.
1676+Project was hard forked and tidied however no logical changes have occurred since
1677+v2.2 as released by Bitly.
1678+
1679+## Changes since v2.2:
1680+
1681+- [#7](https://github.com/oauth2-proxy/oauth2-proxy/pull/7) Migration to Pusher (@joelspeed)
1682+ - Move automated build to debian base image
1683+ - Add Makefile
1684+ - Update CI to run `make test`
1685+ - Update Dockerfile to use `make clean oauth2_proxy`
1686+ - Update `VERSION` parameter to be set by `ldflags` from Git Status
1687+ - Remove lint and test scripts
1688+ - Remove Go v1.8.x from Travis CI testing
1689+ - Add CODEOWNERS file
1690+ - Add CONTRIBUTING guide
1691+ - Add Issue and Pull Request templates
1692+ - Add Dockerfile
1693+ - Fix fsnotify import
1694+ - Update README to reflect new repository ownership
1695+ - Update CI scripts to separate linting and testing
1696+ - Now using `gometalinter` for linting
1697+ - Move Go import path from `github.com/bitly/oauth2_proxy` to `github.com/pusher/oauth2_proxy`
1698+ - Repository forked on 27/11/18
1699+ - README updated to include note that this repository is forked
1700+ - CHANGLOG created to track changes to repository from original fork
CODE_OF_CONDUCT.mdnew file+112
@@ -0,0 +1,112 @@
1+## CNCF Community Code of Conduct v1.3
2+
3+Other languages available:
4+- [Arabic/العربية](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/ar.md)
5+- [Bengali/বাংলা](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/bn.md)
6+- [Bulgarian/Български](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/bg.md)
7+- [Chinese/中文](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/zh.md)
8+- [Czech/Česky](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/cs.md)
9+- [Farsi/فارسی](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/fa.md)
10+- [French/Français](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/fr.md)
11+- [German/Deutsch](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/de.md)
12+- [Hebrew/עברית](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/he.md)
13+- [Hindi/हिन्दी](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/hi.md)
14+- [Hungarian/Magyar](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/hu.md)
15+- [Indonesian/Bahasa Indonesia](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/id.md)
16+- [Italian/Italiano](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/it.md)
17+- [Japanese/日本語](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/ja.md)
18+- [Korean/한국어](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/ko.md)
19+- [Polish/Polski](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/pl.md)
20+- [Portuguese/Português](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/pt.md)
21+- [Russian/Русский](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/ru.md)
22+- [Spanish/Español](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/es.md)
23+- [Turkish/Türkçe](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/tr.md)
24+- [Ukrainian/Українська](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/uk.md)
25+- [Vietnamese/Tiếng Việt](https://github.com/cncf/foundation/blob/main/code-of-conduct-languages/vi.md)
26+
27+### Community Code of Conduct
28+
29+As contributors, maintainers, and participants in the CNCF community, and in the interest of fostering
30+an open and welcoming community, we pledge to respect all people who participate or contribute
31+through reporting issues, posting feature requests, updating documentation,
32+submitting pull requests or patches, attending conferences or events, or engaging in other community or project activities.
33+
34+We are committed to making participation in the CNCF community a harassment-free experience for everyone, regardless of age, body size, caste, disability, ethnicity, level of experience, family status, gender, gender identity and expression, marital status, military or veteran status, nationality, personal appearance, race, religion, sexual orientation, socioeconomic status, tribe, or any other dimension of diversity.
35+
36+## Scope
37+
38+This code of conduct applies:
39+* within project and community spaces,
40+* in other spaces when an individual CNCF community participant's words or actions are directed at or are about a CNCF project, the CNCF community, or another CNCF community participant in the context of a CNCF activity.
41+
42+### CNCF Events
43+
44+CNCF events that are produced by the Linux Foundation with professional events staff are governed by the Linux Foundation [Events Code of Conduct](https://events.linuxfoundation.org/code-of-conduct/) available on the event page. This is designed to be used in conjunction with the CNCF Code of Conduct.
45+
46+## Our Standards
47+
48+The CNCF Community is open, inclusive and respectful. Every member of our community has the right to have their identity respected.
49+
50+Examples of behavior that contributes to a positive environment include but are not limited to:
51+
52+* Demonstrating empathy and kindness toward other people
53+* Being respectful of differing opinions, viewpoints, and experiences
54+* Giving and gracefully accepting constructive feedback
55+* Accepting responsibility and apologizing to those affected by our mistakes,
56+ and learning from the experience
57+* Focusing on what is best not just for us as individuals, but for the
58+ overall community
59+* Using welcoming and inclusive language
60+
61+
62+Examples of unacceptable behavior include but are not limited to:
63+
64+* The use of sexualized language or imagery
65+* Trolling, insulting or derogatory comments, and personal or political attacks
66+* Public or private harassment in any form
67+* Publishing others' private information, such as a physical or email
68+ address, without their explicit permission
69+* Violence, threatening violence, or encouraging others to engage in violent behavior
70+* Stalking or following someone without their consent
71+* Unwelcome physical contact
72+* Unwelcome sexual or romantic attention or advances
73+* Using CNCF projects or community spaces for political campaigning or promotion of political causes
74+ that are unrelated to the advancement of cloud native technology. To clarify, this policy does not restrict individuals' personal attire, including attire that expresses personal beliefs or aspects of identity.
75+* Other conduct which could reasonably be considered inappropriate in a
76+ professional setting
77+
78+The following behaviors are also prohibited:
79+* Providing knowingly false or misleading information in connection with a Code of Conduct investigation or otherwise intentionally tampering with an investigation.
80+* Retaliating against a person because they reported an incident or provided information about an incident as a witness.
81+
82+Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct.
83+By adopting this Code of Conduct, project maintainers commit themselves to fairly and consistently applying these principles to every aspect
84+of managing a CNCF project.
85+Project maintainers who do not follow or enforce the Code of Conduct may be temporarily or permanently removed from the project team.
86+
87+## Reporting
88+
89+For incidents occurring in the Kubernetes community, contact the [Kubernetes Code of Conduct Committee](https://git.k8s.io/community/committee-code-of-conduct) via <conduct@kubernetes.io>. You can expect a response within three business days.
90+
91+For other projects, or for incidents that are project-agnostic or impact multiple CNCF projects, please contact the [CNCF Code of Conduct Committee](https://www.cncf.io/conduct/committee/) via <conduct@cncf.io>. Alternatively, you can contact any of the individual members of the [CNCF Code of Conduct Committee](https://www.cncf.io/conduct/committee/) to submit your report. For more detailed instructions on how to submit a report, including how to submit a report anonymously, please see our [Incident Resolution Procedures](https://github.com/cncf/foundation/blob/main/code-of-conduct/coc-incident-resolution-procedures.md). You can expect a response within three business days.
92+
93+For incidents occurring at CNCF event that is produced by the Linux Foundation, please contact <eventconduct@cncf.io>.
94+
95+## Frequently asked questions
96+For more information about this Code of Conduct, please see the [CNCF Code of Conduct Frequently Asked Questions](https://www.cncf.io/conduct/faq/).
97+
98+## Enforcement
99+
100+Upon review and investigation of a reported incident, the CoC response team that has jurisdiction will determine what action is appropriate based on this Code of Conduct and its related documentation.
101+
102+For information about which Code of Conduct incidents are handled by project leadership, which incidents are handled by the CNCF Code of Conduct Committee, and which incidents are handled by the Linux Foundation (including its events team), see our [Jurisdiction Policy](https://github.com/cncf/foundation/blob/main/code-of-conduct/coc-committee-jurisdiction-policy.md).
103+
104+## Amendments
105+
106+Consistent with the CNCF Charter, any substantive changes to this Code of Conduct must be approved by the Technical Oversight Committee.
107+
108+## Acknowledgements
109+
110+This Code of Conduct is adapted from the Contributor Covenant
111+(http://contributor-covenant.org), version 2.0 available at
112+http://contributor-covenant.org/version/2/0/code_of_conduct/
CONTRIBUTING.mdnew file+23
@@ -0,0 +1,23 @@
1+# Contributing
2+
3+To develop on this project, please fork the repo and clone into your `$GOPATH`.
4+
5+Dependencies are **not** checked in so please download those separately.
6+Download the dependencies using `go mod download`.
7+
8+```bash
9+cd $GOPATH/src/github.com # Create this directory if it doesn't exist
10+git clone git@github.com:<YOUR_FORK>/oauth2-proxy oauth2-proxy/oauth2-proxy
11+cd oauth2-proxy/oauth2-proxy
12+go mod download
13+```
14+
15+## Pull Requests and Issues
16+
17+We track bugs and issues using Github.
18+
19+If you find a bug, please open an Issue.
20+
21+If you want to fix a bug, please fork, create a feature branch, fix the bug and
22+open a PR back to this repo.
23+Please mention the open bug issue number within your PR if applicable.
DCO.mdnew file+34
@@ -0,0 +1,34 @@
1+Developer Certificate of Origin
2+Version 1.1
3+
4+Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
5+
6+Everyone is permitted to copy and distribute verbatim copies of this
7+license document, but changing it is not allowed.
8+
9+
10+Developer's Certificate of Origin 1.1
11+
12+By making a contribution to this project, I certify that:
13+
14+(a) The contribution was created in whole or in part by me and I
15+ have the right to submit it under the open source license
16+ indicated in the file; or
17+
18+(b) The contribution is based upon previous work that, to the best
19+ of my knowledge, is covered under an appropriate open source
20+ license and I have the right under that license to submit that
21+ work with modifications, whether created in whole or in part
22+ by me, under the same open source license (unless I am
23+ permitted to submit under a different license), as indicated
24+ in the file; or
25+
26+(c) The contribution was provided directly to me by some other
27+ person who certified (a), (b) or (c) and I have not modified
28+ it.
29+
30+(d) I understand and agree that this project and the contribution
31+ are public and that a record of the contribution (including all
32+ personal information I submit with it, including my sign-off) is
33+ maintained indefinitely and may be redistributed consistent with
34+ this project or the open source license(s) involved.
Dockerfilenew file+74
@@ -0,0 +1,74 @@
1+# The image ARGs have to be at the top, otherwise the docker daemon cannot validate
2+# the FROM statements and overall Dockerfile
3+#
4+# Argument for setting the build image
5+ARG BUILD_IMAGE=placeholder
6+# Argument for setting the runtime image
7+ARG RUNTIME_IMAGE=placeholder
8+# Argument for setting the oauth2-proxy build version
9+ARG VERSION
10+
11+# All builds should be done using the platform native to the build node to allow
12+# cache sharing of the go mod download step.
13+# Go cross compilation is also faster than emulation the go compilation across
14+# multiple platforms.
15+FROM --platform=${BUILDPLATFORM} ${BUILD_IMAGE} AS builder
16+
17+# Copy sources
18+WORKDIR $GOPATH/src/github.com/oauth2-proxy/oauth2-proxy
19+
20+# Fetch dependencies
21+COPY go.mod go.sum ./
22+RUN go mod download
23+
24+# Now pull in our code
25+COPY . .
26+
27+# Arguments go here so that the previous steps can be cached if no external sources
28+# have changed. These arguments are automatically set by the docker engine.
29+ARG TARGETPLATFORM
30+ARG BUILDPLATFORM
31+
32+# Reload version argument
33+ARG VERSION
34+
35+# Build binary and make sure there is at least an empty key file.
36+# This is useful for GCP App Engine custom runtime builds, because
37+# you cannot use multiline variables in their app.yaml, so you have to
38+# build the key into the container and then tell it where it is
39+# by setting OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem
40+# in app.yaml instead.
41+# Set the cross compilation arguments based on the TARGETPLATFORM which is
42+# automatically set by the docker engine.
43+RUN case ${TARGETPLATFORM} in \
44+ "linux/amd64") GOARCH=amd64 ;; \
45+ # arm64 and arm64v8 are equivalent in go and do not require a goarm
46+ # https://github.com/golang/go/wiki/GoArm
47+ "linux/arm64" | "linux/arm/v8") GOARCH=arm64 ;; \
48+ "linux/ppc64le") GOARCH=ppc64le ;; \
49+ "linux/s390x") GOARCH=s390x ;; \
50+ "linux/arm/v6") GOARCH=arm GOARM=6 ;; \
51+ "linux/arm/v7") GOARCH=arm GOARM=7 ;; \
52+ esac && \
53+ printf "Building OAuth2 Proxy for arch ${GOARCH}\n" && \
54+ GOARCH=${GOARCH} VERSION=${VERSION} make build && touch jwt_signing_key.pem
55+
56+# Reload runtime image
57+ARG RUNTIME_IMAGE
58+# Copy binary to runtime image
59+FROM ${RUNTIME_IMAGE}
60+# Reload version
61+ARG VERSION
62+
63+COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/oauth2-proxy /bin/oauth2-proxy
64+COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/jwt_signing_key.pem /etc/ssl/private/jwt_signing_key.pem
65+
66+LABEL org.opencontainers.image.licenses=MIT \
67+ org.opencontainers.image.description="A reverse proxy that provides authentication with Google, Azure, OpenID Connect and many more identity providers." \
68+ org.opencontainers.image.documentation=https://oauth2-proxy.github.io/oauth2-proxy/ \
69+ org.opencontainers.image.source=https://github.com/oauth2-proxy/oauth2-proxy \
70+ org.opencontainers.image.url=https://quay.io/oauth2-proxy/oauth2-proxy \
71+ org.opencontainers.image.title=oauth2-proxy \
72+ org.opencontainers.image.version=${VERSION}
73+
74+ENTRYPOINT ["/bin/oauth2-proxy"]
LICENSEnew file+17
@@ -0,0 +1,17 @@
1+Permission is hereby granted, free of charge, to any person obtaining a copy
2+of this software and associated documentation files (the "Software"), to deal
3+in the Software without restriction, including without limitation the rights
4+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
5+copies of the Software, and to permit persons to whom the Software is
6+furnished to do so, subject to the following conditions:
7+
8+The above copyright notice and this permission notice shall be included in
9+all copies or substantial portions of the Software.
10+
11+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
12+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
14+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
15+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
16+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
17+THE SOFTWARE.
MAINTAINERSnew file+2
@@ -0,0 +1,2 @@
1+
2+Moved to https://github.com/oauth2-proxy/oauth2-proxy/blob/master/MAINTAINERS.md
MAINTAINERS.mdnew file+33
@@ -0,0 +1,33 @@
1+# Maintainers
2+
3+The table below lists all current maintainers for the oauth2-proxy as defined
4+by our [project governance](GOVERNANCE.md).
5+
6+| Name | GitHub Handle | Domains of reponsibility | Email Alias | Affiliation |
7+| ---------------- | ------------------------------------------------------ | ------------------------ | -------------------------- | ----------- |
8+| Joel Speed | [@JoelSpeed](https://github.com/joelspeed) | Governance, Core | joel@oauth2-proxy.dev | Red Hat |
9+| Jan Larwig | [@tuunit](https://github.com/tuunit) | Governance, Core | jan@oauth2-proxy.dev | STACKIT |
10+| JJ Łakis | [@jjlakis](https://github.com/jjlakis) | Provider | jj@oauth2-proxy.dev | - |
11+| Koen van Zuijlen | [@kvanzuijlen](https://github.com/kvanzuijlen) | CI | koen@oauth2-proxy.dev | - |
12+| Pierluigi Lenoci | [@pierluigilenoci](https://github.com/pierluigilenoci) | Helm | pierluigi@oauth2-proxy.dev | SAP |
13+
14+## Emeritus Maintainers
15+
16+We would like to highlight that this project does have prior maintainers and
17+core contributors that, if they so wished, could (and should) be granted the
18+status of emeritus maintainers.
19+
20+| Name | GitHub Handle |
21+| ------------- | ------------------------------------------------------ |
22+| Nick Meves | [@NickMeves](https://github.com/NickMeves) |
23+| Braunson | [@braunsonm](https://github.com/braunsonm) |
24+| Henry Jenkins | [@steakunderscore](https://github.com/steakunderscore) |
25+
26+
27+## Security Response Team and GitHub Organization Owners
28+
29+The following maintainers are members of the security response team and owners
30+of the GitHub organization.
31+
32+- Joel Speed
33+- Jan Larwig
Makefilenew file+179
@@ -0,0 +1,179 @@
1+#!/usr/bin/env bash
2+
3+#
4+# Makefile with some common workflow for dev, build and test
5+#
6+
7+##@ General
8+
9+# The help target prints out all targets with their descriptions organized
10+# beneath their categories. The categories are represented by '##@' and the
11+# target descriptions by '##'. The awk command is responsible for reading the
12+# entire set of makefiles included in this invocation, looking for lines of the
13+# file as xyz: ## something, and then pretty-format the target and help. Then,
14+# if there's a line with ##@ something, that gets pretty-printed as a category.
15+# More info on the usage of ANSI control characters for terminal formatting:
16+# https://en.wikipedia.org/wiki/ANSI_escape_code#SGR_parameters
17+# More info on the awk command:
18+# http://linuxcommand.org/lc3_adv_awk.php
19+
20+# The following help command is Licensed under the Apache License, Version 2.0 (the "License")
21+# Copyright 2023 The Kubernetes Authors.
22+.PHONY: help
23+help: ## Display this help
24+ @awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf " \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
25+
26+
27+GO ?= go
28+# renovate: datasource=github-tags depName=golangci/golangci-lint
29+GOLANGCILINT_VERSION ?= v2.11.4
30+
31+BINARY := oauth2-proxy
32+VERSION ?= $(shell git describe --always --dirty --tags 2>/dev/null || echo "undefined")
33+# Allow to override image registry.
34+REGISTRY ?= quay.io/oauth2-proxy
35+REPOSITORY ?= oauth2-proxy
36+
37+DATE := $(shell date +"%Y%m%d")
38+.NOTPARALLEL:
39+
40+# The go version in go.mod used for the Docker build toolchain, without the patch
41+GO_MOD_VERSION_MINOR := $(shell $(GO) list -f '{{printf "%.4s" .Module.GoVersion}}' )
42+
43+# From go1.21 go will transparently download the toolchain declared in go.mod. https://go.dev/doc/toolchain
44+# We don't need to keep this message updated: the important info is in go.mod.
45+GO_VERSION_VALIDATION_ERR_MSG = Golang version is not supported, please update to at least go1.21
46+
47+ifeq ($(COVER),true)
48+TESTCOVER ?= -coverprofile c.out
49+endif
50+
51+##@ Build
52+
53+.PHONY: build
54+build: validate-go-version clean $(BINARY) ## Build and create oauth2-proxy binary from current source code
55+
56+$(BINARY):
57+ CGO_ENABLED=0 $(GO) build -a -installsuffix cgo -ldflags="-X github.com/oauth2-proxy/oauth2-proxy/v7/pkg/version.VERSION=${VERSION}" -o $@ github.com/oauth2-proxy/oauth2-proxy/v7
58+
59+DOCKER_BUILDX_COMMON_ARGS ?= --build-arg BUILD_IMAGE=docker.io/library/golang:$(GO_MOD_VERSION_MINOR)-bookworm --build-arg VERSION=$(VERSION)
60+
61+DOCKER_BUILD_PLATFORM ?= linux/amd64,linux/arm64,linux/ppc64le,linux/arm/v7,linux/s390x
62+DOCKER_BUILD_RUNTIME_IMAGE ?= gcr.io/distroless/static:nonroot
63+DOCKER_BUILDX_ARGS ?= --build-arg RUNTIME_IMAGE=${DOCKER_BUILD_RUNTIME_IMAGE} ${DOCKER_BUILDX_COMMON_ARGS}
64+DOCKER_BUILDX := docker buildx build ${DOCKER_BUILDX_ARGS} --pull
65+DOCKER_BUILDX_X_PLATFORM := $(DOCKER_BUILDX) --platform ${DOCKER_BUILD_PLATFORM}
66+DOCKER_BUILDX_PUSH := $(DOCKER_BUILDX) --push
67+DOCKER_BUILDX_PUSH_X_PLATFORM := $(DOCKER_BUILDX_PUSH) --platform ${DOCKER_BUILD_PLATFORM}
68+
69+DOCKER_BUILD_PLATFORM_ALPINE ?= linux/amd64,linux/arm64,linux/ppc64le,linux/arm/v6,linux/arm/v7,linux/s390x
70+DOCKER_BUILD_RUNTIME_IMAGE_ALPINE ?= alpine:3.24.1
71+DOCKER_BUILDX_ARGS_ALPINE ?= --build-arg RUNTIME_IMAGE=${DOCKER_BUILD_RUNTIME_IMAGE_ALPINE} ${DOCKER_BUILDX_COMMON_ARGS}
72+DOCKER_BUILDX_X_PLATFORM_ALPINE := docker buildx build ${DOCKER_BUILDX_ARGS_ALPINE} --platform ${DOCKER_BUILD_PLATFORM_ALPINE}
73+DOCKER_BUILDX_PUSH_X_PLATFORM_ALPINE := $(DOCKER_BUILDX_X_PLATFORM_ALPINE) --push
74+
75+.PHONY: build-docker
76+build-docker: build-distroless build-alpine ## Build multi architecture docker images in both flavours (distroless / alpine)
77+
78+.PHONY: build-docker-local
79+build-docker-local: ## Build distroless docker image and locally load into docker images
80+ $(DOCKER_BUILDX) --load -t $(REGISTRY)/$(REPOSITORY):${VERSION}-local .
81+
82+.PHONY: build-distroless
83+build-distroless: ## Build multi architecture distroless based docker image
84+ $(DOCKER_BUILDX_X_PLATFORM) -t $(REGISTRY)/$(REPOSITORY):latest -t $(REGISTRY)/$(REPOSITORY):${VERSION} .
85+
86+.PHONY: build-alpine
87+build-alpine: ## Build multi architecture alpine based docker image
88+ $(DOCKER_BUILDX_X_PLATFORM_ALPINE) -t $(REGISTRY)/$(REPOSITORY):latest-alpine -t $(REGISTRY)/$(REPOSITORY):${VERSION}-alpine .
89+
90+.PHONY: build-docker-all
91+build-docker-all: build-docker ## Build docker images for all supported architectures in both flavours (distroless / alpine)
92+ $(DOCKER_BUILDX) --platform linux/amd64 -t $(REGISTRY)/$(REPOSITORY):latest-amd64 -t $(REGISTRY)/$(REPOSITORY):${VERSION}-amd64 .
93+ $(DOCKER_BUILDX) --platform linux/arm64 -t $(REGISTRY)/$(REPOSITORY):latest-arm64 -t $(REGISTRY)/$(REPOSITORY):${VERSION}-arm64 .
94+ $(DOCKER_BUILDX) --platform linux/ppc64le -t $(REGISTRY)/$(REPOSITORY):latest-ppc64le -t $(REGISTRY)/$(REPOSITORY):${VERSION}-ppc64le .
95+ $(DOCKER_BUILDX) --platform linux/arm/v7 -t $(REGISTRY)/$(REPOSITORY):latest-armv7 -t $(REGISTRY)/$(REPOSITORY):${VERSION}-armv7 .
96+ $(DOCKER_BUILDX) --platform linux/s390x -t $(REGISTRY)/$(REPOSITORY):latest-s390x -t $(REGISTRY)/$(REPOSITORY):${VERSION}-s390x .
97+
98+
99+##@ Publish
100+
101+.PHONY: push-docker
102+push-docker: push-distroless push-alpine ## Push multi architecture docker images for both flavours (distroless / alpine)
103+
104+.PHONY: push-distroless
105+push-distroless: ## Push multi architecture distroless based docker image
106+ $(DOCKER_BUILDX_PUSH_X_PLATFORM) -t $(REGISTRY)/$(REPOSITORY):latest -t $(REGISTRY)/$(REPOSITORY):${VERSION} .
107+
108+.PHONY: push-alpine
109+push-alpine: ## Push multi architecture alpine based docker image
110+ $(DOCKER_BUILDX_PUSH_X_PLATFORM_ALPINE) -t $(REGISTRY)/$(REPOSITORY):latest-alpine -t $(REGISTRY)/$(REPOSITORY):${VERSION}-alpine .
111+
112+.PHONY: push-docker-all
113+push-docker-all: push-docker ## Push docker images for all supported architectures for both flavours (distroless / alpine)
114+ $(DOCKER_BUILDX_PUSH) --platform linux/amd64 -t $(REGISTRY)/$(REPOSITORY):latest-amd64 -t $(REGISTRY)/$(REPOSITORY):${VERSION}-amd64 .
115+ $(DOCKER_BUILDX_PUSH) --platform linux/arm64 -t $(REGISTRY)/$(REPOSITORY):latest-arm64 -t $(REGISTRY)/$(REPOSITORY):${VERSION}-arm64 .
116+ $(DOCKER_BUILDX_PUSH) --platform linux/ppc64le -t $(REGISTRY)/$(REPOSITORY):latest-ppc64le -t $(REGISTRY)/$(REPOSITORY):${VERSION}-ppc64le .
117+ $(DOCKER_BUILDX_PUSH) --platform linux/arm/v7 -t $(REGISTRY)/$(REPOSITORY):latest-armv7 -t $(REGISTRY)/$(REPOSITORY):${VERSION}-armv7 .
118+ $(DOCKER_BUILDX_PUSH) --platform linux/s390x -t $(REGISTRY)/$(REPOSITORY):latest-s390x -t $(REGISTRY)/$(REPOSITORY):${VERSION}-s390x .
119+
120+
121+##@ Nightly scheduling
122+
123+.PHONY: nightly-build
124+nightly-build: ## Nightly build command for docker images in both flavours (distroless / alpine)
125+ $(DOCKER_BUILDX_X_PLATFORM) -t $(REGISTRY)/$(REPOSITORY)-nightly:latest -t $(REGISTRY)/$(REPOSITORY)-nightly:${DATE} .
126+ $(DOCKER_BUILDX_X_PLATFORM_ALPINE) -t ${REGISTRY}/$(REPOSITORY)-nightly:latest-alpine -t $(REGISTRY)/$(REPOSITORY)-nightly:${DATE}-alpine .
127+
128+.PHONY: nightly-push
129+nightly-push: ## Nightly push command for docker images in both flavours (distroless / alpine)
130+ $(DOCKER_BUILDX_PUSH_X_PLATFORM) -t $(REGISTRY)/$(REPOSITORY)-nightly:latest -t $(REGISTRY)/$(REPOSITORY)-nightly:${DATE} .
131+ $(DOCKER_BUILDX_PUSH_X_PLATFORM_ALPINE) -t ${REGISTRY}/$(REPOSITORY)-nightly:latest-alpine -t $(REGISTRY)/$(REPOSITORY)-nightly:${DATE}-alpine .
132+
133+
134+##@ Docs
135+
136+.PHONY: generate
137+generate: ## Generate alpha config docs from golang structs
138+ go generate ./pkg/...
139+
140+.PHONY: verify-generate
141+verify-generate: generate ## Verify command to check if alpha config docs are in line with golang struct changes
142+ git diff --exit-code
143+
144+##@ Miscellaneous
145+
146+.PHONY: test
147+test: ## Run all Go tests
148+ GO111MODULE=on $(GO) test $(TESTCOVER) -v -race ./...
149+
150+.PHONY: release
151+release: validate-go-version ## Create a full release for all architectures (binaries and checksums)
152+ BINARY=${BINARY} VERSION=${VERSION} ./dist.sh
153+
154+.PHONY: clean
155+clean: ## Cleanup release and build files
156+ -rm -rf release
157+ -rm -f $(BINARY)
158+
159+.PHONY: lint
160+lint: validate-go-version ## Lint all files using golangci-lint
161+ GO111MODULE=on $(GO) run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCILINT_VERSION) run --timeout 10m
162+
163+.PHONY: lint-fix
164+lint-fix: validate-go-version ## Lint all files and apply fixes using golangci-lint
165+ GO111MODULE=on $(GO) run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCILINT_VERSION) run --timeout 10m --fix
166+
167+.PHONY: validate-go-version
168+validate-go-version: ## Validate Go environment requirements
169+ @$(GO) list . >/dev/null || { echo '$(GO_VERSION_VALIDATION_ERR_MSG)'; exit 1; }
170+
171+# local-env can be used to interact with the local development environment
172+# eg:
173+# make local-env-up # Bring up a basic test environment
174+# make local-env-down # Tear down the basic test environment
175+# make local-env-nginx-up # Bring up an nginx based test environment
176+# make local-env-nginx-down # Tead down the nginx based test environment
177+.PHONY: local-env-%
178+local-env-%:
179+ make -C contrib/local-environment $*
README.md+96−30
@@ -1,39 +1,105 @@
1−google_auth_proxy
1+[![Continuous Integration](https://github.com/oauth2-proxy/oauth2-proxy/actions/workflows/ci.yml/badge.svg)](https://github.com/oauth2-proxy/oauth2-proxy/actions/workflows/ci.yml)
2−=================
2+[![Go Report Card](https://goreportcard.com/badge/github.com/oauth2-proxy/oauth2-proxy)](https://goreportcard.com/report/github.com/oauth2-proxy/oauth2-proxy/v7)
3+[![GoDoc](https://godoc.org/github.com/oauth2-proxy/oauth2-proxy?status.svg)](https://godoc.org/github.com/oauth2-proxy/oauth2-proxy/v7)
4+[![MIT licensed](https://img.shields.io/badge/license-MIT-blue.svg)](./LICENSE)
5+[![Maintainability](https://qlty.sh/gh/oauth2-proxy/projects/oauth2-proxy/maintainability.svg)](https://qlty.sh/gh/oauth2-proxy/projects/oauth2-proxy)
6+[![Code Coverage](https://qlty.sh/gh/oauth2-proxy/projects/oauth2-proxy/coverage.svg)](https://qlty.sh/gh/oauth2-proxy/projects/oauth2-proxy)
7+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/oauth2-proxy/oauth2-proxy/badge)](https://scorecard.dev/viewer/?uri=github.com/oauth2-proxy/oauth2-proxy)
8+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/11223/badge)](https://www.bestpractices.dev/projects/11223)
9+[![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Foauth2-proxy%2Foauth2-proxy.svg?type=shield)](https://app.fossa.com/projects/git%2Bgithub.com%2Foauth2-proxy%2Foauth2-proxy?ref=badge_shield)
3
10
4−A reverse proxy that acts as an authentication layer using Google Oauth2 to validate
11+![OAuth2 Proxy](docs/static/img/logos/OAuth2_Proxy_horizontal.svg)
5−individual accounts, or a whole google apps domain.
6
12
13+OAuth2 Proxy is a flexible, open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. It provides a simple and secure way to protect your web applications with OAuth2 / OIDC authentication. As a reverse proxy, it intercepts requests to your application and redirects users to an OAuth2 provider for authentication. As a middleware, it can be seamlessly integrated into your existing infrastructure to handle authentication for multiple applications.
7
14
8−## Structure
15+OAuth2 Proxy supports a lot of OAuth2 as well as OIDC providers. Either through a generic OIDC client or a specific implementation for Google, Microsoft Entra ID, GitHub, login.gov and others. Through specialised provider implementations OAuth2 Proxy can extract more details about the user like preferred usernames and groups. Those details can then be forwarded as HTTP headers to your upstream applications.
9
16
17+![Simplified Architecture](docs/static/img/simplified-architecture.svg)
10
18
11−```
19+## Get Started
12− _______ ___________________ __________
13− |Nginx| ----> |google_auth_proxy| ----> |upstream|
14− ------- ------------------- ----------
15− ||
16− \/
17− [google oauth2 api]
18
20
19−```
21+OAuth2 Proxy's [Installation Docs](https://oauth2-proxy.github.io/oauth2-proxy/installation) cover how to install and configure your setup. Additionally you can take a further look at the [example setup files](https://github.com/oauth2-proxy/oauth2-proxy/tree/master/contrib/local-environment).
20
22
21−## Configuration
23+## Releases
22−
23−1) visit to Google Api Console https://code.google.com/apis/console/
24−2) under "API Access", choose "Create an OAuth 2.0 Client ID"
25−3) Edit the application settings, and list the Redirect URI(s) where you will run your application. For example:
26−`https://internalapp.yourcompany.com/oauth2/callback`
27
24
28−## Usage
25+### Binaries
26+We publish OAuth2 Proxy as compiled binaries on GitHub for all major architectures as well as more exotic ones like `ppc64le` as well as `s390x`.
29
27
30−```
28+Check out the [latest release](https://github.com/oauth2-proxy/oauth2-proxy/releases/latest).
31−./google_auth_proxy
29+
32− -client-id="": the Google OAuth Client ID: ie: "123456.apps.googleusercontent.com"
30+### Images
33− -client-secret="": the OAuth Client secret
31+
34− -cookie-secret="": the seed for cookie values
32+From `v7.6.0` and up the base image has been changed from Alpine to [GoogleContainerTools/distroless](https://github.com/GoogleContainerTools/distroless).
35− -redirect-url="": the http base to redirect to. ie: https://internalapp.yourcompany.com/oauth2/callback
33+This image comes with even fewer installed dependencies and thus should improve security. The image therefore is also slightly smaller than Alpine.
36− -htpasswd-file="": additionally lookup basic auth in a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption
34+For debugging purposes (and those who really need it. e.g. `armv6`) we still provide images based on Alpine. The tags of these images are suffixed with `-alpine`.
37− -pass-basic-auth=true: pass basic auth information to upstream
35+
38− -upstream=[]: the http url(s) of the upstream endpoint(s). If multiple, routing is based on URL path
36+Since 2023-11-18 we build nightly images directly from the `master` branch and provide them at `quay.io/oauth2-proxy/oauth2-proxy-nightly`.
39−```
37+These images are considered unstable and therefore should **NOT** be used for production purposes unless you know what you're doing.
38+
39+## Sponsors
40+Would you like to sponsor the project then please contact us at [sponsors@oauth2-proxy.dev](mailto:sponsors@oauth2-proxy.dev)
41+
42+![SAP](https://avatars.githubusercontent.com/u/2531208?s=300&v=4)
43+
44+SAP Open Source Program
45+
46+## Former Sponsors
47+![Microsoft](https://avatars.githubusercontent.com/u/6154722?s=100&v=4)
48+
49+Microsoft Azure credits for open source projects
50+
51+## Getting Involved
52+[![Slack](https://img.shields.io/badge/slack-CNCF_%23oauth2--proxy-blue?logo=slack)](https://cloud-native.slack.com/archives/C098Y5URZ2N)
53+
54+Join the #oauth2-proxy [Slack channel](https://cloud-native.slack.com/archives/C098Y5URZ2N) to chat with other users of OAuth2 Proxy or reach out to the maintainers directly. Use the [public invite link](https://slack.cncf.io/) to get an invite for the CNCF space.
55+
56+OAuth2 Proxy is a community-driven project. We rely on the contribut️ions of our users to continually improve it. While review times can vary, we appreciate your patience and understanding. As a volunteer-driven project, we strive to keep this project stable and might take longer to merge changes.
57+
58+If you want to contribute to the project. Please see our [Contributing](https://oauth2-proxy.github.io/oauth2-proxy/community/contribution) guide.
59+
60+Thanks to all the people who already contributed ❤
61+
62+<a href="https://github.com/oauth2-proxy/oauth2-proxy/graphs/contributors">
63+ <img src="https://contrib.rocks/image?repo=oauth2-proxy/oauth2-proxy&columns=15&max=75" />
64+ <img src="https://img.shields.io/github/contributors/oauth2-proxy/oauth2-proxy" />
65+</a>
66+
67+Made with [contrib.rocks](https://contrib.rocks).
68+
69+## Security
70+
71+If you believe you have found a vulnerability within OAuth2 Proxy or any of its dependencies, please do **NOT** open an issue or PR on GitHub, please do **NOT** post any details publicly.
72+
73+Security disclosures **MUST** be done in private. If you have found an issue that you would like to bring to the attention of the maintainers, please compose an email and send it to the list of people listed in our [MAINTAINERS.md](MAINTAINERS.md) file.
74+
75+For more details read our full [Security Docs](https://oauth2-proxy.github.io/oauth2-proxy/community/security#security-disclosures)
76+
77+### Security Notice for v6.0.0 and older
78+
79+If you are running a version older than v6.0.0 we **strongly recommend** to the current version.
80+
81+See [open redirect vulnerability](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5m6c-jp6f-2vcv) for details.
82+
83+## Repository History
84+
85+**2018-11-27:** This repository was forked from [bitly/OAuth2_Proxy](https://github.com/bitly/oauth2_proxy). Versions v3.0.0 and up are from this fork and will have diverged from any changes in the original fork. A list of changes can be seen in the [CHANGELOG](CHANGELOG.md).
86+
87+**2020-03-29:** This project was formerly hosted as `pusher/oauth2_proxy` but has been renamed to `oauth2-proxy/oauth2-proxy`. Going forward, all images shall be available at `quay.io/oauth2-proxy/oauth2-proxy` and binaries will be named `oauth2-proxy`.
88+
89+## Code of Conduct
90+Participation in the OAuth2 Proxy project is governed by the [CNCF Code of Conduct](CODE_OF_CONDUCT.md).
91+
92+## License
93+
94+OAuth2 Proxy is distributed under [The MIT License](LICENSE).
95+
96+
97+[![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Foauth2-proxy%2Foauth2-proxy.svg?type=large)](https://app.fossa.com/projects/git%2Bgithub.com%2Foauth2-proxy%2Foauth2-proxy?ref=badge_large)
98+
99+## Trademarks
100+
101+OAuth2 Proxy is a [Cloud Native Computing Foundation](https://cncf.io) Sandbox project.
102+
103+![CNCF](https://www.cncf.io/wp-content/uploads/2023/04/cncf-main-site-logo.svg)
104+
105+The Linux Foundation® (TLF) has registered trademarks and uses trademarks. For a list of TLF trademarks, see [Trademark Usage](https://www.linuxfoundation.org/legal/trademark-usage).
RELEASE.mdnew file+49
@@ -0,0 +1,49 @@
1+# Release
2+
3+The is a legacy document to explain the manual process of creating and publishing a new release of oauth2-proxy. As of now the release process has been automated with GitHub Actions workflows. For more information have a look at the workflows `create-release.yml` and `publish-release.yml`.
4+
5+Here's how OAuth2 Proxy releases are created.
6+
7+## Schedule
8+
9+Our aim is to release once a quarter, but bug fixes will be prioritised and might be released earlier.
10+
11+## The Process
12+
13+Note this uses `v4.1.0` as an example release number.
14+
15+1. Create a draft Github release
16+ * Use format `v4.1.0` for both the tag and title
17+2. Update [CHANGELOG.md](CHANGELOG.md)
18+ * Write the release highlights
19+ * Copy in headings ready for the next release
20+3. Create release commit
21+ ```
22+ git checkout -b release-v4.1.0
23+ ```
24+4. Create pull request getting other maintainers to review
25+5. Copy the release notes in to the draft Github release, adding a link to [CHANGELOG.md](CHANGELOG.md)
26+6. Update you local master branch
27+ ```
28+ git checkout master
29+ git pull
30+ ```
31+7. Create & push the tag
32+ ```
33+ git tag v4.1.0
34+ git push --tags
35+ ```
36+8. Make the release artefacts
37+ ```
38+ make release
39+ ```
40+9. Upload all the files (not the folders) from the `/release` folder to Github release as binary artefacts. There should be both the tarballs (`tar.gz`) and the checksum files (`sha256sum.txt`).
41+10. Publish release in Github
42+11. Make and push docker images to Quay
43+ ```
44+ make build-docker-all
45+ make push-docker-all
46+ ```
47+ Note: Ensure the docker tags don't include `-dirty`. This means you have uncommitted changes.
48+
49+12. Verify everything looks good at [quay](https://quay.io/repository/oauth2-proxy/oauth2-proxy?tag=latest&tab=tags) and [github](https://github.com/oauth2-proxy/oauth2-proxy/releases)
SECURITY.mdnew file+3
@@ -0,0 +1,3 @@
1+# Security Disclosures
2+
3+Please see [our community docs](https://oauth2-proxy.github.io/oauth2-proxy/community/security) for our security policy.
contrib/local-environment/Makefilenew file+56
@@ -0,0 +1,56 @@
1+.PHONY: up
2+up:
3+ docker compose up -d
4+
5+.PHONY: %
6+%:
7+ docker compose $*
8+
9+.PHONY: alpha-config-up
10+alpha-config-up:
11+ docker compose -f docker-compose.yaml -f docker-compose-alpha-config.yaml up -d
12+
13+.PHONY: alpha-config-%
14+alpha-config-%:
15+ docker compose -f docker-compose.yaml -f docker-compose-alpha-config.yaml $*
16+
17+.PHONY: nginx-up
18+nginx-up:
19+ docker compose -f docker-compose.yaml -f docker-compose-nginx.yaml up -d
20+
21+.PHONY: nginx-%
22+nginx-%:
23+ docker compose -f docker-compose.yaml -f docker-compose-nginx.yaml $*
24+
25+.PHONY: keycloak-up
26+keycloak-up:
27+ docker compose -f docker-compose-keycloak.yaml up -d
28+
29+.PHONY: keycloak-%
30+keycloak-%:
31+ docker compose -f docker-compose-keycloak.yaml $*
32+
33+.PHONY: gitea-up
34+gitea-up:
35+ docker compose -f docker-compose-gitea.yaml up -d
36+
37+.PHONY: gitea-%
38+gitea-%:
39+ docker compose -f docker-compose-gitea.yaml $*
40+
41+.PHONY: kubernetes-up
42+kubernetes-up:
43+ make -C kubernetes create-cluster
44+ make -C kubernetes deploy
45+
46+.PHONY: kubernetes-down
47+kubernetes-down:
48+ make -C kubernetes delete-cluster
49+
50+.PHONY: traefik-up
51+traefik-up:
52+ docker compose -f docker-compose-traefik.yaml up -d
53+
54+.PHONY: traefik-%
55+traefik-%:
56+ docker compose -f docker-compose-traefik.yaml $*
contrib/local-environment/README.mdnew file+3
@@ -0,0 +1,3 @@
1+# oauth2-proxy: local-environment
2+
3+Run `make up` to deploy local dex, etcd and oauth2-proxy instances in Docker containers. Review the [`Makefile`](Makefile) for additional deployment options.
contrib/local-environment/dex-traefik.yamlnew file+25
@@ -0,0 +1,25 @@
1+# This configuration is intended to be used with the Traefik local environment.
2+# Dex uses in-memory storage because this environment is disposable.
3+issuer: http://dex.localtest.me/dex
4+storage:
5+ type: memory
6+web:
7+ http: 0.0.0.0:5556
8+oauth2:
9+ skipApprovalScreen: true
10+expiry:
11+ signingKeys: "4h"
12+ idTokens: "1h"
13+staticClients:
14+ - id: oauth2-proxy
15+ redirectURIs:
16+ - "http://oauth2-proxy.localtest.me/oauth2/callback"
17+ name: "OAuth2 Proxy"
18+ secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK
19+enablePasswordDB: true
20+staticPasswords:
21+ - email: "admin@example.com"
22+ # bcrypt hash of the string "password"
23+ hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
24+ username: "admin"
25+ userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
contrib/local-environment/dex.yamlnew file+28
@@ -0,0 +1,28 @@
1+# This configuration is intended to be used with the docker-compose testing
2+# environment.
3+# This should configure Dex to run on port 5556 and provides a static login
4+issuer: http://dex.localtest.me:5556/dex
5+storage:
6+ type: memory
7+web:
8+ http: 0.0.0.0:5556
9+oauth2:
10+ skipApprovalScreen: true
11+expiry:
12+ signingKeys: "4h"
13+ idTokens: "1h"
14+staticClients:
15+ - id: oauth2-proxy
16+ redirectURIs:
17+ # These redirect URIs point to the `--redirect-url` for OAuth2 proxy.
18+ - "http://oauth2-proxy.localtest.me:4180/oauth2/callback" # For basic proxy example.
19+ - "http://oauth2-proxy.localtest.me:8080/oauth2/callback" # For nginx example.
20+ name: "OAuth2 Proxy"
21+ secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK
22+enablePasswordDB: true
23+staticPasswords:
24+ - email: "admin@example.com"
25+ # bcrypt hash of the string "password"
26+ hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
27+ username: "admin"
28+ userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
contrib/local-environment/docker-compose-alpha-config.yamlnew file+54
@@ -0,0 +1,54 @@
1+# This docker-compose file can be used to bring up an example instance of oauth2-proxy
2+# for manual testing and exploration of features.
3+# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,
4+# HTTPBin as an example upstream.
5+# This file also uses alpha configuration when configuring OAuth2 Proxy.
6+#
7+# This file is an extension of the main compose file and must be used with it
8+# docker-compose -f docker-compose.yaml -f docker-compose-alpha-config.yaml <command>
9+# Alternatively:
10+# make alpha-config-<command> (eg make nginx-up, make nginx-down)
11+#
12+# Access http://localhost:4180 to initiate a login cycle
13+version: "3.0"
14+services:
15+ oauth2-proxy:
16+ container_name: oauth2-proxy
17+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4
18+ command: --config /oauth2-proxy.cfg --alpha-config /oauth2-proxy-alpha-config.yaml
19+ hostname: oauth2-proxy
20+ volumes:
21+ - "./oauth2-proxy-alpha-config.cfg:/oauth2-proxy.cfg"
22+ - "./oauth2-proxy-alpha-config.yaml:/oauth2-proxy-alpha-config.yaml"
23+ restart: unless-stopped
24+ ports:
25+ - 4180:4180/tcp
26+ networks:
27+ dex: {}
28+ httpbin: {}
29+ depends_on:
30+ - dex
31+ - httpbin
32+ dex:
33+ container_name: dex
34+ image: ghcr.io/dexidp/dex:v2.45.1
35+ command: dex serve /dex.yaml
36+ hostname: dex
37+ volumes:
38+ - "./dex.yaml:/dex.yaml"
39+ restart: unless-stopped
40+ ports:
41+ - 5556:5556/tcp
42+ networks:
43+ dex:
44+ aliases:
45+ - dex.localtest.me
46+ httpbin:
47+ container_name: httpbin
48+ image: kennethreitz/httpbin
49+ ports: []
50+ networks:
51+ httpbin: {}
52+networks:
53+ dex: {}
54+ httpbin: {}
contrib/local-environment/docker-compose-gitea.yamlnew file+62
@@ -0,0 +1,62 @@
1+# This docker-compose file can be used to bring up an example instance of oauth2-proxy
2+# for manual testing and exploration of features.
3+# Alongside OAuth2-Proxy, this file also starts Gitea to act as the identity provider,
4+# HTTPBin as an example upstream.
5+#
6+# This can either be created using docker-compose
7+# docker-compose -f docker-compose-gitea.yaml <command>
8+# Or:
9+# make gitea-<command> (eg. make gitea-up, make gitea-down)
10+#
11+# Access http://oauth2-proxy.localtest.me:4180 to initiate a login cycle using user=admin@example.com, password=password
12+# Access http://gitea.localtest.me:3000 with the same credentials to check out the settings
13+version: '3.0'
14+services:
15+ oauth2-proxy:
16+ container_name: oauth2-proxy
17+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4
18+ command: --config /oauth2-proxy.cfg
19+ hostname: oauth2-proxy
20+ volumes:
21+ - "./oauth2-proxy-gitea.cfg:/oauth2-proxy.cfg"
22+ restart: unless-stopped
23+ networks:
24+ gitea: {}
25+ httpbin: {}
26+ oauth2-proxy: {}
27+ depends_on:
28+ - httpbin
29+ - gitea
30+ ports:
31+ - 4180:4180/tcp
32+
33+ httpbin:
34+ container_name: httpbin
35+ image: kennethreitz/httpbin:latest
36+ hostname: httpbin
37+ ports: []
38+ networks:
39+ httpbin: {}
40+
41+ gitea:
42+ image: gitea/gitea:1.27.2
43+ container_name: gitea
44+ environment:
45+ - USER_UID=1000
46+ - USER_GID=1000
47+ restart: always
48+ networks:
49+ gitea:
50+ aliases:
51+ - gitea.localtest.me
52+ volumes:
53+ - /etc/timezone:/etc/timezone:ro
54+ - /etc/localtime:/etc/localtime:ro
55+ ports:
56+ - "3000:3000"
57+ - "222:22"
58+
59+networks:
60+ httpbin: {}
61+ gitea: {}
62+ oauth2-proxy: {}
contrib/local-environment/docker-compose-keycloak.yamlnew file+65
@@ -0,0 +1,65 @@
1+# This docker-compose file can be used to bring up an example instance of oauth2-proxy
2+# for manual testing and exploration of features.
3+# Alongside OAuth2-Proxy, this file also starts Keycloak to act as the identity provider,
4+# HTTPBin as an example upstream.
5+#
6+# This can either be created using docker-compose
7+# docker-compose -f docker-compose-keycloak.yaml <command>
8+# Or:
9+# make keycloak-<command> (eg. make keycloak-up, make keycloak-down)
10+#
11+# Access http://oauth2-proxy.localtest.me:4180 to initiate a login cycle using user=admin@example.com, password=password
12+# Access http://keycloak.localtest.me:9080 with the same credentials to check out the settings
13+version: "3.0"
14+services:
15+ oauth2-proxy:
16+ container_name: oauth2-proxy
17+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4
18+ command: --config /oauth2-proxy.cfg
19+ hostname: oauth2-proxy
20+ volumes:
21+ - "./oauth2-proxy-keycloak.cfg:/oauth2-proxy.cfg"
22+ restart: unless-stopped
23+ ports:
24+ - 4180:4180/tcp
25+ networks:
26+ keycloak: {}
27+ httpbin: {}
28+ oauth2-proxy: {}
29+ depends_on:
30+ - httpbin
31+ - keycloak
32+
33+ httpbin:
34+ container_name: httpbin
35+ image: kennethreitz/httpbin:latest
36+ hostname: httpbin
37+ ports: []
38+ networks:
39+ httpbin: {}
40+
41+ keycloak:
42+ container_name: keycloak
43+ image: keycloak/keycloak:26.7
44+ hostname: keycloak
45+ command:
46+ - "start-dev"
47+ - "--http-port=9080"
48+ - "--import-realm"
49+ volumes:
50+ - ./keycloak:/opt/keycloak/data/import
51+ environment:
52+ KC_HTTP_PORT: 9080
53+ KEYCLOAK_ADMIN: admin@example.com
54+ KEYCLOAK_ADMIN_PASSWORD: password
55+ ports:
56+ - 9080:9080/tcp
57+ networks:
58+ keycloak:
59+ aliases:
60+ - keycloak.localtest.me
61+
62+networks:
63+ httpbin: {}
64+ keycloak: {}
65+ oauth2-proxy: {}
contrib/local-environment/docker-compose-nginx.yamlnew file+68
@@ -0,0 +1,68 @@
1+# This docker-compose file can be used to bring up an example instance of oauth2-proxy
2+# for manual testing and exploration of features.
3+# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,
4+# nginx as a reverse proxy and other HTTP services for upstreams.
5+#
6+# This file is an extension of the main compose file and must be used with it
7+# docker-compose -f docker-compose.yaml -f docker-compose-nginx.yaml <command>
8+# Alternatively:
9+# make nginx-<command> (eg make nginx-up, make nginx-down)
10+#
11+# Access http://oauth2-proxy.localtest.me:8080 to initiate a login flow.
12+version: "3.0"
13+services:
14+ oauth2-proxy:
15+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4
16+ ports: []
17+ hostname: oauth2-proxy
18+ container_name: oauth2-proxy
19+ command: --config /oauth2-proxy.cfg
20+ restart: unless-stopped
21+ volumes:
22+ - "./oauth2-proxy-nginx.cfg:/oauth2-proxy.cfg"
23+ networks:
24+ oauth2-proxy: {}
25+ dex: {}
26+ httpbin: {}
27+ depends_on:
28+ - dex
29+ - httpbin
30+ nginx:
31+ depends_on:
32+ - oauth2-proxy
33+ container_name: nginx
34+ image: nginx:1.31
35+ restart: unless-stopped
36+ ports:
37+ - 8080:8080/tcp
38+ hostname: nginx
39+ volumes:
40+ - "./nginx.conf:/etc/nginx/conf.d/default.conf"
41+ networks:
42+ oauth2-proxy: {}
43+ dex: {}
44+ httpbin: {}
45+ dex:
46+ container_name: dex
47+ image: ghcr.io/dexidp/dex:v2.45.1
48+ command: dex serve /dex.yaml
49+ hostname: dex
50+ volumes:
51+ - "./dex.yaml:/dex.yaml"
52+ restart: unless-stopped
53+ ports:
54+ - 5556:5556/tcp
55+ networks:
56+ dex:
57+ aliases:
58+ - dex.localtest.me
59+ httpbin:
60+ container_name: httpbin
61+ image: kennethreitz/httpbin
62+ ports: []
63+ networks:
64+ httpbin: {}
65+networks:
66+ dex: {}
67+ httpbin: {}
68+ oauth2-proxy: {}
contrib/local-environment/docker-compose-traefik.yamlnew file+74
@@ -0,0 +1,74 @@
1+# This docker-compose file can be used to bring up an example instance of oauth2-proxy
2+# for manual testing and exploration of features.
3+# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider
4+# and HTTPBin as an example upstream.
5+#
6+# This can either be created using docker-compose
7+# docker-compose -f docker-compose-traefik.yaml <command>
8+# Or:
9+# make traefik-<command> (eg. make traefik-up, make traefik-down)
10+#
11+# Access one of the following URLs to initiate a login flow:
12+# - http://oauth2-proxy.localtest.me
13+# - http://httpbin.localtest.me
14+# - http://dex.localtest.me/dex
15+#
16+# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.localtest.me
17+services:
18+
19+ oauth2-proxy:
20+ container_name: oauth2-proxy
21+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4
22+ command: --config /oauth2-proxy.cfg
23+ ports: []
24+ hostname: oauth2-proxy
25+ volumes:
26+ - "./oauth2-proxy-traefik.cfg:/oauth2-proxy.cfg"
27+ restart: unless-stopped
28+ networks:
29+ oauth2-proxy: {}
30+ dex: {}
31+ depends_on:
32+ - dex
33+ - httpbin
34+
35+ dex:
36+ container_name: dex
37+ image: ghcr.io/dexidp/dex:v2.45.1
38+ command: dex serve /dex.yaml
39+ hostname: dex
40+ volumes:
41+ - "./dex-traefik.yaml:/dex.yaml"
42+ restart: unless-stopped
43+ networks:
44+ dex: {}
45+
46+ httpbin:
47+ container_name: httpbin
48+ image: kennethreitz/httpbin
49+ ports: []
50+ networks:
51+ httpbin: {}
52+
53+ # Reverse proxy
54+ gateway:
55+ container_name: traefik
56+ image: traefik:v3.7.10
57+ volumes:
58+ - "./traefik:/etc/traefik"
59+ ports:
60+ - "80:80"
61+ - "9090:8080"
62+ depends_on:
63+ - oauth2-proxy
64+ networks:
65+ oauth2-proxy: {}
66+ httpbin: {}
67+ dex:
68+ aliases:
69+ - dex.localtest.me
70+
71+networks:
72+ dex: {}
73+ httpbin: {}
74+ oauth2-proxy: {}
contrib/local-environment/docker-compose.yamlnew file+52
@@ -0,0 +1,52 @@
1+# This docker-compose file can be used to bring up an example instance of oauth2-proxy
2+# for manual testing and exploration of features.
3+# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,
4+# HTTPBin as an example upstream.
5+#
6+# This can either be created using docker-compose
7+# docker-compose -f docker-compose.yaml <command>
8+# Or:
9+# make <command> (eg. make up, make down)
10+#
11+# Access http://oauth2-proxy.localtest.me:4180 to initiate a login cycle
12+version: "3.0"
13+services:
14+ oauth2-proxy:
15+ container_name: oauth2-proxy
16+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4
17+ command: --config /oauth2-proxy.cfg
18+ hostname: oauth2-proxy
19+ volumes:
20+ - "./oauth2-proxy.cfg:/oauth2-proxy.cfg"
21+ restart: unless-stopped
22+ ports:
23+ - 4180:4180/tcp
24+ networks:
25+ dex: {}
26+ httpbin: {}
27+ depends_on:
28+ - dex
29+ - httpbin
30+ dex:
31+ container_name: dex
32+ image: ghcr.io/dexidp/dex:v2.45.1
33+ command: dex serve /dex.yaml
34+ hostname: dex
35+ volumes:
36+ - "./dex.yaml:/dex.yaml"
37+ restart: unless-stopped
38+ ports:
39+ - 5556:5556/tcp
40+ networks:
41+ dex:
42+ aliases:
43+ - dex.localtest.me
44+ httpbin:
45+ container_name: httpbin
46+ image: kennethreitz/httpbin
47+ ports: []
48+ networks:
49+ httpbin: {}
50+networks:
51+ dex: {}
52+ httpbin: {}
contrib/local-environment/keycloak/oauth2-proxy-realm.jsonnew file+2071
@@ -0,0 +1,2071 @@
1+{
2+ "id": "oauth2-proxy",
3+ "realm": "oauth2-proxy",
4+ "displayName": "Keycloak",
5+ "displayNameHtml": "<div class=\"kc-logo-text\"><span>Keycloak</span></div>",
6+ "notBefore": 0,
7+ "revokeRefreshToken": false,
8+ "refreshTokenMaxReuse": 0,
9+ "accessTokenLifespan": 60,
10+ "accessTokenLifespanForImplicitFlow": 900,
11+ "ssoSessionIdleTimeout": 1800,
12+ "ssoSessionMaxLifespan": 36000,
13+ "ssoSessionIdleTimeoutRememberMe": 0,
14+ "ssoSessionMaxLifespanRememberMe": 0,
15+ "offlineSessionIdleTimeout": 2592000,
16+ "offlineSessionMaxLifespanEnabled": false,
17+ "offlineSessionMaxLifespan": 5184000,
18+ "clientSessionIdleTimeout": 0,
19+ "clientSessionMaxLifespan": 0,
20+ "accessCodeLifespan": 60,
21+ "accessCodeLifespanUserAction": 300,
22+ "accessCodeLifespanLogin": 1800,
23+ "actionTokenGeneratedByAdminLifespan": 43200,
24+ "actionTokenGeneratedByUserLifespan": 300,
25+ "enabled": true,
26+ "sslRequired": "external",
27+ "registrationAllowed": false,
28+ "registrationEmailAsUsername": false,
29+ "rememberMe": false,
30+ "verifyEmail": false,
31+ "loginWithEmailAllowed": true,
32+ "duplicateEmailsAllowed": false,
33+ "resetPasswordAllowed": false,
34+ "editUsernameAllowed": false,
35+ "bruteForceProtected": false,
36+ "permanentLockout": false,
37+ "maxFailureWaitSeconds": 900,
38+ "minimumQuickLoginWaitSeconds": 60,
39+ "waitIncrementSeconds": 60,
40+ "quickLoginCheckMilliSeconds": 1000,
41+ "maxDeltaTimeSeconds": 43200,
42+ "failureFactor": 30,
43+ "roles": {
44+ "realm": [
45+ {
46+ "id": "32626c92-4327-40f1-b318-76a6b5c7eee5",
47+ "name": "offline_access",
48+ "description": "${role_offline-access}",
49+ "composite": false,
50+ "clientRole": false,
51+ "containerId": "oauth2-proxy",
52+ "attributes": {}
53+ },
54+ {
55+ "id": "e36da570-7ae0-4323-8b39-73eb92ce722f",
56+ "name": "admin",
57+ "description": "${role_admin}",
58+ "composite": true,
59+ "composites": {
60+ "realm": [
61+ "create-realm"
62+ ],
63+ "client": {
64+ "oauth2-proxy-realm": [
65+ "query-groups",
66+ "create-client",
67+ "query-realms",
68+ "view-authorization",
69+ "view-realm",
70+ "manage-clients",
71+ "query-users",
72+ "manage-realm",
73+ "view-events",
74+ "manage-events",
75+ "view-identity-providers",
76+ "view-users",
77+ "manage-identity-providers",
78+ "manage-authorization",
79+ "manage-users",
80+ "view-clients",
81+ "query-clients",
82+ "impersonation"
83+ ]
84+ }
85+ },
86+ "clientRole": false,
87+ "containerId": "oauth2-proxy",
88+ "attributes": {}
89+ },
90+ {
91+ "id": "71aca46c-6fcf-4456-ba87-6374e70108a2",
92+ "name": "uma_authorization",
93+ "description": "${role_uma_authorization}",
94+ "composite": false,
95+ "clientRole": false,
96+ "containerId": "oauth2-proxy",
97+ "attributes": {}
98+ },
99+ {
100+ "id": "6ca3fee8-1a3f-4068-a311-6e81223a884b",
101+ "name": "create-realm",
102+ "description": "${role_create-realm}",
103+ "composite": false,
104+ "clientRole": false,
105+ "containerId": "oauth2-proxy",
106+ "attributes": {}
107+ }
108+ ],
109+ "client": {
110+ "oauth2-proxy": [],
111+ "security-admin-console": [],
112+ "admin-cli": [],
113+ "account-console": [],
114+ "broker": [
115+ {
116+ "id": "2cc5e40c-0a28-4c09-85eb-20cd47ac1351",
117+ "name": "read-token",
118+ "description": "${role_read-token}",
119+ "composite": false,
120+ "clientRole": true,
121+ "containerId": "380985f1-61c7-4940-93ae-7a09458071ca",
122+ "attributes": {}
123+ }
124+ ],
125+ "oauth2-proxy-realm": [
126+ {
127+ "id": "a8271c2c-6437-4ca5-ae83-49ea5fe1318d",
128+ "name": "query-groups",
129+ "description": "${role_query-groups}",
130+ "composite": false,
131+ "clientRole": true,
132+ "containerId": "7174c175-1887-4e57-b95b-969fe040deff",
133+ "attributes": {}
134+ },
135+ {
136+ "id": "5a7cb1ae-7dac-486b-bf7b-4d7fbc5adb31",
137+ "name": "create-client",
138+ "description": "${role_create-client}",
139+ "composite": false,
140+ "clientRole": true,
141+ "containerId": "7174c175-1887-4e57-b95b-969fe040deff",
142+ "attributes": {}
143+ },
144+ {
145+ "id": "a9e6a2fa-c31b-4959-bf8a-a46fcc9c65ec",
146+ "name": "view-authorization",
147+ "description": "${role_view-authorization}",
148+ "composite": false,
149+ "clientRole": true,
150+ "containerId": "7174c175-1887-4e57-b95b-969fe040deff",
151+ "attributes": {}
152+ },
153+ {
154+ "id": "1cef34e3-569a-4d2b-ba5c-aafe5c7ab423",
155+ "name": "query-realms",
156+ "description": "${role_query-realms}",
157+ "composite": false,
158+ "clientRole": true,
159+ "containerId": "7174c175-1887-4e57-b95b-969fe040deff",
160+ "attributes": {}
161+ },
162+ {
163+ "id": "efc46075-30cd-4600-aa92-2ae4a171d0c2",
164+ "name": "view-realm",
165+ "description": "${role_view-realm}",
166+ "composite": false,
167+ "clientRole": true,
168+ "containerId": "7174c175-1887-4e57-b95b-969fe040deff",
169+ "attributes": {}
170+ },
171+ {
172+ "id": "9ffacaf0-afc6-49e9-8708-ef35ac40f3f8",
173+ "name": "manage-clients",
174+ "description": "${role_manage-clients}",
175+ "composite": false,
176+ "clientRole": true,
177+ "containerId": "7174c175-1887-4e57-b95b-969fe040deff",
178+ "attributes": {}
179+ },
180+ {
181+ "id": "90662091-b3bc-4ae4-83c9-a4f53e7e9eeb",
182+ "name": "query-users",
183+ "description": "${role_query-users}",
184+ "composite": false,
185+ "clientRole": true,
186+ "containerId": "7174c175-1887-4e57-b95b-969fe040deff",
187+ "attributes": {}
188+ },
189+ {
190+ "id": "9a5fbc9d-6fae-4155-86f6-72fd399aa126",
191+ "name": "manage-realm",
192+ "description": "${role_manage-realm}",
193+ "composite": false,
194+ "clientRole": true,
195+ "containerId": "7174c175-1887-4e57-b95b-969fe040deff",
196+ "attributes": {}
197+ },
198+ {
199+ "id": "03f46127-9436-477d-8c7f-58569f45237c",
200+ "name": "view-events",
201+ "description": "${role_view-events}",
202+ "composite": false,
203+ "clientRole": true,
204+ "containerId": "7174c175-1887-4e57-b95b-969fe040deff",
205+ "attributes": {}
206+ },
207+ {
208+ "id": "f10eaea2-90ab-4310-9d5f-8d986564d061",
209+ "name": "view-identity-providers",
210+ "description": "${role_view-identity-providers}",
211+ "composite": false,
212+ "clientRole": true,
213+ "containerId": "7174c175-1887-4e57-b95b-969fe040deff",
214+ "attributes": {}
215+ },
216+ {
217+ "id": "2403e038-2cf7-4b06-b5cb-33a417a00d8d",
218+ "name": "manage-events",
219+ "description": "${role_manage-events}",
220+ "composite": false,
221+ "clientRole": true,
222+ "containerId": "7174c175-1887-4e57-b95b-969fe040deff",
223+ "attributes": {}
224+ },
225+ {
226+ "id": "677d057b-66f8-4163-9948-95fdbd06dfdc",
227+ "name": "view-users",
228+ "description": "${role_view-users}",
229+ "composite": true,
230+ "composites": {
231+ "client": {
232+ "oauth2-proxy-realm": [
233+ "query-groups",
234+ "query-users"
235+ ]
236+ }
237+ },
238+ "clientRole": true,
239+ "containerId": "7174c175-1887-4e57-b95b-969fe040deff",
240+ "attributes": {}
241+ },
242+ {
243+ "id": "dc140fa6-bf2c-49f2-b8c9-fc34ef8a2c63",
244+ "name": "manage-identity-providers",
245+ "description": "${role_manage-identity-providers}",
246+ "composite": false,
247+ "clientRole": true,
248+ "containerId": "7174c175-1887-4e57-b95b-969fe040deff",
249+ "attributes": {}
250+ },
251+ {
252+ "id": "155bf234-4895-4855-95c2-a460518f57e8",
253+ "name": "manage-authorization",
254+ "description": "${role_manage-authorization}",
255+ "composite": false,
256+ "clientRole": true,
257+ "containerId": "7174c175-1887-4e57-b95b-969fe040deff",
258+ "attributes": {}
259+ },
260+ {
261+ "id": "5441ec71-3eac-4696-9e68-0de54fbdde98",
262+ "name": "manage-users",
263+ "description": "${role_manage-users}",
264+ "composite": false,
265+ "clientRole": true,
266+ "containerId": "7174c175-1887-4e57-b95b-969fe040deff",
267+ "attributes": {}
268+ },
269+ {
270+ "id": "2db0f052-cb91-4170-81fd-107756b162f7",
271+ "name": "view-clients",
272+ "description": "${role_view-clients}",
273+ "composite": true,
274+ "composites": {
275+ "client": {
276+ "oauth2-proxy-realm": [
277+ "query-clients"
278+ ]
279+ }
280+ },
281+ "clientRole": true,
282+ "containerId": "7174c175-1887-4e57-b95b-969fe040deff",
283+ "attributes": {}
284+ },
285+ {
286+ "id": "e1d7f235-8bf2-40b8-be49-49aca70a5088",
287+ "name": "query-clients",
288+ "description": "${role_query-clients}",
289+ "composite": false,
290+ "clientRole": true,
291+ "containerId": "7174c175-1887-4e57-b95b-969fe040deff",
292+ "attributes": {}
293+ },
294+ {
295+ "id": "e743f66a-2f56-4b97-b34b-33f06ff1e739",
296+ "name": "impersonation",
297+ "description": "${role_impersonation}",
298+ "composite": false,
299+ "clientRole": true,
300+ "containerId": "7174c175-1887-4e57-b95b-969fe040deff",
301+ "attributes": {}
302+ }
303+ ],
304+ "account": [
305+ {
306+ "id": "64d8f532-839e-4386-b2eb-fe8848b0a9de",
307+ "name": "manage-consent",
308+ "description": "${role_manage-consent}",
309+ "composite": true,
310+ "composites": {
311+ "client": {
312+ "account": [
313+ "view-consent"
314+ ]
315+ }
316+ },
317+ "clientRole": true,
318+ "containerId": "a367038f-fe01-4459-9f91-7ad0cf498533",
319+ "attributes": {}
320+ },
321+ {
322+ "id": "3ec22748-960f-4f96-a43e-50f54a02dc23",
323+ "name": "view-profile",
324+ "description": "${role_view-profile}",
325+ "composite": false,
326+ "clientRole": true,
327+ "containerId": "a367038f-fe01-4459-9f91-7ad0cf498533",
328+ "attributes": {}
329+ },
330+ {
331+ "id": "177d18e4-46b0-4ea3-8b70-327486ce5bb2",
332+ "name": "view-applications",
333+ "description": "${role_view-applications}",
334+ "composite": false,
335+ "clientRole": true,
336+ "containerId": "a367038f-fe01-4459-9f91-7ad0cf498533",
337+ "attributes": {}
338+ },
339+ {
340+ "id": "703643d6-0542-4e27-9737-7c442925c18c",
341+ "name": "manage-account-links",
342+ "description": "${role_manage-account-links}",
343+ "composite": false,
344+ "clientRole": true,
345+ "containerId": "a367038f-fe01-4459-9f91-7ad0cf498533",
346+ "attributes": {}
347+ },
348+ {
349+ "id": "c64f9f66-d762-4337-8833-cf31c316e8a7",
350+ "name": "view-consent",
351+ "description": "${role_view-consent}",
352+ "composite": false,
353+ "clientRole": true,
354+ "containerId": "a367038f-fe01-4459-9f91-7ad0cf498533",
355+ "attributes": {}
356+ },
357+ {
358+ "id": "611f568b-0fdd-4d2e-ba34-03136cd486c4",
359+ "name": "manage-account",
360+ "description": "${role_manage-account}",
361+ "composite": true,
362+ "composites": {
363+ "client": {
364+ "account": [
365+ "manage-account-links"
366+ ]
367+ }
368+ },
369+ "clientRole": true,
370+ "containerId": "a367038f-fe01-4459-9f91-7ad0cf498533",
371+ "attributes": {}
372+ }
373+ ]
374+ }
375+ },
376+ "groups": [],
377+ "defaultRoles": [
378+ "offline_access",
379+ "uma_authorization"
380+ ],
381+ "requiredCredentials": [
382+ "password"
383+ ],
384+ "otpPolicyType": "totp",
385+ "otpPolicyAlgorithm": "HmacSHA1",
386+ "otpPolicyInitialCounter": 0,
387+ "otpPolicyDigits": 6,
388+ "otpPolicyLookAheadWindow": 1,
389+ "otpPolicyPeriod": 30,
390+ "otpSupportedApplications": [
391+ "FreeOTP",
392+ "Google Authenticator"
393+ ],
394+ "webAuthnPolicyRpEntityName": "keycloak",
395+ "webAuthnPolicySignatureAlgorithms": [
396+ "ES256"
397+ ],
398+ "webAuthnPolicyRpId": "",
399+ "webAuthnPolicyAttestationConveyancePreference": "not specified",
400+ "webAuthnPolicyAuthenticatorAttachment": "not specified",
401+ "webAuthnPolicyRequireResidentKey": "not specified",
402+ "webAuthnPolicyUserVerificationRequirement": "not specified",
403+ "webAuthnPolicyCreateTimeout": 0,
404+ "webAuthnPolicyAvoidSameAuthenticatorRegister": false,
405+ "webAuthnPolicyAcceptableAaguids": [],
406+ "webAuthnPolicyPasswordlessRpEntityName": "keycloak",
407+ "webAuthnPolicyPasswordlessSignatureAlgorithms": [
408+ "ES256"
409+ ],
410+ "webAuthnPolicyPasswordlessRpId": "",
411+ "webAuthnPolicyPasswordlessAttestationConveyancePreference": "not specified",
412+ "webAuthnPolicyPasswordlessAuthenticatorAttachment": "not specified",
413+ "webAuthnPolicyPasswordlessRequireResidentKey": "not specified",
414+ "webAuthnPolicyPasswordlessUserVerificationRequirement": "not specified",
415+ "webAuthnPolicyPasswordlessCreateTimeout": 0,
416+ "webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister": false,
417+ "webAuthnPolicyPasswordlessAcceptableAaguids": [],
418+ "scopeMappings": [
419+ {
420+ "clientScope": "offline_access",
421+ "roles": [
422+ "offline_access"
423+ ]
424+ }
425+ ],
426+ "clientScopeMappings": {
427+ "account": [
428+ {
429+ "client": "account-console",
430+ "roles": [
431+ "manage-account"
432+ ]
433+ }
434+ ]
435+ },
436+ "clients": [
437+ {
438+ "id": "a367038f-fe01-4459-9f91-7ad0cf498533",
439+ "clientId": "account",
440+ "name": "${client_account}",
441+ "rootUrl": "${authBaseUrl}",
442+ "baseUrl": "/realms/oauth2-proxy/account/",
443+ "surrogateAuthRequired": false,
444+ "enabled": true,
445+ "alwaysDisplayInConsole": false,
446+ "clientAuthenticatorType": "client-secret",
447+ "secret": "0896a464-da81-4454-bee9-b56bdbad9e7f",
448+ "defaultRoles": [
449+ "view-profile",
450+ "manage-account"
451+ ],
452+ "redirectUris": [
453+ "/realms/oauth2-proxy/account/*"
454+ ],
455+ "webOrigins": [],
456+ "notBefore": 0,
457+ "bearerOnly": false,
458+ "consentRequired": false,
459+ "standardFlowEnabled": true,
460+ "implicitFlowEnabled": false,
461+ "directAccessGrantsEnabled": false,
462+ "serviceAccountsEnabled": false,
463+ "publicClient": false,
464+ "frontchannelLogout": false,
465+ "protocol": "openid-connect",
466+ "attributes": {},
467+ "authenticationFlowBindingOverrides": {},
468+ "fullScopeAllowed": false,
469+ "nodeReRegistrationTimeout": 0,
470+ "defaultClientScopes": [
471+ "web-origins",
472+ "role_list",
473+ "roles",
474+ "profile",
475+ "email"
476+ ],
477+ "optionalClientScopes": [
478+ "address",
479+ "phone",
480+ "offline_access",
481+ "microprofile-jwt"
482+ ]
483+ },
484+ {
485+ "id": "72f75604-1e21-407c-b967-790aafd11534",
486+ "clientId": "account-console",
487+ "name": "${client_account-console}",
488+ "rootUrl": "${authBaseUrl}",
489+ "baseUrl": "/realms/oauth2-proxy/account/",
490+ "surrogateAuthRequired": false,
491+ "enabled": true,
492+ "alwaysDisplayInConsole": false,
493+ "clientAuthenticatorType": "client-secret",
494+ "secret": "91f85142-ee18-4e30-9949-e5acb701bdee",
495+ "redirectUris": [
496+ "/realms/oauth2-proxy/account/*"
497+ ],
498+ "webOrigins": [],
499+ "notBefore": 0,
500+ "bearerOnly": false,
501+ "consentRequired": false,
502+ "standardFlowEnabled": true,
503+ "implicitFlowEnabled": false,
504+ "directAccessGrantsEnabled": false,
505+ "serviceAccountsEnabled": false,
506+ "publicClient": true,
507+ "frontchannelLogout": false,
508+ "protocol": "openid-connect",
509+ "attributes": {
510+ "pkce.code.challenge.method": "S256"
511+ },
512+ "authenticationFlowBindingOverrides": {},
513+ "fullScopeAllowed": false,
514+ "nodeReRegistrationTimeout": 0,
515+ "protocolMappers": [
516+ {
517+ "id": "2772c101-0dba-49b7-9627-5aaddc666939",
518+ "name": "audience resolve",
519+ "protocol": "openid-connect",
520+ "protocolMapper": "oidc-audience-resolve-mapper",
521+ "consentRequired": false,
522+ "config": {}
523+ }
524+ ],
525+ "defaultClientScopes": [
526+ "web-origins",
527+ "role_list",
528+ "roles",
529+ "profile",
530+ "email"
531+ ],
532+ "optionalClientScopes": [
533+ "address",
534+ "phone",
535+ "offline_access",
536+ "microprofile-jwt"
537+ ]
538+ },
539+ {
540+ "id": "b13fd0de-3be0-4a08-bc5d-d1de34421b1a",
541+ "clientId": "admin-cli",
542+ "name": "${client_admin-cli}",
543+ "surrogateAuthRequired": false,
544+ "enabled": true,
545+ "alwaysDisplayInConsole": false,
546+ "clientAuthenticatorType": "client-secret",
547+ "secret": "4640af2e-b4a6-44eb-85ec-6278a62a4f01",
548+ "redirectUris": [],
549+ "webOrigins": [],
550+ "notBefore": 0,
551+ "bearerOnly": false,
552+ "consentRequired": false,
553+ "standardFlowEnabled": false,
554+ "implicitFlowEnabled": false,
555+ "directAccessGrantsEnabled": true,
556+ "serviceAccountsEnabled": false,
557+ "publicClient": true,
558+ "frontchannelLogout": false,
559+ "protocol": "openid-connect",
560+ "attributes": {},
561+ "authenticationFlowBindingOverrides": {},
562+ "fullScopeAllowed": false,
563+ "nodeReRegistrationTimeout": 0,
564+ "defaultClientScopes": [
565+ "web-origins",
566+ "role_list",
567+ "roles",
568+ "profile",
569+ "email"
570+ ],
571+ "optionalClientScopes": [
572+ "address",
573+ "phone",
574+ "offline_access",
575+ "microprofile-jwt"
576+ ]
577+ },
578+ {
579+ "id": "380985f1-61c7-4940-93ae-7a09458071ca",
580+ "clientId": "broker",
581+ "name": "${client_broker}",
582+ "surrogateAuthRequired": false,
583+ "enabled": true,
584+ "alwaysDisplayInConsole": false,
585+ "clientAuthenticatorType": "client-secret",
586+ "secret": "65d2ba2b-bcae-49ff-9f56-77c818f55930",
587+ "redirectUris": [],
588+ "webOrigins": [],
589+ "notBefore": 0,
590+ "bearerOnly": false,
591+ "consentRequired": false,
592+ "standardFlowEnabled": true,
593+ "implicitFlowEnabled": false,
594+ "directAccessGrantsEnabled": false,
595+ "serviceAccountsEnabled": false,
596+ "publicClient": false,
597+ "frontchannelLogout": false,
598+ "protocol": "openid-connect",
599+ "attributes": {},
600+ "authenticationFlowBindingOverrides": {},
601+ "fullScopeAllowed": false,
602+ "nodeReRegistrationTimeout": 0,
603+ "defaultClientScopes": [
604+ "web-origins",
605+ "role_list",
606+ "roles",
607+ "profile",
608+ "email"
609+ ],
610+ "optionalClientScopes": [
611+ "address",
612+ "phone",
613+ "offline_access",
614+ "microprofile-jwt"
615+ ]
616+ },
617+ {
618+ "id": "7174c175-1887-4e57-b95b-969fe040deff",
619+ "clientId": "oauth2-proxy-realm",
620+ "name": "oauth2-proxy Realm",
621+ "surrogateAuthRequired": false,
622+ "enabled": true,
623+ "alwaysDisplayInConsole": false,
624+ "clientAuthenticatorType": "client-secret",
625+ "secret": "40f73851-a94c-4091-90de-aeee8ca1acf8",
626+ "redirectUris": [],
627+ "webOrigins": [],
628+ "notBefore": 0,
629+ "bearerOnly": true,
630+ "consentRequired": false,
631+ "standardFlowEnabled": true,
632+ "implicitFlowEnabled": false,
633+ "directAccessGrantsEnabled": false,
634+ "serviceAccountsEnabled": false,
635+ "publicClient": false,
636+ "frontchannelLogout": false,
637+ "attributes": {},
638+ "authenticationFlowBindingOverrides": {},
639+ "fullScopeAllowed": true,
640+ "nodeReRegistrationTimeout": 0,
641+ "defaultClientScopes": [
642+ "web-origins",
643+ "role_list",
644+ "roles",
645+ "profile",
646+ "email"
647+ ],
648+ "optionalClientScopes": [
649+ "address",
650+ "phone",
651+ "offline_access",
652+ "microprofile-jwt"
653+ ]
654+ },
655+ {
656+ "id": "0493c7c6-6e20-49ea-9acb-627c0b52d400",
657+ "clientId": "oauth2-proxy",
658+ "surrogateAuthRequired": false,
659+ "enabled": true,
660+ "alwaysDisplayInConsole": false,
661+ "clientAuthenticatorType": "client-secret",
662+ "secret": "72341b6d-7065-4518-a0e4-50ee15025608",
663+ "redirectUris": [
664+ "http://oauth2-proxy.localtest.me:4180/oauth2/callback"
665+ ],
666+ "webOrigins": [],
667+ "notBefore": 0,
668+ "bearerOnly": false,
669+ "consentRequired": false,
670+ "standardFlowEnabled": true,
671+ "implicitFlowEnabled": false,
672+ "directAccessGrantsEnabled": true,
673+ "serviceAccountsEnabled": false,
674+ "publicClient": false,
675+ "frontchannelLogout": false,
676+ "protocol": "openid-connect",
677+ "attributes": {
678+ "saml.assertion.signature": "false",
679+ "saml.force.post.binding": "false",
680+ "saml.multivalued.roles": "false",
681+ "saml.encrypt": "false",
682+ "saml.server.signature": "false",
683+ "saml.server.signature.keyinfo.ext": "false",
684+ "exclude.session.state.from.auth.response": "false",
685+ "saml_force_name_id_format": "false",
686+ "saml.client.signature": "false",
687+ "tls.client.certificate.bound.access.tokens": "false",
688+ "saml.authnstatement": "false",
689+ "display.on.consent.screen": "false",
690+ "saml.onetimeuse.condition": "false"
691+ },
692+ "authenticationFlowBindingOverrides": {},
693+ "fullScopeAllowed": true,
694+ "nodeReRegistrationTimeout": -1,
695+ "defaultClientScopes": [
696+ "web-origins",
697+ "role_list",
698+ "roles",
699+ "profile",
700+ "email"
701+ ],
702+ "optionalClientScopes": [
703+ "address",
704+ "phone",
705+ "offline_access",
706+ "microprofile-jwt"
707+ ]
708+ },
709+ {
710+ "id": "2a3ad1fd-a30d-4b72-89c4-bed12f178338",
711+ "clientId": "security-admin-console",
712+ "name": "${client_security-admin-console}",
713+ "rootUrl": "${authAdminUrl}",
714+ "baseUrl": "/admin/oauth2-proxy/console/",
715+ "surrogateAuthRequired": false,
716+ "enabled": true,
717+ "alwaysDisplayInConsole": false,
718+ "clientAuthenticatorType": "client-secret",
719+ "secret": "b234b7aa-8417-410f-b3fd-c57434d3aa4a",
720+ "redirectUris": [
721+ "/admin/oauth2-proxy/console/*"
722+ ],
723+ "webOrigins": [
724+ "+"
725+ ],
726+ "notBefore": 0,
727+ "bearerOnly": false,
728+ "consentRequired": false,
729+ "standardFlowEnabled": true,
730+ "implicitFlowEnabled": false,
731+ "directAccessGrantsEnabled": false,
732+ "serviceAccountsEnabled": false,
733+ "publicClient": true,
734+ "frontchannelLogout": false,
735+ "protocol": "openid-connect",
736+ "attributes": {
737+ "pkce.code.challenge.method": "S256"
738+ },
739+ "authenticationFlowBindingOverrides": {},
740+ "fullScopeAllowed": false,
741+ "nodeReRegistrationTimeout": 0,
742+ "protocolMappers": [
743+ {
744+ "id": "5885b0d3-a917-4b52-8380-f37d0754a2ef",
745+ "name": "locale",
746+ "protocol": "openid-connect",
747+ "protocolMapper": "oidc-usermodel-attribute-mapper",
748+ "consentRequired": false,
749+ "config": {
750+ "userinfo.token.claim": "true",
751+ "user.attribute": "locale",
752+ "id.token.claim": "true",
753+ "access.token.claim": "true",
754+ "claim.name": "locale",
755+ "jsonType.label": "String"
756+ }
757+ }
758+ ],
759+ "defaultClientScopes": [
760+ "web-origins",
761+ "role_list",
762+ "roles",
763+ "profile",
764+ "email"
765+ ],
766+ "optionalClientScopes": [
767+ "address",
768+ "phone",
769+ "offline_access",
770+ "microprofile-jwt"
771+ ]
772+ }
773+ ],
774+ "clientScopes": [
775+ {
776+ "id": "47ea3b67-4f0c-4c7e-8ac6-a33a3d655894",
777+ "name": "address",
778+ "description": "OpenID Connect built-in scope: address",
779+ "protocol": "openid-connect",
780+ "attributes": {
781+ "include.in.token.scope": "true",
782+ "display.on.consent.screen": "true",
783+ "consent.screen.text": "${addressScopeConsentText}"
784+ },
785+ "protocolMappers": [
786+ {
787+ "id": "4be0ca19-0ec7-4cc1-b263-845ea539ff12",
788+ "name": "address",
789+ "protocol": "openid-connect",
790+ "protocolMapper": "oidc-address-mapper",
791+ "consentRequired": false,
792+ "config": {
793+ "user.attribute.formatted": "formatted",
794+ "user.attribute.country": "country",
795+ "user.attribute.postal_code": "postal_code",
796+ "userinfo.token.claim": "true",
797+ "user.attribute.street": "street",
798+ "id.token.claim": "true",
799+ "user.attribute.region": "region",
800+ "access.token.claim": "true",
801+ "user.attribute.locality": "locality"
802+ }
803+ }
804+ ]
805+ },
806+ {
807+ "id": "aba72e57-540f-4825-95b7-2d143be028cc",
808+ "name": "email",
809+ "description": "OpenID Connect built-in scope: email",
810+ "protocol": "openid-connect",
811+ "attributes": {
812+ "include.in.token.scope": "true",
813+ "display.on.consent.screen": "true",
814+ "consent.screen.text": "${emailScopeConsentText}"
815+ },
816+ "protocolMappers": [
817+ {
818+ "id": "7fe82724-5748-4b6d-9708-a028f5d3b970",
819+ "name": "email verified",
820+ "protocol": "openid-connect",
821+ "protocolMapper": "oidc-usermodel-property-mapper",
822+ "consentRequired": false,
823+ "config": {
824+ "userinfo.token.claim": "true",
825+ "user.attribute": "emailVerified",
826+ "id.token.claim": "true",
827+ "access.token.claim": "true",
828+ "claim.name": "email_verified",
829+ "jsonType.label": "boolean"
830+ }
831+ },
832+ {
833+ "id": "e42f334e-cfae-44a0-905d-c3ef215feaae",
834+ "name": "email",
835+ "protocol": "openid-connect",
836+ "protocolMapper": "oidc-usermodel-property-mapper",
837+ "consentRequired": false,
838+ "config": {
839+ "userinfo.token.claim": "true",
840+ "user.attribute": "email",
841+ "id.token.claim": "true",
842+ "access.token.claim": "true",
843+ "claim.name": "email",
844+ "jsonType.label": "String"
845+ }
846+ }
847+ ]
848+ },
849+ {
850+ "id": "ec765598-bd71-4318-86c3-b3f81a41c99e",
851+ "name": "microprofile-jwt",
852+ "description": "Microprofile - JWT built-in scope",
853+ "protocol": "openid-connect",
854+ "attributes": {
855+ "include.in.token.scope": "true",
856+ "display.on.consent.screen": "false"
857+ },
858+ "protocolMappers": [
859+ {
860+ "id": "90694036-4014-4672-a2c8-c68319e9308a",
861+ "name": "upn",
862+ "protocol": "openid-connect",
863+ "protocolMapper": "oidc-usermodel-property-mapper",
864+ "consentRequired": false,
865+ "config": {
866+ "userinfo.token.claim": "true",
867+ "user.attribute": "username",
868+ "id.token.claim": "true",
869+ "access.token.claim": "true",
870+ "claim.name": "upn",
871+ "jsonType.label": "String"
872+ }
873+ },
874+ {
875+ "id": "f7b0fcc0-6139-4158-ac45-34fd9a58a5ef",
876+ "name": "groups",
877+ "protocol": "openid-connect",
878+ "protocolMapper": "oidc-usermodel-realm-role-mapper",
879+ "consentRequired": false,
880+ "config": {
881+ "multivalued": "true",
882+ "user.attribute": "foo",
883+ "id.token.claim": "true",
884+ "access.token.claim": "true",
885+ "claim.name": "groups",
886+ "jsonType.label": "String"
887+ }
888+ }
889+ ]
890+ },
891+ {
892+ "id": "8a09267b-3634-4a9c-baab-6f2fb4137347",
893+ "name": "offline_access",
894+ "description": "OpenID Connect built-in scope: offline_access",
895+ "protocol": "openid-connect",
896+ "attributes": {
897+ "consent.screen.text": "${offlineAccessScopeConsentText}",
898+ "display.on.consent.screen": "true"
899+ }
900+ },
901+ {
902+ "id": "3a48c5dd-33a8-4be0-9d2e-30fd7f98363a",
903+ "name": "phone",
904+ "description": "OpenID Connect built-in scope: phone",
905+ "protocol": "openid-connect",
906+ "attributes": {
907+ "include.in.token.scope": "true",
908+ "display.on.consent.screen": "true",
909+ "consent.screen.text": "${phoneScopeConsentText}"
910+ },
911+ "protocolMappers": [
912+ {
913+ "id": "5427d1b4-ba79-412a-b23c-da640a98980c",
914+ "name": "phone number",
915+ "protocol": "openid-connect",
916+ "protocolMapper": "oidc-usermodel-attribute-mapper",
917+ "consentRequired": false,
918+ "config": {
919+ "userinfo.token.claim": "true",
920+ "user.attribute": "phoneNumber",
921+ "id.token.claim": "true",
922+ "access.token.claim": "true",
923+ "claim.name": "phone_number",
924+ "jsonType.label": "String"
925+ }
926+ },
927+ {
928+ "id": "31d4a53f-6503-40e8-bd9d-79a7c46c4fbe",
929+ "name": "phone number verified",
930+ "protocol": "openid-connect",
931+ "protocolMapper": "oidc-usermodel-attribute-mapper",
932+ "consentRequired": false,
933+ "config": {
934+ "userinfo.token.claim": "true",
935+ "user.attribute": "phoneNumberVerified",
936+ "id.token.claim": "true",
937+ "access.token.claim": "true",
938+ "claim.name": "phone_number_verified",
939+ "jsonType.label": "boolean"
940+ }
941+ }
942+ ]
943+ },
944+ {
945+ "id": "5921a9e9-7fec-4471-95e3-dd96eebdec58",
946+ "name": "profile",
947+ "description": "OpenID Connect built-in scope: profile",
948+ "protocol": "openid-connect",
949+ "attributes": {
950+ "include.in.token.scope": "true",
951+ "display.on.consent.screen": "true",
952+ "consent.screen.text": "${profileScopeConsentText}"
953+ },
954+ "protocolMappers": [
955+ {
956+ "id": "4fa92092-ee0d-4dc7-a63b-1e3b02d35ebb",
957+ "name": "zoneinfo",
958+ "protocol": "openid-connect",
959+ "protocolMapper": "oidc-usermodel-attribute-mapper",
960+ "consentRequired": false,
961+ "config": {
962+ "userinfo.token.claim": "true",
963+ "user.attribute": "zoneinfo",
964+ "id.token.claim": "true",
965+ "access.token.claim": "true",
966+ "claim.name": "zoneinfo",
967+ "jsonType.label": "String"
968+ }
969+ },
970+ {
971+ "id": "1a5cc2e2-c983-4150-8583-23a7f5c826bf",
972+ "name": "family name",
973+ "protocol": "openid-connect",
974+ "protocolMapper": "oidc-usermodel-property-mapper",
975+ "consentRequired": false,
976+ "config": {
977+ "userinfo.token.claim": "true",
978+ "user.attribute": "lastName",
979+ "id.token.claim": "true",
980+ "access.token.claim": "true",
981+ "claim.name": "family_name",
982+ "jsonType.label": "String"
983+ }
984+ },
985+ {
986+ "id": "67931f77-722a-492d-b581-a953e26b7d44",
987+ "name": "full name",
988+ "protocol": "openid-connect",
989+ "protocolMapper": "oidc-full-name-mapper",
990+ "consentRequired": false,
991+ "config": {
992+ "id.token.claim": "true",
993+ "access.token.claim": "true",
994+ "userinfo.token.claim": "true"
995+ }
996+ },
997+ {
998+ "id": "10f6ac36-3a63-4e1c-ac69-c095588f5967",
999+ "name": "locale",
1000+ "protocol": "openid-connect",
1001+ "protocolMapper": "oidc-usermodel-attribute-mapper",
1002+ "consentRequired": false,
1003+ "config": {
1004+ "userinfo.token.claim": "true",
1005+ "user.attribute": "locale",
1006+ "id.token.claim": "true",
1007+ "access.token.claim": "true",
1008+ "claim.name": "locale",
1009+ "jsonType.label": "String"
1010+ }
1011+ },
1012+ {
1013+ "id": "205d9dce-b6c8-4b1d-9c9c-fa24788651cf",
1014+ "name": "picture",
1015+ "protocol": "openid-connect",
1016+ "protocolMapper": "oidc-usermodel-attribute-mapper",
1017+ "consentRequired": false,
1018+ "config": {
1019+ "userinfo.token.claim": "true",
1020+ "user.attribute": "picture",
1021+ "id.token.claim": "true",
1022+ "access.token.claim": "true",
1023+ "claim.name": "picture",
1024+ "jsonType.label": "String"
1025+ }
1026+ },
1027+ {
1028+ "id": "638216c8-ea8c-40e3-9429-771e9278920e",
1029+ "name": "gender",
1030+ "protocol": "openid-connect",
1031+ "protocolMapper": "oidc-usermodel-attribute-mapper",
1032+ "consentRequired": false,
1033+ "config": {
1034+ "userinfo.token.claim": "true",
1035+ "user.attribute": "gender",
1036+ "id.token.claim": "true",
1037+ "access.token.claim": "true",
1038+ "claim.name": "gender",
1039+ "jsonType.label": "String"
1040+ }
1041+ },
1042+ {
1043+ "id": "39c17eae-8ea7-422c-ae21-b8876bf12184",
1044+ "name": "birthdate",
1045+ "protocol": "openid-connect",
1046+ "protocolMapper": "oidc-usermodel-attribute-mapper",
1047+ "consentRequired": false,
1048+ "config": {
1049+ "userinfo.token.claim": "true",
1050+ "user.attribute": "birthdate",
1051+ "id.token.claim": "true",
1052+ "access.token.claim": "true",
1053+ "claim.name": "birthdate",
1054+ "jsonType.label": "String"
1055+ }
1056+ },
1057+ {
1058+ "id": "01c559cf-94f2-46ad-b965-3b2e1db1a2a6",
1059+ "name": "updated at",
1060+ "protocol": "openid-connect",
1061+ "protocolMapper": "oidc-usermodel-attribute-mapper",
1062+ "consentRequired": false,
1063+ "config": {
1064+ "userinfo.token.claim": "true",
1065+ "user.attribute": "updatedAt",
1066+ "id.token.claim": "true",
1067+ "access.token.claim": "true",
1068+ "claim.name": "updated_at",
1069+ "jsonType.label": "String"
1070+ }
1071+ },
1072+ {
1073+ "id": "1693b5ab-28eb-485d-835d-2ae070ccb3ba",
1074+ "name": "profile",
1075+ "protocol": "openid-connect",
1076+ "protocolMapper": "oidc-usermodel-attribute-mapper",
1077+ "consentRequired": false,
1078+ "config": {
1079+ "userinfo.token.claim": "true",
1080+ "user.attribute": "profile",
1081+ "id.token.claim": "true",
1082+ "access.token.claim": "true",
1083+ "claim.name": "profile",
1084+ "jsonType.label": "String"
1085+ }
1086+ },
1087+ {
1088+ "id": "a0e08332-954c-46d2-9795-56eb31132580",
1089+ "name": "given name",
1090+ "protocol": "openid-connect",
1091+ "protocolMapper": "oidc-usermodel-property-mapper",
1092+ "consentRequired": false,
1093+ "config": {
1094+ "userinfo.token.claim": "true",
1095+ "user.attribute": "firstName",
1096+ "id.token.claim": "true",
1097+ "access.token.claim": "true",
1098+ "claim.name": "given_name",
1099+ "jsonType.label": "String"
1100+ }
1101+ },
1102+ {
1103+ "id": "cea0cd9c-d085-4d19-acc3-4bb41c891b68",
1104+ "name": "nickname",
1105+ "protocol": "openid-connect",
1106+ "protocolMapper": "oidc-usermodel-attribute-mapper",
1107+ "consentRequired": false,
1108+ "config": {
1109+ "userinfo.token.claim": "true",
1110+ "user.attribute": "nickname",
1111+ "id.token.claim": "true",
1112+ "access.token.claim": "true",
1113+ "claim.name": "nickname",
1114+ "jsonType.label": "String"
1115+ }
1116+ },
1117+ {
1118+ "id": "3122097d-4cba-46c2-8b3b-5d87a4cc605e",
1119+ "name": "middle name",
1120+ "protocol": "openid-connect",
1121+ "protocolMapper": "oidc-usermodel-attribute-mapper",
1122+ "consentRequired": false,
1123+ "config": {
1124+ "userinfo.token.claim": "true",
1125+ "user.attribute": "middleName",
1126+ "id.token.claim": "true",
1127+ "access.token.claim": "true",
1128+ "claim.name": "middle_name",
1129+ "jsonType.label": "String"
1130+ }
1131+ },
1132+ {
1133+ "id": "a3b97897-d913-4e0a-a4cf-033ce78f7d24",
1134+ "name": "username",
1135+ "protocol": "openid-connect",
1136+ "protocolMapper": "oidc-usermodel-property-mapper",
1137+ "consentRequired": false,
1138+ "config": {
1139+ "userinfo.token.claim": "true",
1140+ "user.attribute": "username",
1141+ "id.token.claim": "true",
1142+ "access.token.claim": "true",
1143+ "claim.name": "preferred_username",
1144+ "jsonType.label": "String"
1145+ }
1146+ },
1147+ {
1148+ "id": "a44eeb9d-410d-49c5-b0e0-5d84787627ad",
1149+ "name": "website",
1150+ "protocol": "openid-connect",
1151+ "protocolMapper": "oidc-usermodel-attribute-mapper",
1152+ "consentRequired": false,
1153+ "config": {
1154+ "userinfo.token.claim": "true",
1155+ "user.attribute": "website",
1156+ "id.token.claim": "true",
1157+ "access.token.claim": "true",
1158+ "claim.name": "website",
1159+ "jsonType.label": "String"
1160+ }
1161+ }
1162+ ]
1163+ },
1164+ {
1165+ "id": "651408a7-6704-4198-a60f-988821b633ea",
1166+ "name": "role_list",
1167+ "description": "SAML role list",
1168+ "protocol": "saml",
1169+ "attributes": {
1170+ "consent.screen.text": "${samlRoleListScopeConsentText}",
1171+ "display.on.consent.screen": "true"
1172+ },
1173+ "protocolMappers": [
1174+ {
1175+ "id": "a8c56c7b-ccbc-4b01-8df5-3ecb6328755f",
1176+ "name": "role list",
1177+ "protocol": "saml",
1178+ "protocolMapper": "saml-role-list-mapper",
1179+ "consentRequired": false,
1180+ "config": {
1181+ "single": "false",
1182+ "attribute.nameformat": "Basic",
1183+ "attribute.name": "Role"
1184+ }
1185+ }
1186+ ]
1187+ },
1188+ {
1189+ "id": "13ec0fd3-e64a-4d6f-9be7-c8760f2c9d6b",
1190+ "name": "roles",
1191+ "description": "OpenID Connect scope for add user roles to the access token",
1192+ "protocol": "openid-connect",
1193+ "attributes": {
1194+ "include.in.token.scope": "false",
1195+ "display.on.consent.screen": "true",
1196+ "consent.screen.text": "${rolesScopeConsentText}"
1197+ },
1198+ "protocolMappers": [
1199+ {
1200+ "id": "75e741f8-dcd5-49d2-815e-8604ec1d08a1",
1201+ "name": "realm roles",
1202+ "protocol": "openid-connect",
1203+ "protocolMapper": "oidc-usermodel-realm-role-mapper",
1204+ "consentRequired": false,
1205+ "config": {
1206+ "user.attribute": "foo",
1207+ "access.token.claim": "true",
1208+ "claim.name": "realm_access.roles",
1209+ "jsonType.label": "String",
1210+ "multivalued": "true"
1211+ }
1212+ },
1213+ {
1214+ "id": "06a2d506-4996-4a33-8c43-2cf64af6a630",
1215+ "name": "client roles",
1216+ "protocol": "openid-connect",
1217+ "protocolMapper": "oidc-usermodel-client-role-mapper",
1218+ "consentRequired": false,
1219+ "config": {
1220+ "user.attribute": "foo",
1221+ "access.token.claim": "true",
1222+ "claim.name": "resource_access.${client_id}.roles",
1223+ "jsonType.label": "String",
1224+ "multivalued": "true"
1225+ }
1226+ },
1227+ {
1228+ "id": "3c3470df-d414-4e1c-87fc-3fb3cea34b8d",
1229+ "name": "audience resolve",
1230+ "protocol": "openid-connect",
1231+ "protocolMapper": "oidc-audience-resolve-mapper",
1232+ "consentRequired": false,
1233+ "config": {}
1234+ }
1235+ ]
1236+ },
1237+ {
1238+ "id": "d85aba25-c74b-49e3-9ccb-77b4bb16efa5",
1239+ "name": "web-origins",
1240+ "description": "OpenID Connect scope for add allowed web origins to the access token",
1241+ "protocol": "openid-connect",
1242+ "attributes": {
1243+ "include.in.token.scope": "false",
1244+ "display.on.consent.screen": "false",
1245+ "consent.screen.text": ""
1246+ },
1247+ "protocolMappers": [
1248+ {
1249+ "id": "86b3f64f-1525-4500-bcbc-9b889b25f995",
1250+ "name": "allowed web origins",
1251+ "protocol": "openid-connect",
1252+ "protocolMapper": "oidc-allowed-origins-mapper",
1253+ "consentRequired": false,
1254+ "config": {}
1255+ }
1256+ ]
1257+ }
1258+ ],
1259+ "defaultDefaultClientScopes": [
1260+ "roles",
1261+ "profile",
1262+ "role_list",
1263+ "email",
1264+ "web-origins"
1265+ ],
1266+ "defaultOptionalClientScopes": [
1267+ "phone",
1268+ "address",
1269+ "offline_access",
1270+ "microprofile-jwt"
1271+ ],
1272+ "browserSecurityHeaders": {
1273+ "contentSecurityPolicyReportOnly": "",
1274+ "xContentTypeOptions": "nosniff",
1275+ "xRobotsTag": "none",
1276+ "xFrameOptions": "SAMEORIGIN",
1277+ "xXSSProtection": "1; mode=block",
1278+ "contentSecurityPolicy": "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
1279+ "strictTransportSecurity": "max-age=31536000; includeSubDomains"
1280+ },
1281+ "smtpServer": {},
1282+ "eventsEnabled": false,
1283+ "eventsListeners": [
1284+ "jboss-logging"
1285+ ],
1286+ "enabledEventTypes": [],
1287+ "adminEventsEnabled": false,
1288+ "adminEventsDetailsEnabled": false,
1289+ "components": {
1290+ "org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy": [
1291+ {
1292+ "id": "59048b39-ad0f-4d12-8c52-7cfc2c43278a",
1293+ "name": "Allowed Protocol Mapper Types",
1294+ "providerId": "allowed-protocol-mappers",
1295+ "subType": "authenticated",
1296+ "subComponents": {},
1297+ "config": {
1298+ "allowed-protocol-mapper-types": [
1299+ "saml-user-attribute-mapper",
1300+ "oidc-full-name-mapper",
1301+ "oidc-sha256-pairwise-sub-mapper",
1302+ "saml-user-property-mapper",
1303+ "saml-role-list-mapper",
1304+ "oidc-address-mapper",
1305+ "oidc-usermodel-attribute-mapper",
1306+ "oidc-usermodel-property-mapper"
1307+ ]
1308+ }
1309+ },
1310+ {
1311+ "id": "760559a6-a59f-4175-9ac5-6f3612e20129",
1312+ "name": "Trusted Hosts",
1313+ "providerId": "trusted-hosts",
1314+ "subType": "anonymous",
1315+ "subComponents": {},
1316+ "config": {
1317+ "host-sending-registration-request-must-match": [
1318+ "true"
1319+ ],
1320+ "client-uris-must-match": [
1321+ "true"
1322+ ]
1323+ }
1324+ },
1325+ {
1326+ "id": "24f4cb42-76bd-499e-812a-4e0d270c9e13",
1327+ "name": "Full Scope Disabled",
1328+ "providerId": "scope",
1329+ "subType": "anonymous",
1330+ "subComponents": {},
1331+ "config": {}
1332+ },
1333+ {
1334+ "id": "abbfc599-480a-44ef-8e33-73a83eaab166",
1335+ "name": "Allowed Protocol Mapper Types",
1336+ "providerId": "allowed-protocol-mappers",
1337+ "subType": "anonymous",
1338+ "subComponents": {},
1339+ "config": {
1340+ "allowed-protocol-mapper-types": [
1341+ "saml-user-attribute-mapper",
1342+ "oidc-sha256-pairwise-sub-mapper",
1343+ "oidc-full-name-mapper",
1344+ "saml-role-list-mapper",
1345+ "saml-user-property-mapper",
1346+ "oidc-usermodel-property-mapper",
1347+ "oidc-usermodel-attribute-mapper",
1348+ "oidc-address-mapper"
1349+ ]
1350+ }
1351+ },
1352+ {
1353+ "id": "3c6450f0-4521-402b-a247-c8165854b1fa",
1354+ "name": "Allowed Client Scopes",
1355+ "providerId": "allowed-client-templates",
1356+ "subType": "anonymous",
1357+ "subComponents": {},
1358+ "config": {
1359+ "allow-default-scopes": [
1360+ "true"
1361+ ]
1362+ }
1363+ },
1364+ {
1365+ "id": "d9b64399-744b-498e-9d35-f68b1582bd7d",
1366+ "name": "Consent Required",
1367+ "providerId": "consent-required",
1368+ "subType": "anonymous",
1369+ "subComponents": {},
1370+ "config": {}
1371+ },
1372+ {
1373+ "id": "22f15f1f-3116-4348-a1e5-fc0d7576452a",
1374+ "name": "Max Clients Limit",
1375+ "providerId": "max-clients",
1376+ "subType": "anonymous",
1377+ "subComponents": {},
1378+ "config": {
1379+ "max-clients": [
1380+ "200"
1381+ ]
1382+ }
1383+ },
1384+ {
1385+ "id": "4ad7b291-ddbb-4674-8c3d-ab8fd76d4168",
1386+ "name": "Allowed Client Scopes",
1387+ "providerId": "allowed-client-templates",
1388+ "subType": "authenticated",
1389+ "subComponents": {},
1390+ "config": {
1391+ "allow-default-scopes": [
1392+ "true"
1393+ ]
1394+ }
1395+ }
1396+ ],
1397+ "org.keycloak.keys.KeyProvider": [
1398+ {
1399+ "id": "f71cc325-9907-4d27-a0e6-88fca7450e5e",
1400+ "name": "aes-generated",
1401+ "providerId": "aes-generated",
1402+ "subComponents": {},
1403+ "config": {
1404+ "kid": [
1405+ "6c7d982e-372f-49c6-a4f3-5c451fb85eca"
1406+ ],
1407+ "secret": [
1408+ "yH6M3W7aOgh2_cKJ0srWbw"
1409+ ],
1410+ "priority": [
1411+ "100"
1412+ ]
1413+ }
1414+ },
1415+ {
1416+ "id": "7b50d0ab-dda5-4624-aa42-b4b397724ce1",
1417+ "name": "hmac-generated",
1418+ "providerId": "hmac-generated",
1419+ "subComponents": {},
1420+ "config": {
1421+ "kid": [
1422+ "587f0fb5-845d-4b45-87a0-84145092aaef"
1423+ ],
1424+ "secret": [
1425+ "PuH8Lxh9GeNfGJRDk34SWIlBDdrJpC3U3SfcxqqQtlIf2DBzRKUu8VbDVrmMN5b5CoPsJhrQ2SVb-iE9Lzsb3A"
1426+ ],
1427+ "priority": [
1428+ "100"
1429+ ],
1430+ "algorithm": [
1431+ "HS256"
1432+ ]
1433+ }
1434+ },
1435+ {
1436+ "id": "547c1c71-9f97-4e12-801b-ed5c2cc61bba",
1437+ "name": "rsa-generated",
1438+ "providerId": "rsa-generated",
1439+ "subComponents": {},
1440+ "config": {
1441+ "privateKey": [
1442+ "MIIEowIBAAKCAQEAjdo2HZ5ruNnIbkSeAfFYpbPvJw3vtz/VuKJerC4mUXYd7qRMhs3VLJZ3mFyeCuO8W81vkGrFiC9KQnX2lHj2dtA/RWEJw5bpz+JdOFr5pvXg0lQ0sa+hro9afWDygTU4FmLsEi5z98847TbH178RT6n7+JVqZ9jYU9rSpwVTC8E/4yxSuStmhGCcAkZ6dGhHNBdvGUgwxKYj7dYLRJiI+nilIdKuxPzxI/YZxZnXBHDdbNXJgDymTQPut99OnBxeZbH38CJ1MNo3VdV1fzOMGUHe+vn/EOD5E+pXC8PwvJnWU+XHUTFVZeyIXehh3pYLUsq/6bZ1MYsEaFIhznOkwwIDAQABAoIBAHB+64fVyUxRurhoRn737fuLlU/9p2xGfbHtYvNdrhnQeLB3MBGAT10K/1Gfsd6k+Q49AAsiAgGcr2HBt4nL3HohcOwOpvWsS0UIGjHFRFP6jw9+pEN+K9UJ7xObvPZnRFHMpbdNi76tYlINrbMV3h61ihR8OmSc/gKSeZjnihK5OkaNnlqGRaBM/koI+iAxUHuJPnBLBZmD4T8eIfE4S2TvUeVeQogI9Muvnb9tIPJ5XyP9iXWLdRjnek/+wTdxHHZuo06Tc0bMjRaTHiF6K9ntOM2EmQb6bS2J47zgzRLNFE22BWH7RJq659EzElkOn0C0k7dWDTur/3Lpx1+zxJECgYEA8t+J3J+9oGTFmY2VPH05Yr/R/iVDOyIOlO1CmgonOQ3KPhbfNBB3aTAJP20LOZChN4JoWuiZJg4UwzXOeY9DvdDkPO0YLlSjPAIwJNk+xcxFcp5hqMUul2db+cgEY8zp0Wg9kFOq3JmJjK4+1+fgsVnOB+B08ZYI6bZzsUVKzucCgYEAlYTrsxs6fQua0cvZNQPYNZzwF3LVwPBl/ntkdRBE3HGyZeCAhIj7e9pAUusCPsQJaCmW2UEmywD/aIxGrBkojzTKItshM3PN1PYKL8W0Zq+H67uF5KfdvsbabZWHfP/LGCpoKF8Ov7JVPPqGrZ03Z2SheeLZAtNeHN4OB1u9i8UCgYATkS7qN3Rvl67T0DRVy0D0U7/3Wckw2m2SUgsrneXLEvFYTz9sUmdMcjJMidx9pslWT4tYx6SPDFNf5tXbtU8f29SHlBJ+qRL9oq9+SIJmLS7rLRdxIXG/gPRIC3VPFRNBa8SJ/DOn0jbivqcRffz8TN/sgojpbc0KB0kK3ypHwQKBgCKVCcb1R0PgyUA4+9YNO5a647UotFPZxl1jwMpqpuKt0WtKz67X2AK/ah1DidNmmB5lcCRzsztE0c4mk7n+X6kvtoj1UeqKoFLfTV/bRGxzsOZPCxrl0J3tdFvgN+QrbZf7Rvf/dHPWFWzzLO8+66+YUNjWJQdIR/45Rdlh2KdZAoGBAMfF3ir+fe3KdQ6hAf9QyrLxJ5l+GO+IgtxXGbon7eeJBIZHHdMeDy4pC7DMcI214BmIntbyY+xS+gI3oM26EJUVmrZ6tkyIDFsCHm9rcXG9ogvffzQWM1Wqzm27hR/3s+EPWW9AOcIimiFV1UPp/mLjnrCuq58V2aJS/TT14oLe"
1443+ ],
1444+ "certificate": [
1445+ "MIICmzCCAYMCBgFygL/j4DANBgkqhkiG9w0BAQsFADARMQ8wDQYDVQQDDAZtYXN0ZXIwHhcNMjAwNjA0MTkxMDU4WhcNMzAwNjA0MTkxMjM4WjARMQ8wDQYDVQQDDAZtYXN0ZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCN2jYdnmu42chuRJ4B8Vils+8nDe+3P9W4ol6sLiZRdh3upEyGzdUslneYXJ4K47xbzW+QasWIL0pCdfaUePZ20D9FYQnDlunP4l04Wvmm9eDSVDSxr6Guj1p9YPKBNTgWYuwSLnP3zzjtNsfXvxFPqfv4lWpn2NhT2tKnBVMLwT/jLFK5K2aEYJwCRnp0aEc0F28ZSDDEpiPt1gtEmIj6eKUh0q7E/PEj9hnFmdcEcN1s1cmAPKZNA+63306cHF5lsffwInUw2jdV1XV/M4wZQd76+f8Q4PkT6lcLw/C8mdZT5cdRMVVl7Ihd6GHelgtSyr/ptnUxiwRoUiHOc6TDAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAIAqydMYxa51kNEyfXyR2kStlglE4LDeLBLHDABeBPE0eN2awoH/mw3kXS4OA/C0e3c7bAwViOzOVERGeUNiBvP5rL1Amuu97nwFcxhkTaJH4ZwCGkxceaIo9LNDpAEesqHLQSdplFXIA4TbEFoKMem4k31KVU7i9/rUesrSRmxLptIOK7LLvRMYiY/t7tdAvoZAtoliuQlFKQywEuxXQrCkcoVEAARABWGt0rsWC2xK0tVxHRIrENwvMp/aUYd17sZ0403aaS9dlvfQ63ExnaHd+++RJtPku8P220Tw27YVmFAwzJgS0aUpEaDsgRNz6OMSyxEg/n7eKK08aU3szwQ="
1446+ ],
1447+ "priority": [
1448+ "100"
1449+ ]
1450+ }
1451+ }
1452+ ]
1453+ },
1454+ "internationalizationEnabled": false,
1455+ "supportedLocales": [],
1456+ "authenticationFlows": [
1457+ {
1458+ "id": "3253f9b7-905d-4458-ad8a-8ada5e16d195",
1459+ "alias": "Account verification options",
1460+ "description": "Method with which to verity the existing account",
1461+ "providerId": "basic-flow",
1462+ "topLevel": false,
1463+ "builtIn": true,
1464+ "authenticationExecutions": [
1465+ {
1466+ "authenticator": "idp-email-verification",
1467+ "requirement": "ALTERNATIVE",
1468+ "priority": 10,
1469+ "userSetupAllowed": false,
1470+ "autheticatorFlow": false
1471+ },
1472+ {
1473+ "requirement": "ALTERNATIVE",
1474+ "priority": 20,
1475+ "flowAlias": "Verify Existing Account by Re-authentication",
1476+ "userSetupAllowed": false,
1477+ "autheticatorFlow": true
1478+ }
1479+ ]
1480+ },
1481+ {
1482+ "id": "75bd854e-ab99-46f1-90ed-a8bfc1559558",
1483+ "alias": "Authentication Options",
1484+ "description": "Authentication options.",
1485+ "providerId": "basic-flow",
1486+ "topLevel": false,
1487+ "builtIn": true,
1488+ "authenticationExecutions": [
1489+ {
1490+ "authenticator": "basic-auth",
1491+ "requirement": "REQUIRED",
1492+ "priority": 10,
1493+ "userSetupAllowed": false,
1494+ "autheticatorFlow": false
1495+ },
1496+ {
1497+ "authenticator": "basic-auth-otp",
1498+ "requirement": "DISABLED",
1499+ "priority": 20,
1500+ "userSetupAllowed": false,
1501+ "autheticatorFlow": false
1502+ },
1503+ {
1504+ "authenticator": "auth-spnego",
1505+ "requirement": "DISABLED",
1506+ "priority": 30,
1507+ "userSetupAllowed": false,
1508+ "autheticatorFlow": false
1509+ }
1510+ ]
1511+ },
1512+ {
1513+ "id": "9b0e6cce-62c5-4fb6-a48d-e07c950e38c3",
1514+ "alias": "Browser - Conditional OTP",
1515+ "description": "Flow to determine if the OTP is required for the authentication",
1516+ "providerId": "basic-flow",
1517+ "topLevel": false,
1518+ "builtIn": true,
1519+ "authenticationExecutions": [
1520+ {
1521+ "authenticator": "conditional-user-configured",
1522+ "requirement": "REQUIRED",
1523+ "priority": 10,
1524+ "userSetupAllowed": false,
1525+ "autheticatorFlow": false
1526+ },
1527+ {
1528+ "authenticator": "auth-otp-form",
1529+ "requirement": "REQUIRED",
1530+ "priority": 20,
1531+ "userSetupAllowed": false,
1532+ "autheticatorFlow": false
1533+ }
1534+ ]
1535+ },
1536+ {
1537+ "id": "1c26fd14-ac06-4dc1-bdd8-8c34c1b41720",
1538+ "alias": "Direct Grant - Conditional OTP",
1539+ "description": "Flow to determine if the OTP is required for the authentication",
1540+ "providerId": "basic-flow",
1541+ "topLevel": false,
1542+ "builtIn": true,
1543+ "authenticationExecutions": [
1544+ {
1545+ "authenticator": "conditional-user-configured",
1546+ "requirement": "REQUIRED",
1547+ "priority": 10,
1548+ "userSetupAllowed": false,
1549+ "autheticatorFlow": false
1550+ },
1551+ {
1552+ "authenticator": "direct-grant-validate-otp",
1553+ "requirement": "REQUIRED",
1554+ "priority": 20,
1555+ "userSetupAllowed": false,
1556+ "autheticatorFlow": false
1557+ }
1558+ ]
1559+ },
1560+ {
1561+ "id": "254f7549-51ec-4565-a736-35c07b6e25f0",
1562+ "alias": "First broker login - Conditional OTP",
1563+ "description": "Flow to determine if the OTP is required for the authentication",
1564+ "providerId": "basic-flow",
1565+ "topLevel": false,
1566+ "builtIn": true,
1567+ "authenticationExecutions": [
1568+ {
1569+ "authenticator": "conditional-user-configured",
1570+ "requirement": "REQUIRED",
1571+ "priority": 10,
1572+ "userSetupAllowed": false,
1573+ "autheticatorFlow": false
1574+ },
1575+ {
1576+ "authenticator": "auth-otp-form",
1577+ "requirement": "REQUIRED",
1578+ "priority": 20,
1579+ "userSetupAllowed": false,
1580+ "autheticatorFlow": false
1581+ }
1582+ ]
1583+ },
1584+ {
1585+ "id": "b2413da8-3de9-4bfe-b77e-643fd1964c8f",
1586+ "alias": "Handle Existing Account",
1587+ "description": "Handle what to do if there is existing account with same email/username like authenticated identity provider",
1588+ "providerId": "basic-flow",
1589+ "topLevel": false,
1590+ "builtIn": true,
1591+ "authenticationExecutions": [
1592+ {
1593+ "authenticator": "idp-confirm-link",
1594+ "requirement": "REQUIRED",
1595+ "priority": 10,
1596+ "userSetupAllowed": false,
1597+ "autheticatorFlow": false
1598+ },
1599+ {
1600+ "requirement": "REQUIRED",
1601+ "priority": 20,
1602+ "flowAlias": "Account verification options",
1603+ "userSetupAllowed": false,
1604+ "autheticatorFlow": true
1605+ }
1606+ ]
1607+ },
1608+ {
1609+ "id": "f8392bfb-8dce-4a16-8af1-b2a4d1a0a273",
1610+ "alias": "Reset - Conditional OTP",
1611+ "description": "Flow to determine if the OTP should be reset or not. Set to REQUIRED to force.",
1612+ "providerId": "basic-flow",
1613+ "topLevel": false,
1614+ "builtIn": true,
1615+ "authenticationExecutions": [
1616+ {
1617+ "authenticator": "conditional-user-configured",
1618+ "requirement": "REQUIRED",
1619+ "priority": 10,
1620+ "userSetupAllowed": false,
1621+ "autheticatorFlow": false
1622+ },
1623+ {
1624+ "authenticator": "reset-otp",
1625+ "requirement": "REQUIRED",
1626+ "priority": 20,
1627+ "userSetupAllowed": false,
1628+ "autheticatorFlow": false
1629+ }
1630+ ]
1631+ },
1632+ {
1633+ "id": "fb69c297-b26e-44fa-aabd-d7b40eec3cd3",
1634+ "alias": "User creation or linking",
1635+ "description": "Flow for the existing/non-existing user alternatives",
1636+ "providerId": "basic-flow",
1637+ "topLevel": false,
1638+ "builtIn": true,
1639+ "authenticationExecutions": [
1640+ {
1641+ "authenticatorConfig": "create unique user config",
1642+ "authenticator": "idp-create-user-if-unique",
1643+ "requirement": "ALTERNATIVE",
1644+ "priority": 10,
1645+ "userSetupAllowed": false,
1646+ "autheticatorFlow": false
1647+ },
1648+ {
1649+ "requirement": "ALTERNATIVE",
1650+ "priority": 20,
1651+ "flowAlias": "Handle Existing Account",
1652+ "userSetupAllowed": false,
1653+ "autheticatorFlow": true
1654+ }
1655+ ]
1656+ },
1657+ {
1658+ "id": "de3a41a9-7018-4931-9c4d-d04f9501b2ce",
1659+ "alias": "Verify Existing Account by Re-authentication",
1660+ "description": "Reauthentication of existing account",
1661+ "providerId": "basic-flow",
1662+ "topLevel": false,
1663+ "builtIn": true,
1664+ "authenticationExecutions": [
1665+ {
1666+ "authenticator": "idp-username-password-form",
1667+ "requirement": "REQUIRED",
1668+ "priority": 10,
1669+ "userSetupAllowed": false,
1670+ "autheticatorFlow": false
1671+ },
1672+ {
1673+ "requirement": "CONDITIONAL",
1674+ "priority": 20,
1675+ "flowAlias": "First broker login - Conditional OTP",
1676+ "userSetupAllowed": false,
1677+ "autheticatorFlow": true
1678+ }
1679+ ]
1680+ },
1681+ {
1682+ "id": "6526b0d1-b48e-46c6-bb08-11ebcf458def",
1683+ "alias": "browser",
1684+ "description": "browser based authentication",
1685+ "providerId": "basic-flow",
1686+ "topLevel": true,
1687+ "builtIn": true,
1688+ "authenticationExecutions": [
1689+ {
1690+ "authenticator": "auth-cookie",
1691+ "requirement": "ALTERNATIVE",
1692+ "priority": 10,
1693+ "userSetupAllowed": false,
1694+ "autheticatorFlow": false
1695+ },
1696+ {
1697+ "authenticator": "auth-spnego",
1698+ "requirement": "DISABLED",
1699+ "priority": 20,
1700+ "userSetupAllowed": false,
1701+ "autheticatorFlow": false
1702+ },
1703+ {
1704+ "authenticator": "identity-provider-redirector",
1705+ "requirement": "ALTERNATIVE",
1706+ "priority": 25,
1707+ "userSetupAllowed": false,
1708+ "autheticatorFlow": false
1709+ },
1710+ {
1711+ "requirement": "ALTERNATIVE",
1712+ "priority": 30,
1713+ "flowAlias": "forms",
1714+ "userSetupAllowed": false,
1715+ "autheticatorFlow": true
1716+ }
1717+ ]
1718+ },
1719+ {
1720+ "id": "92a653ba-8f2d-4283-8354-ca55f9d89181",
1721+ "alias": "clients",
1722+ "description": "Base authentication for clients",
1723+ "providerId": "client-flow",
1724+ "topLevel": true,
1725+ "builtIn": true,
1726+ "authenticationExecutions": [
1727+ {
1728+ "authenticator": "client-secret",
1729+ "requirement": "ALTERNATIVE",
1730+ "priority": 10,
1731+ "userSetupAllowed": false,
1732+ "autheticatorFlow": false
1733+ },
1734+ {
1735+ "authenticator": "client-jwt",
1736+ "requirement": "ALTERNATIVE",
1737+ "priority": 20,
1738+ "userSetupAllowed": false,
1739+ "autheticatorFlow": false
1740+ },
1741+ {
1742+ "authenticator": "client-secret-jwt",
1743+ "requirement": "ALTERNATIVE",
1744+ "priority": 30,
1745+ "userSetupAllowed": false,
1746+ "autheticatorFlow": false
1747+ },
1748+ {
1749+ "authenticator": "client-x509",
1750+ "requirement": "ALTERNATIVE",
1751+ "priority": 40,
1752+ "userSetupAllowed": false,
1753+ "autheticatorFlow": false
1754+ }
1755+ ]
1756+ },
1757+ {
1758+ "id": "e365be39-78db-46f0-b2e8-4e7001c2f5d0",
1759+ "alias": "direct grant",
1760+ "description": "OpenID Connect Resource Owner Grant",
1761+ "providerId": "basic-flow",
1762+ "topLevel": true,
1763+ "builtIn": true,
1764+ "authenticationExecutions": [
1765+ {
1766+ "authenticator": "direct-grant-validate-username",
1767+ "requirement": "REQUIRED",
1768+ "priority": 10,
1769+ "userSetupAllowed": false,
1770+ "autheticatorFlow": false
1771+ },
1772+ {
1773+ "authenticator": "direct-grant-validate-password",
1774+ "requirement": "REQUIRED",
1775+ "priority": 20,
1776+ "userSetupAllowed": false,
1777+ "autheticatorFlow": false
1778+ },
1779+ {
1780+ "requirement": "CONDITIONAL",
1781+ "priority": 30,
1782+ "flowAlias": "Direct Grant - Conditional OTP",
1783+ "userSetupAllowed": false,
1784+ "autheticatorFlow": true
1785+ }
1786+ ]
1787+ },
1788+ {
1789+ "id": "dd61caf5-a40f-48b7-9e8c-a1f3b67041dd",
1790+ "alias": "docker auth",
1791+ "description": "Used by Docker clients to authenticate against the IDP",
1792+ "providerId": "basic-flow",
1793+ "topLevel": true,
1794+ "builtIn": true,
1795+ "authenticationExecutions": [
1796+ {
1797+ "authenticator": "docker-http-basic-authenticator",
1798+ "requirement": "REQUIRED",
1799+ "priority": 10,
1800+ "userSetupAllowed": false,
1801+ "autheticatorFlow": false
1802+ }
1803+ ]
1804+ },
1805+ {
1806+ "id": "7a055643-62e1-4ac1-b126-9a8d6c299635",
1807+ "alias": "first broker login",
1808+ "description": "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account",
1809+ "providerId": "basic-flow",
1810+ "topLevel": true,
1811+ "builtIn": true,
1812+ "authenticationExecutions": [
1813+ {
1814+ "authenticatorConfig": "review profile config",
1815+ "authenticator": "idp-review-profile",
1816+ "requirement": "REQUIRED",
1817+ "priority": 10,
1818+ "userSetupAllowed": false,
1819+ "autheticatorFlow": false
1820+ },
1821+ {
1822+ "requirement": "REQUIRED",
1823+ "priority": 20,
1824+ "flowAlias": "User creation or linking",
1825+ "userSetupAllowed": false,
1826+ "autheticatorFlow": true
1827+ }
1828+ ]
1829+ },
1830+ {
1831+ "id": "fe8bc7ee-6e8f-436e-8336-c60fcd350843",
1832+ "alias": "forms",
1833+ "description": "Username, password, otp and other auth forms.",
1834+ "providerId": "basic-flow",
1835+ "topLevel": false,
1836+ "builtIn": true,
1837+ "authenticationExecutions": [
1838+ {
1839+ "authenticator": "auth-username-password-form",
1840+ "requirement": "REQUIRED",
1841+ "priority": 10,
1842+ "userSetupAllowed": false,
1843+ "autheticatorFlow": false
1844+ },
1845+ {
1846+ "requirement": "CONDITIONAL",
1847+ "priority": 20,
1848+ "flowAlias": "Browser - Conditional OTP",
1849+ "userSetupAllowed": false,
1850+ "autheticatorFlow": true
1851+ }
1852+ ]
1853+ },
1854+ {
1855+ "id": "3646f08e-ab70-415b-a701-6ed2e2d214c9",
1856+ "alias": "http challenge",
1857+ "description": "An authentication flow based on challenge-response HTTP Authentication Schemes",
1858+ "providerId": "basic-flow",
1859+ "topLevel": true,
1860+ "builtIn": true,
1861+ "authenticationExecutions": [
1862+ {
1863+ "authenticator": "no-cookie-redirect",
1864+ "requirement": "REQUIRED",
1865+ "priority": 10,
1866+ "userSetupAllowed": false,
1867+ "autheticatorFlow": false
1868+ },
1869+ {
1870+ "requirement": "REQUIRED",
1871+ "priority": 20,
1872+ "flowAlias": "Authentication Options",
1873+ "userSetupAllowed": false,
1874+ "autheticatorFlow": true
1875+ }
1876+ ]
1877+ },
1878+ {
1879+ "id": "04176530-0972-47ad-83df-19d8534caac2",
1880+ "alias": "registration",
1881+ "description": "registration flow",
1882+ "providerId": "basic-flow",
1883+ "topLevel": true,
1884+ "builtIn": true,
1885+ "authenticationExecutions": [
1886+ {
1887+ "authenticator": "registration-page-form",
1888+ "requirement": "REQUIRED",
1889+ "priority": 10,
1890+ "flowAlias": "registration form",
1891+ "userSetupAllowed": false,
1892+ "autheticatorFlow": true
1893+ }
1894+ ]
1895+ },
1896+ {
1897+ "id": "fa0ed569-6746-439e-b07e-89f7ed918c07",
1898+ "alias": "registration form",
1899+ "description": "registration form",
1900+ "providerId": "form-flow",
1901+ "topLevel": false,
1902+ "builtIn": true,
1903+ "authenticationExecutions": [
1904+ {
1905+ "authenticator": "registration-user-creation",
1906+ "requirement": "REQUIRED",
1907+ "priority": 20,
1908+ "userSetupAllowed": false,
1909+ "autheticatorFlow": false
1910+ },
1911+ {
1912+ "authenticator": "registration-profile-action",
1913+ "requirement": "REQUIRED",
1914+ "priority": 40,
1915+ "userSetupAllowed": false,
1916+ "autheticatorFlow": false
1917+ },
1918+ {
1919+ "authenticator": "registration-password-action",
1920+ "requirement": "REQUIRED",
1921+ "priority": 50,
1922+ "userSetupAllowed": false,
1923+ "autheticatorFlow": false
1924+ },
1925+ {
1926+ "authenticator": "registration-recaptcha-action",
1927+ "requirement": "DISABLED",
1928+ "priority": 60,
1929+ "userSetupAllowed": false,
1930+ "autheticatorFlow": false
1931+ }
1932+ ]
1933+ },
1934+ {
1935+ "id": "03680917-28f3-4ccd-bdf6-4a516f7c0018",
1936+ "alias": "reset credentials",
1937+ "description": "Reset credentials for a user if they forgot their password or something",
1938+ "providerId": "basic-flow",
1939+ "topLevel": true,
1940+ "builtIn": true,
1941+ "authenticationExecutions": [
1942+ {
1943+ "authenticator": "reset-credentials-choose-user",
1944+ "requirement": "REQUIRED",
1945+ "priority": 10,
1946+ "userSetupAllowed": false,
1947+ "autheticatorFlow": false
1948+ },
1949+ {
1950+ "authenticator": "reset-credential-email",
1951+ "requirement": "REQUIRED",
1952+ "priority": 20,
1953+ "userSetupAllowed": false,
1954+ "autheticatorFlow": false
1955+ },
1956+ {
1957+ "authenticator": "reset-password",
1958+ "requirement": "REQUIRED",
1959+ "priority": 30,
1960+ "userSetupAllowed": false,
1961+ "autheticatorFlow": false
1962+ },
1963+ {
1964+ "requirement": "CONDITIONAL",
1965+ "priority": 40,
1966+ "flowAlias": "Reset - Conditional OTP",
1967+ "userSetupAllowed": false,
1968+ "autheticatorFlow": true
1969+ }
1970+ ]
1971+ },
1972+ {
1973+ "id": "19a9d9aa-2d2b-4701-807f-c384ab921c7e",
1974+ "alias": "saml ecp",
1975+ "description": "SAML ECP Profile Authentication Flow",
1976+ "providerId": "basic-flow",
1977+ "topLevel": true,
1978+ "builtIn": true,
1979+ "authenticationExecutions": [
1980+ {
1981+ "authenticator": "http-basic-authenticator",
1982+ "requirement": "REQUIRED",
1983+ "priority": 10,
1984+ "userSetupAllowed": false,
1985+ "autheticatorFlow": false
1986+ }
1987+ ]
1988+ }
1989+ ],
1990+ "authenticatorConfig": [
1991+ {
1992+ "id": "534f01f4-45b3-43a0-91d1-238860cc126d",
1993+ "alias": "create unique user config",
1994+ "config": {
1995+ "require.password.update.after.registration": "false"
1996+ }
1997+ },
1998+ {
1999+ "id": "65bb9337-9633-4a21-8f6f-1d4129f664ac",
2000+ "alias": "review profile config",
2001+ "config": {
2002+ "update.profile.on.first.login": "missing"
2003+ }
2004+ }
2005+ ],
2006+ "requiredActions": [
2007+ {
2008+ "alias": "CONFIGURE_TOTP",
2009+ "name": "Configure OTP",
2010+ "providerId": "CONFIGURE_TOTP",
2011+ "enabled": true,
2012+ "defaultAction": false,
2013+ "priority": 10,
2014+ "config": {}
2015+ },
2016+ {
2017+ "alias": "terms_and_conditions",
2018+ "name": "Terms and Conditions",
2019+ "providerId": "terms_and_conditions",
2020+ "enabled": false,
2021+ "defaultAction": false,
2022+ "priority": 20,
2023+ "config": {}
2024+ },
2025+ {
2026+ "alias": "UPDATE_PASSWORD",
2027+ "name": "Update Password",
2028+ "providerId": "UPDATE_PASSWORD",
2029+ "enabled": true,
2030+ "defaultAction": false,
2031+ "priority": 30,
2032+ "config": {}
2033+ },
2034+ {
2035+ "alias": "UPDATE_PROFILE",
2036+ "name": "Update Profile",
2037+ "providerId": "UPDATE_PROFILE",
2038+ "enabled": true,
2039+ "defaultAction": false,
2040+ "priority": 40,
2041+ "config": {}
2042+ },
2043+ {
2044+ "alias": "VERIFY_EMAIL",
2045+ "name": "Verify Email",
2046+ "providerId": "VERIFY_EMAIL",
2047+ "enabled": true,
2048+ "defaultAction": false,
2049+ "priority": 50,
2050+ "config": {}
2051+ },
2052+ {
2053+ "alias": "update_user_locale",
2054+ "name": "Update User Locale",
2055+ "providerId": "update_user_locale",
2056+ "enabled": true,
2057+ "defaultAction": false,
2058+ "priority": 1000,
2059+ "config": {}
2060+ }
2061+ ],
2062+ "browserFlow": "browser",
2063+ "registrationFlow": "registration",
2064+ "directGrantFlow": "direct grant",
2065+ "resetCredentialsFlow": "reset credentials",
2066+ "clientAuthenticationFlow": "clients",
2067+ "dockerAuthenticationFlow": "docker auth",
2068+ "attributes": {},
2069+ "keycloakVersion": "10.0.0",
2070+ "userManagedAccessAllowed": false
2071+}
contrib/local-environment/keycloak/oauth2-proxy-users-0.jsonnew file+38
@@ -0,0 +1,38 @@
1+{
2+ "realm": "oauth2-proxy",
3+ "users": [
4+ {
5+ "id": "3356c0a0-d4d5-4436-9c5a-2299c71c08ec",
6+ "createdTimestamp": 1591297959169,
7+ "username": "admin@example.com",
8+ "email": "admin@example.com",
9+ "enabled": true,
10+ "totp": false,
11+ "emailVerified": true,
12+ "credentials": [
13+ {
14+ "id": "a1a06ecd-fdc0-4e67-92cd-2da22d724e32",
15+ "type": "password",
16+ "createdDate": 1591297959315,
17+ "secretData": "{\"value\":\"6rt5zuqHVHopvd0FTFE0CYadXTtzY0mDY2BrqnNQGS51/7DfMJeGgj0roNnGMGvDv30imErNmiSOYl+cL9jiIA==\",\"salt\":\"LI0kqr09JB7J9wvr2Hxzzg==\"}",
18+ "credentialData": "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\"}"
19+ }
20+ ],
21+ "disableableCredentialTypes": [],
22+ "requiredActions": [],
23+ "realmRoles": [
24+ "offline_access",
25+ "admin",
26+ "uma_authorization"
27+ ],
28+ "clientRoles": {
29+ "account": [
30+ "view-profile",
31+ "manage-account"
32+ ]
33+ },
34+ "notBefore": 0,
35+ "groups": []
36+ }
37+ ]
38+}
contrib/local-environment/kubernetes/.gitignorenew file+1
@@ -0,0 +1 @@
1+charts/
contrib/local-environment/kubernetes/Chart.locknew file+15
@@ -0,0 +1,15 @@
1+dependencies:
2+- name: dex
3+ repository: https://charts.dexidp.io
4+ version: 0.24.1
5+- name: oauth2-proxy
6+ repository: https://oauth2-proxy.github.io/manifests
7+ version: 7.18.0
8+- name: httpbin
9+ repository: https://conservis.github.io/helm-charts
10+ version: 1.1.0
11+- name: hello-world
12+ repository: https://conservis.github.io/helm-charts
13+ version: 1.1.0
14+digest: sha256:3fff8bf99cebcd20a73c984423d5f1c2dfa1e5a394f82a5dc60d9aaffe5361b7
15+generated: "2026-08-18T07:33:03.791274914Z"
contrib/local-environment/kubernetes/Chart.yamlnew file+18
@@ -0,0 +1,18 @@
1+apiVersion: v2
2+description: K8S example based on https://kind.sigs.k8s.io
3+name: kubernetes
4+dependencies:
5+ - name: dex
6+ version: 0.24.1
7+ repository: https://charts.dexidp.io
8+ - name: oauth2-proxy
9+ version: &chartVersion 7.18.0
10+ repository: https://oauth2-proxy.github.io/manifests
11+ # https://github.com/postmanlabs/httpbin/issues/549 is still in progress, for now using a non-official chart
12+ - name: httpbin
13+ version: 1.1.0
14+ repository: https://conservis.github.io/helm-charts
15+ - name: hello-world
16+ version: 1.1.0
17+ repository: https://conservis.github.io/helm-charts
18+version: *chartVersion
contrib/local-environment/kubernetes/Makefilenew file+59
@@ -0,0 +1,59 @@
1+all:
2+ @echo "Usage:"
3+ @echo " make create-cluster"
4+ @echo " make deploy"
5+
6+# create kind cluster with nginx-ingress as the most popular ingress controller for K8S
7+.PHONY: deploy
8+create-cluster:
9+ kind create cluster --name oauth2-proxy --config kind-cluster.yaml
10+ make setup-dns
11+ make setup-ingress
12+
13+.PHONY: setup-ingress
14+setup-ingress:
15+ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/kind/deploy.yaml
16+ kubectl --namespace ingress-nginx rollout status --timeout 5m deployment/ingress-nginx-controller
17+
18+# default Pod CIDR is 10.244.0.0/16 https://github.com/kubernetes-sigs/kind/blob/a6e8108025bc7a9440beedb8ef7714aec84fe87e/pkg/apis/config/v1alpha4/default.go#L52
19+# what makes cluster host IP equal to 10.244.0.1
20+# thus we add dex.localtest.me and oauth2-proxy.localtest.me stub hosts pointing to this IP
21+# NOT NEEDED IN REAL LIFE!
22+.PHONY: setup-dns
23+setup-dns:
24+ kubectl apply -f custom-dns.yaml
25+ kubectl -n kube-system rollout restart deployment/coredns
26+ kubectl -n kube-system rollout status --timeout 5m deployment/coredns
27+
28+.PHONY: delete-cluster
29+delete-cluster:
30+ kind delete cluster --name oauth2-proxy
31+
32+.PHONY: deploy
33+deploy: helm-deploy
34+ kubectl rollout status --timeout 5m deployment/oauth2-proxy-example-oauth2-proxy-sample
35+ kubectl rollout status --timeout 1m deployment/oauth2-proxy-example-httpbin
36+ kubectl rollout status --timeout 1m deployment/oauth2-proxy-example-hello-world
37+
38+.PHONY: undeploy
39+undeploy: helm-undeploy
40+
41+######################
42+###### HELM CMDs #####
43+######################
44+.PHONY: helm-init
45+helm-init:
46+ helm dep update
47+
48+# unpacking is useful to be able to explore underlying helm charts
49+.PHONY: helm-unpack
50+helm-unpack:
51+ cd charts; for f in *.tgz; do tar -zxf "$$f"; done
52+
53+.PHONY: helm-deploy
54+helm-deploy: helm-init
55+ helm upgrade --wait --debug --install --render-subchart-notes oauth2-proxy-example .
56+
57+.PHONY: helm-undeploy
58+helm-undeploy:
59+ helm del oauth2-proxy-example
contrib/local-environment/kubernetes/README.mdnew file+23
@@ -0,0 +1,23 @@
1+# Kubernetes example
2+Based on [kind](https://kind.sigs.k8s.io) as a local Kubernetes cluster.
3+
4+## Quick start
5+
6+Before you start:
7+
8+_Required_
9+* install [kind](https://kind.sigs.k8s.io/docs/user/quick-start/#installation)
10+* install [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/)
11+* install [helm](https://helm.sh/docs/intro/quickstart/#install-helm).
12+
13+Then:
14+
15+* `make create-cluster`
16+* `make deploy`
17+
18+Visit http://httpbin.localtest.me or http://hello-world.localtest.me/
19+Note: When accessing the service for the first time you will need to authenticate with Dex. It is configured using static credentials for testing. With username `admin@example.com` and password set to `password`.
20+
21+## Uninstall
22+
23+* `make delete-cluster`
contrib/local-environment/kubernetes/custom-dns.yamlnew file+30
@@ -0,0 +1,30 @@
1+apiVersion: v1
2+kind: ConfigMap
3+metadata:
4+ name: coredns
5+ namespace: kube-system
6+data:
7+ Corefile: |
8+ .:53 {
9+ errors
10+ health {
11+ lameduck 5s
12+ }
13+ ready
14+ kubernetes cluster.local in-addr.arpa ip6.arpa {
15+ pods insecure
16+ fallthrough in-addr.arpa ip6.arpa
17+ ttl 30
18+ }
19+ prometheus :9153
20+ forward . /etc/resolv.conf
21+ cache 30
22+ loop
23+ reload
24+ loadbalance
25+ hosts {
26+ 10.244.0.1 dex.localtest.me
27+ 10.244.0.1 oauth2-proxy.localtest.me
28+ fallthrough
29+ }
30+ }
contrib/local-environment/kubernetes/kind-cluster.yamlnew file+17
@@ -0,0 +1,17 @@
1+apiVersion: kind.x-k8s.io/v1alpha4
2+kind: Cluster
3+nodes:
4+ - role: control-plane
5+ kubeadmConfigPatches:
6+ - |
7+ kind: InitConfiguration
8+ nodeRegistration:
9+ kubeletExtraArgs:
10+ node-labels: "ingress-ready=true"
11+ extraPortMappings:
12+ - containerPort: 80
13+ hostPort: 80
14+ protocol: TCP
15+ - containerPort: 443
16+ hostPort: 443
17+ protocol: TCP
contrib/local-environment/kubernetes/values.yamlnew file+97
@@ -0,0 +1,97 @@
1+dex:
2+ ingress:
3+ enabled: true
4+ hosts:
5+ - host: dex.localtest.me
6+ paths:
7+ - path: /
8+ pathType: ImplementationSpecific
9+ grpc:
10+ enabled: false
11+ certs:
12+ grpc:
13+ create: false
14+ web:
15+ create: false
16+
17+ config:
18+ issuer: http://dex.localtest.me
19+ storage:
20+ type: kubernetes
21+ config:
22+ inCluster: true
23+ enablePasswordDB: true
24+ expiry:
25+ signingKeys: "4h"
26+ idTokens: "1h"
27+ staticClients:
28+ - id: oauth2-proxy
29+ redirectURIs:
30+ # These redirect URI points to the `--redirect-url` for OAuth2 proxy.
31+ - 'http://oauth2-proxy.localtest.me/oauth2/callback'
32+ name: 'OAuth2 Proxy'
33+ secret: "b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"
34+ staticPasswords:
35+ - email: "admin@example.com"
36+ # bcrypt hash of the string "password"
37+ hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
38+ username: "admin"
39+ userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
40+
41+oauth2-proxy:
42+ nameOverride: oauth2-proxy-sample
43+ ingress:
44+ enabled: true
45+ hosts:
46+ - oauth2-proxy.localtest.me
47+ # pick up client_id and client_secret from configFile as opposed to helm .Values.config.clientID and .Values.config.clientSecret
48+ proxyVarsAsSecrets: false
49+ config:
50+ configFile: |-
51+ cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="
52+ cookie_domains=".localtest.me"
53+ whitelist_domains=[".localtest.me"]
54+ # only users with this domain will be let in
55+ email_domains=["example.com"]
56+
57+ client_id="oauth2-proxy"
58+ client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"
59+ cookie_secure="false"
60+
61+ redirect_url="http://oauth2-proxy.localtest.me/oauth2/callback"
62+
63+ # we don't want to proxy anything so pick a non-existent directory
64+ upstreams = [ "file:///dev/null" ]
65+
66+ # return authenticated user to nginx
67+ set_xauthrequest = true
68+ # using http://dex.localtest.me/.well-known/openid-configuration oauth2-proxy will populate
69+ # login_url, redeem_url, and oidc_jwks_url
70+ provider="oidc"
71+ oidc_issuer_url="http://dex.localtest.me"
72+
73+httpbin:
74+ ingress:
75+ enabled: true
76+ hosts:
77+ - httpbin.localtest.me
78+ annotations:
79+ nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start
80+ # That's what will be used in REAL LIFE
81+ #nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy.localtest.me/oauth2/auth
82+ # but because of https://github.com/kubernetes/ingress-nginx/issues/3665
83+ nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy-example-oauth2-proxy-sample.default.svc.cluster.local/oauth2/auth
84+ nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email
85+
86+hello-world:
87+ ingress:
88+ enabled: true
89+ hosts:
90+ - hello-world.localtest.me
91+ annotations:
92+ nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start
93+ # That's what will be used in REAL LIFE
94+ #nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy.localtest.me/oauth2/auth
95+ # but because of https://github.com/kubernetes/ingress-nginx/issues/3665
96+ nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy-example-oauth2-proxy-sample.default.svc.cluster.local/oauth2/auth
97+ nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email
contrib/local-environment/nginx.confnew file+44
@@ -0,0 +1,44 @@
1+# Reverse proxy to httpbin
2+server {
3+ listen 8080;
4+ server_name oauth2-proxy.localtest.me;
5+
6+ location /oauth2/ {
7+ proxy_pass http://oauth2-proxy:4180;
8+ proxy_set_header Host $host;
9+ proxy_set_header X-Real-IP $remote_addr;
10+ proxy_set_header X-Forwarded-Uri $request_uri;
11+ proxy_set_header X-Auth-Request-Redirect $request_uri;
12+ }
13+
14+ location = /oauth2/auth {
15+ proxy_pass http://oauth2-proxy:4180;
16+ proxy_set_header Host $host;
17+ proxy_set_header X-Real-IP $remote_addr;
18+ proxy_set_header X-Forwarded-Uri $request_uri;
19+ # nginx auth_request includes headers but not body
20+ proxy_set_header Content-Length "";
21+ proxy_pass_request_body off;
22+ }
23+
24+ location / {
25+ auth_request /oauth2/auth;
26+ error_page 401 = @oauth2_signin;
27+
28+ # pass information via X-User and X-Email headers to backend,
29+ # requires running with --set-xauthrequest flag
30+ auth_request_set $user $upstream_http_x_auth_request_user;
31+ auth_request_set $email $upstream_http_x_auth_request_email;
32+ proxy_set_header X-User $user;
33+ proxy_set_header X-Email $email;
34+
35+ proxy_pass http://httpbin/;
36+ # or "root /path/to/site;" or "fastcgi_pass ..." etc
37+ }
38+
39+ # Named location for handling OAuth2 sign-in redirects
40+ # This ensures the browser receives a proper 302 redirect that it will follow
41+ location @oauth2_signin {
42+ return 302 /oauth2/sign_in?rd=$scheme://$http_host$request_uri;
43+ }
44+}
contrib/local-environment/oauth2-proxy-alpha-config.cfgnew file+4
@@ -0,0 +1,4 @@
1+cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="
2+email_domains="example.com"
3+cookie_secure="false"
4+redirect_url="http://oauth2-proxy.localtest.me:4180/oauth2/callback"
contrib/local-environment/oauth2-proxy-alpha-config.yamlnew file+23
@@ -0,0 +1,23 @@
1+server:
2+ bindAddress: "0.0.0.0:4180"
3+upstreamConfig:
4+ upstreams:
5+ - id: httpbin
6+ path: /
7+ uri: http://httpbin
8+injectRequestHeaders:
9+ - name: X-Forwarded-User
10+ values:
11+ - claimSource:
12+ claim: user
13+ - name: X-Forwarded-Email
14+ values:
15+ - claimSource:
16+ claim: email
17+providers:
18+ - id: oidc
19+ provider: oidc
20+ clientSecret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK
21+ clientID: oauth2-proxy
22+ oidcConfig:
23+ issuerURL: http://dex.localtest.me:5556/dex
contrib/local-environment/oauth2-proxy-gitea.cfgnew file+19
@@ -0,0 +1,19 @@
1+http_address="0.0.0.0:4180"
2+cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="
3+email_domains=["localhost"]
4+cookie_secure="false"
5+upstreams="http://httpbin"
6+cookie_domains=[".localtest.me"] # Required so cookie can be read on all subdomains.
7+whitelist_domains=[".localtest.me"] # Required to allow redirection back to original requested target.
8+
9+client_id="ef0c2b91-2e38-4fa8-908d-067a35dbb71c"
10+client_secret="gto_qdppomn2p26su5x46tyixj7bcny5m5er2s67xhrponq2qtp66f3a"
11+redirect_url="http://oauth2-proxy.localtest.me:4180/oauth2/callback"
12+
13+# gitea provider
14+provider="github"
15+provider_display_name="Gitea"
16+login_url="http://gitea.localtest.me:3000/login/oauth/authorize"
17+redeem_url="http://gitea.localtest.me:3000/login/oauth/access_token"
18+validate_url="http://gitea.localtest.me:3000/api/v1/user/emails"
19+
contrib/local-environment/oauth2-proxy-keycloak.cfgnew file+18
@@ -0,0 +1,18 @@
1+http_address="0.0.0.0:4180"
2+cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="
3+email_domains="example.com"
4+cookie_secure="false"
5+upstreams="http://httpbin"
6+cookie_domains=["oauth2-proxy.localtest.me:4080", "keycloak.localtest.me:9080"] # Required so cookie can be read on all subdomains.
7+whitelist_domains=[".localtest.me"] # Required to allow redirection back to original requested target.
8+
9+# keycloak provider
10+client_secret="72341b6d-7065-4518-a0e4-50ee15025608"
11+client_id="oauth2-proxy"
12+redirect_url="http://oauth2-proxy.localtest.me:4180/oauth2/callback"
13+
14+# in this case oauth2-proxy is going to visit
15+# http://keycloak.localtest.me:9080/realms/oauth2-proxy/.well-known/openid-configuration for configuration
16+oidc_issuer_url="http://keycloak.localtest.me:9080/realms/oauth2-proxy"
17+provider="oidc"
18+provider_display_name="Keycloak"
contrib/local-environment/oauth2-proxy-nginx.cfgnew file+19
@@ -0,0 +1,19 @@
1+http_address="0.0.0.0:4180"
2+cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="
3+email_domains="example.com"
4+cookie_secure="false"
5+upstreams="static://200"
6+cookie_domains=[".localtest.me"] # Required so cookie can be read on all subdomains.
7+whitelist_domains=[".localtest.me"] # Required to allow redirection back to original requested target.
8+
9+# dex provider
10+client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"
11+client_id="oauth2-proxy"
12+redirect_url="http://oauth2-proxy.localtest.me:8080/oauth2/callback"
13+
14+oidc_issuer_url="http://dex.localtest.me:5556/dex"
15+provider="oidc"
16+provider_display_name="Dex"
17+
18+# Enables the use of `X-Forwarded-*` headers to determine request correctly
19+reverse_proxy="true"
contrib/local-environment/oauth2-proxy-traefik.cfgnew file+22
@@ -0,0 +1,22 @@
1+http_address="0.0.0.0:4180"
2+cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="
3+provider="oidc"
4+email_domains=["example.com"]
5+oidc_issuer_url="http://dex.localtest.me/dex"
6+client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"
7+client_id="oauth2-proxy"
8+cookie_secure="false"
9+
10+redirect_url="http://oauth2-proxy.localtest.me/oauth2/callback"
11+cookie_domains=".localtest.me" # Required so cookie can be read on all subdomains.
12+whitelist_domains=".localtest.me" # Required to allow redirection back to original requested target.
13+
14+# Mandatory option when using oauth2-proxy with traefik
15+reverse_proxy="true"
16+# Required for traefik with ForwardAuth and static upstream configuration
17+upstreams="static://202"
18+# The following option skip the page requesting the user
19+# to click on a button to be redirected to the identity provider
20+# It can be activated only when traefik is not configure with
21+# the error redirection middleware as this example.
22+skip_provider_button="true"
contrib/local-environment/oauth2-proxy.cfgnew file+16
@@ -0,0 +1,16 @@
1+http_address="0.0.0.0:4180"
2+cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="
3+email_domains="example.com"
4+cookie_secure="false"
5+upstreams="http://httpbin"
6+cookie_domains=[".localtest.me"] # Required so cookie can be read on all subdomains.
7+whitelist_domains=[".localtest.me"] # Required to allow redirection back to original requested target.
8+
9+# dex provider
10+client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"
11+client_id="oauth2-proxy"
12+redirect_url="http://oauth2-proxy.localtest.me:4180/oauth2/callback"
13+
14+oidc_issuer_url="http://dex.localtest.me:5556/dex"
15+provider="oidc"
16+provider_display_name="Dex"
contrib/local-environment/traefik/dynamic.yamlnew file+64
@@ -0,0 +1,64 @@
1+http:
2+ routers:
3+ oauth2-proxy-route:
4+ rule: "Host(`oauth2-proxy.localtest.me`)"
5+ middlewares:
6+ - auth-headers
7+ service: oauth-backend
8+ dex-route:
9+ rule: "Host(`dex.localtest.me`)"
10+ service: dex-service
11+ httpbin-route:
12+ rule: "Host(`httpbin.localtest.me`)"
13+ service: httpbin-service
14+ middlewares:
15+ - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin
16+ httpbin-route-2:
17+ rule: "Host(`httpbin.localtest.me`) && PathPrefix(`/no-auto-redirect`)"
18+ service: httpbin-service
19+ middlewares:
20+ - oauth-auth-wo-redirect # unauthenticated session will return a 401
21+ services-oauth2-route:
22+ rule: "Host(`httpbin.localtest.me`) && PathPrefix(`/oauth2/`)"
23+ middlewares:
24+ - auth-headers
25+ service: oauth-backend
26+
27+ services:
28+ httpbin-service:
29+ loadBalancer:
30+ servers:
31+ - url: http://httpbin
32+ oauth-backend:
33+ loadBalancer:
34+ servers:
35+ - url: http://oauth2-proxy:4180
36+ dex-service:
37+ loadBalancer:
38+ servers:
39+ - url: http://dex:5556
40+
41+ middlewares:
42+ auth-headers:
43+ headers:
44+ stsSeconds: 315360000
45+ browserXssFilter: true
46+ contentTypeNosniff: true
47+ forceSTSHeader: true
48+ stsIncludeSubdomains: true
49+ stsPreload: true
50+ frameDeny: true
51+ oauth-auth-redirect:
52+ forwardAuth:
53+ address: http://oauth2-proxy:4180
54+ trustForwardHeader: true
55+ authResponseHeaders:
56+ - X-Auth-Request-Access-Token
57+ - Authorization
58+ oauth-auth-wo-redirect:
59+ forwardAuth:
60+ address: http://oauth2-proxy:4180/oauth2/auth
61+ trustForwardHeader: true
62+ authResponseHeaders:
63+ - X-Auth-Request-Access-Token
64+ - Authorization
contrib/local-environment/traefik/traefik.yamlnew file+9
@@ -0,0 +1,9 @@
1+api:
2+ insecure: true
3+log:
4+ level: INFO
5+providers:
6+ file:
7+ filename: /etc/traefik/dynamic.yaml
8+ # Routes are static for this example; disabling watch avoids host inotify limits.
9+ watch: false
contrib/oauth2-proxy.cfg.examplenew file+108
@@ -0,0 +1,108 @@
1+## OAuth2 Proxy Config File
2+## https://github.com/oauth2-proxy/oauth2-proxy
3+
4+## <addr>:<port> to listen on for HTTP/HTTPS clients
5+# http_address = "127.0.0.1:4180"
6+# https_address = ":443"
7+
8+## Are we running behind a reverse proxy? Will not accept headers like X-Real-Ip unless this is set.
9+# reverse_proxy = true
10+
11+## TLS Settings
12+# tls_cert_file = ""
13+# tls_key_file = ""
14+
15+## the OAuth Redirect URL.
16+# defaults to the "https://" + requested host header + "/oauth2/callback"
17+# redirect_url = "https://internalapp.yourcompany.com/oauth2/callback"
18+
19+## the http url(s) of the upstream endpoint. If multiple, routing is based on path
20+# upstreams = [
21+# "http://127.0.0.1:8080/"
22+# ]
23+
24+## Logging configuration
25+#logging_filename = ""
26+#logging_max_size = 100
27+#logging_max_age = 7
28+#logging_local_time = true
29+#logging_compress = false
30+#standard_logging = true
31+#standard_logging_format = "[{{.Timestamp}}] [{{.File}}] {{.Message}}"
32+#request_logging = true
33+#request_logging_format = "{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}"
34+#auth_logging = true
35+#auth_logging_format = "{{.Client}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}"
36+
37+## pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream
38+# pass_basic_auth = true
39+# pass_user_headers = true
40+## pass the request Host Header to upstream
41+## when disabled the upstream Host is used as the Host Header
42+# pass_host_header = true
43+
44+## Email Domains to allow authentication for (this authorizes any email on this domain)
45+## for more granular authorization use `authenticated_emails_file`
46+## To authorize any email addresses use "*"
47+# email_domains = [
48+# "yourcompany.com"
49+# ]
50+
51+## The OAuth Client ID, Secret
52+# client_id = "123456.apps.googleusercontent.com"
53+# client_secret = ""
54+
55+## Scopes Added to the request
56+## It has the same behavior as the --scope flag
57+# scope = "openid email profile"
58+
59+## Pass OAuth Access token to upstream via "X-Forwarded-Access-Token"
60+# pass_access_token = false
61+
62+## Authenticated Email Addresses File (one email per line)
63+# authenticated_emails_file = ""
64+
65+## Htpasswd File (optional)
66+## Additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -B" for bcrypt encryption
67+## enabling exposes a username/login signin form
68+# htpasswd_file = ""
69+
70+## bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods
71+# skip_auth_routes = [
72+# "GET=^/probe",
73+# "^/metrics"
74+# ]
75+
76+## mark paths as API routes to get HTTP Status code 401 instead of redirect to login page
77+# api_routes = [
78+# "^/api"
79+# ]
80+
81+## Templates
82+## optional directory with custom sign_in.html and error.html
83+# custom_templates_dir = ""
84+
85+## skip SSL checking for HTTPS requests
86+# ssl_insecure_skip_verify = false
87+
88+
89+## Cookie Settings
90+## Name - the cookie name
91+## Secret - the seed string for secure cookies; should be 16, 24, or 32 bytes
92+## for use with an AES cipher when cookie_refresh or pass_access_token
93+## is set
94+## Domain - (optional) cookie domain to force cookies to (ie: .yourcompany.com)
95+## Expire - (duration) expire timeframe for cookie
96+## Refresh - (duration) refresh the cookie when duration has elapsed after cookie was initially set.
97+## Should be less than cookie_expire; set to 0 to disable.
98+## On refresh, OAuth token is re-validated.
99+## (ie: 1h means tokens are refreshed on request 1hr+ after it was set)
100+## Secure - secure cookies are only sent by the browser of a HTTPS connection (recommended)
101+## HttpOnly - httponly cookies are not readable by javascript (recommended)
102+# cookie_name = "_oauth2_proxy"
103+# cookie_secret = ""
104+# cookie_domains = ""
105+# cookie_expire = "168h"
106+# cookie_refresh = ""
107+# cookie_secure = true
108+# cookie_httponly = true
contrib/oauth2-proxy.service.examplenew file+33
@@ -0,0 +1,33 @@
1+[Unit]
2+Description=oauth2-proxy daemon service
3+After=network.target network-online.target nss-lookup.target basic.target
4+Wants=network-online.target nss-lookup.target
5+StartLimitIntervalSec=30
6+StartLimitBurst=3
7+
8+[Service]
9+User=oauth2-proxy
10+Group=oauth2-proxy
11+Restart=on-failure
12+RestartSec=30
13+WorkingDirectory=/etc/oauth2-proxy
14+ExecStart=/usr/bin/oauth2-proxy --config=/etc/oauth2-proxy/oauth2-proxy.cfg
15+ExecReload=/bin/kill -HUP $MAINPID
16+LimitNOFILE=65535
17+NoNewPrivileges=true
18+ProtectHome=true
19+ProtectSystem=full
20+ProtectHostname=true
21+ProtectControlGroups=true
22+ProtectKernelModules=true
23+ProtectKernelTunables=true
24+LockPersonality=true
25+RestrictRealtime=yes
26+RestrictNamespaces=yes
27+MemoryDenyWriteExecute=yes
28+PrivateDevices=yes
29+PrivateTmp=true
30+CapabilityBoundingSet=
31+
32+[Install]
33+WantedBy=multi-user.target
contrib/oauth2-proxy_autocomplete.shnew file+34
@@ -0,0 +1,34 @@
1+#
2+# Autocompletion for oauth2-proxy
3+#
4+# To install this, copy/move this file to /etc/bash.completion.d/
5+# or add a line to your ~/.bashrc | ~/.bash_profile that says ". /path/to/oauth2-proxy/contrib/oauth2-proxy_autocomplete.sh"
6+#
7+
8+_oauth2_proxy() {
9+ _oauth2_proxy_commands=$(oauth2-proxy -h 2>&1 | sed -n '/^\s*--/s/ \+/ /gp' | awk '{print $1}' | tr '\n' ' ')
10+ local cur prev
11+ COMPREPLY=()
12+ cur="${COMP_WORDS[COMP_CWORD]}"
13+ prev="${COMP_WORDS[COMP_CWORD-1]}"
14+ case "$prev" in
15+ --@(config|tls-cert-file|tls-key-file|authenticated-emails-file|htpasswd-file|custom-templates-dir|logging-filename|jwt-key-file))
16+ _filedir
17+ return 0
18+ ;;
19+ --provider)
20+ COMPREPLY=( $(compgen -W "google azure facebook github keycloak gitlab linkedin login.gov digitalocean" -- ${cur}) )
21+ return 0
22+ ;;
23+ --real-client-ip-header)
24+ COMPREPLY=( $(compgen -W 'X-Real-IP X-Forwarded-For X-ProxyUser-IP' -- ${cur}) )
25+ return 0
26+ ;;
27+ --@(http-address|https-address|redirect-url|upstream|basic-auth-password|skip-auth-regex|flush-interval|extra-jwt-issuers|email-domain|whitelist-domain|trusted-ip|keycloak-group|azure-tenant|bitbucket-team|bitbucket-repository|github-org|github-team|github-repo|github-token|gitlab-group|github-user|google-group|google-admin-email|google-service-account-json|client-id|client_secret|banner|footer|proxy-prefix|ping-path|ready-path|cookie-name|cookie-secret|cookie-domain|cookie-path|cookie-expire|cookie-refresh|cookie-samesite|redist-sentinel-master-name|redist-sentinel-connection-urls|redist-cluster-connection-urls|logging-max-size|logging-max-age|logging-max-backups|standard-logging-format|request-logging-format|exclude-logging-paths|auth-logging-format|oidc-issuer-url|oidc-jwks-url|login-url|redeem-url|profile-url|resource|validate-url|scope|approval-prompt|signature-key|acr-values|jwt-key|pubjwk-url|force-json-errors))
28+ return 0
29+ ;;
30+ esac
31+ COMPREPLY=( $(compgen -W "${_oauth2_proxy_commands}" -- ${cur}) )
32+ return 0;
33+}
34+complete -F _oauth2_proxy oauth2-proxy
dist.shnew file+64
@@ -0,0 +1,64 @@
1+#!/usr/bin/env bash
2+
3+set -o errexit
4+
5+if [[ -z ${BINARY} ]] || [[ -z ${VERSION} ]]; then
6+ echo "Missing required env var: BINARY=X VERSION=X $(basename $0)"
7+ exit 1
8+fi
9+
10+ARCHS=(
11+ darwin-amd64
12+ darwin-arm64
13+ linux-amd64
14+ linux-arm64
15+ linux-armv5
16+ linux-armv6
17+ linux-armv7
18+ linux-ppc64le
19+ linux-s390x
20+ freebsd-amd64
21+ windows-amd64
22+)
23+
24+mkdir -p release
25+
26+# Create architecture specific release dirs
27+for ARCH in "${ARCHS[@]}"; do
28+ mkdir -p release/${BINARY}-${VERSION}.${ARCH}
29+
30+ GO_OS=$(echo $ARCH | awk -F- '{print $1}')
31+ GO_ARCH=$(echo $ARCH | awk -F- '{print $2}')
32+
33+ # Determine binary name based on OS
34+ if [[ "${GO_OS}" == "windows" ]]; then
35+ BINARY_NAME="${BINARY}.exe"
36+ else
37+ BINARY_NAME="${BINARY}"
38+ fi
39+
40+ # Create architecture specific binaries
41+ if [[ ${GO_ARCH} == armv* ]]; then
42+ GO_ARM=$(echo $GO_ARCH | awk -Fv '{print $2}')
43+ GO111MODULE=on GOOS=${GO_OS} GOARCH=arm GOARM=${GO_ARM} CGO_ENABLED=0 go build \
44+ -ldflags="-X github.com/oauth2-proxy/oauth2-proxy/v7/pkg/version.VERSION=${VERSION}" \
45+ -o release/${BINARY}-${VERSION}.${ARCH}/${BINARY_NAME} .
46+ else
47+ GO111MODULE=on GOOS=${GO_OS} GOARCH=${GO_ARCH} CGO_ENABLED=0 go build \
48+ -ldflags="-X github.com/oauth2-proxy/oauth2-proxy/v7/pkg/version.VERSION=${VERSION}" \
49+ -o release/${BINARY}-${VERSION}.${ARCH}/${BINARY_NAME} .
50+ fi
51+
52+ cd release
53+
54+ # Create tar file for architecture specific binary
55+ tar -czvf ${BINARY}-${VERSION}.${ARCH}.tar.gz ${BINARY}-${VERSION}.${ARCH}
56+
57+ # Create sha256sum for architecture-specific tar
58+ sha256sum ${BINARY}-${VERSION}.${ARCH}.tar.gz > ${BINARY}-${VERSION}.${ARCH}.tar.gz-sha256sum.txt
59+
60+ # Create sha256sum for architecture specific binary
61+ sha256sum ${BINARY}-${VERSION}.${ARCH}/${BINARY_NAME} > ${BINARY}-${VERSION}.${ARCH}-sha256sum.txt
62+
63+ cd ..
64+done
docs/.gitignorenew file+23
@@ -0,0 +1,23 @@
1+# Dependencies
2+/node_modules
3+package-lock.json
4+pnpm-lock.yaml
5+yarn.lock
6+
7+# Production
8+/build
9+
10+# Generated files
11+.docusaurus
12+.cache-loader
13+
14+# Misc
15+.DS_Store
16+.env.local
17+.env.development.local
18+.env.test.local
19+.env.production.local
20+
21+npm-debug.log*
22+yarn-debug.log*
23+yarn-error.log*
docs/README.mdnew file+33
@@ -0,0 +1,33 @@
1+# Website
2+
3+This website is built using [Docusaurus 2](https://v2.docusaurus.io/), a modern static website generator.
4+
5+## Installation
6+
7+```console
8+npm install
9+```
10+
11+## Local Development
12+
13+```console
14+npm start
15+```
16+
17+This command starts a local development server and open up a browser window. Most changes are reflected live without having to restart the server.
18+
19+## Build
20+
21+```console
22+npm run build
23+```
24+
25+This command generates static content into the `build` directory and can be served using any static contents hosting service.
26+
27+## Deployment
28+
29+```console
30+GIT_USER=<Your GitHub username> USE_SSH=true npm deploy
31+```
32+
33+If you are using GitHub pages for hosting, this command is a convenient way to build the website and push to the `gh-pages` branch.
docs/babel.config.jsnew file+3
@@ -0,0 +1,3 @@
1+module.exports = {
2+ presets: [require.resolve('@docusaurus/core/lib/babel/preset')],
3+};
docs/docs/behaviour.mdnew file+26
@@ -0,0 +1,26 @@
1+---
2+id: behaviour
3+title: Behaviour
4+---
5+
6+1. Authentication Requirement: All requests passing through the proxy to upstream applications require authentication, excluding default proxy endpoints.
7+ - Exception: If the request matches a skipped route (configured via `--skip-auth-route`):
8+ - Authentication is not enforced, but the proxy will opportunistically attempt to validate a session cookie (`--cookie-name`) or JWT (`--skip-jwt-bearer-tokens`) if present in the request.
9+ - Configured user info and authentication headers (e.g., `--pass-access-token`) are injected to upstream routes when validation succeeds.
10+
11+2. Unauthenticated Requests: When authentication is missing but required, the user is redirected to the configured Identity Provider (IdP) login page by default.
12+ - Ajax Requests: If the request has `Accept: application/json` header:
13+ - Returns `401 Unauthorized`.
14+ - Invalid JWT Tokens: If `--skip-jwt-bearer-tokens` is set and the request includes an invalid JWT:
15+ - Redirects to the login page by default.
16+ - Returns `403 Forbidden` if `--bearer-token-login-fallback` is set to `false`.
17+
18+3. Post-Authentication: After successful authentication with the IdP, OAuth tokens are stored in the configured session store (cookie or Redis), and a cookie is set.
19+
20+4. Request Forwarding: The authenticated request is processed based on configuration:
21+ - Forwarded to the configured upstream application with added user info and authentication headers, or
22+ - Returns a valid status code for downstream processing by another proxy or load balancer (e.g., Nginx or Traefik).
23+
24+---
25+
26+Note: The proxy also provides a number of useful [endpoints](features/endpoints.md) for monitoring and management.
docs/docs/community/contribution.mdnew file+91
@@ -0,0 +1,91 @@
1+---
2+id: contribution
3+title: Contribution Guide
4+---
5+
6+We track bugs and issues using Github.
7+
8+If you find a bug, please open an Issue. When opening an Issue or Pull Request please follow the preconfigured template and take special note of the checkboxes.
9+
10+If you want to fix a bug, add a new feature or extend existing functionality, please create a fork, create a feature branch and open a PR back to this repo.
11+Please mention open bug issue number(s) within your PR if applicable.
12+
13+We suggest using [Visual Studio Code](https://code.visualstudio.com/docs/languages/go) with the official [Go for Visual Studio Code](https://marketplace.visualstudio.com/items?itemName=golang.go) extension.
14+
15+
16+# Go version
17+
18+See the `go.mod` file in the root of this repository for the version of Go used by this project.
19+You can follow [the installation guide for Go](https://go.dev/doc/install),
20+and you can find this specific Go version on [the Go downloads page](https://go.dev/dl/).
21+
22+# Preparing your fork
23+Clone your fork, create a feature branch and update the depedencies to get started.
24+```bash
25+git clone git@github.com:<YOUR_FORK>/oauth2-proxy
26+cd oauth2-proxy
27+git branch feature/<BRANCH_NAME>
28+git push --set-upstream origin feature/<BRANCH_NAME>
29+go mod download
30+```
31+
32+
33+# Testing / Debugging
34+For starting oauth2-proxy locally open the debugging tab and create the `launch.json` and select `Go: Launch Package`.
35+
36+![Debugging Tab](/img/debug-tab.png)
37+```json
38+{
39+ "version": "0.2.0",
40+ "configurations": [
41+ {
42+ "name": "Launch OAuth2 Proxy with Dex",
43+ "type": "go",
44+ "request": "launch",
45+ "mode": "auto",
46+ "program": "${workspaceFolder}",
47+ "args": [
48+ "--config",
49+ // The following configuration contains settings for a locally deployed
50+ // upstream and dex as an idetity provider
51+ "contrib/local-environment/oauth2-proxy.cfg"
52+ ]
53+ },
54+ {
55+ "name": "Launch OAuth2 Proxy with Keycloak",
56+ "type": "go",
57+ "request": "launch",
58+ "mode": "auto",
59+ "program": "${workspaceFolder}",
60+ "args": [
61+ "--config",
62+ // The following configuration contains settings for a locally deployed
63+ // upstream and keycloak as an idetity provider
64+ "contrib/local-environment/oauth2-proxy-keycloak.cfg"
65+ ]
66+ }
67+ ]
68+}
69+```
70+
71+Before you can start your local version of oauth2-proxy, you will have to use the provided docker compose files to start a local upstream service and identity provider. We suggest using [httpbin](https://hub.docker.com/r/kennethreitz/httpbin) as your upstream for testing as it allows for request and response introspection of all things HTTP.
72+
73+Inside the `contrib/local-environment` directory you can use the `Makefile` for
74+starting different example setups:
75+
76+- Dex as your IdP: `make up` or `make down`
77+- Dex as your IdP using the alpha-config: `make alpha-config-up`
78+- Keycloak as your IdP: `make keycloak-up`
79+- Dex as your IdP & nginx reverse proxy: `make nginx-up`
80+- and many more...
81+
82+Check out the `Makefile` to see what is available.
83+
84+The username and password for all setups is usually `admin@example.com` and `password`.
85+
86+The docker compose setups expose the services with a dynamic reverse DNS resolver: localtest.me
87+
88+- OAuth2 Proxy: http://oauth2-proxy.localtest.me:4180
89+- Upstream: http://httpbin.localtest.me:8080
90+- Dex: http://dex.localtest.me:5556
91+
docs/docs/community/security.mdnew file+49
@@ -0,0 +1,49 @@
1+---
2+id: security
3+title: Security
4+---
5+
6+:::note
7+OAuth2 Proxy is a community project.
8+Maintainers do not work on this project full time, and as such,
9+while we endeavour to respond to disclosures as quickly as possible,
10+this may take longer than in projects with corporate sponsorship.
11+:::
12+
13+## Security Disclosures
14+
15+:::important
16+If you believe you have found a vulnerability within OAuth2 Proxy or any of its
17+dependencies, please do NOT open an issue or PR on GitHub, please do NOT post
18+any details publicly.
19+:::
20+
21+Security disclosures MUST be done in private.
22+If you have found an issue that you would like to bring to the attention of the
23+maintenance team for OAuth2 Proxy, please compose an email and send it to the
24+list of maintainers in our [MAINTAINERS.md](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/MAINTAINERS.md) file.
25+
26+Please include as much detail as possible.
27+Ideally, your disclosure should include:
28+- A reproducible case that can be used to demonstrate the exploit
29+- How you discovered this vulnerability
30+- A potential fix for the issue (if you have thought of one)
31+- Versions affected (if not present in master)
32+- Your GitHub ID
33+
34+### How will we respond to disclosures?
35+
36+We use [GitHub Security Advisories](https://docs.github.com/en/github/managing-security-vulnerabilities/about-github-security-advisories)
37+to privately discuss fixes for disclosed vulnerabilities.
38+If you include a GitHub ID with your disclosure we will add you as a collaborator
39+for the advisory so that you can join the discussion and validate any fixes
40+we may propose.
41+
42+For minor issues and previously disclosed vulnerabilities (typically for
43+dependencies), we may use regular PRs for fixes and forego the security advisory.
44+
45+Once a fix has been agreed upon, we will merge the fix and create a new release.
46+If we have multiple security issues in flight simultaneously, we may delay
47+merging fixes until all patches are ready.
48+We may also backport the fix to previous releases,
49+but this will be at the discretion of the maintainers.
docs/docs/configuration/alpha_config.mdnew file+713
@@ -0,0 +1,713 @@
1+---
2+id: alpha-config
3+title: Alpha Configuration
4+---
5+
6+:::warning
7+This page contains documentation for alpha features.
8+We reserve the right to make breaking changes to the features detailed within this page with no notice.
9+
10+Options described in this page may be changed, removed, renamed or moved without prior warning.
11+Please beware of this before you use alpha configuration options.
12+:::
13+
14+This page details a set of **alpha** configuration options in a new format.
15+Going forward we are intending to add structured configuration in YAML format to
16+replace the existing TOML based configuration file and flags.
17+
18+Below is a reference for the structure of the configuration, with
19+[AlphaOptions](#alphaoptions) as the root of the configuration.
20+
21+When using alpha configuration, your config file will look something like below:
22+
23+```yaml
24+upstreams:
25+ - id: ...
26+ ...: ...
27+providers:
28+ - id: ...
29+ ...: ...
30+cookie:
31+ secret: ...
32+ ...: ...
33+injectRequestHeaders:
34+ - secretSource:
35+ ...: ...
36+injectResponseHeaders:
37+ - claimSource:
38+ ...: ...
39+```
40+
41+Please browse the [reference](#configuration-reference) below for the structure
42+of the new configuration format.
43+
44+# Migration Guide
45+
46+This section details breaking changes and migration steps for moving to the new
47+alpha configuration format.
48+
49+## Migrating header injections in v7.14.0
50+
51+From v7.14.0 onward, header injection sources must be explicitly nested. If you
52+previously relied on squashed fields, update to the new structure before
53+upgrading:
54+
55+```yaml
56+# before v7.14.0
57+injectRequestHeaders:
58+- name: X-Forwarded-User
59+ values:
60+ - claim: user
61+- name: X-Custom-Secret-header
62+ values:
63+ - value: my-super-secret
64+
65+# v7.14.0 and later
66+injectRequestHeaders:
67+- name: X-Forwarded-User
68+ values:
69+ - claimSource:
70+ claim: user
71+- name: X-Custom-Secret-header
72+ values:
73+ - secretSource:
74+ value: my-super-secret
75+```
76+
77+## Using Alpha Configuration
78+
79+To use the new **alpha** configuration, generate a YAML file based on the format
80+described in the [reference](#configuration-reference) below.
81+
82+Provide the path to this file using the `--alpha-config` flag.
83+
84+:::note
85+When using the `--alpha-config` flag, some options are no longer available.
86+See [removed options](#removed-options) below for more information.
87+:::
88+
89+### Converting configuration to the new structure
90+
91+Before adding the new `--alpha-config` option, start OAuth2 Proxy using the
92+`convert-config-to-alpha` flag to convert existing configuration to the new format.
93+
94+```bash
95+oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg
96+```
97+
98+This will convert any options supported by the new format to YAML and print the
99+new configuration to `STDOUT`.
100+
101+Copy this to a new file, remove any options from your existing configuration
102+noted in [removed options](#removed-options) and then start OAuth2 Proxy using
103+the new config.
104+
105+```bash
106+oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg
107+```
108+
109+### Validating Alpha Configuration
110+
111+Use `--config-test` to validate your alpha configuration without starting the proxy:
112+
113+```bash
114+oauth2-proxy --config core.cfg --alpha-config alpha.yaml --config-test
115+```
116+
117+This is useful for CI/CD pipelines to catch configuration errors before deployment.
118+See the [Configuration Validation](./overview.md#configuration-validation) section for more details.
119+
120+### How to use environment variables
121+
122+The alpha package supports the use of environment variables in place of yaml values, allowing sensitive data to be pulled from somewhere other than the yaml file.
123+When using environment variables, your yaml will look like this:
124+
125+```yaml
126+ providers:
127+ - provider: azure
128+ clientSecret: ${CLIENT_SECRET}
129+ ...
130+```
131+Where CLIENT_SECRET is an environment variable.
132+More information and available patterns can be found [here](https://github.com/a8m/envsubst#docs)
133+
134+### How to inject custom headers
135+
136+Configure `injectRequestHeaders` and `injectResponseHeaders` in alpha config YAML.
137+
138+```yaml
139+injectRequestHeaders:
140+ - name: "X-User-Email"
141+ values:
142+ - claimSource:
143+ claim: "email" # extract the email claim contents from the id token
144+ - name: "X-Static-Secret"
145+ values:
146+ # secrets need to be encoded with base64 when directly in the yaml config but will be send decoded
147+ - secretSource:
148+ value: "c3VwZXItc2VjcmV0"
149+ - name: "X-Static-File-Secret"
150+ - secretSource:
151+ fromFile: "/path/to/my/secret"
152+ - name: "X-Static-Env-Secret"
153+ - secretSource:
154+ value: "${MY_SECRET_ENV}" # content still needs to be base64 encoded
155+injectResponseHeaders:
156+ # Following will result in a header "Authorization: Basic <user:password> (encoded)"
157+ - name: "Authorization"
158+ values:
159+ - claimSource:
160+ claim: user
161+ prefix: "Basic "
162+ basicAuthPassword:
163+ value: c3VwZXItc2VjcmV0LXBhc3N3b3Jk # base64 encoded password
164+```
165+
166+**Value sources:**
167+* `claimSource` - `claim` (session claims either from id token or from profile URL)
168+* `secretSource` - `value` (base64), `fromFile` (file path)
169+
170+#### Claim value serialization
171+
172+`claimSource` converts the selected claim into one or more string header values. Scalars
173+produce one value, while arrays produce one value per element. Values that cannot be
174+converted directly to strings, such as objects, are JSON-encoded individually.
175+
176+Each non-empty value is added separately under the configured header name. An array of
177+objects therefore produces multiple header values containing one JSON object each, not a
178+single JSON array. HTTP libraries and intermediaries may expose repeated values as a
179+comma-joined string, so consumers should retrieve and parse each header value separately.
180+
181+**Request option:** `preserveRequestValue: true` retains existing header values
182+
183+**Incompatibility:** Remove legacy flags `pass-user-headers`, `set-xauthrequest`
184+
185+### How to utilize arbitrary claims provided by your Identity Provider
186+
187+With the additionalClaims attribute you can specify which claims you want to extract
188+from the ID Token or userinfo (ProfileURL) endpoint.
189+
190+Configure these on the relevant provider entry:
191+
192+```yaml
193+providers:
194+ - id: my-oidc-provider
195+ provider: oidc
196+ clientID: ${OAUTH_CLIENT_ID}
197+ clientSecret: ${OAUTH_CLIENT_SECRET}
198+ oidcConfig:
199+ issuerURL: https://issuer.example.com
200+ profileURL: https://issuer.example.com/oauth2/userinfo
201+ additionalClaims:
202+ - department
203+ - employee_id
204+ - organization.name
205+```
206+
207+OAuth2 Proxy resolves each configured claim using the following order:
208+
209+1. The raw ID token is checked first.
210+2. If the claim is not present there and `profileURL` is configured, the userinfo endpoint is queried.
211+3. If `skipClaimsFromProfileURL: true` is set, only the ID token is used.
212+
213+Claims that are not found are ignored rather than causing authentication to fail.
214+
215+You can use dot-separated paths for nested JSON objects, for example `organization.name`.
216+Array indexes are not supported.
217+
218+Once loaded, these claims are stored in the session as `additionalClaims`. They can then be
219+used anywhere session claims are accepted, including header injection:
220+
221+```yaml
222+injectRequestHeaders:
223+ - name: X-Department
224+ values:
225+ - claimSource:
226+ claim: department
227+ - name: X-Organization
228+ values:
229+ - claimSource:
230+ claim: organization.name
231+```
232+
233+This is useful when your IdP exposes application-specific attributes such as department,
234+tenant, employee ID, entitlement, or other custom claims that are not part of the default
235+OAuth2 Proxy session fields.
236+
237+## Removed options
238+
239+The following flags/options and their respective environment variables are no
240+longer available when using alpha configuration:
241+
242+<!-- Legacy Upstream FlagSet -->
243+- `flush-interval`/`flush_interval`
244+- `pass-host-header`/`pass_host_header`
245+- `proxy-websockets`/`proxy_websockets`
246+- `ssl-upstream-insecure-skip-verify`/`ssl_upstream_insecure_skip_verify`
247+- `upstream`/`upstreams`
248+
249+<!-- Legacy Headers FlagSet -->
250+- `pass-basic-auth`/`pass_basic_auth`
251+- `pass-access-token`/`pass_access_token`
252+- `pass-user-headers`/`pass_user_headers`
253+- `pass-authorization-header`/`pass_authorization_header`
254+- `set-basic-auth`/`set_basic_auth`
255+- `set-xauthrequest`/`set_xauthrequest`
256+- `set-authorization-header`/`set_authorization_header`
257+- `prefer-email-to-user`/`prefer_email_to_user`
258+- `basic-auth-password`/`basic_auth_password`
259+- `skip-auth-strip-headers`/`skip_auth_strip_headers`
260+
261+<!-- Legacy provider FlagSet -->
262+- `client-id`/`client_id`
263+- `client-secret`/`client_secret`, and `client-secret-file`/`client_secret_file`
264+- `provider`
265+- `provider-display-name`/`provider_display_name`
266+- `provider-ca-file`/`provider_ca_files`
267+- `login-url`/`login_url`
268+- `redeem-url`/`redeem_url`
269+- `profile-url`/`profile_url`
270+- `resource`
271+- `validate-url`/`validate_url`
272+- `scope`
273+- `prompt`
274+- `approval-prompt`/`approval_prompt`
275+- `acr-values`/`acr_values`
276+- `user-id-claim`/`user_id_claim`
277+- `allowed-group`/`allowed_groups`
278+- `allowed-role`/`allowed_roles`
279+- `jwt-key`/`jwt_key`
280+- `jwt-key-file`/`jwt_key_file`
281+- `pubjwk-url`/`pubjwk_url`
282+
283+and all provider-specific options, i.e. any option whose name includes `oidc`,
284+`azure`, `bitbucket`, `github`, `gitlab`, `google` or `keycloak`. Attempting to
285+use any of these options via flags or via config when `--alpha-config` is
286+set will result in an error.
287+
288+:::important
289+You must remove these options before starting OAuth2 Proxy with `--alpha-config`
290+:::
291+
292+## Configuration Reference
293+
294+<!--- THIS FILE IS AUTOGENERATED!!! DO NOT EDIT!!! -->
295+
296+### ADFSOptions
297+
298+(**Appears on:** [Provider](#provider))
299+
300+
301+
302+| Field | Type | Description |
303+| ----- | ---- | ----------- |
304+| `skipScope` | _bool_ | Skip adding the scope parameter in login request<br/>Default value is 'false' |
305+
306+### AlphaOptions
307+
308+AlphaOptions contains alpha structured configuration options.
309+Usage of these options allows users to access alpha features that are not
310+available as part of the primary configuration structure for OAuth2 Proxy.
311+
312+:::warning
313+The options within this structure are considered alpha.
314+They may change between releases without notice.
315+:::
316+
317+| Field | Type | Description |
318+| ----- | ---- | ----------- |
319+| `upstreamConfig` | _[UpstreamConfig](#upstreamconfig)_ | UpstreamConfig is used to configure upstream servers.<br/>Once a user is authenticated, requests to the server will be proxied to<br/>these upstream servers based on the path mappings defined in this list. |
320+| `injectRequestHeaders` | _[[]Header](#header)_ | InjectRequestHeaders is used to configure headers that should be added<br/>to requests to upstream servers.<br/>Headers may source values from either the authenticated user's session<br/>or from a static secret value. |
321+| `injectResponseHeaders` | _[[]Header](#header)_ | InjectResponseHeaders is used to configure headers that should be added<br/>to responses from the proxy.<br/>This is typically used when using the proxy as an external authentication<br/>provider in conjunction with another proxy such as NGINX and its<br/>auth_request module.<br/>Headers may source values from either the authenticated user's session<br/>or from a static secret value. |
322+| `server` | _[Server](#server)_ | Server is used to configure the HTTP(S) server for the proxy application.<br/>You may choose to run both HTTP and HTTPS servers simultaneously.<br/>This can be done by setting the BindAddress and the SecureBindAddress simultaneously.<br/>To use the secure server you must configure a TLS certificate and key. |
323+| `metricsServer` | _[Server](#server)_ | MetricsServer is used to configure the HTTP(S) server for metrics.<br/>You may choose to run both HTTP and HTTPS servers simultaneously.<br/>This can be done by setting the BindAddress and the SecureBindAddress simultaneously.<br/>To use the secure server you must configure a TLS certificate and key. |
324+| `providers` | _[Providers](#providers)_ | Providers is used to configure your provider. **Multiple-providers is not<br/>yet working.** [This feature is tracked in<br/>#925](https://github.com/oauth2-proxy/oauth2-proxy/issues/926) |
325+
326+### AzureOptions
327+
328+(**Appears on:** [Provider](#provider))
329+
330+
331+
332+| Field | Type | Description |
333+| ----- | ---- | ----------- |
334+| `tenant` | _string_ | Tenant directs to a tenant-specific or common (tenant-independent) endpoint<br/>Default value is 'common' |
335+| `graphGroupField` | _string_ | GraphGroupField configures the group field to be used when building the groups list from Microsoft Graph<br/>Default value is 'id' |
336+
337+### BitbucketOptions
338+
339+(**Appears on:** [Provider](#provider))
340+
341+
342+
343+| Field | Type | Description |
344+| ----- | ---- | ----------- |
345+| `team` | _string_ | Team sets restrict logins to members of this team |
346+| `repository` | _string_ | Repository sets restrict logins to user with access to this repository |
347+
348+### ClaimSource
349+
350+(**Appears on:** [HeaderValue](#headervalue))
351+
352+ClaimSource allows loading a header value from a claim within the session
353+
354+| Field | Type | Description |
355+| ----- | ---- | ----------- |
356+| `claim` | _string_ | Claim is the name of the claim in the session that the value should be<br/>loaded from. Available claims: `access_token` `id_token` `created_at`<br/>`expires_on` `refresh_token` `email` `user` `groups` `preferred_username`. |
357+| `prefix` | _string_ | Prefix is an optional prefix that will be prepended to the value of the<br/>claim if it is non-empty. |
358+| `basicAuthPassword` | _[SecretSource](#secretsource)_ | BasicAuthPassword converts this claim into a basic auth header.<br/>Note the value of claim will become the basic auth username and the<br/>basicAuthPassword will be used as the password value. |
359+
360+### GitHubOptions
361+
362+(**Appears on:** [Provider](#provider))
363+
364+
365+
366+| Field | Type | Description |
367+| ----- | ---- | ----------- |
368+| `org` | _string_ | Org sets restrict logins to members of this organisation |
369+| `team` | _string_ | Team sets restrict logins to members of this team |
370+| `repo` | _string_ | Repo sets restrict logins to collaborators of this repository |
371+| `token` | _string_ | Token is the token to use when verifying repository collaborators<br/>it must have push access to the repository |
372+| `users` | _[]string_ | Users allows users with these usernames to login<br/>even if they do not belong to the specified org and team or collaborators |
373+
374+### GitLabOptions
375+
376+(**Appears on:** [Provider](#provider))
377+
378+
379+
380+| Field | Type | Description |
381+| ----- | ---- | ----------- |
382+| `group` | _[]string_ | Group sets restrict logins to members of this group |
383+| `projects` | _[]string_ | Projects restricts logins to members of these projects |
384+
385+### GoogleOptions
386+
387+(**Appears on:** [Provider](#provider))
388+
389+
390+
391+| Field | Type | Description |
392+| ----- | ---- | ----------- |
393+| `group` | _[]string_ | Groups sets restrict logins to members of this Google group |
394+| `adminEmail` | _string_ | AdminEmail is the Google admin to impersonate for api calls |
395+| `serviceAccountJson` | _string_ | ServiceAccountJSON is the path to the service account json credentials |
396+| `useApplicationDefaultCredentials` | _bool_ | UseApplicationDefaultCredentials is a boolean whether to use Application Default Credentials instead of a ServiceAccountJSON |
397+| `targetPrincipal` | _string_ | TargetPrincipal is the Google Service Account used for Application Default Credentials |
398+| `useOrganizationID` | _bool_ | UseOrganizationId indicates whether to use the organization ID as the UserName claim |
399+| `adminAPIUserScope` | _string_ | admin scope needed for fetching user organization information from admin api, can be one of cloud, user or defaults to readonly |
400+
401+### Header
402+
403+(**Appears on:** [AlphaOptions](#alphaoptions))
404+
405+Header represents an individual header that will be added to a request or
406+response header.
407+
408+| Field | Type | Description |
409+| ----- | ---- | ----------- |
410+| `name` | _string_ | Name is the header name to be used for this set of values.<br/>Names should be unique within a list of Headers. |
411+| `preserveRequestValue` | _bool_ | PreserveRequestValue determines whether any values for this header<br/>should be preserved for the request to the upstream server.<br/>This option only applies to injected request headers.<br/>Defaults to false (headers that match this header will be stripped). |
412+| `InsecureSkipHeaderNormalization` | _bool_ | InsecureSkipHeaderNormalization disables normalizing the header name<br/>According to RFC 7230 Section 3.2 there aren't any rules about<br/>capitalization of header names, but the standard practice is to use<br/>Title-Case (e.g. X-Forwarded-For). By default, header names will be<br/>normalized to Title-Case and any incoming headers that match will be<br/>treated as the same header. Additionally underscores (_) in header names<br/>will be converted to dashes (-) when normalizing.<br/>Defaults to false (header names will be normalized). |
413+| `values` | _[[]HeaderValue](#headervalue)_ | Values contains the desired values for this header |
414+
415+### HeaderValue
416+
417+(**Appears on:** [Header](#header))
418+
419+HeaderValue represents a single header value and the sources that can
420+make up the header value
421+
422+| Field | Type | Description |
423+| ----- | ---- | ----------- |
424+| `value` | _[]byte_ | Value expects a base64 encoded string value. |
425+| `fromEnv` | _string_ | FromEnv expects the name of an environment variable. |
426+| `fromFile` | _string_ | FromFile expects a path to a file containing the secret value. |
427+| `claim` | _string_ | Claim is the name of the claim in the session that the value should be<br/>loaded from. Available claims: `access_token` `id_token` `created_at`<br/>`expires_on` `refresh_token` `email` `user` `groups` `preferred_username`. |
428+| `prefix` | _string_ | Prefix is an optional prefix that will be prepended to the value of the<br/>claim if it is non-empty. |
429+| `basicAuthPassword` | _[SecretSource](#secretsource)_ | BasicAuthPassword converts this claim into a basic auth header.<br/>Note the value of claim will become the basic auth username and the<br/>basicAuthPassword will be used as the password value. |
430+
431+### KeycloakOptions
432+
433+(**Appears on:** [Provider](#provider))
434+
435+
436+
437+| Field | Type | Description |
438+| ----- | ---- | ----------- |
439+| `groups` | _[]string_ | Group enables to restrict login to members of indicated group |
440+| `roles` | _[]string_ | Role enables to restrict login to users with role (only available when using the keycloak-oidc provider) |
441+
442+### LoginGovOptions
443+
444+(**Appears on:** [Provider](#provider))
445+
446+
447+
448+| Field | Type | Description |
449+| ----- | ---- | ----------- |
450+| `jwtKey` | _string_ | JWTKey is a private key in PEM format used to sign JWT, |
451+| `jwtKeyFile` | _string_ | JWTKeyFile is a path to the private key file in PEM format used to sign the JWT |
452+| `pubjwkURL` | _string_ | PubJWKURL is the JWK pubkey access endpoint |
453+
454+### LoginURLParameter
455+
456+(**Appears on:** [Provider](#provider))
457+
458+LoginURLParameter is the configuration for a single query parameter that
459+can be passed through from the `/oauth2/start` endpoint to the IdP login
460+URL. The "default" option specifies the default value or values (if any)
461+that will be passed to the IdP for this parameter, and "allow" is a list
462+of options for ways in which this parameter can be set or overridden via
463+the query string to `/oauth2/start`.
464+If _only_ a default is specified and no "allow" then the parameter is
465+effectively fixed - the default value will always be used and anything
466+passed to the start URL will be ignored. If _only_ "allow" is specified
467+but no default then the parameter will only be passed on to the IdP if
468+the caller provides it, and no value will be sent otherwise.
469+
470+Examples:
471+
472+# A parameter whose value is fixed
473+
474+```
475+name: organization
476+default:
477+- myorg
478+```
479+
480+A parameter that is not passed by default, but may be set to one of a
481+fixed set of values
482+
483+```
484+name: prompt
485+allow:
486+- value: login
487+- value: consent
488+- value: select_account
489+```
490+
491+A parameter that is passed by default but may be overridden by one of
492+a fixed set of values
493+
494+```
495+name: prompt
496+default: ["login"]
497+allow:
498+- value: consent
499+- value: select_account
500+```
501+
502+A parameter that may be overridden, but only by values that match a
503+regular expression. For example to restrict `login_hint` to email
504+addresses in your organization's domain:
505+
506+```
507+name: login_hint
508+allow:
509+- pattern: '^[^@]*@example\.com$'
510+# this allows at most one "@" sign, and requires "example.com" domain.
511+```
512+
513+Note that the YAML rules around exactly which characters are allowed
514+and/or require escaping in different types of string literals are
515+convoluted. For regular expressions the single quoted form is simplest
516+as backslash is not considered to be an escape character. Alternatively
517+use the "chomped block" format `|-`:
518+
519+```
520+ - pattern: |-
521+ ^[^@]*@example\.com$
522+
523+```
524+
525+The hyphen is important, a `|` block would have a trailing newline
526+character.
527+
528+| Field | Type | Description |
529+| ----- | ---- | ----------- |
530+| `name` | _string_ | Name specifies the name of the query parameter. |
531+| `default` | _[]string_ | _(Optional)_ Default specifies a default value or values that will be<br/>passed to the IdP if not overridden. |
532+| `allow` | _[[]URLParameterRule](#urlparameterrule)_ | _(Optional)_ Allow specifies rules about how the default (if any) may be<br/>overridden via the query string to `/oauth2/start`. Only<br/>values that match one or more of the allow rules will be<br/>forwarded to the IdP. |
533+
534+### MicrosoftEntraIDOptions
535+
536+(**Appears on:** [Provider](#provider))
537+
538+
539+
540+| Field | Type | Description |
541+| ----- | ---- | ----------- |
542+| `allowedTenants` | _[]string_ | AllowedTenants is a list of allowed tenants. In case of multi-tenant apps, incoming tokens are<br/>issued by different issuers and OIDC issuer verification needs to be disabled.<br/>When not specified, all tenants are allowed. Redundant for single-tenant apps<br/>(regular ID token validation matches the issuer). |
543+| `federatedTokenAuth` | _bool_ | FederatedTokenAuth enable oAuth2 client authentication with federated token projected<br/>by Entra Workload Identity plugin, instead of client secret. |
544+
545+### OIDCOptions
546+
547+(**Appears on:** [Provider](#provider))
548+
549+
550+
551+| Field | Type | Description |
552+| ----- | ---- | ----------- |
553+| `issuerURL` | _string_ | IssuerURL is the OpenID Connect issuer URL<br/>eg: https://accounts.google.com |
554+| `insecureAllowUnverifiedEmail` | _bool_ | InsecureAllowUnverifiedEmail prevents failures if an email address in an id_token is not verified<br/>default set to 'false' |
555+| `insecureSkipIssuerVerification` | _bool_ | InsecureSkipIssuerVerification skips verification of ID token issuers. When false, ID Token Issuers must match the OIDC discovery URL<br/>default set to 'false' |
556+| `insecureSkipNonce` | _bool_ | InsecureSkipNonce skips verifying the ID Token's nonce claim that must match<br/>the random nonce sent in the initial OAuth flow. Otherwise, the nonce is checked<br/>after the initial OAuth redeem & subsequent token refreshes.<br/>default set to 'true'<br/>Warning: In a future release, this will change to 'false' by default for enhanced security. |
557+| `skipDiscovery` | _bool_ | SkipDiscovery allows to skip OIDC discovery and use manually supplied Endpoints<br/>default set to 'false' |
558+| `jwksURL` | _string_ | JwksURL is the OpenID Connect JWKS URL<br/>eg: https://www.googleapis.com/oauth2/v3/certs |
559+| `publicKeyFiles` | _[]string_ | PublicKeyFiles is a list of paths pointing to public key files in PEM format to use<br/>for verifying JWT tokens |
560+| `emailClaim` | _string_ | EmailClaim indicates which claim contains the user email,<br/>default set to 'email' |
561+| `groupsClaim` | _string_ | GroupsClaim indicates which claim contains the user groups<br/>default set to 'groups' |
562+| `userIDClaim` | _string_ | UserIDClaim indicates which claim contains the user ID<br/>default set to 'email' |
563+| `audienceClaims` | _[]string_ | AudienceClaim allows to define any claim that is verified against the client id<br/>By default `aud` claim is used for verification. |
564+| `extraAudiences` | _[]string_ | ExtraAudiences is a list of additional audiences that are allowed<br/>to pass verification in addition to the client id. |
565+| `enabledSigningAlgs` | _[]string_ | EnabledSigningAlgs is a list of allowed JWT signing algorithms.<br/>When discovery is enabled, the effective set is the intersection<br/>between this list and the provider's discovered supported algorithms.<br/>By default `RS256` is used if nothing has been discovered or specified. |
566+
567+### Provider
568+
569+(**Appears on:** [Providers](#providers))
570+
571+Provider holds all configuration for a single provider
572+
573+| Field | Type | Description |
574+| ----- | ---- | ----------- |
575+| `clientID` | _string_ | ClientID is the OAuth Client ID that is defined in the provider<br/>This value is required for all providers. |
576+| `clientSecret` | _string_ | ClientSecret is the OAuth Client Secret that is defined in the provider<br/>This value is required for all providers. |
577+| `clientSecretFile` | _string_ | ClientSecretFile is the name of the file<br/>containing the OAuth Client Secret, it will be used if ClientSecret is not set. |
578+| `keycloakConfig` | _[KeycloakOptions](#keycloakoptions)_ | KeycloakConfig holds all configurations for Keycloak provider. |
579+| `azureConfig` | _[AzureOptions](#azureoptions)_ | AzureConfig holds all configurations for Azure provider. |
580+| `microsoftEntraIDConfig` | _[MicrosoftEntraIDOptions](#microsoftentraidoptions)_ | MicrosoftEntraIDConfig holds all configurations for Entra ID provider. |
581+| `ADFSConfig` | _[ADFSOptions](#adfsoptions)_ | ADFSConfig holds all configurations for ADFS provider. |
582+| `bitbucketConfig` | _[BitbucketOptions](#bitbucketoptions)_ | BitbucketConfig holds all configurations for Bitbucket provider. |
583+| `githubConfig` | _[GitHubOptions](#githuboptions)_ | GitHubConfig holds all configurations for GitHubC provider. |
584+| `gitlabConfig` | _[GitLabOptions](#gitlaboptions)_ | GitLabConfig holds all configurations for GitLab provider. |
585+| `googleConfig` | _[GoogleOptions](#googleoptions)_ | GoogleConfig holds all configurations for Google provider. |
586+| `oidcConfig` | _[OIDCOptions](#oidcoptions)_ | OIDCConfig holds all configurations for OIDC provider<br/>or providers utilize OIDC configurations. |
587+| `loginGovConfig` | _[LoginGovOptions](#logingovoptions)_ | LoginGovConfig holds all configurations for LoginGov provider. |
588+| `id` | _string_ | ID should be a unique identifier for the provider.<br/>This value is required for all providers. |
589+| `provider` | _[ProviderType](#providertype)_ | Type is the OAuth provider<br/>must be set from the supported providers group,<br/>otherwise 'Google' is set as default |
590+| `name` | _string_ | Name is the providers display name<br/>if set, it will be shown to the users in the login page. |
591+| `caFiles` | _[]string_ | CAFiles is a list of paths to CA certificates that should be used when connecting to the provider.<br/>If not specified, the default Go trust sources are used instead |
592+| `useSystemTrustStore` | _bool_ | UseSystemTrustStore determines if your custom CA files and the system trust store are used<br/>If set to true, your custom CA files and the system trust store are used otherwise only your custom CA files. |
593+| `loginURL` | _string_ | LoginURL is the authentication endpoint |
594+| `loginURLParameters` | _[[]LoginURLParameter](#loginurlparameter)_ | LoginURLParameters defines the parameters that can be passed from the start URL to the IdP login URL |
595+| `authRequestResponseMode` | _string_ | AuthRequestResponseMode defines the response mode to request during authorization request |
596+| `redeemURL` | _string_ | RedeemURL is the token redemption endpoint |
597+| `profileURL` | _string_ | ProfileURL is the profile access endpoint |
598+| `skipClaimsFromProfileURL` | _bool_ | SkipClaimsFromProfileURL allows to skip request to Profile URL for resolving claims not present in id_token<br/>default set to 'false' |
599+| `resource` | _string_ | ProtectedResource is the resource that is protected (Azure AD and ADFS only) |
600+| `validateURL` | _string_ | ValidateURL is the access token validation endpoint |
601+| `scope` | _string_ | Scope is the OAuth scope specification |
602+| `allowedGroups` | _[]string_ | AllowedGroups is a list of restrict logins to members of this group |
603+| `code_challenge_method` | _string_ | The code challenge method |
604+| `additionalClaims` | _[]string_ | Additional claims to be obtained from the upstream IDP, either from the id_token or from the userinfo endpoint if configured. |
605+| `backendLogoutURL` | _string_ | URL to call to perform backend logout, `{id_token}` would be replaced by the actual `id_token` if available in the session |
606+
607+### ProviderType
608+#### (`string` alias)
609+
610+(**Appears on:** [Provider](#provider))
611+
612+ProviderType is used to enumerate the different provider type options
613+Valid options are: adfs, azure, bitbucket, digitalocean facebook, github,
614+gitlab, google, keycloak, keycloak-oidc, linkedin, login.gov, nextcloud
615+and oidc.
616+
617+### Providers
618+
619+#### ([[]Provider](#provider) alias)
620+
621+(**Appears on:** [AlphaOptions](#alphaoptions))
622+
623+The provider can be selected using the `provider` configuration value, or
624+set in the [`providers` array using
625+AlphaConfig](https://oauth2-proxy.github.io/oauth2-proxy/configuration/alpha-config#providers).
626+However, [**the feature to implement multiple providers is not
627+complete**](https://github.com/oauth2-proxy/oauth2-proxy/issues/926).
628+
629+### SecretSource
630+
631+(**Appears on:** [ClaimSource](#claimsource), [HeaderValue](#headervalue), [TLS](#tls))
632+
633+SecretSource references an individual secret value.
634+Only one source within the struct should be defined at any time.
635+
636+| Field | Type | Description |
637+| ----- | ---- | ----------- |
638+| `value` | _[]byte_ | Value expects a base64 encoded string value. |
639+| `fromEnv` | _string_ | FromEnv expects the name of an environment variable. |
640+| `fromFile` | _string_ | FromFile expects a path to a file containing the secret value. |
641+
642+### Server
643+
644+(**Appears on:** [AlphaOptions](#alphaoptions))
645+
646+Server represents the configuration for an HTTP(S) server
647+
648+| Field | Type | Description |
649+| ----- | ---- | ----------- |
650+| `bindAddress` | _string_ | BindAddress is the address on which to serve traffic.<br/>Different types of bind addresses are supported:<br/>* `[http://]<addr>:<port>`<br/>* `fd:<int>` (case insensitive)<br/>* `unix://<path>`<br/>Unix sockets are created with default system umask mode, which can be overridden, e.g.: `unix://my-socket,mode=0777`<br/>Square brackets are required for ipv6 address, e.g. `http://[::1]:4180`<br/>Leave blank or set to "-" to disable. |
651+| `secureBindAddress` | _string_ | SecureBindAddress is the address on which to serve secure traffic.<br/>Secure bind addresses need to respond with valid SSL and use the following format:<br/>* `[https://]<addr>:<port>`<br/>Square brackets are required for ipv6 address, e.g. `https://[::1]:4180`<br/>Leave blank or set to "-" to disable. |
652+| `tls` | _[TLS](#tls)_ | TLS contains the information for loading the certificate and key for the<br/>secure traffic and further configuration for the TLS server. |
653+
654+### TLS
655+
656+(**Appears on:** [Server](#server))
657+
658+TLS contains the information for loading a TLS certificate and key
659+as well as an optional minimal TLS version that is acceptable.
660+
661+| Field | Type | Description |
662+| ----- | ---- | ----------- |
663+| `key` | _[SecretSource](#secretsource)_ | Key is the TLS key data to use.<br/>Typically this will come from a file. |
664+| `cert` | _[SecretSource](#secretsource)_ | Cert is the TLS certificate data to use.<br/>Typically this will come from a file. |
665+| `minVersion` | _string_ | MinVersion is the minimal TLS version that is acceptable.<br/>E.g. Set to "TLS1.3" to select TLS version 1.3 |
666+| `cipherSuites` | _[]string_ | CipherSuites is a list of TLS cipher suites that are allowed.<br/>E.g.:<br/>- TLS_RSA_WITH_RC4_128_SHA<br/>- TLS_RSA_WITH_AES_256_GCM_SHA384<br/>If not specified, the default Go safe cipher list is used.<br/>List of valid cipher suites can be found in the [crypto/tls documentation](https://pkg.go.dev/crypto/tls#pkg-constants). |
667+
668+### URLParameterRule
669+
670+(**Appears on:** [LoginURLParameter](#loginurlparameter))
671+
672+URLParameterRule represents a rule by which query parameters
673+passed to the `/oauth2/start` endpoint are checked to determine whether
674+they are valid overrides for the given parameter passed to the IdP's
675+login URL. Either Value or Pattern should be supplied, not both.
676+
677+| Field | Type | Description |
678+| ----- | ---- | ----------- |
679+| `value` | _string_ | A Value rule matches just this specific value |
680+| `pattern` | _string_ | A Pattern rule gives a regular expression that must be matched by<br/>some substring of the value. The expression is _not_ automatically<br/>anchored to the start and end of the value, if you _want_ to restrict<br/>the whole parameter value you must anchor it yourself with `^` and `$`. |
681+
682+### Upstream
683+
684+(**Appears on:** [UpstreamConfig](#upstreamconfig))
685+
686+Upstream represents the configuration for an upstream server.
687+Requests will be proxied to this upstream if the path matches the request path.
688+
689+| Field | Type | Description |
690+| ----- | ---- | ----------- |
691+| `id` | _string_ | ID should be a unique identifier for the upstream.<br/>This value is required for all upstreams. |
692+| `path` | _string_ | Path is used to map requests to the upstream server.<br/>The closest match will take precedence and all Paths must be unique.<br/>Without RewriteTarget, Path follows gorilla/mux route syntax.<br/>Eg:<br/>- `/foo`: Match only the explicit path `/foo`<br/>- `/bar/`: Match any path prefixed with `/bar/`<br/>- `/baz/{path:.*}`: Match any path prefixed with `/baz/`<br/>When RewriteTarget is set, Path is treated as a regular expression.<br/>Eg: `^/baz/(.*)$` matches any path prefixed with `/baz` and captures the<br/>remaining path for use with RewriteTarget. |
693+| `rewriteTarget` | _string_ | RewriteTarget allows users to rewrite the request path before it is sent to<br/>the upstream server (for an HTTP/HTTPS upstream) or mapped to the filesystem<br/>(for a `file:` upstream).<br/>Use the Path to capture segments for reuse within the rewrite target.<br/>Eg: With a Path of `^/baz/(.*)`, a RewriteTarget of `/foo/$1` would rewrite<br/>the request `/baz/abc/123` to `/foo/abc/123` before proxying to the<br/>upstream server. Or if the upstream were `file:///app`, a request for<br/>`/baz/info.html` would return the contents of the file `/app/foo/info.html`. |
694+| `uri` | _string_ | The URI of the upstream server. This may be an HTTP(S) server of a File<br/>based URL. It may include a path, in which case all requests will be served<br/>under that path.<br/>Eg:<br/>- http://localhost:8080<br/>- https://service.localhost<br/>- https://service.localhost/path<br/>- file://host/path<br/>If the URI's path is "/base" and the incoming request was for "/dir",<br/>the upstream request will be for "/base/dir". |
695+| `insecureSkipTLSVerify` | _bool_ | InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.<br/>This option is insecure and will allow potential Man-In-The-Middle attacks<br/>between OAuth2 Proxy and the upstream server.<br/>Defaults to false. |
696+| `static` | _bool_ | Static will make all requests to this upstream have a static response.<br/>The response will have a body of "Authenticated" and a response code<br/>matching StaticCode.<br/>If StaticCode is not set, the response will return a 200 response. |
697+| `staticCode` | _int_ | StaticCode determines the response code for the Static response.<br/>This option can only be used with Static enabled. |
698+| `flushInterval` | _duration_ | FlushInterval is the period between flushing the response buffer when<br/>streaming response from the upstream.<br/>Defaults to 1 second. |
699+| `passHostHeader` | _bool_ | PassHostHeader determines whether the request host header should be proxied<br/>to the upstream server.<br/>Defaults to true. |
700+| `proxyWebSockets` | _bool_ | ProxyWebSockets enables proxying of websockets to upstream servers<br/>Defaults to true. |
701+| `timeout` | _duration_ | Timeout is the maximum duration the server will wait for a response from the upstream server.<br/>Defaults to 30 seconds. |
702+| `disableKeepAlives` | _bool_ | DisableKeepAlives disables HTTP keep-alive connections to the upstream server.<br/>Defaults to false. |
703+
704+### UpstreamConfig
705+
706+(**Appears on:** [AlphaOptions](#alphaoptions))
707+
708+UpstreamConfig is a collection of definitions for upstream servers.
709+
710+| Field | Type | Description |
711+| ----- | ---- | ----------- |
712+| `proxyRawPath` | _bool_ | ProxyRawPath will pass the raw url path to upstream allowing for urls<br/>like: "/%2F/" which would otherwise be redirected to "/" |
713+| `upstreams` | _[[]Upstream](#upstream)_ | Upstreams represents the configuration for the upstream servers.<br/>Requests will be proxied to this upstream if the path matches the request path. |
docs/docs/configuration/alpha_config.md.tmplnew file+292
@@ -0,0 +1,292 @@
1+---
2+id: alpha-config
3+title: Alpha Configuration
4+---
5+
6+:::warning
7+This page contains documentation for alpha features.
8+We reserve the right to make breaking changes to the features detailed within this page with no notice.
9+
10+Options described in this page may be changed, removed, renamed or moved without prior warning.
11+Please beware of this before you use alpha configuration options.
12+:::
13+
14+This page details a set of **alpha** configuration options in a new format.
15+Going forward we are intending to add structured configuration in YAML format to
16+replace the existing TOML based configuration file and flags.
17+
18+Below is a reference for the structure of the configuration, with
19+[AlphaOptions](#alphaoptions) as the root of the configuration.
20+
21+When using alpha configuration, your config file will look something like below:
22+
23+```yaml
24+upstreams:
25+ - id: ...
26+ ...: ...
27+providers:
28+ - id: ...
29+ ...: ...
30+cookie:
31+ secret: ...
32+ ...: ...
33+injectRequestHeaders:
34+ - secretSource:
35+ ...: ...
36+injectResponseHeaders:
37+ - claimSource:
38+ ...: ...
39+```
40+
41+Please browse the [reference](#configuration-reference) below for the structure
42+of the new configuration format.
43+
44+# Migration Guide
45+
46+This section details breaking changes and migration steps for moving to the new
47+alpha configuration format.
48+
49+## Migrating header injections in v7.14.0
50+
51+From v7.14.0 onward, header injection sources must be explicitly nested. If you
52+previously relied on squashed fields, update to the new structure before
53+upgrading:
54+
55+```yaml
56+# before v7.14.0
57+injectRequestHeaders:
58+- name: X-Forwarded-User
59+ values:
60+ - claim: user
61+- name: X-Custom-Secret-header
62+ values:
63+ - value: my-super-secret
64+
65+# v7.14.0 and later
66+injectRequestHeaders:
67+- name: X-Forwarded-User
68+ values:
69+ - claimSource:
70+ claim: user
71+- name: X-Custom-Secret-header
72+ values:
73+ - secretSource:
74+ value: my-super-secret
75+```
76+
77+## Using Alpha Configuration
78+
79+To use the new **alpha** configuration, generate a YAML file based on the format
80+described in the [reference](#configuration-reference) below.
81+
82+Provide the path to this file using the `--alpha-config` flag.
83+
84+:::note
85+When using the `--alpha-config` flag, some options are no longer available.
86+See [removed options](#removed-options) below for more information.
87+:::
88+
89+### Converting configuration to the new structure
90+
91+Before adding the new `--alpha-config` option, start OAuth2 Proxy using the
92+`convert-config-to-alpha` flag to convert existing configuration to the new format.
93+
94+```bash
95+oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg
96+```
97+
98+This will convert any options supported by the new format to YAML and print the
99+new configuration to `STDOUT`.
100+
101+Copy this to a new file, remove any options from your existing configuration
102+noted in [removed options](#removed-options) and then start OAuth2 Proxy using
103+the new config.
104+
105+```bash
106+oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg
107+```
108+
109+### Validating Alpha Configuration
110+
111+Use `--config-test` to validate your alpha configuration without starting the proxy:
112+
113+```bash
114+oauth2-proxy --config core.cfg --alpha-config alpha.yaml --config-test
115+```
116+
117+This is useful for CI/CD pipelines to catch configuration errors before deployment.
118+See the [Configuration Validation](./overview.md#configuration-validation) section for more details.
119+
120+### How to use environment variables
121+
122+The alpha package supports the use of environment variables in place of yaml values, allowing sensitive data to be pulled from somewhere other than the yaml file.
123+When using environment variables, your yaml will look like this:
124+
125+```yaml
126+ providers:
127+ - provider: azure
128+ clientSecret: ${CLIENT_SECRET}
129+ ...
130+```
131+Where CLIENT_SECRET is an environment variable.
132+More information and available patterns can be found [here](https://github.com/a8m/envsubst#docs)
133+
134+### How to inject custom headers
135+
136+Configure `injectRequestHeaders` and `injectResponseHeaders` in alpha config YAML.
137+
138+```yaml
139+injectRequestHeaders:
140+ - name: "X-User-Email"
141+ values:
142+ - claimSource:
143+ claim: "email" # extract the email claim contents from the id token
144+ - name: "X-Static-Secret"
145+ values:
146+ # secrets need to be encoded with base64 when directly in the yaml config but will be send decoded
147+ - secretSource:
148+ value: "c3VwZXItc2VjcmV0"
149+ - name: "X-Static-File-Secret"
150+ - secretSource:
151+ fromFile: "/path/to/my/secret"
152+ - name: "X-Static-Env-Secret"
153+ - secretSource:
154+ value: "${MY_SECRET_ENV}" # content still needs to be base64 encoded
155+injectResponseHeaders:
156+ # Following will result in a header "Authorization: Basic <user:password> (encoded)"
157+ - name: "Authorization"
158+ values:
159+ - claimSource:
160+ claim: user
161+ prefix: "Basic "
162+ basicAuthPassword:
163+ value: c3VwZXItc2VjcmV0LXBhc3N3b3Jk # base64 encoded password
164+```
165+
166+**Value sources:**
167+* `claimSource` - `claim` (session claims either from id token or from profile URL)
168+* `secretSource` - `value` (base64), `fromFile` (file path)
169+
170+#### Claim value serialization
171+
172+`claimSource` converts the selected claim into one or more string header values. Scalars
173+produce one value, while arrays produce one value per element. Values that cannot be
174+converted directly to strings, such as objects, are JSON-encoded individually.
175+
176+Each non-empty value is added separately under the configured header name. An array of
177+objects therefore produces multiple header values containing one JSON object each, not a
178+single JSON array. HTTP libraries and intermediaries may expose repeated values as a
179+comma-joined string, so consumers should retrieve and parse each header value separately.
180+
181+**Request option:** `preserveRequestValue: true` retains existing header values
182+
183+**Incompatibility:** Remove legacy flags `pass-user-headers`, `set-xauthrequest`
184+
185+### How to utilize arbitrary claims provided by your Identity Provider
186+
187+With the additionalClaims attribute you can specify which claims you want to extract
188+from the ID Token or userinfo (ProfileURL) endpoint.
189+
190+Configure these on the relevant provider entry:
191+
192+```yaml
193+providers:
194+ - id: my-oidc-provider
195+ provider: oidc
196+ clientID: ${OAUTH_CLIENT_ID}
197+ clientSecret: ${OAUTH_CLIENT_SECRET}
198+ oidcConfig:
199+ issuerURL: https://issuer.example.com
200+ profileURL: https://issuer.example.com/oauth2/userinfo
201+ additionalClaims:
202+ - department
203+ - employee_id
204+ - organization.name
205+```
206+
207+OAuth2 Proxy resolves each configured claim using the following order:
208+
209+1. The raw ID token is checked first.
210+2. If the claim is not present there and `profileURL` is configured, the userinfo endpoint is queried.
211+3. If `skipClaimsFromProfileURL: true` is set, only the ID token is used.
212+
213+Claims that are not found are ignored rather than causing authentication to fail.
214+
215+You can use dot-separated paths for nested JSON objects, for example `organization.name`.
216+Array indexes are not supported.
217+
218+Once loaded, these claims are stored in the session as `additionalClaims`. They can then be
219+used anywhere session claims are accepted, including header injection:
220+
221+```yaml
222+injectRequestHeaders:
223+ - name: X-Department
224+ values:
225+ - claimSource:
226+ claim: department
227+ - name: X-Organization
228+ values:
229+ - claimSource:
230+ claim: organization.name
231+```
232+
233+This is useful when your IdP exposes application-specific attributes such as department,
234+tenant, employee ID, entitlement, or other custom claims that are not part of the default
235+OAuth2 Proxy session fields.
236+
237+## Removed options
238+
239+The following flags/options and their respective environment variables are no
240+longer available when using alpha configuration:
241+
242+<!-- Legacy Upstream FlagSet -->
243+- `flush-interval`/`flush_interval`
244+- `pass-host-header`/`pass_host_header`
245+- `proxy-websockets`/`proxy_websockets`
246+- `ssl-upstream-insecure-skip-verify`/`ssl_upstream_insecure_skip_verify`
247+- `upstream`/`upstreams`
248+
249+<!-- Legacy Headers FlagSet -->
250+- `pass-basic-auth`/`pass_basic_auth`
251+- `pass-access-token`/`pass_access_token`
252+- `pass-user-headers`/`pass_user_headers`
253+- `pass-authorization-header`/`pass_authorization_header`
254+- `set-basic-auth`/`set_basic_auth`
255+- `set-xauthrequest`/`set_xauthrequest`
256+- `set-authorization-header`/`set_authorization_header`
257+- `prefer-email-to-user`/`prefer_email_to_user`
258+- `basic-auth-password`/`basic_auth_password`
259+- `skip-auth-strip-headers`/`skip_auth_strip_headers`
260+
261+<!-- Legacy provider FlagSet -->
262+- `client-id`/`client_id`
263+- `client-secret`/`client_secret`, and `client-secret-file`/`client_secret_file`
264+- `provider`
265+- `provider-display-name`/`provider_display_name`
266+- `provider-ca-file`/`provider_ca_files`
267+- `login-url`/`login_url`
268+- `redeem-url`/`redeem_url`
269+- `profile-url`/`profile_url`
270+- `resource`
271+- `validate-url`/`validate_url`
272+- `scope`
273+- `prompt`
274+- `approval-prompt`/`approval_prompt`
275+- `acr-values`/`acr_values`
276+- `user-id-claim`/`user_id_claim`
277+- `allowed-group`/`allowed_groups`
278+- `allowed-role`/`allowed_roles`
279+- `jwt-key`/`jwt_key`
280+- `jwt-key-file`/`jwt_key_file`
281+- `pubjwk-url`/`pubjwk_url`
282+
283+and all provider-specific options, i.e. any option whose name includes `oidc`,
284+`azure`, `bitbucket`, `github`, `gitlab`, `google` or `keycloak`. Attempting to
285+use any of these options via flags or via config when `--alpha-config` is
286+set will result in an error.
287+
288+:::important
289+You must remove these options before starting OAuth2 Proxy with `--alpha-config`
290+:::
291+
292+## Configuration Reference
docs/docs/configuration/integrations/caddy.mdnew file+63
@@ -0,0 +1,63 @@
1+---
2+id: caddy
3+title: Caddy
4+---
5+
6+Integrate OAuth2 Proxy with Caddy v2 using the `forward_auth` directive.
7+
8+**Key features:**
9+- Simple forward_auth setup
10+- Automatic header handling
11+- Custom error handling and redirects
12+
13+## Configuring for use with the Caddy (v2) `forward_auth` directive
14+
15+The [Caddy `forward_auth` directive](https://caddyserver.com/docs/caddyfile/directives/forward_auth) allows Caddy to authenticate requests via the `oauth2-proxy`'s `/auth`.
16+
17+This example is for a simple reverse proxy setup where the `/oauth2/` path is kept under the same domain and failed auth requests (401 status returned) will be caught and redirected to the `sign_in` endpoint.
18+
19+**Following options need to be set on `oauth2-proxy`:**
20+- `--reverse-proxy=true`: Enables the use of `X-Forwarded-*` headers to determine redirects correctly
21+
22+```nginx title="Caddyfile"
23+example.com {
24+ # Requests to /oauth2/* are proxied to oauth2-proxy without authentication.
25+ # You can't use `reverse_proxy /oauth2/* oauth2-proxy.internal:4180` here because the reverse_proxy directive has lower precedence than the handle directive.
26+ handle /oauth2/* {
27+ reverse_proxy oauth2-proxy.internal:4180 {
28+ # oauth2-proxy requires the X-Real-IP and X-Forwarded-{Proto,Host,Uri} headers.
29+ # The reverse_proxy directive automatically sets X-Forwarded-{For,Proto,Host} headers.
30+ header_up X-Real-IP {remote_host}
31+ header_up X-Forwarded-Uri {uri}
32+ }
33+ }
34+
35+ # Requests to other paths are first processed by oauth2-proxy for authentication.
36+ handle {
37+ forward_auth oauth2-proxy.internal:4180 {
38+ uri /oauth2/auth
39+
40+ # oauth2-proxy requires the X-Real-IP and X-Forwarded-{Proto,Host,Uri} headers.
41+ # The forward_auth directive automatically sets the X-Forwarded-{For,Proto,Host,Method,Uri} headers.
42+ header_up X-Real-IP {remote_host}
43+
44+ # If needed, you can copy headers from the oauth2-proxy response to the request sent to the upstream.
45+ # Make sure to configure the --set-xauthrequest flag to enable this feature.
46+ #copy_headers X-Auth-Request-User X-Auth-Request-Email
47+
48+ # If oauth2-proxy returns a 401 status, redirect the client to the sign-in page.
49+ @error status 401
50+ handle_response @error {
51+ redir * /oauth2/sign_in?rd={scheme}://{host}{uri}
52+ }
53+ }
54+
55+ # If oauth2-proxy returns a 2xx status, the request is then proxied to the upstream.
56+ reverse_proxy upstream.internal:3000
57+ }
58+}
59+```
60+
61+:::note
62+If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.
63+:::
docs/docs/configuration/integrations/headlamp.mdnew file+105
@@ -0,0 +1,105 @@
1+---
2+id: headlamp
3+title: Headlamp
4+---
5+
6+Modern, actively maintained Kubernetes web UI with OAuth2 Proxy integration examples.
7+
8+**Key features:**
9+- Active development and maintenance
10+- Modern, intuitive interface
11+- Multi-cluster support
12+- Plugin system
13+- Works with all OAuth2 providers
14+
15+## Configuring for use with Headlamp
16+
17+[Headlamp](https://headlamp.dev/) is a modern, user-friendly Kubernetes web UI that can be integrated with OAuth2 Proxy for authentication. This is a recommended alternative to the deprecated Kubernetes Dashboard.
18+
19+### Architecture
20+
21+```
22+User → Ingress → OAuth2 Proxy → Authentication Provider (e.g., Azure Entra ID)
23+ ↓
24+ Headlamp
25+```
26+
27+### Prerequisites
28+
29+- Kubernetes cluster (e.g., AKS, EKS, GKE, or self-hosted)
30+- Headlamp installed in the cluster
31+- OAuth2 provider configured (Azure Entra ID, Google, GitHub, etc.)
32+- Ingress controller (Nginx, Traefik, etc.)
33+
34+### Configuration Overview
35+
36+When integrating Headlamp with OAuth2 Proxy, the OAuth2 Proxy acts as a reverse proxy in front of Headlamp:
37+
38+1. User requests access to Headlamp
39+2. Ingress forwards to OAuth2 Proxy
40+3. OAuth2 Proxy authenticates the user via the OAuth2 provider
41+4. After successful authentication, OAuth2 Proxy proxies requests to Headlamp
42+5. Headlamp receives the authenticated user information via headers
43+
44+### OAuth2 Proxy Configuration
45+
46+Configure OAuth2 Proxy to proxy to the Headlamp service:
47+
48+```yaml
49+upstreamConfig:
50+ upstreams:
51+ - id: headlamp
52+ path: /
53+ uri: http://headlamp-service.headlamp-namespace.svc.cluster.local:4466
54+```
55+
56+Enable the necessary headers:
57+
58+```yaml
59+extraArgs:
60+ reverse-proxy: true
61+ pass-authorization-header: true
62+ set-xauthrequest: true
63+ email-domain: "*" # Or restrict to your organization
64+```
65+
66+### Example with Azure Entra ID on AKS
67+
68+For detailed instructions on deploying Headlamp with OAuth2 Proxy on Azure Kubernetes Service using Azure Entra ID, see the official Headlamp documentation:
69+
70+https://headlamp.dev/docs/latest/installation/in-cluster/aks-cluster-oauth/
71+
72+Key steps include:
73+
74+1. **Set up AKS with OIDC**: Enable Microsoft Entra ID authentication with Kubernetes RBAC
75+2. **Create Azure App Registration**: Configure redirect URI and create client secret
76+3. **Deploy Headlamp**: Install Headlamp via Helm in your cluster
77+4. **Deploy OAuth2 Proxy**: Configure OAuth2 Proxy with Entra ID provider settings and upstream pointing to Headlamp
78+5. **Configure Ingress**: Set up Ingress to route traffic through OAuth2 Proxy to Headlamp
79+6. **Set RBAC Policies**: Apply Kubernetes RBAC bindings based on users or groups
80+
81+### Integration with Other Providers
82+
83+The same integration pattern works with other OAuth2 providers supported by OAuth2 Proxy:
84+
85+- **Google**: Use the Google provider configuration
86+- **GitHub**: Use the GitHub provider configuration
87+- **GitLab**: Use the GitLab provider configuration
88+- **Keycloak**: Use the Keycloak OIDC provider configuration
89+- **Any OIDC Provider**: Use the generic OIDC provider configuration
90+
91+For provider-specific configuration examples, see the [OAuth Provider Configuration](../providers/index.md) documentation.
92+
93+### Benefits Over Kubernetes Dashboard
94+
95+Headlamp offers several advantages:
96+
97+- **Active Development**: Headlamp is actively maintained and developed
98+- **Modern UI**: Clean, intuitive interface with better UX
99+- **Plugin System**: Extensible with custom plugins
100+- **Multi-cluster Support**: Built-in support for managing multiple clusters
101+- **Desktop App**: Available as both web UI and desktop application
102+
103+:::note
104+If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.
105+:::
docs/docs/configuration/integrations/index.mdnew file+41
@@ -0,0 +1,41 @@
1+---
2+id: index
3+title: Integrations
4+---
5+
6+This section provides configuration examples for integrating OAuth2 Proxy with various reverse proxies, ingress controllers, and Kubernetes web UIs.
7+
8+## Reverse Proxies and Ingress Controllers
9+
10+OAuth2 Proxy can be integrated with popular reverse proxies and ingress controllers to add authentication to your applications:
11+
12+- [Nginx](nginx.md)
13+- [Traefik](traefik.md)
14+- [caddy](caddy.md)
15+
16+## Kubernetes Web UIs
17+
18+OAuth2 Proxy can also be used to add authentication to Kubernetes web user interfaces:
19+
20+- [Headlamp](headlamp.md) ✨ *Recommended*
21+- [Kubernetes Dashboard](kubernetes-dashboard.md) ⚠️ *Deprecated*
22+
23+:::tip
24+When integrating with Kubernetes web UIs, make sure to:
25+1. Configure the Ingress to pass the Authorization header with the bearer token
26+2. Increase buffer sizes for large OIDC tokens (especially with Azure Entra ID)
27+3. Set up appropriate Kubernetes RBAC permissions for your users or groups
28+:::
29+
30+## General Requirements
31+
32+Most integrations require the following OAuth2 Proxy configuration:
33+
34+- `--reverse-proxy=true`: Required to correctly handle `X-Forwarded-*` headers
35+- **Session storage**: For production deployments with large tokens due to a lot of claims like AD groups, use `--session-store-type=redis`
36+
37+For provider-specific configuration, see the [OAuth Provider Configuration](../providers/index.md) documentation.
38+
39+:::note
40+If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.
41+:::
docs/docs/configuration/integrations/kubernetes-dashboard.mdnew file+289
@@ -0,0 +1,289 @@
1+---
2+id: kubernetes-dashboard
3+title: Kubernetes Dashboard
4+---
5+
6+:::warning Deprecated Project
7+Kubernetes Dashboard has been deprecated and discontinued as of January 2025. See the [official announcement](https://github.com/kubernetes/dashboard/commit/0ba796dce6916bb6ca5da5ca0b3ab22cecfd1e18) for more information.
8+
9+You may want to consider alternative solutions such as [Headlamp](./headlamp.md).
10+:::
11+
12+## Kubernetes Dashboard on AKS with Azure Entra ID
13+
14+Integration guide for the deprecated Kubernetes Dashboard, including comprehensive Azure Entra ID configuration on AKS with detailed troubleshooting and RBAC setup.
15+
16+### Architecture
17+
18+```
19+User → Nginx Ingress → OAuth2 Proxy → Entra ID
20+ ↓
21+ Kubernetes Dashboard
22+```
23+
24+The integration flow:
25+1. Unauthenticated requests to Dashboard are intercepted by Nginx Ingress
26+2. Nginx redirects to OAuth2 Proxy for authentication
27+3. OAuth2 Proxy redirects to Entra ID login
28+4. After successful authentication, OAuth2 Proxy receives ID token from Entra ID
29+5. OAuth2 Proxy sets Authorization header with the bearer token
30+6. Nginx forwards the request with token to Kubernetes Dashboard
31+7. Dashboard validates the token and grants access based on AKS RBAC configuration
32+
33+### Prerequisites
34+
35+- AKS cluster with Entra ID integration enabled
36+- Kubernetes Dashboard installed (version 7.x or later)
37+- NGINX Ingress Controller installed
38+- Entra ID App Registration configured with:
39+ - Redirect URI: `https://your-oauth2-domain.com/oauth2/callback`
40+ - API Permissions: `openid`, `email`, `profile`
41+ - Groups claim enabled (if using group-based RBAC)
42+- Users or groups assigned appropriate Kubernetes RBAC permissions
43+
44+### Alpha Configuration Example
45+
46+Using [Alpha Configuration](../alpha_config.md) with the OAuth2 Proxy Helm chart:
47+
48+```yaml
49+alphaConfig:
50+ enabled: true
51+ configData:
52+ providers:
53+ - id: azure-entra
54+ provider: entra-id
55+ clientID: YOUR_CLIENT_ID
56+ clientSecret: YOUR_CLIENT_SECRET
57+ oidcConfig:
58+ issuerURL: https://login.microsoftonline.com/YOUR_TENANT_ID/v2.0
59+ audienceClaims:
60+ - aud
61+ emailClaim: email
62+ groupsClaim: groups
63+ userIDClaim: oid
64+ scope: openid email profile
65+
66+ upstreamConfig:
67+ upstreams:
68+ - id: static
69+ path: /
70+ static: true
71+ staticCode: 200
72+
73+ # Response headers passed to Dashboard via Nginx
74+ injectResponseHeaders:
75+ - name: Authorization
76+ values:
77+ - claim: id_token
78+ prefix: "Bearer "
79+ - name: X-Auth-Request-User
80+ values:
81+ - claim: email
82+ - name: X-Auth-Request-Email
83+ values:
84+ - claim: email
85+ - name: X-Auth-Request-Groups
86+ values:
87+ - claim: groups
88+
89+ server:
90+ BindAddress: "0.0.0.0:4180"
91+
92+extraArgs:
93+ cookie-domain: ".your-domain.com"
94+ whitelist-domain: ".your-domain.com"
95+ email-domain: "*" # Or restrict to your organization
96+ skip-provider-button: true
97+ reverse-proxy: true
98+ pass-authorization-header: true
99+ set-xauthrequest: true
100+
101+sessionStorage:
102+ type: redis
103+
104+redis:
105+ enabled: true
106+ auth:
107+ enabled: true
108+
109+ingress:
110+ enabled: true
111+ className: nginx
112+ hosts:
113+ - OAuth2 Proxy.your-domain.com
114+ path: /oauth2
115+ pathType: Prefix
116+```
117+
118+### Kubernetes Dashboard Ingress
119+
120+**Critical**: The Ingress must include `Authorization` in the `auth-response-headers` annotation:
121+
122+```yaml
123+apiVersion: networking.k8s.io/v1
124+kind: Ingress
125+metadata:
126+ name: kubernetes-dashboard
127+ namespace: kubernetes-dashboard
128+ annotations:
129+ nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
130+ nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
131+
132+ # OAuth2 Proxy authentication
133+ nginx.ingress.kubernetes.io/auth-url: "https://OAuth2 Proxy.your-domain.com/oauth2/auth"
134+ nginx.ingress.kubernetes.io/auth-signin: "https://OAuth2 Proxy.your-domain.com/oauth2/start?rd=$scheme://$best_http_host$request_uri"
135+
136+ # Include Authorization header with bearer token
137+ nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Auth-Request-User, X-Auth-Request-Email"
138+
139+ # Buffer sizes for large tokens (Entra tokens can exceed 4KB)
140+ nginx.ingress.kubernetes.io/proxy-buffer-size: "256k"
141+ nginx.ingress.kubernetes.io/proxy-buffers-number: "4"
142+ nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
143+spec:
144+ ingressClassName: nginx
145+ tls:
146+ - hosts:
147+ - dashboard.your-domain.com
148+ secretName: dashboard-tls
149+ rules:
150+ - host: dashboard.your-domain.com
151+ http:
152+ paths:
153+ - path: /
154+ pathType: Prefix
155+ backend:
156+ service:
157+ name: kubernetes-dashboard-kong-proxy
158+ port:
159+ number: 443
160+```
161+
162+### RBAC Configuration
163+
164+Assign Kubernetes permissions to Entra ID users or groups.
165+
166+**User-based:**
167+```yaml
168+apiVersion: rbac.authorization.k8s.io/v1
169+kind: ClusterRoleBinding
170+metadata:
171+ name: dashboard-user-admin
172+roleRef:
173+ apiGroup: rbac.authorization.k8s.io
174+ kind: ClusterRole
175+ name: cluster-admin
176+subjects:
177+ - kind: User
178+ name: "user@your-domain.com" # Email from Entra ID token
179+ apiGroup: rbac.authorization.k8s.io
180+```
181+
182+**Group-based (recommended):**
183+```yaml
184+apiVersion: rbac.authorization.k8s.io/v1
185+kind: ClusterRoleBinding
186+metadata:
187+ name: dashboard-admins-group
188+roleRef:
189+ apiGroup: rbac.authorization.k8s.io
190+ kind: ClusterRole
191+ name: cluster-admin
192+subjects:
193+ - kind: Group
194+ name: "YOUR_ENTRA_GROUP_OBJECT_ID" # Entra ID Group Object ID
195+ apiGroup: rbac.authorization.k8s.io
196+```
197+
198+For production, create custom roles with limited permissions instead of using `cluster-admin`.
199+
200+### Troubleshooting
201+
202+**Dashboard still asks for token after authentication**
203+
204+Verify that:
205+1. `injectResponseHeaders` in alphaConfig includes Authorization header with id_token claim
206+2. Dashboard Ingress includes `Authorization` in `auth-response-headers` annotation
207+3. Buffer sizes are sufficient for large tokens (set to 256k as shown above)
208+4. Check OAuth2 Proxy logs for successful token generation: `kubectl logs -n OAuth2 Proxy <pod-name>`
209+
210+**"Unauthorized" or "Invalid token" errors**
211+
212+Common causes:
213+1. User/group not configured in Kubernetes RBAC
214+ - Check: `kubectl get clusterrolebindings | grep <user-email>`
215+2. Token validation failed
216+ - Verify AKS Entra ID integration is enabled
217+ - Check Dashboard logs: `kubectl logs -n kubernetes-dashboard <pod-name>`
218+3. Incorrect OAuth2 Proxy configuration
219+ - Ensure `reverse-proxy: true` is set
220+ - Verify issuer URL matches your tenant
221+
222+**Groups not included in token**
223+
224+To include groups in the token:
225+1. In Entra ID App Registration, go to **Token configuration**
226+2. Add **groups claim** and select security groups
227+3. Or edit the manifest and add: `"groupMembershipClaims": "SecurityGroup"`
228+4. For 200+ groups, ensure scope includes `User.Read` for group overage handling
229+5. Verify groups appear in token: check OAuth2 Proxy logs
230+
231+**Session expires too quickly**
232+
233+Configure cookie expiration:
234+```yaml
235+extraArgs:
236+ cookie-expire: "24h"
237+ cookie-refresh: "1h"
238+```
239+
240+### Using Workload Identity (Passwordless)
241+
242+For production environments, use Workload Identity instead of client secrets:
243+
244+```yaml
245+config:
246+ clientID: "YOUR_CLIENT_ID"
247+ secretKeys: # Exclude client-secret
248+ - client-id
249+ - cookie-secret
250+ cookieSecret: "YOUR_COOKIE_SECRET"
251+
252+serviceAccount:
253+ annotations:
254+ azure.workload.identity/client-id: YOUR_CLIENT_ID
255+ azure.workload.identity/tenant-id: YOUR_TENANT_ID
256+
257+podLabels:
258+ azure.workload.identity/use: "true"
259+
260+alphaConfig:
261+ enabled: true
262+ configData:
263+ providers:
264+ - id: azure-entra
265+ provider: entra-id
266+ clientID: YOUR_CLIENT_ID
267+ oidcConfig:
268+ issuerURL: https://login.microsoftonline.com/YOUR_TENANT_ID/v2.0
269+ # ... other config
270+ entraIdConfig:
271+ federatedTokenAuth: true
272+```
273+
274+This requires:
275+- AKS with OIDC issuer and Workload Identity enabled
276+- Federated identity credential configured in Entra ID App Registration
277+- Service account annotated with `azure.workload.identity/client-id`
278+
279+For detailed Workload Identity setup instructions, see the [Workload Identity section](../providers/ms_entra_id.md#workload-identity) in the Microsoft Entra ID provider documentation.
280+
281+## Integration with Other Providers
282+
283+While this guide focuses on Azure Entra ID, Kubernetes Dashboard can be integrated with other OAuth2 providers supported by OAuth2 Proxy. The key requirements remain the same:
284+
285+1. **Authorization Header**: Pass the bearer token via the `Authorization` header
286+2. **RBAC Configuration**: Configure Kubernetes RBAC for your authentication provider's users/groups
287+3. **Buffer Sizes**: Ensure adequate buffer sizes for tokens (especially important for OIDC providers)
288+
289+For provider-specific configuration examples, see the [OAuth Provider Configuration](../providers/index.md) documentation.
docs/docs/configuration/integrations/nginx.mdnew file+190
@@ -0,0 +1,190 @@
1+---
2+id: nginx
3+title: Nginx
4+---
5+
6+Configure OAuth2 Proxy with Nginx using the `auth_request` directive. Includes examples for both standalone Nginx configurations and Kubernetes ingress-nginx with annotations.
7+
8+**Key features:**
9+- Support for `auth_request` directive
10+- Kubernetes Ingress annotations
11+- Multi-part cookie handling for large tokens
12+- Session refresh support
13+
14+## Configuring for use with the Nginx `auth_request` directive
15+
16+**This option requires `--reverse-proxy` option to be set.**
17+
18+The [Nginx `auth_request` directive](http://nginx.org/en/docs/http/ngx_http_auth_request_module.html) allows Nginx to authenticate requests via the oauth2-proxy's `/auth` endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:
19+
20+```nginx
21+server {
22+ listen 443 ssl;
23+ server_name ...;
24+ include ssl/ssl.conf;
25+
26+ location /oauth2/ {
27+ proxy_pass http://127.0.0.1:4180;
28+ proxy_set_header Host $host;
29+ proxy_set_header X-Real-IP $remote_addr;
30+ proxy_set_header X-Auth-Request-Redirect $request_uri;
31+ # or, if you are handling multiple domains:
32+ # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
33+ }
34+ location = /oauth2/auth {
35+ proxy_pass http://127.0.0.1:4180;
36+ proxy_set_header Host $host;
37+ proxy_set_header X-Real-IP $remote_addr;
38+ proxy_set_header X-Forwarded-Uri $request_uri;
39+ # nginx auth_request includes headers but not body
40+ proxy_set_header Content-Length "";
41+ proxy_pass_request_body off;
42+ }
43+
44+ location / {
45+ auth_request /oauth2/auth;
46+ error_page 401 = @oauth2_signin;
47+
48+ # pass information via X-User and X-Email headers to backend,
49+ # requires running with --set-xauthrequest flag
50+ auth_request_set $user $upstream_http_x_auth_request_user;
51+ auth_request_set $email $upstream_http_x_auth_request_email;
52+ proxy_set_header X-User $user;
53+ proxy_set_header X-Email $email;
54+
55+ # if you enabled --pass-access-token, this will pass the token to the backend
56+ auth_request_set $token $upstream_http_x_auth_request_access_token;
57+ proxy_set_header X-Access-Token $token;
58+
59+ # if you enabled --cookie-refresh, this is needed for it to work with auth_request
60+ auth_request_set $auth_cookie $upstream_http_set_cookie;
61+ add_header Set-Cookie $auth_cookie;
62+
63+ # Large OIDC tokens can make the session cookie exceed the 4KB limit,
64+ # causing OAuth2 Proxy to split the cookie into multiple parts.
65+ # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
66+ # so extract the second part when using the default cookie name, `_oauth2_proxy`.
67+ auth_request_set $auth_cookie_upstream_1 $upstream_cookie__oauth2_proxy_1;
68+
69+ # Extract the Cookie attributes from the first Set-Cookie header and append them
70+ # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
71+ if ($auth_cookie ~* "(; .*)") {
72+ set $auth_cookie_0 $auth_cookie;
73+ set $auth_cookie_1 "_oauth2_proxy_1=$auth_cookie_upstream_1$1";
74+ }
75+
76+ # Send both Set-Cookie headers now if there was a second part
77+ if ($auth_cookie_upstream_1) {
78+ add_header Set-Cookie $auth_cookie_0;
79+ add_header Set-Cookie $auth_cookie_1;
80+ }
81+
82+ proxy_pass http://backend/;
83+ # or "root /path/to/site;" or "fastcgi_pass ..." etc
84+ }
85+
86+ # Named location for handling OAuth2 sign-in redirects
87+ # This ensures the browser receives a proper 302 redirect that it will follow
88+ location @oauth2_signin {
89+ return 302 /oauth2/sign_in?rd=$scheme://$host$request_uri;
90+ }
91+}
92+```
93+
94+### Multi-part session cookies
95+
96+The example above is ready to use with the default `--cookie-name=_oauth2_proxy` setting and handles a session split into two cookies. If you configure a custom cookie name, update both references to the second cookie part:
97+
98+| Cookie configuration | Nginx upstream cookie variable | `Set-Cookie` name |
99+| --- | --- | --- |
100+| Default (`_oauth2_proxy`) | `$upstream_cookie__oauth2_proxy_1` | `_oauth2_proxy_1=` |
101+| `--cookie-name=my_cookie` | `$upstream_cookie_my_cookie_1` | `my_cookie_1=` |
102+
103+For example, with `--cookie-name=my_cookie`, change the relevant lines to:
104+
105+```nginx
106+auth_request_set $auth_cookie_upstream_1 $upstream_cookie_my_cookie_1;
107+set $auth_cookie_1 "my_cookie_1=$auth_cookie_upstream_1$1";
108+```
109+
110+If a session is split into more than two cookies, repeat the extraction for each additional numeric suffix. For consistently large sessions, prefer `--session-store-type=redis` so only a small session ticket is stored in the browser cookie.
111+
112+### Understanding the `error_page` redirect pattern
113+
114+The `auth_request` directive expects the authentication endpoint (`/oauth2/auth`) to return:
115+- **2xx**: Request is authenticated, allow access
116+- **401 or 403**: Request is not authenticated, deny access
117+
118+When a 401 is returned, nginx triggers the `error_page` directive. The recommended pattern uses a **named location** (`@oauth2_signin`) that returns a proper **302 redirect**:
119+
120+```nginx
121+error_page 401 = @oauth2_signin;
122+
123+location @oauth2_signin {
124+ return 302 /oauth2/sign_in?rd=$scheme://$host$request_uri;
125+}
126+```
127+
128+:::warning Avoid `error_page 401 =403` with sign_in
129+Some older configurations use `error_page 401 =403 /oauth2/sign_in`. While this works for displaying the sign-in page, it returns a **403 status code** with a `Location` header. Browsers do not automatically follow redirects on 403 responses, which can cause issues when using `--skip-provider-button=true` (users see a "Found." link instead of being automatically redirected).
130+
131+The named location pattern above ensures the browser receives a standard **302 redirect** that works correctly with all oauth2-proxy configurations.
132+:::
133+
134+### Browser vs API Routes
135+
136+:::important When to use redirects
137+Redirecting authentication failures (302 to `/oauth2/sign_in`) should **only be used for browser-facing routes**. API or machine clients should receive a plain 401/403 response without redirect.
138+:::
139+
140+#### Browser-facing routes (HTML, UI)
141+
142+For interactive browser routes where users should be redirected to sign in:
143+
144+```nginx
145+location / {
146+ auth_request /oauth2/auth;
147+ error_page 401 = @oauth2_signin;
148+ proxy_pass http://backend/;
149+}
150+
151+location @oauth2_signin {
152+ return 302 /oauth2/sign_in?rd=$scheme://$host$request_uri;
153+}
154+```
155+
156+#### API / Machine routes (no redirect)
157+
158+For API endpoints where clients expect a 401/403 status code (not a redirect):
159+
160+```nginx
161+location /api/ {
162+ auth_request /oauth2/auth;
163+ error_page 401 =401; # Pass through the 401 status
164+ proxy_pass http://backend/;
165+}
166+```
167+
168+This ensures:
169+- ✅ Browsers get a redirect and smooth login flow
170+- ✅ API clients fail fast with appropriate HTTP status codes
171+- ✅ `/oauth2/auth` remains a pure boolean oracle (2xx/401)
172+
173+When you use ingress-nginx in Kubernetes, you can configure the same behavior with the following annotations on your Ingress resource:
174+
175+```yaml
176+nginx.ingress.kubernetes.io/auth-url: "https://<oauth2-proxy-fqdn>/oauth2/auth"
177+nginx.ingress.kubernetes.io/auth-signin: "https://<oauth2-proxy-fqdn>/oauth2/start?rd=$escaped_request_uri"
178+```
179+
180+This minimal configuration works for standard authentication flows. Lua/cookie handling is only needed for advanced scenarios (e.g., multi-part cookies, custom session logic). See the official ingress-nginx example: https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth/.
181+
182+It is recommended to use `--session-store-type=redis` when expecting large sessions/OIDC tokens (_e.g._ with MS Azure).
183+
184+:::tip Kubernetes Dashboard with Azure Entra ID
185+For a complete example of integrating oauth2-proxy with Kubernetes Dashboard on AKS using Azure Entra ID, including RBAC configuration and troubleshooting, see the [Kubernetes Dashboard on AKS](../providers/ms_entra_id.md#kubernetes-dashboard-on-aks) section in the Microsoft Entra ID provider documentation.
186+:::
187+
188+:::note
189+If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.
190+:::
docs/docs/configuration/integrations/traefik.mdnew file+192
@@ -0,0 +1,192 @@
1+---
2+id: traefik
3+title: Traefik
4+---
5+
6+Set up OAuth2 Proxy with Traefik v2 using the `ForwardAuth` middleware. Includes examples for both error-based redirects and static upstream configurations.
7+
8+**Key features:**
9+- ForwardAuth middleware integration
10+- Error middleware for 401 redirects
11+- Static upstream configuration (202 responses)
12+- Dynamic file configuration examples
13+
14+
15+## Configuring for use with the Traefik (v2) `ForwardAuth` middleware
16+
17+**This option requires `--reverse-proxy` option to be set.**
18+
19+### ForwardAuth with 401 errors middleware
20+
21+The [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/http/forwardauth/) allows Traefik to authenticate requests via the oauth2-proxy's `/oauth2/auth` endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:
22+
23+```yaml
24+http:
25+ routers:
26+ a-service:
27+ rule: "Host(`a-service.example.com`)"
28+ service: a-service-backend
29+ middlewares:
30+ - oauth-errors
31+ - oauth-auth
32+ tls:
33+ certResolver: default
34+ domains:
35+ - main: "example.com"
36+ sans:
37+ - "*.example.com"
38+ oauth:
39+ rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"
40+ middlewares:
41+ - auth-headers
42+ service: oauth-backend
43+ tls:
44+ certResolver: default
45+ domains:
46+ - main: "example.com"
47+ sans:
48+ - "*.example.com"
49+
50+ services:
51+ a-service-backend:
52+ loadBalancer:
53+ servers:
54+ - url: http://172.16.0.2:7555
55+ oauth-backend:
56+ loadBalancer:
57+ servers:
58+ - url: http://172.16.0.1:4180
59+
60+ middlewares:
61+ auth-headers:
62+ headers:
63+ sslRedirect: true
64+ stsSeconds: 315360000
65+ browserXssFilter: true
66+ contentTypeNosniff: true
67+ forceSTSHeader: true
68+ sslHost: example.com
69+ stsIncludeSubdomains: true
70+ stsPreload: true
71+ frameDeny: true
72+ oauth-auth:
73+ forwardAuth:
74+ address: https://oauth.example.com/oauth2/auth
75+ trustForwardHeader: true
76+ oauth-errors:
77+ errors:
78+ status:
79+ - "401-403"
80+ service: oauth-backend
81+ query: "/oauth2/sign_in?rd={url}"
82+ statusRewrites:
83+ "401": 302
84+```
85+
86+:::caution Troubleshooting: Browser shows "Found." instead of redirecting
87+When using the Errors middleware without `statusRewrites`, the redirect response from oauth2-proxy can be served within the original 401/403 status context. This causes some browsers to display a "Found." link instead of automatically following the redirect to the identity provider.
88+
89+Adding `statusRewrites` to rewrite `401 -> 302` ensures the browser treats the response as a proper redirect and follows it automatically.
90+:::
91+
92+### ForwardAuth with static upstreams configuration
93+
94+Redirect to sign_in functionality provided without the use of `errors` middleware with [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/http/forwardauth/) pointing to oauth2-proxy service's `/` endpoint
95+
96+**Following options need to be set on `oauth2-proxy`:**
97+- `--upstream=static://202`: Configures a static response for authenticated sessions
98+- `--reverse-proxy=true`: Enables the use of `X-Forwarded-*` headers to determine redirects correctly
99+
100+```yaml
101+http:
102+ routers:
103+ a-service-route-1:
104+ rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"
105+ service: a-service-backend
106+ middlewares:
107+ - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin
108+ tls:
109+ certResolver: default
110+ domains:
111+ - main: "example.com"
112+ sans:
113+ - "*.example.com"
114+ a-service-route-2:
115+ rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"
116+ service: a-service-backend
117+ middlewares:
118+ - oauth-auth-wo-redirect # unauthenticated session will return a 401
119+ tls:
120+ certResolver: default
121+ domains:
122+ - main: "example.com"
123+ sans:
124+ - "*.example.com"
125+ services-oauth2-route:
126+ rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"
127+ middlewares:
128+ - auth-headers
129+ service: oauth-backend
130+ tls:
131+ certResolver: default
132+ domains:
133+ - main: "example.com"
134+ sans:
135+ - "*.example.com"
136+ oauth2-proxy-route:
137+ rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"
138+ middlewares:
139+ - auth-headers
140+ service: oauth-backend
141+ tls:
142+ certResolver: default
143+ domains:
144+ - main: "example.com"
145+ sans:
146+ - "*.example.com"
147+
148+ services:
149+ a-service-backend:
150+ loadBalancer:
151+ servers:
152+ - url: http://172.16.0.2:7555
153+ b-service-backend:
154+ loadBalancer:
155+ servers:
156+ - url: http://172.16.0.3:7555
157+ oauth-backend:
158+ loadBalancer:
159+ servers:
160+ - url: http://172.16.0.1:4180
161+
162+ middlewares:
163+ auth-headers:
164+ headers:
165+ sslRedirect: true
166+ stsSeconds: 315360000
167+ browserXssFilter: true
168+ contentTypeNosniff: true
169+ forceSTSHeader: true
170+ sslHost: example.com
171+ stsIncludeSubdomains: true
172+ stsPreload: true
173+ frameDeny: true
174+ oauth-auth-redirect:
175+ forwardAuth:
176+ address: https://oauth.example.com/
177+ trustForwardHeader: true
178+ authResponseHeaders:
179+ - X-Auth-Request-Access-Token
180+ - Authorization
181+ oauth-auth-wo-redirect:
182+ forwardAuth:
183+ address: https://oauth.example.com/oauth2/auth
184+ trustForwardHeader: true
185+ authResponseHeaders:
186+ - X-Auth-Request-Access-Token
187+ - Authorization
188+```
189+
190+:::note
191+If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.
192+:::
docs/docs/configuration/overview.mdnew file+451
@@ -0,0 +1,451 @@
1+---
2+id: overview
3+title: Overview
4+---
5+
6+`oauth2-proxy` can be configured via [command line options](#command-line-options), [environment variables](#environment-variables) or [config file](#config-file) (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings).
7+
8+## Generating a Cookie Secret
9+
10+To generate a strong cookie secret use one of the below commands:
11+
12+import Tabs from '@theme/Tabs';
13+import TabItem from '@theme/TabItem';
14+
15+<Tabs defaultValue="python">
16+ <TabItem value="python" label="Python">
17+
18+```shell
19+python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'
20+```
21+
22+ </TabItem>
23+ <TabItem value="bash" label="Bash">
24+
25+```shell
26+dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\n' | tr -- '+/' '-_' ; echo
27+```
28+
29+ </TabItem>
30+ <TabItem value="openssl" label="OpenSSL">
31+
32+```shell
33+openssl rand -base64 32 | tr -- '+/' '-_'
34+```
35+
36+ </TabItem>
37+ <TabItem value="powershell" label="PowerShell">
38+
39+```powershell
40+# Add System.Web assembly to session, just in case
41+Add-Type -AssemblyName System.Web
42+[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")
43+```
44+
45+ </TabItem>
46+ <TabItem value="terraform" label="Terraform">
47+
48+```hcl
49+# Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret
50+resource "random_password" "cookie_secret" {
51+ length = 32
52+ override_special = "-_"
53+}
54+```
55+
56+ </TabItem>
57+</Tabs>
58+
59+## Config File
60+
61+Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (\_). If the argument can be specified multiple times, the config option should be plural (trailing s).
62+
63+An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example) config file is in the contrib directory. It can be used by specifying `--config=/etc/oauth2-proxy.cfg`
64+
65+## Config Options
66+
67+### Command Line Options
68+
69+| Flag | Description |
70+| ---------------- | ------------------------------------------------------- |
71+| `--config` | path to config file |
72+| `--config-test` | test configuration and exit (for CI/CD validation) |
73+| `--version` | print version string |
74+
75+### General Provider Options
76+
77+Provider specific options can be found on their respective subpages.
78+
79+| Flag / Config Field | Type | Description | Default |
80+| --------------------------------------------------------------------------------------------------- | -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
81+| flag: `--acr-values`<br/>toml: `acr_values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
82+| flag: `--allowed-group`<br/>toml: `allowed_groups` | string \| list | Restrict login to members of a group or list of groups. Furthermore, if you aren't setting the `scope` and use `allowed_groups` with the generic OIDC provider the scope `groups` gets added implicitly. | |
83+| flag: `--approval-prompt`<br/>toml: `approval_prompt` | string | OAuth approval_prompt | `"force"` |
84+| flag: `--backend-logout-url`<br/>toml: `backend_logout_url` | string | URL to perform backend logout, if you use `{id_token}` in the url it will be replaced by the actual `id_token` of the user session | |
85+| flag: `--client-id`<br/>toml: `client_id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
86+| flag: `--client-secret-file`<br/>toml: `client_secret_file` | string | the file with OAuth Client Secret. The file must contain the secret only, with no trailing newline | |
87+| flag: `--client-secret`<br/>toml: `client_secret` | string | the OAuth Client Secret | |
88+| flag: `--code-challenge-method`<br/>toml: `code_challenge_method` | string | use PKCE code challenges with the specified method. Either 'plain' or 'S256' (recommended) | |
89+| flag: `--insecure-oidc-allow-unverified-email`<br/>toml: `insecure_oidc_allow_unverified_email` | bool | don't fail if an email address in an id_token is not verified | false |
90+| flag: `--insecure-oidc-skip-issuer-verification`<br/>toml: `insecure_oidc_skip_issuer_verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
91+| flag: `--insecure-oidc-skip-nonce`<br/>toml: `insecure_oidc_skip_nonce` | bool | skip verifying the OIDC ID Token's nonce claim | true |
92+| flag: `--jwt-key-file`<br/>toml: `jwt_key_file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |
93+| flag: `--jwt-key`<br/>toml: `jwt_key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |
94+| flag: `--login-url`<br/>toml: `login_url` | string | Authentication endpoint | |
95+| flag: `--auth-request-response-mode`<br/>toml: `auth-request-response-mode` | string | Response mode to ask for during authentication request | |
96+| flag: `--oidc-audience-claim`<br/>toml: `oidc_audience_claims` | string | which OIDC claim contains the audience | `"aud"` |
97+| flag: `--oidc-email-claim`<br/>toml: `oidc_email_claim` | string | which OIDC claim contains the user's email | `"email"` |
98+| flag: `--oidc-extra-audience`<br/>toml: `oidc_extra_audiences` | string \| list | additional audiences which are allowed to pass verification | `"[]"` |
99+| flag: `--oidc-groups-claim`<br/>toml: `oidc_groups_claim` | string | which OIDC claim contains the user groups | `"groups"` |
100+| flag: `--oidc-issuer-url`<br/>toml: `oidc_issuer_url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
101+| flag: `--oidc-jwks-url`<br/>toml: `oidc_jwks_url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled and public key files are not provided | |
102+| flag: `--oidc-public-key-file`<br/>toml: `oidc_public_key_files` | string | Path to public key file in PEM format to use for verifying JWT tokens (may be given multiple times). Required if OIDC discovery is disabled na JWKS URL isn't provided | |
103+| flag: `--oidc-enabled-signing-alg`<br/>toml: `oidc_enabled_signing_algs` | string \| list | List of allowed JWT signing algorithms. When oidc discovery is enabled, the effective set is the intersection between this list and the provider's discovered supported algorithms. | |
104+| flag: `--profile-url`<br/>toml: `profile_url` | string | Profile access endpoint | |
105+| flag: `--prompt`<br/>toml: `prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
106+| flag: `--provider-ca-file`<br/>toml: `provider_ca_files` | string \| list | Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead. | |
107+| flag: `--provider-display-name`<br/>toml: `provider_display_name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
108+| flag: `--provider`<br/>toml: `provider` | string | OAuth provider | google |
109+| flag: `--pubjwk-url`<br/>toml: `pubjwk_url` | string | JWK pubkey access endpoint: required by login.gov | |
110+| flag: `--redeem-url`<br/>toml: `redeem_url` | string | Token redemption endpoint | |
111+| flag: `--scope`<br/>toml:`scope` | string | OAuth scope specification. Every provider has a default list of scopes which will be used in case no scope is configured. | |
112+| flag: `--skip-claims-from-profile-url`<br/>toml: `skip_claims_from_profile_url` | bool | skip request to Profile URL for resolving claims not present in id_token | false |
113+| flag: `--skip-oidc-discovery`<br/>toml: `skip_oidc_discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
114+| flag: `--use-system-trust-store`<br/>toml: `use_system_trust_store` | bool | Determines if `provider-ca-file` files and the system trust store are used. If set to true, your custom CA files and the system trust store are used otherwise only your custom CA files. | false |
115+| flag: `--validate-url`<br/>toml: `validate_url` | string | Access token validation endpoint | |
116+
117+### Cookie Options
118+
119+| Flag / Config Field | Type | Description | Default |
120+| --------------------------------------------------------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- |
121+| flag: `--cookie-csrf-expire`<br/>toml: `cookie_csrf_expire` | duration | expire timeframe for CSRF cookie | 15m |
122+| flag: `--cookie-csrf-per-request`<br/>toml:`cookie_csrf_per_request` | bool | Enable having different CSRF cookies per request, making it possible to have parallel requests. | false |
123+| flag: `--cookie-csrf-per-request-limit`<br/>toml: `cookie_csrf_per_request_limit` | int | Sets a limit on the number of CSRF requests cookies that oauth2-proxy will create. The oldest cookie will be removed. Useful if users end up with 431 Request headers too large status codes. Only effective if --cookie-csrf-per-request is true | "infinite" |
124+| flag: `--cookie-csrf-samesite`<br/>toml: `cookie_csrf_samesite` | string | set SameSite CSRF cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). When using the default setting, the CSRF cookie samesite value is taken from the session cookie configuration. | `""` |
125+| flag: `--cookie-domain`<br/>toml: `cookie_domains` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
126+| flag: `--cookie-expire`<br/>toml: `cookie_expire` | duration | expire timeframe for cookie. If set to 0, cookie becomes a session-cookie which will expire when the browser is closed. | 168h0m0s |
127+| flag: `--cookie-httponly`<br/>toml: `cookie_httponly` | bool | set HttpOnly cookie flag | true |
128+| flag: `--cookie-name`<br/>toml: `cookie_name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
129+| flag: `--cookie-path`<br/>toml: `cookie_path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
130+| flag: `--cookie-refresh`<br/>toml: `cookie_refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;[^1] | |
131+| flag: `--cookie-samesite`<br/>toml: `cookie_samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
132+| flag: `--cookie-secret`<br/>toml: `cookie_secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
133+| flag: `--cookie-secret-file`<br/>toml: `cookie_secret_file` | string | File containing the cookie secret (must be raw binary, exactly 16, 24, or 32 bytes). Use dd if=/dev/urandom bs=32 count=1 > cookie.secret to generate | |
134+| flag: `--cookie-secure`<br/>toml: `cookie_secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
135+
136+[^1]: The following providers support `--cookie-refresh`: ADFS, Azure, GitLab, Google, Keycloak and all other Identity Providers which support the full [OIDC specification](https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokens)
137+
138+### Header Options
139+
140+| Flag / Config Field | Type | Description | Default |
141+| ------------------------------------------------------------------------- | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
142+| flag: `--basic-auth-password`<br/>toml: `basic_auth_password` | string | the password to set when passing the HTTP Basic Auth header | |
143+| flag: `--set-xauthrequest`<br/>toml: `set_xauthrequest` | bool | set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with `--pass-access-token`, X-Auth-Request-Access-Token is added to response headers. | false |
144+| flag: `--set-authorization-header`<br/>toml: `set_authorization_header` | bool | set Authorization Bearer response header (useful in Nginx auth_request mode) | false |
145+| flag: `--set-basic-auth`<br/>toml: `set_basic_auth` | bool | set HTTP Basic Auth information in response (useful in Nginx auth_request mode) | false |
146+| flag: `--skip-auth-strip-headers`<br/>toml: `skip_auth_strip_headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy | true |
147+| flag: `--pass-access-token`<br/>toml: `pass_access_token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
148+| flag: `--pass-authorization-header`<br/>toml: `pass_authorization_header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
149+| flag: `--pass-basic-auth`<br/>toml: `pass_basic_auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
150+| flag: `--prefer-email-to-user`<br/>toml: `prefer_email_to_user` | bool | Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with `--pass-basic-auth` and `--pass-user-headers` | false |
151+| flag: `--pass-user-headers`<br/>toml: `pass_user_headers` | bool | pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
152+
153+### Logging Options
154+
155+| Flag / Config Field | Type | Description | Default |
156+| --------------------------------------------------------------------- | ------ | ---------------------------------------------------------------------------- | --------------------------------------------------- |
157+| flag: `--auth-logging-format`<br/>toml: `auth_logging_format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
158+| flag: `--auth-logging`<br/>toml: `auth_logging` | bool | Log authentication attempts | true |
159+| flag: `--errors-to-info-log`<br/>toml: `errors_to_info_log` | bool | redirects error-level logging to default log channel instead of stderr | false |
160+| flag: `--exclude-logging-path`<br/>toml: `exclude_logging_paths` | string | comma separated list of paths to exclude from logging, e.g. `"/ping,/path2"` | `""` (no paths excluded) |
161+| flag: `--logging-compress`<br/>toml: `logging_compress` | bool | Should rotated log files be compressed using gzip | false |
162+| flag: `--logging-filename`<br/>toml: `logging_filename` | string | File to log requests to, empty for `stdout` | `""` (stdout) |
163+| flag: `--logging-local-time`<br/>toml: `logging_local_time` | bool | Use local time in log files and backup filenames instead of UTC | true (local time) |
164+| flag: `--logging-max-age`<br/>toml: `logging_max_age` | int | Maximum number of days to retain old log files | 7 |
165+| flag: `--logging-max-backups`<br/>toml: `logging_max_backups` | int | Maximum number of old log files to retain; 0 to disable | 0 |
166+| flag: `--logging-max-size`<br/>toml: `logging_max_size` | int | Maximum size in megabytes of the log file before rotation | 100 |
167+| flag: `--request-id-header`<br/>toml: `request_id_header` | string | Request header to use as the request ID in logging | X-Request-Id |
168+| flag: `--request-logging-format`<br/>toml: `request_logging_format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
169+| flag: `--request-logging`<br/>toml: `request_logging` | bool | Log requests | true |
170+| flag: `--silence-ping-logging`<br/>toml: `silence_ping_logging` | bool | disable logging of requests to ping & ready endpoints | false |
171+| flag: `--standard-logging-format`<br/>toml: `standard_logging_format` | string | Template for standard log lines | see [Logging Configuration](#logging-configuration) |
172+| flag: `--standard-logging`<br/>toml: `standard_logging` | bool | Log standard runtime information | true |
173+
174+### Page Template Options
175+
176+| Flag / Config Field | Type | Description | Default |
177+| ----------------------------------------------------------------- | ------ | --------------------------------------------------------------------------------------------------------------------------- | ------- |
178+| flag: `--banner`<br/>toml: `banner` | string | custom (html) banner string. Use `"-"` to disable default banner. | |
179+| flag: `--custom-sign-in-logo`<br/>toml: `custom_sign_in_logo` | string | path or a URL to an custom image for the sign_in page logo. Use `"-"` to disable default logo. | |
180+| flag: `--custom-templates-dir`<br/>toml: `custom_templates_dir` | string | path to custom html templates | |
181+| flag: `--display-htpasswd-form`<br/>toml: `display_htpasswd_form` | bool | display username / password login form if an htpasswd file is provided | true |
182+| flag: `--footer`<br/>toml: `footer` | string | custom (html) footer string. Use `"-"` to disable default footer. (Can be used to obfuscate the version) | |
183+| flag: `--show-debug-on-error`<br/>toml: `show_debug_on_error` | bool | show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production) | false |
184+
185+### Probe Options
186+
187+| Flag / Config Field | Type | Description | Default |
188+| ------------------------------------------------------- | ------ | ---------------------------------------------------------- | ----------------------------- |
189+| flag: `--ping-path`<br/>toml: `ping_path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
190+| flag: `--ping-user-agent`<br/>toml: `ping_user_agent` | string | a User-Agent that can be used for basic health checks | `""` (don't check user agent) |
191+| flag: `--ready-path`<br/>toml: `ready_path` | string | the ready endpoint that can be used for deep health checks | `"/ready"` |
192+| flag: `--gcp-healthchecks`<br/>toml: `gcp_healthchecks` | bool | Enable GCP/GKE healthcheck endpoints (deprecated) | false |
193+
194+### Proxy Options
195+
196+:::warning
197+When `--reverse-proxy` is enabled, configure `--trusted-proxy-ip` to the IPs or CIDR ranges of the reverse proxies that are allowed to send `X-Forwarded-*` headers. If you leave it unset, OAuth2 Proxy currently trusts all source IPs for backwards compatibility, which means a client that can reach OAuth2 Proxy directly may be able to spoof forwarded headers.
198+:::
199+
200+| Flag / Config Field | Type | Description | Default |
201+| ----------------------------------------------------------------------------- | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
202+| flag: `--allow-query-semicolons`<br/>toml: `allow_query_semicolons` | bool | allow the use of semicolons in query args ([required for some legacy applications](https://github.com/golang/go/issues/25192)) | `false` |
203+| flag: `--api-route`<br/>toml: `api_routes` | string \| list | Requests to these paths must already be authenticated with a cookie, or a JWT if `--skip-jwt-bearer-tokens` is set. No redirect to login will be done. Return 401 if not. Format: path_regex | |
204+| flag: `--authenticated-emails-file`<br/>toml: `authenticated_emails_file` | string | authenticate against emails via file (one per line) | |
205+| flag: `--bearer-token-login-fallback`<br/>toml: `bearer_token_login_fallback` | bool | if `--skip-jwt-bearer-tokens` is set, if a request includes an invalid JWT (expired, malformed, missing required audiences, etc), fall back to normal login redirect as if the token were not sent at all. If false, respond 403 | true |
206+| flag: `--email-domain`<br/>toml: `email_domains` | string \| list | authenticate emails with the specified domain (may be given multiple times). Use `*` to authenticate any email | |
207+| flag: `--encode-state`<br/>toml: `encode_state` | bool | encode the state parameter as UrlEncodedBase64 | false |
208+| flag: `--extra-jwt-issuers`<br/>toml: `extra_jwt_issuers` | string | if `--skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` (see a token's `iss`, `aud` fields) pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
209+| flag: `--force-https`<br/>toml: `force_https` | bool | enforce https redirect | `false` |
210+| flag: `--force-json-errors`<br/>toml: `force_json_errors` | bool | force JSON errors instead of HTTP error pages or redirects | `false` |
211+| flag: `--htpasswd-file`<br/>toml: `htpasswd_file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
212+| flag: `--htpasswd-user-group`<br/>toml: `htpasswd_user_groups` | string \| list | the groups to be set on sessions for htpasswd users | |
213+| flag: `--proxy-prefix`<br/>toml: `proxy_prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
214+| flag: `--real-client-ip-header`<br/>toml: `real_client_ip_header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, X-ProxyUser-IP, X-Envoy-External-Address, or CF-Connecting-IP) | X-Real-IP |
215+| flag: `--redirect-url`<br/>toml: `redirect_url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
216+| flag: `--relative-redirect-url`<br/>toml: `relative_redirect_url` | bool | allow relative OAuth Redirect URL.` | false |
217+| flag: `--reverse-proxy`<br/>toml: `reverse_proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-\{Proto,Host,Uri\} headers to be used on redirect selection | false |
218+| flag: `--trusted-proxy-ip`<br/>toml: `trusted_proxy_ips` | string \| list | list of IPs or CIDR ranges allowed to supply `X-Forwarded-*` headers when `--reverse-proxy` is enabled. If not set, OAuth2 Proxy preserves backwards compatibility by trusting all source IPs (`0.0.0.0/0`, `::/0`) and logs a warning at startup. Configure this to your reverse proxy addresses to prevent forwarded header spoofing. | `"0.0.0.0/0", "::/0"` |
219+| flag: `--signature-key`<br/>toml: `signature_key` | string | GAP-Signature request signature key (algorithm:secretkey) | |
220+| flag: `--skip-auth-preflight`<br/>toml: `skip_auth_preflight` | bool | will skip authentication for OPTIONS requests | false |
221+| flag: `--skip-auth-regex`<br/>toml: `skip_auth_regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times). Path matching is performed against the normalized path only; fragment identifiers (`#`) and their URL-encoded form (`%23`) are stripped before evaluation. | |
222+| flag: `--skip-auth-route`<br/>toml: `skip_auth_routes` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR method!=path_regex. For all methods: path_regex OR !=path_regex. Path matching is performed against the normalized path only; fragment identifiers (`#`) and their URL-encoded form (`%23`) are stripped before evaluation. | |
223+| flag: `--skip-jwt-bearer-tokens`<br/>toml: `skip_jwt_bearer_tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
224+| flag: `--skip-provider-button`<br/>toml: `skip_provider_button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
225+| flag: `--ssl-insecure-skip-verify`<br/>toml: `ssl_insecure_skip_verify` | bool | skip validation of certificates presented when using HTTPS providers | false |
226+| flag: `--trusted-ip`<br/>toml: `trusted_ips` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
227+| flag: `--whitelist-domain`<br/>toml: `whitelist_domains` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` or a `*.` to allow subdomains (e.g. `.example.com`, `*.example.com`)&nbsp;[^2] | |
228+
229+[^2]: When using the `whitelist-domain` option, any domain prefixed with a `.` or a `*.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
230+
231+### Server Options
232+
233+| Flag / Config Field | Type | Description | Default |
234+| ------------------------------------------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ |
235+| flag: `--http-address`<br/>toml: `http_address` | string | `[http://]<addr>:<port>` or `unix://<path>` or `fd:<int>` (case insensitive) to listen on for HTTP clients. Unix sockets are created with default system umask mode, which can be overridden, e.g. `unix://my-socket,mode=0777`. Square brackets are required for ipv6 address, e.g. `http://[::1]:4180` | `"127.0.0.1:4180"` |
236+| flag: `--https-address`<br/>toml: `https_address` | string | `[https://]<addr>:<port>` to listen on for HTTPS clients. Square brackets are required for ipv6 address, e.g. `https://[::1]:443` | `":443"` |
237+| flag: `--metrics-address`<br/>toml: `metrics_address` | string | the address prometheus metrics will be scraped from | `""` |
238+| flag: `--metrics-secure-address`<br/>toml: `metrics_secure_address` | string | the address prometheus metrics will be scraped from if using HTTPS | `""` |
239+| flag: `--metrics-tls-cert-file`<br/>toml: `metrics_tls_cert_file` | string | path to certificate file for secure metrics server | `""` |
240+| flag: `--metrics-tls-key-file`<br/>toml: `metrics_tls_key_file` | string | path to private key file for secure metrics server | `""` |
241+| flag: `--tls-cert-file`<br/>toml: `tls_cert_file` | string | path to certificate file | |
242+| flag: `--tls-key-file`<br/>toml: `tls_key_file` | string | path to private key file | |
243+| flag: `--tls-cipher-suite`<br/>toml: `tls_cipher_suites` | string \| list | Restricts TLS cipher suites used by server to those listed (e.g. TLS_RSA_WITH_RC4_128_SHA) (may be given multiple times). If not specified, the default Go safe cipher list is used. List of valid cipher suites can be found in the [crypto/tls documentation](https://pkg.go.dev/crypto/tls#pkg-constants). | |
244+| flag: `--tls-min-version`<br/>toml: `tls_min_version` | string | minimum TLS version that is acceptable, either `"TLS1.2"` or `"TLS1.3"` | `"TLS1.2"` |
245+
246+### Session Options
247+
248+| Flag / Config Field | Type | Description | Default |
249+| ----------------------------------------------------------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
250+| flag: `--session-cookie-minimal`<br/>toml: `session_cookie_minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
251+| flag: `--session-store-type`<br/>toml: `session_store_type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
252+| flag: `--redis-cluster-connection-urls`<br/>toml: `redis_cluster_connection_urls` | string \| list | List of Redis cluster connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-cluster` | |
253+| flag: `--redis-connection-url`<br/>toml: `redis_connection_url` | string | URL of redis server for redis session storage (e.g. `redis://HOST[:PORT]`) | |
254+| flag: `--redis-ca-path`<br/>toml: `redis_ca_path` | string | Path to a CA certificates file that should be used when connecting to redis. If not specified, the system cert pool is used instead. | |
255+| flag: `--redis-insecure-skip-tls-verify`<br/>toml: `redis_insecure_skip_tls_verify` | bool | skip TLS verification when connecting to Redis | false |
256+| flag: `--redis-password`<br/>toml: `redis_password` | string | Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url` | |
257+| flag: `--redis-sentinel-password`<br/>toml: `redis_sentinel_password` | string | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password` | |
258+| flag: `--redis-sentinel-master-name`<br/>toml: `redis_sentinel_master_name` | string | Redis sentinel master name. Used in conjunction with `--redis-use-sentinel` | |
259+| flag: `--redis-sentinel-connection-urls`<br/>toml: `redis_sentinel_connection_urls` | string \| list | List of Redis sentinel connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-sentinel` | |
260+| flag: `--redis-use-cluster`<br/>toml: `redis_use_cluster` | bool | Connect to redis cluster. Must set `--redis-cluster-connection-urls` to use this feature | false |
261+| flag: `--redis-use-sentinel`<br/>toml: `redis_use_sentinel` | bool | Connect to redis via sentinels. Must set `--redis-sentinel-master-name` and `--redis-sentinel-connection-urls` to use this feature | false |
262+| flag: `--redis-connection-idle-timeout`<br/>toml: `redis_connection_idle_timeout` | int | Redis connection idle timeout seconds. If Redis [timeout](https://redis.io/docs/reference/clients/#client-timeouts) option is set to non-zero, the `--redis-connection-idle-timeout` must be less than Redis timeout option. Example: if either redis.conf includes `timeout 15` or using `CONFIG SET timeout 15` the `--redis-connection-idle-timeout` must be at least `--redis-connection-idle-timeout=14` | 0 |
263+
264+### Upstream Options
265+
266+| Flag / Config Field | Type | Description | Default |
267+| ----------------------------------------------------------------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------- |
268+| flag: `--flush-interval`<br/>toml: `flush_interval` | duration | period between flushing response buffers when streaming responses | `"1s"` |
269+| flag: `--pass-host-header`<br/>toml: `pass_host_header` | bool | pass the request Host Header to upstream | true |
270+| flag: `--proxy-websockets`<br/>toml: `proxy_websockets` | bool | enables WebSocket proxying | true |
271+| flag: `--ssl-upstream-insecure-skip-verify`<br/>toml: `ssl_upstream_insecure_skip_verify` | bool | skip validation of certificates presented when using HTTPS upstreams | false |
272+| flag: `--disable-keep-alives`<br/>toml: `disable_keep_alives` | bool | disable HTTP keep-alive connections to the upstream server | false |
273+| flag: `--upstream-timeout`<br/>toml: `upstream_timeout` | duration | maximum amount of time the server will wait for a response from the upstream | 30s |
274+| flag: `--upstream`<br/>toml: `upstreams` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
275+
276+## Configuration Validation
277+
278+The `--config-test` flag validates your configuration file without starting the proxy server. This is useful for:
279+- **CI/CD pipelines**: Pre-deployment validation
280+- **Configuration management**: Testing before applying changes
281+- **Debugging**: Verifying syntax and required fields
282+
283+### Usage
284+
285+```bash
286+# Test legacy config
287+oauth2-proxy --config /etc/oauth2-proxy.cfg --config-test
288+
289+# Test alpha config
290+oauth2-proxy --config /etc/core.cfg --alpha-config /etc/alpha.yaml --config-test
291+
292+# CI/CD pre-deployment check
293+# Returns with exit code 1 if any validation errors occur
294+oauth2-proxy --config new-config.cfg --config-test
295+```
296+
297+### Exit Codes
298+
299+- **0**: Configuration is valid ✅
300+- **1**: Configuration is invalid (errors printed to stderr) ❌
301+
302+### Validation Coverage
303+
304+The `--config-test` flag performs the **same comprehensive validation** as normal startup, including:
305+- Required fields (client ID, client secret, cookie secret, etc.)
306+- Syntax validation (TOML/YAML parsing)
307+- Provider configuration
308+- Upstream server definitions
309+- Session store connectivity (e.g., Redis network checks if configured)
310+
311+**Note**: Cannot be combined with `--convert-config-to-alpha`.
312+
313+## Upstreams Configuration
314+
315+`oauth2-proxy` supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers, unix socket or serve static files from the file system.
316+
317+To configure **HTTP and HTTPS upstreams**, provide such a URL in `--upstream=URL`. The scheme+host portion and the path portion are extracted to configure proxying behavior. When processing incoming requests, the path portion becomes a lookup key for selecting the destination server of the proxied request.
318+
319+* Upstream URLs *without a trailing slash,* like in `--upstream=http://service2.internal/foo`, will match an incoming request exactly to `/foo` in `https://this.o2p.example.com/foo`, and forward the request on to service2.internal, but not match a request to `https://this.o2p.example.com/foo/more` nor ...`.com/food`.
320+* Upstream URLs *with a trailing slash,* like in `--upstream=http://service1.internal/foo/`, will match any incoming request to any incoming requests's path *starting with* `/foo/`, like `/foo/` and `/foo/more` and `/foo/lots/more?etc`.
321+
322+If multiple `--upstream` URLs' paths match an incoming request, the one with the longest matching path (the most specific match) takes priority over shorter (less specific) ones.
323+
324+**Unix socket upstreams** are configured as `unix:///path/to/unix.sock`.
325+
326+**Static file paths** are configured as a file:// URL. `file:///var/www/static/` will serve the files from that directory at `http://[oauth2-proxy url]/var/www/static/`, which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. `file:///var/www/static/#/static/` will make `/var/www/static/` available at `http://[oauth2-proxy url]/static/`.
327+
328+Multiple upstreams can either be configured by supplying a comma separated list to the `--upstream` parameter, supplying the parameter multiple times or providing a list in the [config file](#config-file). When multiple upstreams are used routing to them will be based on the path they are set up with.
329+
330+## Environment variables
331+
332+Every command line argument can be specified as an environment variable by
333+prefixing it with `OAUTH2_PROXY_`, capitalising it, and replacing hyphens (`-`)
334+with underscores (`_`). If the argument can be specified multiple times, the
335+environment variable should be plural (trailing `S`).
336+
337+This is particularly useful for storing secrets outside a configuration file
338+or the command line.
339+
340+For example, the `--cookie-secret` flag becomes `OAUTH2_PROXY_COOKIE_SECRET`.
341+If a flag has the type `string | list` like the `--email-domain` flag it is
342+available as an environment variable in plural form e.g. `OAUTH2_PROXY_EMAIL_DOMAINS`
343+
344+Values for type `string | list` usually have a plural environment variable name
345+and need to be seperated by `,` e.g.
346+`OAUTH2_PROXY_SKIP_AUTH_ROUTES="GET=^/api/status,POST=^/api/saved_objects/_import"`
347+
348+Please check the type for each [config option](#config-options) first.
349+
350+## Logging Configuration
351+
352+By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the `--logging-filename` command.
353+
354+If logging to a file you can also configure the maximum file size (`--logging-max-size`), age (`--logging-max-age`), max backup logs (`--logging-max-backups`), and if backup logs should be compressed (`--logging-compress`).
355+
356+There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with `--standard-logging`, `--auth-logging`, and `--request-logging`.
357+
358+Each type of logging has its own configurable format and variables. By default, these formats are similar to the Apache Combined Log.
359+
360+Logging of requests to the `/ping` endpoint (or using `--ping-user-agent`) and the `/ready` endpoint can be disabled with `--silence-ping-logging` reducing log volume.
361+
362+## Auth Log Format
363+
364+Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:
365+
366+```
367+<REMOTE_ADDRESS> - <REQUEST ID> - <user@domain.com> [2015/03/19 17:20:19] [<STATUS>] <MESSAGE>
368+```
369+
370+The status block will contain one of the below strings:
371+
372+- `AuthSuccess` If a user has authenticated successfully by any method
373+- `AuthFailure` If the user failed to authenticate explicitly
374+- `AuthError` If there was an unexpected error during authentication
375+
376+If you require a different format than that, you can configure it with the `--auth-logging-format` flag.
377+The default format is configured as follows:
378+
379+```
380+{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}
381+```
382+
383+Available variables for auth logging:
384+
385+| Variable | Example | Description |
386+| ------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
387+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
388+| Host | domain.com | The value of the Host header. |
389+| Message | Authenticated via OAuth2 | The details of the auth attempt. |
390+| Protocol | HTTP/1.0 | The request protocol. |
391+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
392+| RequestMethod | GET | The request method. |
393+| Timestamp | 2015/03/19 17:20:19 | The date and time of the logging event. |
394+| UserAgent | - | The full user agent as reported by the requesting client. |
395+| Username | username@email.com | The email or username of the auth request. |
396+| Status | AuthSuccess | The status of the auth request. See above for details. |
397+
398+## Request Log Format
399+
400+HTTP request logs will output by default in the below format:
401+
402+```
403+<REMOTE_ADDRESS> - <REQUEST ID> - <user@domain.com> [2015/03/19 17:20:19] <HOST_HEADER> GET <UPSTREAM_HOST> "/path/" HTTP/1.1 "<USER_AGENT>" <RESPONSE_CODE> <RESPONSE_BYTES> <REQUEST_DURATION>
404+```
405+
406+If you require a different format than that, you can configure it with the `--request-logging-format` flag.
407+The default format is configured as follows:
408+
409+```
410+{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}
411+```
412+
413+Available variables for request logging:
414+
415+| Variable | Example | Description |
416+| --------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
417+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
418+| Host | domain.com | The value of the Host header. |
419+| Protocol | HTTP/1.0 | The request protocol. |
420+| RequestDuration | 0.001 | The time in seconds that a request took to process. |
421+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
422+| RequestMethod | GET | The request method. |
423+| RequestURI | "/oauth2/auth" | The URI path of the request. |
424+| ResponseSize | 12 | The size in bytes of the response. |
425+| StatusCode | 200 | The HTTP status code of the response. |
426+| Timestamp | 2015/03/19 17:20:19 | The date and time of the logging event. |
427+| Upstream | - | The upstream data of the HTTP request. |
428+| UserAgent | - | The full user agent as reported by the requesting client. |
429+| Username | username@email.com | The email or username of the auth request. |
430+
431+## Standard Log Format
432+
433+All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:
434+
435+```
436+[2015/03/19 17:20:19] [main.go:40] <MESSAGE>
437+```
438+
439+If you require a different format than that, you can configure it with the `--standard-logging-format` flag. The default format is configured as follows:
440+
441+```
442+[{{.Timestamp}}] [{{.File}}] {{.Message}}
443+```
444+
445+Available variables for standard logging:
446+
447+| Variable | Example | Description |
448+| --------- | --------------------------------- | -------------------------------------------------- |
449+| Timestamp | 2015/03/19 17:20:19 | The date and time of the logging event. |
450+| File | main.go:40 | The file and line number of the logging statement. |
451+| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
docs/docs/configuration/providers/adfs.mdnew file+19
@@ -0,0 +1,19 @@
1+---
2+id: adfs
3+title: ADFS
4+---
5+
6+1. Open the ADFS administration console on your Windows Server and add a new Application Group
7+2. Provide a name for the integration, select Server Application from the Standalone applications section and click Next
8+3. Follow the wizard to get the client-id, client-secret and configure the application credentials
9+4. Configure the proxy with
10+
11+```
12+ --provider=adfs
13+ --client-id=<application ID from step 3>
14+ --client-secret=<value from step 3>
15+```
16+
17+Note: When using the ADFS Auth provider with nginx and the cookie session store you may find the cookie is too large and
18+doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the
19+[redis session storage](../sessions.md#redis-storage) should resolve this.
docs/docs/configuration/providers/atlassian.mdnew file+26
@@ -0,0 +1,26 @@
1+---
2+id: atlassian
3+title: Atlassian Cloud
4+---
5+
6+1. Create an OAuth 2.0 integration in the [Atlassian developer console](https://developer.atlassian.com/console/myapps/).
7+2. Under **Permissions**, add the User identity API with the `read:me` scope.
8+3. Under **Authorization**, set the callback URL to `https://<proxy_host>/oauth2/callback`.
9+4. Copy the client ID and secret from **Settings**.
10+5. Run the proxy with:
11+
12+```shell
13+ --provider=atlassian
14+ --client-id=<client ID>
15+ --client-secret=<secret>
16+ --redirect-url=https://<proxy_host>/oauth2/callback
17+ --cookie-secret=<cookie secret>
18+```
19+
20+A new app works only for the account that created it. Enable sharing under **Distribution** to let other users sign in.
21+Atlassian then admits only accounts with access to the Atlassian site the app is installed on; others are refused at
22+the consent screen.
23+
24+The proxy reads the user's email from `https://api.atlassian.com/me`. Restricting access further is supported by
25+[email](index.md#email-authentication). With `--cookie-refresh` set, the proxy re-validates the token against `/me` on
26+that interval.
docs/docs/configuration/providers/bitbucket.mdnew file+25
@@ -0,0 +1,25 @@
1+---
2+id: bitbucket
3+title: BitBucket
4+---
5+
6+1. [Add a new OAuth consumer](https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html)
7+ * In "Callback URL" use `https://<oauth2-proxy>/oauth2/callback`, substituting `<oauth2-proxy>` with the actual
8+ hostname that oauth2-proxy is running on.
9+ * In Permissions section select:
10+ * Account -> Email
11+ * Team membership -> Read
12+ * Repositories -> Read
13+2. Note the Client ID and Client Secret.
14+
15+To use the provider, pass the following options:
16+
17+```
18+ --provider=bitbucket
19+ --client-id=<Client ID>
20+ --client-secret=<Client Secret>
21+```
22+
23+The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team
24+members use additional configuration option: `--bitbucket-team=<Team name>`. To restrict the access to only these users
25+who have access to one selected repository use `--bitbucket-repository=<Repository name>`.
docs/docs/configuration/providers/cidaas.mdnew file+37
@@ -0,0 +1,37 @@
1+---
2+id: cidaas
3+title: Cidaas
4+---
5+
6+[Cidaas](https://www.cidaas.com/) is an Identity as a Service (IDaaS) solution that provides authentication and authorization services.
7+It supports various protocols including OpenID Connect, OAuth 2.0, and SAML.
8+
9+However, Cidaas provides groups and their roles as hierarchical claims, which are not supported by oauth2-proxy yet.
10+The Cidaas provider transforms the hierarchical claims into a flat list of groups, which can be used by oauth2-proxy.
11+
12+Example of groups and roles in Cidaas:
13+
14+```json
15+{
16+ "groups": [
17+ {
18+ "groupId": "group1",
19+ "roles": ["role1", "role2"]
20+ },
21+ {
22+ "groupId": "group2",
23+ "roles": ["role3"]
24+ }
25+ ]
26+}
27+```
28+
29+This will be transformed into a flat list of groups:
30+
31+```json
32+{
33+ "groups": ["group1:role1", "group2:role2", "group2:role3"]
34+}
35+```
36+
37+Apart from that the Cidaas provider inherits all the features of the [OpenID Connect provider](openid_connect.md).
docs/docs/configuration/providers/cisco_duo.mdnew file+44
@@ -0,0 +1,44 @@
1+---
2+id: cisco_duo
3+title: Cisco Duo
4+---
5+
6+Cisco Duo SSO can be configured with OAuth2 Proxy using the OIDC provider.
7+
8+1. Create a new **Generic OIDC Relying Party - Single Sign-On** application in the Duo Admin Portal
9+2. Configure OAuth2 Proxy with the following options:
10+
11+```
12+provider = "oidc"
13+provider_display_name = "Duo SSO"
14+scope = "openid email profile"
15+pass_access_token = true
16+code_challenge_method = "S256"
17+```
18+
19+3. Configure Provider endpoints. Copy the following values from the corresponding fields in the Duo Admin Portal:
20+
21+```
22+# Copy from "Client ID" field
23+client_id = "XXXXXXXX"
24+
25+# Copy from "Client Secret" field
26+client_secret = "XXXXXXXX"
27+
28+# Copy from "Issuer" field
29+oidc_issuer_url = "https://sso-xxxxxxxx.sso.duosecurity.com/oidc/xxxxxxxx"
30+
31+# Copy from "JWKS URL" field
32+oidc_jwks_url = "https://sso-xxxxxxxx.sso.duosecurity.com/oidc/xxxxxxxx/jwks"
33+
34+# Copy from "Token Introspection URL" field
35+validate_url = "https://sso-xxxxxxxx.sso.duosecurity.com/oidc/xxxxxxxx/token_introspection"
36+
37+# Copy from "UserInfo" field
38+profile_url = "https://sso-xxxxxxxx.sso.duosecurity.com/oidc/xxxxxxxx/userinfo"
39+
40+# Copy from "Token URL" field
41+redeem_url = "https://sso-xxxxxxxx.sso.duosecurity.com/oidc/xxxxxxxx/token"
42+```
43+
44+4. Complete Configuration by filling in any remaining required fields and save your configuration.
docs/docs/configuration/providers/digitalocean.mdnew file+21
@@ -0,0 +1,21 @@
1+---
2+id: digitalocean
3+title: DigitalOcean
4+---
5+
6+1. [Create a new OAuth application](https://cloud.digitalocean.com/account/api/applications)
7+ * You can fill in the name, homepage, and description however you wish.
8+ * In the "Application callback URL" field, enter: `https://oauth-proxy/oauth2/callback`, substituting `oauth2-proxy`
9+ with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL.
10+2. Note the Client ID and Client Secret.
11+
12+To use the provider, pass the following options:
13+
14+```
15+ --provider=digitalocean
16+ --client-id=<Client ID>
17+ --client-secret=<Client Secret>
18+```
19+
20+Alternatively, set the equivalent options in the config file. The redirect URL defaults to
21+`https://<requested host header>/oauth2/callback`. If you need to change it, you can use the `--redirect-url` command-line option.
docs/docs/configuration/providers/dtt_sso.mdnew file+45
@@ -0,0 +1,45 @@
1+---
2+id: dtt_sso
3+title: DTT SSO
4+---
5+
6+Signs users in with the DTT SSO (auth-server) using the authorization code flow and its HS256 id_token.
7+
8+1. Register a client in the auth-server config, one per protected service, with the proxy's callback as its
9+ only redirect URI:
10+
11+ ```yaml
12+ clients:
13+ redash-gate:
14+ secret: <random secret>
15+ redirect_uri: https://redash.example.com/oauth2/callback
16+ display_name: Redash
17+ ```
18+
19+2. Run the proxy with:
20+
21+ ```shell
22+ --provider=dtt-sso
23+ --client-id=redash-gate
24+ --client-secret-file=/run/secrets/client_secret
25+ --redirect-url=https://redash.example.com/oauth2/callback
26+ --cookie-secret-file=/run/secrets/cookie_secret
27+ --cookie-name=_dtt_sso_redash
28+ --cookie-refresh=5m
29+ ```
30+
31+ Give each instance its own `--cookie-name`: another oauth2-proxy setting its cookie on a parent domain
32+ (the Atlassian proxy uses `_oauth2_proxy` on `.thebestagent.pro`) would otherwise shadow this one.
33+
34+The endpoints default to `https://auth.thebestagent.pro`. For another SSO host set `--login-url`, `--redeem-url`
35+and `--validate-url` to its `/oauth/authorize`, `/oauth/token` and `/oauth/check_token`; the id_token issuer must
36+equal the login URL's origin (the SSO's `site_host`).
37+
38+The scope must stay `openid`, the only scope the SSO accepts.
39+
40+The session carries the SSO `email`, the user UUID as the user, and the SSO `role` as the only group, so
41+`--allowed-group=dtt_admin` restricts access by role. `--authenticated-emails-file` and `--email-domain` restrict
42+by email as usual.
43+
44+With `--cookie-refresh` set, the proxy refreshes the tokens on that interval and re-reads the email and role; a user
45+deleted or signed out in the SSO loses access at the next refresh.
docs/docs/configuration/providers/facebook.mdnew file+7
@@ -0,0 +1,7 @@
1+---
2+id: facebook
3+title: Facebook
4+---
5+
6+1. Create a new FB App from https://developers.facebook.com/
7+2. Under FB Login, set your Valid OAuth redirect URIs to `https://internal.yourcompany.com/oauth2/callback`
docs/docs/configuration/providers/gitea.mdnew file+24
@@ -0,0 +1,24 @@
1+---
2+id: gitea
3+title: Gitea / Forgejo
4+---
5+
6+:::note
7+This is not actually a fully serparate provider. For more details and options please refer to the [GitHub Provider Options](github.md)
8+:::
9+
10+1. Create a new application: `https://< your gitea host >/user/settings/applications`
11+2. Under `Redirect URI` enter the correct URL i.e. `https://<proxied host>/oauth2/callback`
12+3. Note the Client ID and Client Secret.
13+4. Pass the following options to the proxy:
14+
15+```
16+ --provider="github"
17+ --redirect-url="https://<proxied host>/oauth2/callback"
18+ --provider-display-name="Gitea"
19+ --client-id="< client_id as generated by Gitea >"
20+ --client-secret="< client_secret as generated by Gitea >"
21+ --login-url="https://< your gitea host >/login/oauth/authorize"
22+ --redeem-url="https://< your gitea host >/login/oauth/access_token"
23+ --validate-url="https://< your gitea host >/api/v1/user/emails"
24+```
docs/docs/configuration/providers/github.mdnew file+81
@@ -0,0 +1,81 @@
1+---
2+id: github
3+title: GitHub
4+---
5+
6+## Config Options
7+
8+| Flag | Toml Field | Type | Description | Default |
9+| ---------------- | -------------- | -------------- | ------------------------------------------------------------------------------------------------------------- | ------- |
10+| `--github-org` | `github_org` | string | restrict logins to members of this organisation | |
11+| `--github-team` | `github_team` | string | restrict logins to members of any of these teams (slug) or (org:team), comma separated | |
12+| `--github-repo` | `github_repo` | string | restrict logins to collaborators of this repository formatted as `orgname/repo` | |
13+| `--github-token` | `github_token` | string | the token to use when verifying repository collaborators (must have push access to the repository) | |
14+| `--github-user` | `github_users` | string \| list | To allow users to login by username even if they do not belong to the specified org and team or collaborators | |
15+
16+## Usage
17+
18+1. Create a new project: https://github.com/settings/developers
19+2. Under `Authorization callback URL` enter the correct url ie `https://internal.yourcompany.com/oauth2/callback`
20+
21+The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional
22+team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with `--email-domain=*`. Additionally, all the organizations and teams a user belongs to are set as part of the `X-Forwarded-Groups` header. e.g. `org1:team1,org1:team2,org2:team1`
23+
24+NOTE: When `--github-user` is set, the specified users are allowed to log in even if they do not belong to the specified
25+org and team or collaborators.
26+
27+To restrict access to your organization:
28+
29+```shell
30+ # restrict logins to members of this organisation
31+ --github-org="your-org"
32+```
33+
34+To restrict access to specific teams within an organization:
35+
36+```shell
37+ --github-org="your-org"
38+ # restrict logins to members of any of these teams (slug), comma separated
39+ --github-team="team1,team2,team3"
40+```
41+
42+To restrict to teams within different organizations, keep the organization flag empty and use `--github-team` like so:
43+
44+```shell
45+ # keep empty
46+ --github-org=""
47+ # restrict logins to members to any of the following teams (format <org>:<slug>, like octo:team1), comma separated
48+ --github-team="org1:team1,org2:team1,org3:team42,octo:cat"
49+```
50+
51+If you would rather restrict access to collaborators of a repository, those users must either have push access to a
52+public repository or any access to a private repository:
53+
54+```shell
55+ # restrict logins to collaborators of this repository formatted as orgname/repo
56+ --github-repo=""
57+```
58+
59+If you'd like to allow access to users with **read only** access to a **public** repository you will need to provide a
60+[token](https://github.com/settings/tokens) for a user that has write access to the repository. The token must be
61+created with at least the `public_repo` scope:
62+
63+```shell
64+ # the token to use when verifying repository collaborators
65+ --github-token=""
66+```
67+
68+To allow a user to log in with their username even if they do not belong to the specified org and team or collaborators:
69+
70+```shell
71+ # allow logins by username, comma separated
72+ --github-user=""
73+```
74+
75+If you are using GitHub enterprise, make sure you set the following to the appropriate url:
76+
77+```shell
78+ --login-url="http(s)://<enterprise github host>/login/oauth/authorize"
79+ --redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"
80+ --validate-url="http(s)://<enterprise github host>/api/v3"
81+```
docs/docs/configuration/providers/gitlab.mdnew file+49
@@ -0,0 +1,49 @@
1+---
2+id: gitlab
3+title: GitLab
4+---
5+
6+## Config Options
7+
8+| Flag | Toml Field | Type | Description | Default |
9+| ------------------- | ----------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
10+| `--gitlab-group` | `gitlab_groups` | string \| list | restrict logins to members of any of these groups (slug), separated by a comma | |
11+| `--gitlab-project` | `gitlab_projects` | string \| list | restrict logins to members of any of these projects (may be given multiple times) formatted as `orgname/repo=accesslevel`. Access level should be a value matching [Gitlab access levels](https://docs.gitlab.com/ee/api/members.html#valid-access-levels), defaulted to 20 if absent | |
12+
13+## Usage
14+
15+This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version
16+prior to 12.X (see [994](https://github.com/oauth2-proxy/oauth2-proxy/issues/994)).
17+
18+Whether you are using GitLab.com or self-hosting GitLab, follow
19+[these steps to add an application](https://docs.gitlab.com/integration/oauth_provider/). Make sure to enable at
20+least the `openid`, `profile` and `email` scopes, and set the redirect url to your application url e.g.
21+https://myapp.com/oauth2/callback.
22+
23+If you need projects filtering, add the extra `read_api` scope to your application.
24+
25+The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow
26+[these steps](../overview.md#generating-a-cookie-secret)
27+
28+```
29+ --provider="gitlab"
30+ --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab
31+ --client-id=GITLAB_CLIENT_ID
32+ --client-secret=GITLAB_CLIENT_SECRET
33+ --cookie-secret=COOKIE_SECRET
34+```
35+
36+Restricting by group membership is possible with the following option:
37+
38+```shell
39+ --gitlab-group="mygroup,myothergroup" # restrict logins to members of any of these groups (slug), separated by a comma
40+```
41+
42+If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:
43+
44+```shell
45+ --oidc-issuer-url="<your gitlab url>"
46+```
47+
48+If your self-hosted GitLab is on a subdirectory (e.g. domain.tld/gitlab), as opposed to its own subdomain
49+(e.g. gitlab.domain.tld), you may need to add a redirect from domain.tld/oauth pointing at e.g. domain.tld/gitlab/oauth.
docs/docs/configuration/providers/google.mdnew file+84
@@ -0,0 +1,84 @@
1+---
2+id: google
3+title: Google (default)
4+---
5+
6+## Config Options
7+
8+| Flag | Toml Field | Type | Description | Default |
9+|-------------------------------------------------|----------------------------------------------| ------ |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------|
10+| `--google-admin-email` | `google_admin_email` | string | the google admin to impersonate for api calls | |
11+| `--google-group` | `google_groups` | string | restrict logins to members of this google group (may be given multiple times). If not specified and service account or default credentials are configured, all user groups will be allowed. | |
12+| `--google-service-account-json` | `google_service_account_json` | string | the path to the service account json credentials | |
13+| `--google-use-application-default-credentials` | `google_use_application_default_credentials` | bool | use application default credentials instead of service account json (i.e. GKE Workload Identity) | |
14+| `--google-target-principal` | `google_target_principal` | bool | the target principal to impersonate when using ADC | defaults to the service account configured for ADC |
15+| `--google-use-organization-id` | `google_use_organization_id` | bool | use organization id as preferred username | false |
16+| `--google-admin-api-user-scope` | `google_admin_api_user_scope` | string | the OAuth scope to use when querying the Google Admin SDK for organization id, can be 'readonly', 'user' or 'cloud'<br/> | `readonly` |
17+
18+## Usage
19+
20+For Google, the registration steps are:
21+
22+1. Create a new project: https://console.developers.google.com/project
23+2. Choose the new project from the top right project dropdown (only if another project is selected)
24+3. In the project Dashboard center pane, choose **"APIs & Services"**
25+4. In the left Nav pane, choose **"Credentials"**
26+5. In the center pane, choose **"OAuth consent screen"** tab. Fill in **"Product name shown to users"** and hit save.
27+6. In the center pane, choose **"Credentials"** tab.
28+ - Open the **"New credentials"** drop down
29+ - Choose **"OAuth client ID"**
30+ - Choose **"Web application"**
31+ - Application name is freeform, choose something appropriate
32+ - Authorized JavaScript origins is your domain ex: `https://internal.yourcompany.com`
33+ - Authorized redirect URIs is the location of oauth2/callback ex: `https://internal.yourcompany.com/oauth2/callback`
34+ - Choose **"Create"**
35+7. Take note of the **Client ID** and **Client Secret**
36+
37+It's recommended to refresh sessions on a short interval (1h) with `cookie-refresh` setting which validates that the
38+account is still authorized.
39+
40+#### Restrict auth to specific Google groups on your domain. (optional)
41+
42+1. Create a [service account](https://developers.google.com/identity/protocols/oauth2/service-account) and configure it
43+ to use [Application Default Credentials / Workload Identity / Workload Identity Federation (recommended)](#using-application-default-credentials-adc--workload-identity--workload-identity-federation-recommended) or,
44+ alternatively download the JSON.
45+2. Make note of the Client ID for a future step.
46+3. Under "APIs & Auth", choose APIs.
47+4. Click on Admin SDK and then Enable API.
48+5. Follow the steps on [Set up domain-wide delegation for a service account](https://developers.google.com/workspace/guides/create-credentials#optional_set_up_domain-wide_delegation_for_a_service_account)
49+ and give the client id from step 2 the following oauth scopes:
50+
51+ ```
52+ https://www.googleapis.com/auth/admin.directory.group.member.readonly
53+ ```
54+
55+6. Follow the steps on https://support.google.com/a/answer/60757 to enable Admin API access.
56+7. Create or choose an existing administrative email address on the Gmail domain to assign to the `google-admin-email`
57+ flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from
58+ step 5 for the reason why.
59+8. Create or choose an existing email group and set that email to the `google-group` flag. You can pass multiple instances
60+ of this flag with different groups and the user will be checked against all the provided groups.
61+
62+(Only if using a JSON file (see step 1))
63+
64+9. Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and
65+ set the path to the file in the `google-service-account-json` flag.
66+10. Restart oauth2-proxy.
67+
68+Note: The user is checked against the group members list on initial authentication and every time the token is
69+refreshed ( about once an hour ).
70+
71+##### Using Application Default Credentials (ADC) / Workload Identity / Workload Identity Federation (recommended)
72+oauth2-proxy can make use of [Application Default Credentials](https://cloud.google.com/docs/authentication/application-default-credentials).
73+When deployed within GCP, this means that it can automatically use the service account attached to the resource. When deployed to GKE, ADC
74+can be leveraged through a feature called Workload Identity. Follow Google's [guide](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity)
75+to set up Workload Identity.
76+
77+When deployed outside of GCP, [Workload Identity Federation](https://cloud.google.com/docs/authentication/provide-credentials-adc#wlif) might be an option.
78+
79+##### Using Organization ID as Preferred Username (optional)
80+By default, the google provider uses the google id as username. If you would like to use an organization id instead, you can set the `google-use-organization-id` flag to true.
81+This requires that the service account used to query the Google Admin SDK has one of the following scopes granted in step 5 above:
82+- `https://www.googleapis.com/auth/admin.directory.user.readonly`,
83+- `https://www.googleapis.com/auth/admin.directory.user`
84+- `https://www.googleapis.com/auth/cloud-platform`
docs/docs/configuration/providers/index.mdnew file+48
@@ -0,0 +1,48 @@
1+---
2+id: index
3+title: OAuth Provider Configuration
4+---
5+
6+You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it
7+with Redirect URI(s) for the domain you intend to run `oauth2-proxy` on.
8+
9+Valid providers are :
10+
11+- [ADFS](adfs.md)
12+- [Atlassian Cloud](atlassian.md)
13+- [Bitbucket](bitbucket.md)
14+- [Cidaas](cidaas.md)
15+- [CiscoDuo](cisco_duo.md)
16+- [DigitalOcean](digitalocean.md)
17+- [DTT SSO](dtt_sso.md)
18+- [Facebook](facebook.md)
19+- [Gitea](gitea.md)
20+- [GitHub](github.md)
21+- [GitLab](gitlab.md)
22+- [Google](google.md) _default_
23+- [Keycloak](keycloak.md) (Deprecated)
24+- [Keycloak OIDC](keycloak_oidc.md)
25+- [LinkedIn](linkedin.md)
26+- [login.gov](login_gov.md)
27+- [Microsoft Azure](ms_azure_ad.md) (Deprecated)
28+- [Microsoft Entra ID](ms_entra_id.md)
29+- [Nextcloud](nextcloud.md)
30+- [OpenID Connect](openid_connect.md)
31+- [SourceHut](sourcehut.md)
32+
33+The provider can be selected using the `provider` configuration value, or set in the [`providers` array using AlphaConfig](https://oauth2-proxy.github.io/oauth2-proxy/configuration/alpha-config#providers). However, [**the feature to implement multiple providers is not complete**](https://github.com/oauth2-proxy/oauth2-proxy/issues/926).
34+
35+Please note that not all providers support all claims. The `preferred_username` claim is currently only supported by the
36+OpenID Connect provider.
37+
38+## Email Authentication
39+
40+To authorize a specific email-domain use `--email-domain=yourcompany.com`. To authorize individual email addresses use
41+`--authenticated-emails-file=/path/to/file` with one email per line. To authorize all email addresses use `--email-domain=*`.
42+
43+## Adding a new Provider
44+
45+Follow the examples in the [`providers` package](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/) to define a new
46+`Provider` instance. Add a new `case` to
47+[`providers.New()`](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go) to allow `oauth2-proxy` to use the
48+new `Provider`.
docs/docs/configuration/providers/keycloak.mdnew file+36
@@ -0,0 +1,36 @@
1+---
2+id: keycloak
3+title: Keycloak (Deprecated)
4+---
5+
6+:::note
7+This is the legacy and deprecated provider for Keycloak, use [Keycloak OIDC Auth Provider](keycloak_oidc.md) if possible.
8+:::
9+
10+1. Create new client in your Keycloak realm with **Access Type** 'confidential' and **Valid Redirect URIs** 'https://internal.yourcompany.com/oauth2/callback'
11+2. Take note of the Secret in the credential tab of the client
12+3. Create a mapper with **Mapper Type** 'Group Membership' and **Token Claim Name** 'groups'.
13+
14+Make sure you set the following to the appropriate url:
15+
16+```
17+ --provider=keycloak
18+ --client-id=<client you have created>
19+ --client-secret=<your client's secret>
20+ --login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"
21+ --redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"
22+ --profile-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
23+ --validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
24+ --keycloak-group=<first_allowed_user_group>
25+ --keycloak-group=<second_allowed_user_group>
26+```
27+
28+For group based authorization, the optional `--keycloak-group` (legacy) or `--allowed-group` (global standard)
29+flags can be used to specify which groups to limit access to.
30+
31+If these are unset but a `groups` mapper is set up above in step (3), the provider will still
32+populate the `X-Forwarded-Groups` header to your upstream server with the `groups` data in the
33+Keycloak userinfo endpoint response.
34+
35+The group management in keycloak is using a tree. If you create a group named admin in keycloak
36+you should define the 'keycloak-group' value to /admin.
docs/docs/configuration/providers/keycloak_oidc.mdnew file+151
@@ -0,0 +1,151 @@
1+---
2+id: keycloak_oidc
3+title: Keycloak OIDC
4+---
5+
6+## Config Options
7+
8+| Flag | Toml Field | Type | Description | Default |
9+| ---------------- | --------------- | -------------- | ------------------------------------------------------------------------------------------------------------------ | ------- |
10+| `--allowed-role` | `allowed_roles` | string \| list | restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider. | |
11+
12+## Usage
13+
14+```
15+ --provider=keycloak-oidc
16+ --client-id=<your client's id>
17+ --client-secret=<your client's secret>
18+ --redirect-url=https://internal.yourcompany.com/oauth2/callback
19+ --oidc-issuer-url=https://<keycloak host>/realms/<your realm> // For Keycloak versions <17: --oidc-issuer-url=https://<keycloak host>/auth/realms/<your realm>
20+ --email-domain=<yourcompany.com> // Validate email domain for users, see option documentation
21+ --allowed-role=<realm role name> // Optional, required realm role
22+ --allowed-role=<client id>:<client role name> // Optional, required client role
23+ --allowed-group=</group name> // Optional, requires group client scope
24+ --code-challenge-method=S256 // PKCE
25+```
26+
27+:::note
28+Keycloak has updated its admin console and as of version 19.0.0, the new admin console is enabled by default. The
29+legacy admin console has been announced for removal with the release of version 21.0.0.
30+:::
31+
32+**Keycloak legacy admin console**
33+
34+1. Create new client in your Keycloak realm with **Access Type** 'confidential', **Client protocol** 'openid-connect'
35+ and **Valid Redirect URIs** 'https://internal.yourcompany.com/oauth2/callback'
36+2. Take note of the Secret in the credential tab of the client
37+3. Create a mapper with **Mapper Type** 'Group Membership' and **Token Claim Name** 'groups'.
38+4. Create a mapper with **Mapper Type** 'Audience' and **Included Client Audience** and **Included Custom Audience** set
39+ to your client name.
40+
41+**Keycloak new admin console (default as of v19.0.0)**
42+
43+The following example shows how to create a simple OIDC client using the new Keycloak admin2 console. However, for best
44+practices, it is recommended to consult the Keycloak documentation.
45+
46+The OIDC client must be configured with an _audience mapper_ to include the client's name in the `aud` claim of the JWT token.
47+The `aud` claim specifies the intended recipient of the token, and OAuth2 Proxy expects a match against the values of
48+either `--client-id` or `--oidc-extra-audience`.
49+
50+_In Keycloak, claims are added to JWT tokens through the use of mappers at either the realm level using "client scopes" or
51+through "dedicated" client mappers._
52+
53+**Creating the client**
54+
55+1. Create a new OIDC client in your Keycloak realm by navigating to:
56+ **Clients** -> **Create client**
57+ * **Client Type** 'OpenID Connect'
58+ * **Client ID** `<your client's id>`, please complete the remaining fields as appropriate and click **Next**.
59+ * **Client authentication** 'On'
60+ * **Authentication flow**
61+ * **Standard flow** 'selected'
62+ * **Direct access grants** 'deselect'
63+ * _Save the configuration._
64+ * **Settings / Access settings**:
65+ * **Valid redirect URIs** `https://internal.yourcompany.com/oauth2/callback`
66+ * _Save the configuration._
67+ * Under the **Credentials** tab you will now be able to locate `<your client's secret>`.
68+2. Configure a dedicated *audience mapper* for your client by navigating to **Clients** -> **\<your client's id\>** -> **Client scopes**.
69+* Access the dedicated mappers pane by clicking **\<your client's id\>-dedicated**, located under *Assigned client scope*.
70+ _(It should have a description of "Dedicated scope and mappers for this client")_
71+ * Click **Configure a new mapper** and select **Audience**
72+ * **Name** 'aud-mapper-\<your client's id\>'
73+ * **Included Client Audience** select `<your client's id>` from the dropdown.
74+ * _OAuth2 proxy can be set up to pass both the access and ID JWT tokens to your upstream services.
75+ If you require additional audience entries, you can use the **Included Custom Audience** field in addition
76+ to the "Included Client Audience" dropdown. Note that the "aud" claim of a JWT token should be limited and
77+ only specify its intended recipients._
78+ * **Add to ID token** 'On'
79+ * **Add to access token** 'On' - [#1916](https://github.com/oauth2-proxy/oauth2-proxy/pull/1916)
80+ * _Save the configuration._
81+* Any subsequent dedicated client mappers can be defined by clicking **Dedicated scopes** -> **Add mapper** ->
82+ **By configuration** -> *Select mapper*
83+
84+You should now be able to create a test user in Keycloak and get access to the OAuth2 Proxy instance, make sure to set
85+an email address matching `<yourcompany.com>` and select _Email verified_.
86+
87+**Authorization**
88+
89+_OAuth2 Proxy will perform authorization by requiring a valid user, this authorization can be extended to take into
90+account a user's membership in Keycloak `groups`, `realm roles`, and `client roles` using the keycloak-oidc provider options
91+`--allowed-role` or `--allowed-group`_
92+
93+**Roles**
94+
95+_A standard Keycloak installation comes with the required mappers for **realm roles** and **client roles** through the
96+pre-defined client scope "roles". This ensures that any roles assigned to a user are included in the `JWT` tokens when
97+using an OIDC client that has the "Full scope allowed" feature activated, the feature is enabled by default._
98+
99+_Creating a realm role_
100+* Navigate to **Realm roles** -> **Create role**
101+ * **Role name**, *`<realm role name>`* -> **save**
102+
103+_Creating a client role_
104+* Navigate to **Clients** -> `<your client's id>` -> **Roles** -> **Create role**
105+ * **Role name**, *`<client role name>`* -> **save**
106+
107+
108+_Assign a role to a user_
109+
110+**Users** -> _Username_ -> **Role mapping** -> **Assign role** -> _filter by roles or clients and select_ -> **Assign**.
111+
112+Keycloak "realm roles" can be authorized using the `--allowed-role=<realm role name>` option, while "client roles" can be
113+evaluated using `--allowed-role=<your client's id>:<client role name>`.
114+
115+You may limit the _realm roles_ included in the JWT tokens for any given client by navigating to:
116+**Clients** -> `<your client's id>` -> **Client scopes** -> _\<your client's id\>-dedicated_ -> **Scope**
117+Disabling **Full scope allowed** activates the **Assign role** option, allowing you to select which roles, if assigned
118+to a user, will be included in the user's JWT tokens. This can be useful when a user has many associated roles, and you
119+want to reduce the size and impact of the JWT token.
120+
121+
122+**Groups**
123+
124+You may also do authorization on group memberships by using the OAuth2 Proxy option `--allowed-group`.
125+We will only do a brief description of creating the required _client scope_ **groups** and refer you to read the Keycloak
126+documentation.
127+
128+To summarize, the steps required to authorize Keycloak group membership with OAuth2 Proxy are as follows:
129+
130+* Create a new Client Scope with the name **groups** in Keycloak.
131+ * Include a mapper of type **Group Membership**.
132+ * Set the "Token Claim Name" to **groups** or customize by matching it to the `--oidc-groups-claim` option of OAuth2 Proxy.
133+ * If the "Full group path" option is selected, you need to include a "/" separator in the group names defined in the
134+ `--allowed-group` option of OAuth2 Proxy. Example: "/groupname" or "/groupname/child_group".
135+
136+After creating the _Client Scope_ named _groups_ you will need to attach it to your client.
137+**Clients** -> `<your client's id>` -> **Client scopes** -> **Add client scope** -> Select **groups** and choose Optional
138+and you should now have a client that maps group memberships into the JWT tokens so that Oauth2 Proxy may evaluate them.
139+
140+Create a group by navigating to **Groups** -> **Create group** and _add_ your test user as a member.
141+
142+The OAuth2 Proxy option `--allowed-group=/groupname` will now allow you to filter on group membership
143+
144+Keycloak also has the option of attaching roles to groups, please refer to the Keycloak documentation for more information.
145+
146+**Tip**
147+
148+To check if roles or groups are added to JWT tokens, you can preview a users token in the Keycloak console by following
149+these steps: **Clients** -> `<your client's id>` -> **Client scopes** -> **Evaluate**.
150+Select a _realm user_ and optional _scope parameters_ such as groups, and generate the JSON representation of an access
151+or id token to examine its contents.
docs/docs/configuration/providers/linkedin.mdnew file+13
@@ -0,0 +1,13 @@
1+---
2+id: linkedin
3+title: LinkedIn
4+---
5+
6+For LinkedIn, the registration steps are:
7+
8+1. Create a new project: https://www.linkedin.com/secure/developer
9+2. In the OAuth User Agreement section:
10+ - In default scope, select r_basicprofile and r_emailaddress.
11+ - In "OAuth 2.0 Redirect URLs", enter `https://internal.yourcompany.com/oauth2/callback`
12+3. Fill in the remaining required fields and Save.
13+4. Take note of the **Consumer Key / API Key** and **Consumer Secret / Secret Key**
docs/docs/configuration/providers/login_gov.mdnew file+79
@@ -0,0 +1,79 @@
1+---
2+id: login_gov
3+title: Login.gov
4+---
5+
6+login.gov is an OIDC provider for the US Government.
7+If you are a US Government agency, you can contact the login.gov team through the contact information
8+that you can find on https://login.gov/developers/ and work with them to understand how to get login.gov
9+accounts for integration/test and production access.
10+
11+A developer guide is available here: https://developers.login.gov/, though this proxy handles everything
12+but the data you need to create to register your application in the login.gov dashboard.
13+
14+As a demo, we will assume that you are running your application that you want to secure locally on
15+http://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that
16+you have an agency integration account for testing.
17+
18+First, register your application in the dashboard. The important bits are:
19+* Identity protocol: make this `Openid connect`
20+* Issuer: do what they say for OpenID Connect. We will refer to this string as `${LOGINGOV_ISSUER}`.
21+* Public key: This is a self-signed certificate in .pem format generated from a 2048-bit RSA private key.
22+ A quick way to do this is
23+ `openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'`.
24+ The contents of the `key.pem` shall be referred to as `${OAUTH2_PROXY_JWT_KEY}`.
25+* Return to App URL: Make this be `http://localhost:4180/`
26+* Redirect URIs: Make this be `http://localhost:4180/oauth2/callback`.
27+* Attribute Bundle: Make sure that email is selected.
28+
29+Now start the proxy up with the following options:
30+```
31+./oauth2-proxy -provider login.gov \
32+ -client-id=${LOGINGOV_ISSUER} \
33+ -redirect-url=http://localhost:4180/oauth2/callback \
34+ -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \
35+ -cookie-secure=false \
36+ -email-domain=gsa.gov \
37+ -upstream=http://localhost:3000/ \
38+ -cookie-secret=somerandomstring12341234567890AB \
39+ -cookie-domain=localhost \
40+ -skip-provider-button=true \
41+ -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \
42+ -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \
43+ -jwt-key="${OAUTH2_PROXY_JWT_KEY}"
44+```
45+You can also set all these options with environment variables, for use in cloud/docker environments.
46+One tricky thing that you may encounter is that some cloud environments will pass in environment
47+variables in a docker env-file, which does not allow multiline variables like a PEM file.
48+If you encounter this, then you can create a `jwt_signing_key.pem` file in the top level
49+directory of the repo which contains the key in PEM format and then do your docker build.
50+The docker build process will copy that file into your image which you can then access by
51+setting the `OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem`
52+environment variable, or by setting `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem` on the commandline.
53+
54+Once it is running, you should be able to go to `http://localhost:4180/` in your browser,
55+get authenticated by the login.gov integration server, and then get proxied on to your
56+application running on `http://localhost:3000/`. In a real deployment, you would secure
57+your application with a firewall or something so that it was only accessible from the
58+proxy, and you would use real hostnames everywhere.
59+
60+#### Skip OIDC discovery
61+
62+Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization,
63+token and jwks URI endpoints from the provider's metadata.
64+
65+In this case, you can set the `--skip-oidc-discovery` option, and supply those required endpoints manually:
66+
67+```
68+ -provider oidc
69+ -client-id oauth2-proxy
70+ -client-secret proxy
71+ -redirect-url http://127.0.0.1:4180/oauth2/callback
72+ -oidc-issuer-url http://127.0.0.1:5556
73+ -skip-oidc-discovery
74+ -login-url http://127.0.0.1:5556/authorize
75+ -redeem-url http://127.0.0.1:5556/token
76+ -oidc-jwks-url http://127.0.0.1:5556/keys
77+ -cookie-secure=false
78+ -email-domain example.com
79+```
docs/docs/configuration/providers/ms_azure_ad.mdnew file+59
@@ -0,0 +1,59 @@
1+---
2+id: azure
3+title: Azure (Deprecated)
4+---
5+
6+:::note
7+This is the legacy and deprecated provider for Azure, use [Microsoft Entra ID](ms_entra_id.md) if possible.
8+:::
9+
10+## Config Options
11+
12+| Flag | Toml Field | Type | Description | Default |
13+| ---------------- | -------------- | ------ | ---------------------------------------------------------------- | ---------- |
14+| `--azure-tenant` | `azure_tenant` | string | go to a tenant-specific or common (tenant-independent) endpoint. | `"common"` |
15+| `--resource` | `resource` | string | The resource that is protected (Azure AD only) | |
16+
17+## Usage
18+
19+1. Add an application: go to [https://portal.azure.com](https://portal.azure.com), choose **Azure Active Directory**, select
20+ **App registrations** and then click on **New registration**.
21+2. Pick a name, check the supported account type(single-tenant, multi-tenant, etc). In the **Redirect URI** section create a new
22+ **Web** platform entry for each app that you want to protect by the oauth2 proxy(e.g.
23+ https://internal.yourcompanycom/oauth2/callback). Click **Register**.
24+3. Next we need to add group read permissions for the app registration, on the **API Permissions** page of the app, click on
25+ **Add a permission**, select **Microsoft Graph**, then select **Application permissions**, then click on **Group** and select
26+ **Group.Read.All**. Hit **Add permissions** and then on **Grant admin consent** (you might need an admin to do this).
27+ <br/>**IMPORTANT**: Even if this permission is listed with **"Admin consent required=No"** the consent might actually
28+ be required, due to AAD policies you won't be able to see. If you get a **"Need admin approval"** during login,
29+ most likely this is what you're missing!
30+4. Next, if you are planning to use v2.0 Azure Auth endpoint, go to the **Manifest** page and set `"accessTokenAcceptedVersion": 2`
31+ in the App registration manifest file.
32+5. On the **Certificates & secrets** page of the app, add a new client secret and note down the value after hitting **Add**.
33+6. Configure the proxy with:
34+- for V1 Azure Auth endpoint (Azure Active Directory Endpoints - https://login.microsoftonline.com/common/oauth2/authorize)
35+
36+```
37+ --provider=azure
38+ --client-id=<application ID from step 3>
39+ --client-secret=<value from step 5>
40+ --azure-tenant={tenant-id}
41+ --oidc-issuer-url=https://sts.windows.net/{tenant-id}/
42+```
43+
44+- for V2 Azure Auth endpoint (Microsoft Identity Platform Endpoints - https://login.microsoftonline.com/common/oauth2/v2.0/authorize)
45+```
46+ --provider=azure
47+ --client-id=<application ID from step 3>
48+ --client-secret=<value from step 5>
49+ --azure-tenant={tenant-id}
50+ --oidc-issuer-url=https://login.microsoftonline.com/{tenant-id}/v2.0
51+```
52+
53+***Notes***:
54+- When using v2.0 Azure Auth endpoint (`https://login.microsoftonline.com/{tenant-id}/v2.0`) as `--oidc_issuer_url`, in conjunction
55+ with `--resource` flag, be sure to append `/.default` at the end of the resource name. See
56+ https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#the-default-scope for more details.
57+- When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't
58+ get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the
59+ [redis session storage](../sessions.md#redis-storage) should resolve this.
docs/docs/configuration/providers/ms_entra_id.mdnew file+201
@@ -0,0 +1,201 @@
1+---
2+id: ms_entra_id
3+title: Microsoft Entra ID
4+---
5+
6+Provider for Microsoft Entra ID. Fully compliant with OIDC, with support for group overage and multi-tenant apps.
7+
8+## Config Options
9+
10+The provider is OIDC-compliant, so all the OIDC parameters are honored. Additional provider-specific configuration parameters are:
11+
12+| Flag | Toml Field | Type | Description | Default |
13+| --------------------------- | -------------------------- | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
14+| `--entra-id-allowed-tenant` | `entra_id_allowed_tenants` | string \| list | List of allowed tenants. In case of multi-tenant apps, incoming tokens are issued by different issuers and OIDC issuer verification needs to be disabled. When not specified, all tenants are allowed. Redundant for single-tenant apps (regular ID token validation matches the issuer). | |
15+| `--entra-id-federated-token-auth` | `entra_id_federated_token_auth` | boolean | Enable oAuth2 client authentication with federated token projected by Entra Workload Identity plugin, instead of client secret. | false |
16+
17+## Configure App registration
18+To begin, create an App registration, set a redirect URI, and generate a secret. All account types are supported, including single-tenant, multi-tenant, multi-tenant with Microsoft accounts, and Microsoft accounts only.
19+
20+<details>
21+ <summary>See Azure Portal example</summary>
22+ <div class="videoBlock">
23+ <iframe src="https://www.youtube.com/embed/IUNfxhOzr4E"></iframe>
24+ </div>
25+</details>
26+
27+<details>
28+ <summary>See Terraform example</summary>
29+```
30+ resource "azuread_application" "auth" {
31+ display_name = "oauth2-proxy"
32+ sign_in_audience = "AzureADMyOrg" # Others are also supported
33+
34+ web {
35+ redirect_uris = [
36+ "https://podinfo.lakis.tech/oauth2/callback",
37+ ]
38+ }
39+ // We don't specify any required API permissions - we allow user consent only
40+ }
41+
42+ resource "azuread_service_principal" "sp" {
43+ client_id = azuread_application.auth.client_id
44+ app_role_assignment_required = false
45+ }
46+
47+ resource "azuread_service_principal_password" "pass" {
48+ service_principal_id = azuread_service_principal.sp.id
49+ }
50+
51+```
52+</details>
53+
54+### Configure groups
55+If you want to make use of groups, you can configure *groups claim* to be present in ID Tokens issued by the App registration.
56+<details>
57+ <summary>See Azure Portal example</summary>
58+ <div class="videoBlock">
59+ <div class="videoBlock">
60+ <iframe src="https://www.youtube.com/embed/QZmP5MKEJis"></iframe>
61+ </div>
62+ </div>
63+</details>
64+<details>
65+ <summary>See Terraform example</summary>
66+```
67+ resource "azuread_application" "auth" {
68+ display_name = "oauth2-proxy"
69+ sign_in_audience = "AzureADMyOrg"
70+
71+ group_membership_claims = [
72+ "SecurityGroup"
73+ ]
74+
75+ web {
76+ redirect_uris = [
77+ "https://podinfo.lakis.tech/oauth2/callback",
78+ ]
79+ }
80+ }
81+
82+ resource "azuread_service_principal" "sp" {
83+ client_id = azuread_application.auth.client_id
84+ app_role_assignment_required = false
85+ }
86+
87+ resource "azuread_service_principal_password" "pass" {
88+ service_principal_id = azuread_service_principal.sp.id
89+ }
90+
91+```
92+</details>
93+
94+### Scopes and claims
95+For single-tenant and multi-tenant apps without groups, the only required scope is `openid` (See: [Scopes and permissions](https://learn.microsoft.com/en-us/entra/identity-platform/scopes-oidc#the-openid-scope)).
96+
97+To make use of groups - for example use `allowed_groups` setting or authorize based on groups inside your service - you need to enable *groups claims* in the App Registration. When enabled, list of groups is present in the issued ID token. No additional scopes are required besides `openid`. This works up to 200 groups.
98+
99+When user has more than 200 group memberships, OAuth2-Proxy attempts to retrieve the complete list from Microsoft Graph API's [`transitiveMemberOf`](https://learn.microsoft.com/en-us/graph/api/user-list-transitivememberof). Endpoint requires `User.Read` scope (delegated permission). This permission can be by default consented by user during first login. Set scope to `openid User.Read` to request user consent. Without proper scope, user with 200+ groups will authenticate with 0 groups. See: [group overages](https://learn.microsoft.com/en-us/security/zero-trust/develop/configure-tokens-group-claims-app-roles#group-overages).
100+
101+Alternatively to user consent, both `openid` and `User.Read` permissions can be consented by admistrator. Then, user is not asked for consent on the first login, and group overage works with `openid` scope only. Admin consent can also be required for some tenants. It can be granted with [azuread_service_principal_delegated_permission_grant](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/service_principal_delegated_permission_grant) terraform resource.
102+
103+For personal microsoft accounts, required scope is `openid profile email`.
104+
105+See: [Overview of permissions and consent in the Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/permissions-consent-overview).
106+
107+### Multi-tenant apps
108+To authenticate apps from multiple tenants (including personal Microsoft accounts), set the common OIDC issuer url and disable verification:
109+```toml
110+oidc_issuer_url=https://login.microsoftonline.com/common/v2.0
111+insecure_oidc_skip_issuer_verification=true
112+```
113+`insecure_oidc_skip_issuer_verification` setting is required to disable following checks:
114+* Startup check for matching issuer URL returned from [discovery document](https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration) with `oidc_issuer_url` setting. Required, as document's `issuer` field doesn't equal to `https://login.microsoftonline.com/common/v2.0`. See [OIDC Discovery 4.3](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationValidation).
115+* Matching ID token's `issuer` claim with `oidc_issuer_url` setting during ID token validation. Required to support tokens issued by different tenants. See [OIDC Core 3.1.3.7](https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation).
116+
117+To provide additional security, Entra ID provider performs check on the ID token's `issuer` claim to match the `https://login.microsoftonline.com/{tenant-id}/v2.0` template.
118+
119+### Workload Identity
120+Provider supports authentication with federated token, without need of using client secret. Following conditions have to be met:
121+
122+* Cluster has public OIDC provider URL. For major cloud providers, it can be enabled with a single flag, for example for [Azure Kubernetes Service deployed with Terraform](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster), it's `oidc_issuer_enabled`.
123+* Workload Identity admission webhook is deployed on the cluster. For AKS, it can be enabled with a flag (`workload_identity_enabled` in Terraform resource), for clusters outside of Azure, it can be installed from [helm chart](https://github.com/Azure/azure-workload-identity).
124+* Appropriate federated credential is added to application registration.
125+<details>
126+ <summary>See federated credential terraform example</summary>
127+```
128+ resource "azuread_application_federated_identity_credential" "fedcred" {
129+ application_id = azuread_application.application.id # ID of your application
130+ display_name = "federation-cred"
131+ description = "Workload identity for oauth2-proxy"
132+ audiences = ["api://AzureADTokenExchange"] # Fixed value
133+ issuer = "https://cluster-oidc-issuer-url..."
134+ subject = "system:serviceaccount:oauth2-proxy-namespace-name:oauth2-proxy-sa-name" # set proper NS and SA name
135+ }
136+```
137+</details>
138+
139+* Kubernetes service account associated with oauth2-proxy deployment, is annotated with `azure.workload.identity/client-id: <app-registration-client-id>`
140+* oauth2-proxy pod is labeled with `azure.workload.identity/use: "true"`
141+* oauth2-proxy is configured with `entra_id_federated_token_auth` set to `true`.
142+
143+`client_secret` setting can be omitted when using federated token authentication.
144+
145+See: [Azure Workload Identity documentation](https://azure.github.io/azure-workload-identity/docs/).
146+
147+### Example configurations
148+Single-tenant app without groups (*groups claim* not enabled). Consider using generic OIDC provider:
149+```toml
150+provider="entra-id"
151+oidc_issuer_url="https://login.microsoftonline.com/<tenant-id>/v2.0"
152+client_id="<client-id>"
153+client_secret="<client-secret>"
154+scope="openid"
155+```
156+
157+Single-tenant app with up to 200 groups (*groups claim* enabled). Consider using generic OIDC provider:
158+```toml
159+provider="entra-id"
160+oidc_issuer_url="https://login.microsoftonline.com/<tenant-id>/v2.0"
161+client_id="<client-id>"
162+client_secret="<client-secret>"
163+scope="openid"
164+allowed_groups=["ac51800c-2679-4ecb-8130-636380a3b491"]
165+```
166+
167+Single-tenant app with more than 200 groups:
168+```toml
169+provider="entra-id"
170+oidc_issuer_url="https://login.microsoftonline.com/<tenant-id>/v2.0"
171+client_id="<client-id>"
172+client_secret="<client-secret>"
173+scope="openid User.Read"
174+allowed_groups=["968b4844-d5e7-4e18-a834-59927959369f"]
175+```
176+
177+Single-tenant app with more than 200 groups and workload identity enabled:
178+```toml
179+provider="entra-id"
180+oidc_issuer_url="https://login.microsoftonline.com/<tenant-id>/v2.0"
181+client_id="<client-id>"
182+scope="openid User.Read"
183+allowed_groups=["968b4844-d5e7-4e18-a834-59927959369f"]
184+entra_id_federated_token_auth=true
185+```
186+
187+Multi-tenant app with Microsoft personal accounts & one Entra tenant allowed, with group overage considered:
188+```toml
189+provider="entra-id"
190+oidc_issuer_url="https://login.microsoftonline.com/common/v2.0"
191+client_id="<client-id>"
192+client_secret="<client-secret>"
193+insecure_oidc_skip_issuer_verification=true
194+scope="openid profile email User.Read"
195+entra_id_allowed_tenants=["9188040d-6c67-4c5b-b112-36a304b66dad","<my-tenant-id>"] # Allow only <my-tenant-id> and Personal MS Accounts tenant
196+email_domains="*"
197+```
198+
199+## Kubernetes Dashboard Integration
200+
201+For a complete guide on integrating oauth2-proxy with Kubernetes Dashboard on AKS using Azure Entra ID authentication, including detailed configuration examples, RBAC setup, troubleshooting, and Workload Identity setup, see the [Kubernetes Dashboard integration guide](../integrations/kubernetes-dashboard.md).
docs/docs/configuration/providers/nextcloud.mdnew file+28
@@ -0,0 +1,28 @@
1+---
2+id: nextcloud
3+title: NextCloud
4+---
5+
6+The Nextcloud provider allows you to authenticate against users in your
7+Nextcloud instance.
8+
9+When you are using the Nextcloud provider, you must specify the urls via
10+configuration, environment variable, or command line argument. Depending
11+on whether your Nextcloud instance is using pretty urls your urls may be of the
12+form `/index.php/apps/oauth2/*` or `/apps/oauth2/*`.
13+
14+Refer to the [OAuth2
15+documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html)
16+to set up the client id and client secret. Your "Redirection URI" will be
17+`https://internalapp.yourcompany.com/oauth2/callback`.
18+
19+```
20+ -provider nextcloud
21+ -client-id <from nextcloud admin>
22+ -client-secret <from nextcloud admin>
23+ -login-url="<your nextcloud url>/index.php/apps/oauth2/authorize"
24+ -redeem-url="<your nextcloud url>/index.php/apps/oauth2/api/v1/token"
25+ -validate-url="<your nextcloud url>/ocs/v2.php/cloud/user?format=json"
26+```
27+
28+Note: in *all* cases the validate-url will *not* have the `index.php`.
docs/docs/configuration/providers/openid_connect.mdnew file+146
@@ -0,0 +1,146 @@
1+---
2+id: openid_connect
3+title: OpenID Connect
4+---
5+
6+OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects.
7+
8+This provider was originally built against CoreOS Dex, and we will use it as an example.
9+The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below.
10+
11+#### Dex
12+
13+To configure the OIDC provider for Dex, perform the following steps:
14+
15+1. Download Dex:
16+
17+ ```
18+ go get github.com/dexidp/dex
19+ ```
20+
21+ See the [getting started guide](https://dexidp.io/docs/getting-started/) for more details.
22+
23+2. Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to
24+ the `staticClients` section of `examples/config-dev.yaml`:
25+
26+ ```
27+ - id: oauth2-proxy
28+ redirectURIs:
29+ - 'http://127.0.0.1:4180/oauth2/callback'
30+ name: 'oauth2-proxy'
31+ secret: proxy
32+ ```
33+
34+3. Launch Dex: from `$GOPATH/github.com/dexidp/dex`, run:
35+
36+ ```
37+ bin/dex serve examples/config-dev.yaml
38+ ```
39+
40+4. In a second terminal, run the oauth2-proxy with the following args:
41+
42+ ```shell
43+ --provider oidc
44+ --provider-display-name "My OIDC Provider"
45+ --client-id oauth2-proxy
46+ --client-secret proxy
47+ --redirect-url http://127.0.0.1:4180/oauth2/callback
48+ --oidc-issuer-url http://127.0.0.1:5556/dex
49+ --cookie-secure=false
50+ --cookie-secret=secret
51+ --email-domain kilgore.trout
52+ ```
53+
54+ To serve the current working directory as a website under the `/static` endpoint, add:
55+
56+ ```shell
57+ --upstream file://$PWD/#/static/
58+ ```
59+
60+5. Test the setup by visiting http://127.0.0.1:4180 or http://127.0.0.1:4180/static .
61+
62+See also [our local testing environment](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment) for a self-contained example using Docker and etcd as storage for Dex.
63+
64+#### Okta
65+
66+To configure the OIDC provider for Okta, perform the following steps:
67+
68+1. Log in to Okta using an administrative account. It is suggested you try this in preview first, `example.oktapreview.com`
69+2. (OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,
70+ you may wish to configure an authorization server for each application. Otherwise, the provided `default` will work.
71+ * Navigate to **Security** then select **API**
72+ * Click **Add Authorization Server**, if this option is not available you may require an additional license for a custom
73+ authorization server.
74+ * Fill out the **Name** with something to describe the application you are protecting. e.g. 'Example App'.
75+ * For **Audience**, pick the URL of the application you wish to protect: https://example.corp.com
76+ * Fill out a **Description**
77+ * Add any **Access Policies** you wish to configure to limit application access.
78+ * The default settings will work for other options.
79+ [See Okta documentation for more information on Authorization Servers](https://developer.okta.com/docs/guides/customize-authz-server/overview/)
80+3. Navigate to **Applications** then select **Add Application**.
81+ * Select **Web** for the **Platform** setting.
82+ * Select **OpenID Connect** and click **Create**
83+ * Pick an **Application Name** such as `Example App`.
84+ * Set the **Login redirect URI** to `https://example.corp.com`.
85+ * Under **General** set the **Allowed grant types** to `Authorization Code` and `Refresh Token`.
86+ * Leave the rest as default, taking note of the `Client ID` and `Client Secret`.
87+ * Under **Assignments** select the users or groups you wish to access your application.
88+4. Create a configuration file like the following:
89+
90+ ```
91+ provider = "oidc"
92+ redirect_url = "https://example.corp.com/oauth2/callback"
93+ oidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"
94+ upstreams = [
95+ "https://example.corp.com"
96+ ]
97+ email_domains = [
98+ "corp.com"
99+ ]
100+ client_id = "XXXXX"
101+ client_secret = "YYYYY"
102+ pass_access_token = true
103+ cookie_secret = "ZZZZZ"
104+ skip_provider_button = true
105+ ```
106+
107+The `oidc_issuer_url` is based on URL from your **Authorization Server**'s **Issuer** field in step 2, or simply
108+https://corp.okta.com. The `client_id` and `client_secret` are configured in the application settings.
109+Generate a unique `cookie_secret` to encrypt the cookie.
110+
111+Then you can start the oauth2-proxy with `./oauth2-proxy --config /etc/example.cfg`
112+
113+#### Okta - localhost
114+
115+1. Signup for developer account: https://developer.okta.com/signup/
116+2. Create New `Web` Application: https://$\{your-okta-domain\}/dev/console/apps/new
117+3. Example Application Settings for localhost:
118+ * **Name:** My Web App
119+ * **Base URIs:** http://localhost:4180/
120+ * **Login redirect URIs:** http://localhost:4180/oauth2/callback
121+ * **Logout redirect URIs:** http://localhost:4180/
122+ * **Group assignments:** `Everyone`
123+ * **Grant type allowed:** `Authorization Code` and `Refresh Token`
124+4. Make note of the `Client ID` and `Client secret`, they are needed in a future step
125+5. Make note of the **default** Authorization Server Issuer URI from: https://$\{your-okta-domain\}/admin/oauth2/as
126+6. Example config file `/etc/localhost.cfg`
127+ ```shell
128+ provider = "oidc"
129+ redirect_url = "http://localhost:4180/oauth2/callback"
130+ oidc_issuer_url = "https://$\{your-okta-domain\}/oauth2/default"
131+ upstreams = [
132+ "http://0.0.0.0:8080"
133+ ]
134+ email_domains = [
135+ "*"
136+ ]
137+ client_id = "XXX"
138+ client_secret = "YYY"
139+ pass_access_token = true
140+ cookie_secret = "ZZZ"
141+ cookie_secure = false
142+ skip_provider_button = true
143+ # Note: use the following for testing within a container
144+ # http_address = "0.0.0.0:4180"
145+ ```
146+7. Then you can start the oauth2-proxy with `./oauth2-proxy --config /etc/localhost.cfg`
docs/docs/configuration/providers/sourcehut.mdnew file+25
@@ -0,0 +1,25 @@
1+---
2+id: sourcehut
3+title: SourceHut
4+---
5+
6+1. Create a new OAuth client: https://meta.sr.ht/oauth2
7+2. Under `Redirection URI` enter the correct URL, i.e.
8+ `https://internal.yourcompany.com/oauth2/callback`
9+
10+To use the provider, start with `--provider=sourcehut`.
11+
12+If you are hosting your own SourceHut instance, make sure you set the following
13+to the appropriate URLs:
14+
15+```shell
16+ --login-url="https://<meta.your.instance>/oauth2/authorize"
17+ --redeem-url="https://<meta.your.instance>/oauth2/access-token"
18+ --profile-url="https://<meta.your.instance>/query"
19+ --validate-url="https://<meta.your.instance>/profile"
20+```
21+
22+The default configuration allows everyone with an account to authenticate.
23+Restricting access is currently only supported by
24+[email](index.md#email-authentication).
25+
docs/docs/configuration/sessions.mdnew file+99
@@ -0,0 +1,99 @@
1+---
2+id: session_storage
3+title: Session Storage
4+---
5+
6+Sessions allow a user's authentication to be tracked between multiple HTTP
7+requests to a service.
8+
9+The OAuth2 Proxy uses a Cookie to track user sessions and will store the session
10+data in one of the available session storage backends.
11+
12+At present the available backends are (as passed to `--session-store-type`):
13+- [cookie](#cookie-storage) (default)
14+- [redis](#redis-storage)
15+
16+### Cookie Storage
17+
18+The Cookie storage backend is the default backend implementation and has
19+been used in the OAuth2 Proxy historically.
20+
21+With the Cookie storage backend, all session information is stored in client
22+side cookies and transferred with each and every request.
23+
24+The following should be known when using this implementation:
25+- Since all state is stored client side, this storage backend means that the OAuth2 Proxy is completely stateless
26+- Cookies are signed server side to prevent modification client-side
27+- It is mandatory to set a `cookie-secret` which will ensure data is encrypted within the cookie data.
28+- Since multiple requests can be made concurrently to the OAuth2 Proxy, this session implementation
29+cannot lock sessions and while updating and refreshing sessions, there can be conflicts which force
30+users to re-authenticate
31+
32+
33+### Redis Storage
34+
35+The Redis Storage backend stores encrypted sessions in redis. Instead of sending all the information
36+back the client for storage, as in the [Cookie storage](#cookie-storage), a ticket is sent back
37+to the user as the cookie value instead.
38+
39+A ticket is composed as the following:
40+
41+`{CookieName}-{ticketID}.{secret}`
42+
43+Where:
44+
45+- The `CookieName` is the OAuth2 cookie name (_oauth2_proxy by default)
46+- The `ticketID` is a 128-bit random number, hex-encoded
47+- The `secret` is a 128-bit random number, base64url encoded (no padding). The secret is unique for every session.
48+- The pair of `{CookieName}-{ticketID}` comprises a ticket handle, and thus, the redis key
49+to which the session is stored. The encoded session is encrypted with the secret and stored
50+in redis via the `SETEX` command.
51+
52+Encrypting every session uniquely protects the refresh/access/id tokens stored in the session from
53+disclosure. Additionally, the browser only has to send a short Cookie with every request and not the whole JWT,
54+which can get quite big.
55+
56+Two settings are used to configure the OAuth2 Proxy cookie lifetime:
57+
58+ --cookie-refresh duration refresh the cookie after this duration; 0 to disable
59+ --cookie-expire duration expire timeframe for cookie 168h0m0s
60+
61+The "cookie-expire" value should be equal to the lifetime of the Refresh-Token that is issued by the OAuth2 authorization server.
62+If it expires earlier and is deleted by the browser, OAuth2 Proxy cannot find the stored Refresh-Tokens in Redis and thus cannot start
63+the refresh flow to get a new Access-Token. If it is longer, it might be that the old Refresh-Token will be found in Redis but has already
64+expired.
65+
66+The "cookie-refresh" value controls when OAuth2 Proxy tries to refresh an Access-Token. If it is set to "0", the
67+Access-Token will never be refreshed, even if it is already expired and a valid Refresh-Token is available. If set, OAuth2 Proxy will
68+refresh the Access-Token after this many seconds whether it is still valid or not. According to the official OAuth2.0 specification
69+Access-Tokens are not required to follow a specific format. Therefore OAuth2 Proxy cannot check for any expiry date without an
70+introspection endpoint. If an Access-Token expires and you have not set a corresponding "cookie-refresh" value, you will likely
71+encounter expiry issues.
72+
73+Caveat: It can happen that the Access-Token is valid for e.g. "1m" and a request happens after exactly "59s".
74+It would pass OAuth2 Proxy and be forwarded to the backend but is just expired when the backend tries to validate
75+it. This is especially relevant if the backend uses the JWT to make requests to other backends.
76+For this reason, it's advised to set the cookie-refresh a couple of seconds less than the Access-Token lifespan.
77+
78+Recommended settings:
79+
80+* cookie_refresh := Access-Token lifespan - 1m
81+* cookie_expire := Refresh-Token lifespan (i.e. Keycloak client_session_idle)
82+
83+#### Usage
84+
85+When using the redis store, specify `--session-store-type=redis` as well as the Redis connection URL, via
86+`--redis-connection-url=redis://host[:port][/db-number]`.
87+
88+You may also configure the store for Redis Sentinel. In this case, you will want to use the
89+`--redis-use-sentinel=true` flag, as well as configure the flags `--redis-sentinel-master-name`
90+and `--redis-sentinel-connection-urls` appropriately.
91+
92+Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the
93+`--redis-use-cluster=true` flag, and configure the flags `--redis-cluster-connection-urls` appropriately.
94+
95+Note that flags `--redis-use-sentinel=true` and `--redis-use-cluster=true` are mutually exclusive.
96+
97+Note, if Redis timeout option is set to non-zero, the `--redis-connection-idle-timeout`
98+must be less than [Redis timeout option](https://redis.io/docs/reference/clients/#client-timeouts). For example: if either redis.conf includes
99+`timeout 15` or using `CONFIG SET timeout 15` the `--redis-connection-idle-timeout` must be at least `--redis-connection-idle-timeout=14`
docs/docs/configuration/systemd_socket.mdnew file+51
@@ -0,0 +1,51 @@
1+---
2+id: systemd_socket
3+title: Systemd Socket Activation
4+---
5+
6+Pass an existing listener created by systemd.socket to oauth2-proxy.
7+
8+To do this create a socket:
9+
10+oauth2-proxy.socket
11+```
12+[Socket]
13+ListenStream=%t/oauth2.sock
14+SocketGroup=www-data
15+SocketMode=0660
16+```
17+
18+Now it's possible to call this socket from e.g. nginx:
19+```
20+server {
21+ location /oauth2/ {
22+ proxy_pass http://unix:/run/oauth2-proxy/oauth2.sock;
23+}
24+```
25+
26+The oauth2-proxy should have `--http-address=fd:3` as a parameter.
27+Here fd is case insensitive and means file descriptor. The number 3 refers to the first non-stdin/stdout/stderr file descriptor,
28+systemd-socket-activate (which is what systemd.socket uses), listens to what it is told and passes
29+the listener it created onto the process, starting with file descriptor 3.
30+
31+```
32+./oauth2-proxy \
33+ --http-address="fd:3" \
34+ --email-domain="yourcompany.com" \
35+ --upstream=http://127.0.0.1:8080/ \
36+ --cookie-secret=... \
37+ --cookie-secure=true \
38+ --provider=... \
39+ --client-id=... \
40+ --client-secret=...
41+```
42+
43+## Trusted IPs
44+
45+When listening on a Unix socket, Go sets `http.Request.RemoteAddr` to `"@"` instead of the usual `"host:port"` format. This means there is no client IP available from the connection itself.
46+
47+As a result, `--trusted-ip` entries cannot match against the direct connection address for Unix socket listeners. Requests arriving over a Unix socket will never be considered "trusted" based on their `RemoteAddr`. IP-based trust decisions will still work if a trusted reverse proxy sets `X-Forwarded-For` or `X-Real-IP` headers and `--reverse-proxy=true` is configured.
48+
49+## TLS
50+
51+Currently TLS is not supported (but it's doable).
docs/docs/configuration/tls.mdnew file+85
@@ -0,0 +1,85 @@
1+---
2+id: tls
3+title: TLS Configuration
4+---
5+
6+There are two recommended configurations:
7+- [At OAuth2 Proxy](#terminate-tls-at-oauth2-proxy)
8+- [At Reverse Proxy](#terminate-tls-at-reverse-proxy-eg-nginx)
9+
10+### Terminate TLS at OAuth2 Proxy
11+
12+1. Configure SSL Termination with OAuth2 Proxy by providing a `--tls-cert-file=/path/to/cert.pem` and `--tls-key-file=/path/to/cert.key`.
13+
14+ The command line to run `oauth2-proxy` in this configuration would look like this:
15+
16+ ```bash
17+ ./oauth2-proxy \
18+ --email-domain="yourcompany.com" \
19+ --upstream=http://127.0.0.1:8080/ \
20+ --tls-cert-file=/path/to/cert.pem \
21+ --tls-key-file=/path/to/cert.key \
22+ --cookie-secret=... \
23+ --cookie-secure=true \
24+ --provider=... \
25+ --client-id=... \
26+ --client-secret=...
27+ ```
28+
29+2. With this configuration approach the customization of the TLS settings is limited.
30+
31+ The minimal acceptable TLS version can be set with `--tls-min-version=TLS1.3`.
32+ The defaults set `TLS1.2` as the minimal version.
33+ Regardless of the minimum version configured, `TLS1.3` is currently always used as the maximal version.
34+
35+ TLS server side cipher suites can be specified with `--tls-cipher-suite=TLS_RSA_WITH_RC4_128_SHA`.
36+ If not specified, the defaults from [`crypto/tls`](https://pkg.go.dev/crypto/tls#CipherSuites) of the currently used `go` version for building `oauth2-proxy` will be used.
37+ A complete list of valid TLS cipher suite names can be found in [`crypto/tls`](https://pkg.go.dev/crypto/tls#pkg-constants).
38+
39+### Terminate TLS at Reverse Proxy, e.g. Nginx
40+
41+1. Configure SSL Termination with [Nginx](http://nginx.org/) (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ...
42+
43+ Because `oauth2-proxy` listens on `127.0.0.1:4180` by default, to listen on all interfaces (needed when using an
44+ external load balancer like Amazon ELB or Google Platform Load Balancing) use `--http-address="0.0.0.0:4180"` or
45+ `--http-address="http://:4180"`.
46+
47+ Nginx will listen on port `443` and handle SSL connections while proxying to `oauth2-proxy` on port `4180`.
48+ `oauth2-proxy` will then authenticate requests for an upstream application. The external endpoint for this example
49+ would be `https://internal.yourcompany.com/`.
50+
51+ An example Nginx config follows. Note the use of `Strict-Transport-Security` header to pin requests to SSL
52+ via [HSTS](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security):
53+
54+ ```
55+ server {
56+ listen 443 default ssl;
57+ server_name internal.yourcompany.com;
58+ ssl_certificate /path/to/cert.pem;
59+ ssl_certificate_key /path/to/cert.key;
60+ add_header Strict-Transport-Security max-age=2592000;
61+
62+ location / {
63+ proxy_pass http://127.0.0.1:4180;
64+ proxy_set_header Host $host;
65+ proxy_set_header X-Real-IP $remote_addr;
66+ proxy_connect_timeout 1;
67+ proxy_send_timeout 30;
68+ proxy_read_timeout 30;
69+ }
70+ }
71+ ```
72+
73+2. The command line to run `oauth2-proxy` in this configuration would look like this:
74+
75+ ```bash
76+ ./oauth2-proxy \
77+ --email-domain="yourcompany.com" \
78+ --upstream=http://127.0.0.1:8080/ \
79+ --cookie-secret=... \
80+ --cookie-secure=true \
81+ --provider=... \
82+ --reverse-proxy=true \
83+ --client-id=... \
84+ --client-secret=...
85+ ```
docs/docs/features/endpoints.mdnew file+73
@@ -0,0 +1,73 @@
1+---
2+id: endpoints
3+title: Endpoints
4+---
5+
6+OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The `/oauth2` prefix can be changed with the `--proxy-prefix` config variable.
7+
8+- / - the proxy endpoint provides authentication and returns the appropriate 40x error if not authenticated or authorized then passes the request upstream.
9+- /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see [robotstxt.org](http://www.robotstxt.org/) for more info
10+- /ping - returns a 200 OK response, which is intended for use with health checks
11+- /ready - returns a 200 OK response if all the underlying connections (e.g., Redis store) are connected
12+- /metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by `--metrics-address`, disabled by default
13+- /oauth2/sign_in - the login page, which also doubles as a sign-out page (it clears cookies)
14+- /oauth2/sign_out - this URL is used to clear the session cookie
15+- /oauth2/start - a URL that will redirect to start the OAuth cycle
16+- /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
17+- /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
18+- /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the [Nginx `auth_request` directive](../configuration/integrations/nginx)
19+- /oauth2/static/\* - stylesheets and other dependencies used in the sign_in and error pages
20+
21+### Sign out
22+
23+To sign the user out, redirect them to `/oauth2/sign_out`. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign-out page afterward using the `rd` query parameter, i.e. redirect the user to something like (notice the url-encoding!):
24+
25+```
26+/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page
27+```
28+
29+Alternatively, include the redirect URL in the `X-Auth-Request-Redirect` header:
30+
31+```
32+GET /oauth2/sign_out HTTP/1.1
33+X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
34+...
35+```
36+
37+(The "sign_out_page" should be the [`end_session_endpoint`](https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1) from [the metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig) if your OIDC provider supports Session Management and Discovery.)
38+
39+BEWARE that the domain you want to redirect to (`my-oidc-provider.example.com` in the example) must be added to the [`--whitelist-domain`](../configuration/overview) configuration option otherwise the redirect will be ignored. Make sure to include the actual domain and port (if needed) and not the URL (e.g "localhost:8081" instead of "http://localhost:8081").
40+
41+ID Token can be injected in the redirect url by using `{id_token}` placeholder. For example to redirect to `https://my-oidc-provider.example.com/sign_out_page?id_token_hint={id_token}&post_logout_redirect_uri=https://my-app.example.com`;
42+
43+```
44+/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page%3Fid_token_hint%3D%7Bid_token%7D%26post_logout_redirect_uri%3Dhttps%3A%2F%2Fmy-app.example.com
45+```
46+
47+or alternatively in the header:
48+
49+```
50+GET /oauth2/sign_out HTTP/1.1
51+X-Auth-Request-Redirect: https://my-oidc-provider.example.com/sign_out_page?id_token_hint={id_token}&post_logout_redirect_uri=https://my-app.example.com
52+...
53+```
54+
55+### Auth
56+
57+This endpoint returns 202 Accepted response or a 401 Unauthorized response.
58+
59+It can be configured using the following query parameters:
60+- `allowed_groups`: comma separated list of allowed groups
61+- `allowed_email_domains`: comma separated list of allowed email domains
62+- `allowed_emails`: comma separated list of allowed emails
63+
64+### Proxy (/)
65+
66+This endpoint returns the upstream response if authenticated.
67+If unauthenticated it returns a 401 Unauthorized. If the authenticatd user
68+is not in one of the allowed groups, or emails then it returns a 403 forbidden
69+
70+It can be configured using the following query parameters:
71+- `allowed_groups`: comma separated list of allowed groups
72+- `allowed_email_domains`: comma separated list of allowed email domains
73+- `allowed_emails`: comma separated list of allowed emails
docs/docs/installation.mdnew file+32
@@ -0,0 +1,32 @@
1+---
2+id: installation
3+title: Installation
4+---
5+
6+1. Choose how to deploy:
7+
8+ a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.15.4`)
9+
10+ b. Using Go to install the latest release
11+ ```bash
12+ $ go install github.com/oauth2-proxy/oauth2-proxy/v7@latest
13+ ```
14+ This will install the binary into `$GOPATH/bin`. Make sure you include `$GOPATH` in your `$PATH`. Otherwise your system won't find binaries installed via `go install`
15+
16+ c. Using a [Prebuilt Docker Image](https://quay.io/oauth2-proxy/oauth2-proxy) (AMD64, PPC64LE, S390x, ARMv6, ARMv7, and ARM64 available)
17+
18+ d. Using a [Pre-Release Nightly Docker Image](https://quay.io/oauth2-proxy/oauth2-proxy-nightly) (AMD64, PPC64LE, ARMv6, ARMv7, and ARM64 available)
19+
20+ e. Using the official [Kubernetes manifest](https://github.com/oauth2-proxy/manifests) (Helm)
21+
22+ Prebuilt binaries can be validated by extracting the file and verifying it against the `sha256sum.txt` checksum file provided for each release starting with version `v3.0.0`.
23+
24+ ```
25+ $ sha256sum -c sha256sum.txt
26+ oauth2-proxy-x.y.z.linux-amd64: OK
27+ ```
28+
29+2. [Select a Provider and Register an OAuth Application with a Provider](configuration/providers/index.md)
30+3. [Configure OAuth2 Proxy using config file, command line options, or environment variables](configuration/overview.md)
31+4. [Configure SSL or Deploy behind an SSL endpoint](configuration/tls.md) (example provided for Nginx)
32+5. [Configure OAuth2 Proxy using systemd.socket](configuration/systemd_socket.md) (example provided for Nginx/Systemd)
docs/docs/welcome.mdnew file+33
@@ -0,0 +1,33 @@
1+---
2+id: welcome
3+title: Welcome
4+hide_table_of_contents: true
5+slug: /
6+---
7+
8+![OAuth2 Proxy](/img/logos/OAuth2_Proxy_horizontal.svg)
9+
10+A reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others)
11+to validate accounts by email, domain or group.
12+
13+:::note
14+This repository was forked from [bitly/OAuth2_Proxy](https://github.com/bitly/oauth2_proxy) on 27/11/2018.
15+Versions v3.0.0 and up are from this fork and will have diverged from any changes in the original fork.
16+A list of changes can be seen in the [CHANGELOG](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/CHANGELOG.md).
17+:::
18+
19+![Sign In Page](/img/sign-in-page.png)
20+
21+## Architecture
22+
23+![OAuth2 Proxy Architecture](/img/simplified-architecture.svg)
24+
25+
26+## Cloud Native Computing Foundation
27+
28+OAuth2 Proxy is a [Cloud Native Computing Foundation](https://cncf.io) Sandbox project.
29+
30+![CNCF](https://www.cncf.io/wp-content/uploads/2023/04/cncf-main-site-logo.svg)
31+
32+The Linux Foundation® (TLF) has registered trademarks and uses trademarks. For a list of TLF trademarks, see [Trademark Usage](https://www.linuxfoundation.org/legal/trademark-usage).
33+
docs/docusaurus.config.jsnew file+131
@@ -0,0 +1,131 @@
1+// @ts-check
2+// `@type` JSDoc annotations allow editor autocompletion and type checking
3+// (when paired with `@ts-check`).
4+// There are various equivalent ways to declare your Docusaurus config.
5+// See: https://docusaurus.io/docs/api/docusaurus-config
6+
7+import { themes as prismThemes } from 'prism-react-renderer';
8+
9+/** @type {import('@docusaurus/types').Config} */
10+const config = {
11+ title: 'OAuth2 Proxy',
12+ tagline: 'A lightweight authentication proxy written in Go',
13+ favicon: 'img/logos/OAuth2_Proxy_icon.svg',
14+
15+ // Set the production url of your site here
16+ url: 'https://oauth2-proxy.github.io',
17+ // Set the /<baseUrl>/ pathname under which your site is served
18+ // For GitHub pages deployment, it is often '/<projectName>/'
19+ baseUrl: '/oauth2-proxy/',
20+
21+ // GitHub pages deployment config.
22+ // If you aren't using GitHub pages, you don't need these.
23+ organizationName: 'oauth2-proxy', // Usually your GitHub org/user name.
24+ projectName: 'oauth2-proxy', // Usually your repo name.
25+
26+ onBrokenLinks: 'throw',
27+ onBrokenMarkdownLinks: 'warn',
28+
29+ // Even if you don't use internationalization, you can use this field to set
30+ // useful metadata like html lang. For example, if your site is Chinese, you
31+ // may want to replace "en" with "zh-Hans".
32+ i18n: {
33+ defaultLocale: 'en',
34+ locales: ['en'],
35+ },
36+
37+ presets: [
38+ [
39+ 'classic',
40+ /** @type {import('@docusaurus/preset-classic').Options} */
41+ ({
42+ docs: {
43+ sidebarPath: require.resolve('./sidebars.js'),
44+ routeBasePath: '/',
45+ // Please change this to your repo.
46+ // Remove this to remove the "edit this page" links.
47+ editUrl:
48+ 'https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/',
49+ },
50+ blog: false,
51+ theme: {
52+ customCss: './src/css/custom.css',
53+ },
54+ }),
55+ ],
56+ ],
57+
58+ themes: [
59+ '@docusaurus/theme-mermaid',
60+ [
61+ require.resolve("@easyops-cn/docusaurus-search-local"),
62+ /** @type {import("@easyops-cn/docusaurus-search-local").PluginOptions} */
63+ ({
64+ hashed: true,
65+ docsDir: "docs", // only index the latest docs
66+ language: ["en"],
67+ indexDocs: true,
68+ indexBlog: false,
69+ indexPages: false,
70+ docsRouteBasePath: "/", // fix the default /docs path
71+ searchResultLimits: 10,
72+ searchBarShortcut: true,
73+ removeDefaultStemmer: true, // allow for partial word matching
74+ searchBarShortcutHint: true,
75+ highlightSearchTermsOnTargetPage: true,
76+ }),
77+ ]
78+ ],
79+
80+ markdown: {
81+ mermaid: true,
82+ },
83+
84+ themeConfig:
85+ /** @type {import('@docusaurus/preset-classic').ThemeConfig} */
86+ ({
87+ // Replace with your project's social card
88+ image: 'img/logos/OAuth2_Proxy_horizontal.png',
89+ navbar: {
90+ title: 'OAuth2 Proxy',
91+ logo: {
92+ alt: 'OAuth2 Proxy',
93+ src: 'img/logos/OAuth2_Proxy_icon.svg',
94+ },
95+ items: [
96+ {
97+ type: 'docSidebar',
98+ sidebarId: 'docs',
99+ position: 'left',
100+ label: 'Docs',
101+ },
102+ {
103+ type: 'docsVersionDropdown',
104+ position: 'right',
105+ dropdownActiveClassDisabled: true,
106+ },
107+ {
108+ href: 'https://cloud-native.slack.com/archives/C098Y5URZ2N',
109+ label: 'Slack',
110+ position: 'right',
111+ },
112+ {
113+ href: 'https://github.com/oauth2-proxy/oauth2-proxy',
114+ label: 'GitHub',
115+ position: 'right',
116+ },
117+ ],
118+ },
119+ footer: {
120+ style: 'dark',
121+ copyright: `Copyright © ${new Date().getFullYear()} OAuth2 Proxy a Series of LF Projects, LLC.<br>For website terms of use, trademark policy and other project policies please see lfprojects.org/policies/`,
122+ },
123+ prism: {
124+ theme: prismThemes.github,
125+ darkTheme: prismThemes.dracula,
126+ additionalLanguages: ['hcl', 'nginx', 'powershell'],
127+ },
128+ }),
129+};
130+
131+export default config;
docs/package.jsonnew file+49
@@ -0,0 +1,49 @@
1+{
2+ "name": "oauth2-proxy",
3+ "version": "0.0.0",
4+ "private": true,
5+ "scripts": {
6+ "docusaurus": "docusaurus",
7+ "start": "docusaurus start",
8+ "build": "docusaurus build",
9+ "swizzle": "docusaurus swizzle",
10+ "deploy": "docusaurus deploy",
11+ "clear": "docusaurus clear",
12+ "serve": "docusaurus serve",
13+ "write-translations": "docusaurus write-translations",
14+ "write-heading-ids": "docusaurus write-heading-ids"
15+ },
16+ "dependencies": {
17+ "@docusaurus/core": "^3.3.2",
18+ "@docusaurus/preset-classic": "^3.3.2",
19+ "@docusaurus/theme-mermaid": "^3.3.2",
20+ "@easyops-cn/docusaurus-search-local": "^0.55.0",
21+ "@mdx-js/react": "^3.0.0",
22+ "clsx": "^2.0.0",
23+ "prism-react-renderer": "^2.3.0",
24+ "react": "^18.0.0",
25+ "react-dom": "^18.0.0"
26+ },
27+ "devDependencies": {
28+ "@docusaurus/module-type-aliases": "^3.3.2",
29+ "@docusaurus/types": "^3.3.2"
30+ },
31+ "browserslist": {
32+ "production": [
33+ ">0.5%",
34+ "not dead",
35+ "not op_mini all"
36+ ],
37+ "development": [
38+ "last 3 chrome version",
39+ "last 3 firefox version",
40+ "last 5 safari version"
41+ ]
42+ },
43+ "engines": {
44+ "node": ">=18.0"
45+ },
46+ "overrides" : {
47+ "webpackbar" : "^7.0.0"
48+ }
49+}
docs/sidebars.jsnew file+99
@@ -0,0 +1,99 @@
1+const sidebars = {
2+ docs: [
3+ {
4+ type: 'doc',
5+ id: 'welcome',
6+ },
7+ {
8+ type: 'doc',
9+ id: 'installation',
10+ },
11+ {
12+ type: 'doc',
13+ id: 'behaviour',
14+ },
15+ {
16+ type: 'category',
17+ label: 'Configuration',
18+ link: {
19+ type: 'doc',
20+ id: 'configuration/overview',
21+ },
22+ collapsed: false,
23+ items: [
24+ 'configuration/overview',
25+ {
26+ type: 'category',
27+ label: 'Integration Guides',
28+ link: {
29+ type: 'doc',
30+ id: 'configuration/integrations/index',
31+ },
32+ items: [
33+ "configuration/integrations/nginx",
34+ "configuration/integrations/traefik",
35+ "configuration/integrations/caddy",
36+ "configuration/integrations/headlamp",
37+ "configuration/integrations/kubernetes-dashboard"
38+ ],
39+ },
40+ {
41+ type: 'category',
42+ label: 'OAuth Provider Configuration',
43+ link: {
44+ type: 'doc',
45+ id: 'configuration/providers/index',
46+ },
47+ items: [
48+ "configuration/providers/adfs",
49+ "configuration/providers/atlassian",
50+ "configuration/providers/azure",
51+ "configuration/providers/bitbucket",
52+ "configuration/providers/cidaas",
53+ "configuration/providers/cisco_duo",
54+ "configuration/providers/digitalocean",
55+ "configuration/providers/dtt_sso",
56+ "configuration/providers/facebook",
57+ "configuration/providers/gitea",
58+ "configuration/providers/github",
59+ "configuration/providers/gitlab",
60+ "configuration/providers/google",
61+ "configuration/providers/keycloak",
62+ "configuration/providers/keycloak_oidc",
63+ "configuration/providers/linkedin",
64+ "configuration/providers/login_gov",
65+ "configuration/providers/ms_entra_id",
66+ "configuration/providers/nextcloud",
67+ "configuration/providers/openid_connect",
68+ "configuration/providers/sourcehut"
69+ ],
70+ },
71+ 'configuration/session_storage',
72+ 'configuration/tls',
73+ 'configuration/alpha-config',
74+ ],
75+ },
76+ {
77+ type: 'category',
78+ label: 'Features',
79+ link: {
80+ type: 'doc',
81+ id: 'features/endpoints',
82+ },
83+ collapsed: false,
84+ items: ['features/endpoints'],
85+ },
86+ {
87+ type: 'category',
88+ label: 'Community',
89+ link: {
90+ type: 'doc',
91+ id: 'community/security',
92+ },
93+ collapsed: false,
94+ items: ['community/contribution', 'community/security'],
95+ },
96+ ],
97+};
98+
99+export default sidebars;
docs/src/css/custom.cssnew file+39
@@ -0,0 +1,39 @@
1+/* stylelint-disable docusaurus/copyright-header */
2+/**
3+ * Any CSS included here will be global. The classic template
4+ * bundles Infima by default. Infima is a CSS framework designed to
5+ * work well for content-centric websites.
6+ */
7+
8+/* You can override the default Infima variables here. */
9+:root {
10+ --ifm-color-primary: #25c2a0;
11+ --ifm-color-primary-dark: rgb(33, 175, 144);
12+ --ifm-color-primary-darker: rgb(31, 165, 136);
13+ --ifm-color-primary-darkest: rgb(26, 136, 112);
14+ --ifm-color-primary-light: rgb(70, 203, 174);
15+ --ifm-color-primary-lighter: rgb(102, 212, 189);
16+ --ifm-color-primary-lightest: rgb(146, 224, 208);
17+ --ifm-code-font-size: 95%;
18+}
19+
20+.docusaurus-highlight-code-line {
21+ background-color: rgb(72, 77, 91);
22+ display: block;
23+ margin: 0 calc(-1 * var(--ifm-pre-padding));
24+ padding: 0 var(--ifm-pre-padding);
25+}
26+
27+.videoBlock {
28+ position: relative;
29+ padding-bottom: 75%;
30+ height: 0;
31+}
32+
33+.videoBlock iframe {
34+ position: absolute;
35+ top: 0;
36+ left: 0;
37+ width: 100%;
38+ height: 100%;
39+}
docs/static/.nojekyllnew file

No changes to the content.

docs/static/img/debug-tab.pngnew file

Binary file not shown.

docs/static/img/logos/OAuth2_Proxy_horizontal.pngnew file

Binary file not shown.

docs/static/img/logos/OAuth2_Proxy_horizontal.svgnew file+1
@@ -0,0 +1 @@
1+<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 840.55645 412.45904"><defs><style>.cls-1{fill:#333;}.cls-2{fill:#7c7c82;}.cls-3{fill:#06ed94;}.cls-4{fill:#059b61;}.cls-5{fill:#1957ba;}.cls-6{fill:#6ca8ff;}</style></defs><title>OAuth2_Proxy_logo_v3</title><path class="cls-1" d="M474.20933,196.63116a41.46679,41.46679,0,0,1-16.33506-3.18964,39.80757,39.80757,0,0,1-21.67092-21.83518,42.99409,42.99409,0,0,1,0-32.23,39.80765,39.80765,0,0,1,21.67092-21.83518,43.41665,43.41665,0,0,1,32.67012,0,39.8101,39.8101,0,0,1,21.66989,21.83518,42.994,42.994,0,0,1,0,32.23,39.81,39.81,0,0,1-21.66989,21.83518A41.485,41.485,0,0,1,474.20933,196.63116Zm0-14.07985a26.63714,26.63714,0,0,0,10.28431-1.9799,25.89889,25.89889,0,0,0,8.36072-5.50012,25.04229,25.04229,0,0,0,5.60963-8.525,31.04294,31.04294,0,0,0,0-22.11,25.07963,25.07963,0,0,0-5.60963-8.52549,25.9145,25.9145,0,0,0-8.36072-5.49961,27.6962,27.6962,0,0,0-20.56965,0,25.89233,25.89233,0,0,0-8.36072,5.49961,25.03434,25.03434,0,0,0-5.60962,8.52549,31.04279,31.04279,0,0,0,0,22.11,24.99714,24.99714,0,0,0,5.60962,8.525,25.87675,25.87675,0,0,0,8.36072,5.50012A26.63112,26.63112,0,0,0,474.20933,182.55131Z"/><path class="cls-1" d="M548.12931,116.11083h16.94044l29.59051,78.76048H578.26942L571.77961,176.061H541.41945l-6.48981,18.81033H518.53983Zm18.81032,46.3104-7.03941-19.69-2.8606-9.56994h-.88018l-2.85957,9.56994-7.04044,19.69Z"/><path class="cls-1" d="M636.67873,187.83138h-.88019a18.26469,18.26469,0,0,1-6.82039,6.43506,19.94541,19.94541,0,0,1-9.78947,2.36472q-10.23059,0-15.23483-6.26977-5.00682-6.27052-5.00527-16.7204V140.97087H613.359v30.91027q0,5.832,2.58477,8.635,2.58321,2.80482,7.53425,2.80533a10.50006,10.50006,0,0,0,5.22532-1.265,12.21407,12.21407,0,0,0,3.85029-3.41019,15.44293,15.44293,0,0,0,2.41947-5.06,22.69746,22.69746,0,0,0,.82543-6.215V140.97087H650.209v53.90044H636.67873Z"/><path class="cls-1" d="M669.01723,153.29138h-9.461V140.97087h9.461V124.471h14.4094v16.49984h13.2007v12.32051h-13.2007V174.829a15.54561,15.54561,0,0,0,.38534,3.57135,5.7936,5.7936,0,0,0,1.48454,2.77744,5.44914,5.44914,0,0,0,4.39988,1.81357,8.00547,8.00547,0,0,0,5.06-1.4303l4.07034,12.65007a23.83924,23.83924,0,0,1-5.44434,1.81512,31.8029,31.8029,0,0,1-6.43505.60487,19.66528,19.66528,0,0,1-7.31524-1.29084,15.54151,15.54151,0,0,1-5.44537-3.53675q-5.17107-5.05331-5.16953-14.37272Z"/><path class="cls-1" d="M707.735,116.11083h14.4094v22.1105l-.87915,9.79h.87915a17.85447,17.85447,0,0,1,6.65511-6.325,19.31492,19.31492,0,0,1,9.73574-2.47526q10.44909,0,15.45488,6.16026,5.00371,6.16128,5.00527,16.8299v32.67013H744.585V163.961q0-5.60962-2.64055-8.525a9.44018,9.44018,0,0,0-7.37-2.91484,10.82482,10.82482,0,0,0-5.28007,1.265,11.76092,11.76092,0,0,0-3.904,3.465,16.09429,16.09429,0,0,0-2.4205,5.11478,22.748,22.748,0,0,0-.82544,6.215v26.29034H707.735Z"/><path class="cls-1" d="M769.77353,194.87131V181.78115q6.48979-6.37824,11.98992-11.87991,2.31048-2.3097,4.73048-4.73,2.4174-2.41818,4.50939-4.50991,2.08888-2.08889,3.74078-3.795,1.6488-1.70458,2.53-2.69531,1.75726-2.08811,3.13436-3.73975a18.16413,18.16413,0,0,0,2.20046-3.24542,16.47472,16.47472,0,0,0,1.26449-3.18963,13.02445,13.02445,0,0,0,.44009-3.465,8.4276,8.4276,0,0,0-2.85956-6.325,10.93308,10.93308,0,0,0-7.81009-2.6953q-4.951,0-7.70058,2.80533a14.59773,14.59773,0,0,0-3.73975,6.325l-13.09015-5.3901a24.55547,24.55547,0,0,1,2.8606-6.105,22.76637,22.76637,0,0,1,5.06-5.61014,26.44875,26.44875,0,0,1,7.31421-4.07034,26.86184,26.86184,0,0,1,9.5157-1.59456,29.71878,29.71878,0,0,1,10.3401,1.70458,23.00883,23.00883,0,0,1,7.81008,4.67521,20.92923,20.92923,0,0,1,4.94949,6.98517,21.28551,21.28551,0,0,1,1.76037,8.635,25.00612,25.00612,0,0,1-3.465,12.92486,56.87664,56.87664,0,0,1-8.41546,10.945l-9.45992,9.46043q-3.74077,3.74077-8.47022,8.35968l.44009.66014h30.4707v12.65007Z"/><path class="cls-2" d="M447.03623,265.05824v31.9h-10.12V218.19774h26.84045a24.25664,24.25664,0,0,1,17.38054,6.82039,22.75761,22.75761,0,0,1,0,33.32974,24.22463,24.22463,0,0,1-17.38054,6.71037Zm0-37.18055v27.50059h16.94045a13.378,13.378,0,0,0,10.01054-4.07033,13.80577,13.80577,0,0,0-10.01054-23.43026Z"/><path class="cls-2" d="M507.31645,296.95821h-10.12V243.05777h9.68v8.80029h.44009a14.60805,14.60805,0,0,1,6.32451-7.31523,17.56035,17.56035,0,0,1,9.40516-3.02486,18.97706,18.97706,0,0,1,7.48054,1.31976l-3.08065,9.7905a16.79182,16.79182,0,0,0-5.94021-.77017A13.09674,13.09674,0,0,0,511.551,256.478a15.45278,15.45278,0,0,0-4.23459,10.78019Z"/><path class="cls-2" d="M530.74567,270.00825q0-12.42951,7.81009-20.57018a26.6222,26.6222,0,0,1,19.91055-8.14015q11.98785,0,19.8,8.14015,7.92011,8.14172,7.91959,20.57018,0,12.53952-7.91959,20.57017-7.81164,8.1417-19.8,8.13964a26.616,26.616,0,0,1-19.91055-8.13964Q530.74412,282.439,530.74567,270.00825Zm10.12,0q0,8.691,5.06,14.07984a17.28222,17.28222,0,0,0,25.08008,0q5.05952-5.388,5.06-14.07984,0-8.58025-5.06-13.97034a17.04544,17.04544,0,0,0-25.08008,0Q540.86469,261.429,540.86572,270.00825Z"/><path class="cls-2" d="M619.95626,269.56816l19.25041,27.39005H627.32625l-13.3102-19.91-13.09016,19.91H589.04651l19.03036-27.39005L589.4866,243.05777h11.43929l13.31021,19.03037,12.65006-19.03037h11.88042Z"/><path class="cls-2" d="M694.4248,243.05777l-33.77035,77.66076H650.20484L662.74437,293.548l-22.21949-50.49024h11.00024l16.06026,38.72036h.219l15.62017-38.72036Z"/><path class="cls-3" d="M211.931,392.63536c-101.38027,0-183.85932-82.47852-183.85932-183.8588S110.55071,24.91776,211.931,24.91776,395.7903,107.39629,395.7903,208.77656,313.31125,392.63536,211.931,392.63536Zm0-354.70389c-94.2045,0-170.84457,76.64111-170.84457,170.84509S117.72648,379.62165,211.931,379.62165s170.84457-76.6411,170.84457-170.84509S306.13548,37.93147,211.931,37.93147Z"/><polygon class="cls-4" points="244.602 112.007 239.295 131.843 281.959 166.856 322.055 161.912 244.602 112.007"/><polygon class="cls-3" points="348.449 195.562 348.449 158.734 290.209 109.179 244.602 112.007 300.209 156.67 76.642 156.67 76.642 198.05 348.449 195.562"/><polygon class="cls-5" points="180.489 297.175 185.796 277.34 141.87 240.558 103.037 247.271 180.489 297.175"/><polygon class="cls-6" points="76.642 213.62 76.642 250.448 134.882 300.004 180.489 297.175 124.882 252.512 348.449 252.512 348.449 211.132 76.642 213.62"/></svg>
docs/static/img/logos/OAuth2_Proxy_icon.pngnew file

Binary file not shown.

docs/static/img/logos/OAuth2_Proxy_icon.svgnew file+1
@@ -0,0 +1 @@
1+<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 360 360"><defs><style>.cls-1{fill:#06ed94;}.cls-2{fill:#059b61;}.cls-3{fill:#1957ba;}.cls-4{fill:#6ca8ff;}</style></defs><title>OAuth2_Proxy_logo_v3</title><path class="cls-1" d="M179.00205,349.728c-93.69483,0-169.921-76.22687-169.921-169.9217S85.30722,9.88462,179.00205,9.88462c93.69408,0,169.92021,76.22687,169.92021,169.9217S272.69613,349.728,179.00205,349.728Zm0-327.81581c-87.06238,0-157.89338,70.831-157.89338,157.89411s70.831,157.89411,157.89338,157.89411,157.89411-70.831,157.89411-157.89411S266.06442,21.91221,179.00205,21.91221Z"/><polygon class="cls-2" points="208.628 90.373 203.724 108.705 243.153 141.064 280.21 136.494 208.628 90.373"/><polygon class="cls-1" points="304.604 167.593 304.604 133.558 250.778 87.759 208.628 90.373 260.02 131.65 53.401 131.65 53.401 169.893 304.604 167.593"/><polygon class="cls-3" points="149.376 261.504 154.28 243.172 113.684 209.179 77.795 215.382 149.376 261.504"/><polygon class="cls-4" points="53.401 184.283 53.401 218.319 107.226 264.118 149.376 261.504 97.984 220.226 304.604 220.226 304.604 181.984 53.401 184.283"/></svg>
docs/static/img/logos/OAuth2_Proxy_vertical.pngnew file

Binary file not shown.

docs/static/img/logos/OAuth2_Proxy_vertical.svgnew file+1
@@ -0,0 +1 @@
1+<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 271.25527 412.45904"><defs><style>.cls-1{fill:#06ed94;}.cls-2{fill:#333;}.cls-3{fill:#7c7c82;}.cls-4{fill:#059b61;}.cls-5{fill:#1957ba;}.cls-6{fill:#6ca8ff;}</style></defs><title>OAuth2_Proxy_logo_v3</title><path class="cls-1" d="M135.48689,257.62084A124.15145,124.15145,0,1,1,259.6386,133.46912,124.29216,124.29216,0,0,1,135.48689,257.62084Zm0-239.515a115.36361,115.36361,0,1,0,115.365,115.36333A115.4943,115.4943,0,0,0,135.48689,18.10579Z"/><path class="cls-2" d="M43.349,326.11062a25.03594,25.03594,0,0,1-9.86153-1.9257,24.03513,24.03513,0,0,1-13.08258-13.18176,25.95077,25.95077,0,0,1,0-19.45748,24.03513,24.03513,0,0,1,13.08258-13.18176,25.03611,25.03611,0,0,1,9.86153-1.92569,25.04373,25.04373,0,0,1,9.86152,1.92569,24.03191,24.03191,0,0,1,13.082,13.18176,25.95077,25.95077,0,0,1,0,19.45748,24.03191,24.03191,0,0,1-13.082,13.18176A25.04355,25.04355,0,0,1,43.349,326.11062Zm0-8.5a16.08167,16.08167,0,0,0,6.20905-1.19509,15.64,15.64,0,0,0,5.047-3.32023,15.1262,15.1262,0,0,0,3.3869-5.14675,18.7484,18.7484,0,0,0,0-13.34816,15.13964,15.13964,0,0,0-3.3869-5.1462,15.65025,15.65025,0,0,0-5.047-3.32078,16.727,16.727,0,0,0-12.4181,0,15.62678,15.62678,0,0,0-5.047,3.32078,15.1001,15.1001,0,0,0-3.3869,5.1462,18.74056,18.74056,0,0,0,0,13.34816,15.08674,15.08674,0,0,0,3.3869,5.14675,15.61654,15.61654,0,0,0,5.047,3.32023A16.07574,16.07574,0,0,0,43.349,317.61057Z"/><path class="cls-2" d="M87.97487,277.50053H98.20116l17.864,47.54779h-9.89513l-3.91805-11.3558H83.92349L80.006,325.04832H70.11085Zm11.35526,27.95752-4.24976-11.887L93.35359,287.794h-.53115l-1.72678,5.77708-4.24975,11.887Z"/><path class="cls-2" d="M141.432,320.798h-.53115a11.02494,11.02494,0,0,1-4.117,3.885,12.04189,12.04189,0,0,1-5.91041,1.42761q-6.17625,0-9.19759-3.78527-3.02268-3.78444-3.0216-10.0935v-19.723h8.6995V311.169q0,3.521,1.56039,5.21287a5.88,5.88,0,0,0,4.54893,1.69372,6.335,6.335,0,0,0,3.15439-.76366,7.36817,7.36817,0,0,0,2.3246-2.05849,9.31986,9.31986,0,0,0,1.46067-3.0552,13.70705,13.70705,0,0,0,.49809-3.75166V292.5088h8.6995v32.53952H141.432Z"/><path class="cls-2" d="M160.95505,299.94654h-5.711V292.5088h5.711v-9.96125h8.6995v9.96125h7.96889v7.43774h-7.96889v13.00237a9.40943,9.40943,0,0,0,.232,2.156,3.50429,3.50429,0,0,0,.89645,1.67692,3.29006,3.29006,0,0,0,2.6563,1.09428,4.8322,4.8322,0,0,0,3.0552-.86339l2.45685,7.63719a14.4013,14.4013,0,0,1-3.28718,1.09591,19.24352,19.24352,0,0,1-3.885.36476,11.87693,11.87693,0,0,1-4.41614-.77884,9.38856,9.38856,0,0,1-3.28718-2.13545q-3.12186-3.05113-3.12078-8.67673Z"/><path class="cls-2" d="M184.32841,277.50053h8.6995v13.34815l-.53115,5.90987h.53115a10.7816,10.7816,0,0,1,4.01778-3.81832,11.65893,11.65893,0,0,1,5.87681-1.49427q6.30877,0,9.33037,3.71914,3.02106,3.71941,3.0216,10.16016v19.72306H206.575V306.38757a7.42672,7.42672,0,0,0-1.59345-5.14621,5.69992,5.69992,0,0,0-4.44975-1.75984,6.53689,6.53689,0,0,0-3.18745.76366,7.09646,7.09646,0,0,0-2.35711,2.09154A9.73186,9.73186,0,0,0,193.526,305.425a13.71381,13.71381,0,0,0-.49809,3.7522v15.87113h-8.6995Z"/><path class="cls-2" d="M221.78162,325.04832v-7.90223q3.91778-3.85111,7.23829-7.17217l2.85575-2.85575q1.46012-1.45931,2.72242-2.72242,1.26094-1.26095,2.25793-2.291.99672-1.02924,1.52733-1.627,1.06176-1.26095,1.89264-2.25794a10.94254,10.94254,0,0,0,1.32842-1.9593,9.958,9.958,0,0,0,.76366-1.92569,7.87231,7.87231,0,0,0,.26558-2.09154,5.08948,5.08948,0,0,0-1.72679-3.81887,6.60122,6.60122,0,0,0-4.71478-1.62652,6.212,6.212,0,0,0-4.64865,1.69318,8.82073,8.82073,0,0,0-2.25794,3.81833l-7.90223-3.25412A14.83518,14.83518,0,0,1,223.11,285.3697a13.75313,13.75313,0,0,1,3.05466-3.38636,15.96788,15.96788,0,0,1,4.41614-2.45739,16.21169,16.21169,0,0,1,5.744-.96258,17.927,17.927,0,0,1,6.24211,1.02924,13.884,13.884,0,0,1,4.71532,2.82215,12.6457,12.6457,0,0,1,2.98854,4.21669,12.85272,12.85272,0,0,1,1.0623,5.21341,15.09115,15.09115,0,0,1-2.09208,7.80251,34.27852,34.27852,0,0,1-5.08008,6.60741l-5.711,5.7115q-2.25848,2.25766-5.11369,5.04648l.26612.3989h18.39517v7.63666Z"/><path class="cls-3" d="M66.12613,369.53928v19.258H60.01681V341.24951H76.22017A14.64408,14.64408,0,0,1,86.71258,345.367a13.739,13.739,0,0,1,0,20.12141,14.62588,14.62588,0,0,1-10.49241,4.05085Zm0-22.446v16.60227H76.353a8.07584,8.07584,0,0,0,6.0432-2.45739,8.33447,8.33447,0,0,0-6.0432-14.14488Z"/><path class="cls-3" d="M102.51758,388.7973H96.40771V356.25779H102.252v5.31259h.26558a8.81855,8.81855,0,0,1,3.81832-4.41614,10.59845,10.59845,0,0,1,5.6779-1.82651,11.44924,11.44924,0,0,1,4.51533.79727l-1.859,5.90987a10.15183,10.15183,0,0,0-3.58636-.46449,7.90481,7.90481,0,0,0-6.00959,2.78909,9.32607,9.32607,0,0,0-2.55657,6.50768Z"/><path class="cls-3" d="M116.66137,372.52727a17.213,17.213,0,0,1,4.71478-12.4181,16.07132,16.07132,0,0,1,12.01974-4.91423,15.85788,15.85788,0,0,1,11.95307,4.91423,18.51723,18.51723,0,0,1,0,24.83674,15.85544,15.85544,0,0,1-11.95307,4.91369,16.06883,16.06883,0,0,1-12.01974-4.91369A17.2098,17.2098,0,0,1,116.66137,372.52727Zm6.10933,0a11.91437,11.91437,0,0,0,3.05466,8.50059,10.43448,10.43448,0,0,0,15.14106,0,13.26169,13.26169,0,0,0,0-16.934,10.28983,10.28983,0,0,0-15.14106,0A11.823,11.823,0,0,0,122.7707,372.52727Z"/><path class="cls-3" d="M170.51794,372.2617l11.62137,16.5356h-7.17217l-8.03556-12.01973-7.90223,12.01973h-7.17216l11.48858-16.5356-11.223-16.00391h6.90659l8.035,11.48858,7.6372-11.48858h7.17162Z"/><path class="cls-3" d="M215.47447,356.25779l-20.387,46.8833H188.7787l7.57053-16.40227-13.41428-30.481h6.641l9.69513,23.37553h.13279l9.4301-23.37553Z"/><polygon class="cls-4" points="157.133 68.125 153.55 81.519 182.358 105.162 209.433 101.824 157.133 68.125"/><polygon class="cls-1" points="227.257 124.546 227.257 99.678 187.929 66.216 157.133 68.125 194.682 98.284 43.718 98.284 43.718 126.226 227.257 124.546"/><polygon class="cls-5" points="113.841 193.161 117.424 179.767 87.763 154.93 61.541 159.463 113.841 193.161"/><polygon class="cls-6" points="43.718 136.74 43.718 161.608 83.045 195.071 113.841 193.161 76.292 163.002 227.257 163.002 227.257 135.06 43.718 136.74"/></svg>
docs/static/img/sign-in-page.pngnew file

Binary file not shown.

docs/static/img/simplified-architecture.svgnew file+4
@@ -0,0 +1,4 @@
1+<?xml version="1.0" encoding="UTF-8"?>
2+<!-- Do not edit this file with editors other than draw.io -->
3+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
4+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" width="1037px" height="433px" viewBox="-0.5 -0.5 1037 433" content="&lt;mxfile host=&quot;app.diagrams.net&quot; agent=&quot;Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36&quot; version=&quot;24.7.17&quot; scale=&quot;1&quot; border=&quot;10&quot;&gt;&#10; &lt;diagram name=&quot;Page-1&quot; id=&quot;fac173e5-deb3-fd42-0b6a-9958e0450fd0&quot;&gt;&#10; &lt;mxGraphModel dx=&quot;752&quot; dy=&quot;1319&quot; grid=&quot;0&quot; gridSize=&quot;10&quot; guides=&quot;1&quot; tooltips=&quot;1&quot; connect=&quot;1&quot; arrows=&quot;1&quot; fold=&quot;1&quot; page=&quot;0&quot; pageScale=&quot;1&quot; pageWidth=&quot;1100&quot; pageHeight=&quot;500&quot; background=&quot;#ffffff&quot; math=&quot;0&quot; shadow=&quot;0&quot;&gt;&#10; &lt;root&gt;&#10; &lt;mxCell id=&quot;0&quot; /&gt;&#10; &lt;mxCell id=&quot;1&quot; parent=&quot;0&quot; /&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-56&quot; value=&quot;&quot; style=&quot;rounded=1;whiteSpace=wrap;html=1;fillColor=#f5f5f5;strokeColor=#666666;arcSize=6;fontColor=#333333;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;550&quot; y=&quot;94&quot; width=&quot;500&quot; height=&quot;350&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-57&quot; value=&quot;&quot; style=&quot;rounded=1;whiteSpace=wrap;html=1;strokeColor=none;fillColor=#4A4A4A;arcSize=44;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;550&quot; y=&quot;32.5&quot; width=&quot;500&quot; height=&quot;55&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-55&quot; value=&quot;&quot; style=&quot;rounded=1;whiteSpace=wrap;html=1;fillColor=#f5f5f5;strokeColor=#666666;arcSize=6;fontColor=#333333;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;35&quot; y=&quot;94&quot; width=&quot;500&quot; height=&quot;350&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-54&quot; value=&quot;&quot; style=&quot;rounded=1;whiteSpace=wrap;html=1;strokeColor=none;fillColor=#4A4A4A;arcSize=44;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;35&quot; y=&quot;32.5&quot; width=&quot;500&quot; height=&quot;55&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-7&quot; style=&quot;edgeStyle=orthogonalEdgeStyle;rounded=1;orthogonalLoop=1;jettySize=auto;html=1;&quot; parent=&quot;1&quot; source=&quot;wUbSNccMbzvjAEwLt-_H-2&quot; target=&quot;wUbSNccMbzvjAEwLt-_H-6&quot; edge=&quot;1&quot;&gt;&#10; &lt;mxGeometry relative=&quot;1&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-2&quot; value=&quot;&quot; style=&quot;verticalLabelPosition=bottom;aspect=fixed;html=1;shape=mxgraph.salesforce.web;rounded=1;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;100&quot; y=&quot;125.00000000000001&quot; width=&quot;60&quot; height=&quot;47.400000000000006&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-4&quot; value=&quot;&amp;lt;b&amp;gt;&amp;lt;font color=&amp;quot;#fafafa&amp;quot; face=&amp;quot;Verdana&amp;quot;&amp;gt;OAuth2 Proxy as a standalone&amp;lt;/font&amp;gt;&amp;lt;font color=&amp;quot;#505050&amp;quot; face=&amp;quot;Verdana&amp;quot;&amp;gt; &amp;lt;/font&amp;gt;&amp;lt;font color=&amp;quot;#21ff46&amp;quot; face=&amp;quot;Verdana&amp;quot;&amp;gt;reverse-proxy&amp;lt;/font&amp;gt;&amp;lt;/b&amp;gt;&quot; style=&quot;text;html=1;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=1;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;35&quot; y=&quot;45&quot; width=&quot;500&quot; height=&quot;30&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-5&quot; value=&quot;&amp;lt;b&amp;gt;&amp;lt;font color=&amp;quot;#fafafa&amp;quot; face=&amp;quot;Verdana&amp;quot;&amp;gt;OAuth2 Proxy as a authentication &amp;lt;/font&amp;gt;&amp;lt;font color=&amp;quot;#21ff46&amp;quot; face=&amp;quot;Verdana&amp;quot;&amp;gt;middleware&amp;lt;/font&amp;gt;&amp;lt;/b&amp;gt;&quot; style=&quot;text;html=1;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=1;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;550&quot; y=&quot;45&quot; width=&quot;500&quot; height=&quot;30&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-9&quot; value=&quot;&quot; style=&quot;edgeStyle=orthogonalEdgeStyle;rounded=1;orthogonalLoop=1;jettySize=auto;html=1;dashed=1;&quot; parent=&quot;1&quot; source=&quot;wUbSNccMbzvjAEwLt-_H-6&quot; target=&quot;wUbSNccMbzvjAEwLt-_H-8&quot; edge=&quot;1&quot;&gt;&#10; &lt;mxGeometry relative=&quot;1&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-11&quot; value=&quot;&quot; style=&quot;edgeStyle=orthogonalEdgeStyle;rounded=1;orthogonalLoop=1;jettySize=auto;html=1;&quot; parent=&quot;1&quot; source=&quot;wUbSNccMbzvjAEwLt-_H-6&quot; target=&quot;wUbSNccMbzvjAEwLt-_H-10&quot; edge=&quot;1&quot;&gt;&#10; &lt;mxGeometry relative=&quot;1&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-6&quot; value=&quot;&quot; style=&quot;rounded=1;whiteSpace=wrap;html=1;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;75&quot; y=&quot;255&quot; width=&quot;110&quot; height=&quot;40&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-8&quot; value=&quot;Auth Provider&amp;lt;div&amp;gt;(Google, MS Entra, Keycloak, ...)&amp;lt;/div&amp;gt;&quot; style=&quot;rounded=1;whiteSpace=wrap;html=1;align=left;spacingLeft=50;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;280&quot; y=&quot;250&quot; width=&quot;240&quot; height=&quot;50&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-10&quot; value=&quot;secured upstream&quot; style=&quot;rounded=1;whiteSpace=wrap;html=1;align=left;spacingLeft=45;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;50&quot; y=&quot;375&quot; width=&quot;160&quot; height=&quot;40&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-16&quot; value=&quot;&quot; style=&quot;shape=image;verticalLabelPosition=bottom;labelBackgroundColor=default;verticalAlign=top;aspect=fixed;imageAspect=0;image=data:image/svg+xml,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA4NDAuNTU2NDUgNDEyLjQ1OTA0IiBkYXRhLW5hbWU9IkxheWVyIDEiIGlkPSJMYXllcl8xIj48ZGVmcz48c3R5bGU+LmNscy0xe2ZpbGw6IzMzMzt9LmNscy0ye2ZpbGw6IzdjN2M4Mjt9LmNscy0ze2ZpbGw6IzA2ZWQ5NDt9LmNscy00e2ZpbGw6IzA1OWI2MTt9LmNscy01e2ZpbGw6IzE5NTdiYTt9LmNscy02e2ZpbGw6IzZjYThmZjt9PC9zdHlsZT48L2RlZnM+PHRpdGxlPk9BdXRoMl9Qcm94eV9sb2dvX3YzPC90aXRsZT48cGF0aCBkPSJNNDc0LjIwOTMzLDE5Ni42MzExNmE0MS40NjY3OSw0MS40NjY3OSwwLDAsMS0xNi4zMzUwNi0zLjE4OTY0LDM5LjgwNzU3LDM5LjgwNzU3LDAsMCwxLTIxLjY3MDkyLTIxLjgzNTE4LDQyLjk5NDA5LDQyLjk5NDA5LDAsMCwxLDAtMzIuMjMsMzkuODA3NjUsMzkuODA3NjUsMCwwLDEsMjEuNjcwOTItMjEuODM1MTgsNDMuNDE2NjUsNDMuNDE2NjUsMCwwLDEsMzIuNjcwMTIsMCwzOS44MTAxLDM5LjgxMDEsMCwwLDEsMjEuNjY5ODksMjEuODM1MTgsNDIuOTk0LDQyLjk5NCwwLDAsMSwwLDMyLjIzLDM5LjgxLDM5LjgxLDAsMCwxLTIxLjY2OTg5LDIxLjgzNTE4QTQxLjQ4NSw0MS40ODUsMCwwLDEsNDc0LjIwOTMzLDE5Ni42MzExNlptMC0xNC4wNzk4NWEyNi42MzcxNCwyNi42MzcxNCwwLDAsMCwxMC4yODQzMS0xLjk3OTksMjUuODk4ODksMjUuODk4ODksMCwwLDAsOC4zNjA3Mi01LjUwMDEyLDI1LjA0MjI5LDI1LjA0MjI5LDAsMCwwLDUuNjA5NjMtOC41MjUsMzEuMDQyOTQsMzEuMDQyOTQsMCwwLDAsMC0yMi4xMSwyNS4wNzk2MywyNS4wNzk2MywwLDAsMC01LjYwOTYzLTguNTI1NDksMjUuOTE0NSwyNS45MTQ1LDAsMCwwLTguMzYwNzItNS40OTk2MSwyNy42OTYyLDI3LjY5NjIsMCwwLDAtMjAuNTY5NjUsMCwyNS44OTIzMywyNS44OTIzMywwLDAsMC04LjM2MDcyLDUuNDk5NjEsMjUuMDM0MzQsMjUuMDM0MzQsMCwwLDAtNS42MDk2Miw4LjUyNTQ5LDMxLjA0Mjc5LDMxLjA0Mjc5LDAsMCwwLDAsMjIuMTEsMjQuOTk3MTQsMjQuOTk3MTQsMCwwLDAsNS42MDk2Miw4LjUyNSwyNS44NzY3NSwyNS44NzY3NSwwLDAsMCw4LjM2MDcyLDUuNTAwMTJBMjYuNjMxMTIsMjYuNjMxMTIsMCwwLDAsNDc0LjIwOTMzLDE4Mi41NTEzMVoiIGNsYXNzPSJjbHMtMSIvPjxwYXRoIGQ9Ik01NDguMTI5MzEsMTE2LjExMDgzaDE2Ljk0MDQ0bDI5LjU5MDUxLDc4Ljc2MDQ4SDU3OC4yNjk0Mkw1NzEuNzc5NjEsMTc2LjA2MUg1NDEuNDE5NDVsLTYuNDg5ODEsMTguODEwMzNINTE4LjUzOTgzWm0xOC44MTAzMiw0Ni4zMTA0LTcuMDM5NDEtMTkuNjktMi44NjA2LTkuNTY5OTRoLS44ODAxOGwtMi44NTk1Nyw5LjU2OTk0LTcuMDQwNDQsMTkuNjlaIiBjbGFzcz0iY2xzLTEiLz48cGF0aCBkPSJNNjM2LjY3ODczLDE4Ny44MzEzOGgtLjg4MDE5YTE4LjI2NDY5LDE4LjI2NDY5LDAsMCwxLTYuODIwMzksNi40MzUwNiwxOS45NDU0MSwxOS45NDU0MSwwLDAsMS05Ljc4OTQ3LDIuMzY0NzJxLTEwLjIzMDU5LDAtMTUuMjM0ODMtNi4yNjk3Ny01LjAwNjgyLTYuMjcwNTItNS4wMDUyNy0xNi43MjA0VjE0MC45NzA4N0g2MTMuMzU5djMwLjkxMDI3cTAsNS44MzIsMi41ODQ3Nyw4LjYzNSwyLjU4MzIxLDIuODA0ODIsNy41MzQyNSwyLjgwNTMzYTEwLjUwMDA2LDEwLjUwMDA2LDAsMCwwLDUuMjI1MzItMS4yNjUsMTIuMjE0MDcsMTIuMjE0MDcsMCwwLDAsMy44NTAyOS0zLjQxMDE5LDE1LjQ0MjkzLDE1LjQ0MjkzLDAsMCwwLDIuNDE5NDctNS4wNiwyMi42OTc0NiwyMi42OTc0NiwwLDAsMCwuODI1NDMtNi4yMTVWMTQwLjk3MDg3SDY1MC4yMDl2NTMuOTAwNDRINjM2LjY3ODczWiIgY2xhc3M9ImNscy0xIi8+PHBhdGggZD0iTTY2OS4wMTcyMywxNTMuMjkxMzhoLTkuNDYxVjE0MC45NzA4N2g5LjQ2MVYxMjQuNDcxaDE0LjQwOTR2MTYuNDk5ODRoMTMuMjAwN3YxMi4zMjA1MWgtMTMuMjAwN1YxNzQuODI5YTE1LjU0NTYxLDE1LjU0NTYxLDAsMCwwLC4zODUzNCwzLjU3MTM1LDUuNzkzNiw1Ljc5MzYsMCwwLDAsMS40ODQ1NCwyLjc3NzQ0LDUuNDQ5MTQsNS40NDkxNCwwLDAsMCw0LjM5OTg4LDEuODEzNTcsOC4wMDU0Nyw4LjAwNTQ3LDAsMCwwLDUuMDYtMS40MzAzbDQuMDcwMzQsMTIuNjUwMDdhMjMuODM5MjQsMjMuODM5MjQsMCwwLDEtNS40NDQzNCwxLjgxNTEyLDMxLjgwMjksMzEuODAyOSwwLDAsMS02LjQzNTA1LjYwNDg3LDE5LjY2NTI4LDE5LjY2NTI4LDAsMCwxLTcuMzE1MjQtMS4yOTA4NCwxNS41NDE1MSwxNS41NDE1MSwwLDAsMS01LjQ0NTM3LTMuNTM2NzVxLTUuMTcxMDctNS4wNTMzMS01LjE2OTUzLTE0LjM3MjcyWiIgY2xhc3M9ImNscy0xIi8+PHBhdGggZD0iTTcwNy43MzUsMTE2LjExMDgzaDE0LjQwOTR2MjIuMTEwNWwtLjg3OTE1LDkuNzloLjg3OTE1YTE3Ljg1NDQ3LDE3Ljg1NDQ3LDAsMCwxLDYuNjU1MTEtNi4zMjUsMTkuMzE0OTIsMTkuMzE0OTIsMCwwLDEsOS43MzU3NC0yLjQ3NTI2cTEwLjQ0OTA5LDAsMTUuNDU0ODgsNi4xNjAyNiw1LjAwMzcxLDYuMTYxMjgsNS4wMDUyNywxNi44Mjk5djMyLjY3MDEzSDc0NC41ODVWMTYzLjk2MXEwLTUuNjA5NjItMi42NDA1NS04LjUyNWE5LjQ0MDE4LDkuNDQwMTgsMCwwLDAtNy4zNy0yLjkxNDg0LDEwLjgyNDgyLDEwLjgyNDgyLDAsMCwwLTUuMjgwMDcsMS4yNjUsMTEuNzYwOTIsMTEuNzYwOTIsMCwwLDAtMy45MDQsMy40NjUsMTYuMDk0MjksMTYuMDk0MjksMCwwLDAtMi40MjA1LDUuMTE0NzgsMjIuNzQ4LDIyLjc0OCwwLDAsMC0uODI1NDQsNi4yMTV2MjYuMjkwMzRINzA3LjczNVoiIGNsYXNzPSJjbHMtMSIvPjxwYXRoIGQ9Ik03NjkuNzczNTMsMTk0Ljg3MTMxVjE4MS43ODExNXE2LjQ4OTc5LTYuMzc4MjQsMTEuOTg5OTItMTEuODc5OTEsMi4zMTA0OC0yLjMwOTcsNC43MzA0OC00LjczLDIuNDE3NC0yLjQxODE4LDQuNTA5MzktNC41MDk5MSwyLjA4ODg4LTIuMDg4ODksMy43NDA3OC0zLjc5NSwxLjY0ODgtMS43MDQ1OCwyLjUzLTIuNjk1MzEsMS43NTcyNi0yLjA4ODExLDMuMTM0MzYtMy43Mzk3NWExOC4xNjQxMywxOC4xNjQxMywwLDAsMCwyLjIwMDQ2LTMuMjQ1NDIsMTYuNDc0NzIsMTYuNDc0NzIsMCwwLDAsMS4yNjQ0OS0zLjE4OTYzLDEzLjAyNDQ1LDEzLjAyNDQ1LDAsMCwwLC40NDAwOS0zLjQ2NSw4LjQyNzYsOC40Mjc2LDAsMCwwLTIuODU5NTYtNi4zMjUsMTAuOTMzMDgsMTAuOTMzMDgsMCwwLDAtNy44MTAwOS0yLjY5NTNxLTQuOTUxLDAtNy43MDA1OCwyLjgwNTMzYTE0LjU5NzczLDE0LjU5NzczLDAsMCwwLTMuNzM5NzUsNi4zMjVsLTEzLjA5MDE1LTUuMzkwMWEyNC41NTU0NywyNC41NTU0NywwLDAsMSwyLjg2MDYtNi4xMDUsMjIuNzY2MzcsMjIuNzY2MzcsMCwwLDEsNS4wNi01LjYxMDE0LDI2LjQ0ODc1LDI2LjQ0ODc1LDAsMCwxLDcuMzE0MjEtNC4wNzAzNCwyNi44NjE4NCwyNi44NjE4NCwwLDAsMSw5LjUxNTctMS41OTQ1NiwyOS43MTg3OCwyOS43MTg3OCwwLDAsMSwxMC4zNDAxLDEuNzA0NTgsMjMuMDA4ODMsMjMuMDA4ODMsMCwwLDEsNy44MTAwOCw0LjY3NTIxLDIwLjkyOTIzLDIwLjkyOTIzLDAsMCwxLDQuOTQ5NDksNi45ODUxNywyMS4yODU1MSwyMS4yODU1MSwwLDAsMSwxLjc2MDM3LDguNjM1LDI1LjAwNjEyLDI1LjAwNjEyLDAsMCwxLTMuNDY1LDEyLjkyNDg2LDU2Ljg3NjY0LDU2Ljg3NjY0LDAsMCwxLTguNDE1NDYsMTAuOTQ1bC05LjQ1OTkyLDkuNDYwNDNxLTMuNzQwNzcsMy43NDA3Ny04LjQ3MDIyLDguMzU5NjhsLjQ0MDA5LjY2MDE0aDMwLjQ3MDd2MTIuNjUwMDdaIiBjbGFzcz0iY2xzLTEiLz48cGF0aCBkPSJNNDQ3LjAzNjIzLDI2NS4wNTgyNHYzMS45aC0xMC4xMlYyMTguMTk3NzRoMjYuODQwNDVhMjQuMjU2NjQsMjQuMjU2NjQsMCwwLDEsMTcuMzgwNTQsNi44MjAzOSwyMi43NTc2MSwyMi43NTc2MSwwLDAsMSwwLDMzLjMyOTc0LDI0LjIyNDYzLDI0LjIyNDYzLDAsMCwxLTE3LjM4MDU0LDYuNzEwMzdabTAtMzcuMTgwNTV2MjcuNTAwNTloMTYuOTQwNDVhMTMuMzc4LDEzLjM3OCwwLDAsMCwxMC4wMTA1NC00LjA3MDMzLDEzLjgwNTc3LDEzLjgwNTc3LDAsMCwwLTEwLjAxMDU0LTIzLjQzMDI2WiIgY2xhc3M9ImNscy0yIi8+PHBhdGggZD0iTTUwNy4zMTY0NSwyOTYuOTU4MjFoLTEwLjEyVjI0My4wNTc3N2g5LjY4djguODAwMjloLjQ0MDA5YTE0LjYwODA1LDE0LjYwODA1LDAsMCwxLDYuMzI0NTEtNy4zMTUyMywxNy41NjAzNSwxNy41NjAzNSwwLDAsMSw5LjQwNTE2LTMuMDI0ODYsMTguOTc3MDYsMTguOTc3MDYsMCwwLDEsNy40ODA1NCwxLjMxOTc2bC0zLjA4MDY1LDkuNzkwNWExNi43OTE4MiwxNi43OTE4MiwwLDAsMC01Ljk0MDIxLS43NzAxN0ExMy4wOTY3NCwxMy4wOTY3NCwwLDAsMCw1MTEuNTUxLDI1Ni40NzhhMTUuNDUyNzgsMTUuNDUyNzgsMCwwLDAtNC4yMzQ1OSwxMC43ODAxOVoiIGNsYXNzPSJjbHMtMiIvPjxwYXRoIGQ9Ik01MzAuNzQ1NjcsMjcwLjAwODI1cTAtMTIuNDI5NTEsNy44MTAwOS0yMC41NzAxOGEyNi42MjIyLDI2LjYyMjIsMCwwLDEsMTkuOTEwNTUtOC4xNDAxNXExMS45ODc4NSwwLDE5LjgsOC4xNDAxNSw3LjkyMDExLDguMTQxNzIsNy45MTk1OSwyMC41NzAxOCwwLDEyLjUzOTUyLTcuOTE5NTksMjAuNTcwMTctNy44MTE2NCw4LjE0MTctMTkuOCw4LjEzOTY0YTI2LjYxNiwyNi42MTYsMCwwLDEtMTkuOTEwNTUtOC4xMzk2NFE1MzAuNzQ0MTIsMjgyLjQzOSw1MzAuNzQ1NjcsMjcwLjAwODI1Wm0xMC4xMiwwcTAsOC42OTEsNS4wNiwxNC4wNzk4NGExNy4yODIyMiwxNy4yODIyMiwwLDAsMCwyNS4wODAwOCwwcTUuMDU5NTItNS4zODgsNS4wNi0xNC4wNzk4NCwwLTguNTgwMjUtNS4wNi0xMy45NzAzNGExNy4wNDU0NCwxNy4wNDU0NCwwLDAsMC0yNS4wODAwOCwwUTU0MC44NjQ2OSwyNjEuNDI5LDU0MC44NjU3MiwyNzAuMDA4MjVaIiBjbGFzcz0iY2xzLTIiLz48cGF0aCBkPSJNNjE5Ljk1NjI2LDI2OS41NjgxNmwxOS4yNTA0MSwyNy4zOTAwNUg2MjcuMzI2MjVsLTEzLjMxMDItMTkuOTEtMTMuMDkwMTYsMTkuOTFINTg5LjA0NjUxbDE5LjAzMDM2LTI3LjM5MDA1TDU4OS40ODY2LDI0My4wNTc3N2gxMS40MzkyOWwxMy4zMTAyMSwxOS4wMzAzNywxMi42NTAwNi0xOS4wMzAzN2gxMS44ODA0MloiIGNsYXNzPSJjbHMtMiIvPjxwYXRoIGQ9Ik02OTQuNDI0OCwyNDMuMDU3NzdsLTMzLjc3MDM1LDc3LjY2MDc2SDY1MC4yMDQ4NEw2NjIuNzQ0MzcsMjkzLjU0OGwtMjIuMjE5NDktNTAuNDkwMjRoMTEuMDAwMjRsMTYuMDYwMjYsMzguNzIwMzZoLjIxOWwxNS42MjAxNy0zOC43MjAzNloiIGNsYXNzPSJjbHMtMiIvPjxwYXRoIGQ9Ik0yMTEuOTMxLDM5Mi42MzUzNmMtMTAxLjM4MDI3LDAtMTgzLjg1OTMyLTgyLjQ3ODUyLTE4My44NTkzMi0xODMuODU4OFMxMTAuNTUwNzEsMjQuOTE3NzYsMjExLjkzMSwyNC45MTc3NiwzOTUuNzkwMywxMDcuMzk2MjksMzk1Ljc5MDMsMjA4Ljc3NjU2LDMxMy4zMTEyNSwzOTIuNjM1MzYsMjExLjkzMSwzOTIuNjM1MzZabTAtMzU0LjcwMzg5Yy05NC4yMDQ1LDAtMTcwLjg0NDU3LDc2LjY0MTExLTE3MC44NDQ1NywxNzAuODQ1MDlTMTE3LjcyNjQ4LDM3OS42MjE2NSwyMTEuOTMxLDM3OS42MjE2NXMxNzAuODQ0NTctNzYuNjQxMSwxNzAuODQ0NTctMTcwLjg0NTA5UzMwNi4xMzU0OCwzNy45MzE0NywyMTEuOTMxLDM3LjkzMTQ3WiIgY2xhc3M9ImNscy0zIi8+PHBvbHlnb24gcG9pbnRzPSIyNDQuNjAyIDExMi4wMDcgMjM5LjI5NSAxMzEuODQzIDI4MS45NTkgMTY2Ljg1NiAzMjIuMDU1IDE2MS45MTIgMjQ0LjYwMiAxMTIuMDA3IiBjbGFzcz0iY2xzLTQiLz48cG9seWdvbiBwb2ludHM9IjM0OC40NDkgMTk1LjU2MiAzNDguNDQ5IDE1OC43MzQgMjkwLjIwOSAxMDkuMTc5IDI0NC42MDIgMTEyLjAwNyAzMDAuMjA5IDE1Ni42NyA3Ni42NDIgMTU2LjY3IDc2LjY0MiAxOTguMDUgMzQ4LjQ0OSAxOTUuNTYyIiBjbGFzcz0iY2xzLTMiLz48cG9seWdvbiBwb2ludHM9IjE4MC40ODkgMjk3LjE3NSAxODUuNzk2IDI3Ny4zNCAxNDEuODcgMjQwLjU1OCAxMDMuMDM3IDI0Ny4yNzEgMTgwLjQ4OSAyOTcuMTc1IiBjbGFzcz0iY2xzLTUiLz48cG9seWdvbiBwb2ludHM9Ijc2LjY0MiAyMTMuNjIgNzYuNjQyIDI1MC40NDggMTM0Ljg4MiAzMDAuMDA0IDE4MC40ODkgMjk3LjE3NSAxMjQuODgyIDI1Mi41MTIgMzQ4LjQ0OSAyNTIuNTEyIDM0OC40NDkgMjExLjEzMiA3Ni42NDIgMjEzLjYyIiBjbGFzcz0iY2xzLTYiLz48L3N2Zz4=;rounded=1;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;89.18&quot; y=&quot;255&quot; width=&quot;81.65&quot; height=&quot;40&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-17&quot; value=&quot;&quot; style=&quot;shape=image;editableCssRules=.*;verticalLabelPosition=bottom;labelBackgroundColor=default;verticalAlign=top;aspect=fixed;imageAspect=0;image=data:image/svg+xml,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9Ii0wLjUgLTAuNSAyOCAyOCIgaGVpZ2h0PSIyOCIgd2lkdGg9IjI4Ij4mI3hhOwkgIDxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+LnN0MCB7IHN0b3AtY29sb3I6IHJnYig5MSwgMTE1LCAxMzkpOyB9IC5zdDEgeyBzdG9wLWNvbG9yOiByZ2IoMzQsIDUzLCA3Mik7IH0gPC9zdHlsZT4mI3hhOwk8ZGVmcz4mI3hhOwkJPGxpbmVhckdyYWRpZW50IGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIiB5Mj0iMjUuMzA5IiB4Mj0iMjMuNDU0IiB5MT0iMy40NzQiIHgxPSIyLjAzOSIgaWQ9IkEiPiYjeGE7CQkJPHN0b3AgY2xhc3M9InN0MCIvPiYjeGE7CQkJPHN0b3AgY2xhc3M9InN0MSIgb2Zmc2V0PSIxIi8+JiN4YTsJCTwvbGluZWFyR3JhZGllbnQ+JiN4YTsJPC9kZWZzPiYjeGE7CTxwYXRoIGZpbGw9InVybCgjQSkiIGQ9Ik0yMS43NDcgMTMuMmExMS4zNSAxMS4zNSAwIDAgMSA0LjE2NCAzLjk0NWMxLjA1OSAxLjY4IDEuNTg5IDMuNTc5IDEuNTg5IDUuNjk5djMuMTIzYzAgMS4wMjItLjUzIDEuNTM0LTEuNTg5IDEuNTM0SDcuMjgyYy0uNDc1IDAtLjg1OS0uMTQ2LTEuMTUyLS40MzgtLjI5MS0uMjU2LS40MzgtLjYyMS0uNDM4LTEuMDk2di0xLjU4OUgxLjAzNGMtMS4wMjIgMC0xLjUzNC0uNTEyLTEuNTM0LTEuNTM0VjE5LjcyYTcuMjcgNy4yNyAwIDAgMSAxLjI2MS00LjE2NmMuODAzLTEuMjA5IDEuOTIxLTIuMTc1IDMuMjMzLTIuNzkzLS40NjQtLjUyOC0uODE4LTEuMTQzLTEuMDQyLTEuODA5YTYuODggNi44OCAwIDAgMS0uMzMtMi4wODFjMC0uODc3LjE2NS0xLjY4LjQ5NC0yLjQxMWE2LjE3IDYuMTcgMCAwIDEgMS4zMTUtMS45NzNjLjU2OC0uNTczIDEuMjM3LTEuMDM3IDEuOTczLTEuMzY5YTYuMDYgNi4wNiAwIDAgMSAyLjQxMS0uNDkzYy4yNTYgMCAuNDkzLjAxOC43MTIuMDUzYTIuNjUgMi42NSAwIDAgMSAuNzEyLjExQTcuNDEgNy40MSAwIDAgMSAxMi45MjYuMzc3YzEuMTM0LS41ODUgMi4zOTQtLjg4NiAzLjY3LS44NzcgMS4wOTYgMCAyLjEyLjIwMiAzLjA2OC42MDNzMS43NzEuOTY4IDIuNDY1IDEuNjk5Yy42OTQuNjk0IDEuMjQzIDEuNTE1IDEuNjQ1IDIuNDY1LjQwMy45MTIuNjAzIDEuOTE4LjYwMyAzLjAxNC4wMDMgMS4xNTItLjIzOSAyLjI5MS0uNzEyIDMuMzQyLS40MjIgMS4wMDEtMS4wOCAxLjg4NS0xLjkxOCAyLjU3NnpNMTYuNTk0IDIuNjIzYy0xLjMxNSAwLTIuNDI4LjQ1Ni0zLjM0MiAxLjM3MS0uODc3Ljg3Ny0xLjMxNSAxLjk3My0xLjMxNSAzLjI4OHMuNDM4IDIuNDI4IDEuMzE1IDMuMzQyYy45MTIuODc3IDIuMDI3IDEuMzE1IDMuMzQyIDEuMzE1czIuNDExLS40MzggMy4yODgtMS4zMTVhNC41NCA0LjU0IDAgMCAwIDEuMzY5LTMuMzQyYzAtMS4zMTUtLjQ1Ni0yLjQxMS0xLjM2OC0zLjI4OC0uODc3LS45MTQtMS45NzQtMS4zNzEtMy4yODktMS4zNzF6TTguNjUxIDUuNzQ5Yy0uODQyIDAtMS41NzEuMzEtMi4xOTIuOTMxLS41ODQuNTg0LS44NzcgMS4zMTUtLjg3NyAyLjE5MmEzLjA5IDMuMDkgMCAwIDAgLjg3NyAyLjE5MiAzLjA5IDMuMDkgMCAwIDAgMi4xOTIuODc3aDEuNzUzYTcuOTggNy45OCAwIDAgMS0xLjE1LTIuMTM3IDcuNjMgNy42MyAwIDAgMS0uNDM4LTIuNTJ2LS43NzFhNC4wMSA0LjAxIDAgMCAxIC4xNjMtLjc2NmgtLjMyOHpNMi42MjMgMjEuMzExaDMuMjMzYy4zMy0yLjUyMSAxLjM2OS00LjYwMyAzLjEyMy02LjI0N0g3LjI4M2MtMS4zMTUgMC0yLjQzLjQ1Ni0zLjM0NCAxLjM2OS0uODc3Ljg3Ny0xLjMxNSAxLjk3NC0xLjMxNSAzLjI4OXptMjEuNzU0IDEuNTM0YTcuNCA3LjQgMCAwIDAtLjYwMy0zLjAxNGMtLjM4My0uOTIxLS45NDItMS43NTgtMS42NDUtMi40NjVhNy4yNiA3LjI2IDAgMCAwLTIuNDY1LTEuNjk5Yy0uOTcxLS40MDYtMi4wMTUtLjYxMS0zLjA2OC0uNjAzLTEuMDk2IDAtMi4xMTguMjAyLTMuMDY4LjYwMy0uOTEyLjQwMy0xLjczNi45NjgtMi40NjUgMS42OTlhNy42NyA3LjY3IDAgMCAwLTEuNjQ1IDIuNDY1IDcuNCA3LjQgMCAwIDAtLjYwMSAzLjAxNHYxLjUzNGgxNS41NjF6Ii8+JiN4YTs8L3N2Zz4=;rounded=1;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;290&quot; y=&quot;257.5&quot; width=&quot;35&quot; height=&quot;35&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-18&quot; value=&quot;&quot; style=&quot;verticalLabelPosition=bottom;html=1;verticalAlign=top;strokeWidth=1;align=center;outlineConnect=0;dashed=0;outlineConnect=0;shape=mxgraph.aws3d.application;fillColor=#4286c5;strokeColor=#57A2D8;aspect=fixed;rounded=1;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;62.15&quot; y=&quot;380&quot; width=&quot;27.03&quot; height=&quot;30&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-20&quot; value=&quot;Authenticate&quot; style=&quot;text;html=1;align=center;verticalAlign=middle;resizable=0;points=[];autosize=1;strokeColor=none;fillColor=none;rounded=1;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;185&quot; y=&quot;245&quot; width=&quot;90&quot; height=&quot;30&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-21&quot; value=&quot;Request&quot; style=&quot;text;html=1;align=center;verticalAlign=middle;resizable=0;points=[];autosize=1;strokeColor=none;fillColor=none;rounded=1;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;130&quot; y=&quot;195&quot; width=&quot;70&quot; height=&quot;30&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-22&quot; value=&quot;Forward authenticated requests&quot; style=&quot;text;html=1;align=center;verticalAlign=middle;resizable=0;points=[];autosize=1;strokeColor=none;fillColor=none;rounded=1;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;130&quot; y=&quot;335&quot; width=&quot;190&quot; height=&quot;30&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-23&quot; style=&quot;edgeStyle=orthogonalEdgeStyle;rounded=1;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;&quot; parent=&quot;1&quot; source=&quot;wUbSNccMbzvjAEwLt-_H-24&quot; target=&quot;wUbSNccMbzvjAEwLt-_H-42&quot; edge=&quot;1&quot;&gt;&#10; &lt;mxGeometry relative=&quot;1&quot; as=&quot;geometry&quot;&gt;&#10; &lt;mxPoint x=&quot;650&quot; y=&quot;255&quot; as=&quot;targetPoint&quot; /&gt;&#10; &lt;/mxGeometry&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-24&quot; value=&quot;&quot; style=&quot;verticalLabelPosition=bottom;aspect=fixed;html=1;shape=mxgraph.salesforce.web;rounded=1;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;620&quot; y=&quot;125.00000000000001&quot; width=&quot;60&quot; height=&quot;47.400000000000006&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-26&quot; value=&quot;&quot; style=&quot;edgeStyle=orthogonalEdgeStyle;rounded=1;orthogonalLoop=1;jettySize=auto;html=1;exitX=0.5;exitY=1;exitDx=0;exitDy=0;&quot; parent=&quot;1&quot; source=&quot;wUbSNccMbzvjAEwLt-_H-42&quot; target=&quot;wUbSNccMbzvjAEwLt-_H-29&quot; edge=&quot;1&quot;&gt;&#10; &lt;mxGeometry relative=&quot;1&quot; as=&quot;geometry&quot;&gt;&#10; &lt;mxPoint x=&quot;650&quot; y=&quot;295&quot; as=&quot;sourcePoint&quot; /&gt;&#10; &lt;/mxGeometry&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-29&quot; value=&quot;secured upstream&quot; style=&quot;rounded=1;whiteSpace=wrap;html=1;align=left;spacingLeft=45;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;570&quot; y=&quot;375&quot; width=&quot;160&quot; height=&quot;40&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-32&quot; value=&quot;&quot; style=&quot;verticalLabelPosition=bottom;html=1;verticalAlign=top;strokeWidth=1;align=center;outlineConnect=0;dashed=0;outlineConnect=0;shape=mxgraph.aws3d.application;fillColor=#4286c5;strokeColor=#57A2D8;aspect=fixed;rounded=1;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;582.15&quot; y=&quot;380&quot; width=&quot;27.03&quot; height=&quot;30&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-34&quot; value=&quot;Request&quot; style=&quot;text;html=1;align=center;verticalAlign=middle;resizable=0;points=[];autosize=1;strokeColor=none;fillColor=none;rounded=1;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;650&quot; y=&quot;195&quot; width=&quot;70&quot; height=&quot;30&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-35&quot; value=&quot;Forward authenticated requests&quot; style=&quot;text;html=1;align=center;verticalAlign=middle;resizable=0;points=[];autosize=1;strokeColor=none;fillColor=none;rounded=1;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;650&quot; y=&quot;335&quot; width=&quot;190&quot; height=&quot;30&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-36&quot; value=&quot;&quot; style=&quot;edgeStyle=orthogonalEdgeStyle;rounded=1;orthogonalLoop=1;jettySize=auto;html=1;dashed=1;entryX=0.5;entryY=1;entryDx=0;entryDy=0;&quot; parent=&quot;1&quot; source=&quot;wUbSNccMbzvjAEwLt-_H-37&quot; target=&quot;wUbSNccMbzvjAEwLt-_H-46&quot; edge=&quot;1&quot;&gt;&#10; &lt;mxGeometry relative=&quot;1&quot; as=&quot;geometry&quot;&gt;&#10; &lt;mxPoint x=&quot;1069.99&quot; y=&quot;275&quot; as=&quot;targetPoint&quot; /&gt;&#10; &lt;/mxGeometry&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-37&quot; value=&quot;&quot; style=&quot;rounded=1;whiteSpace=wrap;html=1;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;865&quot; y=&quot;252.5&quot; width=&quot;110&quot; height=&quot;40&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-39&quot; value=&quot;&quot; style=&quot;shape=image;verticalLabelPosition=bottom;labelBackgroundColor=default;verticalAlign=top;aspect=fixed;imageAspect=0;image=data:image/svg+xml,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA4NDAuNTU2NDUgNDEyLjQ1OTA0IiBkYXRhLW5hbWU9IkxheWVyIDEiIGlkPSJMYXllcl8xIj48ZGVmcz48c3R5bGU+LmNscy0xe2ZpbGw6IzMzMzt9LmNscy0ye2ZpbGw6IzdjN2M4Mjt9LmNscy0ze2ZpbGw6IzA2ZWQ5NDt9LmNscy00e2ZpbGw6IzA1OWI2MTt9LmNscy01e2ZpbGw6IzE5NTdiYTt9LmNscy02e2ZpbGw6IzZjYThmZjt9PC9zdHlsZT48L2RlZnM+PHRpdGxlPk9BdXRoMl9Qcm94eV9sb2dvX3YzPC90aXRsZT48cGF0aCBkPSJNNDc0LjIwOTMzLDE5Ni42MzExNmE0MS40NjY3OSw0MS40NjY3OSwwLDAsMS0xNi4zMzUwNi0zLjE4OTY0LDM5LjgwNzU3LDM5LjgwNzU3LDAsMCwxLTIxLjY3MDkyLTIxLjgzNTE4LDQyLjk5NDA5LDQyLjk5NDA5LDAsMCwxLDAtMzIuMjMsMzkuODA3NjUsMzkuODA3NjUsMCwwLDEsMjEuNjcwOTItMjEuODM1MTgsNDMuNDE2NjUsNDMuNDE2NjUsMCwwLDEsMzIuNjcwMTIsMCwzOS44MTAxLDM5LjgxMDEsMCwwLDEsMjEuNjY5ODksMjEuODM1MTgsNDIuOTk0LDQyLjk5NCwwLDAsMSwwLDMyLjIzLDM5LjgxLDM5LjgxLDAsMCwxLTIxLjY2OTg5LDIxLjgzNTE4QTQxLjQ4NSw0MS40ODUsMCwwLDEsNDc0LjIwOTMzLDE5Ni42MzExNlptMC0xNC4wNzk4NWEyNi42MzcxNCwyNi42MzcxNCwwLDAsMCwxMC4yODQzMS0xLjk3OTksMjUuODk4ODksMjUuODk4ODksMCwwLDAsOC4zNjA3Mi01LjUwMDEyLDI1LjA0MjI5LDI1LjA0MjI5LDAsMCwwLDUuNjA5NjMtOC41MjUsMzEuMDQyOTQsMzEuMDQyOTQsMCwwLDAsMC0yMi4xMSwyNS4wNzk2MywyNS4wNzk2MywwLDAsMC01LjYwOTYzLTguNTI1NDksMjUuOTE0NSwyNS45MTQ1LDAsMCwwLTguMzYwNzItNS40OTk2MSwyNy42OTYyLDI3LjY5NjIsMCwwLDAtMjAuNTY5NjUsMCwyNS44OTIzMywyNS44OTIzMywwLDAsMC04LjM2MDcyLDUuNDk5NjEsMjUuMDM0MzQsMjUuMDM0MzQsMCwwLDAtNS42MDk2Miw4LjUyNTQ5LDMxLjA0Mjc5LDMxLjA0Mjc5LDAsMCwwLDAsMjIuMTEsMjQuOTk3MTQsMjQuOTk3MTQsMCwwLDAsNS42MDk2Miw4LjUyNSwyNS44NzY3NSwyNS44NzY3NSwwLDAsMCw4LjM2MDcyLDUuNTAwMTJBMjYuNjMxMTIsMjYuNjMxMTIsMCwwLDAsNDc0LjIwOTMzLDE4Mi41NTEzMVoiIGNsYXNzPSJjbHMtMSIvPjxwYXRoIGQ9Ik01NDguMTI5MzEsMTE2LjExMDgzaDE2Ljk0MDQ0bDI5LjU5MDUxLDc4Ljc2MDQ4SDU3OC4yNjk0Mkw1NzEuNzc5NjEsMTc2LjA2MUg1NDEuNDE5NDVsLTYuNDg5ODEsMTguODEwMzNINTE4LjUzOTgzWm0xOC44MTAzMiw0Ni4zMTA0LTcuMDM5NDEtMTkuNjktMi44NjA2LTkuNTY5OTRoLS44ODAxOGwtMi44NTk1Nyw5LjU2OTk0LTcuMDQwNDQsMTkuNjlaIiBjbGFzcz0iY2xzLTEiLz48cGF0aCBkPSJNNjM2LjY3ODczLDE4Ny44MzEzOGgtLjg4MDE5YTE4LjI2NDY5LDE4LjI2NDY5LDAsMCwxLTYuODIwMzksNi40MzUwNiwxOS45NDU0MSwxOS45NDU0MSwwLDAsMS05Ljc4OTQ3LDIuMzY0NzJxLTEwLjIzMDU5LDAtMTUuMjM0ODMtNi4yNjk3Ny01LjAwNjgyLTYuMjcwNTItNS4wMDUyNy0xNi43MjA0VjE0MC45NzA4N0g2MTMuMzU5djMwLjkxMDI3cTAsNS44MzIsMi41ODQ3Nyw4LjYzNSwyLjU4MzIxLDIuODA0ODIsNy41MzQyNSwyLjgwNTMzYTEwLjUwMDA2LDEwLjUwMDA2LDAsMCwwLDUuMjI1MzItMS4yNjUsMTIuMjE0MDcsMTIuMjE0MDcsMCwwLDAsMy44NTAyOS0zLjQxMDE5LDE1LjQ0MjkzLDE1LjQ0MjkzLDAsMCwwLDIuNDE5NDctNS4wNiwyMi42OTc0NiwyMi42OTc0NiwwLDAsMCwuODI1NDMtNi4yMTVWMTQwLjk3MDg3SDY1MC4yMDl2NTMuOTAwNDRINjM2LjY3ODczWiIgY2xhc3M9ImNscy0xIi8+PHBhdGggZD0iTTY2OS4wMTcyMywxNTMuMjkxMzhoLTkuNDYxVjE0MC45NzA4N2g5LjQ2MVYxMjQuNDcxaDE0LjQwOTR2MTYuNDk5ODRoMTMuMjAwN3YxMi4zMjA1MWgtMTMuMjAwN1YxNzQuODI5YTE1LjU0NTYxLDE1LjU0NTYxLDAsMCwwLC4zODUzNCwzLjU3MTM1LDUuNzkzNiw1Ljc5MzYsMCwwLDAsMS40ODQ1NCwyLjc3NzQ0LDUuNDQ5MTQsNS40NDkxNCwwLDAsMCw0LjM5OTg4LDEuODEzNTcsOC4wMDU0Nyw4LjAwNTQ3LDAsMCwwLDUuMDYtMS40MzAzbDQuMDcwMzQsMTIuNjUwMDdhMjMuODM5MjQsMjMuODM5MjQsMCwwLDEtNS40NDQzNCwxLjgxNTEyLDMxLjgwMjksMzEuODAyOSwwLDAsMS02LjQzNTA1LjYwNDg3LDE5LjY2NTI4LDE5LjY2NTI4LDAsMCwxLTcuMzE1MjQtMS4yOTA4NCwxNS41NDE1MSwxNS41NDE1MSwwLDAsMS01LjQ0NTM3LTMuNTM2NzVxLTUuMTcxMDctNS4wNTMzMS01LjE2OTUzLTE0LjM3MjcyWiIgY2xhc3M9ImNscy0xIi8+PHBhdGggZD0iTTcwNy43MzUsMTE2LjExMDgzaDE0LjQwOTR2MjIuMTEwNWwtLjg3OTE1LDkuNzloLjg3OTE1YTE3Ljg1NDQ3LDE3Ljg1NDQ3LDAsMCwxLDYuNjU1MTEtNi4zMjUsMTkuMzE0OTIsMTkuMzE0OTIsMCwwLDEsOS43MzU3NC0yLjQ3NTI2cTEwLjQ0OTA5LDAsMTUuNDU0ODgsNi4xNjAyNiw1LjAwMzcxLDYuMTYxMjgsNS4wMDUyNywxNi44Mjk5djMyLjY3MDEzSDc0NC41ODVWMTYzLjk2MXEwLTUuNjA5NjItMi42NDA1NS04LjUyNWE5LjQ0MDE4LDkuNDQwMTgsMCwwLDAtNy4zNy0yLjkxNDg0LDEwLjgyNDgyLDEwLjgyNDgyLDAsMCwwLTUuMjgwMDcsMS4yNjUsMTEuNzYwOTIsMTEuNzYwOTIsMCwwLDAtMy45MDQsMy40NjUsMTYuMDk0MjksMTYuMDk0MjksMCwwLDAtMi40MjA1LDUuMTE0NzgsMjIuNzQ4LDIyLjc0OCwwLDAsMC0uODI1NDQsNi4yMTV2MjYuMjkwMzRINzA3LjczNVoiIGNsYXNzPSJjbHMtMSIvPjxwYXRoIGQ9Ik03NjkuNzczNTMsMTk0Ljg3MTMxVjE4MS43ODExNXE2LjQ4OTc5LTYuMzc4MjQsMTEuOTg5OTItMTEuODc5OTEsMi4zMTA0OC0yLjMwOTcsNC43MzA0OC00LjczLDIuNDE3NC0yLjQxODE4LDQuNTA5MzktNC41MDk5MSwyLjA4ODg4LTIuMDg4ODksMy43NDA3OC0zLjc5NSwxLjY0ODgtMS43MDQ1OCwyLjUzLTIuNjk1MzEsMS43NTcyNi0yLjA4ODExLDMuMTM0MzYtMy43Mzk3NWExOC4xNjQxMywxOC4xNjQxMywwLDAsMCwyLjIwMDQ2LTMuMjQ1NDIsMTYuNDc0NzIsMTYuNDc0NzIsMCwwLDAsMS4yNjQ0OS0zLjE4OTYzLDEzLjAyNDQ1LDEzLjAyNDQ1LDAsMCwwLC40NDAwOS0zLjQ2NSw4LjQyNzYsOC40Mjc2LDAsMCwwLTIuODU5NTYtNi4zMjUsMTAuOTMzMDgsMTAuOTMzMDgsMCwwLDAtNy44MTAwOS0yLjY5NTNxLTQuOTUxLDAtNy43MDA1OCwyLjgwNTMzYTE0LjU5NzczLDE0LjU5NzczLDAsMCwwLTMuNzM5NzUsNi4zMjVsLTEzLjA5MDE1LTUuMzkwMWEyNC41NTU0NywyNC41NTU0NywwLDAsMSwyLjg2MDYtNi4xMDUsMjIuNzY2MzcsMjIuNzY2MzcsMCwwLDEsNS4wNi01LjYxMDE0LDI2LjQ0ODc1LDI2LjQ0ODc1LDAsMCwxLDcuMzE0MjEtNC4wNzAzNCwyNi44NjE4NCwyNi44NjE4NCwwLDAsMSw5LjUxNTctMS41OTQ1NiwyOS43MTg3OCwyOS43MTg3OCwwLDAsMSwxMC4zNDAxLDEuNzA0NTgsMjMuMDA4ODMsMjMuMDA4ODMsMCwwLDEsNy44MTAwOCw0LjY3NTIxLDIwLjkyOTIzLDIwLjkyOTIzLDAsMCwxLDQuOTQ5NDksNi45ODUxNywyMS4yODU1MSwyMS4yODU1MSwwLDAsMSwxLjc2MDM3LDguNjM1LDI1LjAwNjEyLDI1LjAwNjEyLDAsMCwxLTMuNDY1LDEyLjkyNDg2LDU2Ljg3NjY0LDU2Ljg3NjY0LDAsMCwxLTguNDE1NDYsMTAuOTQ1bC05LjQ1OTkyLDkuNDYwNDNxLTMuNzQwNzcsMy43NDA3Ny04LjQ3MDIyLDguMzU5NjhsLjQ0MDA5LjY2MDE0aDMwLjQ3MDd2MTIuNjUwMDdaIiBjbGFzcz0iY2xzLTEiLz48cGF0aCBkPSJNNDQ3LjAzNjIzLDI2NS4wNTgyNHYzMS45aC0xMC4xMlYyMTguMTk3NzRoMjYuODQwNDVhMjQuMjU2NjQsMjQuMjU2NjQsMCwwLDEsMTcuMzgwNTQsNi44MjAzOSwyMi43NTc2MSwyMi43NTc2MSwwLDAsMSwwLDMzLjMyOTc0LDI0LjIyNDYzLDI0LjIyNDYzLDAsMCwxLTE3LjM4MDU0LDYuNzEwMzdabTAtMzcuMTgwNTV2MjcuNTAwNTloMTYuOTQwNDVhMTMuMzc4LDEzLjM3OCwwLDAsMCwxMC4wMTA1NC00LjA3MDMzLDEzLjgwNTc3LDEzLjgwNTc3LDAsMCwwLTEwLjAxMDU0LTIzLjQzMDI2WiIgY2xhc3M9ImNscy0yIi8+PHBhdGggZD0iTTUwNy4zMTY0NSwyOTYuOTU4MjFoLTEwLjEyVjI0My4wNTc3N2g5LjY4djguODAwMjloLjQ0MDA5YTE0LjYwODA1LDE0LjYwODA1LDAsMCwxLDYuMzI0NTEtNy4zMTUyMywxNy41NjAzNSwxNy41NjAzNSwwLDAsMSw5LjQwNTE2LTMuMDI0ODYsMTguOTc3MDYsMTguOTc3MDYsMCwwLDEsNy40ODA1NCwxLjMxOTc2bC0zLjA4MDY1LDkuNzkwNWExNi43OTE4MiwxNi43OTE4MiwwLDAsMC01Ljk0MDIxLS43NzAxN0ExMy4wOTY3NCwxMy4wOTY3NCwwLDAsMCw1MTEuNTUxLDI1Ni40NzhhMTUuNDUyNzgsMTUuNDUyNzgsMCwwLDAtNC4yMzQ1OSwxMC43ODAxOVoiIGNsYXNzPSJjbHMtMiIvPjxwYXRoIGQ9Ik01MzAuNzQ1NjcsMjcwLjAwODI1cTAtMTIuNDI5NTEsNy44MTAwOS0yMC41NzAxOGEyNi42MjIyLDI2LjYyMjIsMCwwLDEsMTkuOTEwNTUtOC4xNDAxNXExMS45ODc4NSwwLDE5LjgsOC4xNDAxNSw3LjkyMDExLDguMTQxNzIsNy45MTk1OSwyMC41NzAxOCwwLDEyLjUzOTUyLTcuOTE5NTksMjAuNTcwMTctNy44MTE2NCw4LjE0MTctMTkuOCw4LjEzOTY0YTI2LjYxNiwyNi42MTYsMCwwLDEtMTkuOTEwNTUtOC4xMzk2NFE1MzAuNzQ0MTIsMjgyLjQzOSw1MzAuNzQ1NjcsMjcwLjAwODI1Wm0xMC4xMiwwcTAsOC42OTEsNS4wNiwxNC4wNzk4NGExNy4yODIyMiwxNy4yODIyMiwwLDAsMCwyNS4wODAwOCwwcTUuMDU5NTItNS4zODgsNS4wNi0xNC4wNzk4NCwwLTguNTgwMjUtNS4wNi0xMy45NzAzNGExNy4wNDU0NCwxNy4wNDU0NCwwLDAsMC0yNS4wODAwOCwwUTU0MC44NjQ2OSwyNjEuNDI5LDU0MC44NjU3MiwyNzAuMDA4MjVaIiBjbGFzcz0iY2xzLTIiLz48cGF0aCBkPSJNNjE5Ljk1NjI2LDI2OS41NjgxNmwxOS4yNTA0MSwyNy4zOTAwNUg2MjcuMzI2MjVsLTEzLjMxMDItMTkuOTEtMTMuMDkwMTYsMTkuOTFINTg5LjA0NjUxbDE5LjAzMDM2LTI3LjM5MDA1TDU4OS40ODY2LDI0My4wNTc3N2gxMS40MzkyOWwxMy4zMTAyMSwxOS4wMzAzNywxMi42NTAwNi0xOS4wMzAzN2gxMS44ODA0MloiIGNsYXNzPSJjbHMtMiIvPjxwYXRoIGQ9Ik02OTQuNDI0OCwyNDMuMDU3NzdsLTMzLjc3MDM1LDc3LjY2MDc2SDY1MC4yMDQ4NEw2NjIuNzQ0MzcsMjkzLjU0OGwtMjIuMjE5NDktNTAuNDkwMjRoMTEuMDAwMjRsMTYuMDYwMjYsMzguNzIwMzZoLjIxOWwxNS42MjAxNy0zOC43MjAzNloiIGNsYXNzPSJjbHMtMiIvPjxwYXRoIGQ9Ik0yMTEuOTMxLDM5Mi42MzUzNmMtMTAxLjM4MDI3LDAtMTgzLjg1OTMyLTgyLjQ3ODUyLTE4My44NTkzMi0xODMuODU4OFMxMTAuNTUwNzEsMjQuOTE3NzYsMjExLjkzMSwyNC45MTc3NiwzOTUuNzkwMywxMDcuMzk2MjksMzk1Ljc5MDMsMjA4Ljc3NjU2LDMxMy4zMTEyNSwzOTIuNjM1MzYsMjExLjkzMSwzOTIuNjM1MzZabTAtMzU0LjcwMzg5Yy05NC4yMDQ1LDAtMTcwLjg0NDU3LDc2LjY0MTExLTE3MC44NDQ1NywxNzAuODQ1MDlTMTE3LjcyNjQ4LDM3OS42MjE2NSwyMTEuOTMxLDM3OS42MjE2NXMxNzAuODQ0NTctNzYuNjQxMSwxNzAuODQ0NTctMTcwLjg0NTA5UzMwNi4xMzU0OCwzNy45MzE0NywyMTEuOTMxLDM3LjkzMTQ3WiIgY2xhc3M9ImNscy0zIi8+PHBvbHlnb24gcG9pbnRzPSIyNDQuNjAyIDExMi4wMDcgMjM5LjI5NSAxMzEuODQzIDI4MS45NTkgMTY2Ljg1NiAzMjIuMDU1IDE2MS45MTIgMjQ0LjYwMiAxMTIuMDA3IiBjbGFzcz0iY2xzLTQiLz48cG9seWdvbiBwb2ludHM9IjM0OC40NDkgMTk1LjU2MiAzNDguNDQ5IDE1OC43MzQgMjkwLjIwOSAxMDkuMTc5IDI0NC42MDIgMTEyLjAwNyAzMDAuMjA5IDE1Ni42NyA3Ni42NDIgMTU2LjY3IDc2LjY0MiAxOTguMDUgMzQ4LjQ0OSAxOTUuNTYyIiBjbGFzcz0iY2xzLTMiLz48cG9seWdvbiBwb2ludHM9IjE4MC40ODkgMjk3LjE3NSAxODUuNzk2IDI3Ny4zNCAxNDEuODcgMjQwLjU1OCAxMDMuMDM3IDI0Ny4yNzEgMTgwLjQ4OSAyOTcuMTc1IiBjbGFzcz0iY2xzLTUiLz48cG9seWdvbiBwb2ludHM9Ijc2LjY0MiAyMTMuNjIgNzYuNjQyIDI1MC40NDggMTM0Ljg4MiAzMDAuMDA0IDE4MC40ODkgMjk3LjE3NSAxMjQuODgyIDI1Mi41MTIgMzQ4LjQ0OSAyNTIuNTEyIDM0OC40NDkgMjExLjEzMiA3Ni42NDIgMjEzLjYyIiBjbGFzcz0iY2xzLTYiLz48L3N2Zz4=;rounded=1;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;879.1800000000001&quot; y=&quot;252.5&quot; width=&quot;81.65&quot; height=&quot;40&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-41&quot; value=&quot;Authenticate&quot; style=&quot;text;html=1;align=center;verticalAlign=middle;resizable=0;points=[];autosize=1;strokeColor=none;fillColor=none;rounded=1;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;914.99&quot; y=&quot;205&quot; width=&quot;90&quot; height=&quot;30&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-45&quot; style=&quot;edgeStyle=orthogonalEdgeStyle;rounded=1;orthogonalLoop=1;jettySize=auto;html=1;entryX=0;entryY=0.25;entryDx=0;entryDy=0;exitX=1;exitY=0.25;exitDx=0;exitDy=0;dashed=1;&quot; parent=&quot;1&quot; source=&quot;wUbSNccMbzvjAEwLt-_H-42&quot; target=&quot;wUbSNccMbzvjAEwLt-_H-37&quot; edge=&quot;1&quot;&gt;&#10; &lt;mxGeometry relative=&quot;1&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-42&quot; value=&quot;nginx&amp;lt;div&amp;gt;istio / envoy&amp;lt;/div&amp;gt;&amp;lt;div&amp;gt;traefik&amp;lt;/div&amp;gt;&quot; style=&quot;rounded=1;whiteSpace=wrap;html=1;spacingLeft=20;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;595.01&quot; y=&quot;250&quot; width=&quot;110&quot; height=&quot;50&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-44&quot; value=&quot;&quot; style=&quot;verticalLabelPosition=bottom;html=1;verticalAlign=top;align=center;strokeColor=none;fillColor=#00BEF2;shape=mxgraph.azure.load_balancer_generic;pointerEvents=1;rounded=1;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;602&quot; y=&quot;261&quot; width=&quot;22.5&quot; height=&quot;30&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-46&quot; value=&quot;Auth Provider&amp;lt;div&amp;gt;(Google, MS Entra, Keycloak, ...)&amp;lt;/div&amp;gt;&quot; style=&quot;rounded=1;whiteSpace=wrap;html=1;align=left;spacingLeft=50;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;800&quot; y=&quot;125&quot; width=&quot;240&quot; height=&quot;50&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-47&quot; value=&quot;&quot; style=&quot;shape=image;editableCssRules=.*;verticalLabelPosition=bottom;labelBackgroundColor=default;verticalAlign=top;aspect=fixed;imageAspect=0;image=data:image/svg+xml,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9Ii0wLjUgLTAuNSAyOCAyOCIgaGVpZ2h0PSIyOCIgd2lkdGg9IjI4Ij4mI3hhOwkgIDxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+LnN0MCB7IHN0b3AtY29sb3I6IHJnYig5MSwgMTE1LCAxMzkpOyB9IC5zdDEgeyBzdG9wLWNvbG9yOiByZ2IoMzQsIDUzLCA3Mik7IH0gPC9zdHlsZT4mI3hhOwk8ZGVmcz4mI3hhOwkJPGxpbmVhckdyYWRpZW50IGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIiB5Mj0iMjUuMzA5IiB4Mj0iMjMuNDU0IiB5MT0iMy40NzQiIHgxPSIyLjAzOSIgaWQ9IkEiPiYjeGE7CQkJPHN0b3AgY2xhc3M9InN0MCIvPiYjeGE7CQkJPHN0b3AgY2xhc3M9InN0MSIgb2Zmc2V0PSIxIi8+JiN4YTsJCTwvbGluZWFyR3JhZGllbnQ+JiN4YTsJPC9kZWZzPiYjeGE7CTxwYXRoIGZpbGw9InVybCgjQSkiIGQ9Ik0yMS43NDcgMTMuMmExMS4zNSAxMS4zNSAwIDAgMSA0LjE2NCAzLjk0NWMxLjA1OSAxLjY4IDEuNTg5IDMuNTc5IDEuNTg5IDUuNjk5djMuMTIzYzAgMS4wMjItLjUzIDEuNTM0LTEuNTg5IDEuNTM0SDcuMjgyYy0uNDc1IDAtLjg1OS0uMTQ2LTEuMTUyLS40MzgtLjI5MS0uMjU2LS40MzgtLjYyMS0uNDM4LTEuMDk2di0xLjU4OUgxLjAzNGMtMS4wMjIgMC0xLjUzNC0uNTEyLTEuNTM0LTEuNTM0VjE5LjcyYTcuMjcgNy4yNyAwIDAgMSAxLjI2MS00LjE2NmMuODAzLTEuMjA5IDEuOTIxLTIuMTc1IDMuMjMzLTIuNzkzLS40NjQtLjUyOC0uODE4LTEuMTQzLTEuMDQyLTEuODA5YTYuODggNi44OCAwIDAgMS0uMzMtMi4wODFjMC0uODc3LjE2NS0xLjY4LjQ5NC0yLjQxMWE2LjE3IDYuMTcgMCAwIDEgMS4zMTUtMS45NzNjLjU2OC0uNTczIDEuMjM3LTEuMDM3IDEuOTczLTEuMzY5YTYuMDYgNi4wNiAwIDAgMSAyLjQxMS0uNDkzYy4yNTYgMCAuNDkzLjAxOC43MTIuMDUzYTIuNjUgMi42NSAwIDAgMSAuNzEyLjExQTcuNDEgNy40MSAwIDAgMSAxMi45MjYuMzc3YzEuMTM0LS41ODUgMi4zOTQtLjg4NiAzLjY3LS44NzcgMS4wOTYgMCAyLjEyLjIwMiAzLjA2OC42MDNzMS43NzEuOTY4IDIuNDY1IDEuNjk5Yy42OTQuNjk0IDEuMjQzIDEuNTE1IDEuNjQ1IDIuNDY1LjQwMy45MTIuNjAzIDEuOTE4LjYwMyAzLjAxNC4wMDMgMS4xNTItLjIzOSAyLjI5MS0uNzEyIDMuMzQyLS40MjIgMS4wMDEtMS4wOCAxLjg4NS0xLjkxOCAyLjU3NnpNMTYuNTk0IDIuNjIzYy0xLjMxNSAwLTIuNDI4LjQ1Ni0zLjM0MiAxLjM3MS0uODc3Ljg3Ny0xLjMxNSAxLjk3My0xLjMxNSAzLjI4OHMuNDM4IDIuNDI4IDEuMzE1IDMuMzQyYy45MTIuODc3IDIuMDI3IDEuMzE1IDMuMzQyIDEuMzE1czIuNDExLS40MzggMy4yODgtMS4zMTVhNC41NCA0LjU0IDAgMCAwIDEuMzY5LTMuMzQyYzAtMS4zMTUtLjQ1Ni0yLjQxMS0xLjM2OC0zLjI4OC0uODc3LS45MTQtMS45NzQtMS4zNzEtMy4yODktMS4zNzF6TTguNjUxIDUuNzQ5Yy0uODQyIDAtMS41NzEuMzEtMi4xOTIuOTMxLS41ODQuNTg0LS44NzcgMS4zMTUtLjg3NyAyLjE5MmEzLjA5IDMuMDkgMCAwIDAgLjg3NyAyLjE5MiAzLjA5IDMuMDkgMCAwIDAgMi4xOTIuODc3aDEuNzUzYTcuOTggNy45OCAwIDAgMS0xLjE1LTIuMTM3IDcuNjMgNy42MyAwIDAgMS0uNDM4LTIuNTJ2LS43NzFhNC4wMSA0LjAxIDAgMCAxIC4xNjMtLjc2NmgtLjMyOHpNMi42MjMgMjEuMzExaDMuMjMzYy4zMy0yLjUyMSAxLjM2OS00LjYwMyAzLjEyMy02LjI0N0g3LjI4M2MtMS4zMTUgMC0yLjQzLjQ1Ni0zLjM0NCAxLjM2OS0uODc3Ljg3Ny0xLjMxNSAxLjk3NC0xLjMxNSAzLjI4OXptMjEuNzU0IDEuNTM0YTcuNCA3LjQgMCAwIDAtLjYwMy0zLjAxNGMtLjM4My0uOTIxLS45NDItMS43NTgtMS42NDUtMi40NjVhNy4yNiA3LjI2IDAgMCAwLTIuNDY1LTEuNjk5Yy0uOTcxLS40MDYtMi4wMTUtLjYxMS0zLjA2OC0uNjAzLTEuMDk2IDAtMi4xMTguMjAyLTMuMDY4LjYwMy0uOTEyLjQwMy0xLjczNi45NjgtMi40NjUgMS42OTlhNy42NyA3LjY3IDAgMCAwLTEuNjQ1IDIuNDY1IDcuNCA3LjQgMCAwIDAtLjYwMSAzLjAxNHYxLjUzNGgxNS41NjF6Ii8+JiN4YTs8L3N2Zz4=;rounded=1;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;810&quot; y=&quot;132.5&quot; width=&quot;35&quot; height=&quot;35&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-48&quot; style=&quot;edgeStyle=orthogonalEdgeStyle;rounded=1;orthogonalLoop=1;jettySize=auto;html=1;exitX=0;exitY=0.75;exitDx=0;exitDy=0;entryX=1.001;entryY=0.64;entryDx=0;entryDy=0;entryPerimeter=0;dashed=1;&quot; parent=&quot;1&quot; source=&quot;wUbSNccMbzvjAEwLt-_H-37&quot; target=&quot;wUbSNccMbzvjAEwLt-_H-42&quot; edge=&quot;1&quot;&gt;&#10; &lt;mxGeometry relative=&quot;1&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-49&quot; value=&quot;Request authentication&quot; style=&quot;text;html=1;align=center;verticalAlign=middle;resizable=0;points=[];autosize=1;strokeColor=none;fillColor=none;rounded=1;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;710&quot; y=&quot;235&quot; width=&quot;150&quot; height=&quot;30&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;mxCell id=&quot;wUbSNccMbzvjAEwLt-_H-50&quot; value=&quot;Respond with 200 or 401&quot; style=&quot;text;html=1;align=center;verticalAlign=middle;resizable=0;points=[];autosize=1;strokeColor=none;fillColor=none;rounded=1;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#10; &lt;mxGeometry x=&quot;710&quot; y=&quot;275&quot; width=&quot;160&quot; height=&quot;30&quot; as=&quot;geometry&quot; /&gt;&#10; &lt;/mxCell&gt;&#10; &lt;/root&gt;&#10; &lt;/mxGraphModel&gt;&#10; &lt;/diagram&gt;&#10;&lt;/mxfile&gt;&#10;"><defs/><g><g data-cell-id="0"><g data-cell-id="1"><g data-cell-id="wUbSNccMbzvjAEwLt-_H-56"><g><rect x="525" y="71" width="500" height="350" rx="21" ry="21" fill="#f5f5f5" stroke="#666666" pointer-events="all"/></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-57"><g><rect x="525" y="9.5" width="500" height="55" rx="24.2" ry="24.2" fill="#4a4a4a" stroke="none" pointer-events="all"/></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-55"><g><rect x="10" y="71" width="500" height="350" rx="21" ry="21" fill="#f5f5f5" stroke="#666666" pointer-events="all"/></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-54"><g><rect x="10" y="9.5" width="500" height="55" rx="24.2" ry="24.2" fill="#4a4a4a" stroke="none" pointer-events="all"/></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-7"><g><path d="M 105 149.23 L 105 225.63" fill="none" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 105 230.88 L 101.5 223.88 L 105 225.63 L 108.5 223.88 Z" fill="rgb(0, 0, 0)" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="all"/></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-2"><g><path d="M 77.09 102.17 C 75.93 102.17 75 103.1 75 104.25 L 75 138.62 C 75 139.77 75.93 140.71 77.09 140.71 L 98.69 140.71 L 98.69 144.02 L 93.15 144.02 C 92.6 144.02 92.07 144.24 91.68 144.63 C 91.29 145.02 91.07 145.55 91.07 146.11 C 91.07 147.26 92 148.19 93.15 148.19 L 108.31 148.19 C 109.46 148.19 110.39 147.26 110.39 146.11 C 110.39 144.95 109.46 144.02 108.31 144.02 L 102.86 144.02 L 102.86 140.71 L 124.39 140.71 C 125.55 140.71 126.48 139.77 126.48 138.62 L 126.48 104.25 C 126.48 103.1 125.55 102.17 124.39 102.17 Z" fill="#032d60" stroke="none" pointer-events="all"/><path d="M 100.74 116.08 C 103.76 116.08 106.15 118.48 106.15 121.49 C 106.15 124.5 103.76 126.89 100.74 126.89 C 97.73 126.89 95.34 124.5 95.34 121.49 C 95.34 118.48 97.73 116.08 100.74 116.08 Z M 100.74 131.07 C 105.13 131.07 108.02 133.59 109.52 136.54 L 92.08 136.54 C 93.45 133.63 96.07 131.07 100.74 131.07 Z" fill="#ffffff" stroke="none" pointer-events="all"/><path d="M 79.17 106.34 L 122.31 106.34 L 122.31 136.54 L 114.04 136.54 C 112.92 133.38 110.59 130.31 107.21 128.51 C 109.11 126.75 110.33 124.26 110.33 121.49 C 110.33 116.22 106.02 111.91 100.75 111.91 C 95.48 111.91 91.17 116.22 91.17 121.49 C 91.17 124.25 92.38 126.74 94.28 128.49 C 90.83 130.32 88.57 133.45 87.53 136.54 L 79.17 136.54 Z" fill="#0d9dda" stroke="none" pointer-events="all"/><path d="M 89.02 109.6 C 86.83 109.6 84.85 110.8 83.85 112.49 C 82.85 114.18 82.57 116.17 82.57 118.32 C 82.57 119.48 83.5 120.41 84.66 120.41 C 85.81 120.41 86.74 119.48 86.74 118.32 C 86.74 116.6 87.05 115.27 87.44 114.61 C 87.83 113.95 88.04 113.77 89.02 113.77 C 90.18 113.77 91.11 112.84 91.11 111.68 C 91.11 110.53 90.18 109.6 89.02 109.6 Z" fill="#ffffff" stroke="none" pointer-events="all"/><path d="M 119.18 115.08 C 116.21 115.08 113.75 117.53 113.75 120.5 L 113.75 143.81 C 113.75 146.78 116.21 149.23 119.18 149.23 L 129.58 149.23 C 132.54 149.23 135 146.78 135 143.81 L 135 120.5 C 135 117.53 132.54 115.08 129.58 115.08 Z" fill="#032d60" stroke="none" pointer-events="all"/><path d="M 119.18 119.25 L 129.58 119.25 C 130.31 119.25 130.83 119.77 130.83 120.5 L 130.83 143.81 C 130.83 144.54 130.31 145.06 129.58 145.06 L 119.18 145.06 C 118.45 145.06 117.93 144.54 117.93 143.81 L 117.93 120.5 C 117.93 119.77 118.45 119.25 119.18 119.25 Z" fill="#0d9dda" stroke="none" pointer-events="all"/><ellipse cx="124.34" cy="140.7" rx="2.1290799779998864" ry="2.1290799779998864" fill="#ffffff" stroke="none" pointer-events="all"/></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-4"><g><rect x="10" y="22" width="500" height="30" rx="4.5" ry="4.5" fill="none" stroke="none" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 498px; height: 1px; padding-top: 37px; margin-left: 11px;"><div data-drawio-colors="color: rgb(0, 0, 0); " style="box-sizing: border-box; font-size: 0px; text-align: center;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; pointer-events: all; white-space: normal; overflow-wrap: normal;"><b><font face="Verdana" color="#fafafa">OAuth2 Proxy as a standalone</font><font face="Verdana" color="#505050"> </font><font face="Verdana" color="#21ff46">reverse-proxy</font></b></div></div></div></foreignObject><image x="11" y="30.5" width="498" height="17" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB8gAAABECAYAAADtEW++AAAAAXNSR0IArs4c6QAAIABJREFUeF7sfQeYZEW1/zm3u+rOBtICktnpBUVJEkSCigvs9ICCTxTMEbOoD0XFpz6MD58Zn4gB4/ubEDARpxcQQUVJIhgeskwPSSTH3Zlbt/uef5/ZO+uEe6uq00zP7Knv2+/bb7rir+rWrVu/c34HQZIgMO8QQACgeddr6fDCRkBW5cKeXxmdICAICAKCgCAgCAgC8wMBOZXOj3mSXgoCgsD8QUD21fkzV9JTQSAHAXmMZWkIAoKAICAIZCDArwdJgoAgIAgIAoKAICAICAKCgCAgCAgCgoAgMAsIyB3tLIAsTWykCMjTtZFOvAxbEBAEBAFBQBCYfQR66NjRQ12Z/XmQFucVAr22VoUgn1fLRzorCAgCgoAg0BYCvfYWbmswUlgQWMgIyMO6kGdXxiYICAKCgCAgCAgCgoAgIAg0j4B8IzSPmZQQBAQBQUAQEAQEgTwEhCCXtSEICAKCgCAgCAgCgoAgIAgIAoKAILDRISDX7BvdlMuABQFBQBAQBAQBQUAQEAQEAUFAEBAEBIFxBIQgl4UgCAgCgoAgIAgIAoKAICAICAKCgCAgCCxABMQIYAFOqgxJEBAE5gYB2VDnBndpVRAQBAQBQUAQEAQEgS4hIAR5l4CVagUBQUAQEAQEAUFAEBAEBAFBQBBYWAgIO7Cw5lNGIwgIAoKAICAICAILFQE5tS3UmZVxCQKCgCAgCHQKASHIO4Wk1CMICAJtICDH9jbAa6Ko4NwEWJJVEBAEBAFBQBAQBAQBQUAQEARmCQH5UpkloKUZQUAQEAQEAUFAEBAEbAjIoSwHnYUFzMIaTeuPtBDkrWMnJQUBQUAQEAQEAUFAEBAEBAFBQBAQBASB+YmA3IrMz3lbCL2WtbcQZlHGIAgIAoKAICAICAKCgCAgCMxrBIQgn9fTJ50XBAQBQaD3ECCiMI7jPYioHxG3R8QlAKABYIyIHguC4K56vX6b1vrviJj03gikR74IGGN+AwDPysuPiOcppY7zra8b+YgIx8bGliulnpYkyVYAsCkibgoACa/HdE2OFIvFPyHiE93og9QpCAgCgoAgIAh0HoHeYBjXrVu3Y7FYvNM2PiI6PgzDczuPQWdqnA/nmc6MVGoRBASBriDQG9txV4YmlQoCgoAgIAgIAoKAILCQERCCfCHProxNEBAEBIFZQmB0dLRULBZfRkQvAID9UkLc1frjRPQbRPxFg7w8GxEfcRVo53ciWhTH8T+ZIPWo51da68M98m3UWXrxQpmINjXGHIaIhwHAIQCwOwCwkYYrEQDcQkTnEtH3+vr61rgKdON3Y8x1ALB/i3XXASAiokcQ8R8A8HcAuDZJkl/29fUNt1inFGsRAbkrbRE4KSYICALzCgEhyOfVdElnBYGNDIFeOI31Qh+6Me0LdVzdwGp+1ikzPD/nTXotCAgCgoAg0BwCs0qQy8u1ucmR3IKAICAI9DoCURTtEQTBJ1NiPGijv+sA4NtKqY8j4v1t1JNbNIqiVyDiDzzrpnq93r9o0aI7PPP3dLaxsbEViPgaWye11mci4n3NDKSXCHJjzDOJ6FREHPA00HAN9QdKqXd3az3mNd4mQW4b0/UNdYdPhWF4nmvg8rsgIAgIAr2CABEFxphTbf1BxIu01tf0Rp974Yt3dvsgBHlvrDzphSAgCAgCgoAgIAgIAoKAINB7CMzut0nvjV961OsIzCpB3utgSP8EAUFAEBAE/BAgImWM+SQingwABb9SXrkeA4CTtNbf8crdRKYoii5BxEHfIoj4YaXUf/nm7+V8cRyvIqLVtj4S0V5hGP65mXH0EkEeRdFHEfEjzfTfI+9DiHi0Uupqj7wdydJFgnyif1fXarXjFy9efHdHOiyVCAKCgCDQRQSIqBjHcexo4p1a6zO62A2p2oKAEOSyPAQBQUAQEAQEAUFAEBAEBAFBYH4jIET+/J6/1nsvBHnr2ElJQaA9BGTfbQ8/KT1nCBDRVnEcnw8AB3WxE+xN/pYGSV3rRBtr167dTinF8TGbIfP/rrXerRPtz3UdQpC3NQNstDEwW96Js0CQAxH9g4l/rfUf20JGCgsCs4iAHJtmEeweakoI8h6ajJyuCEHe+3MkPRQEBAFBoFMIyHmsU0hKPYKAIDB7CMyznWueddd7HhfquLwBkIy9ioAQ5L06M9IvQUAQEATmEoGcg0tKjl8FAE/tdvc4NnmxWHwxInJc5bZSHMfvI6LPtFDJwVrr37dQrqeKCEHuPx05S/8WpdTeiGj8a2ot52wQ5NwzIrpba70XIj7cWk+llCAgCAgC3UdACPLuY9xuC0KQt4uglBcEBAFBQBAQBDZuBIQ327jnX0YvCAgCc4GA7LwTqAtBPhfrT9oUBAQBQWAeIkBEOo7jX3fZc3w6Ml/TWr+tXbiMMTcBwF4t1PNVrfXbWyjXU0WEIO/IdLxHa/3FjtRkqWS2CPK0Cz/SWr+i22OS+gUBQUAQaBUBIchbRW72yglBPntYS0uCgCAgCAgCgoAgMD8RECpqfs6b9FoQEAQWPgIbNUEuL6eFv8BlhIKAINA5BIwxnwMAjjnukx4HgO8i4oX1ev3WMAwfiaJoK0RkL9wXAsBLAaDoUxERvTQMw5/45M3KY4zZFwBuaLH8Q0qp7WbDc7jF/nkV28gJcpbWvxgA/khE9wRB8FiSJFsCwD6IyOtwVy8QAa7XWj/DM2/L2TwJ8u8DwL3TGtGIuBMRPRcAtvDtABHtHYbhzb75JZ8gIAgIArOJwEZJkM+zj1QhyGfziZC2BAFBQBAQBAQBQWDWEZhnZ7NZx0caFAQEAUFgHiPgQZDLW2Aez690XRAQBASBjiBgjHl6SjIHrgoR8bxisfh2RLwvL28URU9FxO8BwDNd9QHA/UqpXRGRY0E3nYwxpwPAvzddMC1ARC8Ow/CnrZbvhXIbIUEeAwAbVXxJa31t3hwQUaFWq32IiD7mM09xHG+/ZMmSe3zytprHkyA/QGt9XVYbKZn0GgDgdb+Jqx9E9N9hGP6HK5/8LghkISBfCbIuuo3ARkmQdxvUFurnEDsAwGfARxExmlyFEOQtACpFONQLG8puYYzZMgiCLYjIJEnycBiGDyHiIxs9RAS4Mzx/c4JkWRGSLQkIA6g/HIB+eA1c/AAgECzUl7DP2Df6BdIcAFvTyqVLIdgygWAZQLCIoPAIQvLwVvDAA9fj9fzdJEkQEAQEAUFAEBAEBIGNEgEPgnxh4bJQvyF6ZpY6AHAHqugZOKQjgsBCQSCKoosQ8agp48l+WL+ulGJyPHGNnYiWxnF8AQCwx6s1NYjMT4RheKor3/Tf04v1uwHgSc2WnciPiL9USv1bs+UbMc8Xx3H8FFs5pdQaRHzClseznr8j4rq8enqJIB8dHS0Vi8UX8bwT0fYAsDUArGWPaCL6HSKe30rc9yiKPoqIHwGAs2u12vsWL17MnuNeyRhzZqN9p5Q/Ij5bKfVbr0pbzNQuQT7RbBzHK4nospTQsPXmaq31IVkZjDH7ONbvXYj4QFYeDskwNja2XaFQ2BwAUCl1MyLWfWAhom2MMSsR8VAA2A8AmJhZBgCbMjkDAA8BALd7AxFdqbX+NSJO96jPbIqItozjeCdXP5RSdyPi/a58/Pu6det2KhaLrEpgfZSVUn/2xcCn3V7JQ0Sb1mq1vYhoTwDYDRF3JqLliLgtES0BgMWpYshaIlqLiI8TURUR/w4Af67X65csWrTojk6NxxhzECLy+t8bAPbgOUdENhbhvqwjoscR8WFEvCVJkr8CwJ+01lf5rqFO9LPXMGt3TGNjY7sEQcBnBDam43Am26bPK+POF+9s4PYYEd3WUO74G897kiS/6evr4zVgf3CIinEcuy7v36m1PsNVV9bvTzzxxLZhGHK/ea3skq7d5em64bXL64bPNLx+1yEik3drkiS5FdYriwwhIu9LTSVuV2vNOOXtVbUwDP88+Uci2iKO42MAgLHeGQC2AwDeV3mvupGIKlrr8zuxz7BhJBEdj4gvAAA+y4QTfSGifwZBcHWSJOdprX82Ojq6rFgsWt+5XFcYhue6QJqr+TDG/AYAnpXXPzb+bOzhx7n6n/X72NjYbkEQ8FmX32lPS99n/M5gTB8GgAcB4J9EdHUQBFcWi8XfIiKfi5pKvb6meDB8NkmSZBARGQ9W5VE5g+T1xOet1UqpHyLiWFNgtJl5FxrctQ7J0vxqCo+M4CUj2Q8vBMthcJsAcGuCehAAVYfxUq89YjmteloBAv7mOJTWr0c+92SlRxDgagC4kqD+nSpe5nUGahOWrhafrbH304D1bKshvuvveEXm2XZ3Ol6PwoPbASg2XMAR2PxmwHOcZ9t+WnVQAMHKBHBvBNqDALbE9Uas4+eShkLb4zS+F9AtCDh+LgGoX9XOvD6FVm5lIDwuAHourd97+JsrK0UEcD2OP2/B96t4CYclm9dpRzp4UQib7EKA2yZASwngvgIkdw3jpU2fNdmwYAkoh9pY/H8jeEXmHrUNlZcsgfoOCQSLEQqjVbzkFi9w6fhCPzx8AAAeioDPbijz9RPAMgTi7yH+tOL3xkMAOAJAvyGAK0dgs+t81iOXLtHhywkKTsWxGjxxy1149ahPn/kZRsANZ4WsMk1h4NOo5BEEBAFBQBAQBDqAwEZHkHcAs85X4cMI++TpfM+kRkFggSAgD1A7E5le7PGFtuud8Uel1IGI6LrI3tCdtWvXbsekUXpZaOvmA0qpnZq9IBsbGzs6CILzLRUnDdn3nxKR7dIzVkptn0cE5tXNJA2sv7zKTYg4oJS61JbHpx4AOHg6qWyM4XqPaGfuJ5dVSm0x3aOnmQvlKIqYNDkNEY/26NPlSZK8ua+v7zaPvONZjDH7IWKfUup3vmUm8o2Oju5cKBRud5XjdRKG4XmufO383imCPMXkx2k4A1uXHmwQS0xAT0mteG3y86y1fj0R8RwfOJmcz1o/UxpEABONK1W8P+1zoQkc+XLyx0T0aZdcfEowXc93Q476/6KUOgARrZdCqefknzz2sK9prd+W5v+ZYz/9rdbaW/XCGMNKHGzkkZuSJPl4X1/fL5vA1Jl1bGxsRRAEF6Xkmev94KrvTw1joM9orX/UMHQhV+aM9bq0Vqu9h4hOAIDlzZZP8/+JSbAois5aunTpP1usw1qslzBrd3wN5Q2M4/hVjQvad6VEVytVMgn2CyI6KwzDDZfycRx/mA3jWqkwqwwRHRuG4c8n/xZFERtqnYGITDK3k2pEdCkifqwZ464oij7ZOC99yNLwhr2ZiLZmTBok6lsb71Ht6CwbzL1TKVVpZVBjY2NPLhQK/01EjI9PYoKXie832TK7CPK5no9mzjM+oPDzEUXR84MgOAUAmNxoJj1KRGdqrU+3qTFNr7BX1xQRBcaYlzTep4yFlZzMAel+RDy9WCx+uhPGHz4TUaKy1WCiYQh0XhUrG74dmJBTsMkrGoYqHEbq8NQwbLwpAjh2BCtT9p/pfVhORx4cAH0AgNgAptn3KSs6fN9A/ZS78TImzWakFVR+JQFweJ7cRACnj2Dl3T74cJ4Slfm5f7Elv1FgdsgjmyfKdXvsU/pHK4sl0I7vVHxnFYc2GFwtp8HtAkheDzD+/TLlbEtgthjBKzLVDtYTq+F7EJITALDlcwkAnUegzhrBi7zOJUx8AhTeCwBvAMBFvvM5Kd9qAHxfFYf4bDunqUTlb5JlzwgALxvGId5X+EHD5TDwQgR8NQIdmTN2JqfPQUg+52u0soIGVxHQahsQAcBet2Flg0FbiQafTkCvRYDnseHopLJ/qmLFugfyXqJhk9cRAM/hiiYnYJgAPwsQfTePsJ+or0SDzwSgq1xnCgL6zgiu5rO1Na2gwecTEDs+WBMBvHwEKz/up8F/A6D/tGVGwP+p4tD/uuqc+H0Fld+WjK/77IQAFEPthXfh5ew8IUkQEAQEAUFAENiAQLOHb4FOEBAEBAFBoMMI9Dp9H0XRfzVicH/QNWxEfFYr5KQx5u0NL+KvuOpvReo8juOf8KWspe4rG6T7B9hz2dH+u7TWX3b1cfLvPsT2xkCQF4vFV8dx/OmGh9uJHt7MkyFkL+Hnaa3/0AzureY1xrD3jVVpgIheFobh2a224VOuwwT5mxsehl93tFvXWrPM6ZTUDEHOXsLGmFMbXrlM6mZ6DtgIcvY2j+P48w2v8Hf4YGTJw8Tql5RS70PEWl6+1DOen3nXxeFXtda8P2UmvvSP4/hyDxWMq5VS7BFvuCJjDK9pW3gJo5Tajj1VffDwUEBYlxr5eHmw+bSZjoMv+f7om98z37VKqWOa8eaOooj3+P9hj3XPNlzZ/L2Rm3yBp2tvzjFzAeD6PYqivRHxO6nCgyu78/fp3rmzQZAbY04CgC86O9dchm8rpd5i238mqvMlM40xTDx/AQAs3qwzOslGQydqrV37/5SCURS9GBGZROtrbtju3C6CfK7no2mC3PLsp57cbKDmVEhyIMeepW/TWnsRBL24plLjjh80vMEH3KvEmePXxpiXdcuAaXLrzRDkJSozIXNa3hnSSpCvJ2w/BevJsHbTnQRw/AhWZpyb+2llH4LmEEGs6pN9pgG4ewQqO41LtzsSe8UuBuBQWqyykVfjT6q4+qX5P8/O2Ke03wRBvt7zF08loNyzbR5BXqKB4wHwf1I1FRecHr9PJe3zCqSGELzvs2d6O2kMAU4cxsq326mk3bK+z2GJBp8DQPyeZFUKn8TGBm+uYsVmRD9eTzMEeeqV/QUEzDMwsxLk/VQ+ENeHCGOFmHbSCAIdP4yrM8NxTVTcT4NvRaCvuhvCl1ZxiPuVmfrpedsi1NjIkVXhLIk+X8XV43vdzvT8LQoQ/8Nx3riuipUD3P1bn2MFDfyFAHe35P9tFSvNGqz5Ni/5BAFBQBAQBNpBoMl7lXaayiorBHmnEZX6BAFBQBBYYAgYY25ueAexdK4t3dCQ9dy/laEzuRbHMVvybuYo/z2t9et82yCizeM45g9gm9TXiUqpr8ZxzDKJto9RllH1/ege76IQ5OMwMBHEF+0sKdp0IqK7tdb7NOu933RD6+dr2OVVjIhlpZTVi6CVtieX6SRBzh55TDw5+hRprWeQIb4EecOI4RoA4Mtvq/xgHkHOcupxHP8i9cppF76J8r9RSh1rWzfGGN5LmOCzpiRJXtDX15d5geZD4rEUca1W229y7HpjzBsB4CxH00xuWb3CuXw6T3zpvUEFIOPb4ptaa6t3pwuHrN+7RPZyU8OpGkmmxOnkvkRR9BFE/Ggr/beU8SfIm2y4FzBrssszstdqtecnScLkXzOErbXZBUSQg29YFg8yk0MBXEE07lHaSqoh4uFKKfYQcyZjDBtU8UU5xxnveJojgtx7PpomyHMQ4rMfEf2sgwY73NKZSql3usIX9eCaYpn+CxFxhw4uqJuVUge3IkHfTB98iDmC4jsQamy8YCX/8wjyFbRqM4LgQpu0fzN9TvM+UQA8aA0O/WV62RINngFAbKxqSXhoFYece0Y/lV+GAD9y9K9cxUrmmXm2x76hn54E+fqzLTnPtlkEeT+VP9I4h3X4XOImyEtUZkL+nS2sGdt6eG0zHrydbXtcpcCh5EAXAgS3ABArHzR7t11DwJcN45D1O8mXIK8D7I8AbEzP0vl5KZcg76fym9PyLpUYX5hZOv8tI1j5nq3AChr8DgG57lc4Xv3TMyXqCbAE5SGPffDyEdisPFkCvkRlNsh7pa1/dSjscQdezGEHrIlDJyCg1QAVAV41jBV+riUJAoKAICAIzBcE2ibO/Spo9hAxR/D5DWaOOifNCgKziIA8C7MItjS1nnxhkpm9GF3vi3ezFGSroBljvgsAr3WUH9Za7+LbhjHmLQ3L/a9Z8teVUjuwp2IURZ9txAK3em8Q0R5hGDo/0CbaE4Lcd6ac+U7XWntLPjpry8hARCqOY46Ra/Waq9VqOy5evLirsmydJMg9ngFG4w6t9QzpR0+C/Ncs7++S5+NGsghyIuprxCO9osPk+MQMX6mUWmUL+WCM4f2B9wlbeiCO470nE9yc2RjDMpt8cTfD+35SZTEiHjY9bj0RLY3jmEltG8F4rdba5mU+3kxKVrokDZ+htWZZ+Y6mLpK93M/va61fbetwSug15SHrCcB8JMi9MPMcf2621HOcvRM76mG8kAjyFLw3aq2/ZcPbg8xsd7q4/B+11vu5KkrPK1da4kG7qnD+PlcEue98dIIgHxsb2yUIAn4+OL54RxMRfSoMQ6uaUy+tqbVr125fLBav6TA5PoHpj7XWL+8owNMqcxNzMBEeKi+u84YaMwny9UQthyjphGf9dCjWPAFm3/vxiicm/7CcVu0bQHCDA7czq1hxkOgcDLn8UwQ41lLXSBUqKzK90edg7P+aDB+JdfA+204nyFOSswvnEjtB3h1Sfhy1MQI6eARX39jN5y2vbo/nsN1uxQB4gE1O3ocgBwAOaVL26EwmQb6cBo4NYNyg2XXf4tHElCxJAnD07Vi5OK9gGh6CVbVc4S+uqsJmh02PcV6iMt+ffNbeMbpdQfyM6eEW+mnguQjI34G29NkqVjj8ljWVqMx9sNzl0AMFKO64Bi/mkBQLL8k18cKbUxmRICAIzCoCnX4Bz2rnpTFBQBAQBASB7iIQx/HhRHSZRysHaq3Zk7Sl5OlRySTbsoaMM8e7dCZjzG8bH6yHWDJeprVexb8bY9g7/FpbpWl84w84G04ztE+Qr//S8amnV2OQ+2KVlW/Sd97jqdz02nbqs5VtkLQriehXjvpHtNauuNVtd7HDBDl7DbzG0alfa61XTs/jSZB7jzcnhr2PYcxEGxzjkY0YljXhufoVrXWubHuDcAjjOGZPKZd836WN8BHlidjYRLRpHMfspeCKDfh2rXWmdKEx5hseMXt3D8PwbzaQjTE/BAAbUeBFtHtP5KSMDoKc54vlV9nAir1htmh4zbMXobdnTJIku/T19bGyw4y0bt26HYrF4hoPopalpm9AxDuI6FFE3Iwlf1NVizwpyLkiyLuKWStzPLkM78mRMRyTdG+PujgO9v8REcfD5VAGjHU/AGQaufUgQc4hN+5vXLYywdTHSheIuE0T3tWZhkeTcZslMpM9qA+1eZGnKj7sbdpqjNzc5TD5vrZNgrzr89EuQU5Ei+M4ZjlbH8UclrDmuNom3Y9sSkcb8CWil4RheE4e4D20popxHP8eAHKVpYjoH0EQfDFJkou11lUAqI+NjW1fKBT4XP4fLkUfADiomyF4OknMZRHkK2jgdILxsDR5aYwAvkoQnFOA2l+Hoba2HxZvBVA/EIFOBoDnWL9ZgE4ZwdWfmZ6nRIM3ANC+lrL3VWGz7aeTYJPzc2ztpaB5f7QYStGpVVz9iax25mrs433x8iD3eMOlWSYT5DvS4Tso8D2X0A0AeAcBPIrrFdQc55J8gtyHXCWgnwYA30LA624D81A/wFKEcC8EOMHlPYwAFw9jhWNpz3rq5HOY3fnxt9QfqlA5BBCS7PXqjkHeBDAzCPJdaXCPOhAbVvnI4scEcB8CFNKQDj6KL48GgM+4DYf4zJyZdqYjVhSgwO8vPqtb0tTnejkN7hcAXe04248lgM+6HYcyjXNKNMgKAE+xNHpPFTbbybYnAUFQgvLtALCjpR4vor2JuZSsgoAgIAh0HgExduk8pp41CkHuCZRkEwQEAUFgY0TAk7jmeLlLbZ6aLuyiKNoTEVnK3ZX211q7vB9gbGxs1yAIbnVU9hatNZNU48kYwx+OuR7qqdz3zi6Jy0n1HQQA/NGYm7oZgzyKoo8FQfB0bjy9gLUZC3C2yxHx8bzOFovFV06XtHRdKGfUNUZEDyEie85u6prsid8R8QilFMd67koyxnBc8ZfYKm9cfn8mDMNTutKBSZV2iiBPCUR+Bqxxthvr+VSl1IxLzG4T5MYY9o72iS//nSRJTuvr6xu/2CEijOOYvRx4LvJjW67HNCGivcMwnCE1OgH5unXrdioWi7ynbJAoz5pjRHy/UmrcQ8IY45QEZPl2rfUJeevFGMOkvNWoyLXmUmLLEQMUTmgoBDil5FtZ19MIcjZeYG+4SpIkV/b19d02vc5UqYG9WV/BcXVd3qqs6qGU4tj0M1IURR9tGCx8xPHMfkJr/QVEZOI5q449OGwCALDk/eSYhbNFkM8qZq3M8eQyPoZEiPiLer3+HpthQ6FQOAwRWTHmiAlvqekEOceVb7zDJ2Q3kYhe4Oj/TY06mWTLTOx9O51MmxzzGhHvIqKfE9HlWuurssIzENEm9Xr92Y2wCW/16A/3w6rc0AKZWSOiBxCRjUw4jrDPxTjvmZ8Iw/DUPGziOH5vYy9xeH+Nl2ZC93QiukgpxWFpxsbGxrblcwYivhAArBKtzRDkczEfrvPM9DU6Hc84jt/PhpSOdRrxvlUsFr+JiGw8wvOja7UaG6N+0kYop/XeqZTalYn1nD3tk42z+IeaeNa7sqY81D1Y4eUYROQ9cEZK1avYyDU3lizvNUopXnddSZ0k5qYT5Mtp1dMCCPibh0murHRPAskRt+Ol2QZy68kgNoB8lWXw9xKY/hG8YmxynhVUfjsBfMUGGgKtGsbVucbRK2jwFbRefjwvJQUoLF+DF981PcNcjn28L10kyFdQ+aMEYD2XAOAnCKIvjOAVmecSJksToDIAvXFqLOVsgnx3Ol6PwqO3pAZoWfNRA6BXVHF1rmGNj9d7Asl+t+OlVvnqbjyInXwObf1LgF50O67+WVYeTw9y3+HPIMhXUPkiAjjKUcFdAHhyDI+dfxdePcp5+2nl5gj6xQ0lK353bGsvTz+p4mrrN9MKGnw+AXFIKRtHUEsgOPR2vOTqbai8ZDEgG9zYyG2uzirTX6Ly+wBghjHP5PEkAM+zecEvp8HDAiDbPQHVoPDkO/HiGd8mvhMn+QQBQUAQyEZAGO2FsjKEIF8oMynj6DwCss91HlNqKwlAAAAgAElEQVSpcd4hEMfxqQ1C6mO2jrMXSBiGbcUXZAI3jmMmeqzJFg94csEoij6OiP9pqayWeiVviHEbRdFpiMheK7mpmRjUPp7f3STIJw8ijuNVRGSNnU1Ee4VhyJKR3sl1oZxW9AgRnYWIP2rEhf7ThIEBE5OFQuFdLml7rqNxGfxBpdSnvDvWRMY4jg8mIr6ItV4I1Ov1XRctWsTW6V1NnSDIU3KcLzlsXkIT48gkcbpNkEdRdDEiHunYWz4ZhmHuc+wTGgERz1FKWY0f4jgeIKJLHIRTnMrJ84U9xxy1pWuVUs9p7CdWGT/j8MblvVVrzUY57AU9I0VRxEYrTNbnpUeUUtsj4vhlWqfT6OjozoVC4YNJklwUhuGQa7zT9qQjiIglKW0k3w+01pkEgDGGJVAPtYzpGq01y+B7pTiOD03JLTZs6hpBPpeYeQFhycRGV2xQY8lCqbHcOp+2UkM2jtP6CkT8qVLquKxynntR03MWx3GZiIkIOFcp9YcJhQifvvsYaLBChNb6m3n1eRLktYZH8tmI+J1isfhbRBwnu4hosziOX5bKmtrinXLeShiGgznY9hljqh7xsn+TEpqZpM66det2LBaLd9qwcxHkcz0frvOMjSBPw2awgYbN0Crhd55SKvMs1th/FjXOIxzH1eoZ3DBUOFFrfWbOO8GHIO/2mgprtdoaIsrz5GNVoCdzeCPbemmou/A74lJLHjbO3bxb77dOEnPTCfISlZmszNzveLwuMojzpOQYP3O5oVqyiO60HId4sYXJOKuKlTfnYV+i8s8b4Rv+Le93ArhoBCvPz/p9Lsc+3p8uEuQlKjvPJVWseJ9LSlTmMw4b3RwEkE2Ql2jgRAA8I28uEPAzwzjkNO4t0cBVAPhsy/P2ySpWbN/VPq/OpvN4Pof3AtD32dM9gOJNm8F9jzwOm2xmIHwGjhtjOg3suF/nV7GSaYjXTYK8n8oHIgCrbdjSPQUoPDPL4IQLLadyKVhfx5Ns57MC4F5rcCjXYJjLlmjw4wDkmudqAQr71KD+RVYgcPT9y1WsvMuWZxcqPykBYGMaZcl3dhUrfObJTCUaPIuNSizlK1WsZJ6Dml6UUkAQEATmBQJC53R5mhYgwE0S5AsQgS6vGaleEBAEBIH5jIAPAQUAf9Fa79nOOD0vwPmi9xVhGP7I1lbqYcoWwrly2EQ0FIbhFHLOGMPe1q4Ya864uBN9E4J8HIlrlFJH2mTxfaSmG/E8v6y1tn5gt7L+2CMwjmOW1t/NUf5rWmv2eO16apYgZ69c9hKPomibYrH45CRJ+ALg9QBgJU3SgVyptX5u1qB8n8m07AgiXpckSTUIAiZQmMRRSZJsgYg7AcBTlVIrJxQKfMiUxuXxn5VS++SRw9xu6pHMRh0274VEKbU1IrLUd26K4/iDjfr+yzHBvK/wBZQN2/tqtdr+ixcvnuE5Nb1uYwzLv3/Z1mZKqDBpMiNFUXQRItq8Tr6ktT6p64u2xQaMMUyQ2+KvbgiDkYEdS6/b9vi7tdbsaTnFe8717jDGHIeIt/kolbQ47LaKtYNZWw2vV074drq35FbVoqHVQUS0bRiGTLrMSJ57UdMEeTt4EFFfatSXuxewkZ5Sij27MpMHQb42SZL9+vr6/m6pg40LbJ6cXPRmrXWmLH4URf+GiJm4T7SZqufsnufty/l89nQXQT7X89EOQe5hrMTDc54j0hjm/9fwCCxa8LhRa51p/NYja+pYNnix9P+7Wms+o1hTepZnL/tcyd9uqgt5EnM8hgcR4BoCug2ASX82SCM2/NoUALcFoD0SwA/djkPjYXx2oCO21FBgg+A847CRKla8wvm4iGr2Vq7i0AyjphKVXSo4Dy6DB7e7Hq9nw8ApaVc6atM61Ln/uWEB8rxxe2HsTRLkrJTBstNVAHoEAcYSCFQAyRYJ4E4Bn22hb+Ut+Mtx9a0Sle3nEoC7Acyu07367Q8CYAkGjksguC1LorpEZUfYk1p/FS93Gvf20+BJCPRFS1+uqmJlilFiiQ5fDlDoQLx1vK6KlQ9nte3xHF5FYMo2TD3js9cKUNhyDV48Q9WiCYKcjVn5m4Tn5E4cD9FChsaNUYItAYhV6sYmE70exC4QwMtGsMJKZ7mpn8qvRQAOW5WbCOD0Eay827HeghIMXASAGWTyFC6A70s8YpabwwGvYKMsaypR+dzGWYW94fPSGIHZLkt5IVVRYIMrVtbJTFlhLlx96urvQqt0FV6pXBAQBASBVhBokiBvpQkpIwgIAoKAIDBfETDG/A970zn6/3ut9cHtjtEYw0SGKw6jUy449QRkK35byqzHGMNyhk+1FFyrlNq24fXMcUmtSQjycc/v8/K8AifA88EJALwNE1zzMvE7EQW1Wu1cIjrW9p3akNP9p9b6aXkyze72mvsK9iTI3c165EDEVQ1P50wZTU9S6gdJkpyaJ6ec1wVjDEvxumS/vQivOI7fx1LktuES0YvDMLRd2I9Lt9dqNZZYdkk525qqpZi69p/xOlIZ2X84ZPB/rLWeEWM8Vd3gsrlEChE9LQxDJls6mnxWdFYefuYaMoqL2XNtdHS0r1gssrS/TZb5Oq11Znx4YwyThk92DOx3RMTGNasn5Iw7CsQsVNZJzNrtrqcx0x0Nj8bPJUlyYbP7Ql7/PPcir/2iHQy4HxPrd2xsrK9QKLDhSu55oeFV/LkwDFk6NDN5kJkPaq2toR9SIyE2/sn3IkW8SynFhkozkucZ7w0NJQs2jshNc0GQd3o+2iHIjTFMTHDYgNzkazwSRdGFiGiL98tKDU/KCgPQI2vqawDwFgsUb9daf9XnWTTGcBgWDseSmRre46copazvf592svJ4EHM3AuBbqjB0LSBzWH6pn8ovQwCLoa9bCnmipRU0+GkCen8uPjmxoz3kiHO92Es0+GoAsqno3FsFs2MWKdYLY/ckyH9Qh/qpd+BlTHh7pxKVnecSAvgdG0bGUF99N142Hmah1dRPz9sWocZqAHnpvipWtvGpfzmVjwrWh8nJSTRaxdV8ftuQdqHyngmAT3g0RxdoqIqrMxWlPJ7D86pYyVVjGG94fUiC612ELgGtHMHVM87vngT5+2LAb9+FQ1Zj3OlAlKjMyiP9FoD+WQWzk4tkTkliXgvLLHXdXMVKprHc5DI70uAyBcR42fplnVMCuBuhvn8VL7MqhUxU0k+rBhECVvLKX4FAbx3B1TMMMpbTwLEB5BtlcV9GYLPl1hjmPg+J5BEEBAFBQBBY0AgIQT7fp9fnlnK+j1H6LwgIAnOGgKcH+Z+11nu108lGjMxCHMdOC2MiemUYhj+0tWWM+RbYJb9YlpFJ7oen1+Mpm/p6rbXVSpvr9SF+25JYn7r/H6y1zpVomyuJdR+CPI2jbDU48Kmn2fVnjGHPXfbgtSWWRB1UStlkPptt2pp/tghyj/jWxTiOZ3gPTet8S6SUMYYvV19tBT5JdrN5Tk6UjaJoL0S8yTEJX9Fau+Z6QraYvYV2bXFST9Jaf6mZsh5YjKX71aOT6zXGnNiQ882V1QSAK7TWhzXTl07kZUI3jmN+H7CM6O5ExF7c2xHRdojI3vd5MVezmr9ea/2MrB88SKTpxW7jdZIkyU0NI4gb6vX6tUuWLLFdLHcCDq86Zgszr85YMvkYo0wrfm/DAIk9qfj5vJGIrg3D8NZmpMy5vtkkyNkzvFarsVHGAUTE5Dd7cnJsz+0apMaWTWL4ea31e/PKdILMTM8a13B/LX3LJdobigns7baHpSzvP1sh4lrb2LtFkM/mfLRJkLNhSKYRQrqG7wnDcHuf9WOMYaNUNk7NTXne+D2yptYAAHtK5iX2ts2MoZ5RYFOb7G7j/PjZMAxzCWIfvPPydISYy6i8RGUOu/AG2zMHANbnbVLZRanRTk51dG0VV880MCDAfijfivZ5+l4VKzMM2EpU5vA9R+f13ybp3RtjX1ksgXacbbPlzF3rqZ/KFzbUBGzGLVOqIABWJbopALiJgG5IILj2dhzyPpeUaOBVAPj/LP1ij+bMsBgZZdgAbDPbGCMIl/wDz98QQmXeEOTrvfud+yoCnTyMq78wHQMfgjwA2Os2rDQVpmxnOmJFAQrWmNgE+KMRHHqFa+3x7/00cB4Cvsj26ihAYZs1ePH9rvp2ofL+CQCHH3M5LmRVFRHAc0ewwgZOfmnciGFgGACXWwpcXcXKIdN/d4VtaFgvfXQEK9ZwgX6dlFyCgCDQFALCVTUF12xnlumZibgQ5LO9CqU9QWC2EJAdb7aQXtDtRFH0EUTkGKG5CS3eSb7gENGyOI6dlvSuGORpDMd/rpc2zE5EdGEYhpmXO1EUsafwXx39/pXW+nDX2LpOkE/twLwlyHkYxhgmyJfkYdppgjyKok8jovNStSHP/AGlFMf/m7U0SwT5D5VSr3HIl3eTIL8KAGyxDtelsYydXlmpByVfJufGriOii8Mw9Lq0jKJo74ZRxNX2S+fM5dCSykEcx88hoisdC+wtWutvTM5jjGEvpFzlDiJ6aRiGP+n2wp04ahhjmMh+U4MIfaEjDmIzXcolyH3k6V0N8buLiH7V8Ow8r0HEX2B7Hlx1tfL7bGPWSh8nl4miaE9EbNdb7JFG3O/fsay3Uopja8+QM53ez24T5GygEEXR0YVC4fVpTPIpXnJt4DYrBHkURbx2M+P9pn23EeS8d9rG66UQ1EmCfK7mo1WCPF2fTPjm3qs08w6K4/i5RHSF49yd6TndPEGe/bHY6ppKjX2YfMyTD2/jccos+i2ttS3ubMvtdY8gH/gVAK5suWNNFGQCdgQrmQZ/JRr4IADawso8mpJp0USTK2jVZgQBy6vr3PM61Hcbxssyw0KUqAfG7hWDvDWCvESD7wAga9gcj+m7C4B+RRCcNwKbXjDF63Xa4+opHe7RpF+WAhR2mhwHez4R5CnhywawuQmBvjSMq2eEJeoWQb6CBo4gQKsBNgGdMoKrvVQy/NYDHljFITaqc6YSDbwRAM9yZpyRgd5UxdVsCNRUKtHAfwLgx+1zNHV/SUM+sJd6X065Wgy1/rvw8rub6oxkFgQEAUFgHiAglE9nJ0kI8s7i2bHaZKF3DEqpSBAQBNpAwBjDF0+uj6MoJbOcHuB5XfH0AuXi+9tiw0ZR9HJEtHqYA8BrtNa5FvfGGPZ2s3nEU71e71+0aBF7DOUmIcj9JNYZwCiK/sFepnlgdpIgN8Z8HgDe4/FYfFVr/XaPfB3N0mWCnD3iP6yU+pSr090kpTxCGdyhtbZ5EUzpvjGGL0fYOzkvXau1zpVpnV4oiqJXIVq9cqYXuVEpdUhD7nXUhWvW7x54/K4hE/6sibKjo6OlQqFgk/68lyWVEdGlANBKd6eUGR0dXR4EwRmNGPS5HmVtNJJLkDfkq5fGccyeil7yoR59qBLRe11S/J04n88VZh4YOLN4EGfOOiZleBQRP1ssFtlgKff80M29KA3JcqbDi7qZMU3OOysEuTGGzzwzwjBM6kgmQZ7GUXftWV6GP50iyOdyPtogyLeJ45gNM23pf7XWVgn2icI+hpp5ntPNE+TZXW5jTW0Vx7HTO7HVByqjXGYIkk7U3y2CvJ/Kf0a7akMnuj9Rxz+rWMk8W+9EA9sXAfk7JlfVhQBfOIJDv5iozCPO8ZVVrDw3bwA9MfYuEuRb08qlS0F39FyCkLx3GC/NDBFUosEzAIjVhGYpBU+t4iW3TDQ2nwjy1LjD6k2PgN8dxqHXTwezWwR5P5VfigA/5vbYGjjrYh4BTxjGIVdIqvEur6Dy2wiAzzO5CYGeP4yrLVL6U4t6qD5MKYAAXx/GyltbWZA70uE7KCjebleaotOquPpDE/WvoMHXE1BuCBgC+NkIVmxe9a10dZ6X6cSXzDyHQLovCAgCGzUCebugEOQb9bKQwc86AnIemXXIpcH2EIjj+HAiyoxRPK1mK3Ht6oUx5oSGPCVLo1uTUmpZljT6RKEoii5hSWxHNf/eIEhzvdbY8xIRM2OhTdTbIJ4+pJQ6zdaOEOT+BLkxhuMk75aHZycI8tTTmC3aX+NaZwDwbaXUmxAx8cjb0SxdJMj/0JDJfZ9Sir23nambpJQHof0XrfWezk6mGYwxLknX4YZRjE3ydUZTxpivAICPgUQ9SZKntBNvOY7jkzlesW28aRu3cp6G9P2HGvPzybz8RHRaGIYbLpB8cWw2XxzHhxDRBQCwRbNlPfPnEuQpDkcQEV/05XqzebYzOZuV1GyhvilF5hqzdvu/du3a7YrF4rWIuEO7dU0q/2ul1DGIyNLLM1K39qI0TAFLWXfL23W2CHJXzOdMgtyH1AYAr/AUPnXlyYJPTPhcz0erBLkPoe2LI2PhgyWfUbTWM2S6O0iQt7Smoih6KiL+rYN7g6uqs7XWL3NlauX3bhHkJSqzMUWnDLtcQ7u3ihUOEZGZSjRwAUC++sR0eWe3hDi+popDuQbIPTH2LhLkDHLqFdzhcwl9voqrZ4TrKFGZydWXuhZBp34ngKeNYIW/18bTfCLI0zjkLDmfm/LI1G4R5D6ENgAcX8XKuT5z6CG5zzS89Rmd3s6udFSYQP13BLCfRx9uWQSb7f1XPMc3hMaMKl0hHBrhKe6sQqUfEMa/z0tUXg0Aqyx9K1exwnkkCQKzgoBc988KzNKIIDATgQ48fEKQb8wLqwMLqFPw9VBXOjUkqUcQWBAIENHmcRw/ZJOOTAf6Lq11y7Jyxhj2UnfJJFa11ivygOWLe6XUnU3GuG11nm7RWnN80tzkSZAfqZQaarcellqerzHIeezGmBsB4Ol5OLRLkBPRZnEc8wWD7SN6ovkzlVLvaDZObqsLaXq5DhPkMRFd3oih+7UwDH/eTB+7RUql822N19rwhnQ+X5PH4kGQ/1VrbYuzOwUaIkJjzC99vaKJ6BNhGJ7aDL6T8xIRe92x/F8u0dsw8PivMAw/nOL3F47vndNeUq/XVyxatIi9MLqWxsbGVgRBcD0AbN5kIyzXehcAcJxNJlk5xnNeshLkXCiO44FGnPPvd1DWnas9UWtt9cJpcszj2XsFs1b6PrnM6Ohof6FQYI+2fduta6I8Ip6jlHpJVn3d2IuiKHoRIvI7odlvYTau4/XLJBeHFcgN5wIAs0WQnw4AbPiXl/II8h2KxSKPxZa+rrV2eoP5kLo2grwX5qM1ghxhbGyU90JrHNlGDHsvHHkifLBs7Hdnaq1neI52kCBvaU1FUbQ7IvL7qYtpyq1BzxHkrjuNEpVZonzrLgI0uWorQb6cBo4NADO9k9NKnojh8SfdhVeP7kzP36IAMav15IWzeTSGx7fjvHlj64mxd5kg57GXqDwAAB09lyDAicNYmXIuKdHgTwDo+FlaS+zlPI8JcnfseQL44QhWXjkdzy4S5CeQwzmAAF4+gpVxL3NX8iPI6SVVXH2Oq66J359CK7eKQV3niA0+kZ1J6yPbIaRLNPACANygWpHVTwQcGMahS5fT4HYBkO3eZ00VKk8BHHfQlyQICAKCgCAgCFgRaPZSIKcy16eAzIIgIAgIAoLAfEXAQ3Kch3ad1vqAVsZIRIvjOP4HAGzmKG+VqIzj+L0sO9lKH1osc5DW+g95ZX0IcldMda7bpx4hyPNncGxsbNcgCH4JAE9zzDOlygBO+fEW14tXMU+C/HtENF3SlS8A4iAI1hERS9bfWiwWb2xV9rsbpNQEAMaYG2zkGhHdE4bh9l6ArX9GXBLrv9Zae8f8jKLoYw31gGYIb2qQxccUi8ULffs8PZ8x5mwAyCQI07x3KKX64zjeBwAYv8xERBeGYdgNufMp7cVx/DMi4njjtkREtBoRL0LEP0ZR9PclS5bcO2F8Yow5g8loSwVOgpzLEtEyY8wpiPgWj/eIzxQ9rJTaGRGf8Mnsm6eXMPPts2WdFRvv7TcDwMnsNNdufVweEZ+tlPrt9Lo6vRextLgxZtgW1iPtAxM9TKKzkdFflFK3IuIGiVZjzJ8d0uw9TZA3zktLGucm1xr/kdb6Fa759SF18wjyXpmP1gjy8f1n0ziOH3Vg5IUj1+Hjkd4w4vpYGIYfnd7mXBPk69at8zG6eLvW+quuNTXXv3fRg5yVYDLjgq8fM/2kiqtnxyt4PVnMRjIWj/b1hNoKKrvIvDOrWLHKfZeoPPdjnwWCnGdxRxpcpgFOIaCOnUueALPz/XjFhj27RINnAZDNuPy+KlZmS62gK49sp57D9USvtoZ/mO0Y5D5kMAG8ZQQr3/AB18cjnSA4bAQvucKnPqDjC/3waAUBDvfKv37/egCB9h/GS61h6HLro+MLJXiUy9q+Ab9fxcqrV1D53QTwBUvf3lfFilWdy39cklMQEAQEAUFgoSPQIYJ8ocMk4xMEBAFBYONFwOPCbRycvMttF3INcutt7A3jykdEx4VheF5ePk8i39VMM79nevBMVOBDbBPRq8MwZC+D3ORTjxDk2fDFcTxIRD/ykIAeJaITwjD0stJvZpE0m9eTID9Aa31ds3U3k7/TpNTktj1CIZBSapOGJPxaV5/TOLqcL1cmmT1FlVJeXjZjY2MvCIKAve2bPSM/kiTJ/q1KrcdxvIrJZNt4EXFVkiRHNojbGVKbE+WCIDi6HaLehTf/TkQcc5c93nNjlzbk6dlL7gUOI6KOEOQTfea1EEXRqiAIjgKAZ6de9kWfMU3P45KDbrbOXsWs2XFk4IRxHB9IREcjIseeZa/yJS3Wmynn3em9KIqi49hj3dHHPzSUTV64dOnS3NjS850g5/EbY1gKNc8jlLN4GT+2Q5D3yny0SpCnOI4BQGhZU9dorQ/0eS7iOC4TkVVZCADeobXmMCBTksd5PVNNYHo9xpjTEeDfLW53eXHtgziO2bDEFvbCenb2wWg28nSKmJveV5ckMAL9dRhXeyvetItFicqfAYD3Weo5r4qV40o0cAlAfgirBJL9bsdL/2jrT0+MfZYI8gkc+mllXwB6FQG0fS6ZLrddojKH0skNt8N9KEDhSWvwYisx3O4a6mb5Tj2HJRp8DgBdae8rfaiKq2eET+uWB3k/rToIIbja1icE/MwwDp3ig3E/lU9DgP+w5S0A7rkGh7xUPko0+HkAeo9P21Pz0LUFKD5nDV7MilF+aZK/XYnKvKZtYaLWaejb1sAYGy+ykk9WigzUd7gbL3vQrwOSSxAQBASBBYyA+DR7TW6zl39elUqmHkOgpYehpUI9NnDpjiAgCHQCgbGxsacEQcAxx1zvjJuUUgcgonfsqbVr127fIK74Q80l0/uAUmonRORLyBnJGMOX8rlelZ3AIaOOh5RS2+WN1xjDl6G/t7XNXqpKqU/Y8nSMIAdabRMZI6K9wzC8uRms2rlQntxOpyXWWSK7Vqt9II3T7Iovy5bqL9RaWy/2msGlnbwbCUH+SfbWdzwbz1FK/caFZRzHhxLRrx11naKU4ktga0r3umsdssm2Om5USh3Sitc+r9k4jjmWus0b9wdMQhLRjjmduF0ptaKxr4zH5utWiqLoWESrLCs3fYLW+juOva2jBPn0togoNMbslhLl+yHiQQDA+7IzZnmj7KfCMPxgpzCcL5i1O14iCqIoYtn83QuFwj5JkjwTEZ/j6dl/tdb6kIx5ZG/1eOrfZ3yneId5McZ8CQDeZRkrJUmyq8vYZT4R5KHWW2WRncYYW7gGhihSSm2dFx9+AsN2CPJemY92zjOusqycrpRahohOwiCO41PZQ9zxLB6otb5mep5OEuStyPZzf1xnGFa40VqzQoc1HnC7e1G75TtFzE3vR4kGPgeArLyRm+pQ2OMOvPiv7Y7Bp3yJjtwNINkQV3pmGRoFqD8NoMjnk0yDMwS4YRgr+7va64mxzzJBPh0TjulcB9qNINkd18d19j+XAHxqBCsbziUrqHw0AZxvwx0B3j6MlZ5XbMgbQ6eewxKVOUSR9XsbgAaruLoyvS9OgpwAAoS9bsMKq8p4p+3pmMUhRA9bwysBXjaCQz7hwWAFlS8ngMMsHXi8CmYZ4BU1Vyf7qfwyBGAD85YSAnx9GCvO8CxZlS+ncikA4LAlufdOCPRpArQZDox7mbfUeSkkCAgCgoAgsFEi4CI7NkpQZNCCgCAgCLSEwAK2K4mi6AJEfL4HLt9SSr3Zh6Ahok0anmcXA8CzXPW6YvwaY74IACe56un070T04jAMM+P3RVG0JyK6CGen9HOHCPIjiOhSx/itccyzyrouhX1jh3eSIOd1VavVWIL8WNd8s5eW1vpViPiAK+9s/e66XE77Ma89yOM4XklEv3JgeobW+p0u3I0xZzViAtskJrmKZ2itOV52biKipXEcM+HgkuJ3dem7WuvXuzJl/R7H8Qc51ritm9YLI8QPKaVmeL+00hdbGWMM77W85+amlGC0xuVtVWI9NYB5d7FY/A4i8uWidyKiLeI4ZknG1zkKddTLca4x8wbIkjGKIo7N+ccwDJsibhprWsVxzDKz/+MwtPur1nqG52Tj/V+I49h6odsgHv9DKfXfPuNshCn4ORH9W15eRLyLDfJcdc0nglxrvVXOO/x7APAax1jfrLXmfTY3tUOQ98p8tHOeiaLoo43QER9xvGOsKkhcNjWUugUAnmyp6xGl1FZZBHMvEORRFP13w0jM6vHYMLg4WSllk8a1LklW5DDGnMhe9IjIIVYsqbWPs04Rc9M71k+DRyIQf/vY0vlVrLzAtQfl/b47Ha/H4JF31KFw9e14idVDletwjZUALrfJLPuSsD0x9m4R5AS4AgbeXQP9nTvwwqbOJRzfvQi1LxCQ81wyWcZ+Ba3ajCBgtZ5coz8CuLsIhd3X4MWPtbqeSjT4EgRSw1j5Qat1tFrOtTYBYFzhwFY/Pw+j8Cjvq/2WfGMEZosRvGKGIb6TIF8vYdU0QZ4+eyx3zuo7eakOUN+hipdZ97kVtGpngqBqU9NqfAtdUMXKMa65KNGRewMkvG8sduW1vvOAXj+Cq/QYwUsAAB80SURBVL/bSh0lKrOhwoClLNv85XIZCcCzbsfK71ppW8oIAoKAIPAvBFo7QwqC8xMBIcjn57xJrwUBQWCjRWBuXtJRFO2FiDc6PrzGZ4VJ0WKx+HZE5I/2zBRF0e6IyBezedJYk8ux9/guiJj5cZ/Krzpi6HVnwSDiL5RSmXF4PWMx8oXoi8Iw/FlWDzkWZeMD9TOI6IopbCW3PUl25yX49D62c6E8ua5OEeTGGI7P/BPH5TI3XefL7GKxeNpEPOTurJDma90YCHIi0o34xf8AgC0tCI0lSbJnX19fLsma7ktMfOdKBBPR3am3Wq5XdUq4nsvPomPGvkFEx3jELn6r1vrrzc7+2rVrt1NKsaJBK7Lgcaqy4SALmu3VzPxxHL+fiD5tqylJkif39fWxx1luaoMgH/coJiKWv36P1vrHzTzHRLR1HMe576f0PeZU92gGybnGrJm+5uVN9/tnIOJpxWLxc4i4rpl6PbyVL9daH5FVpzHGJWH9Q601E/jOFEXRRYjIcreZifeMMAzzVBo2lPEjyMP3Qo50Sy+QmcYYjiPv2qvuS5LkYJtHfRrO5BIb+HlhC2Z3PnRueIp2zjPGGPaedYU94Tj2+zbUU6apIfwLNWMMe9y5vD1z45n3wppK38s3OR5EQ0QvDcOQw5l4J1YFaZwdeM1y/PVlRLRXGIZNeW36NtYJYi57g/GJ+83Mj7+08uR2VtDg8wnos+uN/fCdVRxipRZr6qeB1yGgVfElvwIaRaDthvHSR13tgFfM8y6PvWsE+fi88rP9TwR6zzCs/jGgTbdrKlq70lFb16FuPZcA0KlVXD3FC7qfBs5DQOvZFQF+tRbgmHux4gxbNLlXu1B5zzrApxHgeT5EtHP+W8jQieewn8pfRIcRPQFcNIKVTEeA7hLkgycDkCtO9llVrPC+l5tKVOYQYS+1voM94pmzsUYBYn6X2dSsmJxmY1yWc7eotNEoARwygqv5/qipVKKB4wGQv+dbSTdXsbJ3KwWljCAgCAgCgsDGi4AQ5Bvv3MvIBQFBoOcQmBvy2xeGKIqYqLXFqZtcFZPZ30PEi+r1+t/DMHwkiiL2eNkbEdmz9yW+JBARvdwWG3psbOzoIAisEnMNq/GmvTpT+fc7HUYBTEptn+WBnHq9PQIASx0YM3HHH7aXJ0lyPyL28cUWIpYBYIbcbE5dVoJ8bGxst1Qm39aVPyulDmyG9GjnQnlyRzpBkKex7Nmr1RYHdKJZlpO0ehRbgKprrV/r+9w0m29jIMgZEw9vac52a5IkR/f19f19Oo5sPIKI7IW13IHxOxvek9YLYs++/EEp9Zxarcbe7xwf1naG5jATz8mSwHWthziOf0FErXiO/URrbb0cc7Xt+7sxhj3kv23Lz3HSG3HkP5+XJ47jg4mI5Rtt83e91nqGEVVGTOq/AcAZSqmzEdEZbzCO48OJ6DJb/zsdg5wxQ4BvW2L6snFZ1zDznVtbvmn7/f1ExAYj33UZQnCdRLRlHMe3AsAWljYyY5Bz/iiK7kHEbS1lR5Mk2bevr4+9xKzJGOPjNW1V6UifgTMBgN/XeenzWucTsr1AZqaKCmysZBsHj4+Jm48ppc6dMH5k1Y16vc4hH95ARGwoaL1XyHumemU+2j3PGGNcHm/8jP+yWCy+BhFnkIlpGIYfOuaCiGifMAwzCeheWFPp83oxIh7peBR5O/xWkiSf6evr470hN7FRbRAExyVJ8tbJBmrzkiBnN1YaPAWBfBQvrkRIPjQMl/7WRrYup8HtEOgYBHgbALChaJr8CPJtqLxkMcA9ALCJa//M+P1/q1jxPhPP+di7T5BPQPQ3BDgjgvrZPnGQd6Hy4QmA9VwyPQY5N+QTxzrt0AgB/EcRCj+zxYbemlYuXQxqIAA8AQCYMJ7Y152e2i2sHWeRdghyfi4CoE8BgHN9ItCqYVydiX83CfLd6AWbGBhjz2+bwTCfok6twuanAZ4zNTQFHV8owSMfB0BrSKBUSWAXa1xwgqAE5Qsb4eEcezd+oYpDJ3vECuf5Ha6Dekazqgqp1z87P2ztXCTTMvgqWjRbr+QXBAQBQUAQWNgICEG+sOdXRicICAKCQMcQSL0+WRbZl7TtRNtnaa2tVtNxHP+EL15tjfFFnVKKSa2mkjGGx7vSUSg39qkxhj+2D2+q0dYyWwny1OuGL2Rd5DFL534NEZlAZg/NpyLiKvaaVUptg4hM+G9I7V4oT1TULkEeRRHLpP+/1qBruhQT5K14+Ho1tLEQ5Kmk+bDH5UeMiCyJ/NtG3OCHmGBDxGenEvquebhTKfVkW9zXOI6PJCK+ELLFqn+0Xq/vs2jRohGeRGMMe3tYY4gCALfNca+bku/3NPiZsZYQ8TClFEs1dj0ZY54OAC6PEL7EO6tBjH5Za30bzwERbRVF0SGFQuF1PoQaG7F4EuQTY2bvrd8iIhsbcXiL25IkeSxJkrhQKCwtFAqlJElWNSR5mURYYgHqIaXUDog4Q2qzVXDnGrNW++253zNZt7ph2HEDIt6SJMnD9Xp9LAiCsFgs7gAAbAxxoocxS2Zc5fSZ83kXP9RYY2cUCoVriIjnneMcc/zz44jojRPeqsaYfweA0x2YPMKe8nEc/3jRokVMHNHY2NgOhUKBPdx5LM54uw2yqecJ8hRbls19RRNrhA0g2QhomY+q0ES9FoK8J+aj3fNMqtTDkq6u+xU24jkHAP4EAGsRcUciYkUDXqvWhIjnKKXYwDQz9RBBzgZsf/Q4c06Mg/cQ3j+G+dnldUVE2yLi9ikumYZU85cgX9mHEP4JgJ7imvP09zsB8PcAwGfzRwGIn78nAYwbDe0PQEyKZ6w7P4Kc2yhR+RsA8CbP/kzKhodWcegq33L9NMdjnz2CfNK5ZPz8ejkB3hxAchtB8lgNCrGCZGkCWEIIOMa081xCYHbIkgAv0cD/AqBvvOVHEeB3BPBnAnoAIVgHkGyxfi3hbgDE+1CWZHuvEuR81mQVCfZ65m8EA4CbA9BeaXz3XPn5SWv2mipWDsxbw90kyLnNJoxGbiGAnwUAtwIgJUBPRgCWl7eF5BgfFgKcOIwVNurLTf1UPg3Xe4Xb0nXL4MFDrsfr41QRgp/9g+xF6MIqrD6mGUWF9XvSwOcA0PWtNb3pJzT0bX8L/vJx3z1J8gkCGyMCve2WtTHOiIy5FxBwfcD1Qh+lD4KAICAICAI9gkDqBXZlQ8Z69253iYgu0Fofi4i5sUeJaLM4jllm1+b9xBLt29nqyRuLMYbjpn7N9bGotT4gK49n+U5A6Ywfboz5deOC5tBWG1NKMTHZkwS5pyxpq0OfXk4I8n8h4vTOtoEexzEbX7AXuIvobmXuTEoa58agGxsbWxEEAV+q2bxa2fv1+DAMz53oRGosxPH59nN0bLVS6khEzJV3n16elSdqtdoIETklnieV/T+tdbux05vC2BjDnrq+l/tctzVeYE7jMwlybPjRJDQusd5Uh5vLzLLt1hjrzVW3PvecYdZKZzPKuAjEdpphz1qlVG5c8CiKPtZ4jk5ttQ02qJkgyEdHR3cuFAocuqGZfaeV9TsvCPJ0H2SCYVGr+PqUyyPIe2U+XOubwwcppayxbn1ikftglZNnRCl1gM3oqlcI8nS/eyMbSbUxXmfR+UqQ88D6aWAfBPyNw1jLiYE9gz9B3k/lAxGASfhm0i1VrDy1mQJzPvbZJ8ibhSczPwK8ZxgrmeeSXemoTetQ57nr5jmwVwnydvEdI6CDbTLg3SbI1xPN4SUAlBlipt0BAuAvqzD0QrsKxcCxAeB5DgOvx+pQ3/cOvIyNm8fTznTEigIU2BhqU1s/CfAjIzj08WbGUqIjdwNI2CjIOyHA14exwqFKJAkCgoAgIAg0jcDGbTohBHnTC6Z3CmzcS7d35kF6IghsbAikJDlLmh/cxbF/vxGL9wRbrEZu2zN+5te01myZ33RKx8reY7kxjrlSItojDEP2vp6SiGhxHMf8IblN0403V8BJkEdR9EpE/H5z1f4rtxDkG7CYI4J8ylvfKv/b6hxPLjcuY12LY0cExbYI8vQZfkdDWvDLnejzpDqYzDpBa/3dvHrTZ5NJblecusz9Iw1bwDL9Nk9k3htOC8PwQ82ML4qijyPifzZR5iSt9ZeayN921iiKjmNvxrYrslfQrAd5291phAH5qVLqxW1XlFHBXGLWifG4CMQ22lijlHomIj6cV8fo6Gh/oVDgUAvWd7Hled9AkKf7DoddYE/wbqZ5QZAzAHEcn0LkJfncMl62sAXGmDmfD9f69iHIiQhrtdrZLlWjFkB8jIieHYYhK2Pkpl4iyNN19V6i8XjYXUm9TZC7b2r66ciVCMkvW5Q298DUnyDnykpU5vW1p0fFE1neX8VKS/M7Z2OfhwQ5Af10BFdbzyW70lE71qG+uhGyq2mDBc/5XqgE+RurWPnWTAz+9fx2nSAHgB1pcJkCuLoJVQnPaYObNfQ9y+ZRvZxWPS2A4A+ufYgAXj6CFQ4JNyWVaOBVAE4Vt4Qged4IXtqUml+JyuyU4VRXmegQAe3bSsxzXzAlnyAgCAgC8xIB95F0Xgyr28MQgnxeLAPppCAgCMx/BLq9nc8uQkSkjDGfRByXvip0sPUnWLpYa81Sf85kjGHZOqvkOyKuVEqx93RLKYqiixCR5S9zExF9OgzDD2RliON4MPWSbeWdy6T7Vz0IRCdBnsZEZxye1QoQQpBvQG2OCPIpszY7BLnbS7dtgpxHFUXRSxCRL6iWtrI2p5V5JEmS1/b19fGlc24yxnCs15c72rs5Je4ypbaNMT4ecpQkyQtd/Zncj9HR0eWFQoENa2yy7xNFRpVS209Xd+gAjs4qjDFfacQmfrszY3YG3ts49jFLi+al2SbIOY75SQ3jhKkxHlscYFaxucLMawiOY4qLQPRqY2amq5RSL/IJRRBF0X8j4imttDPZg5zLN0i7JXEcs2x7pvqLqw32eCciDjWQKf2clu8oQZ43PcYYlotnmfK89KDWeivbmJjYjeOYvX3f4Bp7xu9jRHR6IyRB5hloIr+NIO+F+XCtbx+CPF1bhfR8zGu1lXPfdIj/SkQvDsPQ6UnXawQ5DyRVivmmR4iFppdebxPkfsPZiY7apQj1b7ej8JTfUnMEeT8NnoRAvuopcQCw421Yuc9vpDNzzcnY5x1BTmdUYfOTZsSezgA9jWfNIYCsoclanK+FRpDXCfAdIzjkUomD2SDIeU6YJNdA3ycA652D7/yxHHsRCq9bgxdz2IrMlKoPXAMAu9nrxW9WcSg3BEOJymyA/0pH3x4iCPYfwUvGw1X5pBINvhqA/tcnbyN2+u+rWOmm84ZnNxZQtoV1fbmAJkaGIggIAt1AoBMfbS30S3baFkCTIoKAICAI9BwCURTtEQTBJxuxR1/gSebkjWG04bzwPWPMx5YuXcqS6c40Nja2SxAEa2wZiegfWuudmpE4nl6fMYbjulk/zhDxrmKxuHxmO+vfd1EUvQwR+QLMV8J0lIi+oLX+RBzH+8K4Vbk1OQlyLk1Ey+I4/vlMa2z3e1kI8g34C0H+r6XYEYKcq4uiiL1ePoeIz2uRVCBE/EW9Xj+5r69vg/xf1lMTx/HJjRjofIloS+saYR6eEYbh32yZ4jg+l8kLR12PJknyjL6+Put+NbmOKIouQcRB50YI8B2t9Qke+TqehYgCY8yn1xtKIYuf+7RRS/e2j8RxzHNg8+LNI8iZzOP99HiXB79PhzieOpN7SqmmPFs8656SbSpm3uRZ25i10teMd+G/E9EpiLhdB+q7t3Fm+HjDuOMbvuFPUhKX1Saa9vyeTpCn78Mt2VAGEctNjIdjnLIEP59XWJZ8D0vZjhLkee10giBP8QjiOP5MI8bxu5s4z11LRCfU6/VHisXinY7z2JRQFdPzsmLPXM5HpwjyiXHVarWjkiT5FACwIUUraS1LlCulPoyI/H9n6kWCPF1bmxhj/hMR+V21pXMgMzLMOKPy/nG2UupURHy0+frcJUpUZvlzm0Fp5whDAuyHwbcg0Ht84gm7ew/rGrHJzy8AfmINDv3FI/94lh3oiC01FNhwzRm32cer2avd2R571whywBUw+G0C6ti5hCD5QLMet4z5Cho4giWtm/G8tcxVggBsXP2FYaxc4DWnHczkfg7pAQDcBADCJpodIUje6ovtbBHk4/0nXkflkwjg/Y0Qb9s2MaYNWQng7gDgNFfMcW6rBIM/Bxi/w8lNBPCXGjx+wF14Nd/VZKaUaL+RhSgcdV1fhMKz1uDFkc/YdqSDFynYhPekzd358bVVHPIl093VSQ5BQBAQBASBjQqBOSLINyqMe3CwbiKkBzstXRIEBIHJCPTYYzw6OloqFosvT4lyjsvrI4PKF34cH/jnSqkfIyJfPHsnz5ikp2ut+bK35UREm8RxzB4StjjngIgDSqlL8xpKJZlZNpkvT/Iun/jS75w4jj+1ZMkS/iBkGfmDOkWQc30pycCkP3sY+HiTM+s1rJTaBxHZw39D6tSFsjGGP6pzL5FdnlsSg7zl5Z1bcFxifZY8yCd3go1uEJEJMPYsfrLHyNir7tIkSc7o6+vjuNjWFMfxYUTEMpQu5Ys3aK2ZhLUmItoijuM/AcBOjqw3NQjYgxGRL66dKYqiFyPihrjnlgLP1Fpf66ywixniOF5JRBwf+jBLM+wxcn46TyyVzXubS1Y5kyCfaINl8o0x5dSQ4NA0JrpXXGkiuhsRL2CZ+GKxeDkierH7nYJxrjBrt/9M8NdqtWclSfI8VmdJQxQs9qz3MUTkZ/VcrfUvfJ+F6XXHccxymycR0dE+RA4A3IuIL1FKsVTnlMTjieP4tQDA3r55HlS8Nm5AxJ8Vi8UzJ6TgZ40gzzjvTf5TpwjyCWCMMQc0zgkc830gJ0474/EHNjIKw5BjlsK6det2bJcg53rmcj46dZ7JWK9HcsgPIuI9yhVuJ07X2gXFYvGriPig57M1nq1XCfJJe3ZojHlREAQcy/2ZRLSj5/gSNmRqYHh5EARDxWLxV91U+uA+uYk56BxBPgmEVHr8Vak6Fu9JPkoyXAMbBv6KAC5dC+aC+/GKKed1T5yhRIM/gfUkrzUlAM+7HSsXT87U7qfprIy9WwR5CsT2dMxiDVEZgAYDgEMJ8Ck5++gMfFNi8wIAOmcYVl9uixntmp/1a/jI3RDqrycYf1fzN5b1O3ZSnbzvXIEAlxmo/fIuvPxun/a6kcfnOUwA3xlA8g4A5G/b3LM4E70I8N0CFL7sS9DymGaVIE9B3JWOCuuQvAaAXpKGtLOGc2qo7z0OQL9DCM7eAh74/vV4Pb9LrKmfBk9FoI/Zc9FoAYIDfAxt+mnVQQjBVR7r/VtVrLACl1cq0cCXAZDDcdnSQwRmhxG8IlPxy6uhbmdqd4Psdv8WQP0C8QKYRBmCIDCHCAhBPofgS9OdQEBeg51AUerYCBCYxUeFiMKGV+WeRFRiTzNE5I86JswjIno8SRImJm7TWv9fty+4enFmmdRhgoGIViDiMiJiedL7GBOl1DXteLs3O172KK/VavsQ0S6IuCkAMNFRb3gJsgf7/UEQVIvF4k0ND9HHm61b8gsC7SLwxBNPbNvX17dvg1RleeBliLiU9xAieigIggeKxSKTVi3Le7bbv26WN8bsAwB/dLRxg9Z6/272o5m6iWgbY8yhiLgDz1WDdBxNkuQeAPhTGIbeXmzNtDk5bxr6g40qnsJ7K8dTTN8/xOuGLxAbHox3FIvFm30kvVvtRzPl5hqzZvqalZcNrsbGxpYXi8Wn8lhSzHnuC0TEBM3jQRDcG8fxXxYtWuQtq+nTr0Zok0VxHO/V8CR9GgBska45Jm/5rPEgIt4dRdFNvqo0rGKBiBwLncehuf9EdGetVvv9hMHahn7N4pnKB4tu5GGP7iiKnhUEAYdw4LPKw0T0T631b2dj321qProBgKvOFtYAG0oiIq8zfp/xHhUS0SPpO+2eYrF4bauGI67u9uLvRPSkWq329CRJtkTEzfhf+uyxAe1aPhsDwBqt9ZqGykfvEh9dAndrWrl0EyjuQxCwJ+lmDfnzzQhgCQCOIsDaBODhAILbEhi7dQSveKRL3ZiTahfK2Pen/dX98KQnB1B/SgCwLAHaBAGWICAR4OME9DgB3hFCdPPf8YoHugU29+NBWLYHsFgBAD9nmyHApgQY81pqKKM8BkAjCeCtt+MQn9t6IvkQ5FWssMHNuPd1P5R3C4D2TQCehDB+DmV58XtqUPjjnXjxbT0xqGY7QSuLK6BvX4JkOQEsA8AtuAoEeGj9Pxq5DTa70UeGv9mmeyG/X+gH/EIVhzjsnyRBQBCYcwRaOCDPeZ+lA4JAZ+JiCY6CgCDggcDG8JrYGMboMdWSRRAQBAQBQUAQaAsBY8zXPeJIvklrzbFdJQkCGzUCcv7cqKdfBi8ICAKCgCCwABFoiiBfgOPf6Ic0LgNf5lBXthjphFB/6jBeNq5OJUkQEAQEAUFAEGgFAfEgbwW1LpWRy50uASvVCgKCgCAgCAgCgoAgME8QSGXb70oVHfJ6/VgjfjN7dnrFpp0nQ5duCgKCgCAgCAgCgoAgIAgIAnMW6kCg7w0ESjRQBsAhe2/wsioOcViu7iS5pO8OrlKrICAICAI9hoAQ5D02IdIdQUAQEAQEAUFAEFi4CMh39sKd206NLI7jkzm+r6O+M7TW7+xUm1KPICAICAKCgCAgCDSLgM+pzidPs+1KfkFg4SMgHuQLf45tIyxR+XwAONqWBwGPG8ah8zZupGT0goAgIAgIAu0iIAR5uwhKeUFAEBAEBAFBQBAQBAQBQaADCBBREMfxrQCwwlYdEe05G3G9OzAkqUIQEATmFQJC5s2r6ZLOCgKCgCDQJQTm+m0gBHmXJnYeVLszHbHi/7dzx6pRBGEAgGdOkgsiYi2iBi0sfAbBQsVC7H0BCzsrKxsrCzsL38DeyqQQwUcQ7PQEEQtfILloRgI2gm7u3N3Zmd0v9e38/3z/3Ozs/kdOhBNHz0OzhnS/LcLyfIhvf1QwJSkSIECAQMECGuQFF+eP1IY+ndbiJE8CBAgQIECAQKUCe3t7d2az2atj0n+3ubl5rdIpSpsAgZ4EPC72BGtYAgQIEMguoEGenbyYgNvp1rMQ0sPmhOKTRdx5XEzSEiFAgMA/BDyjlb80NMjLr9EEMrRVTKDIpkiAAAECRQu4F5dQnuVyuRtCuNGUS0rp3nw+f1lCvnIgQIAAAQIECBAg0LWABnlL0Uof7c6mOyfnYf9rCOFMg8DPWQjbH+Pul5ZKLidAgAABAkGD3CLoQaDSk1gPEoYkQIAAAQIECKwisL+/fyXG+CGExvP5942NjXMxxuUqY/oMAQIECBAgQIAAgdoENMhrq1g3+V5MN+7HEF80jxZfLeLO3W4iGoUAgfEK6E+Nt7bdzkyDvFtPoxEgQIAAAQIECBBYW2C5XD4PITxoujCl9HQ+nz9ae3AXECBAgAABAgQIEKhEQIO8kkKtmuaKfartdPN9COHq34ZNv39FnEK8/TnuvF41tM8RIECAAIEmAQ1y64MAAQIECBAgQIDAgAIppdMHBwdH/07wVEMa6fDw8PLW1tanAVMVmgABAgQIECBAgECvAhrkvfIWOfiFdOv6LKQ3xyS3WITdSyGGo365PwIECExLYMUfG00Lpf1sNcjbGxqBQCsBe1srPhcTIECAAAECBAgQIECAAAECYxbw4mTt6iJbm8wFBAhMTMA+ObGCmy6BvwhokFsWBAgQIECAAAECBAjkEfAWIo+zKAQIEBhYwHY/cAGEJ0BgUAF74KD8owpuLY2qnCZDgEBugWM20SIa5Db63KtCPAIECBCoWcB9s+bqyZ0AAQK1Cbjr1FYx+RIgQIAAAQIECBAgQIAAAQLNAkU0yBWJAAECBPIIeMWdx1kUAgQIECBAgAABAgQIECBAgAABAgQIECCQXUATYCVyDfKVmHyIAAECIxJwgxxRMU2FAAECwwm4nQxnLzIBAgQIECBAgEAdAvWdmevLuI6VIEsCBAgQKE1Ag7x1RTIdGjKFac1hgFYCytyKz8UECBAgQIBAk0DJB42Sc7OqCBAgQIAAgfIFnCXKr5EMCRAgQIAAAQIFCWiQF1QMqRAgQIBAtwLekXTraTQCBAgQIECAQH0CToT11UzGBAgQIECAAAECBAgQ6FdAg7xfX6MTIECAQFaB8b4AHe/Msi4QwTIIWKsZkIUgQIAAAQIECBCYrIDz9mRLb+IlCfgillQNuRAgQOC/BDTI/4vNRQQIECBAgAABAgQIECBAgAABAgQIECBAgAABAgQIECBQm4AGeW0Vky8BAgRKF/Ar2tIrVGx+lk6xpZEYAQIZBOyBGZCFWF/AwlzfzBUECBAgQIAAAQIECBAgULyABnnxJZIgAQIEjhHw4tISIUCAAAECBAgQIECAAIGxCnjmHWtlzYsAAQIECBAgMJjAiBrkTsuDrSKBCRCYjoCtdjq1nvxMLfZ1lgCtdbR8lgABAgTKEHD3KqMOsiBAgACBfALuffmsRSJAgACB0gVG1CAvnVp+BAgQIECAAAECBAgQIECgXwGvvvv1NToBAgQIECBAgAABAgQIDCDQ8cOuBvkANRRyigIdf3OnSGjOBAgQIECAAAECBAgQIECAAAECBAgQIECAAAECBFoK/AL4r8DoxiSX5wAAAABJRU5ErkJggg=="/></switch></g></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-5"><g><rect x="525" y="22" width="500" height="30" rx="4.5" ry="4.5" fill="none" stroke="none" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 498px; height: 1px; padding-top: 37px; margin-left: 526px;"><div data-drawio-colors="color: rgb(0, 0, 0); " style="box-sizing: border-box; font-size: 0px; text-align: center;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; pointer-events: all; white-space: normal; overflow-wrap: normal;"><b><font face="Verdana" color="#fafafa">OAuth2 Proxy as a authentication </font><font face="Verdana" color="#21ff46">middleware</font></b></div></div></div></foreignObject><image x="526" y="30.5" width="498" height="17" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB8gAAABECAYAAADtEW++AAAAAXNSR0IArs4c6QAAIABJREFUeF7sXQeYZEW1Pud2V93eXXKWtDu7SAYxoKKoizC9LCKiTzCLopgx+3xGDDwMD9N7iJjwYRZBFETYWUAUFVF5imIgbQ8ZJcMy07eq557XZ/bOMqFvVXWcnplT37fft990hVN/xVv/CQgdSQgA1FRNzZdoqnrJLAgIAoKAICAICAKCQFcQkDtMV2CVSgUBQUAQEAQEAUFgniIgd6d5OrDSLUFAEBAEBAFBQBAQBAQBQWAOI8DfKZIEAUFAEBAEBAFBQBAQBOYMAvLMPGeGSgQVBASBOYjAXNxj56LMc3BqiMiCgCAgCAgCgoAgIAgIAoKAICAICALzBgEhyOfNUEpHBAFBQBDwI9Dd59Pu1u7vneQQBAQBQUAQEAQEAUGgFwjM3p1n9lruBa7ShiAwTxGQhTtPB1a6JQgsUAQ6uqd1tLIFOiDSbUFAEBAEuo3A/N2rhSDv9tyR+gUBQWDOI9C7I6B3Lc35QZEOAMh0kVkgCAgCgoAgIAgIAoKAICAIBCAgF+cAkCSLICAICAKCgCDQEAE5RWViCAKCwHxFQAjy+Tqyc71fcvLO9REU+QUBQUAQEAQEAUFgwSPQ4oWuxWILHm4BQBAQBAQBQUAQEAQEAUFAEBAEBAFBQBAQBOYtAvJc0tmhzSHIBebOwiy1CQKCgCAgCAgCgoAgIAgIAoKAICAICAKCgCAgCHQCAXm16gSKUocgIAgIAp1GQHbnTiMq9QkCgoAgIAh0DwGxIO8etlKzICAIzCcE5I4/n0ZT+iIICAKCgBsB2fNlhggCfYdAz5dlzxvsO8hFIEFgQSAgS31BDLN0UhAQBAQBQUAQEAQEAUFAEJiBgBDkMikEAUFAEBAEBAFBQBAQBAQBQUAQEAQEAUGghwgILdlDsOdcUzI75tyQicATCMjklbkgCAgCgoAgIAgIAoLAnEFACPI5M1QiqCAgCAgCvUGAiDav1Wr7pmm6FBG3RcTFABABwCgR3Y+It1pr/7F48eLbeiORtNINBIioaK21nrpP1Fqf1o32Q+skIqxWq0uVUnulaboNAGyGiJsBQEpED/G/KIqGi8XiNYi4PrReyScICAKCgCCwUBDoBlsxs865cq4ulFHvVj+ttSuJ6Oee+n+gtX5xt2SQejcgkCTJRxDxJA8eb9RanyGYLSQE2t/zB6h8OQA8y4UaAew1jEP/6Cayy6h8IwKsyG8Dv1jBNW/ppgwDNPhyAPyWqw0FZtvr8fJ7GuahlcUB0J5vTjyxgmsaf3O2P5zdhEfqXlAIyGTs9HALop1GVOoTBASBVhAQgrwV1KSMICAICALzDAFjzFMB4BgAOAIA9gAA7/lARHch4iVEdJ7W+gJE9JGtbaFmrT2YiK4IqYQfy5RSHwvJu1Dz9OtDPhFtZow5BBEPAYCnAcDeALAkYJwIAK4jonOI6KxSqXRjQJmOZzHG/AEAnthixWP83ktEDyDiHQBwPQD8Pk3T80ul0roW65RigoAgIAgscAR68/zWr+fqAh/8jndfCPKOQ9pyhUKQtwydFPQgIAT5owDNOkEus1UQEAQEAUFgfiDQm0+y+YGV9KKnCHgJkJ5KI40JAnMeAdnt5/wQdrgD/T4jarXac9I0/WgbhN44YkR0RxRFnykWi6choukwjOPVGWO+AgAnBNZ9k9Z6t8C8fZ/NWvvsNE2fmSdoFEUjSqlPN9ORfnvIN8Y8mYg+jIiDAKCb6UtO3u8opd6BiHd3oK7gKtokyF3tXE1En4jj+NxgYSSjICAI9DkC/X5L6HP42hBvIZyrbcAzb4pWq9XliPhKV4e01qcj4r9COy0EeShSU/MZY44nol0dpf8Wx/HZzdQuBHkzaEneZhAQgvxRtIQgb2bmSF5BQBAQBAQBQUAQmGsICEE+10ZM5BUEBAFBoAMIENH2xpgzEZEtxjuZbgCAV2itr+pkpXViMLbW3gUAW4TWW7duP1gp9evQ/P2cL0mSk+sW+h9wyHhv3RU6ux8PTv1GkAc+cgb3L8t4HyIeqZS6stmCrebvIkE+IdKVtVrtmMWLF9/eqoxSThAQBASBhY7AQjhXF/oYc/+ttYcR0VoXFkS0XxzH14biJQR5KFJT8xljfgUAT88rjYjnKqVe2EztgXdHcbHeDKiSdxwBIcgfnQhCkMuiEAQEAUFAEBAEBIH5jIAQ5PN5dKVvgoAgIAg0QMAYw+6fLwSA7bsEUA0A3qK1/nKn6k+S5FhE/EGT9X1Fa/36Jsv0ZfaF8JAf+MjZyvg8BACDWuvftVK42TI9IMjHPTYw8a+1/mOz8nU/v1jEdh9jaUEQEATaRWAhnKvtYjQfygtB3j+j2BOCvPEVRAjy/pkGc0YSIcgfHSohyOfMtBVBBQFBQBBYQAjIu9MCGuyud1UI8q5DLA0IAoKAIMAI9Mfhba09iIiGAGCTbo8LIr5HKXVqJ9pJkuTCFqzdH1BKPQYRq52QYTbrWAgP+V0kyHnorlNK7d8t9/+T50YvCHJuj4hu11rvh4j3z+bclLYFAUFAEJiLCCyEc3UujkunZRaCvNOItl5fTwjyxuIJQd76sC3YkkKQPzr0QpAv2GUgHRcEBAFBQBAQBBYEAkKQL4hhlk4KAr1GoD/I4F73ut/b4ziMURSx6/OmXHG30S8iopfGcfz9NupgInA7ay27ky42Ww8RvajZeIbNttGL/PPhId+3K3SZIOdheqfW+nPdHq9eEeRZP76ntX5pt/sk9QsCgoAgMN8QmA/n6twZE98NoHs96QZBnoUpGnRJHUXRsFKKXYpLyhDoEkG+PwDwv9xERFeVSiUOASVJEAhGYIDKgwDk9LZWgOL5N+JF7Kmqa2kZlW9EgBX5DeAXK7jmLV0TYNzd/ODLAfBbrjYUmG2vx8vvaZiHVhYHQFu3jHhiBdec1s1+SN2CgCAgCAgCgkCvEJi9r59e9XCutBM2EkKQz5XxFDkFAUEgF4Gw7W5hA5jFm+aHuqcEIlFBxP+txwpca629ddGiRYkxZgdE5NiBLwKAlYH1rE/T9IBSqXRTYP4Z2Ywx7wCAz7ZSnogujOP4yFbK9lOZhfCQ7yDIb63P24sA4I9EdGcURQ+labo1AByAiDwXdwscq6u11k8KzNtytkCC/NsA8M9pjWhE3IWIngUAW4YKQET7x3H8l9D8kk8QEAQEAUEAYCGcqzLO3YlBLri2hkA3CPLWJJFSgsDcQUAI8rkzViKpICAICAKCgCAgCMxNBIQgn5vjJlK3jMBCoFLnZh/nptQtT8SeFzTGvLVOun0hoGFCxJOKxeKnETHJy2+tPZyIvgkA2/rqJKI1cRwf7suX97sx5k8A8LgWy9eUUjsj4nQyssXqZqdYbx/yp6zGE7XWPdHmn0aQs5XB2Txntda/z0OdiAq1Wu0DRPTRkJGx1u64ZMmSO/Pztr8TBRLkB2qt/9BIjkyZ5ZUA8HkA2NTXLyL6ZBzH7/Plk98FAUFAEGgJgfa3xZaa7Xah3p6rU3rTs3M1BEMi2qRarW5dKBS2QsRFaZo+UKvV7l+8ePE9iOix+AtpYXbzdMOCfHZ71O+t528YQpD3+9iJfLOBwB501KYjMLqpAXzwnzj0yHQZekKQ0zGFpfDQdjWomdth7EHAy2uT5ZhLFuS70eo4gdrWGnArANo8hcLDEaT3j0J87x14wchsjHGrbc7T61ercLRdbltauckmEG2dQrQVQLSIoPAAQnr/NnDPPVfj1XP+vtM2QFKBICAICAILGIEpBLkcwAt4JkjXBQFBYN4iQESLrbU3B7hWZ5for4jj+DshYFSr1d0R8XJEfIwvPyIeqpS6zJdv+u9JknCM5T83W25a/pZca2e47e5qWyl1IyKud+UJrOd6RMz9aO+nh3xjzIFE9AIAeEI29lsAwP1EdGsURb+o1WrnLFq0qNLsmE0iyH9Qq9Xes3jxYrYcD0rGmNPrFtlv9GVGxIOVUr/25Wvn93YJ8om2rbUriehSAIg88lyptX7a9DxMelhrndb1Sql/IGK1Uf1EtCRJkp2iKFqcpuloqVS6LhSXarW6RxRFbAn/TADYCwC2AgC2+o95rgDAvQBwFxFdGUXRL4vF4q8RccajYI5cW1trd/HJopS6HRHv9uXj30dGRnYpFossn3MpK6WuRcSxkDrnUh4i2qxWq+1HRPsCwB6IuCsRLUXEHXgeAMDiLMTFI0T0CCI+TETsZeR6ALh2bGzs4kWLFt3SiT4TkU6SpIyIT42iiGXag4g2R8TNAEADAO+3D2ceGP5e9yLxdwD4Q7FY/E3oHOqEnOvXr98hjmNW3NqHiFZkeC0loq0RkfFi3FIAYMxGEPE+RLwxTVN288veLNYg4oOdkKWVOhhna+3e2ZjvVfcYswwAlgLATgCwSSY/r9dR7kP2j/fkGxDxH7w3aa3/GNb2o1+YgeehnKsAHTlXc/bQbay1LwSAZxHRMxFxx5xxZCXJq4mIz8xvx3Hc1F3MGHOA5/50GyJOccfbjftFtwjyVvoXtl6AQwvx+ftsRGSvN09CxOVEtAUisncZAgDeO3hP+SsAsBLpZcVi8SpE5D3HfZD1dO1PFaUbBHm7dx3noU+0vTFmJSLyXeYJ2XcU32f4PBofAwDgOfx/RPRLrfUvWlXIbWU+dWO9+OaP73cmoJaA8nh2sv8Yxss33j23p/KSRQDPBcCjEGgZAO1IgLUI4BYC+E0K6Xduxkv4rHemFVTeNwV4EQI8nTacZxEA3Q2Af0fANRFE596IF+Uqf0+vfBkdsQOA3SGv0QJg7SYcutYn1/Tfd6Zn71QEdQwCPR8AHj9NGfZhAvg9Av6MoPCdYfzZXV0hyAmiZXDYIEL0AgBaBYA7A0Ahk5UA8AYC+lUE+L11sOayARh8ab+6WGdCfAzS5xGkh0QAzyTAvXPGhPdO3jN/g0A/WQdrLwIc309z0wA9eylBwenVqwbrr7sNr+S7kjPtQqtXFKDWUPE5gnRkHV7Kd2rfHN9uDCjvzB4v65Jnw5w2j4sA9yHAFQC0FAB5rfA30NS7K8AIAtxHADdG4/MBrkYYW7MOL2n67rqCVu02BinfLXNS4YFhvHi44Y8E0VJYtX0EuC3BWBQBVUJl2J1WbmMgfmEE9Cza8E2ae9/Z0D/4NUD07Qpe3NR9xzdu8rsgIAgIAnMKgQVKDosF+Zyapf0s7AJdQf08JCKbIJAhYIx5PQCcEQDIaVrrEwPybcxirV1FRBf7yhDRT+M4fq4v3/TfjTGn1smQdznKMWnHjx2u+IN/0lrzA0RTyRjzVAC40lUIEQeVUpe48oTUAwAHaa1/O7keYwxr7088VjQle4PM12itpzxWZ5bKPm3pjZZu1Wr1uVEUnQIATKK5Est9plLqnc0QVsYYJtxLSqnfNNvZ0dHRXQuFAiuBOBMRvTCO43N9+dr5vVMEOctgjPl+FtLAJdK9dSv/baZnaIUUMMYw4XccABzBROmkOmfMn+nt1a34MUmS50RR9F4AOLhJDB8kotO11p9HxH+5yhLRltbaqzkkoqeNvyqlDkRE56PVyMjIzsVi8ZqMxHdVeYbW+o1JkjyvTpJ/yNP2f2ut2cNGUDLGsHLHaxyZqVarHb148eLbgyoMzFStVpdHUfQzAGBFoHa/Ca6pk5+f1lp/r+6FxPng2Ei80dHRpYVC4YP1x8tjAGDzwC5MzmYA4Ar2PKGUOsvlAaWFujcWSZKElYNOC1EM87RTI6JLEPGj0/f+duQLKWuMYWU1DpfCCgctJyK6PYqiLxWLxS/4FMUmGgk5D+VcbTgkLZ2rk2vK1ti7s71mUQsDv7auKPEerTXvl8402/cLYwzfyw71yRn6u1JqS0R8YCJ/s/0LbccY82QA4Dv7sZmiSmhRzscKYWcT0RlxHDck7Xq99q21BxMR78udSuxV6O2TK2vlruMTJrsL/Xt2/2rmHs4KdN8nok81E/qm2fnU7fu4Dx/X78tp1WEExHtFbooA9mNieWc6aJGCTd4BgP/h8ZjEd4pvEZi3DePlG9fhRAMZMf6ZOvFZ9sh+CwK8eR0O/TSkjwNUPhkAPuDIe28Fh2bcv/PyL6fDNieIuD726sYKaL404U1rEAC2y8/cXAzy5TR4KAHy97VTiWlSe0yOXosATOjnpl7HIGfL+wRG34iAvCd4lfWnC45AfwOIPrwO1+R+Fw7Q4PsB8D9d/SaAFw/j0A+cg0kQDUD5DgDIi2n/8FZw79Y+K+bltOobBPSq/LZoNIHSNtMt5ZfTYS8giNgjXNM4TWuL7yKXEKQfHcZLprxbuPo/QGUO88f3zrx0bgWHWHFvPG3YGzZ9aV0B7GgAeHZG3o//RgDPH8ahH7vbe/ZSgEJ238EW7zv4ngqu8d53fItYfhcEBAFBoLcICDfXKt7tPoa12q6UEwQEgbmIQB/ttX0kSt+PpDGGrX9mWJhOE/x+pdQuzRCaE+XrVmj8IMekhiulSimOYR5k0Tn+AURUMMbc6iIiiOhjURRV69ZwTNzmplbiNMtD/jicJ9ZqtZ8Ui8VvtPDYfI1S6rDpFmLdWjB1kpHd6DsekMbn1IvjOHY/YrQpYIcJ8tfVHzO+7BFpTGtdnJ6nmUdjJk6KxeJnM88AjZpzEuRsTau1ZjKfrcbbSexF4Y0+cjmztGJFCt+jx5e01m/KE6i+f0TWWiYLfXJfqZRiKzKTEfT8yFVydPQPWusDQ4EwxrBFS57FC1fza611s0oH3uYzHAOtgL3VTWT4vVLquaFWdDwGxpiT6h40mIxwYRosABHtl0cQBVeSk9EYww+xn2u3nmnlWaHo9Yg4xaVph9vYWF29D0wwtKKEkCfSPxHx+Uopp0IZF5ZzdXbO1SRJXla/S/FZwp4N2kls9flmrfWZrkpCCb9u3S/mGkFORFtZaz8NAMd3QFkJ0jTdvVQqsbeKKanXa79dgrzBt15XCfLMswYTrW9pZ5FkVv5fUEq9J2Rfn+310mZfpxQPJcjHgLZGgLMy69UgEQjgrwWAZ9+EQ+OKlEyQGqgyif3mJhSKxwjotcO49n99jXaSIN+VVu9dgLGL6grEu/rabf73QIKcAAeg/ClWdGq+DX+JXhLkS+mwx0cQnQMAy/2S+XLQaVvBfe9sRE7vRqv2GQNyegkgoDOGca3Ti9kKGnx6CsgkcW5CoMPW4Vr2HJabBqi8zq0gjOdXcM3zplewjFa9HYE6enclgDOHwbx+ujv+RsI3Q5APUJkVhvldp+E3vY8gX07ll9GGb+e27zuZQo3zvuObXfK7ICAICAJzH4GFwb4IQT73Z6r0QBAQBASBXASIaFtr7V0Bbpo/q7V2WWrntmGtfQa7FgwYhldrrb0PEhP11Gq11WmasnWjq3/s3rYaRdFNnvY/o7VmTeLgJA/544TyzxCRlSvY3WvTib0LaK2PaMWitNnGjDGeRwMARCwrpZyWLc22Oz1/JwlytlZFRJ/Fe6K1nkEshhLkiPjEumu9//FY7+QS5LxOiOg8dsfdLnaTyp+ulDrR5S7WGMMWFKy44Uxpmh5VKpUuaJTJWvvBuiLOxz17zF21Wu0Jk2PXG2O+XXc1/TLf3hTH8d988oWQ1ET08tDQF772Jv8e0nYz9U3Ku04p9RSfcgy7EWYvCYh4ZIvtNCw2Bwly3pvOV0rNeNTsJC4TdXWBJOOq2Y38qrpSlPMBeL6dq7HWB0x2lxBCdPX6XDXG/Dcru3V4Lh3nUmSabRzmEkGeJMm+9fAvbPGeZ1nY9NAR0V5xHP+jwf1kXDmmw89cuWu/XYK8Qce7RpAT0fbW2p8AwFOaBjy/wK+UUs8POAuL1lqnR6de7xutYhBCkAPQ2QDI1qK+EEKNxPhFBYYOWQ6H7UtQOAeAnKGwcvqRFACfeCOuYeXE3NQpgnw5HX4gQboGAJyuulvFHMBNkI+v9w3kOHs2ennr7bhL9oogzwjQrwda4Qd1l4C+MYxrWUFpRvK7uId/VHCIw0m55tJ/1UMEOd8hCODzwzj0jrxKVlB5lxTAGc4IAY9fh2tmfBt1gyDfIGdjQn56H0IIcoLiWxBqPEfZY0JuchHkA1Tuwn0Hj6vgmmCvYEETTjIFIdDhu0pQm5JJEBAEFi4CQpAv3LGXngsCgsACQCBJkqMR8byArj5ea81xDFtKxhiOOc0xTF3pTK21y43wlLLGmO8BwIsdFV6rtd6PfzfG/J7jNOblJaI7tdZsIR8cP3i+PeS36GK9pfkwuRARHR3HMT86di0RkbLWPuSzQK3Vajt32k319E51kiAPDI9wi9aa48dNSYEE+RArDQQMTEOCvFqtroii6Kosdl1ANeFZiOgTcRy/31XCGMOhI9gdrSvdY63dfzLBne0Z/AjOZN4M6/tJlVlEPGR63HprLcfuvdzVaJ38/a84jtkq2pmSJPmvuntq16PZPUqpnbvhMryLBDn3+dta61d4xu+7APASH0bN/j4XCfKsj6+tn1P86NvV1CWCnGW+QSm1PyJujC3bYH+U0CUdGN3QczVJEvbO8JEONDm9Ch5jDg3T8N4YQpB3QqY8HOYKQZ4kyT6I+HMA2LYTeEzU4SPIO9lWVlfDtT9XCHIiKllr+UzvJDk+AfMvM29KuQT4bK+XTs6HMIK8vRYJ4Lsb4ne35Dp5ovGfVnDIGfqrEwT5rvScLQtgeZ/sguX4RFf8FuQDtOpdAMRu1buWekGQZ+7hObSb6+7eUh8J6A3DuHaG164BWvUZAHqnu9KxHSp4KXsya5gGqMzxxR/rEezGCg7l5hmgwZd74sCPKTA7XI+X3zO9ne4R5OMtvbaCQ867awBBzlb6WzlihG/sUh5BvozKJ9XJja7cdwjooGFc2/I7WUsTUgoJAoKAICAI9BQBIch7Crc0JggIAoJAbxFIkuRjAfFy1yultmiGPJ7eixCLSgDwxjGeqJeINsss33NdKHO/lFLsWg+ste9mQsqFLiKuVkp546VP1CEEecfm6mVa647FAm0kVf1hcyUR8SOzKw1rrX1xq9vudIcJ8rMA4JUeoX6htV45PU8IQd5EZxvFsF9srf0DADitJrI22Mjy7sxFORMBIbEX2YPBsXEc/zBPzjqJHltrOb6pz535JfXY9uUJTwbZ/sKuxX2uGd+ktf5So/aNMddlsbsbiheilMPuxWu12s1EtLOjj0FEexNjuTGrhyBnS0N2Y3pfFquaLZ92aiZudZqmK0qlEnt2mJECvSNwOXa7/zsAYE8oo4i4dT1ePbtd3H9yTMLJDcwiQc6PoxxGZD0r67BFIiKyVWiolVxDZZdWxtZVxkGQj2Y4cx9Y5k05FGSTbipf43K/Ledqx0bTe64mScKWq+yBJPd7HxF/hIhfLxQKvJfzWt+kVqvtR0RsSeeIcwqQEl1UiuMjGvWoV4QfADTEYS4Q5ETEWP/dtf+3OltaIMi7svbnCkFujGHvVscF4s1nIytkMpmzSWCZL2qtc922z/Z6CexDULZeEORBgvgzpQjpwDq8JNcitxME+QCV2Q34v/nFaSeHmyDP3JGzMqtqpxVf2W4T5EupPBAB/J/Hq9kfAPB/CPCXi2HTO+6FB9ViiFYQpM/HDRbcjjVL94wALvsnDj0yua8DVH4mAPzC1X9XHPLMvb7TW8GjdUd7VvBi/r6YkQZo1VcB6LUOOa6o4BDLOiN5CPIpd9fMm0lTd9cKDs1Q1J6GoS8GuW96bfy9EUG+lAafH4H7vkNAP4oAvo6Af7gJzH3LADZBiPdDgOPdcd3HL1EXrcOhhvedYMEloyAgCAgCgsAkBPrPR4QQ5DJBBQFBQBCYxwgEEteXa60PaQcGYww//LCbZld6WGu9WUg7xhj+APyqK2+apnuUSiXWyIbR0dFdC4XCsCd24/e01i8NaZ/zzPZDvrWWH7YLLAs/drrIOBYXETm2XcNERBWt9RS3bS0+yD1EROsRkckyX/znCVmsUmozl1Vh6Jjk5TPGcFzxY131ENGn4zh+74Y83buQdYogHxkZ2alYLHIMUSfOdTfkH1ZKzXAT3m2C3Fr770TEsQxdKamT0icVi8WvIeK92VzWtVrt2fX5x8ot7N7dlW5VSu3GxHpeppGRkV2KxSI/mG3jqohjXCulxpVoAvfFb2itG7pb5Dqste/hOeVqM4qiI4rFYu66tNYeQkQcAz136aZp+thSqbQxhEQnZ+40gpwf/DmkxVCapr+c3OaEcJmnhicAAO+jHG/R+djKlvFKKY7nOiMZY9hazxX7nfeaN9S9hJzbaPxZllqt9uQ0TTne+asnxyrsFUGOiLcR0Y95DOtKQFc0cqNLRJuOjY0dzH0hoqMC9ronaa2vDsjXcpZJBDnHPOdH358CwBVKqT81UpSrVqt7FAqF59X3fn5cdlq6EtFP4zjOtcqTc7XhsHX8XM1iKfMje55nnxoRvdSlgGSMeR1siOPpSk/QWrOy0ZQ02/eLJEk+GkXR47Izh+csh4pxpcsQ8eG8DPWzmGO4byRNAvt3otb6tLw6jTG8N3qsEsdL/wsRP88utpVSrHDECjib12q1fdmCPiN2p5x/AQR5T9Z+kiR7RVH0iUlnyDMyYrkhLER0RxRF7BEq7/cLpnvZCLnruM4EY8yTAYDJQ1/6Rpqmp5RKpRuzeYXW2gPqnyB8r3yRp3BKRPvHcdyQJAucT9Ob6Pi+4QMg5PcWCHL27MVKWRwqqKVwThtivtO9AJhm8yvIupgAXjWMQ6yI2jC1S5Avp8EnEWDufJ7UqAHArxLgOUXAv2rY5MGH4YFtCuMWx7gKAd7qVlRzE+QDNPhTAHxOwPj9BYD+O4Lo8lHQd2wKWDBgdkRIn04blHVddzboNkG+jFax5wCH1yH8bAXWvAcQeB7MSJmiABO1i3P3GMB3DOOaz0/5nY4pDMADdwFg7ncGAXxpGIfe1KjeARp8PwD+ZwD+/H367gquaXhv9lmhI9C71uHazzZqZxpBfhsA/TgFuCwGe0Uji/M96KhNq1A9OAJ8A4D3ZLjLAAAgAElEQVT/7hoBPOkmHMq9uwZYkIfBs2GxP38Yh348UWBvOkaPwoPO+w4AvbSCa3MVrpdR+XXoue+kkD7hZrxkxn0nWHDJKAjMQKCTX/ULHF6BcoFPgM50XwjyzuAotQgCgoAg0JcIGGOYfPGR39/VWjvj6fo6lyTJMYh4ti9fRpTmPkJOlDfGcExzfkjLS3/SWj9+8o/GmN+wy09HmVGl1A6IyESQN832Q/5kAZMkORkRP+AQ+t76Q6yTIJxetokHOX4MPH1sbOzHixYtYlf644nJNXaDjYiH+8DkOOZKqSt9+Vr53Vp7EBH92qMcURsbG9tt0aJFN7fSRjNlOkGQZ+Q4x82eMsdz5GhIqIU8GjfRrykW5Gz5Zq3lueCacynPjbyY73VyfVF97Dgmo2uds4hv1lqf7pLVWjvI8e49lrrs3pT3h73rluO+WHK/V0o9w+XWnK2YrbW3eUjiH2itc8NEGGNYCSjXGoSIhuI4XtXEODWVNVMsen+apj+L43hNM27c65b7h7J8Hsy/o7WeEe8y23vYRfO4AlCjNFWhxd2tjLh/MSKewtaY3STIrbVlIuKwBOcopa6a8EoQAnySJB9hhRFP3hO01l8Lqa/VPMYYJu3+VHeHztbDbDUclB555JEdi8XiHxDxMY5xuz2O41yPCHKubkSuq+eqMebN9f05l5wNXV/GGPbQcbBjvE+O4/hD03/vp/tFyFnY7J4R2L9cgpyVTqIoYpeyTiKPiC7SWr/IRd5nyhAn1L17nAIA40qoDoJ81tZ+dm90WhGyxwOlFMemDk7tjm+SJBf57rGs0Ndonk8IGRAqBRDxh0qphoqcgfOJm+vqvhEMuiNjEwT5rwng1Bo8vOY2vJI9GMBSWvWYCIiVed8TIgsB3BQBfBYBzrkJh9jjDexMBy3SsMnRBMhK21t7bg+nVXDtiXl52ifIy+cRACuxuNKdCOmqdXjJX/Iy+WNg5xPky2jwAAT0knoI9IV1sMW7AH/YMBRZgHvvrhLky+mw/QgidnGd55HnqgoMHQTI/Gl+GqAyKxR/MD8H/aqCa2d8lwxQ2edl4u8VHOLvixlpgAZ/B4A+T1fj5RDg5+tw6NnTK8nWxh2uvo3B2Ipb8NKGXpsGaJDvrWUCOmcYLrnKh9PkdpZT+SN1DZQZd1cG+lEygU6o4Nrcu2s3CfIBGnxzXXkh976DgJ9eh2syBXnX3Bi8AgBz7zv18/rkCg7NuO+E7FWSRxAQBAQBQaANBHqkACEEeRtjNJeL9mh+zWWIRHZBYA4g4F/JvtjcWSedrv9CgAh5oOJ6rLU7To8FPL3+0dHRgUKhwBaTLreg71NKfXJyWWPM2+rWB1O1vmcKHxzjVR7yx8H7klLqrYjI1kYzUvYwy9a7+7jmCRH9WxzHPwqZS83kYetMay1bZ+zhKXeG1potXruemiXImdxjK/EkSbYvFouPTdOUCVG2iGX3xr70S611Q4uO0DUJAPwYxg/11xDRrVEUsXUaW2yzi+itEXEFEVUnE71JkrA13bfbxTyLYf4PD0kwQxmmUbvW2vfXsfRZaPC+wu65Xdj+q1arPXHx4sVMfjuTtfYcntuOTFWl1GMQkV2yTknZ2mG3hrkWU0T0/DiON1pJ+OTp9e/GGCbIBx3tXqq1Pmz67xkx71RWaYUoqZN+7Pb/VUqpsxtZc/canwZjznFu+RE/d/5NDh0y2/K2uM7YY0icpzgg5+o4ql0/V40x12RhCBpOo7GxsWUhCmN1bwNvr1srf84xF6/QWs9w6RpI+HUdB5Y75CzsNUFujOG7Kt9ZXen/6mGBnlpXjsyNXT25cLVaXR5FEd+zHpdHkIfvKTO/LwLOWOfa57aNMX1FkI+MjOxcLBZv9eByrVLqAFcYqkxJi+9RuzvqSpVS2zZSSuqn9RI+RxrnDCPI6RUVXJt7hxygVWcD0DEeWc7aCu494Wq8uuH6GKBVxwIQe5dypXMrOJSrkNEOQZ7FHudY0K4QKykAHlTBNRxGJje1R5CXP4cAvI+70gUVHHJ6uJltgnyAyl+ohwFhS/qGyecNYKJQgMKAsfDwFhNKGxPlMhfenu/YmXHId6HBHYuA/D0R+u5uEdJt1+ElD07u6DIqvxgBvucYxL9UcIhDD3U8LaOVJQTtvLvWvyU/VMGh8bB3jVITBPm9CPA7AroJAP8JgKMAxGtoMwDcAYD2SQE/cDOu2RhWbYDKzvsOQG1ZBS/zKsgHxGnPdWHfcdDnc4X+58v53Ps52zcZtjk7dCJ4EwiEHtRNVClZBQFBQBAQBPoFAWPMnwFgP5c8RPTJOI7f15rMG65LIY/eXP/Y2NjyyVbIjdq01n6YiD7qkqdRbNtHHnnkMUop/gh1PUbkEorT2wvpEyIOKqUucckaUg9btmqtf5tXzyxakDtdhLK81tr/YEtyz/wJVkwInYdZ/GYmKJ/vmd93aa33akRShrbVTL5AgryZKnPzIuJhdUvnS3PW0WFEtNbVUN1l7HuKxeKZzViRcn0h8TpDCYckSS5ERFdcN1JKbecjPOt7BtZqNXZ3fVQbLvRrGabOWIMTmFprV2WW6y6Y2U34DDfFWXzg3Mc2Irpda73U9SjfkUnURCW85jLXlKXR0dFSsVhkSxxXnOI/aK1nWM2wJbJS6vaApr+NiGcVi8VfI/Ij2dxLTHxMYFatVkuFQoG9JuyZ15O6d4ZT4zgOsp7rFRqseMAKMyMjIyWlFLtPP8PVtlJqk8nuqCfnDTkP5Vxt71xdv379DlrrOx1j9C+tNccX9aZarbaaPUw4Mo5qrWe4qw0k/Hpyv+hTgpzjHu/iGYCnaK2dxNn08pmS0P5ZuAT20tFW6uTaz+4OfUWQG2P4/PqGByTvPOXyIWFX8pRF+2m9tDVh6u55QgjyCGC/m3CIFQoapuVUPpIA2ItSbkKA963DoSmK0pMzP5GeqO6Dre/3uCa/tIJrZijxTdTTDkG+nA57AUHEobIcib5VwbXsutyZ2iHIB6jsewegCHD3m3DNeOiAvNQHBDkr0+YqQ6eQ7n0zXvJ3H5bsYUDBpiPufPiU6UoL21N5yWIAVnjgUAA5CV9UwTVTvOktp/KbCOCLDQqwF66BxhXNrGcZDX4Jx92d56bOWjfTyuJusGgxwViJIC0RRM67az22+6kVHMq9uwYQ5H8CwNdXYM3vm7FuX0ZH7IBQc953KjgUdN9ZSuXV0YZQUzmJRiu4Ntc9v2/uye+CgCAgCAgC/Y2AEOT9PT4inSAgCAgCbSEQaEF+mtY618VciACZu10nUcz1WGt3WrJkidNFmDGG4y7v5mj391prjhk4IwXEtaWxsbEVPpKeK5aH/HF4vQ+DtVrtiDRNL/TME289IfNsch5jDLtPfIunHLv5XuVTYmi2bVf+XhHkPhe53SAFJvptjHE+7hPRnXEc7xiCqzGG957/duUlomPiOD7HVx8RbW6t/YNn/3BV83atNVupBCUmjK217M5wqaPAlVrrGfFvrbU/JKJcyyUi+kgcx05FoSAhm8yU9YmVqp7C7uiJiGPAP4aI2BKere9z3aI3aOpqrfWTpv+diArWWn64DvGSMH50AMDfAODPiMiPvVdnrr694Tqa7H5L2etKZqVarcaKAAcSEZPf/Oi5Qz1+M7si97h4ndHkZ7TWHOu7p2l0dHRZFEUcgmC/KIp2J6KdMvm5H3EzwtTjzm9ajz/PnihmJDlXxyHxnoftnKtJkry87vnjW44xY68hM7xa5ORnBY/NXeOvlFqCiFMIh04Rfq3hMNXOpRtnYTv9Gx0dXVooFIY9a6qhclEz6zA0b6/WPsvTbxbkxhgOt/IKF1Zpmu5RKpWu9+GZJMl+2fnkytrQY1c782lyY62tF1/Pmvu9EwT5LrR6RRHGnIStjyBnqQeozG7L93X04NcVHMp1qdwOQT5Aq04DIA51kZsigENvwiEOheZMrRLku9HqbcdgjD0Vud58g6xiZ5Mg341W7zwGYz5PDxwuxulefRLIznsZAj1nHa6dQZQOUJmVNo7MG6xGccgHqMzEMrs3n5boBABki+sG5O1MxYkBKvMdeK+8tn0xwBuV22AZHh+IkB5IgG3eXekzFVybe3cNIMid3hzy+h0wLzt630kgXnIHXuBRsPCt6FZ/FxveVpGTcoKAICAIhCAgBHkISpJHEBAEBIE5ioAxhl1QrfSI/22ttfOByNf9JElewC5xffl8McittU8nIrYwyU1s9Vq3UDu1UQZjDLvRdsYr5hiwSqmP+WTt3UP++AfPnLUgN8YwAcZuzl3JSwj4xmPy70mSfKr+IP/vvjKI+B9KqU/58nXy9x4R5N9VSr3SZV3cDVKAccoectkFe+4dkuOmxnHssgrfCLm19llEdLlnzb9XKfXpkHFKkmT/ulIEx7tvVsu/pX3QWvuhOqns3E+mP7AT0WbWWn60zLNEqdVqtWWLFy8OsbIOgcWbJ1vHHMf2aEDYLviZ0V1zQ4KciwS4p/fJnAIAWxTx4yPHer/KV6CTv7MiQZIkRxYKhVdnMcmbnW954vSMIB8ZGdmlUCi8FhFfFBCmIhg+IcitzyW29zxs51xNkuQkRPxI8IC1mbFWq+0yPSRF+4TfRu9ELd0vJj8jd+MsbKd/IZ5HiOhTcRz/R5tDk1t8NtY+C9OHBPkVAOCKOTuSecTwEm+Zm/VHAIDD5jRMeXejdubThobaWy+dnGedIMh3plVbKaB7nfdCjwU5lw0g5bpGkC+j8oV1V9Gue/BYAvFmIWRbqwT5cjr8QILU6YWCAD45jENeL3IBRGTXYpAvo8FnIaDzO6GTcxigcQiAARp8LQB+1dHWlDjku9HqzcZg7G4A0NPKEEFxR4QaE+SvmVkf3VOBtdsDAt9zIVN0YBfneenWCg7tGoQBQTQAg0ci4KtpA3Hfobvr7BDky6h8Un3369l9pwCFXW7Ei7whuILGQjIJAoJAQwREFUQmxmwhIAT5bCEv7QoCgoAg0AMEjDEc4+1lnqYaxoltRrwQK1AAeFhrvZmrXmMMuyJ+nSMPW4Bz7Ey2YJ2RiGhbay272nJZOd6otX6sr3+9I8jHJZmzBHm1Wt09iqLrPHh6CQHfeEz8boz5DAC8MyD/l7TWbwrI19EsXSbI2SL+g/UYvz6X9l2Ju8pAEdH21tq7PKB9U2t9XAiwSZKw+3u2jMhNRPRfcRx7FSImKgiwoJze1p+UUk/DCEebJYZHRkZ2KhaLHNsud8+pxxs/JY7jD0yawxxj/sy8DiPieUqpF4Tg124etmaMoug0RMy1immjjVyC3BjDXkBYkcEVEqOZpq8gojfHccwWY11N1tpnEhErYu3TakOOj/+uE+SZG2Z+mGXrtukPt612aWM5IcjbJ8jbOVeNNacBjY9tT1KapnuWSqUpd4D2Cb8NoreDw0Tn+40gN8Y49/9M7ldprc/q9ADO5trnvvQhQc4umXNDXgDALRzqJHQc6kq6rPjGnlbyUkMPWP20XkL7mpevMwS53w12mAX5qksA6FBHn7pGkA9QmZX2Gno7y+S5rYJDvjAL41lbJcj9LqPHq39tXY6v+8Z9NgnyASqzt6Uf+mTs1O8E9IZhXDsjNNIAHbo9QIG94OXeWyOA7W/CoXEyezkNvoQAvztTLvp9Bdc+eYAGOSTUTxrJnUL0tJvxYr4js6KHp/90WgXXej0BDlD5mQRwOrZxd83HeHYI8hBPDZ2aFxvqifas4MW+N4/ONim1CQKCgCAgCPQEASHIewKzNCIICAKCwOwgkCTJx+pWph/ytP6gUmorRBzXVG4lhbgpZPe4WuvH5dVfj2MdZ8TbFo48dyLi+z0ynsTvCa48iPh0pdRvXHmEIB9Hx0tsB8Q7DarHN+8y65yvAYA3Xh+Tj/UYxye0M6d98uT93kWC/KrMewJbPHlTN0gBbjSE0AaAhm5EGwk9MjKyc7FY9LlOPFNr3cDKIh8GYwzH/AtRkBhL03T3UqnErtJbSkmSXOAhmG9VSi2bmI/GGI4Nnxv3EhHLSiln/PiWBJ1WyFr7NCL6KQBs2Yn6GtSRS5Bz3hDr+yblMkT00jiOvd5Mmqx3Y3ZjDBOPHBKgU8T+dFG6SpBn+/XFAJB7FreKzUQ5IcjbJ8jbOVeNMd8HAPYK0JNERHvFcczeHDamThF+7eAwIUw3zsJ2+meM4dAwHCImN6Vp+rxSqXR+Jwdwttc+96UPCXIfof1XrbXLRfeUITLGsFvwFY5xW6e1nvF7O/NpcludWC/tzrlOEORZ/HD2VJSbwgjyPPfWG6vtGkHuI7UJ4K/DOBQ0t3x1AeAXK7hmRsipEFIbAI6p4JA3hFFIXQrMttfj5Ryne2ailcUB0B7vKnhiBdecNr3wMlr1BgT6UrtzM7Q8Ab5xGNec0Sj/AJX57YDD0eQkOraCa8fJ/AEa/AEAHjs9IwGeNIxrPrYjPXdxDNV7AHBRA8BOqeDaccXaARr8HwDMDSmGgIPrcI0zzN0ADb4ZALt4d50tgrzc2/sOwF7DODTlvhM6rySfICAICAKCQH8jIAR5f4/PgpROXGosyGGXTncJgSRJjmZrRF/1RLR/O5Z3AXHDWYRvaK2Pz5MlSZJjEfEHPlk79PtXtNavd9UVSJAfrpRiF7+5KaSeuWxBTkRbZPGEXTB4iXZX4Sy2ND/g5JKKk8qfrpR6S92VvtclZofm0pRqOkyQWyLi+IRnxHH842bk7QYpwO1Xq9XlURTd5JHly1rrN4TIG0iQn661DraIJCI0xpwfahVdj4n98TiOPxwib6M81Wr1qCiKGlqBTORHxEGl1CWPPPLIY5RSrBCQZ3F+o1Jq927P32wcrwaAXIWkHDySusURuxdkTx0cp5rjbeclJ0HOhay1764rv/xnBy2Z+VH9qVrrP7Y6no4zikOJ8D7U7PfTQxlm7HmBXUa7PKl0jSDPlIz4cXdGXHgPVhzDka2meMw5JvUTXPk7QJBvOFcdHwRyro6PQMNz1Vp7NhEd0+n5n1dfNwnyTtwvunEWtkNohoQCIqJ/i+P4R50aw35Y+9yXPiTI2RuVy4r3Oq21y8J8+v3PR5D/TWs9w/NIO/NpsgCdWC/tzrlOEOQQQKaGEeSDFwPgKkefukaQD1D5BvaO7Wj7ugoOBc2tVgny5VR+GQGwJ7ncRAAvGcYhJhmdaTYJ8uVUfhMBsNJrT5KLIF9Gq96LQJ90CHJ6BYfevDcdo0fhQXavPuO+lwI+8WZc839chyOu+Z8rODSuyDhA5T8DwH45bT6wFdy73dV4da7ywXI67AUEUUt3VwS6LQW8C71319kiyFedDdDD+44Q5D1Zg9KIINCvCAhX1a8j0xm5mn3g6UyrUosgIAgIAoJATxAgSre1tsaP8k5rNyI6NY7j97QiVEjc8Kze4+uuCr+R10aSJD9FxOe0IkMLZR5QSu2AiEz2NEwhD/Bpmh5VKpUucLUfUo8Q5PkIVqvV3aIoYkuqvTzjTIj4gRD349750sbtN5AgP4uIprspZ0LfRlE0QkR3IOINxWLxT4g46pW3QYZukALcTBY/+0GPTN/TWr80RO4Qi/Q64f3ROI6DY8wlSfLRurV2M4Q3RVH03GKxeGGIzNPz1An2gjHmFkTc0VF+PMa5MeYd9Qezz+bly7wEnNqKHM2UsdaeR0RH+9YUEa1FxJ8h4h+TJLl+yZIl/5wg740xbOnjUlzwEuTcfjYH2NMJk3pMwLabLtFaD7ZbyeTyRFQyxqxDxMd46uX1yg+RrNjyV6XUDYj4wEQZY8y1HtfsXSPIjTFvqytEfD4Alz/XleZ+FEXRVbVa7bpSqXRrPbRDLRurFyKi09VpuwS5nKvj+2zLimfGGI6R+lrHOP9La719wDxoOUs/EX7dOAub69/UC0WSJC9DRCdpxaGGtNauWLdNjU0/rH0WuA8JciapHp8HJhHdGcex61yfUjTAxfovtNYrG9whita273minX2jqQnlyCwE+QZwBqj8e48y2p0VHAqaW60T5KueQzDuJSg3EcDrh3HoK77xn2WC3Ev0p5DufTNewiETupqWUXlPBMhtB4H+tg7X7rOMVh2OQBfNWOsAtw/j0M4Tfx+gVScAUEP8I4BdE8BHFBBb5ee923+ngkMvz+v0MlpZQtDsIctzd6XxuysBXBZB4a8pVG8Yxss33l2XUflat2v2WSPIvwpAzvtOBYe6et/p6oSTygUBQUAQEAR6hoAQ5D2DWhoSBOY/Am1wSvMfnFnsoe9BKhPtfqXUroi4vllRjTFs9T3Dhdi0elKl1GMQcTwu14wPRqLtrLW3d4gcCeoCER0bx3HuQ38IsU1Er4jj2PnQGVKPEOSNh8xau4qIvhfgAnqUiI6P49hrBRE0OdrIFEiQH6i1/kMbzXiLdoMUmGjUGFMFgNghxO+01k/xCrnBgrhMRE4vDADwFq11kPVIZs3N1vbN3nEfSNP0ia26Wk+S5GRW0HD0eYSVcurxq5k4zbPgTZRSOyHivSHYtZoniyPP+21u3PS6e3req4/SWnMczYapUwT5ROVEtLW1lmOhlzMXli7rdGf3lVLbISJb73QkJUniJYYB4CpjzNGbbLLJdOWXjTLMMkHuI+c5zAoTcw3ikW644YXg0C5BLudqewR5nWj7QJ3A5RjzuanT66PBna5vCL9unIXNEeRT0bHWHkxEvlApZ2it39iRzWsDMd3G2t8gRbtrn+vwfY8g4rlKKY63G5zaGd8kSS5GdFoYU7afPeITiJWorLWcL1chmT2QKKVmeHdoZz5NlksI8qmjNECzakHuDKXDB+p6MJvdjZd7v7tbJchX0ODTU8BfeebuqRUc8irIzyZBHtaPR12b+9Zqu78P0KrrAGj3vHo4DjkBfIyVDxrk+UoFhzb+fRkdsQNCjT30zPhmQYA3pQB3IoDDE6C73/745eMSXkVQPHoYf5Z7d+1fgrzM313O+04BCtvdiBd17Hug3fkj5QUBQcCNgHAKMkNmC4FmHw9nS05pVxAQBBYaAnIydmzEjTEnAIBXO7yuXRzsFnlCuFqtdkSapl6rS45zG8fxc/M65bOq7BgYkyoiogvjOGYypmEyxjDB91tX22ylqpT6uCtPjwjy+7TWWzeDUz8/yLGL7Fqt9h/ZI78v1i+7yDy6Gy6Vm8FzIu8CIch/BYBPZ8IsJzEZvJXLQ8NEOWvth9lC3IP1U7TWv/ONR7Va3T2KIrbacbmwdlXzJ6XU01qx2h8dHR0oFArsej73bk1En6rX/d7GAowfeuNW5r5+tvt7kiTPR0Sf+16nxw+WodME+fR+Zd4K9q5btXCczicCwNMAYP+Q/jPpUR/LoZC8IXmMMV8AgLc68lKaprv5FCwCiKquWJAT0ZbW2vs8ff2m1vo4V552STI5V8fR9YYcaYfoqlarR0ZR5PRsU1eAeVPdirxrMV376X4RSKA2FWaonf5lY8tKUK67zS1KqeWIyOEN2kr9svazM4PJuqfndYjPJaXUvzXT4cDx3S+OY1YSmJICFNsAEZ+hlPKRjKzs90wi+oVLdj7/lVKfbnDW9Y1CSTPYN8orFuQbUBmgMit1vsmDZ7mCQ0ykO1OrBPnutHIbC9pJDBLAb4ZxKHdNTgg2mwT5brR6szEYu9+9Z9LZFVz7Ih+Wnfh9gMq8hh1KBfgiAGJvPY2sto+q4NCU83mAyqyI+uSZstGFBHg9ArDnqUYpWQ9mG5eSxQCVvXfXMRjb7Ra8lK3Mc1O/EuTLqXwkATjvO6xosA6Hunbf6cSckjoEgf5DYI49xs8xcftvvEUiRkAIcpkHgoAgIAjMcwSIaLG1dhgAtg3o6qu11v8bkG/CLe7PAcDrugoRD1VKseVkw2SM4XixB4S028E8tcxac6NV++S7VZIk+yLiXzztNXSXOLlM6wT5o9IkSfLxuovbDzpkqWqtFzWDTTsPvJPbaechv5G8RLRprVZjF+TP9/WHLY+11i9HRHY/1xdpIRDkSZJ8pO5m+yQX4ET0wjiOz/XkQWvtdQDwWEc+DoewjY8oqIeJ2MRayyS6zxW/b578r9b61b5MjX43xjAh63LtzRoFuXdvRHy6UopjRHc1GWPeDgCfczWSkb3OWPOtEuSjo6NLC4UCnwln+cZ1uoxZyAX2KuGMo+3zENIswNbaHxPR82aUy7ZpRLxNKeWKZTtedLYIcmMMn6++uOyvbWw9/miv2yXIZ/9cndKXeXmuEtHm1lq+1+i8eU5Et2ut90bEh5pdCxP5kyRhz0EqjuPvTK+jn+4X1tpDiegSTz8P0lo7FSKn3XvaIjSNMVcDwBM8Mr1Ka31WM+NTq9VWE9FrjDFvXbJkCVsl8p7TF2s/k4Ut5w92zMs1cRwf3kyf2yHIrbUriYi/Y1zpNK31iT6ZAkIbcBVP0lrz2E9J/bRefP30/T5rBHmDx/HZtCBfTqteTUBnuvAigO8O49DLfJi2SpBzvQNUvhkAdnW0UTd2jvaq4MV8F89Ns0mQZ/3g/dnlmSpFiJ66Di9mJdmW0nI6/ECCscMruNap+B5g0c4ewhrcUWk0gdI2d+AFI5MFHKA8K2gaRYAKAbKi6IxEAD8bxiFnaLoBKrNHrZl310dru62CQ967a/8S5IdtThC57zsAtxehsPeNeFHL950BWnUsAql1ODTjvtPSZJtcSIi9tiGUCgQBQUAQ6AQCQpB3AkWpQxAQBASBPkfAGMNxYjlerC9xHOeTisUiWzqavMyZ5TgT6SGk+1qtNbvMbZiSJNkPEf/sE6xLv79Da90wJuvIyMhOxWLxNl+7RPSCOI4buj/j2LoA8GlEzLVUz+p3Ps5aa9ma+hMuWdI03b1UKt3gk3fi9358kMsecs/2EKbchbFsnp4yEQ85tN/dzrcQCHJjDFvz+lzEc/zlx9fdjts8zI0xb6gr2Pi0+r3xzDOPA+fwWvSM71eI6LkBcaTfoLX+crNzJUmSYxCR528r6S9a6yDr6FYqn1zGWmvRgsYAAB05SURBVPvvbM3u2U8eWyqVbnTlaZUgn0Ro8Bxi9/m5btwbtR+CMyI+Uynlc2McDGWSJByHfXVeASYc4zjeGFfSMed9ro67YkFujGHrJB/OJ2itv+YCpV2CXM7VcXS7akHODVhrzw3YD3+ulOL90Os+evKcYCUHAOA74hF5LrH76X4RqKTYVMzvdvtnrX1nXRnwM54N6GEAeKbW+k++jSo7A9+R7etFItorjuN/cLl+Wfssi8+leeg+Ou08O4yInFa4RNTQgpyItLWWFQlcHpiqaZruWyqVchXGsu8YJr6V64zQWnMoKw5lMSW1O58mKuu0wqpv3jX6fdYI8gbCzC5BfujuBAUn6TwetwTgedMtiid3ZQWVd0kBeG45vrfxixVc85ZG47GMVn0XgV7iGcsrLDy86ja8kuNQN0zLqHwKArzPVY8Cs+31eHljhWVaWRwAnfs9sKFePLGCaxq+VQxQmZVU/tvTj9sQxg5dh5de38zcXUHl7Qjo/QTIbyUPVnBoG2d5gmgAyncCwHbNtANAF1Zw7Yz3gOV02H4EUQvvIPi6Cq75qkuG5VT+GQHk312nxUR3jH9fxiBneZfR4LkI6Pz+Q4CfPwLw3H/iUFP3nRVU3neM7zsARwDAuRUcaioESHPzo9O5+5t572/pOj0WUp8gIAjMBQSEIJ8LoyQyCgKCgCDQJgJEVLDW/jJzURtS2zoi+mYURWuttbcsWrSoaozhGOLs4pY/tJ8VUgkArE/T9PEuosUYcyoAvMtTX9OWNEmSvBgR2dLQlf6otW5oxTOOWc0+AASbeOrgxy6OfX1ZmqZ3I2KJAPaKEFkpgPEKSU6C3BjD8crO8FR0ptb6NSGNcZ5+e5AzxnC8TbZqdcW2nugeP/zOsMIJ7PuYz41wYD0Nsy0Egpw7HmAtza5Jzy8Wi69ExAeng5W5+f4uAJQceBMRHRDHsfPhyFr7fiL6T8+4XaWUekatVmOLMY557roDs3LQM0Lcuk9uM3tsZ6WaEMWh6eJ21eXx5MaMMWwh77RsQsR312Ov5hI41tqDiIj316UO3K/WWs+womlg8XcJEZ2utWYSOvGtvyRJPla3PP+QI1+qlNoREf/pqyv0d2MMW3K+0pP/QK11ruJIhvvpnjnfFYI8CwHgdKGJiBcopY7K62NGbn8LAA5x4eCKQZ7dRR4AaP5cZe8QKOfqZOhzifZAUpjrGiai92mtz3OtPfbQYYxh7xjHIyJbrI3vn3OBIK9Wq3tEUTROFjvStUqppyDiFMu+vPzt3p8yPK9DxB09cvFj/vvr+9lXELE6PS+vp1qtxgQx74cb3SRPJsj7Ze1n9wY+M17s6fNxWutvhu7N7ViQcxuB94cb0jQ9slQqzSDeWBEWES/ynIXcVO56bXc+TWAlBPnUWTObBDlLku86e4qcBgE/D1D7+kZil1YWl0HxSQj4MgDk+9oS93rIJ8iXUnl1BPCzgPV0DQGeZECvnbBw5vjYEYytJiB2Fe/02sP1d5Mg357KSxYDDQOgm7wGWE+AJ1uofe12vJRDWTROdExhAB56GgK9jAA4tNHiLOO9XoJ8nJQtfx0Bjg/AdWMWAnzjMK5p+C0/QGW+nw00UR8RFHd0xQ3P5qD37opAB67Dtbl318wbgufuSp+p4Np358k/QGVneI12yOdldNhTEaIrA7AbJoD3FaFw3o14Ue63xra0cpPFoAYjQB7fjfeddmQMkE2yCAKCgCAgCMwyAkKQz/IASPMLHQHRnVvoM6CX/R8dHV1WKBTYBXEr5E1LohLRyxu535z0mFMwxtzqsehMlFLbNyLZXEJlruXZ7ZbzYYGIcmNPGmMuBYBnt9T55go1IMgf3R+stc8iost9VTLxh4jfRUSOy83uVQ8gItZW31Rr/fjJ5XvxIDdph3NazCVJwm7SmXjpRWKCvNithnwEeYaJk0jrhGztPhr7ZMgIGHYH7rtL8gPVDwHgmnrMvkcQcWciYmuGZ/jaQMQfKqXYjW9ustYeTkQXeuK5Pjg2NnbAokWLONQEk/shSjm3KqWe0Kz7/sC6p/dnfUbossVg15Mx5nEA4LNK5Ni3XyWi/6nHRb+JyTMi2iZJkqcVCoVXEdHRAWMfSpBP9PmherzXS4nol4j41zRNbxsbG2NMqFAobFlXRNqzHvaC49NynElXrPeL4jhma4+OJWPM2wCgobeRSY08gIinWGu/v2jRIrYuomq1uhO7kwcAtkxizwu+1BWCPCOm76p7kvE9Lq9FxI8Xi8U/1pUk1mchL/Znl/UA8NpJj8i5/XAR5Nn6m8Vz9VGx5+q5Ogl457lqjGGSkR/+Q9KDRMT7+bVRFN1DRCOIuCUR7QAAe2T79QyX7XOBIK9734mttayk5VO++xsrIiIik+mWiHi/YfL5udkdlBU7xlMn7k9JkrwMEb8dMjgA8BARXYGINxHRw4i4pH5nWlG/8x3UaE1PJsj7ae0nSXISIn7E02c+e77O99koiu5O05Stu5+c7f0Xaa05RMjG1O5dJwvPwuSU79vIIiKH2vg1ANwHAFsi4sFZOCDfnZLvE4/NU0LpxHzK5uUW1lqO1exKXg8WgXOyYTaxIH8UlgFadQIAfSUcTxoFQL7z8H0n1xvBzPryCXLYYO3Md1+vG+2sXlb65jnEc3rzcNm7S5CzHMupfDwBfD1QJgtAVwFE1wCkdwBED9H4e8D4mbYUNyj6bdGgriCCfIAGjwLAnwTKMp6tAIVdbsSLGnqmC4gVPr2pKys45FXCX0aDb9uggOFMfLadEgF8/yYwdwJsS8vh/p0ACoemQG/GoLvr7BHk3LMBOuybAFHwfQcBfkMA1xLQPQjRCEC6JQDuAIB7ABB/nzYKUTPHLMibmZ2St98QEJag30ZE5FkICPgeNRcCBtLHuYSAnBRzabRE1j5EIHO1yLEYN+22ePWHoPcppT7paicjt9jyIjfxg5RSyhuPulEFxhivtUr9cezUOI7fk1M+xHK7E1A6LciJqGSt5Q9Y3wNvnizXaK2nxHjvpwe5QFfbncCZ65hVgjzrxJwnyLkfIbHI2xi0YaXUgS6CulqtLo+iiK0e+DExNxHRMXEcnzORIbP0ZmsDXwzYtUqpwxu5RM1rLNBacXrxL2ut2d18z5Ixhl1/7t5Eg8746Tn1NEuQNyFOblZ24cnW/z534k21NTo6umuhUGAXuz4iZHK9rWDWAYK88WXZGMMP9Sc00fFW5IcAglzOVa2dIW86YQlKRJvV71gct5VDvXQlzQWCnDtujPkFuytvFQSlFJOhHSXIM7m8d9RWZJ5MkGft9MXat9YeQkSXtdKnrMwXOk2Qc70Zyc7fIs3s76HdMIh4iFKKFVAapn66j4d2Ki+fEOSPIvNEeqK6F7b+IwLsw39t6UANGhAHQT5OLK96KQF1PnbyNNm6aUE+0dQAlVmpyBu3PQi2xpmCCPKd6aBFCjZld/ITlue+Jv9UwaEpiuqTCyynwUMJkN9nghIBvXcY137al3k5HbYrQdSDu+vsEuS70erNxmCsq/cdsSD3zTb5vb8RECKlv8dHpOsHBIQg74dREBkEAUFAEOghAsaYJ7DFJSJrynYlsfXH27TWX/TVboxhF8vO2GhE9OI4jn/gq6vR79Vq9agoipwa3kR0p9Z6l7rLXpZ7Ssqs0NmyZPtW2m+ijJMg53qMMRxnjC34WklCkD+KWo8JcgQEGn8Ym5TmBUGexT39ARPQrUxKRxm2ljs4juO/5OXJ1iaT3L643Wdordl9/5SUEdnspt/nYeKUOI4/ENo/vlgnxnA4C6+F/KQ6Hx8SZzZUhpB8IbGkQ+rx5JkNgpzPHl+cypa6FhBzvaV6pxXqAEHeWIyRkZFdisUiK0Ys6oSgeXX4CPJ+OFcnnonm87nK4zMyMrJzsVjk+Mx7dmPM5wpB3qS19lSoEEAVu0OQMzFaq9XOzqyQOzZE0wnyPlr7kbWWLfXZK0ErqSsEOQtijOEYzv/TilCOMnz1O15r/b+ueucHQb5hVxWCfOpIL6Xy0yKAKzxejtqcdm6CnCsfoDIrgBzeZkPO4r0gyPemY/QoPMhvB+xNqBspiCDPMP0xx5APFOLkCg7lhgZiZYr7YGv2etfIqn1GEwhje4TGWh+gVacBEHsx6nzaqPUxuwQ5d2w3Wr3zGIy1dN8JVF4RC/LOzyCpURAQBASBcQT6QYVDCHKZjOEI9MOMDZdWcgoCGxCQedtwJtTjvW5njDkziyXZydlSqbuAfIVSil0QOlNm3cQuX12P9Y8opbYLjQs5vcHMUpTj0Do/OBFxtVLq4kYCW2tXERE/LLRyZvJD4JcCHt28BHn2wMmEns8NZKNuCEH+KCo9JsgbLoN5QZBzz9h9qzHmZER8b/gacW7MfyOif4vj2BkzNkS5pv6A9helFLtmnRG7lWU3xrDCCSueuBKlaXp0qVQ637enTfxujGE3f6ExVH+rtWY3uT1PxhhWYuLYkq0k3tvuAIDDHIW7S5BPnUYcT/B1zcSubbbTRLSk7pb75wBwYLNlx68jiOcTEbu3d8Vt7xpBzjIkSfIiRGSr1VbOM3a7+lOf224fQc5yLOhzFeFErbpvQT4xR9lNvrWWw0q8rpV56yozVwjyzM04W5FvjNPdDBbdsiDPzlBljPkoIrIno45YME8nyPtp7ddqtSPSNL2gRcKwawR5htGxiMgunDdpZn7k5H0gTdPjQu4O84Mg34CCEOQzZ8MyKh+HAN9o8dzl+bgKAHbOn5N+gnwZrdwiAn0p+T0nzWiGAG5HwIsAyKmk3QuCfFw4AlwGg29FwFOasOAOXdLBBHkWm/vMsIrxKRVcw2HuctNyKn+PAF4cUN8/KjgU7Bkmi9/+cwBs6e4KgOcDpI8DQMfddfYJcsZtDzpqUwPVrtx3xII8YGZKFkFAEBAE5jACrTyOzOHuiuiCgCAgCAgCkxGoVqtHRlHE8QBDYqPmgkdEd0VR9Plisfj5vBh70wvXY4+/pv7B/zXPiHxfa+20MPeNqDGGHxeO9+T7ntb6pXl5kiR5MSLyR3Co5d1oXQHgs1rrj1tr2aUaW7q6kpcg58LGGB6nHwHArr5+T/tdCPJHAWmBIA/XtPHFIM/EmDcE+QSstVptdZqmnwAAJgBbSY8wWa2U+mCdKOD/5yZr7bs4NIKnkREielIcx3/31HUOE/Keuh5M0/RJpVLpxpCOEdEiay2TxyGWIMd1k9R1yUtEkTHmU4j4riYebmvZ3nZSRrq5rFIaEuSjo6NLoyj6Msf3HQ/L2GbiMBxpmr7Pp1TRZjPjxesx2bdm5QxELDdRH8erfafW+ixjzLWQuVvNKd9VgpzbTJLkJYjILpeDSSAm9621byoUCgch4g9dfQ8hyDM55FzNAbITLtanV22tPZSITmrSu0XeUHOc2l+kafrZUqnEShNTUj8SfkS0lbWWLf6a8e4x3q9uEuQTwBlj+Oz8DAA8u4n9uNH4XKaUYkUYdv87JfXL2jfGHAcAp7dAbnWVIM/2Jfa2cCoiHtHiOBAi/mRsbOxdpVKJPVB5Uz+uF6/QORn6hyBHjkt8MQAyuZyXfl3BoYPzfhyg8sl1fS6XB6EmyNTyywiAlRJD43rfkQK95WZce94yKt+IACvyu+EnyLnszrRqKwXECnKh9xciwO/XAN6iID0CAL/lPPvBbHs9Xj5j3xkvQyuLA6A5BI4j4YkVXOMMPzK58C60eoWCsZMJ4AU5MaObmsYI9DcC/EYFh3zfF+P17kartx2DMVb0jzwN/bMCQ48ZdyfmSMtp8CUEyNbxzkQAnxzGoff58k3+fSc6dGsNBa47dOy5+H0E8M5hHDprGZWvRcB9NgQKaJT6gyCfkCxzWd+x+049Zj0r2H12HQ7NuO80Mw6SVxAQBAQBQaB/ERCCvH/HRiQTBAQBQaBnCBhjngoAxwIAPwhxXNqQ84FdgV1GROdqrc9HRNOMwCExIYno6DiOnS7SfW1msQXZ5ZYrjSqldkDEh/IyZS6Z2T0au5PWOfnYWv2H1tpPLFmyhAkyJrUZ244Q5FxfnRjcpFarvZ2I+IFxN1//WQREvEAp9cLJefvpQU5ikAeMYpNZQuZ9fe3uF8cxE3YdS/WYt+zC8fh6nFGO9+oLTcCPZf+HiD8tFotfQsR7fYJkMUx5PfuI1ddorb2WHUS0pbX2GgDYxdP2n5VSTA6O+GTM1j27amWXra50n1JqpzwL95B2OpHHWruSiD5cJ7wOcdQ3XFekuiBN09NKpdL1WR/5IbNpgnyiDSLa3lp7JAAMAsDTAsZgY9H6ecWeBs6rx1f+QafnsA9TViyw1vL+y14T8lwF8ysiz+3zisXi6YjI1td8Hsw6Qc5yVKvVFVEU8XnGCmh55xnLfDFbVCqlLuVyIa75QwnyTI49MjnkXJ008bpBkE9Uz3cZRHw1Iq7MFJpKvjmf/X5vvczlRHRprVY7f/Hixbfnleun+8W0ew9aa9nDB1vTh1iT8zpep5Q6ABHXT9q7itZaD9kDJ2pPrPlG+FWr1d0Q8TWIyGcpxy5WnvEZ32uI6AIi+n6pVOIwCrmpX9b+6OjoQKFQYKv5FwHAVgFz8GFE/Gh9f2Elgo2pW3edJEn2QUQ+31iR67EB8rHXm0uyM9I5BtPrmlgvHlVM73zq5r4R0P/xLP1DkLNb8cG+IcgZm11ocMci4McAgL/H8ohyVsT8ioWHT7sNrxzlch0hyCdNLo5JDkDvcliTV5HPfoCTb8Ih9lzGWL683wjyiTm5O63cpgbqlQS4OlP43zJsvtIoAV6JAJcB4E8ruIa/BZpKAzR4BQDmKllwZQT0jWFc61PUB7byR9B3+zyJEMBTh3HoqqYE3SBItBxWHcfxy113V+K7K8B5Y6BOvwUvHL+7biDIx8+jnNRfBPmEkAN0+B4IY68maP6+AwCXI8ClBmrn34aX5d53mh4HKSAICAKCgCDQlwiEECB9KbgIJQgIAuI9XOZAdxBgwqhWq+2bpulSRNwGERdn2tFVIrq//nB3a61Wu27RokU3d0eC/q6V46fWarWnE9FyRNyKiBiXf9Vdy9+klPodIrJlVU8SW2LWCZjHRVHEJNtmGdFhiWh9JtP1Sqm/IqLvIbcn8kojCwuBjIjZk9cJ/wOAmIgeIKL7oii6s1gs/j6UcJ4byD36AmmMeXv9AfRzHrnZywRbb/dFYsLaGPNMROT9hK2LR9M0vRMAronj+K/dFjJzBb1ntrduhoibZhaGhogeJqIHEfHGbE9zehnotqwT9SdJwvOb3fizMojO9l4+I387oSTVK1laaYfdxtdqtWcQ0QpEZI8H7CHgbkS8rlgsXoWItVbqbbaMnKvNItaZ/ESkrLX7ENEyRGTCZvPsLsH3CF5jDyHisDHmhiVLlvBeMG8SW5TXarUDsrnP9ye+644REXsAujuKokqxWPxz3cPGw7PVaSIqWWsfR0R819siGyPeZ1imBxDxhmKx+JfJ5H2orH209jlMC1tt74eI22b7PivAJbznZ2fQ3+I4vgkRnRaYoX1vNt/69et3KJVKj6+T39swmc/nY3Ym8V3mnmKxyMpQrDQsSRDwIrAbrY5TSJ8BQOwNbPsUgPfafyFEf6zgxU0pV3gbc2RgC+wi1J5AADtGgIsI4G4AujWB0q/uwAuClEHbab9bZVfQqt0IaE8C4jvN+LnGbRHg+ghgfQrp7SnQDbfAVjcD/nCsW3L0c73LqLwnAj4ZgDbcXYHWR0C3WsDf3oprxxX851viOO/3wlb7AHvoz+YFAmxGgBY3rMGHAGg4BbzhZlwzr+47820spT+CgCAgCHQDASHIu4Gq1CkICAKCgCAgCAgCgoAgsCARICK2UmTX7nnWxeNvdWma7jlhjb0ggZJOCwKCgCAgCAgCgsAsIhAeQmgWhZSmBQFBQBAQBAQBQUAQEARCEZhxvZP7ng86Ich9CMnvgoAgIAgIAoLAHEFArj1zZKBEzHmNgLW2TERrPJ28VGvNrlsl9QUCsnv2xTCIEH2NQDdWSTfqDAFxttoNkW3e5RGw592QSocWEAKyfhfQYEtXBQFBQBAQBASBhYmAEOQLc9yl18EIyBdBMFSSURAQBAQBQUAQEAQ4TvMFiMixtXMTEb0wjuNzBS5BQBAQBAQBQUAQEAQEAUFAEBAEBAFBQBDofwSEJQgYIwEpACTJ0k8ICEHuGQ1Z0/00XUUWQUAQEAQEAUFAEBAE+heBarW6PIqiGwAgypOSiO7UWu/aq/jO/YuWSCYICAKCgCAgCAgCgoAg0FUE5FGzq/BK5YKAICAICAKCgCAwtxEQgnxuj59ILwgIAoKAICAICAKCgCDQJwgYYz4DAO90iUNEH4/j+MN9IrKIIQgIAoKAICAICAKCgCAgCAgCgoAgIAgIAgsIAdGfWkCD3WRXF9rcEIK8yQki2QUBQcCDwELbRTswIQSyDoAoVQgCgoAgMMsIENFia+3tALCFQ5SxWq02sHjx4lsB+mH37wcZZnngpHlBQBAQBAQBQUAQEAQEAUFAEBAEBIEpCHT+S7HzNcqQtYqAjEWryEm5+YfATIJc1sf8G2XpkSAgCAgCgoAgIAgIAoJAVxEwxrweAM5wNYKI5yulntdVQaRyQUAQEAQEAUFAEBAEBIEFiIA86C7AQZcuCwKCgCAgCAgCgkAbCIgFeRvgSVFBoH0E5AOmfQylBkFAEBAEBAFBYPYRMMb8BQD2dUmCiKuVUhfPvrQigSAgCAgCgsBCQUC+OMNHWrAKx0py9hAB58SUWdvDkQhrSoYkDCfJ1RICMr1agk0KCQKCgCCQi4AQ5DI5BIH5hIDclObTaEpfBIEFh4BsYQtuyOdNh621hxDRZZ4OVZRSKxCR5k3HpSOCgCAgCAgCPUdgxn1JLlA9HwNpUBAQBJpFQDaqZhGT/IKAICAICAKCgCDQfQSEIO8+xtKCICAICAJtIyCfk21DKBUIAoKAICAICAKCgCAgCAgCgoAgIAjMCwTkC3leDOMc7YTMvjk6cCK2ICAICAKCgCAwDQEhyGVK9DECcuXs48ER0QQBQUAQEARaQEBOthZAkyK9RUAmaW/xltYEgf9v196REIZhKADe/9ZUUMAM4ySWLVnbB3/2KSFYEEgp4FGYMhaLIlBewLOlfIQ2QOBHwH2tKAgQIFBXQIO8bnZWToAAAQIECBAgQIAAAQIECBAgQIAAAQIEAgS0fwNQDUmAAAECSQQ0yJMEkXsZXoZy53NxdeK8CLbocrksgn46TY+gluxyySRP8/Z5AgTGBNzQY05ZrpJXliSsgwABAgQIECBAgAABAgQIENgjoEG+x92sBAgQIECAAAECBAgQIECAAAECBAgQIEAgh8BJ/6M8aS85qqPsKpRC2egsnEC4gAZ5OLEJCBAgQIAAAQIECBAgQIBATgGHhjlzsSoC7k01QIAAAQIECBAgQCBOQIM8ztbIBAgQIECAAIEhAQegQ0wuIkCAAAECBAgQIECAAAECBNoKOD1pG72NEwgQ2NQg9yALyNKQBD4C7jDFQIAAAQIECBAgQIAAAQIECBDoIuAkqEvS9kmAAAECBAjMEdjUIJ+z+DujeF28o+YzBAgQIECAAAECBAgQIECAAAECIQIOq0JYDZpYQM0nC0cgyQLptxwl2C9zOyaQQKBdgzyBuSUQIEAgXMB7ZTixCQgQIECAAAECBAgQIECAAAECBEYFHFaNSrmukICyLhSWpRL4EtAgVxIECBAgQIAAgQ4CfrV1SNkeCRAgQCBaoOX3actNR1eS8QkQIECAQA8BrxE9crZLAgUFNMgLhmbJBAgQIECAAIG3gN+aauGxgCJ6TGgAAgQI9BG4+aVx82N9XO2UAAECBDoL+JrsnL69EyCwS0CDfJe8eecKeIuY62k0AgQIbBbwWN8cgOkJEPgj4AmlPAgQIECAAAECBAjECXjfjrM1MoHJAm7XyaCGWymgQb5S21wECBAgQIAAAQIECBAgQOBwAedkhwdsewQIECBAgAABAgQIECgu8AJ+XQBCdIH6YwAAAABJRU5ErkJggg=="/></switch></g></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-9"><g><path d="M 160 252 L 248.63 252" fill="none" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" stroke-dasharray="3 3" pointer-events="stroke"/><path d="M 253.88 252 L 246.88 255.5 L 248.63 252 L 246.88 248.5 Z" fill="rgb(0, 0, 0)" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="all"/></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-11"><g><path d="M 105 272 L 105 345.63" fill="none" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 105 350.88 L 101.5 343.88 L 105 345.63 L 108.5 343.88 Z" fill="rgb(0, 0, 0)" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="all"/></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-6"><g><rect x="50" y="232" width="110" height="40" rx="6" ry="6" fill="rgb(255, 255, 255)" stroke="rgb(0, 0, 0)" pointer-events="all"/></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-8"><g><rect x="255" y="227" width="240" height="50" rx="7.5" ry="7.5" fill="rgb(255, 255, 255)" stroke="rgb(0, 0, 0)" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe flex-start; width: 188px; height: 1px; padding-top: 252px; margin-left: 307px;"><div data-drawio-colors="color: rgb(0, 0, 0); " style="box-sizing: border-box; font-size: 0px; text-align: left;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; pointer-events: all; white-space: normal; overflow-wrap: normal;">Auth Provider<div>(Google, MS Entra, Keycloak, ...)</div></div></div></div></foreignObject><image x="307" y="238" width="188" height="32" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAvAAAACACAYAAABtG12SAAAAAXNSR0IArs4c6QAAIABJREFUeF7tnQnYdV85/+/HkKEQSpQxJZWhyVSUNCBDMmQoqTTKvwmJkimS0qz8NdFEyBRKNKg00ECSIdFAKtIkRHmdz/vu9et+7netvdfae59z9j7ne1/Xe9XvOXuvvdZ3rb32d93jiUmEgBAQAkJACAgBISAEDhCBEzM7c4Dj0pCY2f3LWtfXWvu9/xlXD4SAENgzAtq+2iZgHXjV9bLuqjZ8dLUQEAK7RWAZBL5mzNpxalBa0TWa0BVNlroqBISAEBACQkAILAiB9RD4BYGmrgiBdSGgw9K65ku9FQJCQAgIASHQj4AIvFbIeATEC8djpzuFgBAQAkJACAgBITASARH4kcDpNiEgBISAEBACQkAIHDYC0tQNz+9+MDowAr8fEIcnV1cIASFwWAhorzl/PoXJYa1xjWbfCOiN2vcMLPv5B0bglw22eicEhIAQEAILRkCMaZGTo2lZ5LSoU1tFYHjVL4fAD/d1q1CpcSEgBISAEBACQkAICAEhsAYExhD4i5vZP5nZB4cBXsPMXrCGQU/o4yvN7Iru/lub2aMmtDf3rV9tZk8d0ej7zOx/zOzdZvavZvY6M3uRmT2j+19+l9QjcFEze1u4/PJm9tf1TVRfeXczu4+7+plmdt3qu3WhEBACQkAIHAEC0pIe2iSPIfB3MbMHZIB4nJl9x0oB+ngz+97uX98QDpXA94357zbk/h6bg8uvqpxb9eoWga+GShcKASEgBISAEBACrQiMIfB/bmafk3nQf5nZJTOax9Y+7fL6DzCz25nZT27I+79vtOmfOPDwYyTwCZLHm9ktzey9u5yglT5LBL44cdICrXRNq9tCQAgIASGwIARaCfxVzOylrv//YWYf7v77zmb24AWNr68rn9JplT+vuwi3IBH4/sn7ZTP71pXM7z67KQK/T/T1bCEwCQEdMifBp5uFgBDYCQKtBP6hGx/p73Y9+4nOvSL96a/M7Ao76fn0h3ydmf2Ga+ZQCfxNzezFA3CxDohp+Agz+wQzI54BbfvHZO77RjN7ynT4D7qFj+riRPwgOfz+7RZGLR/4LYCqJoXALhDQUWEXKOsZQuAwEWgh8Bcyszea2cd2UBD0eDEze+1G6/7RDp5rmtnzVgDXsRD4a5vZc0bMB3MLUWc+vfyjmV26C3od0axumRmBagIvsjAz8ituTmthxZOnrguBvSCgXWMvsPc8tIXAo3klkDHJCzdZSq5uZo/utLXp7080M7S+SxcR+OEZ+kgze5mZfXq49Bs2cRC/Pnz7uSv02tciNeq6agI/qnXdJASEgBAQAkJACMyHwEykqIXA/66Z3cCN4J4btwtcaK7XpRtMPxHMeikz+7f5RruVlkTg62D9ZjPD990Lh7Zb1d2uq7aMgAj8lgFW80JACAgBISAEtoPAeDZfS+Dxi36DmX2gGwC+7vi88zfcKkjFmOSuZvbA7Qx2tlZF4OugxHXqHWb2oe5ytPJXrbtdV20ZARH4LQOs5hsQGP8taniILhUCQkAIrAmB7WyMtQT+bmZ2XwfXq0JBo/ub2fe43/9mo7X9zIXDuw0CD54QW4r2cOhB3mxmpN7k35ktY5Ir5DTWB9539c82Ab+f6/7wz13K0JbhfNImNuI63UGP+4mT+PvKBsCV1KWfZWYUEuMwQcGpN5kZrlxvrWxnTZdd2Mw+v1tLZLVhjK83sz8yM7I/JZmLwH+cmX2hmV3iXGzLyTvNzrB2mXtqAcwpV+6eRdD0a7oYjUOcwzkxU1tCQAgIASEgBC5AoJbA/2XILvPDZvZjDsfPNrNXBFy/tCMbLXBDylKQLPd9jZn9TkMDuO98iLs+kldyvj+iob1P64J00y2lPPBoqTnA0P4nF9rHSkGKzYeY2X839KHl0m0R+D/u4h1SX97SEb3YNwKaSc+JQMgIhGWN4WoFPuDkBTLK4fBPCoP8VDPDmnOTQkYcbvvf7v6HmdmTBg5JFOu6n3sWuf8hrJ4Q1+BNDMCvhXawQFHJFpmSRpI1dy8zu3FI0Zoe985NTAI5+XFhe7uZTSHw1EG42eaQeXszI51qaT/gQP6Ybu3yjg0J8/YP7iKCoYmhAZdf3MRVfG1ogPfhyWb2/WbG4W6Lsh1NyBY7rKaFwFYQ0JuwFVjVqBDYGQI1BP4LzOxFrkdokSEZrwu9fElwq/ilTdq8b2scyRoJPNhA5i5XOda/MLOv6lySKm+pvmxbBB5XKW9RiRaY1MEcgadI1g/0jOA2m5iJR4bfccv6wY7IflD16M8dIllzHDhzAlnnIOXbJK999PEfeiTpR7HgJPmFzftwC/ffYwk8KVp/JnPQyfWHcXzTRnvNQfk+7oJnmtl1hwbQWTQ4COSKspVuxwJAteVzWY3KDCBH4L/FzOhbzGrkn8U7tI1UmxVw6BIhIASEgBCYAwEdDudAcbiNGgKPxhrNcpJnm9mXZZqGfJAnPglaNYJZIeW1sjYC/7ObOACCPNE0twiE+GojNL9Dz9gGgYeMMi8+/uH3N4e6r4idOTF77ZnTGviv78heaZ29p3OpQZOcBC09VheCo8cIGmq01/QxJ7/dWXbSbwRng1utkBsfLbG3Jlxr80481zUwhsAPHXRy/Xtbh9W3ux9rCDwEH604WYZahfeawwrWjpLkCDyuOD/ecw9WGJQFkmNAQF/4Y5hljXFhCOi1W9iETOzOEIHH1xiyAiFJggbucZnnQmzIE+9dWL7PzPCPr5VtE3jSIabKqxBo77dP1pw7hI4+1blF8FN0oYnj+sNOG49fL3nyL9MR/BwZ/aGNJvjetcBUXrcNAh8PZnQFjfpPZfrkNfCQS7TEuFd5weUF1w2EVJS4oyRhPWK54VDk5X1mRnpS0phy+MH15ZLdQRIN/meE6/9zQ+C/qIs7iN28UUiB+d4uXqH2oIm7ycNdo/jxM88+vqGVwGM1YHxRfqVzOcHiQT8v2x1OvrMrvJVbFkMEnvmALPugZNrBkoQl5AVmhosU5J5AdTTnuDClOeNa5oNDvD+0+L5EAv+nXfzCh7mLaMMfCu8YFACVS16XCQEhIASEgBA4PgSGCDzuBV7TBnHyvr45woFZPwnm8FrXEu7ZNoH3/Z0jiDW1h78v435pYQndvPMh9nhDdnFFmlPmJvD0D7IXLQyQQA4zUTyB97+9uvPV/oMN+Ufrzpqg0uszNlrXp7kLc4cFsIV0EwScEzThxGPgP+2FQ9SVOrLv/07FWaruEgybhIObJ+V9cwLB5XCQBH/1qFluIfBcyyHAF0PDlx6f8acXOgL+WA4IDI7SR+A/vFuj3h2K+WD8pAYtCYfd3wqByxzW6UcuXWwk8L5d1gCYkcmIwz5B3xyKmPt/6QNevwkBEJAWUetACAgBIVAOWkvY4IZwfQcUgWxo/0rylZvMGb8XfkRT9+zKTXeNBJ5YAEjIUBYNCCJExQsBn/gVzyVzEnh8lbG0pKDU1EfmFx/+nOQIPOT9GhXkDO0sRNanI4Vok4kFsjgkBFb/SLiIAFkftJp+JsXpnd21qSjZ0DOw4PiMLGjdIatxDlsIPGT2R8ODqbfgDza5flENFxL8UeHHPgJPQDA+9knoPweFmqJcjJ04F2+No98Rc9ouEXieg3sT2neJEDiLQOW3QWgJASEgBISAQ6BPA/+JXaCqN51D6kj/VxJM4pAZ3BuSkF0CM3yNrJHAQ5rRhg4JWk/cP7x8eSiCNdTG0O85Ak9V3BcP3EhQJyn9SH1Jukiy/yRXI38r2lr8lEva8ByBr63aihaYTDJeOBCWtNBxSKxTXDo4LCQhzSRkkn57IXAzjgGCOpTWMh4SSmS5lsDz/mFh8IckLF64rNRIdOfhnlKfeDexSvhnPTZUUR56ZpwjNOZkXYqZaXIEnjnAorPlLDNDQ1jy76KyS54d9e34ENAbeXxzvqYR9xF4soCQ/i8JH398fYeEjBiktktC0BuHgRrz+NoIPIQP4lcraOmJFUiCaw1p9dolv7PkCHx72+U7hlxNIoEnoBTXEPzehwTNPoQ9yZhiUWiu42GK3PPPyjwcd6eruL/nXGHibVgT/DtA8OgTMm3XEnhcU/AP9/LFmwBe0nbWCC4oHFK8VjxD4M8uFixh/OaF2AHGVCu44PCOel/23CErR+AJTOZgKBECDQiIQjWANeOlwn1GMNWUENgKAn0EHv91guaS1BAcrsW/+a9Db/FP/umKEayNwEO+IeG1QgpJihElGSLEte2m67ZF4HF5IO94LnDV9zESePydvQtWaTxYAAh6vYi74C4bYvqgRgDQwkNovX87/vFozqNEf/uh4mP4veP/noTDCRaLXA75WgLPGB/g2uSQS0GlFkGL7tdgSQMfrQe8oxQcaxXa91moOOSzNrzkCPw9Npl7yLRzRCISdESTraEKASEgBHaKQInA44bwfNeTkq9vqbMx0A/tPYeBoUqkayPwtYeahBOZPnyqPPywKe40l8xN4JkvMutAvqKmONfnSOAh/H054FMbuUJgV++qrLZig6bX++jjguM1+6m9XNYkNOKlQGRShn6X68yjNsGwty50rpbAkz+erE5JwLo1fWZ0aykR+BjPEjMADeLc0VFSxXL4SZI7pOUIPGlHS6k9B5+tC4TAfAgcycHqSIY537pQS0JgXQiUCDzkxAer4gbz8oah4ReLdtILxASC0idrI/AQGYhdrUQCP0bL3PessQQeFxd8lMkoQuAovvr4zePWEgt29T0/EnjSdHoNc+nenHsHJPgdtcC667D0kL40CYQcYp4T0jT6rElo/JmTKGSuwXfbVwnmkOs18v6eWgJPJVpf2IiaC/6QUDN8CjlRmyFJicCTinKMxn2oD1iVYjGoHIEn0Bu3KIkQEAJCQAgIASEwEYEcgcfPFTcEghrnFHJ4k4GiT9ZG4NHActipld0T+BO7tp3pKmfW9nL8dZHAU/AHLfOQQKIh00k4UOBWM2SxybUbYzf60nXGrEmse+I1YpaUG25SUv6me9hQetRaAk/lWJ8n/74hfmQIN34n6JgiSUlKBJ4DiM/wU9N2zTXk+o/pLHMEngBW5kJyJAhIAXwkE61hCgEhsBcEcgSewLxcoaapHaSwER/6N/c0JAI/DeU500iO6Ukk8NQR+OWKhrD2+IMQ9QbaDpDvZwu4JZEmMgmkPFqD0m+5rEm5zEC/FgpOcUggWLsktQQev3tfhIqUjDGl5BB8EGOfPadE4CluFYs3DbVd8zuxADGVZY7AMwfMhUQICAEhIASEgBCYiECOwJOx49oT2y3dXqrgma6fSuBx9cHdIQnjeE6hM3MUclq+Bv7cXJYwmHuaxxJ4Kq96oj9FA0+FWwJXkwxlCopZkzi8er90yDjEM1UYpm+4iOFqNJXAk8rSu5/g/hMLUg3NEbElWASSlAg87lG+WBS+61gApgoHAzD3IgI/FVXdLwSEwCwIyBI0C4yzNaL5mA3KszU0vJAjmrzU/u/kEc+VeR/qBdrNNwTtZ67svG8nEviv3RRJeurQg7rf6XNMVygCvw4CT6aaGOA41gcen3vvx457yZV71hAacDThSd7VuZqk7DIc0n7e/U4/Ccjsk1oNPL7r+LAn4Tm3rVzv6bKYirJE4ClA5VOeQrrv3fis2stF4GuR0nVCQAgIASEgBEYgEAl8TDVHgRbS2kFqxsj9N/cSyOilr3gRafQu5i7++o2P729UPpj7Yq55Efh1EPhcYaWxWWjQLF/XrRnWD+uoT8i7zvOS+OJTMdC0xi2olsDHYHGKpPmg1pqlz9ie4i4sEfiYGSpaGmqeVXuNCHwtUrpOCAgBIXB0CEgPP8eUewLP/0dLR4n2JBADSq2PlRhgRzt96etwVbiEe1ipUE6uP6RnfFGoyy0Cvw4Cj7Xm7TPkgacdDnHeVaQmleWtzOyRblFRnIm1R0ArlYXTe0If8eWOlUfjeqwl8GSc8VmMOCiT3vK9DS8cedjxyU9SIvCkK72juy4XfFrzWPzdsU4Q01ISEfgaJHWNEBACQkAICIGRCHgCH9PR0SRZY8geM0Vipg3ICcGsuYA23Hf4+Ce5awhI7OtHLIrDtSLw6yDwzBUpRqmamqQv/WNpHcRsMVyXqxQa7ydglvVIBiYEoo7l6U5mdj938c9tgrBvX/Ey1BL46L5D0zcKGW+GHvfKzTt6RXdRicDHTD/cgrYfrX+L4JJEMbI3dlllyLsfi7SJwLcguuJrpUdb8eSp60JACKwaAU/gqSp6MzcaMoFAYghSmyLk5I4f+FJVRooF+ZzdZP/webpL/bjQhvgQEPiZ4YI+Ak9Z999217/RTuxSA4kLI1lSEOtpwMcGsdLK7TbWF/Kge+lzt4prgSqsFB+jYmoSqrteqnIN41KC1j0Jfvk/HgpvYeX5k4qXoZbA01Rc87jzfEllCk0OPLG2QonAozknJsVn9yldWxoiBbIg7F445Dwk/E0EvmKRzH+J6PT8mKpFISAEhMAyEUgEnhL2aCAv7Lr5JDO7yQzdhkDhhgDBSgLRI6AuBp3GQwTa+stUFBOKbgTpOX0EHnJIlc4kNakLReD7F8QUAv9h3TrxMRC4eXxeZfrBGL9BT4nB8EWd+nrPWiEDUxJ858lUlN4RiltdofJ9aCHwBIk/PrRLn+l7n3xkVxjJB6ZyfR8pjwG+XH93MyP//JDgloRVhLSV/p3hvwk+9yICP4SmfhcCQkAICAEhMAGBRE5uuXFreXRoB3cEr6Ge8BiLgYW0lXNtiOkEuY4KklTqzOWP58ABKblNoXN9BP6cz/xp6auuyZUi8P2rYAqBp2V8tPHV9kJcBm4lYJ8T0oaSP937gXPdW8zscp07TM3a5V0gS5J34fL33S240/S12ULgOdi+JGTKoYDV93buY7liVhRk4t3kcBOlj8Djv0/lVF9RlvvJRkP++ZLvPc+jkBXvzFnpdL3cA/ZRROBrVtwSr5ESf4mzoj4JASEgBM5DIBH453Zm+3QBPsAEk5JXfQ7BNQftuhcIAcTMCz7Ir96k7btk+DvacYIMX9wReYILIS/k605FZNDmQ8h9NpE+Ak8buBR4oSgNPv8pnSXE5nXuAhH4/tUwlcDTetJ8+ydBLHFxoVormvB3d8GkHOxwvbl86BbXc0CM7iVDazmnxeceKrMSt0E10xppIfC0h2YfV5rkg5+egUsQQa6sawJcSfPKwRq3lbTuCaj1BZqG3GLA5XdDqliex3uHjz/3k+OevYEc8xQHI9g2FmvClQhXn9weIQJfs0p0jRAQAkJACAiBkQjwkcYEj5bTy2M37gxo5ecSXHTQoHuCAsmCkBAM54XAWYr65IpM9fWHdJVk8MC/PslQESNcNHDxKUkMKNw6gZ+oAFtrJVaPPz7aHKJwcRoj79msZ9xSiJ9oFYgnWvi49iC8YFsrrQSedvG5R6ueCkbVPIuxQuYh3kmGCDzXUfmWeANf9KzmeekarGLXy7y76XcR+BY0da0QEAJCYCwCE0nD2Mfqvv0jwNQTqHfP0BUK1cTCOlN7S2q+6FN/r+75sW0OD2gea0q/k87uzpuA24fbid3bzjQReIIW0eyWBLcMKnUmGU3gu3cMTeoFbghdwaEHTQXW3X8IBJ7hkA4Sv2zI6Qc14IN7yC06X+2G205dCgFGs++FQOqWA8EYAs/zWBtPPnuwHd6UsULcvDt8v9x1tobAczmHWw7qHKJbhDSwBG9T2bUkIvAtiOpaISAEZkdgeAud/ZFqUAjsFAHWOC4ilIZPgvsIvrItuahrOh2DRrmH4FaC4GIwK79BAjhcoAX3wbXpWbg1oLHk8IFGEMHlpUUDzz0cFh648aUnKDBKLHYzmsB3DYvA16yU91+DdYhDFG4j0W87XcXaeeHZA9w58su66GTUFh6DSiGqvA8t7mRjCTz9xkpFSlRcg3DzisL4ntb5yFNB9kobfMYQeNolexM58PlHOyWrV3rmQzcuas+omEIR+AqQdIkQ2BUCo3bCSdvorkam5wiB40Wg1U1lH0ihhcfXFlJw8a6Izmu6lIFvHd+hU1sabhvXMjPycnNYwOce//iXdS4V4x+jO+dAgEDPq3bzwxpgjohXYB0QAErA6qEJY75KR6wZM8WTcPkizWSuhsLU8ZMyFgsAsS9kAuJgRBpOfOPBmHfi6GQS8Tk6tDTgfgS0mrRChIAQmA+BNRD4+UarloSAEBACQuAUAqKVWhBCQAgIgfUhIAK/uDnT53RxU3KoHdJSO9SZ1biEgBAQAkLgwBEQgV/cBItVLW5K1CEhsCcEtBvsCXg9VggIASGwcARE4Bc+QereASIgVnaAk6ohCQEhIASEgBDYHQIi8LvDWk8SAvtBQAeG/eCupwoBISAEhIAQ2BICIvC1wIoE1SKl64SAEBACQkAICAEhIAS2iIAI/BbBVdMjEdBhaSRwuk0IgMC0F2ja3W0zsMtntfVMVwsBISAElo2ACPyy50e9EwJCQAgIgW0joJPEthFW+0JguQhs9f3fXuMi8MtdUurZWQS2t/gFsBAQAkJACCwMAW35C5sQdWepCIjAL3Vm1C8hIASEgBAQAkJACAiB0wjokHeBelNLQwgIASEgBISAEBACQkAICIGVICAN/EomSt0UAkJACAgBIbAGBLyCVMrSNcyY+rhGBA6ewO9k89jJQ8YtrwV3bdyAdNdsCGhtzAblwTa0mDWymI4c7FRrYEJACCwYgdwWuB0Cr812wctAXRMCQkAICAEhIASEgBBYMwLbIfBrRkR9FwJCQAgIASFwiAhIuXaIs6oxHSkCIvBHOvEathAQAstEQBxrB/MyBuQx9+xgKHqEEBACx4mACPxxzrtGLQSEgBDYMQJiwDsG/AAepzVzAJOoIWwJARH4LQGrZveBwBFt9kc01H2sJD1TCAgBIbAMBLTZL2MeltcLEfjlzYl6JASEgBAQAkJACAiBOgTE8etwOrCrWgj8Z5jZy83sw83sLWZ2WTN750Q8LmpmVzSzy5jZR5nZR5jZe83sXWb2ejP7GzN79cRn6HYhcOwIXLp7zz7ZzD7SzHjv/8PM/tnM/s7MXmFm/3McIOlL1zLPQqsFLV0rBITAbhC4YGe6kZn9evfMPzaza5rZ/+6mD/t/Si2B/0Aze76ZfWHX5dub2c+N7P7nmtm3mNnXmtkVKtrgsPB7G5L/BDN7ZsX1umReBL7bzB7qmnypmV1t3kcsvrW3dwfM2NH3mdknmNm/zDSCO2+e88BMW6/pDrktj/ksM7uVmX2DmX3iwI3/aWbP6d6xX90Rmf9eM7tfy4BGXHvrzdgfNeI+3bJMBL7YzJ53qmsndiM7Y785obtX6r4rHxPa+Cczu7YUSKOR/dfNd+Nj3d1fs/lu/M7o1tZ345+ZGVwnySBn0mF59CT/UUfcaeBuO/iujO7o3DfWEvgfNLOf6B7+V2b22WYGeWmRa5jZD5vZ9VpuCtdiAbhrRzYmNFN3q16osziJwJuVCDz43NbMfr5uRZ2+KrO+XmBmX5Rpq4XAf5yZPcTMbtxp2lu79g8bC9j3bD4+v9F6Y+P1x0rgr2Jm1yoc1BohPLrLzyfwZmjgxhJ4vmPPMrOLBSTf0JF33jvJOARE4BsJ/DiYdVenUPyT7nv3nu6/X3kMyNQQeNxb/tLMLtQB0rphXtjM7rtxu/mukYQiNw8PMjMIQOsh4hjmdO4xisD3E/g/MLPrzwD6J5nZ6wrvSC2BR+Pz+2Z2iRn6g9XlTptD95kZ2so1sRUCHw5FS9LA47r04xtrzR3M7Jc3rks33RKuh9zsnAQe6y9Wp4sHwHgH0bxzkJWMR2AxBH5Pirg2DfyeOjl+ehd355M7pRUde5GZXX2L367FDL6GwGP2+qquxwCT0xCWBoQJ7Wlm9nk9I0ajzz/cEPiHjz0EBJ97XDVKfeQj+G3HMEl7Xi0i8P0EnpgN1uu/TZwntN73L7RRQ+Dxb39ZMFun5ugjsSR/28Wt/HfnC49rDaSfdy4nDzYz3Hq2IVsh8KGjSyHw1zGzx20sNZfs+vdEEfhRS2ouAv+ZHXmPB11IO+QdEi+ZhsBiCPy0YYy+u43Aj36MbuwQQNEMj/yg7r+/o9tzDxqgIQL/lZ3/eQIBTSMaxxpB4/TCgp/7Gzs/pd8a0HSwweLDew/38fPP/qHNhN27pjO6ZjQCIvD9BB5gv9PMHjMa4XM3vnjzrn1+oY0aAk98yJeF+9+0OQD/qJmhnXhboW02vK82M9zkcgftG5rZb08cW+72HIFHOcCHfy4hfmZqoP0cfcFiiDUjiQj8OFTnIPAohtC8E7vihWBu3h/cZyTTERCBX5MLzYAFYCUGgkdvkp/cslu6fPt410mIcrDSR+D57c87f3cAwMfoCyqR4F4ig78uXI/LC4QCTSOBc7WChhAf/KgNJHMGfoxkqzlQ2furIwJ/PoEnwO1SbsFhZbrBhAX4qeEgy3tC4HiSIQIP8YgB3n+6OUB/eQ9xj93leT8TiCbXQGzQWM7trpYj8JAqNt5DExH4eWZ0KoH/9I2GnYA3/+7SMyxTaN5RLEnmQUAEfk0Efp4533craOHhgh/QdQSu+SP77tQ2n99H4NF8/5p7OD6baI5qhOwXjwwXvnsD7rea2VNrGihcw2QQCOsF7SJZbSTbQUAE/nwCj384uKT3h4MkwaMEu44RIueJE0mClcsHew8ReNwzvt3d/47O8jWGkPymndgNg+f7NjJIiMCPWSnHfc8UAv9pHXkn1sTLX3ead1KqZmTvCpS1zrgIvAj8PtYu1mK+Vwjf409ZiBV2K1j0EXgyvpBiC8EM/fGVWvOLdFq76F/49VMyW7ht9BmB3ODfi/9vYQOeF7cj3M5F4M8n8N9nZt8YLFJTfO5esjnYXrVbqfiqY736frdyhwj8a7uNKt3y8C5YcszixxrA85IWgzYwTXIon1NE4OdE8zjaGkvg+Yijeed/vZCcgfiENx8HfDsdpQi8CPxOF1z3sKh4vqfLoLiP/mz1mSUCz6bQiTtWAAAgAElEQVT2h+7JpMkjXV6N3N3M7hMu/NlOY1lz/9A1BN0RIPJ+ObG72BnDTC2ZHwER+DyBJzuLDzrFskRtg1ahyJJPV0dMxwc3EHjeYSwA3uXmNhkLWEu/SK2HS0GSv9gcKj6npYGKa0XgK0DSJacQGEPgCdSGvPOeeWFN852bq4ZD5VQdjQpIBF4EvvKdmPUysiVieU41CDicY3U7yEKFJQLvU/KA7pd0hZyGkEZrBxlBi5eEIALMl28durnh9+d2fUq3PGmTZeMmDfenS9HIELiHtYBKsJhcCHwjm8ffj2ivdAs4Q4AorkPasg/tgvXw9yXQdy5swJ/nYDnhOVQkw1+bAw+m4ibpPjVzEfjLdfEKYE2AMxt8Gv+cgYtNY6y8OOaBRwP/K2aG5ju9Q+SfvbjZybsaMy/+wCZF60+6fhDTgbtarQaeOccK5d/lO4biW5XDvOAy0h2iuUiCdStlUGltq3T90gk8VaGpXUEgFP+fNcCHgWp/7BFV0r1Dc/vAX7krqke/2G8JyqzdQ3j30p7HR459j48bWZRYz1hel/o+DhL4QI9Zs5B3fGO9sB9etwGzmrnGhY5Ch+xv5JXHag154FnEkaxF2E/Yg/iOMBYIEQHwZOYh0L52nc1B4D+6SwdIzAJrlerRvHtYKSkoOGeKW9KK8o3iOfwjuB+3X/Y+sptgrWmJA1pVFpoDO1aiMCZteRKs5U9Zywt4tp+VE5Ij8Gw+kL6U950PF3+rWbxsijFLzU8HMjIHjrgrkB2DZ/GvZYPkA4Y1gX8ENZWETQLfYj6+/z6y0xxkKDzF4SJW+ktNQrIJEH7YhixwEBmzKZFrn+egeS1V3eRQAlFMC5k0nN/sxlU6pE0h8BAM0iNCSEtYM34+DA8IMRcjId/KbTkCj/adtKo+sJt5Zg57Jbyb3lXtVWZ2xc0B76caCDzP4iODi1sSKhen1K9D3cn9Tlt8vPlY8yH+rzGNDNyzTwLPfuY1r+TO/4quv6zTH+tcpNIe6IfCeoXEc423UsbhxverDw7IkVd6xKBm3lk+QhfdKEN+MWPpIS0oShcOfTlXQsbL3sCeiauWt9bEfrH/oFRgP2IMY/ajLSyXs00OEnj3YNYw5J0DmBf2QeJLpqZ9pU3I7s02RJ0qmxyKSgoxAuvIUkWBtb53iflFqfEhrsNjA/Fe4RJQ0NxQSlW+G3fpUjP7vSTOJdY59urfHZjksQSetclaJ2EFWbm8K59/JO8vxeZIbvH6kQsOvkLWEiwxHMD6hL2Q94Hq0V2a0V6WNYbAc3B6dkgFDO+C79TGH46E4qBu49vnq/7idk1Ch4OT3IZzu83H+xFupASyflPlyKOmidtYlEupikVWHIJrY+W9vuFx4uc013KCYxMiLd+9XF7SGgjZdMltz2m/VtD6oA2OwVml+7mWDeEXtkzgqQRKsOfQxuj7CTEiIPkfawe/o+tKBD7mbqciJIXOauWyXQaMdD3rBe13K4HnHcX3zwv4/2ptR/Zw3RIJPIHAuAtiIasRyDQpRHPKjbkJPO8FmYau2dMxNIhkVPHC3oVLI4qLVuF9ZD0PuplUKoxanx+vryXw7DlYJS4fGiAzE6mQxwab++bQUD++0bUMosneS99KEq3fKKfYJ1okuplyaICUE9weBYKMRZGDgj84DD2PveUWnZY6d+0YAo/yAqJK/2sFyycJAEhwUXvY5FvJu+vdBGufB5YUYxtKG9xK4HOFxbCsohTimy2pRwCFJgf0pIBB6UKGs2rLaf2j9ntljsBzsvYp8YZO7n4EaBD9phk1S/scLRsUBGmMsDHgUuBdHUrtsGg4/fksIi3PxPQK+UIrOCRoDpivlo2XNkl7yEbkyeacGng0gZCGoToDufFh/eEETQrTpUiJwBM87d1oSI0Keai12LCmIOxJEgFrJfBE3cdc7ZBKCjGRGnJMNpptY780Av9LmyDHx45Ysyg7vLk24TY3gYcQ+LUS5yeX5pe5xzI3RZ630Qpeq4EcTXnW0L01BB7XQbSYkEEvWMuwsuRI7NBz4+9oblHojDkUYS2B+JYsdbH2Cs/Gysf81gpaYt4vvxbJABcFNxEOIWOzuHHA40CEa0uUVgJ/A7OTp5idqT08x+ehjcfSm+uLv5bDEGt6SrVq+ADj7rPAtRB49n2sRb5PuLVhIWdcknYEOCSzbyXhnUNpeVASCdaHdScX/xKxEULMh4Rc7RAX3+ZSCpZwYsYkHIWNHjeZ5NuH7xum0JsXTue43aChKwljhwh41xSuhUyBBVoL/OnACf9M8ndj2o5mXoggRW36SCxBWWwSuKl4wSWDLCTP73wX0byw2eAKA+FMwibk52ouAs+BL2LECRgtMaSG/nFIwQqC9eCWdmLXCroTCCd+/IOav6FFOdPvJQJP89GNho8hWrQa8WZu5hLfZqSVwHNP3LDS81l7fGjIbPP0CebmmvG0XLMkAk+8C3626SBM3A7vMbE2uDTg2sB6RNseCwCxtnFLOR1Yf+79TVlPcLOAmCXh3cRPMwm+tj69bnShQXNM/Az7s59X7woT4x6wmkbNHfvKo81Ofs/sDJp6yCxjhjjgroB2mHcyCvvZErSAQwSe/RsXjxhwDdEE/zmKumBRhkxHosk+gHX3BZ2mD3KPVpX9AC2qdwXhnWTvZ31FYU4pJuXXWUtFZJ7D/T5mBYUcSpsoD8zUVmE9s3+xV2M5x/+dvuCCwDsbY2F+rnMhim23EHjWHvOG5tQLbqx8S7A84RrG79SkQMEFptEVjHcWC3ZJOLCQ8Stq+PkbGnXmlfcdrT7zhzKScfNexMMa33HmtyS1BJ4DBXu3x5Xn40bk3UB6HqWfMgjEOK4WT5LVABoJPOZZToJJOAXy0tRE8PIR40XwghvJfXZkXi2BzsuK32O3gZ7tDR8yTmR9RIuPFho5/9HkxeLDDAnNSfQX5xrKc6PpLpFxNPb40/qgRe4jOA3SUNLmxkwh3MOixdKQM+kzj2yGpQ1uDgLPYQ+y4THDHQYywQeuJGyQfPzIvpIEsulJzz5fqnME/v0LGZNzykCDhhNNZ5LajYIPER+BJASzQtyRMQQeAgpRianyIm6sK4gDWij+12fA2SXGOQJ/lRkPbXzwS3E70QfejxviwoE/5yONkoKDeCxQN5S2szWINRJ43z9ifrAksqdBvtl38cFm70kHXogKBJ3kAUl4DyGNkKI+ye1hVMyOY97lWknP6iPwBDxC9NIh2PcPP2f28qnC/BM8ybubhG8C64VUqyW52qZfYOhJGkoKDgO5dUbcGHvMOTmxN9uZswfMMXFoEFL82+O9OSy5lnlGoZUTMIZUXj38yIGJrD5eagk8ByHWZIzdwi2GdY7FIid813FZ9LEjXIc1zLsA+3s5gD8qNMZeC0/pc7+hbxywU1rt1ARrLR7c0281BB4lHHzLjx3LOHNQY4HvWXJH/xMYeuvFNhIx7B3kSOCjT28KqqvpKHneo584Zjs+iPsUNk6f3o+NDI00BHhI+OARAOFP+qUAQUgrmjwfAIQ7CNqFGhcGClTFqmEU+MEcGiWm+eR3XFbYiPqEQwzzkYtpmIPA+yIK9IPAHzR6NUHGMX8r9+OjeIG/6B4Pgn0a+OhGgwkXM/6QKTfON5s5hz1kDIHnPnw7eQexItUKxA5SyIEJLd0cWsrys98/iTkCX9vnmuvAohRLUSLwNRZDCAf7oifHuFH5/479m4vAY0VB+zhE5GIQF/1hL8PiWCPR/Yf3uCVuqOYZY64pEXjGBXlPtRRi21j8IF/p/RrzbO6Jh3VIH5pS5mVICI5GwYU1J0kpQBVFSIwbQxPMt2hI8O3G4pME5YJ3p0l/hzj6eAoURRyghw547G3EaPG/SXJ1ImoJPIGzBMV6YW9EqTUkHIjQmvvKujwXJUZu/0W5xGHKY8A3psZ3Hm07c+I50/8rWPZpf4jAc/BgDrxVnD7DVWJV7SEc9Pv5COSUIH3fhFViGAk8HzCvocXlgw9GjaDRjoEdJdNdTXtzXIPZOWoGONmTq75WIMbxej4GUaOec9NBgwwxqhHINRpRUtclQSPCQkTL4wWSxoEpCRsLm2+NpQQtCiklY3DpVAKPGxDt+jXVWtyI9cYHMQnanlRVrQbDbV3TR+B5ZnSjqUlbxUcwmWCj//JYAk9fsGLgTsGabSVdrDMOvJjW+ywmc+C8NALPxxMiUBPgeI50nD5RQuzje5pwmoPA0zaHhJqCdVjacGVLgmUG8lsr7PnROsm6Iqhun5Ij8Owx7L0oSvqE9cweN3YMKHGwVnkLF1p9tPu1Er8RWEwgcLnMNJFsQsxx7ewTLAR8M7xbJZpqXPW8sFeTGcdLS+pZrMXJWkgbBAeiuPJEuIbAgylKLu/7TQYk5hlXnhrhYBO/sXfqMv74+yH7PMsLcWp9fuzx+THGj5odP1ToZB+BZ84h7956wAGKg3fOraoGB11zGgH4FHu6jw/kcORdFVePWSTwvDzeB7JvgcbB50yvaIprNN2pLZ5NH8ZITtsfS9RjjuMj3ZLnmPSPvPje5xFXlRgQi2beu3xg4i5phErj48AT03NFDHGFQSPmF2Zr4Z7oH0Z/phJ4NCZ+M0P7yUZVo91IeKAN8esFTSMaq9qg0DHrpuaeIQIfNXNoMHNBY+lZ8WCJ5ctroaYQ+PQMLEJYWugHuLYGOuMKhDl6W3EISyPwxMJABmskRyQhMKWKnnMQ+JbDLId5iBtaX/5xKGuxhEKGoxsF+eLRZO9TcrjzbnqtNv3jI40WOxZvIuWgr2/QMhYsGFEzChEe0lj7Z0Cw+fZ4F8OSkid+T7GMQXRx/ywJyjefbhAlU3T74N5YbJH9lfVLLEaN8A3Fqso/lDb8Y8/y99cQ+Nw6G0OyUIB4qyPugTFbEz7s7IPpnWC87I+1BwVwid94FB2lIPESgQc7yLtPq8x7xTogfuIAZW+2c1xUvbtb7mC3arwjgcfVwwfPsDhZpDWSC15Ee9oSiDE3gedk7vN/jvXljGn6OCX7CGd8Tgn2uYgDCi1da3VYTo1oULx5EmKMSTEJWoNoSuWQwfNrBc1vTFU5lcBjxv5S14FScFNfH4kHILDOH5ZatSS1GLRcN0TgoxsNH0TmsJTz2R92OOBwv3f3mIPA+/GxLsmcwWEQItIXfOXvYy2SuWMbGYGWRuDxI2fN1gia8Fjojb/hSpOTBgJ/9mOXM//eozILVk3/h67BNztqbQkQnSN3+tCz+37PEfh4PXs8xAxyyD7tY58ga7wDfWkcS8+PLm+Q1pimsmZsHAJ4B5OUDhXs6VhbfC2CoWDiSDBL3+94XW3cjh/fECurIfDxIMH6wjI85CIWcY6HHaxVHOrmrl8RLd+kScZykZMcgWdtQt59WlC+LXCUlixDFetsaHoqmlj/JTGxA0oylGUHI5HA8+L4aPlbDQTneCCIticK3Asagfi3PvDmJvBoqn0BpbNBtSNmL5INNgavRcl98Aj0GWNN4MBztghP9wrGYM5oVcCsGysNDg2ROWbj8KbWKQQeUyhaBDRMSVpMsr6/uDyhoU6yS+JSwm2IwHNfdKMhiIYNOyd8/EkdhpCRBOy9zE3gYx/4SHIAhdTzL2oq/fV8VPEbneo/HPuwpCw09O1UvMXACwR+UdvOO1gKCG4g8GefnCPwHKS2Gdh2oROzK50558KHe150ueFA2mK5HNqDxvw+ROAJasT9J7kSxveIZ3JQxjrRehgB++u7Eon4vcfaCzVjgvRBOJMQf0JMVk6i4qhPAcWaxFKMMgnBVYjgyJxViCw1PnDSB9DXjKHmmhoCHwnx2II77E+4HHmBS5SCcWv6n67B9Ya22CfhOLigJiGTlJ9L324k8MS3cb/XCHN9nxa/pZ+69nwEokvuk+zEbtLkE7BwVD2Bh5DGwI+WYjDR/YGhtxLmOQk8pJKN3I+xj1T1TVXOtQXym1w7cuZVNABjcg6fzkBwLuuBD7z5/13qycwHoOnUjYuPz9gwhcDnCM1cS79PyzHXM4baqSHw0Y3mCRtCR2GgKLHISi4QatsEPvYppWYjTWpME8e1rT7UeTxPL8+lEfi+jBJxPLkgWLRqpWDtOQg87ni8s1OEGcCHm75e2k7s0nbm7OENiwzuIIn85Z6xdAIPoYYg+TggtNdoNmPawNaCa+AR/Z+nzIO/F4VFTHuZfo/1HXABxfUjZ23FPcBbfHHF/OpMJ8EEBZT/LtbE7LSOt4bAYyHxygv6j+W6VVAcRfefFus/FkoUKri18D7wj3cERVJfHFELgUc5mquAzJzyfY+xeq0YnLq+iQlMetKibybvu3eLHOuBsdhB+pcYE2nUsLRoffDPw+TupT/w5vxVhp9uzLOcA49NLGq3ow88H5xYeQut45ggEbTpkBgvaMm6kspnTbY+TzKmWj6GLf7fqW0OPZhVk8QMFzzHZ5FJZdZbF1l0eZlC4Nn80CpvQ0pEeBvPKrVZQ+CjGw0WCdZgTIPG3KZsQawTfCLje7NrAp/GjesSPsJo5GIJ87kD0rdG4Cs+XjkC3uLPvA8Cf9pFp2KQ3aSimIGgQW55x2PdiNr3aMkEHvKOe0kuQBXrKNrZGAPS4jIFRriz+AxjtbgNXYdFoFRFm28IWnWfcKAU70SGGx9zVXK3ya1dLABYAuaUGgLvA/l5dm32mVw/cZvx7kYE/MI/SgI5h9xB9Hn3ozdCDRYtBL6vPQ7mFOsaG2Bd09djvAaXSJRSSfqsXavExy9aXE1wOfHS6n8MEfER5Zjd+8zzY0HD/IcZ0Esk8Jymo0aMky4a7VYhECjmfkdrmSL5Y35ZNPNjP5R3DnEHYOoPNWiPbugGAKGPhaNqxteZhC+4dAqBZ/PZVtYSUlP68daMbe5ragg8z4xB4DktEEFvyeWJQ5T3h039Hk/g64ldH0a5gHQqR1I8ZS7ZGoGv6ODFTsz+JZyu+zToscl9EHj2gHjQGxoqLh6Y6EsEMXc/cVAE0/lsUFy3VALfR97T+KLbIX8nGJTAxxgLVMKU68dWCe2bJw76BAiXBL9dr5XGh9rHGnFfrCmB5ZfDRs4HnLXw+vAwXJOigirfn/r9pYbAR1ce9gRfU2Noffvf4x59u813E2t1FHjOQ7pse7WkHe05uKNsSa6PtDuGwJMUgIByLK9eSABB0hDJfAjEbFxjXbTm69HMLfkFTJqwqC2EOMUS7X1dQFsaP/Ke6M7V/RoCn7MIVGngM3sU5DZq7tG4pkMEBNpneZiigedF9jlwCZbzEesxz+/YgkeRbE4h8JiAY6AjKUVbAmtLa4MUmfsugVxL4E+70ZzYL9qZU6nfyA7iD5Clyr61BB5Sh+saax0tHSSLD9dUTQ6vAD6c3rQ/92F8rwQ+k13n0Ah8DBDMvV8oGlBC8O6iwSUeA1N+TmGxVAJPkTyUGn2CNYmAthhrwlgJdj2P6Ga+AfjMe/9ntHkx0HfM942DQSkVIe3FvTUX9O6tetwDcfGaR98vxhD9/1sVdTXjrCHwMUvIFA08e553USEX/uNDR/lmM2+x8rm/DHw54OAyhWYcxRTffg5aUXnWSuA5HONLzzvHgcln/NuKK03NRE2+pv5QN/lRjQ1EPjo2bqXxsbu7PJ5AWUS+GmZrISauR1PnZRuRvzUEHnNazMs81gee1FYxINH7uGOCjAFmY33go8YFIuV91ePvfHhbCvekuaFSo4+Gn0Lgc/NRam93q3u+J9US+OhGwwEGcp0LquODAwHPBQbWEvjcupvDVxrkIilgb2hNRdk3AyLwZXRyQawtGvjzYna6byz+4ATJ879onkuFrthPYlaMNRN4kMYFiYNKtIz2kTA/Q1hzvSJllxpTrL8+HaQv8MfUouTxOcX7NOocZth7/LcfS01NMaqWHbWGwGPpobJ5krE+8KSIjPFm8VsPuYeIxyqy3MfY+Y1vLd/FUhE+4gp4t5K0EHgOBWRASl4BxJ0wr97tB+UOpH6qAqZlng752hgk3ZIquA2XPR1iIoHH384HsbVmEsHfko+Cz/zCyZUTbylHchtQ566uIfBcF7UmrUG1qW9kQvHmLYiZH2NOAz02Cw0aAk7pSSgH7Is2kRnoke53NDh8lFpSbxH0Q15h7+c8hcAz72jzfHtzlS8fsz7mvqeWwPPcaNnwcSR8aFPFTg58/JaTWgJPGjs0RV5wf+HDMlXIAe/b4aPiD/dT2xeBLyM4hcCzp6Ph84dzFBk33QTlkdWkRnJB+Wsn8Iw7ujomLGoszZFsbo8MnD9DMUDVJzaIiR9qspLhxuGDMynMRPKEFuEbDNEtZfOpIfAQZywoSca6OJA5CeuRl1jAivUfNfLswfy9NrtSDLptIfDsp48IfSQzjU8Rzc+7PBi2zPcar6UegM+mVapKvMaxne1zJPCxvPL9Ni8pp/0WyaXuIpWkr/Da0l7u2loCP1ceeNyIfEVQzGpec8DpHpI3NQ887bC5elMteBJUmCSXwx2NGZr4WuGAEIOWphB4not2y7tcjA0+TfmmxwQA146/9boWAh+z0SRzdkx11nfAqSXwHJj4gHofWlyOmIep+MVsSH3Bdq14cr0IfBm1KQQ+l2qx1bc4R3SxJMWkAGPmfco9ubHVuND4Z8a9nN+I/eKdwcWhJA8OOb/Hvg+8qxDfmqrZqS+QbfrmD9ApbSmkxBcTqnFDeVpQHgwVnsthkvLZo6BDMUGFc+9GWkPg58oDH/dclFng7DPTUHEVDXgSFIpYVGqLV3Ff9NmHkEPMc9JXiTVdj/YdLbyvy7FeV5opb/Z27iUBiK+cXIqLOPf0PWnRpwz9FIE/MXv0mdOloSmnTfaCFmGzQQPkNdTcH6tNtrQZr83lXc+5+5BRg6qjSdBEEYgSg3X7+oLmic3am7rYrNh8vMQNIqZ/rBkvmqDozxkr9eVMpq2pFnOxClMJPNoIv5lBenEpQdNfK/hxs0kmP0ReQMyqFB7Zo5y83eyMJ8nftzms3b/QIYLEyE6U3i1ID+4PP7kJnEPThbBJQ4jAKCe1BJ57cVmLVV/JUlSrbc09n+wXZBXyLgPREjR1PkTgywhOIfBkV3l4aLqVfMc4G5rDMksmll7Z3jfwbMtzEHiw4JAb0wNSARpf8FJlzphpDByo9omWr0UgdmRAgZCzv+HSVKP9jv7XfH/4DnmSwr7JOztUsyHGWbEPEfQaXU5L4yKYl33NuyPFLFU1BD43ny3pH1P/oosR+d+9fznXQdh9Np8+8p0bd654W1+sQQ2B5zn0E394b72WK80FMzB6R0EZineCP/SiuIzVlFve3cVdGzXw8STLRgdZbhVSXeUiwO8VCHVru1zPC44Lic92w99zBB4XA3w9/Tgp5JTS+NU8P2oiuQfte8y6wukumsiosBarppaeyQuMGdBr9nHV4cARy2dHzQW/YzKsKeuNJhg3j5jzeSqBz9UBaJ1vLD4QOy/RFFozZ3Nf06KB59m5AOHHuuwzlHonrqIkLQSejBRks/HCukHbFDMn1eJC1gtiLby0FmUbetYxEfioJR3K6DOFwEdyxjzwEav1q8W6iQLGF2WjDTRZMXvJ0BzP/fscBJ4+obXP+Xz3FTTiAI9ywZNWyIB3dxwaLwX6YmXy2vLu+HRziE6COweBqgSCJuEwwaFiSHIKsFs0JAtgL3iiewjfHw4AaOOT1BB4vkEcNnxRKcgsYygdpOLYcjVacvMYg1xLFXBL2JG5JmaOYU/HkpqTWgLPvbm2UT76dNJDc6rfTyOQcy+tUkKsCcgLiG13ziEi31cvY9GzYbWWJKY53GZy6Q3ZePCtby3Pjp8bhLBUta4UcBsDTzCvQW5wFxoSfEEh4D66vRQ0ih84Hziv2UFzj3tLTfq3WKqbvqHlRdsbhWdA1gmUTQKeaJBwwSkJGnE0TV6zmq6dSuBpB80BmVaSYCYGw+ifmOsfOHGdt3S8yOzki6Z7gwxN89DvTRp4GosHYUzWWFKS4HfpP4CxAy0EnntjSlD+RkwCJJnDbu3HkPeWNKYcpPya5yNLNqmYpWoIuL7fj4nAozTwFjtInHfJizhNIfA5DTx7Jz7cQ8K7x1qKaQq5j/R5BPjtUzIE/uRGZmeGstDk+hyLvHAN3zuwKpW1jwkEuCdpwodwwS2S/THFwKR3lP+u8cHmEIbWPn1f6OuPBoVYS+X05AKT+k0fUJb0uRFxLXwAcurTQ+eIbA2Bpz2+b9ECUUtesWzyPfZxexwmOGzG72DUwLfkBCdWiXc2FmL6JTuxbys4K7YQeFxvUTTyfU7CXktCApSoy5HRCvGdDyEeMgke9nFBO+/QNh4YNfCciNHeeV9ucnyXNrS+PmFm4yWJJbnTPWwguHJAbkoBrpAGiA+ExxPD+Fx8727tKqP639E48/HyphR8EKmS2Rd5Tx5kApUg5kkwUUJ0SzlzOZjgK+mFhYPGp/Qi0i+CWaJVABMlH82SmwXjxYTnBV9EtATR5QTtPiZgckKXCmXNQeCxODCffl3hY0hRjT6XDtYYvqnexMm4IP9Ru+zHywHJWxJw+8iRj6nvTqsGPrrR+OdzGGacfa5FrQQeEkDKM3+gS88EEwpaoL0raVDRgPGRukPIdpHawFqA1WBOyRF4rE81ZKanH+d9YRhzPHi05nGPz2u9H9cp5jQJ5IKPSalS8xQCn0sBiUWId6lPEYOlj/249P70ZTdC8RPTDZNGtsXSWbO25tLA8ywyl5BG0pMm/s4eCoa595O9k3uI0/FCggPIdMnKgXaaQwb7nBfuYe+vleiHj8abcSA5LXhfu+z3pNb0rhsohajeWjqo4RZLeXpfu4J3C7y8JYDn1hJ4+k86Tu+rzP1gSjrlUqwAVgQwjXVmSDiBu2KU6ILE7zVZ6dCw45KWy8DVZ0ltIfD0BZ4Tv9tDrjTUgIkWF/zpS4HFtessXsd+FD0OGDscpE8elqknQSrvVD8ndy/EO1p/sahwSGwRlJ+4bSd59MYVmgPuQUmukIogEXwAAA2aSURBVEHUWNdqGHLAQH75KPgsKrnr8K0kep4NiQ2FDZIPXI6Q+Pv5AEIEHjUwK7E4UrqcAwaaGA4oLHo2KDTBmBPRZkdhs2XT7ROIEhuDFzZ2DgO8cGx0kFo+BmyEuN5g7onX80LjV18S5g5SnMMWH2w+2hzGIBts1r6KIB+nmE6tlHosFvUZ8u3PBTEzBog4vrX0CwKDiZ7AMWIsqB0QtRt8rJi3PolmUbQY+JfOLa0EnudHN5rUp5rKua0EnrZZr5CovmIzZJniI8264D1jbbAO+4qt8THkozhZArXOEfjJz8g0QApWPqZeWgl4bLb1/lwGDKwafATxO0Zh4uNHphB4+hqrcvI3DnhoNnkPE5FHeQD54h3E7dErbmLp976q3DliXZuesWXO5yTwPBe3PxRJ8TvYF4DPvsw3Mt7De8VBmfZ4z/idbxiEmLmNxZr45rAvt1i1Yh0Jj92YRBHEh7EmvLAe+Z6yT0HkWSsoJBg3CqpYjbaUNaWWwPNsDoC4/3jrK3/nWwmmWI3hCBfuLIE37qqoRjdQvpf0M3eQwuIVD5kcDtD+M15iCZKgYEEZhULDH7riOxGTWXgcWwk89+Zi0/qsETHujja2kS2KgOnonlvzHcuNh4NXn1UhZtljTCglOQy0SPQGmNsFtKUvW7s2R+ApL+wL57BIcmS2tlMQBV4E/LnGVieNz0ITzoaF+W3I5JfuhYj4bC61/U/X1aYgYoxoKdgAxkh9yrcTu5CdOauF8O4ZQ8/koALpR/vipWRpaSXwEHFiAYZO53395GDCCzeUqWHJBD660aTx8vFhffTJGAJPe2g3CDyP8SFDayL3O243fOBbNIQtzzkmAg+RG3I/wcUiWdumEnjeZVwEc1pD3hkO0Oz9KEpialD2H9553B+9f3efImetBJ71mnOL4e9YaCEgOSFLD3vc2LSqpH7lm1r77fJ9QFudi0uLyQ5q3kX2alzsUFiNEbSiYJHLeNVC4Hk2VmrwjrEXtf3iYIrizPvhx3tzyrV0DcpAFFscYnOKQ6zuWLC9JRk3Rd7b3IFhDIFHMcChxbvh9rnSLI/An9bS7IvAo4hlj0vWJaxTHMqYr4OSHIHHpIVLS9LkcQJnoy8VN6gFBBMtJlXcKca+pLwonPwgOFGrVtMPNmWymsQMOX33krEGzUMsUNV3DxsjGQIIUIpagr77MM+ymfpqnUPj4lk8B3MjGoo+gbSjaWNxxyqpaOJycQmtBD49nz5hBvVavaGxQNjBjXiAGr/tJRP4nBsNlhc2kqF3aSyBB1/ax+eag3i0agzhn35nHTJ/fe5LtW2VrjsmAg8GmHBLAW/87utGTCXwtIfbEx/QFqUJWmEIGRqy6LfPgaDkXrNmAs93jv3Wp/IDP8gc1hsswzlBew+Bja4fQ+8FbpsoN8a6OeAWEDNgoZ1mv2mpBeL7yeGMPbfPeuev5zkc7vlX2qdbCTzt46bFmsV1tlb4BqBFxzI+ZM3AIwD+0KLwgvyh/ON9gLfAB/zBjXUQlWH0fQyB5z6s0fHgWHKlWR6BPz1r+yLwKB98SlM8H3LxmLVrbLHX5Qg8nWXA+EwnYfD8bQ6BPNMeKRP5IAxVd+QAQWAtmma0i4OpzAY6iSkT7Shm7T7XATRmbNBoWkq+qkN4ECzKoYWxRr/JdC8bIO4W+NkxvrGbMKd2NOs8C40frhHML1oeTH0cQAhQQ1uCGTTiyKaZ800bS+AZH33CSoLW2VcKjLjxseSFQ8MRfSn7MF4kgXdKiOhGU5tveQqBT3iBN+XE0UrhqjRE5jlcYP6HaBKwVXOAGlr/fb8fG4Hno48VD3eK3Fz4ugBzEHiwZ3+DmLHflvZZNO4kFiBrGOQyaVMJaIxKklJGqDUTeHDCNYU9MmrUOdAwtpIlEJcPTP78QwFS+p6ypxMbRLrf2qxkpXcH61qM/SklO2h5PzkA4K7BNySm2EztQJCTAg1LQJ+MIfC0x7uB8gHXUuLXSpiihIKT8E4Npc30/aQ9DqkchPoOCrjUoG3HldNXLI5afN4ZKtlGGUvgaQdf+HjIyPn2i8DnV2CswLqNGK6Wd2tr15ZeDnzz2NSTzJ0DOrWLdppATbQf+G6h/ecFxtSBFQC/K7SBQyfrsQBBdNl40VpiNkMzystK+r1U8nhs2/4+TDloF6hIyzjRlGPqQ7uDv+quC6TkfNo4WEWt/BxjT20wdogk4+dZaDbQZjC/fAxq09zl+pRyoePnC86rkR0F9WMFuWKXAYO1jiaJd4/1znvGwQ3ry5DL0mpw3WVHG+eQjBm4OhE8yRygHCBwErI4MYC3OGr2G2J72Gsx+UMoIUAE+HLIjGlqp8CHwgDlAa4pPohsSptruJf3CtclCDYEmAMw+ynfMPb4Oc33saAQ+yr76Bziv1WMCa081gK+hySDmHOtDPWXbwWB7QlTvhF8Kxkr+9VYZVd6Lt9B3gva5x3BhY325/7+D41z6u8+bTccqqX2ytRnz3R/4y6aeWrXAhZH5jBZk9hb4XnbVkjNhENbMyUCTys+EAotOB+ebRK8tp7r6ikIRI0ZWrha8+mU527r3lRBeGq8xrb6p3aFwDEgwIGEvQQSWJsK8BhwmXOMEFqfEhSy2Zehbc5nq61lIoD7ECm2UXTiJnSQZLUSely0fcYaaprgNn2Q0kfgyavu/b5by3EfJGALGRTZXNBGkCKQf/jgtZy6Y7pLzH34e65R0Jxw4karXJO5Zo1jVJ+FwBoQ8MXcCEock599DePcZx9xtSTXfxL2clxzJMeLQFJgYZXAo+CYBUsmVhUEhTPuiH2BzavGqo/Ao0VhQaS0fLh7YIrIRZyvGoRdd366seisBsZXbG0p4MFw/7TzL0xDJ43WlKwxu4bQP89neyGzQ1/qzX32U88WAoeOwG91wbO4ZmGxHRs7dOg4jR0fSgpSVKYsKbKMj0XycO4jTgDSCq1orS57OCicGwnE3dcsKtUEOJhx9xF4BhlLTtcUPjgYcBY8EExEmIqSkC3EF9fo63pME8q15Comt/GaJAUjoZEi+IxAZw41OmDGWZzhxLimhaG+7hwBiCXVe1Mue7KCULxKMi8CsSAYtUXYzyXHiQCusKTTphAfh2XqyUxN8rFmJFMsHGMgxocg/jljTxaHzRCBp8MEsxLUigwV8VncAA+0Q2QIilmB8IEjbWMfgaW67OODvzsBjFhZ6oNIl0EICYQlUxDZfQjGIzDQF+M40KnXsITA4hAgm1hKOUqWFbI+4AvfJMvYVpq6vK2LsX57P2YSO2AhxVXGpyXG9x0feMlxIsA7x7uHJYbsQWQ6Ola5nJ3Yq+zMBbnfUSaQQXAxso39rYbAQ+7YJNLGsUZt7WImcaaOMBe4N8XcxQQe4w5DZok3dWY1IvnJzEJ+2ViQiyh+/rbNfN8zDTnbDHn9r9NluyCjjWQBCGxjo1rAsHq6cHwjzoDxkG7PQfterwxY9sTuq3eQD+owkB4R6yIZpGJxNqqKkjJYcrwIkFWKCqVkexpK63noKPmc8/AgMkIdfDBvDYFn4imuc7duBRDwCCE8eHAWvuLxfcPfO5boru0283fbjvDX3qPrhIAQEALrQGC95yosGMQTlAS3AHLykyJPIgSOHQEqE6NkxlKFUvILuyyKB49LLYGnCAg+xmwaCOY8NL2S/SKACfWJjZXr6DGBUAS+Pn2/3dfTjxuB9TKs4543jX7LCJBJpOQaA0HBFVIZfrY8CWp+NQj4glZUpKd43VFILYEHDAIk8IEnzyjFX8hI05K68CgA3cMgfTXAoVSQr9oUkHlMV3XxoIM79jAPeqQQEAIrQWDhR0fie3IugRQwurOZPWslMKubQmDbCOBGlg6zVFMmXvNoXPhaCPy2J0LtT0cAP0lca6jyiGsNwVAcsgjuxPWJCn6SGRFYOBGYcaRqSggIgR0iQP5qyMilukqoKF+ev8Pn61FCQAgsHAER+BETJNI2AjTdIgSEgBAQAkJACAgBITALAiLws8CoRoTAkSNQOtXqtHvkC0PDFwJCQAgIgW0gIAK/DVTV5lEhII56VNOtwQqBPSCgXWYPoOuRQmDRCIjAL3p6hjunbX0YI10hBISAEBACQkAIHA8Cx8CN9k7gjwHk43llNFIhIASEgBAQAkJACBwmArvgrLXP2DuBP8wp1qiEgBAQAkJg8QjUfikXPxB1UAgIgWNDQAT+2GZc4xUCQmCvCOyUM+70YXuFVQ8XAntFQK/aXuE/yoeLwB/ltO9o0NrRqoAWTFUw6SIhIASEgBAQAkKgQ+BwCPyBsqADHZZeQCEgBISAEDgPAe34WhRCQAjUITCSwGuTqYN33quWgfoyejEvsmpNCAgBISAEhIAQEALrQWAkgV/PANXTtSKgg8JaZ24//dZ62Q/ueqoQEAJCQAjsA4GjJfD63O9juemZ5yOglahVIQSEgBBYNQLaxlc9fWvt/G4I/IEs7gMZxlrXqvotBA4UAe0stRO7M6R29qDakes6ISAEhAAIvH9z2g2BF+pCwCOgj6PWgxAQAkJACAgBISAERiOwVwIvHjd63nSjEBACQkAICAEhIASEwJEisFcCf6SYa9hCQAgsDgGpExY3JVvqkGZ6S8CqWSEgBHaKgAj8TuHWw4SAEBACQkAICAEhIASEwDQE/g+/wziA8OWnHAAAAABJRU5ErkJggg=="/></switch></g></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-10"><g><rect x="25" y="352" width="160" height="40" rx="6" ry="6" fill="rgb(255, 255, 255)" stroke="rgb(0, 0, 0)" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe flex-start; width: 113px; height: 1px; padding-top: 372px; margin-left: 72px;"><div data-drawio-colors="color: rgb(0, 0, 0); " style="box-sizing: border-box; font-size: 0px; text-align: left;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; pointer-events: all; white-space: normal; overflow-wrap: normal;">secured upstream</div></div></div></foreignObject><image x="72" y="365.5" width="113" height="17" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAcQAAABECAYAAAAfmEVzAAAAAXNSR0IArs4c6QAAIABJREFUeF7tnQXYdUtVx9e+ChYGimIiBnZgXAO9XkVssbDFFhULE1tsxQILERMVEzEwsUBBDERCvdid10AxMI/nd76Z911nfTN71uw+5531PPe5975n74k1a9Z/1czupFHjwFlxoBORXf+MHI9MzZIVupx6Cq29Cg5Mtt6TNVQx+E0/Oi9DaL1R40DjQONALwfmVUON+WfDgRMXlE0A4onz8Gxk2T2RtmBuVrUHGwfm4UDbhHPwdROAOMfEWpuNA40DjQONA+fFgbnNgIUBce7p+Bd/OyPxj7n/yfOb0VScae0sx4E5pXDOtpfjUOtpdg5UCcrxwwsD4uysaB00DjQONA40DjQODOJAA8RBbNvIS1WW0JJj3uzAlmTCdH01dk7Hy9ZS40APBxog1ohHU0w13GrP1nCgyVYNtyZ99qqwfol5ztLHLI2mRejMAXFBTk66RVtjjQONA5vkwGCVMvjFa2wY+XovL+dse5OLmB/UmQPiia3GzHI/OzfGb6xni8hzXY6zu0lk9/jkuMf3NTE7lhlQXS91T0/MkFmaGzKjIe/MMvjJGj2/GU3GGldDef41QHQxsD20EAcMIMpNIpIGxIUG1Lq5jgOvKyI3i8iDTpk35w4p5z6/uWRvICD62O17aq6p9bvFhcu9lh9U6xEOVAHiVuVrqaVceP4vICJfICIfLSLfKyL3XmqerZ/Ggdk4YDbRQECcbXj9DS+sAVaa5VXutgoQN8WoAbI54JW1pvyWIvIdIvKSYQCPaIC41lK0fufkwCUgntDunJMhre1VOXCagHj+e+fBInI/JRkbA8TzX4BVd+UsnW9zzU7LQ6xemALTt7kmYZb9g9v00KvX6eKFSQDxTHkznKvj39w4II6f4FotbEdWtzOStdaCfs8GENdazrX6XVNoLvuefPaTAGI1byafRvUItv5CA8Str1Ab3yQcOBtAnIQbMzUyn76dr+WZWFFq1g+IZzf1HtasP9cGiCXJ9f6+9Fr29rf0YLxM8j6XGf+IaTVA9PK+PbcEB/yAuMRoBvYxYj8O7DHx2rSDmAcQpx3jjIGL6ZaltWQ4MJcM9DI632kJEG8QkVcVkdcRkRcVkefZJ9f/SUT+XkR+V0SeXv48uVsEXllEXlNE7igilHjTx9+IyBPDf7sbKjzIHF4vzOtFROT/wpyeISJPEpH/mKqjZDvTCsANIt09RHavEdbht0TkF0XkP51zeF4RuZuIvFTg+3+LyN+KyO8HXkx1OuUuInJjqFKEA38uIk8Tkd8x47wGiJc82sY5xGnXLE6ZfYW8v7SIPOf+OMOtIvKbgS/I5Bi6feD3y4sI/408/EPYT78iIv9c2fjUgIg+eSMReX4R+UMReWwYn2dYN3QiN+5EXiHI7G2DzP6ZiPxyOLrjacfzDPuCsaIn+If9goz+3b7K9g9EuqeI7P7d05DzGfTtG4rIa4f+WDf2CjqQ+fUReo39glzdTkSeKSJ/FM7xPsvZ/5V/LAeIlFd/soi8bxC6HKMQjJ/cb7qvDpv54jmnDmFDfFIo4UbAU4Ry+NU9SH6ViDxyxIq9fujrniLyfJl2EMAf2AP/A0UEcMkRAIQxoIm5/KtzfCgDhFxTbi0+SES+TT34sSLydUGZch7s1Uw7/xh+/yIR+a/MeNg4n7YHz7uLyHNnnmFt4TdnzzBM/HRt8dncH7hXvp8Qxpp6/9dF5PNF5MfCj3N7iBhZKLZIyELs2zM/O763CMrcvnuHAHDx708QkTcN//N2+39/roi8QaZDFOA3iAggVGucvfteWX/Ufkxv3lMf8L/B2KFS9Jt7+kC23svDFBH5UxG5s3qW//5j9f8/uN9PjO2FROThIvJOpl3k9Pv2Y/lUEfnrTJ8vJyKftdcz72zWUD8OOD0myOyTnWO3jwEo993vz7cRkVcqtIE8oP++IoBxqUv2Lec4IwG2T9mP9zlCFS869yUyjfxs2EtWL+E8PEBEPjwAoX0d3sLzzzQyWRrrlfw9pYTvFRiYA40Uo/AkvjYAzv84Ofme4Z0Xcz7PYyiW9xaRv6h4h00IYH9AxTt4Sp8nIoBKitYGxB8REcAEbzpF8Odlg/erf8db+BYRedcKXvzb3sP49LBW3tdeZg/U3x+8AM87DwuKnL7U1W2T31RzDIid3FN2iwIihtanOIvZsO7ZiyjMEmGMYby8dd+DCSMV0GIfEhmxNDUgsm9/TkTerGeMRIl+z/yOYYXRBN/wBj2EPvrWAD7eaAmGIUb3R+z7o89awojBWMXgyFEKEInIfHcwYkp9YiCxd386PIgn+aP7ud6p9GIwWu6BZ9t1IrupYj+OjrfxiM9Fs4CI5fZDAwWCeX9TsFRKPMAS/BKnYrBt/eUeDN5hLxhPLXUiIi8uIj+zVxYA2BDCSsfDsbQ2IGIlI9w5+rJgbevfAUisWSzgIfQ1gRelcB6W/C+FMGxNP98oInjDywGiyJIeIhY+lvyBwvZEeRIqfeGMssdA4FA8EZIcEW4lTP7GNcxWz/5LCNORMtA0NSAC7EQbcvRrYRz6d0AKT/bdBs4NOWSvkObpI0KhgEz04gd2J1+4B8TPPnr5WA9bQOQKPOT+VSo6JPxJVOgFwz7DyPUSa0BkAoO/UYIDGhDxpLDOyBVGQpDw/AAVrElCgniOWHKEQO6z96JuY9olV5SyOONjvINHoAkli4XLJiSPwiYl7ERo8UPC3Yn6+b8SkbtKJ7dK3tLBmkRREJPXxBweus8jPjrE2LG6CNe+xz5X+TGXIcQLSSZshLejyQeIeaNkTMiUOVkrG8VK2CXSa5mQLjkF1oR100Re4uv3igBlTaiOtQTQAArCRoRjNBGyynnNPAeY0Y81QGgbQCWchUUMAKAMCO+RR8vR1DnEtUKmKDG8uEi3BMWJDBLSQlJY089IeHkA5qv3hLsIhaGINcHnbw97iTmzv4gmvEkIzdn1IWzMmmsCYDGiIKIrhHojcb8schMJ4GYukWzIlGgGfZLnimRl9uMSUYjv2uez38+Mi/37sE7k0btDHu+QHyXFg4H4kSLyiglevG2h1oG5IIuaMLzRE+y3P9l7qMwR3QdPWKsPM2Fi3mUt0SW5CNYxIHbyDNkdgSH78FFBL2HoAF6MC12oiRAoaxnnip7mJiHWhZQJ/CC6gDFgnR7SYN9j2mv/GzigmUVsmwWLxKJScIEyyxGbhs2Hwo0U8wVH7wRsYGOzOfTGoB/AiGR/jshF4X1q8P0pvUkT2JNSFIRc6SuXp0A5I5Q6jMuzbHCdj/MBYn4+YwAxtoop8JCQayK8xqYhp0XuAyNCE5vl/c3fUAKf2JNnxLsmr6PBFyV2s0j3BJKECcIDIj+mifAufacS+2x6IgXkTlJ0LoCo54ZxBcDkQnl4GIQINeVuhsEIYn/qvBOh/qM1MHsDngM0Nj+I7Ofy5rVFNRYQ9Vwwrj9nn0ckx4cBRYEbxhfGKOAfCRkmvK8Jj49x5/Yv7X15CF3q9wj5f2lGxij4wkDRBiWh3Xcp1ATgvWLY231FRAl+pch6iPEZjBb6Qz9ZorCHegPSECkiZIp+pIjGEuFVaiL03H4iRNgyzZ37n/tDpxoQATIdmkBIsZBKxJVOWgBYGJRzKpbO4mlLlMo3wAFLr0RYPLaoJlfUQDgB70d7OHieWFWlQgUKEn7BDAahR4lE2gIg9m08PXy+TvAbZj7kVD++xPBguMAL7WU/LpPvgNcUVxBpiITFSuFOKURDFAKFGOhCaM8NEFG0eCv9efZOHiK7A0hEwsMjTEZltyZAjGrdSAAFVaulsDYhQiqJ492kvE9xGzm0FE0FiHg/5Cz78mz0D9ggS9owxWBmv1PIUiKiEeTzIhFxAlD4tyUAVBtkeFgU06CbSoSBjjEKzyMlHYLwYwoQMbQprrEV17rvDw45UTse9iIh9T5+EpKl4CYS89OFZaU5nuXvOVjUgIgVAjhFwrr44T5uhEYBH4QH644Sav5BwLS1RzMIGXkK3SeWDd6Ll7B2CNVGSoV6+A0BQBAi4c4gdJ68I++Qa0NxRaJfNnKktQERJUhC3UN4F4RJIhEWx1P3Fj8xV/rT60bFrgVZa9GjlOnH5qZSY0ZB/3YiBHVOgEgFJKCGoi8RERcACy89Eor7/uZFogFESiIh33ctNR5+pzKScBzhQPYsYKWrmXUzUwAiHjHh+Jx3p/uzaRUMKnjnMZxpB0+RZzVQoZO+MsEb9gNeYiRSAqQGvESURhsvGIHIbYpSgMiYchGS2AbGJo6GDX/a1EiqT0LJeOWaaG/Boxi+ghYvw+d8TjOYHMA7qs4AQzxGTz0SFl3JciMMpBPOhEqpjvK0H4eFhfjzaoxYRngk9rgDSgJlEQkvB0/FS+QtCClikaPQsU6pIou0NiDmNredH+vCmTNdnYexQPi5hrBEdeiUakmObWjCOKHYKRKh57eq6OT+It0DjTicEyBS9fihFfwgxEfxWSSAC0DRRLhR5+sxQsg7WWMl1S2ggXfi2X9TAGLOeE2NjbydBhWqMG0uscRKQseEZiNRmKQN/vh39AR5P85s8m/yuIRQvYSRwn6IRCSKqEyKUoAIGF8D+n7cIOKlw6aZfq5rJBW+Ru/2pcK8cz+75zQgWsBisliNxN9tKfQQRgBKhCMjPVSku69vP168g2JHweuzcyhdlG8k4uVYUzqvSThOFwGUxl8yadYGREK/HEIu0c2dyGONxsProLClhmxeS5+ri1uZUIwOl9bynGIFlL6mcwJEQlvamCvxH2Cz1aUoN+1hIuOsJR52JKI1GEwUTniPHJTGMgUgktP/4lJHwXize5wjG+SzawjZAVgj4WUSzSqlTGr64FlCs4RoI3E+Gc/tgpQysYBIFM177AzvX7eLgW4LgVJjpwqVvanpEoRrZzvD8yVlO0OX2SY1IBJeoJKUpLslku2EESlNJiRQu9EAKeL3euOmqso8c0fgdJWc3WhYeTa0QvFPX9GOp1/9zAqAeCQ2FCU9O2lSHksXxoxWQkPzB/fqRB6pgJX1Zy1jrspYoYdBUMKeKhLo4zUKQlfUnQsgwieUsffiBniE0cfzuiCCY1G6mpPnyPNzds4SITEMRaIlFL5ZY6NG5qcARFIQ8fxcX9/sVWvseUKDtk3yZBSraPIakiXeEHLEYKFSGrDWla2E/nPHvCwgkqaicNFDRAKICEQqVXzH5zCabHh0U4DomfxSz9iYNIUaucR6HBO5EEJobDTCICSVS4QV5PRKqu0FCjIA10ipmDlKNp8kr+7yIPBr3VSDcNvjEDn+2/xGaZ1qfkfhRMvThrJphzJ/brupIa7wQskE6m4S2WGATUVrHbvA0CQkV0s2TEYBm/ZGaA/ZxtjL3fQU+yTKAyBRZUi0psaonQIQUeae22PI1StvsH5z9jCZwjyiXh4iGgXQxXAq68f/kxcn5Gh1Z2yzBhCpwKa61EMWEJUs9PKoAaKHu1HjJLwMwi0coM1d6WWbx5UnPMO5pxzocf7NU1xRMfSLR6n+1KXPFN1QBKMJ4S5VOtb0vSYg2muy+sbNumDBOqlK+aAcKMaAyDVTXacpeLH9XZseuRRCK4hz8RDJ6VGIVEtEZlDAkTjWYo9k8BtKm+Ipe+Y21x+eJxXfDxfpHuNIW0wBiOQ/PV4q3q6nur2WlzzP2UF7lEO3Qzrh3qFwjyI87804uo0aQOTc9fscTyS7By0gxiscS3xogFjikPo9Z+XgUpMsxlrzeiNsMsJzJJht2Tcb9bqQZZX6zU+Kjc0B1EiAo65cpZrSXh5QwaLko2sCIoU+3pstbLXs2Hnr9ykcILEPsakpfIhEdHXI9VccONZX7J0LIOL54kXXklWCfRWQ8JvyfPJKuaKORP/d40V2VEn23d07BSByVtJzJy6FRLkzg7X8s89z7vZBiUbgHakXCsV0WqfUH1EiIk+6NqIGEHPnS1P9NkAsrUaxLqncQA4Q45tUonE/ItWn5AA8d+ZxYTBl05rIAdgjD1Tdla5UKs/g2kbGO43EcZFHGc8XQPQeM/D0ORIQu7uJ7Gx+LbcW9nLvGkAkPKTvLcVL/3HPBB3PEFrnxiAo8PzoLRRLVQFDJ/KI3fERka0BIlWZ2rgy52AvTDx7uTfGYOJqtaJJaI8EUAHJRQYlwnvH0377cPa25OmwD1Hq+kyj7mNJQCT9wTnZSNwQM5XHSIiSw/2X1MltZHeIbtibeiyPyW9Tfcr1Z1wzR9qISnnO82qQbYBYks4N/14CRDt0PEeq5cjT8Q+FAimyoQkKdmyZ79TKLo4jdbBe57umWI4UIPaf7TnWfamc2xyAiHGiS/05GN53B+pQ3pD3wwvSxKFvz5kz/Y49ujG1jNgcYqpIJccD1sdGPrxfu+DQtQ59evlMDlZfpTjkyAyGCQVOrDvGbe78KrUA3HOb+kLKkoBIyPI7FYNIdZC+KV020M/TvO3Bvb9cHK6J41zkWilKItwNENpKzfg879JGpAaI2ZUoGoDefTHbc7WAqAeCpcyRBwRChwx4Bq9N31FJPomQqg6jcZA7dxB4zIRRPDb8Q8gWq66GsLJR6FiollJ9cD+n1+NN5TnnAERC2FSaRqJI49r9lNPKZsrgqT1mwKjwULTcHAHiBEO2VazkPslbesh6fbzjBUQ8Ze4yLd3QosfR098oThDlIepArYC+X5W+kUubC+bvSwIioG2rUSlo0Z+T8qyX5xl4QbtaL5HnxFCyRXO59uxxtckA8WiVO3mS7I6qTA85RIcktByiRxLCMyklDNCh3J1VoQdhIjSn83g0j/eor0qy52hsMYx32NHbyx0oTp1D5NJffXNNqS94QDUnIWP4wKYBwOOBXXJ49vAuh2a9n6VK5UnmAMRUKFMXw5T4EH+PeZW+j6HCJ32minyMPrBc6gujCXnRx37GeYjXawtyWPqTWfZKPjXG615O5cG9gEi7GFF913NZ/pCiIAccCTBlX6auH+MZPEl+81aPcmyA4w36WAehP/JslpYEROaIJ6/3Q6kYJiVb6CXOxeY8O97h6IL9Akfp4wS2L7xZvNpI6AX7jdL4mz12sUoOcZ+auEu4GL20J6/c71HouMWF2D0hE6wxLHV95qXEGLwBfTie563itTfKP7MTudOu7gohFC6hV8AQbwdrjs1KeEMToUF9Mw2KhXyKlzivpMv9UUa3F+meFSryUofIdZFJqR9yGfYjqXMAIkrSHn3g9o6+z/Ckxk5OB/nAw4Ln5CK5dk8bJRTV6Iq5mmvE6JNL1+1XRa4DRIdF3Of9YtjoD9nmiixSPEgdSaoBRC43sF+l6BurvZA9dWaNPUUIlH0LkNSEgJkj+TT9yaOckfpgke5+arlLijx1O4q3qIZx4WVpUOFCA3RMDUVjEMMWmeUfjipoT5PjHfpKxj4wS/WNONJe/CoIz5D3tV+V2RQghqvqvNfg1fD8+mddG3ZcF1O+HZWwBTTi9QCj595FxpPK2wFe+j7TVN6sVjnbi3jpG4VgiwG4JYXziZEANLw6rxBwi70uDLI3s/AZGHvI2nszC4YCIV393T/GOQcg0q69do2qOHLB3vAuHhX3aurwGmFG+406rm2zX58n/GXvUczJr72ui+fGeYjX98SXVvTxBy6LB4hLdFvp5KnmUz28UwOI7CWAy1NoBKDgTeqvwvA1Gs6VajoAmtI5HCnAm/KSOfd5aF9/0T22w32b2nMsXaV2CYiXg6sBRHvtGuPg6sDjgpj8LOmVQia84EjoIvLaurjOGs52n5f4mDpu1HfmdBMe4qKAWOLgln7vLpUwSWvCSbpIhlCA9yvzdqHx4lIVqSSodUk4CXM8Oc/h6xtFDiXiumIuU713uLaN8KWeDwoX4C9VmwKwlDjr0F3qEnIUnJ4jCox3+9pn7FxokCrBnwsQ8RrwSDVRaUqI25PTspWqtJO6dYTQGzzgEvfo+cAjIg2lLwdwVCB1td7UgGiPdbBWGCglw4/jDlR4WqoBRN71fGWEcD05NC0jhP0wULnSTBNhaV11SriU83Oeuzj5rBDnSLVhlsvr04e+u7Z0L+lYDxFjmjXRZ6GJCGHM2I8GpFSq/QIPz3CUQ+fT+Zv1EAk5cxYxbbQcezukSKhL0Bew0yZ1B/orInp8iwNiJ3K7RBRuwZtqJnQRhzZV8Z5WwpTR26/DE1rj22p9FV58n4wQis5F5M5LcZEu4UvdL0UrJPntp520IJG/4byhvfcPMLWfaorvHX0PMfCEa6/IG1nFEt+hoIPwq74lH++Iv9vcDHcJkpvUxEF4wDN1CQDgyUHc3JfN5wJE2sWyJgysiXnCi1yOBfBmA9sjNBgW6jaZozYp9bdFKhQnUNKeAx3ah5dafmKjUwMissoaaALEkaNUzpxIAPtCfz5Hv1sLiLwLuBA+TRkjGHAYovYIQC60S0gc41ODGh4KH/O1n4rS46Yf1l9fG8Y+RO5T39WzOW9ACaWa20djAZGx2oIw/kaEh1Bo35lJPGTkSRu0zAmDwkZF7JEJ+sjlUTX/2MOAaeobhX03SS0OiOFO57O6uq0C3w5rVvO8VsJsLmL3usyb9jh3QwiRcALnzmJyn8/McAO9PufG83iahIZSG4vf7S3+UdAANix4ciVsOAo5OL/ITSv0YxVmydomqU7uwSpvFB+CCTCjTOABMX9CZ2wmbZUyV7xKwo6WsMTxeC2QYclybgpeomS4oYPQIXyKm5QxoEyueVPXaC5ApG0UHYfo7Ze3WSPGisdI2T1fLMFzACAIAduvj6NQ8Pj6Kv6oHMbA0UR4GZ5TwUguB6DB2udAuM4N0b/m/9SAmPoOIONkfHwBhMu0WRv4RXEFxk2MMmAUEpHQIDIEEOmPtSCkj3EBT/EoADEUtPUu2BccmcgZpRis3GCjCT5yNpcv1gD4eD7wFVlkbQmL2n76iqDsUQj6QgYwMDEUicjoi6anAET2CiFda8ixJzHAuY0KY4t9RKEdRjOGS8pYy1UT490BssijJnLZHKVgnSLfmSP5Vi4/oBo3VqYyHqubcrc0NUBMKNIt/ckqYUJhhNdKB3lzc0Cx4AX2fYkB4cGCu08NcpsO8Sb5xl/+OrZrjeNRouyHXJtFwQhn+PqOhigBd8+GcAwAiWGgN/ucgAj7yKfgZesqyxpZRKkSfk0ZB7odvBVkSH9+y9MPyhslo4uNpgZExkERBV5ijt+5sfIBXQpXiDxEcgNiJ/K4XVTWblE53P0JGPblewmxYtwVi056usVQgS850MUbLH3xhq8qRCN4CkCEx+xfZNZ7JZ1dO/Ywx0v67mdOhVdjO+xVIijoQ4xJKzM4CPCNgkJtyPGZKfulEtpsgOjRBAs+Y/dESimgyPDUahUnIRpAynOBL1NGEKm6059pKrECAKSUH4vYe1AXrwDrX38kt9QPmwAw7P1AclDgFCKkvjaQ6gPvgwuG8bbJm04OiAVdS9gW61pXFpZ4we8ULRFezd1kYttAgfABWrxMD/BQeANfCBfq4zszAOKBQ+TKyFl67utF5vDcWGfkdRAghqIuvDDrPef4T5UpnpznCxl4JBTUmHsxi0vLHmKdyI+W8sm0D99yhOdMdAeaChBpizUCSPDMaq4DJMoE/+y9xqnxc5aQIxgeWY3vs4+ovEZX2I+rUxSE526pAWJRJNd9ICcAnN8BsCiqKd3SDwASUuUqttoLtLG6ONiPlaXL4S1XiIFj1RPfv6UuKnzRFFYmQo/FnVOECDfgST/ec5h0QAUcIE24JpULQ6mhUNh4MWc3CyA6xYkjKOSLARxb7aqbICTM+U285FIxUqpreE4lMUZWii+ErAl9w2+UMwbIzIB4MUzkjRw5oWwbMuMhAALvBJmJ5wfHAGIsZAD4UZapTwTRJ8YBOXhPoZnlObKNEcL69t3fy34CKKge9Z6NpD2eJzSaWktdkKMA8cJEq6kyTckS5zgpimFueKM5QqbQRXwVpO8Mon2fSnlyu30fEsdTJ/fKUa/Dh5nD7KyXSWENPLC3/iQB0RkwaHeZOpVb9WNqATwWEWdsyBeSW+J6MmL7hM/IIbBItddz5cZLPo2cITlMQlOEK6hOfLpI9zSR3RCFnOoLaxprFm8p5kuxJslHAO5ezzPVNgCP9wWvMCrIb1Dxh0dIXueInBuhen0rXsB7pkCAnBm8QOkxZvKgHFGoMQr6uqVteI5xFSuaKVYitD6G3xVTzT7KeDAMUGCMk3Wi+hJAKlXH5hpN3TJjK/vIQVOsRS6PPBw5XPjhqaIszRsZZy+Rywc8AHyUM+t5Syfy5N0wA4d+GS+GH/sHXYC8MHYqLu33B0vjHPI7YEwem/w2fOY4EADP3Ni/yNUYIkyLIYfeQ99xGQVrQsgYA3G0vG5g34/hz1m/6wHE5RjQJGU5Xree5uSABxDn7H9rhtdic20dNQ6M4cC2AHHMTPS7DVin4mRrZxgHVgDEJvTDlmrht9oyLczwuu7OExDreHDlnm57cvYlXwEQZ59T66Bx4EQ4MFzDNUA8kSXe8jCHi9+WZzVqbA0QR7Gvvdw4MIIDIxRSV3WMf8QY26uNA2txYMT+GDrkEwLEFbgzlKvtvSQH2gpOJxjNQ5yOl62ltjOjDJwQII4R27bgY7jX3t0eBzYKiG2jbU9UTmBECbFZSZKuCCCegEy0ITYOVHDgAIgrKY2KYbZHGwe2wgHXbrmDSHfr8eciD5dhez8/tupkXTNcdYSt88aBeTiwUQ9xnsmOb7WpivE8XLeFhVaweYjrLrOv94WEwTeY9tQWOLAeIG5CGDcxiC3IQRvDKXOgifFqq7cF1m9hDKstgOp4Cj6sB4hb4OCVHsMU4nNKDNzofDc6rFNa2TbWjXPghGR8BkA8odmPkKPTn+Xpz2DE8q3/agX7Kx51z2uONt2dtwcbBzbKgRkAcaMzbcNamQPDVPCwt1aeauvez4G2wH5etSdn50ADxBKL24Ytcaj9fgocaHK87VVq67OJ9VkNENv6b2L92yAmdWYAAAABHElEQVQaBxoHGgcaBwIH2tVtpyQKzYo4pdUaNdall3rp/kYxp728IgfOW1JW8xBXXNErcRXBdWI7So5HvdyWel0OtN4bBxoHnBwYDognrCMveDNyDiNfdy7RdI+d2ninm3lrqXGgcaBxoMyB4YBYbnveJ4Zq96HvzTub1nrjQOOAkwPLbOFlenFO+Wo9tiLrTxcQr5aItNk2DjQONA6cCQdWRLzIwcwQpgXEDczzTCRmc9M4XtrTXujVRr9ax5sTpzagpTgQNfxuqQ5Pu59pAfG0edFG3ziwaQ5sBk8XHciinfnXvxPpduZ7Jv63Z35yozybedZTNN8AcQoutjbm4UDb1/Pw1dVqY76LTTM8NIjzg16aYfCbb7KfUf8PJ7OlrwwWHhgAAAAASUVORK5CYII="/></switch></g></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-16"><g><g><svg id="svg-image-eRUj3TuY2W_K_Vb6ya1R" data-name="Layer 1" viewBox="0 0 840.55645 412.45904" xmlns="http://www.w3.org/2000/svg" x="63.68000000000001" y="231.5" width="81.65" height="40" style="font-family: initial;"><defs><style>#svg-image-eRUj3TuY2W_K_Vb6ya1R .cls-1 { fill: rgb(51, 51, 51); }&#xa;#svg-image-eRUj3TuY2W_K_Vb6ya1R .cls-2 { fill: rgb(124, 124, 130); }&#xa;#svg-image-eRUj3TuY2W_K_Vb6ya1R .cls-3 { fill: rgb(6, 237, 148); }&#xa;#svg-image-eRUj3TuY2W_K_Vb6ya1R .cls-4 { fill: rgb(5, 155, 97); }&#xa;#svg-image-eRUj3TuY2W_K_Vb6ya1R .cls-5 { fill: rgb(25, 87, 186); }&#xa;#svg-image-eRUj3TuY2W_K_Vb6ya1R .cls-6 { fill: rgb(108, 168, 255); }&#xa;</style></defs><title>OAuth2_Proxy_logo_v3</title><path class="cls-1" d="M474.20933,196.63116a41.46679,41.46679,0,0,1-16.33506-3.18964,39.80757,39.80757,0,0,1-21.67092-21.83518,42.99409,42.99409,0,0,1,0-32.23,39.80765,39.80765,0,0,1,21.67092-21.83518,43.41665,43.41665,0,0,1,32.67012,0,39.8101,39.8101,0,0,1,21.66989,21.83518,42.994,42.994,0,0,1,0,32.23,39.81,39.81,0,0,1-21.66989,21.83518A41.485,41.485,0,0,1,474.20933,196.63116Zm0-14.07985a26.63714,26.63714,0,0,0,10.28431-1.9799,25.89889,25.89889,0,0,0,8.36072-5.50012,25.04229,25.04229,0,0,0,5.60963-8.525,31.04294,31.04294,0,0,0,0-22.11,25.07963,25.07963,0,0,0-5.60963-8.52549,25.9145,25.9145,0,0,0-8.36072-5.49961,27.6962,27.6962,0,0,0-20.56965,0,25.89233,25.89233,0,0,0-8.36072,5.49961,25.03434,25.03434,0,0,0-5.60962,8.52549,31.04279,31.04279,0,0,0,0,22.11,24.99714,24.99714,0,0,0,5.60962,8.525,25.87675,25.87675,0,0,0,8.36072,5.50012A26.63112,26.63112,0,0,0,474.20933,182.55131Z"/><path class="cls-1" d="M548.12931,116.11083h16.94044l29.59051,78.76048H578.26942L571.77961,176.061H541.41945l-6.48981,18.81033H518.53983Zm18.81032,46.3104-7.03941-19.69-2.8606-9.56994h-.88018l-2.85957,9.56994-7.04044,19.69Z"/><path class="cls-1" d="M636.67873,187.83138h-.88019a18.26469,18.26469,0,0,1-6.82039,6.43506,19.94541,19.94541,0,0,1-9.78947,2.36472q-10.23059,0-15.23483-6.26977-5.00682-6.27052-5.00527-16.7204V140.97087H613.359v30.91027q0,5.832,2.58477,8.635,2.58321,2.80482,7.53425,2.80533a10.50006,10.50006,0,0,0,5.22532-1.265,12.21407,12.21407,0,0,0,3.85029-3.41019,15.44293,15.44293,0,0,0,2.41947-5.06,22.69746,22.69746,0,0,0,.82543-6.215V140.97087H650.209v53.90044H636.67873Z"/><path class="cls-1" d="M669.01723,153.29138h-9.461V140.97087h9.461V124.471h14.4094v16.49984h13.2007v12.32051h-13.2007V174.829a15.54561,15.54561,0,0,0,.38534,3.57135,5.7936,5.7936,0,0,0,1.48454,2.77744,5.44914,5.44914,0,0,0,4.39988,1.81357,8.00547,8.00547,0,0,0,5.06-1.4303l4.07034,12.65007a23.83924,23.83924,0,0,1-5.44434,1.81512,31.8029,31.8029,0,0,1-6.43505.60487,19.66528,19.66528,0,0,1-7.31524-1.29084,15.54151,15.54151,0,0,1-5.44537-3.53675q-5.17107-5.05331-5.16953-14.37272Z"/><path class="cls-1" d="M707.735,116.11083h14.4094v22.1105l-.87915,9.79h.87915a17.85447,17.85447,0,0,1,6.65511-6.325,19.31492,19.31492,0,0,1,9.73574-2.47526q10.44909,0,15.45488,6.16026,5.00371,6.16128,5.00527,16.8299v32.67013H744.585V163.961q0-5.60962-2.64055-8.525a9.44018,9.44018,0,0,0-7.37-2.91484,10.82482,10.82482,0,0,0-5.28007,1.265,11.76092,11.76092,0,0,0-3.904,3.465,16.09429,16.09429,0,0,0-2.4205,5.11478,22.748,22.748,0,0,0-.82544,6.215v26.29034H707.735Z"/><path class="cls-1" d="M769.77353,194.87131V181.78115q6.48979-6.37824,11.98992-11.87991,2.31048-2.3097,4.73048-4.73,2.4174-2.41818,4.50939-4.50991,2.08888-2.08889,3.74078-3.795,1.6488-1.70458,2.53-2.69531,1.75726-2.08811,3.13436-3.73975a18.16413,18.16413,0,0,0,2.20046-3.24542,16.47472,16.47472,0,0,0,1.26449-3.18963,13.02445,13.02445,0,0,0,.44009-3.465,8.4276,8.4276,0,0,0-2.85956-6.325,10.93308,10.93308,0,0,0-7.81009-2.6953q-4.951,0-7.70058,2.80533a14.59773,14.59773,0,0,0-3.73975,6.325l-13.09015-5.3901a24.55547,24.55547,0,0,1,2.8606-6.105,22.76637,22.76637,0,0,1,5.06-5.61014,26.44875,26.44875,0,0,1,7.31421-4.07034,26.86184,26.86184,0,0,1,9.5157-1.59456,29.71878,29.71878,0,0,1,10.3401,1.70458,23.00883,23.00883,0,0,1,7.81008,4.67521,20.92923,20.92923,0,0,1,4.94949,6.98517,21.28551,21.28551,0,0,1,1.76037,8.635,25.00612,25.00612,0,0,1-3.465,12.92486,56.87664,56.87664,0,0,1-8.41546,10.945l-9.45992,9.46043q-3.74077,3.74077-8.47022,8.35968l.44009.66014h30.4707v12.65007Z"/><path class="cls-2" d="M447.03623,265.05824v31.9h-10.12V218.19774h26.84045a24.25664,24.25664,0,0,1,17.38054,6.82039,22.75761,22.75761,0,0,1,0,33.32974,24.22463,24.22463,0,0,1-17.38054,6.71037Zm0-37.18055v27.50059h16.94045a13.378,13.378,0,0,0,10.01054-4.07033,13.80577,13.80577,0,0,0-10.01054-23.43026Z"/><path class="cls-2" d="M507.31645,296.95821h-10.12V243.05777h9.68v8.80029h.44009a14.60805,14.60805,0,0,1,6.32451-7.31523,17.56035,17.56035,0,0,1,9.40516-3.02486,18.97706,18.97706,0,0,1,7.48054,1.31976l-3.08065,9.7905a16.79182,16.79182,0,0,0-5.94021-.77017A13.09674,13.09674,0,0,0,511.551,256.478a15.45278,15.45278,0,0,0-4.23459,10.78019Z"/><path class="cls-2" d="M530.74567,270.00825q0-12.42951,7.81009-20.57018a26.6222,26.6222,0,0,1,19.91055-8.14015q11.98785,0,19.8,8.14015,7.92011,8.14172,7.91959,20.57018,0,12.53952-7.91959,20.57017-7.81164,8.1417-19.8,8.13964a26.616,26.616,0,0,1-19.91055-8.13964Q530.74412,282.439,530.74567,270.00825Zm10.12,0q0,8.691,5.06,14.07984a17.28222,17.28222,0,0,0,25.08008,0q5.05952-5.388,5.06-14.07984,0-8.58025-5.06-13.97034a17.04544,17.04544,0,0,0-25.08008,0Q540.86469,261.429,540.86572,270.00825Z"/><path class="cls-2" d="M619.95626,269.56816l19.25041,27.39005H627.32625l-13.3102-19.91-13.09016,19.91H589.04651l19.03036-27.39005L589.4866,243.05777h11.43929l13.31021,19.03037,12.65006-19.03037h11.88042Z"/><path class="cls-2" d="M694.4248,243.05777l-33.77035,77.66076H650.20484L662.74437,293.548l-22.21949-50.49024h11.00024l16.06026,38.72036h.219l15.62017-38.72036Z"/><path class="cls-3" d="M211.931,392.63536c-101.38027,0-183.85932-82.47852-183.85932-183.8588S110.55071,24.91776,211.931,24.91776,395.7903,107.39629,395.7903,208.77656,313.31125,392.63536,211.931,392.63536Zm0-354.70389c-94.2045,0-170.84457,76.64111-170.84457,170.84509S117.72648,379.62165,211.931,379.62165s170.84457-76.6411,170.84457-170.84509S306.13548,37.93147,211.931,37.93147Z"/><polygon class="cls-4" points="244.602 112.007 239.295 131.843 281.959 166.856 322.055 161.912 244.602 112.007"/><polygon class="cls-3" points="348.449 195.562 348.449 158.734 290.209 109.179 244.602 112.007 300.209 156.67 76.642 156.67 76.642 198.05 348.449 195.562"/><polygon class="cls-5" points="180.489 297.175 185.796 277.34 141.87 240.558 103.037 247.271 180.489 297.175"/><polygon class="cls-6" points="76.642 213.62 76.642 250.448 134.882 300.004 180.489 297.175 124.882 252.512 348.449 252.512 348.449 211.132 76.642 213.62"/></svg></g></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-17"><g><g><svg width="35" height="35" viewBox="-0.5 -0.5 28 28" xmlns="http://www.w3.org/2000/svg" id="svg-image-BtR5KxsFGjtRb0FzRgQ_" x="264.5" y="234" style="font-family: initial;">&#xa; <style type="text/css">#svg-image-BtR5KxsFGjtRb0FzRgQ_ .st0 { stop-color: rgb(91, 115, 139); }&#xa;#svg-image-BtR5KxsFGjtRb0FzRgQ_ .st1 { stop-color: rgb(34, 53, 72); }&#xa;</style>&#xa; <defs>&#xa; <linearGradient id="A" x1="2.039" y1="3.474" x2="23.454" y2="25.309" gradientUnits="userSpaceOnUse">&#xa; <stop class="st0"/>&#xa; <stop offset="1" class="st1"/>&#xa; </linearGradient>&#xa; </defs>&#xa; <path d="M21.747 13.2a11.35 11.35 0 0 1 4.164 3.945c1.059 1.68 1.589 3.579 1.589 5.699v3.123c0 1.022-.53 1.534-1.589 1.534H7.282c-.475 0-.859-.146-1.152-.438-.291-.256-.438-.621-.438-1.096v-1.589H1.034c-1.022 0-1.534-.512-1.534-1.534V19.72a7.27 7.27 0 0 1 1.261-4.166c.803-1.209 1.921-2.175 3.233-2.793-.464-.528-.818-1.143-1.042-1.809a6.88 6.88 0 0 1-.33-2.081c0-.877.165-1.68.494-2.411a6.17 6.17 0 0 1 1.315-1.973c.568-.573 1.237-1.037 1.973-1.369a6.06 6.06 0 0 1 2.411-.493c.256 0 .493.018.712.053a2.65 2.65 0 0 1 .712.11A7.41 7.41 0 0 1 12.926.377c1.134-.585 2.394-.886 3.67-.877 1.096 0 2.12.202 3.068.603s1.771.968 2.465 1.699c.694.694 1.243 1.515 1.645 2.465.403.912.603 1.918.603 3.014.003 1.152-.239 2.291-.712 3.342-.422 1.001-1.08 1.885-1.918 2.576zM16.594 2.623c-1.315 0-2.428.456-3.342 1.371-.877.877-1.315 1.973-1.315 3.288s.438 2.428 1.315 3.342c.912.877 2.027 1.315 3.342 1.315s2.411-.438 3.288-1.315a4.54 4.54 0 0 0 1.369-3.342c0-1.315-.456-2.411-1.368-3.288-.877-.914-1.974-1.371-3.289-1.371zM8.651 5.749c-.842 0-1.571.31-2.192.931-.584.584-.877 1.315-.877 2.192a3.09 3.09 0 0 0 .877 2.192 3.09 3.09 0 0 0 2.192.877h1.753a7.98 7.98 0 0 1-1.15-2.137 7.63 7.63 0 0 1-.438-2.52v-.771a4.01 4.01 0 0 1 .163-.766h-.328zM2.623 21.311h3.233c.33-2.521 1.369-4.603 3.123-6.247H7.283c-1.315 0-2.43.456-3.344 1.369-.877.877-1.315 1.974-1.315 3.289zm21.754 1.534a7.4 7.4 0 0 0-.603-3.014c-.383-.921-.942-1.758-1.645-2.465a7.26 7.26 0 0 0-2.465-1.699c-.971-.406-2.015-.611-3.068-.603-1.096 0-2.118.202-3.068.603-.912.403-1.736.968-2.465 1.699a7.67 7.67 0 0 0-1.645 2.465 7.4 7.4 0 0 0-.601 3.014v1.534h15.561z" fill="url(#A)"/>&#xa;</svg></g></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-18"><g><path d="M 37.15 364.63 L 50.66 357 L 64.18 364.63 L 64.18 379.45 L 50.66 387 L 37.15 379.45 Z" fill="#4286c5" stroke="#292929" stroke-width="0.87" stroke-linejoin="round" stroke-miterlimit="10" pointer-events="all"/><path d="M 37.15 364.63 L 50.66 372.04 L 50.66 387 L 37.15 379.45 Z" fill-opacity="0.1" fill="#000000" stroke="none" pointer-events="all"/><path d="M 50.66 372.04 L 64.18 364.63 L 64.18 379.45 L 50.66 387 Z" fill-opacity="0.3" fill="#000000" stroke="none" pointer-events="all"/><path d="M 37.15 364.63 L 50.66 372.04 L 50.66 387 L 37.15 379.45 Z" fill="none" stroke="#57a2d8" stroke-width="0.44" stroke-linejoin="round" stroke-miterlimit="10" pointer-events="all"/><path d="M 50.66 372.04 L 64.18 364.63 L 64.18 379.45 L 50.66 387 Z" fill="none" stroke="#57a2d8" stroke-width="0.44" stroke-linejoin="round" stroke-miterlimit="10" pointer-events="all"/><path d="M 55.24 359.62 L 57.77 361.01 L 44.34 368.65 L 44.34 373.22 L 41.86 371.86 L 41.86 367.38 Z M 60.47 362.54 L 47.39 369.99 L 47.39 374.83 L 44.87 373.48 L 44.87 368.86 L 58.34 361.32 Z" fill="#57a2d8" stroke="none" pointer-events="all"/><path d="M 37.15 364.63 L 50.66 357 L 64.18 364.63 L 64.18 379.45 L 50.66 387 L 37.15 379.45 Z" fill="none" stroke="#292929" stroke-width="0.87" stroke-linejoin="round" stroke-miterlimit="10" pointer-events="all"/></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-20"><g><rect x="160" y="222" width="90" height="30" rx="4.5" ry="4.5" fill="none" stroke="none" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 1px; height: 1px; padding-top: 237px; margin-left: 205px;"><div data-drawio-colors="color: rgb(0, 0, 0); " style="box-sizing: border-box; font-size: 0px; text-align: center;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; pointer-events: all; white-space: nowrap;">Authenticate</div></div></div></foreignObject><image x="171.5" y="230.5" width="67" height="17" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQwAAABECAYAAAB08AsmAAAAAXNSR0IArs4c6QAAF0VJREFUeF7tnQe0PElVxr9GVBRRQUGURV0JKua4hiMqJoIIKmDGxCpiwIgZJYuZZAJBFAwY1pwRE+uKiVUEUTBiQBEVAyYc5/emat6d+6q6qrp74ut7zju7/5nuqlu3bn11U9V0mmk6CXSSFtM1d9lbmsV5eBrAnMwk6YJyHo225hk9miHkNPDoB3B6S2sGjB3P6bwGdizwo+jueLRiBoyjUKjLyeTxLKPy/NSMpeaZck/bfWIEYBzD8LYrvN21PkTWQ96ZdkT752Da8cytrVz3mS6xBOZFfaSTv6eJmwHjSPVlSrazurcnpZxybHNb00rgxADjsDT8cLg5HE6mVd9Va9Wjq35wG1yeRpsnBhjbnpRZ47Yt4W20f2qzts/xDAGMm0v6a0mv7ib3vSVdO3TC9ymEBp6fJ+ltzp/vrpYWT2p4f7JHW+XV+vxkjI5v6J6ddI2ph3uppFuOb/YQWji+WTkHjHreP0/SNybE/d2SPrHJRDyEOVvxgAJ+Yfjr48oBhq6WtBfA2Jvo6vWkhsWPkvTvkn6y5+F7SrrGfH9CgFEjoib9rG5w48GGOR1iYVwv6e0TnP2npDeR9E/DuN7yW2mh3EDS/SU9cgkW/7Zc/FcUuJgBY5ppuo2kb1lapB+8tFZLoHvAgNGw0gpyy7R0A3W6vxbV+jnN7PS00goY7yzpd0x7/yHptc2/P1fSY7bO9TQdvNnSvfhBSe8WmsPNmgEjK9vJFgcWKgB9o9CVAYxkHwcMGNMoYqaVIfq5VYai9xA6qVKIx0n6LMPVIyR9ufn3CyTdYetcD+5gY4xeEQ8GMKpmYrAM9v7ic5cuxjsYLkoWxodK+n7nkmChHAnlZrM4y0P0c2KZXOSxxcJ4DUl/I+kNAlf/I+kNJf350qq4qeH0jpJ+rZnzovyaWyy9MGRCZpekJNXy962AUW7xNJ8Yop9bl0QLYNwrmPCRqd+Q9F6SvlPSpxhOny7p47fO+fgOhkzIDBiD5L6xGxQAY/c7x6Ahbf+lIfpZxdUYCbcAxk9Juqvh6CuWqVVckg9aAsfPm88Jft5K0suruN/fQ0MmZAaM2vnKa+VsYdTJcIh+1rU84qlawHhjSX8l6dVMX8QqiFnw2UtcbvzzJX3TCL528eqQCZkBY/zMtAHGmO2wktcddFHJycZjQ/RzSD/ld4yAagHjQZIebVp+/mYBk75e0hfE7zvphQvprcqcTPhE+6wPmZASYMDFu0h6a0mALETdwPXqdL0Wk9zHRSqYzA6BvzdaZhyILdHHX4bCOSy8EZQUJBbje0oicv+akv4h9EesikxZC7UBRkvL/c9eKYks360l3VjSK4LcfmtZP/RnE3TDBvqWIcZHnO+Gocbkb8PG+oeSXtXQzxD97Gv+FpLeI+gMscc4fubjRbV81QIGg7XZj6+S9FDTydtJ+n3X6ftJ+pVaRsJzLzNBVT66e6GoxzfPYkGhI72/pF82/6bm4lsbeELJCOpGygEGixbApP03zbSPFUbK+bGS/ruBh/govOAG3sPJyDbF4sU9fJik363sw8emvnSZ8vya8O6dlpcOMtcEsi9QJ71yIf3EciF8paQ/7unv74Ki1rD01KXMP8k8OCatemN1uloL3c9tcJ6PP5L0hCXIf/sy60cwv5Y+MMTvPmBZV8KC7KN/DNmer5P0F5kHx+qnb5bN5b5LYPyMsMnk1vsLl3r75KCbvRtODWBcJek6wwlVuiivH/Rvh901Pvp9SyX62FrJh+cOCzA6XalFETCQzQ+F3aVmuH8g6W7Bxat5nkkHnL8oWBM17zBHKMBnSvqvwgspwECpqeb9nJrOwiJ7YA8Y7wMwkPF3hGLCymGIosT7FMCPtrBSADY2pFZiQTIvzI+nJsDopCsXmxuabY/iyu/JFFnmeMZKpVrbbrIbz9YABjsyA4n0rE66U+KuW+ozqNOIxC56q056WcO9uPWAkXZBdm1hsCtR3oyJ10LEft61wpynuIms00e0NG6exWXAIumrvg2AsRYoFsbtlxvCJzf2yTR/zNId+4HEe3WAsWIhb2Gsvr9QGp5Qhc8O1lyNfnt24RXrmF03RbcLZQO4gw1HZU1T3ZlzSpXrL7oOmgAjbNzWAo7NYfn88BL0X7dxDnmcdcvcf2/q3ZJAUVh8sNc3L4NAnBvxdLNQp2FdAnZF4hu1VA8Y6RZLgIHfHys7WbDruEvI6oD8ljC3OesQybskngsUAGvjxWHXvW0AFDJJnjDjH14QzNMkfZx7hhJ2dk54w/fEgqAkHyVB4ejTEi7KnXvuM/cWxvOl7g7m+nMsSaxFfP1/DrEZFhTWo63ypU+K31hQr3Q8AFqvFT7D3SEWEomxPMv8m3jCb5p/t7ok9PWjCbn++rLfp4Q4z9+HxURZAJWn6IIlLI13T7iOxCWwpG3hGe/xGRbDc5ZzAOAwJyxWYlkfEnZtv3hTRY5j9RNeCA/AR6ykjePCEn6iGz9hho8OOoYlG4lYC+7or3o5lgCDHcMiDcrKQS27iGybz5B0b/MBfi2BoFqaEDDO9h0fw7B8DAkq5QADJWfctmze9oVPjkJZebMz4NrliNoWalzsLobFgEUDiKcIsMadYIe1ZOMS/j0PGPH7/5X04AD4Kb/+LZbgS6p9Fdw+3+Yx6Sm5z1F90HPVZgtgvF4A61hcCA/wjg+/kuVFIsv3za6CmaeQ4ePd45+aOGwIAH5Z4QcmOHIAwL+ja++dJD03E68fop8AODpoEw6AFxthbvywBGD+mHPfKNIEfDbKI0qA8XPhgFAcJ0qP0HJ0lyUy/7T7EqSyO0jP65oQMM66mRYwOj1PC3u8/awPdmAyIwS1+ojDViiuJXZa/EZP7A60awNp7BCMpyYLQmDVggYRcfxu/uvt6BxgfFrYkfrGxA7FbszOG+m7Cu5MPWCsWmwBjIcEkLM8YwlhIfUR6+CZLiaBleitNawsa40Q1GdOnNedhABkxYZj11wKlCKfQwCDcoZvMAOFL+b3Rwrj52usGywl600gz6+27/YBBqiI0hpTpbujtOgr+watWQCYyJHwaTF7amjLgLExkUMmJGVhcNaBnbZEoD5mqCXMVVv0Fr/jfAWmeiR2SRSuNv2FpcGz9jAdx/etMsW2U4DBvSbcb1JD7EwfZh6MFcC5d9sBo9M1Zknmjrejp+irHTML5SNrBiHJB/d5jbtPKCGA0GlcLku4mj4O0dcdbeGmRMIlxTVNUat+svYAOevu4YLZKuzzftJmDZaItapIn5P1W29SfYCBmUUlZ6SLiJvu9FHLDr7EvEcQhUmk8xJtGTA2um+dEF72gPGnAZlL44rfY4UQ64mEq0KQzxO+4/uYD3ELfSyjv89OD9HizKWIRFyAPLynFGCgZChbDZHqJY0biRSlXRS+jXbAqLsPg7EBVpbeN+WH9wwKQCdFzhj4w+fnvxAxCKwJdmL+cM1xQ/+vRkjhGaxvrPBIFDdiFaTogn520hU9CQQseawkSwSv/6SBP1wa1mCMN/Eq/P5sbKMPMIg/EMCKhPJZxcjxQcwiCjk+88XLANnXVjB+bIDhI/qlIZJSfVvzEIiOq2IJhf0XF7TCQktlH/r6A3Bs0AorBR/fByRTgMGC93OY64uIuk0Rssu/eQ9jFYDRawnmLIwHSd2jjXfABkUmoyFJV389aGmiM9+TubAZL7KKudR164ZGvYx1H0rAvcniucgBHcAnEkYDm8IZ5QADc5SociSEjhJs+NuZYA3vYNJSGRi7ebG0AHxKkzccMFbMlLIkVkitE8K73sKoBdHYL3EITN9IqftDkNu1Ll9HTh2waSECf8jTUuoaxXPAWMmQHZPrF2t3ToKcFswoUCNekqMKwNh4tTaGQc2BPfRI/I3sUJF69Lj4bsUDuDJYP2SxAH57spu0vL0uYox++nhjwh2rGmm4wmL97C/YOGYOMLh2zgY3cSt+r0I48RH8nlgaHT+r8feGA8aql10DBpPNpNeSBwxSekToLfkFWNt2zXP48z4A5i0MrBsb+Cq1698v3SuyLcBgg7NxF3xxny0qjWXo968TsoG4KmSP+GODxJpM1uiE5TglYPj4yNCx+PfYqNY37KUAAz+GXPJNpuoxtEOqjcXQV+1ybIBRuvzFi7AGMD596R9/28Syj81RIu3Ta37Bk07j7EgtHQpgeOuPW73s5U6146l9DjCgJonjC8QKShnHVLttgNHpih4bnVT7Ni5H3rAYU4P8hExhVmLA0WypMnXwoTFV8UFzNAOGRLwnnuWoVd7a51KniFsXvO+r9f1pLIyLKkdQnp09Urx+oVY2tc8RtCZtTbq2FiQohCIFCxDbuqQ2wOi/QpLYlC/Wqh1T3yZOKp7Y13qr943+0sAa+Rrm+gqIeH8sYOA62Z8/uFiHca5oU8Qwmi2MTrrKBHJSLglBMHsvKkVyU1kcpEB9Wrx1we8VMDrppYv0Tuovp94I1lmmq7a3tDbjauPTY1HkiOkl1oeLwAFArEqCzyw8KlCpRI00JWC8XJ1uaiwQ+PQHQteLvhRMNDwCROvUr0dIcrhULdrPCSRxnqGVyAtzh4aNZZCGpBgmx68HDPL7VMjVEDz7QN20hVsXg55NgNFJ1y02g54pwEDeBPAiYZmxc9QGIbOySi2UTrrXYrMysxSDGA4YKwamsTAujpIDU6RRI/VlIGr0yT+DPrPwKSe3RMyHuBDfMTayi7kj//4SqikBg7obe9fp+ujBCIC8ICcPGD41QxCRasN/Xb3Z3PXGPRmh91yxEl+TCrNBIlJQ9jcp+iaa93ytx0EBxmq36a4yeJkCDA4lEfG2hKk9xZ0NKfkdlYURXNqUr06MjLFE+hl3Q1wNSOBuUINAHMdvah7IaY954nOfjcr15etrpgQMl5k8O+919jtBU5IFDP4flLJ+IHljOwmtfXNIB9S11Fd95081Ek/hAFYNpSr1DhAwNtKqKcBAaVFAOzepYGVJJlQ+ku0oXZV4KoDhYz8EAW3FcUlefM+uzFUCnL/grA8uRCxCpKKTey8iEYtjR8+dq0r1h8VtK1E5Cf6ADGOtLjNu7KqmY7Wvv0Sdbl0sZAidG1OAeAUWUvJeEKuUnEDcPPPR6T7LsxN9B4myk2AYwI/iEEskDjUR/AQcPLGL2qKflqv+Ur/ItgkYmwZS64TAa+nGrZJS1mRJaMNfWERcySprqR++//BgKmMdovz8cWeFt1ROBTB8oRoyYBPh5GYt4fdTLxGJYkOACAIg7NmevsWe6o+Dhrjklij/JyuWolb9pOqUw5+WhtzgzwZPBggrC53hV+nWRZcBMM5WElWL3M4TiZOpCMhXBtYKPz7HEXdf5Um6i7SXp/XhnrC2OSpuT7/m+qY6kqCXvxawz8IgHfbjpsGadOKuACN1iKpl8hEf4MQR7Ui4a+y4ALalXQMGpym5Ki9uhaVDbonCre6WiTAYwW6qTG3MrKUSl4AmC9reW2trh5Cb/S4bVM0oqT8QyGP5sx6rdG2LfmIZYMHYcgiqNi0AltYulw75n618oNQ9Nso7WhgUnrDjc9dhpPbzC2l2SCURNbbn7UEuzDkfyPOgxSQRJM1daRZ7ZPI4++KpDzCIpaxr5MNPJZZqT+oAIx/quU6drjJmYsolwaS8hRZnY7ZpMmTIScmaMzlYEr4gjFQtWSpPuwYMznvYMy25Q3GRz9pKT56PLoUdI9WePiaU0tRndNK9TeDCB+i9hbFRAVlYifDAQrSAwyt9t9IN0U9uSUOnLOFSre/j7YlCUoEKmNsrFzAa+Pc6RhMB4/zuhfOuSP9YhOuVSSEc6k092to41BIa564H+ytXfEx6itr2VP0GAIeQ2KVS1AcYqZhH6Rfo6wAjL6kKl2QtSSwwv8CJMeFqwEeOiHdgLt/QBKm5+IbYVOrmrUrAyM5w5ftrdglG2pJtFjO6kMuctQAG5fC4c6vbsFaEP45e5X7wmUXMgrKXKfEelc72jIxPifIMvJGq7iPWFueF7MVS8XkygPakr21niH5iXVGZae8DoU1OxWK1eusy9kcQmfHZYwt8lz3e7qO3KBhCT1xW25wpoWNcnae6N2EQ5bdElSmn63ywCqTj5CAnLgEOAkfcnEUUOBaVYK2wIG3aqw8waAMTzhK5cmI2Mb2LoK11swPAWLPDHROkCv0xc4qASHPDJ8pBWg8FYbIBTptajI31ZZtaF3xocz2ble+vn/fHDmjvWnV6thZn92owJ/YnKjYAo6cOI44VE5wrA3wGkM0PC5YjDug3WTXiHgQK/Q1aKVPeuwj0R2AQd5sx2avycOWxEDhcaBchc2etDPTVnLna0MUL+tlJrwgp8Jx+0gDgS/rWj591RT0PYyN1zveUr3M9A4HXdXFW4ILYD/LZwABewjXw9yz0+VYFQE1+jcvDQrdXuoF21H0QO7BE+ThWhh9wqV92CDIMthy4DzBoj7LXvjJoAM1e97ZLwIA/FA9F98hfkkX8nl0bkx8rLEeVC36y9/1dH75hYlH2ZqoWCyO2RR9YWd4FqJEbQT/0BlDxRIofflIEcBNgRtdTZ3GeHYCQuFwkNkJcgdzO36qfsV2sI8Zvixhrxh6fwaonfuPX5tmi5Mj6+vhqeKPW72thInU/5flpz03zAzOOHHVNqSsoz6lPzD4sghbAKJXBExfhfo9IuwYM+kUGHKTiGLmNA5VkT6yDHa6U5ZoMMMIUlgq/MM3Z5XN3ZlD7g6sZ41tDAAPZoMNsfC3nKygjAGxylyZTo8Ez9k6L0jyQNHik1D1KWrBhcidKfzXyeYut+ml5AfQYv71Qp8Qr31P2gAyS6XjmGJPb/pYG5g6+0Ar1BnkgSb58EIeHCOQRVElVMZJeBczY5W0wNjaOecfuC9jFW5FaAYO2ACdM4NQNy6b45UwQK8A4l0lTpWdwmay1kA56pqeV25+IafBzlfaItH8akz7+xkSpBoOhlCs9+3VgCOCwiNlAcqliW6g2FDCQCwsUGXNRkb9uL8oNK4xyee5CDXGO3gHzJTs4Fm3fj3XhomBNUB+BpRDJWymlW8Eq9TOpNGQPiWnxh9WWs9pZS8SWqI5N3QC3brzV7K9BqPQzw4GHHRZfCgC5eTjCzkEjjjOX7tGs5Le7ibTA9+eMAOCEqcjC4yyAz51Xtrm1xzCzuUOUBYAfTmYHUxiXD37Pb1jKynz4ZEw8KvL9ACgAgtICcJRW49uX7y5tGwb+OouG2Bz+Oi4ECxk9qq3U9MNnDoil0SZ6gxvDjeRYUC+qYq/qobM5HqufuLfIGl7RGzZpLCn0hbs80fki7Q4wiqzMD8wSmCWwLwnU4VZ7YHFf45n7PQgJ1KrVOGZ308s4Hi/r27OFcVlnfh73LIEBEjgtwDjGrekYee5VtAMe0AGzNmDtbu2VPjGdFmBsTYRzw7MEZgkggRkwtqAHk2xkO25kku62IMu5ycOSwGkDxt5Xwb4ZaOi/4dHDUuGZm8ES6KRuUf7tD9v+dIDRrHDNLwyWy/ziLIFZAtNIYDrAmIafuZUTlEDXSYuGW2eLIpj3mqKImh5okOcMGE2SnR/enwQatHp/TJ58zxnAOOLJOVTWD5Wvo1XxExLoBEOZoIkqTbi8FsauJFw1DQf4ULN8ml/YHPTI1w9QggfA0vRCvbyAcQDTeZlZmF6VdyfNY+Z9rJQ2AOMyC2KsINvfn6XdLrP5jbUERqnP8JdPzMIYLohZFWcJXJTArE9eJhMCRl64l0nshzzWQ+btoOHqxAQ3ZjgTAsaIKR8zghHdll89WMbKrB/NE3uS8YBuB7xyNLNQy+ieAeOYpuCYeM1N/57GsINuq7uofrB2CU313A4ZG9HVngFjKmHP7cwSmCWwCwnMgLELKe+1j9R2MmKL2epYpudr+hZrBLCfXms4G/vM1gHjdEU3VvTz+5dLAqexErYOGJdLKc5HO0Y9xrx7CvK+7OOfbA63IMidAMYW+J5MpnNDswQOLEQ80YRsZ9X9P36fzZClWpGnAAAAAElFTkSuQmCC"/></switch></g></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-21"><g><rect x="105" y="172" width="70" height="30" rx="4.5" ry="4.5" fill="none" stroke="none" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 1px; height: 1px; padding-top: 187px; margin-left: 140px;"><div data-drawio-colors="color: rgb(0, 0, 0); " style="box-sizing: border-box; font-size: 0px; text-align: center;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; pointer-events: all; white-space: nowrap;">Request</div></div></div></foreignObject><image x="117.5" y="180.5" width="45" height="17" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAALQAAABECAYAAAAoXx8rAAAAAXNSR0IArs4c6QAAEARJREFUeF7tnXewJUUVxr9RMAvCGjFizgFQUdEVxVhmRTAABswBDJSKiVVMZbbMCdRFpUyY0bIUQQEjBswJpYwsCkYMeJ3fvT3v9e3XM9090zN33vOef1j2dvz669PnnD49W2gpSwQ2EALFBppLxFSY7iSinFOksVrLNmNGkbnp1eYyNxwzl4HKxBN6wRgsuPuBlqNFN3XArBfAMo8zntAtsJ6v0sPIJ1LmVjvPctnA0AjMM2BAQvcz0SWh+8F1vbY6HkInMDOhaOS65G8xsuN1WWzMaI2H0CNd2kEWb5BORgpw5mFtbEIvidLJxxgEvtROAuUzETp1VJm35bK5JQIGAZfQe0o6xUUnga7nS/qnpL9I+r2kX0j6lqTPmnZbBIGXa7VEIB6BKELHN9dUsjhdmjxF0ufytDeyVhJ2/chGXjuckU5pN0mbJb3aN/ABCT3tHg39dEmvWi+LuqhxppIptXzdvHK104hbq06KHaTJCyU9QdL7JT10rg/T5lpCFzrFuR0+S9LfIxd2u5KsO0i6ZKD8vpI+GNnmstjYEWhF0KRJ3VHSuyXtYmods4bQCTZ0G/LtLOkWkg4opP0n0gXmh1+cLU2uLunPSdNaFu6AQP+s6zC4UNXXSDrEKjQ4oe0B3lbSx0ubZ0dn1IdLekloJsvf6xFY1xRNW9ichC72lSZdzYO7lRr7U84cvi/pBmnzWpbeSAgkbMichFaiyVE7zJMl3cpZkE2S/riRFmk5l14QaCD0PN9iohzNhPbwt4bSLy5j1M9yprubVJzWKke5F9zG32iCVhv/ZOJH2J+G7gAoZIbUttzad5ETmCcO5s0lXUPS5co2L2QucX4liVPgvHicGkteWhIXTfRzMUm/lfRzSV+WxAXSepUh8NvJrBGOP3/msu1sSb+TdKoKnZv4zqI/QndYxbdLeqRT/zqSfhzZ5q6SniPp3pIwVXxCeJFbSeKV34xs1y1GdOa5JfB3lUQY0hWI/Rbj0P5L0j2M01uV21L+4YiVSvMaYJsz9ntK+kTCONmsF7bK7y3phMj6Q+D3AEmPL8d0e81S1X2CMvi6JCIVcOIfNeWINe8XObdfSroaZbubHKbHgOa+qKQzJF3WGuDfJBHegxRNgkZ5gaTDjDaOmSMXOO80QXi0Q4yg6V9RapInxRSW9A1J95d0o0ZCzze2CEIb/IrDpAlzjJFU/Lh3IHBw55jGrTKkRjzQENyt2o7QDhF9uRyJTqF3Si8qiUuYzpaPGW3bhMFFzE6+XwxQnk11kunjT7X1Z5VY6I9IurtbzrRJbgqa0SUEkRrmhrapZF5D2w0W2qbJ3OnSt4ZOws+DUT1+q2Bzip3ocfhjlowy3EXcUtIPnQrtCO00kpvQEOCZ5UnAIrtyO0kA1iRbJT3EKfDX8sborUYr/tTYZ9wg7VPaaI+VdE2nPCYI5kNTYtTrPJoZm49xH1seo38wp9mNjdY/2DrdSMLClg8TWhpaQ8fjV2gfTVrh9+zSNDvSg/nRpTI5TbM5/9dgdBtzQXJDpzxmF5vbFiJiV53+RaEDNRGh30q+JOkN1v9z2nPXkc/kKM0CjjY0wmUMqXD4sJlng5qX95QO1oEBMj9C0juqMkYhsAGwq7BjfYIWfbmHnDikL62pA3A4k7Z8t3T+7mScTV81NsiHJWFKubKlRPWImu0zJKHn8DODzI3fBcs1PrP0Ka5ggVB/Qs0KodG3SsV+qzpmurqYbqfXrFGjUzit7cvlKKQ9J2tzOWZ92Od5h1CHOZ4gRJ0zQG9sDAx92+Y+VRJOUEwUw9W4HGtXrrlqR4ND3krQzFz4oHmbBI2C2bSW0FOn0AvSUIQeCj9I+B0LABTNlYxGbsKOqNFPrNwMyj6tIWkta5QjsK7RP3PsYCpwJx9yBB9lylaN/1vS9cuEFEyMGEFTUxZwKyHL75VOZTxjQnG2c/wYp++m/jhpZllfq/xt0lBDEToOv3rFFIvfXcrQ5vEWQN+WdNOYBTIOOBERggU/MyfeUfNQrrQ0KkLjUB1nTAGO8hjBySAHpJL3emzpUDsQ63lWoa+YuLJd71AnrxZbDHuY/8aIq6GoEyB0scky5/tyCofCb3cnQoHSIuxJBCgkbBoUW8yjjwEJ7d/lXGdjy35tehFR6LyoYc8gwJE815gdFSj7G+csBJL9OxuCha0ELU+ClG3qYAff1yrjc05CfbJJbSdn0Ro6G36FdKLFNh9+lzCmGSZEJZhsnIbvMw57CL+Y3x1CF8dIk/l8aNNKTBz6wSak5XYMcJcyN0KYEbZGpSzHz6PLUNhX5yqG7W+fk0Z0IVa7V91x+cIRbwte9smWecClzrVWChQ6UpPppUqK4LjigFWyaEL3j988Om8unXTMNFc4mXmdhEmCn4Jp0Vba5XJMnUL7TeGMfLFxaMj7xvKWDs+3Eo6Uh0vCZIgVAu3Huk5VeB9ENc9FCFq5Ei5d7NgyxJzacQnCszL7Bc6iCW3wS5hBfFEHv+mqkCKAw06KQJOgPD5jsi6/kKi9s5ocFqEDtJrFC9/lzOo/JsZ4fGPt1R/Z7ez6PoT4cRUKJBLgRlq4uv1QWsfFQdKEmGvlGXoIvTK5sFPYDHHM1fdQ+NkwQWYul7ggiRHuEogQwRW0d0jaEXqNhp51E6uhq0GhrdBatuBkYZIQaA/JMxpixqG6nt/nGPJUywm8eGnrAawt5GV8MrETbHBb62fQ0LWsjiF0Zvzm0LDxc2HiHoLTmMgFD1mNBM9WLkke1xCDpp1EQq9GpnPcFG5vMuh2d8wGrjaZaFP8mcE/uczQeq2FFpshSmMHoZM+6txOYhIx3krSnM9Zh+4Rn4HQtfvSHa8vOak1fhEb2cWvrgq3tfcxqQT4LaEcElITSGiyY9p224mEXq2ag9C0RsyYbDc7M4y/f31E8g/eK/HdSvCuMQ8ICeUWLk/syxuuzsmkC8jc1nFjvimEvpeT2NTUL526GPgIPSR+IaD4nQjIXiY1geSlm9RU4j7gejV3FEMT2qsbSUYicccWokB3CKQ8MmmcB1vIqyUzK1oitDVtEZsmbloJN4z2Y8yY/ngXSb5KJU2E5gU9TlQlJF2RFNUgKzOhHvVt8RHawm+lbjJ+MROPLeOsxVXKiMfDTGjP/TpAnQ/TjtCZbOhqntzZo6W5fLDlB2aXonnXSCHtPJmF2+yQou3MxeKITUdYsemJFx8rOdQyjfDW3Wdiof7YfHbaZBOhSXC3E5kOmOU1RAkOF+MLEZqU3KHws8dCDg8pBrHpuigScmjsqBjrgZ3uSjtCm5s091NgqU6hPRhMGAbtxrubkoWo/z1jtlRtfb60ffk2Q4pUzhrxUGKgZ0jFIdLE1vSuQ8cJgv3H8ReWQps00a8d06qJ0PQ9TUQ30uRkuf274UF+r0vw7wm/6ell40fGGyYEpgIbKcWEYvwkS2GOzKTQVk3EJrf+anqVOBpCM7C3SULD2sLLEuxsEpB84l5bUyYm3XQVmpk2s80JjmvSTAkjVoKNz9Mt247GAcXrjhFf6mQTobk53cNqmKR4FMYacY5pnCouqq7rFKwj9FD4nVRIe1m3iYRED074dxV4bcNnvSrhHoMvI7lCDo6tuWtTIWJuCtdq6EgD1YyKG7sfeZ5Nkb/KjvYJBIPsOIOVQLw9pOKsiOt/NAm72hbSR61HuiuTeH5ZaPXJ1KxxEv3tpBvfGLnuhqD2GCnXRGjirnbaLJuLE6FuY1f9+h5I8FsdoRvwW2OH++YWgd+0Gr6D/W0VzI2blSm+mJUhuaJJSrIDB3UXW66fUpuiUEtoi7NdTI5qUmhoNLUrvA9cm4I569z3SpwMOsyEurxZ2qevNznvAc8pPyWFY+R7ucKny/hC6q7WlTihxQeVi0OYyick5RCvtu3hqlwTocnl5iWGLbx6wVH2pasSKyeuzy2sT5reFA6BH3Yz+dA2KTFJSMZHidUJOTV8p4Wc+UoIz5IdyVq54sbWOW1JWSDnZ07aaeiGkdb8RD/Y0tjUtqCZMD18387DqeRIIo5pC48suZX6gMnvYFKcAjhNLLx9hFX1QtEE6hLgdx/FEoHgGCU+iva5dvmol9wWQnW+B7T010RoXx4wdbjgYcMTdYHYLCwv2w+Sih3NiUTIDjNqhQSFtPek/pHsdlJxgjRJwq+QNnvS35rw43TjlLOFC6CjVei4Mk7PhsVZ5CTjoS6bF7Oi+k5dVQ9t/7Ia/rihSIqxcTjlWReSpLjQyfpiJURz8mR57Wt7tdRhEnbYy26HoxMNHnul6o4h5WunaH4yxNzYedO8fmOe59uRnNCLDS5i0NKuMgnhRwI8jhd2eyWhV981+EXbjDH4cTH16SanPaI30g3Ape6uAW0c+jrATlJxzlAauloA39s9wneQnZ3sE3Y2FzJcqzoffWzkAMcSmgBNHivcVvGVS163hIRICCYTL8VJdK8kRGjKYSsSIXDtb58/BT7kbeMw8XYvhdD0NQR+PEXjJMNMSxEIDH6HF9L5gcRoN6vR7Wf6jZehCY29im11eWc0XzRXn01g8CwKpw6HjY+X1Ak2HZ8wYPO0+cwYdisnBqRzj0X6xA4HXI5a7D6cx1RC0w7hO74fwslAn65gWnE68S2SarO3IXTVbhR+hXTmpD1+PFR+olmj7Rv+gRdCqSgaohd1iszFg5OA8pgW7ilfKYmjUo+9lN2XsezcocVkcMqIDnB7xm1T9U9gcJHDW7UcwmmAqYPdzAbEDkQrY9fblwdtCV2NEQ1K4hYEx8nC/uRJEjY9yfIRYvCJONsNGfrGD41NDjvxaZQPG5Y8FPwDIiCskx0+jZjjSpFdpGKzNOHGET8GH4p1Ie9+Wzyh48BKGVjrsiMaCnOYI3QhbSmPTjsM2Hqeo644skWYYVUkOyajxnhBg+uqoRc0bF+39SwdJX89U4jX0COCvfNQ8q7OBiJ0Z2QX3sBaQq9Z7Lyrv/AZ5x9AM6Ft+JZQ5kffaXH8Gnr8JFhq6N5pGt/BOAk9fhLbCP8fEHr9LMgwhO4ND0/DvfVVqyV6iXIMP414LTjmkvGE3iAI9zCNQTX06vh7mMmgTO02/rraG4PQ3bDpuoxRhB5uiMP11BW4XPXtTR5P6Fy9991Oj+vZY9N9ozLy9vMh24HQ+QaxULR7m8Z8wxvHVFjoagU770DourZ7Y0hwMuuvgMFqCVm2peuB0NnGVtPQAlZ/2uUC+u0bynXbfv1a1BI6vHzhEk14dau9bldiOXAvAvnYsA41dN+cyAdu3yPto/3Fz76bGZaX0ItHY36N+x5P3+33wdhRtpkPyLyENmDVDS/fsBe4KhtiEjn/DajFrEUTx3q2ahYz4WWv/SEw5j3di4buD8o2LfcNf77287Xkx6nv9tusTnKdwCR6IHQ+2MIteUqEKyVjuLErLAqwfvrtTuiW42pZbWNzazm7zgh0J/R0CEt6dl6JZQNJCCQ7hUmtLwsHEMi84aObiy7YegXz9JCnFSbxPx3+KoThbsRhAAAAAElFTkSuQmCC"/></switch></g></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-22"><g><rect x="105" y="312" width="190" height="30" rx="4.5" ry="4.5" fill="none" stroke="none" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 1px; height: 1px; padding-top: 327px; margin-left: 200px;"><div data-drawio-colors="color: rgb(0, 0, 0); " style="box-sizing: border-box; font-size: 0px; text-align: center;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; pointer-events: all; white-space: nowrap;">Forward authenticated requests</div></div></div></foreignObject><image x="115.5" y="320.5" width="169" height="17" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAqQAAABECAYAAABXnScCAAAAAXNSR0IArs4c6QAAIABJREFUeF7t3QecLc9SF/Be9ZlQEROoCJhRUcEAJlTE/MQEZgUVA2JOGFDxCZgQc0QMqJhQMTwzZsyKmDM+c0Iw6zOt+907fW9t3Z6ZnnPmnN1ztuvzuZ//e3tmerqru6t+Fbr6pgzaiQM3pZTbndoazQwODA4MDgwODA4MDgwOPB8OQFFXTgMoXvkEj+ENDgwODA4MDgwODA48Egf2QlnPAJA+0gyNzw4ODA48Uw7sJZ6fKfvGsB9wYKymsSCeCwcGIH0uMz3GOTgww4Gh8MbSGBwYHBgcGBx4bA48c0B6JlV8ps889mJ6ft8/58Se81vPbybHiAcHBgeO4MAQT0cwb7xaOfDMAelYCIMDgwODA4MDgwNPnwMD8z39ORo9PI4DA5Aex7/x9uDAdg48umZ59A5s59l4Y3Dg2XHgWvfptY7r2S3Q3Qc8AOnuLN3S4NiYW7j1VJ8ds/hUZ+Yy+jXWz2XM0+jl4MDgwGk5MADpafl7Ya0P1XhhEza6+4Q4MHbPhsk4J7PO+a0NLBiPDg4MDjzkQAakX7iU8tl7MinJgi9bSnnLnu2Ptq6eA3+olPKtwih/ainlo65+1I8zwL9VSvlq4dM/sJTy8atdGQp/lUULD3zHUsonh9//bSnlHY5pcLz7JDjwP0spnyf05L1LKZ96SM/G9jqEa+OdS+TAyQFpYsoApJe4Sh63zwOQHs9/AOfHTf+WWjsMkB7fv2tt4buVUv5bKeXN1w9Ij4JNgNtPKKX8+lLKP7uSxbAbIL0SfoxhHMOBo7bXpg/36opNjfY+PABpL6fGc4/FgQFID+L8vQT7HKWUDyml/Mw7MPpf77yd77jS1ACkB/H6tZe+fCnll5dSvmUpZc3L/Hw8pG2l+r4Tr75SKeUrllL+0T5T8OitDED66FMwOoADnVh2q644CXNPBkhnmDA8pL3L4yTTfZGNDkB62LS98134/ZNKKV93ev1fDkB6GCMfvLUu3X/0ZAB83um9AUjbbH9DKeXXlVK+V/h5ANIdluho4jo4sC5qdhvnIbpit4/HhnoA6S+YLNg9OiB/9P/s0dBo49lw4AkA0jOKhv2mNXveBiDdj7dLLX36XU7o1wwPrAHSb1dK+a3heTmkPKxddJEr88XIWucVBiDtmvXx0ODArhx4qSsmedKjK3btQG3sJjnsWkJiHCI5CetHo50ceAKAtLOnT+uxAUgfZz62AtLH6eXjf3UA0sefg9GDS+TA/lboIbriJJzr8ZA+K0C6/1yfZN6mRrf2duvzp+z7q7ZXenUwIH2aoz0PT0sphwiZkUN6/PRcESC9KeXmtpTb45nSaGEA0pOwdTQ6OLCZA4fois0f6XnhKgDpMwcePfN8yc8EQHo/0w8MpKud++MHdoiQGYD0+J1yRYD0eGYstPAsAenx2/qkczIaf54cWNUV51q3LwHp9MGLCtnPM+lc7Hueq3d+1Cfh+8Ee0mc+O6tCpsGfAUgPXTSvlv4ApH083A5ITyJe+jp7wFPjlP0BTBuvPAoHVnXFubbeU/eQOv3llPDbl1LetpTyH0sp/66U8mmllM/Yeeq+TClFCRJ1uP713f/+Myf4xs5dbjb3hQLPvujEt/9dSvms6VKCv1ZK+cydOvI2pZRvW0r5cqWU/1xK+SullL/c2faXKKV8/bvag+9SSvn8E8//4V0R/D9fSvl/oY3HBKRfupTyHqUUfPRPPykaa1B5GuDjv3eO9ySPLQiKVSFzACD1ua9dSvkqpZQvOb3vEM5fn/7tEdxVfsSed7DHvv/cpRTfUJ/yz03835uX5tlaJG/UxPz30/fIgK3z+1iAVAWTr1VKIcfsS/sR3+zHf7IDw75qKeUrh73wuaYaq2Tl3y2l/O1Syv/d8J3tgHS5cfLk601r5ouF8ZuPzlJSa2r3/ncHr6zPLzVV1PnnpZS/UUr5O6l7jwlIj9Vl5vmrT7ykT+iLfzPJ5r10B2a++yRfv/i0r+1xOgRPL5lOzT8yil5yickXKaWQmf9hkluw0Vb+HaIr8vzoA72gX+bz802XLFkvf7+U8jdtnrVJfYqA1Ab4wdO/pdOmwMtvuDut+QunGotrY/W7U/6UDjKBBBcefHQp5cdOyi+286fuflOe5BuEP/7GO6D6gR0f+5zTRiZ4K/22Usp373jXN00kXlT6CqWUfzzzrnH8oFLKd5gAg2/PkUUB9P3S6XTv2iJRrPqDQmMEFU/ad71beL9s4mH8lnl5Uyk3nziz/r7xXaWFnzKBf4s40z+922S/uJTyiyYFd25AalP9kOl2KLURl4jS+YOllJ83gaW1qTWngG2l91spmp7by0rufUopfzI8pObor1jrRPg9l2Gb85AChfaH9t9ppv1/Mc2ZuftfG/pQH9UX68IajjyKTQGHf6SU8pGTUdrzmQ8o5eaTwlr8SaWUnz29+M3uhORHlFKsyRb9j7v99Pvu1qE0kX+w8DHKGnjuoU+4k0PfNzx4TB1SwNMp/h+QbtjK/fh70179VaUUxmkvffM7YP79p70K8C0ReapawMeUUuzhFr3rBF57v//9pmL5c8+TH2Sx/QokZn1W36MQf+0kV+yhreQ7ZKCSXuRfiwD/nxH286kB6SG67MPuHAh/aab/X3Da4997ocoDR8FfvNNLP7+U8ju2MnF6nlH/I6c5A5wz+canTLKgOjeAVIZwpbl51qf3D8997P1lIGt2xqsXsq55091PP71znOfg39e5M7R+zHQ+AOCbI7LK7W90KIOxRcfqitomw8ylK99zRQZy4tCV+sQp1qSnBkgJ51/dADlLa8JAP/ROUPzOjoXzlptS3nlCYBWQKhpOSc3Rb7qzsG3SSrwOvENrQI61DvhF0tcexUVR/rHwIu/Du8100Nh/VgKvHay4f+TP3nm2vtNkWc290wKkCqz//skya733m1N9Qc+oywgEf3CnfOAN0zdGxzmuDtU/gpYx1ALKazwFBH/4ipfo8QHpQ+b3ANK/MCkfVn8PsYTfuMFKx2uK/Mc3DMK579l7AMYPvdu7b13p1AdM9VjrY/Y60GSuf0TPgCYQR4nOgf2dAenNO6yLl3sef9zkqescxr0nmyG5BK61BSgAzgyerQSImRfzk2lPQPo17oAT54D/9hIPHGAZjbi1d/Hit0/e17Vn/W5OyGQ3dO1ydejMR1uAdE2XcVrQr5msiV9yV95xzeiI79EdnCsM0V6iExkt1Sm09B7DCYDmcDoOkPb2rpRDAemp+Udqm1u3mc2B8dYoXYZCJ9HhmfYApMA/OcEw7iWy21rj4HitBOgBgLQTTvR279VzrJGftv21+zcMknfFpC1R3sTfeRJOc5NM2QkrCMfEZ/yNcF8iXhWKNhNgCWAuEcuOJVSJB9f4MuXnDmGfsOQ3WQDYGZB+00lALwkvYXzWUCVgD4AFtLfQX51COd8wvHSKqg+s9j98Z5l/o57OLeyAj5q8aXPNPD4gfdizNUDKA+76Sx74LSSEy5pfC3dbF594F/K0Dw8ha5dH9bMXXm4BUp5v3rctRMZ8j7uwlChHpp0B6epd9pQMT8MW5VT7rK/2MK9hi4Sk8bXHcJ7jH165pYqnK9JegJTnlgMiRpB655L33twzmtfI/sALKR1biCeaF/ycgLRHl0lHk/YWCcjh0DhkLalXyTBa04W+Z85EG+qFEbEPUj2AJ2l5mUQAgKfDPaT9M3cIID0H/xjQvJCHEocaORvpWED67Scv7CHOG/1gGDGQHtABgPRQniy+x6LmPcv0JyYPmTABj6ZQntCMzd6y3nm3WKhzFAEpJca6yyEYIYPK5N81hQCEDijYShbhz13hxJ++83K+d+MZXhkWwhJRFjFcbMysxEjfZQKG8W9CjL+mlPIHJi/If5qEIuXynqXcfFApt6zUTEAHL0CLMiA1rhziJFBqmgAvMAEerR9zQrDkvrpeEY/luAGFCop/8JSXOsefUwBSwItXIxJh+yvvQLTxWjc8HixB1r3xC5PKf41E2UkzmfManBqQ+na9mcl6ZYVWkkNsn0WiIIyrUg7Z5zkAMITFpI7wYEgjsXa+RWOyeuZJ9CHe1KMZisl60Te5f4xCYSEKjRD1zUhC+N96waDKgJRxKR+ykvDyb5lyLSlr0Q+ATQjKmsxrAmCzzyIBxTWEJh0geoCMhRyrZK2TZ5W2hux963c3+P2p081HIgv2ILAm1UiYOcourwIQ79lIrZAXSs7Ewv6e9zceT+FegNacaF96i+gFr2MGh4ySyGftCGsCMAhvyapIP2rKe61/w6ec/0pe60cGNjz5lFwcv+/z4lljUXGSV4xje3uOgEnjzpEp+XnSUqw70TI5fAx68mMunO8bdIE52osO1WXx+2Ry1pf0nz3Okym0KheZQUpvSN8w1kj/anLayLueI3JSLm8GnNaxSIU5MyfWkP0gTM4YQOTMf5n4XNvfFrLv5/hLQDo5HdZC9ifk30u3ByeJdRrHbG/RWSKwdI39+HZT/ia9xCEUqV62EWX9MbpCGqIoi1zRSvAUXPNHpz1LjtOXImtkMF5JRYz0Gq7pAaQscYr5UCLkCbE5Ivwk4kaBQeCzYlveiNoORejquZhLYWIcTpjLUYibOPZH3uNPnJipDUy0+Qgdnr7s7RROpyDn6AtMh4jyBHjeJhSKniMLJSbhA0bCRjFFgOKwIOqm1ZaFScgayxL9sAYg/j2TIGi9lwFpfQbYtWFZXoDWO92U8v63pejbzwkNEWA5RKbvNs1cTqy5FaqXu5ipB+hsWasAhg0e827NL8FoU80RhUiYf5/0AAAgzNSiUwPS+M1DEtXnAClQwADisW4RAxFgifLEXovrM79nf2VAwhtl7ufynoAE3gIewkgxLzR/JwPS+juDSURG/m8rr9JBPV59Xr1IwnOuZJ2jrYeatgBSCt2eiTm2+i6HMvOy9s+6th7t+0h4mJ0AjMGPT88B2D95JUVJCg8DQuQo0nvclPLpM7lNhxxqAmKtwTgn5DVDa278+gOQk3EMm0qAFADJUGuR3OKcP6gN+x1AykTu8TTOebJOCUhjX9Z0WX3WgRiOlqg/6RD7HLifI8YH4B91GyD3bRbeyZ5HS8L6A6paBMgAxG4xa9HJAen00SVAei7+kTVkWCWYhHdyKVWppeNb+722uVVXZAeidcP4XTpMBZfpO2xUSZQjju01N31LSCyss66fCAqofY5scgyuxFIS7vnjHa0DYAYZwQTvYLXCcxMtQGoDCwkvWXhAM0VTyWJgGc+FJG0kAjqOqfaRJcHijCfJYz95CVzXWokXMXu2jO/NaXB4ET0x9z/PhJdtdoq/Us2nbbG8BUjliflezpFtvW8eX3mzb8pnldv7vC9Ae4nkp7QS5/cGpDkcQkHxTuPJGhHKqj1QyJVe22Tht0sEpDyIwmVr/LBOAaNIPIXy9jIB89qNaR+UoHXSc+iEhyqCUl4cRpv/ZpoDpHP5dPF9HjbeRGCjkv2wFO4/AJDefHKwN3kzhFZb1Epr4snl4V0iYoCRFaNKgG32NudIkEOd3lnLl/dtvGLQRLCwpAQPAaTSmKQpVdIv8yvKskYMfR7PeMh0DnDw1Fmf8VneTTJv7VAYL1EG//o2D0gPy4I7VJdVPv3eO3DvUGUl+5sXtKciQUs25wOWtV1ARb5ppLkUtPgMZwRHBiCT6SkA0oP4N031Fv6ZF1ijkqiEQ4pr5FAToFkJHok4K76/FZDScTHNitzvcVrKw4/OGs5KWOhldY4eD+nawNd+XwKkwiEOQUTiXeOt7CVWaX5+LseztYktjh6Blt/NeZKxv7zK9cAE8GoxREuAgucVbhGXd/S+Auf+FimHwG34rvzHqRFenux9Bq5eSzKeEqLjKXtNELo9B0J4mbIXtAcI1LHqo75G2huQ8tbyklb4/kpY9imKDMQorlaqhg9cIiBlXPEUrlErP1A4l8GYKYe6KHmApkcZaoun1LPREOCZimClfjMB0vtJFSKMeclLY8sGMyMsVt3I7x4ASO9PxFaaA6QiSEBSHHNNKVqbG7+/V8PzxctTyxXxHmYjUSpGzgNd+pa2KMxKSznVWwEpg54siekQImQ87b2UPTucEKpGZCMoe+85D/BqEQhM4oIX1xmBnM5zDg9pry5jcBtL1P9kvKhUL2XPHQdJBLi1HXMUq0rQo2TF2mFE3XvXUm6V1MqRxscGpNv419YjPfwj5/LaFJrPecCtOSO3RWM5BOwbUWOHxFq0FZCSgTH1T8S3lUaUvyXCU8tT6ZN/5PZLZ+BjA1IMiuFdOXjyD7fUOmM9EKQxp0hZmNYBqQwqeVRM8Jy3MjI0W76QvvBsi6JgZuUBVvGErhPFQoWZ5FgZew1VC4vL08hWuXqDvLasfv8oTV7PXpI/FvPYvGextDxMLQ+pENhc+Db2wWLjgawk1CWfNefgzfW71c+9ASnQhIfAs/8KTwrhL1PdObf3mzyuYRvf/LTo0gAp7+9S6bU8xmzNU0Sf0HDT5/zqVlWGtRnI3kLruZUf3fKQAhwUZQ85TEieVKLII+jKbZwKkLaqdkiHWcqDzH2zrskWY/BP6LWCLF5BXq4qU3hphW+bsnHGVhOdiqFbkZ54ODP2ZysgzZVHtAUYrKUoxW8Ci/ZgDFPrr5ByJODqjSG+BJS38qTb6+emfFi5fSATPHdqQLpFlzlsS45WEnIFzHs84fUdayVGMXm5zGlMc2JE4TcdW0kahL3bS4yunOJ2ICBd9TD0Hmo6F//wyLzCBZWWUsIiTxlw+L/m0ffOVkDKwRbTKYBRHtOe9QOnzUbBjgCkq5NbmbPkIc0LYCmXcWkB5/pjhHROvqYX33L70MLmeeSB7CECKXp7gE5WcyYejJhLYeMbF0uv0lxagUmN5auE4oTk9ia5U7E/2peX1sqnyoBUmgLw2vKm5n5m75J5ouS2EFAUcxH3BqRb+tJ6VlhSCLkSj/9cKZpLA6S5ZuYar4w9HgLhkeJBjgQQMbSiAengyVK+eOu7FHwEYwSvdZmNnRYg7Q17+a7wfCxhxEuZvV+xf6cCpNnw4VVg3PUogdq/bqG9NtEzv+dQ3lIkZSsgzTmda4bB3BCkLsRqHzl8jEfkYAzXC8HP5Tu2vsOL+5ZkiJ0akG7RZVK7HNyrJNya023ml8CLVdTax9mjTg7mE/i9zoz6/VZ4+0BAurqqewHpcfx70Y0m/25K+ZS0obPxzkBUTYixN5f/vDrQ9MBWQJoBueYYDnL510rKLfbtfmKDlDr31aHZo8I7JQS/lbInDgJvFY7NHlIJ+0s1SGM/WsXq5a3lE9VZgQnv8d5YPPWUYT01mEEdxRfz05ZOv2/lkQ0glUGoEvDNIX6e2JZnOgNSuX6tvJ5WfzK/eZsogC2UQxtPAZDyJvHeMnqAqZiLt1Qz9nEB6U15xxX4kg81iTJE7+DavFkbQsOV5ENLX4lk7QiZR6K4curO2rcYUHm9Wtu57QxICXR7uScqog85vcV+bxX0rv09FSBVczPWQ1amTHWBw2g/aCrUz3srzcheiN4wIK6VT6nPWwGp8UbnwZZ0hcijHOnKQI6xkU/2k5U5D3KN7wyGWC7t1IC0V5fxnPG6xQoSPZVfWuNNBujNh5dyG0svcqbEckP0nUMtzXD9zJK013Ie+mMC0qP5F8aZDfgPb5SutKdaOeJ4SdY5dM1RJjK3xTiN87kVkHK62SMxt762R4fok/0qfa0jNeNVV3o8pKcCACaWVyP2AWN41baSfM6c58bNnU9JTwDpZbxVWRxlJ3op5zQ6lZoLQAs/qleIIvCcwkAvPwWoxkNBOuXkZz3QIH2BQGud6JzrrzZY53IihaDrP/l5wlutBVTb6gWkS8nRsV++xTCIB84OAdhCPLwjlU61HjNPAXhAs4bz8dL/5xUX3poTik8XkD7MP2ytoQxIt3qGMiBthZda+cu9+2/tuVYOXQakvLPR+7XWZn5felDM48zvnwqQEu4x79UJ+VxtYG0sh/4ORKg8EvcCGcMbvlSjdk9AmvNTDx1Lfi9HNHIo2vM80UppbSGpWjFKd2pA2qvLHCSUp3wkNeFj9ohzMEUHBGDZUxQ/903OZCwZtRsgTaPo8ZDuxL8m+1sRBWF3kcWlyjwasz4ZV8Cgf1u8p1sBqe+R7WvYSTTVwUh8ffNNKZ+xhpj3B6R1htctcAAob/KtOVF1Vlsn+Vi6+Qq77LFbu5ourxr17NROrKR2ZzytbtRKXNXTwzHRO09gtobU5IrXuq2V0qh94AmmNFlShF7MN9kidHoBaW8YV25vPpndytda62M+mXdKQMoY4IXCT3fytspOrfV3AyC9eb9SbnO1hKX2164Oje8eImTmrg5dG3P9vQeQqhXccyJz/pvzskU1j1z+JwNKRl9/ofOb8gHl9kGZp8cCpHlueKLIkFMRsOmgi4MqjNk5ELD0/T0BqVJgc9UHjuFB9nhPaVMPFhkZ21P9IfYjn3I+NSDt1WUMi55T2ofwlG6MZfB4bdXsrmQNL9Vqnfsmb1xMk9kNkKYPPgSkN+VNdz7HXPrrnPyr3ePNJjNzicE5fsnnlVZgPjjR1tbuIbrCt0WmRdBalx20+iZ9g7dX1LVpFO0PSPuXca636c2t+SX1a0LRufaok3z5NpIMSHkytxwGEo4CoqunEeACPmv4L/cjeohy3mauZZoPaSgC7saPF/RSPj4QlDxCckmWQoh5Rihkrv4H9b8cnrop5TMbFkwO2euTvq2RAuO+FUneEotpC+UUiFMAUlYo5a5aQy6GvtRX3hVrIOZjbQCk98r+uQFSCqreJb9lHfQ86wBNLJnmna0ezvydre/v7iGddrwTqbz0lQ5Jf+nhIUNSTrRway8IpQDta0A/XjF7JCB9IOvkBvcqvofjzAbMw/8vfB29b3RCvMWJSDzkNhqG+weGjpwakPbqsla1hZ510fOMUkgubqiUS+opu1Uv7rh/Zt1vdf8YIBPz8s8DSF8cvsqAtIN/naN6naOZf/kJuc9knIO4S9HO+B6nHKfOUuT5UEDqOyIl8ttFvnpvThO5ZlA7DPwgdeoxAakwyKuC+S/m8FAPaT7ggFHCqrlQ60ZA2lxYD+tqvsglVL8POT0fb3CKuXEaY+XXK/kI2Lcr5eatU+pHvK+XECTc5wqE+xbwtJZva+KBchta+8J+QFQLwPd6SHsBKfCewwZLpbLmBF4uEbQ3IJVP6DBGq2RJ7JOcMKeUAQ6ebAqYdyXXjT0lIJXGEUugzNX+0+9DhMw5PKTy1WJeqdtDjvOYvpolQldx/UhbAWVeh1vf3x2QTh3KSrmnlmMPiIjPkJnCfvGWuNwG2ST0KoSudB2vuIMXgJ3TthGQHAlIH3yaLIn5qfqZD2ZuHa/nyeF44lxoNJcBZKT2VgapfZA7GQ+kPhVA2jpoJO1s6frdXr6SH/HedEa+0l+VDj2IltM1TgVI5WLGagotQHpO/s3xXf48feWk+/t2pCDZsyqezJX1OkRX5L4pUSXHW5/ktpMla+QSjgc3OD4mIBUOzQmvh+aQKviaLQB5YvLFIm0EpE1+ZgASAVJc0DypQkzR6RjzSzVeAQVvolBgnY+5Eja1Q62cWb8BSjxu/gsYzV1hmdMDvLs3IJU7an5jDmlPEe/M9HxgbW9AyoBgSETi8VEJQbkX5a0A0bmcnGyEbAGk1m28QGFpA1sb+SDOJQJSKREO6FSSR87z1XvIaE3I5d+3Aspj3z8VIM05ib21gHv5ZZ8ClrnGKhkKoPnN2JyinbsQRB5/vLZwT0Cq7mwsQba3HKh8at0s5+DWknOgxeN8ZuCpANJcBUbf9+5b5YeT+7HKBgcUXbeV6MZ4y1YvIJXjGK9PXvsuJ0O8FrsFSM/Jv7X++p33Xl1zwBSYNpetGyIdghKlbaVr7AFIc195TvXJYUf/8rWx9fkHaVaPCUh1KFu9h56yz5YYay/eblAHvwcgzcXeeWQsYgDbd2vIVypAPdxUv//war6b8pHl9r5ear6yb+kqRHPG6zkVc79vGvCj6Fs3G7UWdaum396A1HezEpmrD7u08fKtPHsqIlac/KQYkrNGAMXeU9+5BMYSIM0nb+WrxaLoS3xweCTfJnaJgJQV7QRmJHsqn2zuEcY9z1wLIM3VJhxcyHdWr/GDTJQPKZUmZ+dkQ0Fb5snfe+tC5xI1ewJSaUaxugdvT76wY238Pb+3AAfFOtXc7A7H8t7GfMlu0Nf5hUN1mfkXOYsyb0td3h4e1mecGWDYR7IGt3hj6VPe9+jYmAOkeY/QHcLVvZQjRC1Aek7+9fY7Pgf4kXmwVEzx8czcQchTANLYJwAZWOa8ieltnnmQV/zYgHSvOqT5Gq+50kSHbuK8MOLC5eHhQhcGj3URuaLzvdAv6tO9onpjTE6Adyp+rji7EiQ5LDl3S83cgm7dWT13kvTQHFLfdugr1h3tPagV+63cSvTa7AlIc9Fz3+U9lt7QS7kcj3kzfy3iIagpG36XpB4PyS19s5W7dImAlEICcKLsaR1GWuM/hSoKsnaa9FoAac695bGLXqM1fvnd3mFAMWDJISH2esudaADgVcmhAx5JKRW9JEUqViBwGciHzry8texTvP1Ok2vlt+b6TGHz8C4VDDf2eK0tHsXLL9b4AbQAUTHPrxuQrjU+/T6vy9YRbU7/yIeROrvwsnb13OHpuj/jXhfOzQbp0vdaZeLmAGm+Envt2vL4XfLEnL1N+OPc1bLn4l/sn0oX1lPPLU3ek97iXE2sajB3acuhgBTQJM97qzbgsWhLTOvR15eX8vQD0vVF3ruI43MZEBCUcifX7s2ObfDsEU7xRPTc9aN7AVIJubF+KQYDpPEGijmvj5tFat1KbnRhff2y4JCQ2HQwoMn0HAbxztayJDnhXhtzYaljAKlrQl8dzHqhBMxv9vTNrR3hHflqUbDvCUhzGa8lMNnqowni2YubPszfa6/k06KtQzhzvGiV2bhEQGp8vMgRtPPKG35PAAARIklEQVQ+RTDUI0tqrp+yaPaPf7wh2dN6LYC0lSfPSImVOdb4lq8llq5ST0FnELYEJlvfcXmFSywiueJYVYUWbQWkDFsGbiSRqWycr/FA2oEKArzE1ozQesz7935OrQJAyPdeavX11HfZ9x5qMgae62goADmiRVtKDALsDJCaU4yXbi/MHtEM3rZ6tt1omMPuc4A0X1O6dkgozud73JTyaQlZzwHSc/HPHAGLLvJg6G1NQRCRhLEqzRlxWwCp6KpzAPoE44gESBnoJXI+X0cMD91fMd4PSHs/t+05g6KcYj8c1OFu7qVWDiCripc0016ANF/jZ4FSsAACohSzu7z2xQGOKKSFFeK98FFJtHhQvRzxt7l76FvvW9hC/vk0OVCVCxB7/zVAelPKh6zVE5s+zHoi+CU8V9pSriZvKG3sCUjzrS28sfnCgKV1mG/WWpt7h99Ukqj06uaqZYOPsUWwqxwRKQHSB41IeieQK/WUOzrHoSb9yRUl/G0LuDBQ+9uBwkqMHEZVvmzi3IBUznG8OpZR5orOOcrKYO4ue3vcidmYg9dbgs23AQ6AMYY+4806+BZ/23poKqfW+ObSXfPK0+WripeuAuVFAYBiWbtcqWRpr/rtjY2qFoyYeNPa3HNSTQD6HsqpC945n4d0vYetWqtbL8HIJ+h91XXW+aBZPnPhcJhazj0pOowWDpxc67YNSG/Kx5Tb+1JElUQRrPueWwV5U6UuRJoDpOfiX9Z/UuDskU71e18hINbwnrtdcouuyIBS7j+sk0tszq1CIXslqSIxbu6dVI8NSPUhJ8I7UGLQPeWBoHUHiaIgfa20RBj5XoA0n5jXLk9nLUvy2umx0IesIHkNYxJy67aZOHktD+naO/V9wEa4JOdx+J1XtnXt1zEeUu3ihRSBSoQD4dwyGOI4eSQc7sq1QPcEpNlDSkGax54TtUpt8U7l2ohLodTsmcYL1uHyZr4pH11um0bakodUaZB4R7e8sbUatUcA0nsw3FOH1BwTQMYcy/gwhoD1Hu95rk2rzbmbavYDpC/w/lodUpddMFgrraXT9AJS7bWM0d4QaE6fAU6tvarcsod0y1WU+sDTGOWw/i5dfcxIzfUR18r+8RCJFETqDacLYTIW4jXE9oT/n3NkjYPyjtUGrFeeoLXoHa9W65rRpwRI8S8bTvQQfaoSyxpJa/JclM1zaXJkDs9cLAlEtwP4qoYsUU6Hqs/OeUhziUDPqx0ey3i1vqcvZGVudw6Qnot/2fHlu63LeFpjEh4Xoo/lsua801t0BZkt9SweUjJPscTZ0pzKY3WldCVG5ssT+U8BkBJCcikjKJPjI78ul9+IA6VoMDheEUq42vhz17ztBUj1IwOt2Lel8AmvIaXbqm1HKfDyLJ04bpVsogQJk6UCuELlcoVaYFTfCVtlXDIdC0h5ZJ3si7k5Tu4KuWZLqX5bKJKCa90Csycgzda776tjKZS+RDzwwGyr/quw11w9Npco5Lq3FJ+5a+Xh4BklzMvWoiVA2so5XTNcjgCk993rBaSezWkv/sYDYF3oxxzJNxVOjmkcQo6s9NZhif0A6YserQFSh43ilZ4MQIc75rwaWwCpXHURpZiHTFZaV3P1bIErKUw57JkVWy7ZZKw9VU94lZykjlGQOndrt7rl2qKtqxPjOuAddtgQHyIpLQQ8zHnCGI3G9/Ja2ymWsAQ4HszL9Lxv8ybNGZDODVibGZjr61MDpECItRoxgHxh5YGWDsfiochLzLE1PjJsTp678U1ViEhC+8BiKycSFpAzzPnSojlAap5FguLvjA6AM96KWNukg0UrpRq0LkFZWh/n4l82HOh4+z1GvzKPjMuY8k1uMSIS39mqK1qGIW8uj+wSdtFv5dBmIzFPAZBiTAsY+DsrHSDiiXJ4AZhjnbGEYr2wylwMiXmceaL2BKStUlP1e2s5nXmR1feE9ubARxxLrFla/w5MyhchFCowfcNNKe9+++IWJ+3WPFXv8ETHhTHnaTkWkPqW07CxPp2/UdAWJ68hJYuEpAkp81sBu7FET9qegJQAA4IiWNYP3iSpEyzMusHwTjhf34Cc2r/MR+/P3ewiTUIIKh9GITTNPY8wYArEW+f4Vi1R/QD4Xh7wuinlfW5LUQ6oRa3TwjzATqLyCFHqFHlUrucEpAClvsfrMOu6tC70EwBgvOgroWkNx+sY67hfVCtopz2cG5C2DFUGNyPZmHkEYvH+LYDUeJVQERXKspuCspesWUqeMQcESQcSSo3UCnXnsJ3nec3sA2N6cRjzBY+BEQqZp+MlyGvIlDmvWe1LrsJhjTvg6e/2m+gZ0BQJuPf3PH77SjqUsdUSeiqRqIvIa5nLztAp+BO8dK8toJyTqB/2Ki+P2sV4QnZwqgBPMQ86y61HA6QL2UD5JqXKZzrEWgLiOE/ILZ42eoR8zoAbeKTDlygfPPasaJJ3gVNAkhebw0RbwvpzNAdIPZ8PCPubdQVkW0vkHRwhxY4sjx5z+cjmqdISIPXMOfjH6WBN5zEz9shJWILX3pzQZ5wlLq6JaUP6unSgeKuucG6HzvbfSJ9+U8rH3b6QdeaTbsRrTjTrJl9/ytMqbfOlUfJUAKlBtTwmK2v8wc8fO11ltfTOnoAU6LAQoofWt/PdyK3+8Fi43SAT4UnYrhElIOzR8krwEhAi5pYif0NS1A6OsVhZK5RbpbnQ1x6A1DfksuRbL9bGKc+IVzcWrt4TkPp+K/xb+8WDwxBiPVPweb/YdG6okKQdQbNQC3DZIs/zki4J1dZ7PFw2d7wucslDqg2hsqVrMgkInqNKTUC6nN76oKtbPKReBGwoqghq1tZE/J1RIyS+dKfyuQFpvsghjycfkFkHpK9PwKwnrmOuHOqxblqeqZYyr/1nGPD+A4py+/I9O5QQoB29a8AbkDHnuczF4zOv5oAO7y5PZKveYs/6EZXg0Mg3yeV3yVf1rYHvLWRPMVg5LSo9GiBd6DgQg48PipNvGeg03+pLL1Ut0KR1gy9bDy+KMGT+L8lORghjY1qj3aOx9hk0sQLAGiA9F/9yacHuQU0POjNi/S2lQ23VFRxY9sYh12vrFtlgXhnrL+n0gLRDQob+CNNzNbdqiM5NAlDIC7CWJ+L9PQGp9lpWn/7nPKfc91YtRhME9OTLAubGTdgBayEvcJXZNiphDng4PFZLvvgGgNsK5+8FSH1DeE/opud6TjluxkhxRI/S3oBUv2x43uUtIJEyte4A1pw3uCbI8EGeWc9ViAQ9j4GwKI/mFkBqP83dzmHcue7vOT2kdV3jAY9T9Ir3CFzClYeOJ3WJzg1IgRheSpZ/i3jOeNWq530dkLbboRB48N6h+wLGF1494GOuDiTj2jO8kL3EaONMIE/sa/K49zYxOZoAcjbq67d5gufAIFBt/LHCRU+fpYHhwVq5sNoWheukNyO+Rz6I6rnSWV5dLG/zFAFpHSOjnGyJEbQ1XpJLHCscDa+FaWc0kb1B7pF/a7xkbHIyWY853L72Lo813dxbhN864lV0sDIeXFuT4yfjX2NPc2AJi28FgLzP0jDWcvO36gpjtzd50mMK0dq68TuAzIh5LUWwG5CuQp3aje4HZ/sttCKHT0HmuZPqXnYAx0Ji4eUbmeYa3weQvhpjq55nz+07BDClED2cr05c90zpi2fwh0Dg7Wx5S+36t96+qI+q/BJhXHPZhPEog0itU5J7AlLfEh5wolOebUsA8sIA2sCyEPPSzVj9nFp/EhgHduVCzZE5s8EZHbFWafayCkW9y0rSvt8JGF7KnDLg+8IdhCqgzKODtgJS7xD+AH0rrzUnuT8GIK28FqJTSk2x93hFZJ4LIW9XHToZ3QMqzg1I9VfozBqe8wbFknCHAlLfAQAZvxROLSWX+WW/C0U6FT2XZxrfId3INR75XNUhPkeWklm8mPFGuOxlJXMAtDniHedMaMl6B92WACflLKfYP2HBOaBiLwnXMoaB3ENIP8ktSriVI2pd4oW9BqDlnNynDEjxgzNE4XIRHLJpjshnER7jnKuVvcZfaTqiZYyKFi95zRjeUnpaB3vWAKnv0y3kCUN3DpiS4fpRo5IihocA0hPwrwmkGHCwEX2/5AEWkTAOMjIebF2bly26oralH/SfQ01LeM3zAKhScOR306PeM7Frgzjl79zvBI3QnoFL4Cf8eCDkGR1Ix6PmAz98qtcAGjmHTspT5gQwi4hAZ132nBo/Vd/m2qVMCRu5PIwQnhX5PTy1c1cTHtTHjbNtrVE+FCEQpy94yQCSr7P3FZc8hJQVJSAnhwdNTTanWNdO9M7z4+GgedHlXhJo1gpvPAVKQOTakQfxeMeXKCgH7AAsSlLfKUG5tforV/BA2rgSDvxKeO3dyk15r3J7D1DtSQDaOpLasHQA8ZAvV1n59uWmvG25vTfSyUrrqPempfxdc0Cu8IBYN8L8rkQ+Uv6+Njy5tXKj5SmS86JE5psh1ntJRd23+mrd2KcMSOtFG9b8HmSP6ivlW08c+wYQtbds2KO/h7RBTpgLYxWtpD/IIuloyjr1lFHq+a725eVLK7K+yCRzFau9HApI6/dteuXh6MYKTH1HStV97csT0Kn5R0YyFt0EhodkJMOTfLEWRUIPXe/H6Ao6E14zn3Snfc2pJPXOvK5ev3sCQHp2oX+C9fSMmhzT9Ywmewx1cGBwYHDgojhwLCC9qME+986eAJBeP0sHhntKczxm4ynNxujLJXJg7KFLnLX7Pl//1A1AerGLc3vHrwKQXv+e3D6xp3pj8PpUnD1du2POTsfb0fLgwODASTlw0YB0yN5ta+OMgHRMzbapGU8PDgwO7MGBs0mes30ocuVRPrrHtIw2LpQDZ15xFw1IL3SKH63bZwSkjzbG8eGL4sCZxd1F8ea6O3tdM39do+laec9wyF18aT50xczad2iLgHTfTx0+m8/mzRMz/PIB6W4M2q2hZ7M280D34+B+LT3byRgDHxwYHBgcuHwODA/p0XN4Ofr08gHp0ZM1GhgcGBy458BTlVtPtV9j2QwODA6cmgMDkJ6aw0+o/SsDpENzPaG1dWFdGWtncODCluzo7uDA9XNgANJpjp+DfL4yQHr9u3NthM9h0a7x4Hp/H7N7vXM7RjY4MDjQ4MAApM9oWQxA+owmewx1cOBJh+bH9DxTDgxD65lO/Bj24MADDlwcIB2ia6zgwYHH4cBj7b3u73Y/eB7+nbw7HR/oeOQ8zBhfGRzo4MBYrx1MuuJHHgmQPuNl94yHfsX7aAxtcKCPA2P/9/FpPHU0B57NUns2Az16STz5Bh4JkD55vowOPhsOXLs0u/bxPZuFOgY6ODA4MDhw1Rx4voB06OknuLDHpDzBSRldmuHAWK0nWBqDqSdg6mhycOAyOHAGQDokzGUshf16eXNTyu3tfu2duqWxQk/N4Utsf6yKS5y1uT4/qdl8Up25plkeY8kcONdS2+s7ZwCkxy+SvQZ7fE9GC4MDgwP7cWDs7P14OVoaHBgcGBw4Nwf2leEXAUif7hUy55788b3BgcGBwYHr4sC+Ku26eBNHc418usYxXe8KPP3ILgSQnp4R4wuDA4MDl8mBodQuc95Gr0/FgbEjTsXZXdq98Ok5ZfcHIN1lhY1GBgcGBwYHBgdWOXBKbbb68fHA4MDz5MClbLsBSHvWZ+XSBR3U6RnW8c9cyjI/fqSjhR04MJbLDkwcTQwODA4MDlwnBx4HkA7FdJ2r6eBRjQVxMOvGi4MDgwODAxfLgSH7L3bqTtDxxwGkJxjIaPLSOXBlgunRh/PoHbj0BTn6HzkwltNYD4MDgwMn5sBFANIhC+sqGJw48X4YzV8IB8ZOuJCJGt0cHBgcGBzo5MD/B7pKhfmoAdgsAAAAAElFTkSuQmCC"/></switch></g></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-23"><g><path d="M 625.01 149.23 L 625.01 220.63" fill="none" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 625.01 225.88 L 621.51 218.88 L 625.01 220.63 L 628.51 218.88 Z" fill="rgb(0, 0, 0)" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="all"/></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-24"><g><path d="M 597.09 102.17 C 595.93 102.17 595 103.1 595 104.25 L 595 138.62 C 595 139.77 595.93 140.71 597.09 140.71 L 618.69 140.71 L 618.69 144.02 L 613.15 144.02 C 612.6 144.02 612.07 144.24 611.68 144.63 C 611.29 145.02 611.07 145.55 611.07 146.11 C 611.07 147.26 612 148.19 613.15 148.19 L 628.31 148.19 C 629.46 148.19 630.39 147.26 630.39 146.11 C 630.39 145.55 630.17 145.02 629.78 144.63 C 629.39 144.24 628.86 144.02 628.31 144.02 L 622.86 144.02 L 622.86 140.71 L 644.39 140.71 C 645.55 140.71 646.48 139.77 646.48 138.62 L 646.48 104.25 C 646.48 103.1 645.55 102.17 644.39 102.17 Z" fill="#032d60" stroke="none" pointer-events="all"/><path d="M 620.74 116.08 C 623.76 116.08 626.15 118.48 626.15 121.49 C 626.15 124.5 623.76 126.89 620.74 126.89 C 617.73 126.89 615.34 124.5 615.34 121.49 C 615.34 118.48 617.73 116.08 620.74 116.08 Z M 620.74 131.07 C 625.13 131.07 628.02 133.59 629.52 136.54 L 612.08 136.54 C 613.45 133.63 616.07 131.07 620.74 131.07 Z" fill="#ffffff" stroke="none" pointer-events="all"/><path d="M 599.17 106.34 L 642.31 106.34 L 642.31 136.54 L 634.04 136.54 C 632.92 133.38 630.59 130.31 627.21 128.51 C 629.11 126.75 630.33 124.26 630.33 121.49 C 630.33 116.22 626.02 111.91 620.75 111.91 C 615.48 111.91 611.17 116.22 611.17 121.49 C 611.17 124.25 612.38 126.74 614.28 128.49 C 610.83 130.32 608.57 133.45 607.53 136.54 L 599.17 136.54 Z" fill="#0d9dda" stroke="none" pointer-events="all"/><path d="M 609.02 109.6 C 606.83 109.6 604.85 110.8 603.85 112.49 C 602.85 114.18 602.57 116.17 602.57 118.32 C 602.57 119.48 603.5 120.41 604.66 120.41 C 605.81 120.41 606.74 119.48 606.74 118.32 C 606.74 116.6 607.05 115.27 607.44 114.61 C 607.83 113.95 608.04 113.77 609.02 113.77 C 609.58 113.77 610.11 113.55 610.5 113.16 C 610.89 112.77 611.11 112.24 611.11 111.68 C 611.11 110.53 610.18 109.6 609.02 109.6 Z" fill="#ffffff" stroke="none" pointer-events="all"/><path d="M 639.18 115.08 C 636.21 115.08 633.75 117.53 633.75 120.5 L 633.75 143.81 C 633.75 146.78 636.21 149.23 639.18 149.23 L 649.58 149.23 C 652.54 149.23 655 146.78 655 143.81 L 655 120.5 C 655 117.53 652.54 115.08 649.58 115.08 Z" fill="#032d60" stroke="none" pointer-events="all"/><path d="M 639.18 119.25 L 649.58 119.25 C 650.31 119.25 650.83 119.77 650.83 120.5 L 650.83 143.81 C 650.83 144.54 650.31 145.06 649.58 145.06 L 639.18 145.06 C 638.45 145.06 637.93 144.54 637.93 143.81 L 637.93 120.5 C 637.93 119.77 638.45 119.25 639.18 119.25 Z" fill="#0d9dda" stroke="none" pointer-events="all"/><ellipse cx="644.34" cy="140.7" rx="2.1290799779998864" ry="2.1290799779998864" fill="#ffffff" stroke="none" pointer-events="all"/></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-26"><g><path d="M 625.01 277 L 625.01 345.63" fill="none" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 625.01 350.88 L 621.51 343.88 L 625.01 345.63 L 628.51 343.88 Z" fill="rgb(0, 0, 0)" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="all"/></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-29"><g><rect x="545" y="352" width="160" height="40" rx="6" ry="6" fill="rgb(255, 255, 255)" stroke="rgb(0, 0, 0)" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe flex-start; width: 113px; height: 1px; padding-top: 372px; margin-left: 592px;"><div data-drawio-colors="color: rgb(0, 0, 0); " style="box-sizing: border-box; font-size: 0px; text-align: left;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; pointer-events: all; white-space: normal; overflow-wrap: normal;">secured upstream</div></div></div></foreignObject><image x="592" y="365.5" width="113" height="17" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAcQAAABECAYAAAAfmEVzAAAAAXNSR0IArs4c6QAAIABJREFUeF7tnQXYdUtVx9e+ChYGimIiBnZgXAO9XkVssbDFFhULE1tsxQILERMVEzEwsUBBDERCvdid10AxMI/nd76Z911nfTN71uw+5531PPe5975n74k1a9Z/1czupFHjwFlxoBORXf+MHI9MzZIVupx6Cq29Cg5Mtt6TNVQx+E0/Oi9DaL1R40DjQONALwfmVUON+WfDgRMXlE0A4onz8Gxk2T2RtmBuVrUHGwfm4UDbhHPwdROAOMfEWpuNA40DjQONA+fFgbnNgIUBce7p+Bd/OyPxj7n/yfOb0VScae0sx4E5pXDOtpfjUOtpdg5UCcrxwwsD4uysaB00DjQONA40DjQODOJAA8RBbNvIS1WW0JJj3uzAlmTCdH01dk7Hy9ZS40APBxog1ohHU0w13GrP1nCgyVYNtyZ99qqwfol5ztLHLI2mRejMAXFBTk66RVtjjQONA5vkwGCVMvjFa2wY+XovL+dse5OLmB/UmQPiia3GzHI/OzfGb6xni8hzXY6zu0lk9/jkuMf3NTE7lhlQXS91T0/MkFmaGzKjIe/MMvjJGj2/GU3GGldDef41QHQxsD20EAcMIMpNIpIGxIUG1Lq5jgOvKyI3i8iDTpk35w4p5z6/uWRvICD62O17aq6p9bvFhcu9lh9U6xEOVAHiVuVrqaVceP4vICJfICIfLSLfKyL3XmqerZ/Ggdk4YDbRQECcbXj9DS+sAVaa5VXutgoQN8WoAbI54JW1pvyWIvIdIvKSYQCPaIC41lK0fufkwCUgntDunJMhre1VOXCagHj+e+fBInI/JRkbA8TzX4BVd+UsnW9zzU7LQ6xemALTt7kmYZb9g9v00KvX6eKFSQDxTHkznKvj39w4II6f4FotbEdWtzOStdaCfs8GENdazrX6XVNoLvuefPaTAGI1byafRvUItv5CA8Str1Ab3yQcOBtAnIQbMzUyn76dr+WZWFFq1g+IZzf1HtasP9cGiCXJ9f6+9Fr29rf0YLxM8j6XGf+IaTVA9PK+PbcEB/yAuMRoBvYxYj8O7DHx2rSDmAcQpx3jjIGL6ZaltWQ4MJcM9DI632kJEG8QkVcVkdcRkRcVkefZJ9f/SUT+XkR+V0SeXv48uVsEXllEXlNE7igilHjTx9+IyBPDf7sbKjzIHF4vzOtFROT/wpyeISJPEpH/mKqjZDvTCsANIt09RHavEdbht0TkF0XkP51zeF4RuZuIvFTg+3+LyN+KyO8HXkx1OuUuInJjqFKEA38uIk8Tkd8x47wGiJc82sY5xGnXLE6ZfYW8v7SIPOf+OMOtIvKbgS/I5Bi6feD3y4sI/408/EPYT78iIv9c2fjUgIg+eSMReX4R+UMReWwYn2dYN3QiN+5EXiHI7G2DzP6ZiPxyOLrjacfzDPuCsaIn+If9goz+3b7K9g9EuqeI7P7d05DzGfTtG4rIa4f+WDf2CjqQ+fUReo39glzdTkSeKSJ/FM7xPsvZ/5V/LAeIlFd/soi8bxC6HKMQjJ/cb7qvDpv54jmnDmFDfFIo4UbAU4Ry+NU9SH6ViDxyxIq9fujrniLyfJl2EMAf2AP/A0UEcMkRAIQxoIm5/KtzfCgDhFxTbi0+SES+TT34sSLydUGZch7s1Uw7/xh+/yIR+a/MeNg4n7YHz7uLyHNnnmFt4TdnzzBM/HRt8dncH7hXvp8Qxpp6/9dF5PNF5MfCj3N7iBhZKLZIyELs2zM/O763CMrcvnuHAHDx708QkTcN//N2+39/roi8QaZDFOA3iAggVGucvfteWX/Ufkxv3lMf8L/B2KFS9Jt7+kC23svDFBH5UxG5s3qW//5j9f8/uN9PjO2FROThIvJOpl3k9Pv2Y/lUEfnrTJ8vJyKftdcz72zWUD8OOD0myOyTnWO3jwEo993vz7cRkVcqtIE8oP++IoBxqUv2Lec4IwG2T9mP9zlCFS869yUyjfxs2EtWL+E8PEBEPjwAoX0d3sLzzzQyWRrrlfw9pYTvFRiYA40Uo/AkvjYAzv84Ofme4Z0Xcz7PYyiW9xaRv6h4h00IYH9AxTt4Sp8nIoBKitYGxB8REcAEbzpF8Odlg/erf8db+BYRedcKXvzb3sP49LBW3tdeZg/U3x+8AM87DwuKnL7U1W2T31RzDIid3FN2iwIihtanOIvZsO7ZiyjMEmGMYby8dd+DCSMV0GIfEhmxNDUgsm9/TkTerGeMRIl+z/yOYYXRBN/wBj2EPvrWAD7eaAmGIUb3R+z7o89awojBWMXgyFEKEInIfHcwYkp9YiCxd386PIgn+aP7ud6p9GIwWu6BZ9t1IrupYj+OjrfxiM9Fs4CI5fZDAwWCeX9TsFRKPMAS/BKnYrBt/eUeDN5hLxhPLXUiIi8uIj+zVxYA2BDCSsfDsbQ2IGIlI9w5+rJgbevfAUisWSzgIfQ1gRelcB6W/C+FMGxNP98oInjDywGiyJIeIhY+lvyBwvZEeRIqfeGMssdA4FA8EZIcEW4lTP7GNcxWz/5LCNORMtA0NSAC7EQbcvRrYRz6d0AKT/bdBs4NOWSvkObpI0KhgEz04gd2J1+4B8TPPnr5WA9bQOQKPOT+VSo6JPxJVOgFwz7DyPUSa0BkAoO/UYIDGhDxpLDOyBVGQpDw/AAVrElCgniOWHKEQO6z96JuY9olV5SyOONjvINHoAkli4XLJiSPwiYl7ERo8UPC3Yn6+b8SkbtKJ7dK3tLBmkRREJPXxBweus8jPjrE2LG6CNe+xz5X+TGXIcQLSSZshLejyQeIeaNkTMiUOVkrG8VK2CXSa5mQLjkF1oR100Re4uv3igBlTaiOtQTQAArCRoRjNBGyynnNPAeY0Y81QGgbQCWchUUMAKAMCO+RR8vR1DnEtUKmKDG8uEi3BMWJDBLSQlJY089IeHkA5qv3hLsIhaGINcHnbw97iTmzv4gmvEkIzdn1IWzMmmsCYDGiIKIrhHojcb8schMJ4GYukWzIlGgGfZLnimRl9uMSUYjv2uez38+Mi/37sE7k0btDHu+QHyXFg4H4kSLyiglevG2h1oG5IIuaMLzRE+y3P9l7qMwR3QdPWKsPM2Fi3mUt0SW5CNYxIHbyDNkdgSH78FFBL2HoAF6MC12oiRAoaxnnip7mJiHWhZQJ/CC6gDFgnR7SYN9j2mv/GzigmUVsmwWLxKJScIEyyxGbhs2Hwo0U8wVH7wRsYGOzOfTGoB/AiGR/jshF4X1q8P0pvUkT2JNSFIRc6SuXp0A5I5Q6jMuzbHCdj/MBYn4+YwAxtoop8JCQayK8xqYhp0XuAyNCE5vl/c3fUAKf2JNnxLsmr6PBFyV2s0j3BJKECcIDIj+mifAufacS+2x6IgXkTlJ0LoCo54ZxBcDkQnl4GIQINeVuhsEIYn/qvBOh/qM1MHsDngM0Nj+I7Ofy5rVFNRYQ9Vwwrj9nn0ckx4cBRYEbxhfGKOAfCRkmvK8Jj49x5/Yv7X15CF3q9wj5f2lGxij4wkDRBiWh3Xcp1ATgvWLY231FRAl+pch6iPEZjBb6Qz9ZorCHegPSECkiZIp+pIjGEuFVaiL03H4iRNgyzZ37n/tDpxoQATIdmkBIsZBKxJVOWgBYGJRzKpbO4mlLlMo3wAFLr0RYPLaoJlfUQDgB70d7OHieWFWlQgUKEn7BDAahR4lE2gIg9m08PXy+TvAbZj7kVD++xPBguMAL7WU/LpPvgNcUVxBpiITFSuFOKURDFAKFGOhCaM8NEFG0eCv9efZOHiK7A0hEwsMjTEZltyZAjGrdSAAFVaulsDYhQiqJ492kvE9xGzm0FE0FiHg/5Cz78mz0D9ggS9owxWBmv1PIUiKiEeTzIhFxAlD4tyUAVBtkeFgU06CbSoSBjjEKzyMlHYLwYwoQMbQprrEV17rvDw45UTse9iIh9T5+EpKl4CYS89OFZaU5nuXvOVjUgIgVAjhFwrr44T5uhEYBH4QH644Sav5BwLS1RzMIGXkK3SeWDd6Ll7B2CNVGSoV6+A0BQBAi4c4gdJ68I++Qa0NxRaJfNnKktQERJUhC3UN4F4RJIhEWx1P3Fj8xV/rT60bFrgVZa9GjlOnH5qZSY0ZB/3YiBHVOgEgFJKCGoi8RERcACy89Eor7/uZFogFESiIh33ctNR5+pzKScBzhQPYsYKWrmXUzUwAiHjHh+Jx3p/uzaRUMKnjnMZxpB0+RZzVQoZO+MsEb9gNeYiRSAqQGvESURhsvGIHIbYpSgMiYchGS2AbGJo6GDX/a1EiqT0LJeOWaaG/Boxi+ghYvw+d8TjOYHMA7qs4AQzxGTz0SFl3JciMMpBPOhEqpjvK0H4eFhfjzaoxYRngk9rgDSgJlEQkvB0/FS+QtCClikaPQsU6pIou0NiDmNredH+vCmTNdnYexQPi5hrBEdeiUakmObWjCOKHYKRKh57eq6OT+It0DjTicEyBS9fihFfwgxEfxWSSAC0DRRLhR5+sxQsg7WWMl1S2ggXfi2X9TAGLOeE2NjbydBhWqMG0uscRKQseEZiNRmKQN/vh39AR5P85s8m/yuIRQvYSRwn6IRCSKqEyKUoAIGF8D+n7cIOKlw6aZfq5rJBW+Ru/2pcK8cz+75zQgWsBisliNxN9tKfQQRgBKhCMjPVSku69vP168g2JHweuzcyhdlG8k4uVYUzqvSThOFwGUxl8yadYGREK/HEIu0c2dyGONxsProLClhmxeS5+ri1uZUIwOl9bynGIFlL6mcwJEQlvamCvxH2Cz1aUoN+1hIuOsJR52JKI1GEwUTniPHJTGMgUgktP/4lJHwXize5wjG+SzawjZAVgj4WUSzSqlTGr64FlCs4RoI3E+Gc/tgpQysYBIFM177AzvX7eLgW4LgVJjpwqVvanpEoRrZzvD8yVlO0OX2SY1IBJeoJKUpLslku2EESlNJiRQu9EAKeL3euOmqso8c0fgdJWc3WhYeTa0QvFPX9GOp1/9zAqAeCQ2FCU9O2lSHksXxoxWQkPzB/fqRB6pgJX1Zy1jrspYoYdBUMKeKhLo4zUKQlfUnQsgwieUsffiBniE0cfzuiCCY1G6mpPnyPNzds4SITEMRaIlFL5ZY6NG5qcARFIQ8fxcX9/sVWvseUKDtk3yZBSraPIakiXeEHLEYKFSGrDWla2E/nPHvCwgkqaicNFDRAKICEQqVXzH5zCabHh0U4DomfxSz9iYNIUaucR6HBO5EEJobDTCICSVS4QV5PRKqu0FCjIA10ipmDlKNp8kr+7yIPBr3VSDcNvjEDn+2/xGaZ1qfkfhRMvThrJphzJ/brupIa7wQskE6m4S2WGATUVrHbvA0CQkV0s2TEYBm/ZGaA/ZxtjL3fQU+yTKAyBRZUi0psaonQIQUeae22PI1StvsH5z9jCZwjyiXh4iGgXQxXAq68f/kxcn5Gh1Z2yzBhCpwKa61EMWEJUs9PKoAaKHu1HjJLwMwi0coM1d6WWbx5UnPMO5pxzocf7NU1xRMfSLR6n+1KXPFN1QBKMJ4S5VOtb0vSYg2muy+sbNumDBOqlK+aAcKMaAyDVTXacpeLH9XZseuRRCK4hz8RDJ6VGIVEtEZlDAkTjWYo9k8BtKm+Ipe+Y21x+eJxXfDxfpHuNIW0wBiOQ/PV4q3q6nur2WlzzP2UF7lEO3Qzrh3qFwjyI87804uo0aQOTc9fscTyS7By0gxiscS3xogFjikPo9Z+XgUpMsxlrzeiNsMsJzJJht2Tcb9bqQZZX6zU+Kjc0B1EiAo65cpZrSXh5QwaLko2sCIoU+3pstbLXs2Hnr9ykcILEPsakpfIhEdHXI9VccONZX7J0LIOL54kXXklWCfRWQ8JvyfPJKuaKORP/d40V2VEn23d07BSByVtJzJy6FRLkzg7X8s89z7vZBiUbgHakXCsV0WqfUH1EiIk+6NqIGEHPnS1P9NkAsrUaxLqncQA4Q45tUonE/ItWn5AA8d+ZxYTBl05rIAdgjD1Tdla5UKs/g2kbGO43EcZFHGc8XQPQeM/D0ORIQu7uJ7Gx+LbcW9nLvGkAkPKTvLcVL/3HPBB3PEFrnxiAo8PzoLRRLVQFDJ/KI3fERka0BIlWZ2rgy52AvTDx7uTfGYOJqtaJJaI8EUAHJRQYlwnvH0377cPa25OmwD1Hq+kyj7mNJQCT9wTnZSNwQM5XHSIiSw/2X1MltZHeIbtibeiyPyW9Tfcr1Z1wzR9qISnnO82qQbYBYks4N/14CRDt0PEeq5cjT8Q+FAimyoQkKdmyZ79TKLo4jdbBe57umWI4UIPaf7TnWfamc2xyAiHGiS/05GN53B+pQ3pD3wwvSxKFvz5kz/Y49ujG1jNgcYqpIJccD1sdGPrxfu+DQtQ59evlMDlZfpTjkyAyGCQVOrDvGbe78KrUA3HOb+kLKkoBIyPI7FYNIdZC+KV020M/TvO3Bvb9cHK6J41zkWilKItwNENpKzfg879JGpAaI2ZUoGoDefTHbc7WAqAeCpcyRBwRChwx4Bq9N31FJPomQqg6jcZA7dxB4zIRRPDb8Q8gWq66GsLJR6FiollJ9cD+n1+NN5TnnAERC2FSaRqJI49r9lNPKZsrgqT1mwKjwULTcHAHiBEO2VazkPslbesh6fbzjBUQ8Ze4yLd3QosfR098oThDlIepArYC+X5W+kUubC+bvSwIioG2rUSlo0Z+T8qyX5xl4QbtaL5HnxFCyRXO59uxxtckA8WiVO3mS7I6qTA85RIcktByiRxLCMyklDNCh3J1VoQdhIjSn83g0j/eor0qy52hsMYx32NHbyx0oTp1D5NJffXNNqS94QDUnIWP4wKYBwOOBXXJ49vAuh2a9n6VK5UnmAMRUKFMXw5T4EH+PeZW+j6HCJ32minyMPrBc6gujCXnRx37GeYjXawtyWPqTWfZKPjXG615O5cG9gEi7GFF913NZ/pCiIAccCTBlX6auH+MZPEl+81aPcmyA4w36WAehP/JslpYEROaIJ6/3Q6kYJiVb6CXOxeY8O97h6IL9Akfp4wS2L7xZvNpI6AX7jdL4mz12sUoOcZ+auEu4GL20J6/c71HouMWF2D0hE6wxLHV95qXEGLwBfTie563itTfKP7MTudOu7gohFC6hV8AQbwdrjs1KeEMToUF9Mw2KhXyKlzivpMv9UUa3F+meFSryUofIdZFJqR9yGfYjqXMAIkrSHn3g9o6+z/Ckxk5OB/nAw4Ln5CK5dk8bJRTV6Iq5mmvE6JNL1+1XRa4DRIdF3Of9YtjoD9nmiixSPEgdSaoBRC43sF+l6BurvZA9dWaNPUUIlH0LkNSEgJkj+TT9yaOckfpgke5+arlLijx1O4q3qIZx4WVpUOFCA3RMDUVjEMMWmeUfjipoT5PjHfpKxj4wS/WNONJe/CoIz5D3tV+V2RQghqvqvNfg1fD8+mddG3ZcF1O+HZWwBTTi9QCj595FxpPK2wFe+j7TVN6sVjnbi3jpG4VgiwG4JYXziZEANLw6rxBwi70uDLI3s/AZGHvI2nszC4YCIV393T/GOQcg0q69do2qOHLB3vAuHhX3aurwGmFG+406rm2zX58n/GXvUczJr72ui+fGeYjX98SXVvTxBy6LB4hLdFvp5KnmUz28UwOI7CWAy1NoBKDgTeqvwvA1Gs6VajoAmtI5HCnAm/KSOfd5aF9/0T22w32b2nMsXaV2CYiXg6sBRHvtGuPg6sDjgpj8LOmVQia84EjoIvLaurjOGs52n5f4mDpu1HfmdBMe4qKAWOLgln7vLpUwSWvCSbpIhlCA9yvzdqHx4lIVqSSodUk4CXM8Oc/h6xtFDiXiumIuU713uLaN8KWeDwoX4C9VmwKwlDjr0F3qEnIUnJ4jCox3+9pn7FxokCrBnwsQ8RrwSDVRaUqI25PTspWqtJO6dYTQGzzgEvfo+cAjIg2lLwdwVCB1td7UgGiPdbBWGCglw4/jDlR4WqoBRN71fGWEcD05NC0jhP0wULnSTBNhaV11SriU83Oeuzj5rBDnSLVhlsvr04e+u7Z0L+lYDxFjmjXRZ6GJCGHM2I8GpFSq/QIPz3CUQ+fT+Zv1EAk5cxYxbbQcezukSKhL0Bew0yZ1B/orInp8iwNiJ3K7RBRuwZtqJnQRhzZV8Z5WwpTR26/DE1rj22p9FV58n4wQis5F5M5LcZEu4UvdL0UrJPntp520IJG/4byhvfcPMLWfaorvHX0PMfCEa6/IG1nFEt+hoIPwq74lH++Iv9vcDHcJkpvUxEF4wDN1CQDgyUHc3JfN5wJE2sWyJgysiXnCi1yOBfBmA9sjNBgW6jaZozYp9bdFKhQnUNKeAx3ah5dafmKjUwMissoaaALEkaNUzpxIAPtCfz5Hv1sLiLwLuBA+TRkjGHAYovYIQC60S0gc41ODGh4KH/O1n4rS46Yf1l9fG8Y+RO5T39WzOW9ACaWa20djAZGx2oIw/kaEh1Bo35lJPGTkSRu0zAmDwkZF7JEJ+sjlUTX/2MOAaeobhX03SS0OiOFO57O6uq0C3w5rVvO8VsJsLmL3usyb9jh3QwiRcALnzmJyn8/McAO9PufG83iahIZSG4vf7S3+UdAANix4ciVsOAo5OL/ITSv0YxVmydomqU7uwSpvFB+CCTCjTOABMX9CZ2wmbZUyV7xKwo6WsMTxeC2QYclybgpeomS4oYPQIXyKm5QxoEyueVPXaC5ApG0UHYfo7Ze3WSPGisdI2T1fLMFzACAIAduvj6NQ8Pj6Kv6oHMbA0UR4GZ5TwUguB6DB2udAuM4N0b/m/9SAmPoOIONkfHwBhMu0WRv4RXEFxk2MMmAUEpHQIDIEEOmPtSCkj3EBT/EoADEUtPUu2BccmcgZpRis3GCjCT5yNpcv1gD4eD7wFVlkbQmL2n76iqDsUQj6QgYwMDEUicjoi6anAET2CiFda8ixJzHAuY0KY4t9RKEdRjOGS8pYy1UT490BssijJnLZHKVgnSLfmSP5Vi4/oBo3VqYyHqubcrc0NUBMKNIt/ckqYUJhhNdKB3lzc0Cx4AX2fYkB4cGCu08NcpsO8Sb5xl/+OrZrjeNRouyHXJtFwQhn+PqOhigBd8+GcAwAiWGgN/ucgAj7yKfgZesqyxpZRKkSfk0ZB7odvBVkSH9+y9MPyhslo4uNpgZExkERBV5ijt+5sfIBXQpXiDxEcgNiJ/K4XVTWblE53P0JGPblewmxYtwVi056usVQgS850MUbLH3xhq8qRCN4CkCEx+xfZNZ7JZ1dO/Ywx0v67mdOhVdjO+xVIijoQ4xJKzM4CPCNgkJtyPGZKfulEtpsgOjRBAs+Y/dESimgyPDUahUnIRpAynOBL1NGEKm6059pKrECAKSUH4vYe1AXrwDrX38kt9QPmwAw7P1AclDgFCKkvjaQ6gPvgwuG8bbJm04OiAVdS9gW61pXFpZ4we8ULRFezd1kYttAgfABWrxMD/BQeANfCBfq4zszAOKBQ+TKyFl67utF5vDcWGfkdRAghqIuvDDrPef4T5UpnpznCxl4JBTUmHsxi0vLHmKdyI+W8sm0D99yhOdMdAeaChBpizUCSPDMaq4DJMoE/+y9xqnxc5aQIxgeWY3vs4+ovEZX2I+rUxSE526pAWJRJNd9ICcAnN8BsCiqKd3SDwASUuUqttoLtLG6ONiPlaXL4S1XiIFj1RPfv6UuKnzRFFYmQo/FnVOECDfgST/ec5h0QAUcIE24JpULQ6mhUNh4MWc3CyA6xYkjKOSLARxb7aqbICTM+U285FIxUqpreE4lMUZWii+ErAl9w2+UMwbIzIB4MUzkjRw5oWwbMuMhAALvBJmJ5wfHAGIsZAD4UZapTwTRJ8YBOXhPoZnlObKNEcL69t3fy34CKKge9Z6NpD2eJzSaWktdkKMA8cJEq6kyTckS5zgpimFueKM5QqbQRXwVpO8Mon2fSnlyu30fEsdTJ/fKUa/Dh5nD7KyXSWENPLC3/iQB0RkwaHeZOpVb9WNqATwWEWdsyBeSW+J6MmL7hM/IIbBItddz5cZLPo2cITlMQlOEK6hOfLpI9zSR3RCFnOoLaxprFm8p5kuxJslHAO5ezzPVNgCP9wWvMCrIb1Dxh0dIXueInBuhen0rXsB7pkCAnBm8QOkxZvKgHFGoMQr6uqVteI5xFSuaKVYitD6G3xVTzT7KeDAMUGCMk3Wi+hJAKlXH5hpN3TJjK/vIQVOsRS6PPBw5XPjhqaIszRsZZy+Rywc8AHyUM+t5Syfy5N0wA4d+GS+GH/sHXYC8MHYqLu33B0vjHPI7YEwem/w2fOY4EADP3Ni/yNUYIkyLIYfeQ99xGQVrQsgYA3G0vG5g34/hz1m/6wHE5RjQJGU5Xree5uSABxDn7H9rhtdic20dNQ6M4cC2AHHMTPS7DVin4mRrZxgHVgDEJvTDlmrht9oyLczwuu7OExDreHDlnm57cvYlXwEQZ59T66Bx4EQ4MFzDNUA8kSXe8jCHi9+WZzVqbA0QR7Gvvdw4MIIDIxRSV3WMf8QY26uNA2txYMT+GDrkEwLEFbgzlKvtvSQH2gpOJxjNQ5yOl62ltjOjDJwQII4R27bgY7jX3t0eBzYKiG2jbU9UTmBECbFZSZKuCCCegEy0ITYOVHDgAIgrKY2KYbZHGwe2wgHXbrmDSHfr8eciD5dhez8/tupkXTNcdYSt88aBeTiwUQ9xnsmOb7WpivE8XLeFhVaweYjrLrOv94WEwTeY9tQWOLAeIG5CGDcxiC3IQRvDKXOgifFqq7cF1m9hDKstgOp4Cj6sB4hb4OCVHsMU4nNKDNzofDc6rFNa2TbWjXPghGR8BkA8odmPkKPTn+Xpz2DE8q3/agX7Kx51z2uONt2dtwcbBzbKgRkAcaMzbcNamQPDVPCwt1aeauvez4G2wH5etSdn50ADxBKL24Ytcaj9fgocaHK87VVq67OJ9VkNENv6b2L92yAmdWYAAAABHElEQVQaBxoHGgcaBwIH2tVtpyQKzYo4pdUaNdall3rp/kYxp728IgfOW1JW8xBXXNErcRXBdWI7So5HvdyWel0OtN4bBxoHnBwYDognrCMveDNyDiNfdy7RdI+d2ninm3lrqXGgcaBxoMyB4YBYbnveJ4Zq96HvzTub1nrjQOOAkwPLbOFlenFO+Wo9tiLrTxcQr5aItNk2DjQONA6cCQdWRLzIwcwQpgXEDczzTCRmc9M4XtrTXujVRr9ax5sTpzagpTgQNfxuqQ5Pu59pAfG0edFG3ziwaQ5sBk8XHciinfnXvxPpduZ7Jv63Z35yozybedZTNN8AcQoutjbm4UDb1/Pw1dVqY76LTTM8NIjzg16aYfCbb7KfUf8PJ7OlrwwWHhgAAAAASUVORK5CYII="/></switch></g></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-32"><g><path d="M 557.15 364.63 L 570.67 357 L 584.18 364.63 L 584.18 379.45 L 570.67 387 L 557.15 379.45 Z" fill="#4286c5" stroke="#292929" stroke-width="0.87" stroke-linejoin="round" stroke-miterlimit="10" pointer-events="all"/><path d="M 557.15 364.63 L 570.67 372.04 L 570.67 387 L 557.15 379.45 Z" fill-opacity="0.1" fill="#000000" stroke="none" pointer-events="all"/><path d="M 570.67 372.04 L 584.18 364.63 L 584.18 379.45 L 570.67 387 Z" fill-opacity="0.3" fill="#000000" stroke="none" pointer-events="all"/><path d="M 557.15 364.63 L 570.67 372.04 L 570.67 387 L 557.15 379.45 Z" fill="none" stroke="#57a2d8" stroke-width="0.44" stroke-linejoin="round" stroke-miterlimit="10" pointer-events="all"/><path d="M 570.67 372.04 L 584.18 364.63 L 584.18 379.45 L 570.67 387 Z" fill="none" stroke="#57a2d8" stroke-width="0.44" stroke-linejoin="round" stroke-miterlimit="10" pointer-events="all"/><path d="M 575.24 359.62 L 577.77 361.01 L 564.34 368.65 L 564.34 373.22 L 561.86 371.86 L 561.86 367.38 Z M 580.47 362.54 L 567.39 369.99 L 567.39 374.83 L 564.87 373.48 L 564.87 368.86 L 578.34 361.32 Z" fill="#57a2d8" stroke="none" pointer-events="all"/><path d="M 557.15 364.63 L 570.67 357 L 584.18 364.63 L 584.18 379.45 L 570.67 387 L 557.15 379.45 Z" fill="none" stroke="#292929" stroke-width="0.87" stroke-linejoin="round" stroke-miterlimit="10" pointer-events="all"/></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-34"><g><rect x="625" y="172" width="70" height="30" rx="4.5" ry="4.5" fill="none" stroke="none" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 1px; height: 1px; padding-top: 187px; margin-left: 660px;"><div data-drawio-colors="color: rgb(0, 0, 0); " style="box-sizing: border-box; font-size: 0px; text-align: center;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; pointer-events: all; white-space: nowrap;">Request</div></div></div></foreignObject><image x="637.5" y="180.5" width="45" height="17" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAALQAAABECAYAAAAoXx8rAAAAAXNSR0IArs4c6QAAEARJREFUeF7tnXewJUUVxr9RMAvCGjFizgFQUdEVxVhmRTAABswBDJSKiVVMZbbMCdRFpUyY0bIUQQEjBswJpYwsCkYMeJ3fvT3v9e3XM9090zN33vOef1j2dvz669PnnD49W2gpSwQ2EALFBppLxFSY7iSinFOksVrLNmNGkbnp1eYyNxwzl4HKxBN6wRgsuPuBlqNFN3XArBfAMo8zntAtsJ6v0sPIJ1LmVjvPctnA0AjMM2BAQvcz0SWh+8F1vbY6HkInMDOhaOS65G8xsuN1WWzMaI2H0CNd2kEWb5BORgpw5mFtbEIvidLJxxgEvtROAuUzETp1VJm35bK5JQIGAZfQe0o6xUUnga7nS/qnpL9I+r2kX0j6lqTPmnZbBIGXa7VEIB6BKELHN9dUsjhdmjxF0ufytDeyVhJ2/chGXjuckU5pN0mbJb3aN/ABCT3tHg39dEmvWi+LuqhxppIptXzdvHK104hbq06KHaTJCyU9QdL7JT10rg/T5lpCFzrFuR0+S9LfIxd2u5KsO0i6ZKD8vpI+GNnmstjYEWhF0KRJ3VHSuyXtYmods4bQCTZ0G/LtLOkWkg4opP0n0gXmh1+cLU2uLunPSdNaFu6AQP+s6zC4UNXXSDrEKjQ4oe0B3lbSx0ubZ0dn1IdLekloJsvf6xFY1xRNW9ichC72lSZdzYO7lRr7U84cvi/pBmnzWpbeSAgkbMichFaiyVE7zJMl3cpZkE2S/riRFmk5l14QaCD0PN9iohzNhPbwt4bSLy5j1M9yprubVJzWKke5F9zG32iCVhv/ZOJH2J+G7gAoZIbUttzad5ETmCcO5s0lXUPS5co2L2QucX4liVPgvHicGkteWhIXTfRzMUm/lfRzSV+WxAXSepUh8NvJrBGOP3/msu1sSb+TdKoKnZv4zqI/QndYxbdLeqRT/zqSfhzZ5q6SniPp3pIwVXxCeJFbSeKV34xs1y1GdOa5JfB3lUQY0hWI/Rbj0P5L0j2M01uV21L+4YiVSvMaYJsz9ntK+kTCONmsF7bK7y3phMj6Q+D3AEmPL8d0e81S1X2CMvi6JCIVcOIfNeWINe8XObdfSroaZbubHKbHgOa+qKQzJF3WGuDfJBHegxRNgkZ5gaTDjDaOmSMXOO80QXi0Q4yg6V9RapInxRSW9A1J95d0o0ZCzze2CEIb/IrDpAlzjJFU/Lh3IHBw55jGrTKkRjzQENyt2o7QDhF9uRyJTqF3Si8qiUuYzpaPGW3bhMFFzE6+XwxQnk11kunjT7X1Z5VY6I9IurtbzrRJbgqa0SUEkRrmhrapZF5D2w0W2qbJ3OnSt4ZOws+DUT1+q2Bzip3ocfhjlowy3EXcUtIPnQrtCO00kpvQEOCZ5UnAIrtyO0kA1iRbJT3EKfDX8sborUYr/tTYZ9wg7VPaaI+VdE2nPCYI5kNTYtTrPJoZm49xH1seo38wp9mNjdY/2DrdSMLClg8TWhpaQ8fjV2gfTVrh9+zSNDvSg/nRpTI5TbM5/9dgdBtzQXJDpzxmF5vbFiJiV53+RaEDNRGh30q+JOkN1v9z2nPXkc/kKM0CjjY0wmUMqXD4sJlng5qX95QO1oEBMj9C0juqMkYhsAGwq7BjfYIWfbmHnDikL62pA3A4k7Z8t3T+7mScTV81NsiHJWFKubKlRPWImu0zJKHn8DODzI3fBcs1PrP0Ka5ggVB/Qs0KodG3SsV+qzpmurqYbqfXrFGjUzit7cvlKKQ9J2tzOWZ92Od5h1CHOZ4gRJ0zQG9sDAx92+Y+VRJOUEwUw9W4HGtXrrlqR4ND3krQzFz4oHmbBI2C2bSW0FOn0AvSUIQeCj9I+B0LABTNlYxGbsKOqNFPrNwMyj6tIWkta5QjsK7RP3PsYCpwJx9yBB9lylaN/1vS9cuEFEyMGEFTUxZwKyHL75VOZTxjQnG2c/wYp++m/jhpZllfq/xt0lBDEToOv3rFFIvfXcrQ5vEWQN+WdNOYBTIOOBERggU/MyfeUfNQrrQ0KkLjUB1nTAGO8hjBySAHpJL3emzpUDsQ63lWoa+YuLJd71AnrxZbDHuY/8aIq6GoEyB0scky5/tyCofCb3cnQoHSIuxJBCgkbBoUW8yjjwEJ7d/lXGdjy35tehFR6LyoYc8gwJE815gdFSj7G+csBJL9OxuCha0ELU+ClG3qYAff1yrjc05CfbJJbSdn0Ro6G36FdKLFNh9+lzCmGSZEJZhsnIbvMw57CL+Y3x1CF8dIk/l8aNNKTBz6wSak5XYMcJcyN0KYEbZGpSzHz6PLUNhX5yqG7W+fk0Z0IVa7V91x+cIRbwte9smWecClzrVWChQ6UpPppUqK4LjigFWyaEL3j988Om8unXTMNFc4mXmdhEmCn4Jp0Vba5XJMnUL7TeGMfLFxaMj7xvKWDs+3Eo6Uh0vCZIgVAu3Huk5VeB9ENc9FCFq5Ei5d7NgyxJzacQnCszL7Bc6iCW3wS5hBfFEHv+mqkCKAw06KQJOgPD5jsi6/kKi9s5ocFqEDtJrFC9/lzOo/JsZ4fGPt1R/Z7ez6PoT4cRUKJBLgRlq4uv1QWsfFQdKEmGvlGXoIvTK5sFPYDHHM1fdQ+NkwQWYul7ggiRHuEogQwRW0d0jaEXqNhp51E6uhq0GhrdBatuBkYZIQaA/JMxpixqG6nt/nGPJUywm8eGnrAawt5GV8MrETbHBb62fQ0LWsjiF0Zvzm0LDxc2HiHoLTmMgFD1mNBM9WLkke1xCDpp1EQq9GpnPcFG5vMuh2d8wGrjaZaFP8mcE/uczQeq2FFpshSmMHoZM+6txOYhIx3krSnM9Zh+4Rn4HQtfvSHa8vOak1fhEb2cWvrgq3tfcxqQT4LaEcElITSGiyY9p224mEXq2ag9C0RsyYbDc7M4y/f31E8g/eK/HdSvCuMQ8ICeUWLk/syxuuzsmkC8jc1nFjvimEvpeT2NTUL526GPgIPSR+IaD4nQjIXiY1geSlm9RU4j7gejV3FEMT2qsbSUYicccWokB3CKQ8MmmcB1vIqyUzK1oitDVtEZsmbloJN4z2Y8yY/ngXSb5KJU2E5gU9TlQlJF2RFNUgKzOhHvVt8RHawm+lbjJ+MROPLeOsxVXKiMfDTGjP/TpAnQ/TjtCZbOhqntzZo6W5fLDlB2aXonnXSCHtPJmF2+yQou3MxeKITUdYsemJFx8rOdQyjfDW3Wdiof7YfHbaZBOhSXC3E5kOmOU1RAkOF+MLEZqU3KHws8dCDg8pBrHpuigScmjsqBjrgZ3uSjtCm5s091NgqU6hPRhMGAbtxrubkoWo/z1jtlRtfb60ffk2Q4pUzhrxUGKgZ0jFIdLE1vSuQ8cJgv3H8ReWQps00a8d06qJ0PQ9TUQ30uRkuf274UF+r0vw7wm/6ell40fGGyYEpgIbKcWEYvwkS2GOzKTQVk3EJrf+anqVOBpCM7C3SULD2sLLEuxsEpB84l5bUyYm3XQVmpk2s80JjmvSTAkjVoKNz9Mt247GAcXrjhFf6mQTobk53cNqmKR4FMYacY5pnCouqq7rFKwj9FD4nVRIe1m3iYRED074dxV4bcNnvSrhHoMvI7lCDo6tuWtTIWJuCtdq6EgD1YyKG7sfeZ5Nkb/KjvYJBIPsOIOVQLw9pOKsiOt/NAm72hbSR61HuiuTeH5ZaPXJ1KxxEv3tpBvfGLnuhqD2GCnXRGjirnbaLJuLE6FuY1f9+h5I8FsdoRvwW2OH++YWgd+0Gr6D/W0VzI2blSm+mJUhuaJJSrIDB3UXW66fUpuiUEtoi7NdTI5qUmhoNLUrvA9cm4I569z3SpwMOsyEurxZ2qevNznvAc8pPyWFY+R7ucKny/hC6q7WlTihxQeVi0OYyick5RCvtu3hqlwTocnl5iWGLbx6wVH2pasSKyeuzy2sT5reFA6BH3Yz+dA2KTFJSMZHidUJOTV8p4Wc+UoIz5IdyVq54sbWOW1JWSDnZ07aaeiGkdb8RD/Y0tjUtqCZMD18387DqeRIIo5pC48suZX6gMnvYFKcAjhNLLx9hFX1QtEE6hLgdx/FEoHgGCU+iva5dvmol9wWQnW+B7T010RoXx4wdbjgYcMTdYHYLCwv2w+Sih3NiUTIDjNqhQSFtPek/pHsdlJxgjRJwq+QNnvS35rw43TjlLOFC6CjVei4Mk7PhsVZ5CTjoS6bF7Oi+k5dVQ9t/7Ia/rihSIqxcTjlWReSpLjQyfpiJURz8mR57Wt7tdRhEnbYy26HoxMNHnul6o4h5WunaH4yxNzYedO8fmOe59uRnNCLDS5i0NKuMgnhRwI8jhd2eyWhV981+EXbjDH4cTH16SanPaI30g3Ape6uAW0c+jrATlJxzlAauloA39s9wneQnZ3sE3Y2FzJcqzoffWzkAMcSmgBNHivcVvGVS163hIRICCYTL8VJdK8kRGjKYSsSIXDtb58/BT7kbeMw8XYvhdD0NQR+PEXjJMNMSxEIDH6HF9L5gcRoN6vR7Wf6jZehCY29im11eWc0XzRXn01g8CwKpw6HjY+X1Ak2HZ8wYPO0+cwYdisnBqRzj0X6xA4HXI5a7D6cx1RC0w7hO74fwslAn65gWnE68S2SarO3IXTVbhR+hXTmpD1+PFR+olmj7Rv+gRdCqSgaohd1iszFg5OA8pgW7ilfKYmjUo+9lN2XsezcocVkcMqIDnB7xm1T9U9gcJHDW7UcwmmAqYPdzAbEDkQrY9fblwdtCV2NEQ1K4hYEx8nC/uRJEjY9yfIRYvCJONsNGfrGD41NDjvxaZQPG5Y8FPwDIiCskx0+jZjjSpFdpGKzNOHGET8GH4p1Ie9+Wzyh48BKGVjrsiMaCnOYI3QhbSmPTjsM2Hqeo644skWYYVUkOyajxnhBg+uqoRc0bF+39SwdJX89U4jX0COCvfNQ8q7OBiJ0Z2QX3sBaQq9Z7Lyrv/AZ5x9AM6Ft+JZQ5kffaXH8Gnr8JFhq6N5pGt/BOAk9fhLbCP8fEHr9LMgwhO4ND0/DvfVVqyV6iXIMP414LTjmkvGE3iAI9zCNQTX06vh7mMmgTO02/rraG4PQ3bDpuoxRhB5uiMP11BW4XPXtTR5P6Fy9991Oj+vZY9N9ozLy9vMh24HQ+QaxULR7m8Z8wxvHVFjoagU770DourZ7Y0hwMuuvgMFqCVm2peuB0NnGVtPQAlZ/2uUC+u0bynXbfv1a1BI6vHzhEk14dau9bldiOXAvAvnYsA41dN+cyAdu3yPto/3Fz76bGZaX0ItHY36N+x5P3+33wdhRtpkPyLyENmDVDS/fsBe4KhtiEjn/DajFrEUTx3q2ahYz4WWv/SEw5j3di4buD8o2LfcNf77287Xkx6nv9tusTnKdwCR6IHQ+2MIteUqEKyVjuLErLAqwfvrtTuiW42pZbWNzazm7zgh0J/R0CEt6dl6JZQNJCCQ7hUmtLwsHEMi84aObiy7YegXz9JCnFSbxPx3+KoThbsRhAAAAAElFTkSuQmCC"/></switch></g></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-35"><g><rect x="625" y="312" width="190" height="30" rx="4.5" ry="4.5" fill="none" stroke="none" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 1px; height: 1px; padding-top: 327px; margin-left: 720px;"><div data-drawio-colors="color: rgb(0, 0, 0); " style="box-sizing: border-box; font-size: 0px; text-align: center;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; pointer-events: all; white-space: nowrap;">Forward authenticated requests</div></div></div></foreignObject><image x="635.5" y="320.5" width="169" height="17" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAqQAAABECAYAAABXnScCAAAAAXNSR0IArs4c6QAAIABJREFUeF7t3QecLc9SF/Be9ZlQEROoCJhRUcEAJlTE/MQEZgUVA2JOGFDxCZgQc0QMqJhQMTwzZsyKmDM+c0Iw6zOt+907fW9t3Z6ZnnPmnN1ztuvzuZ//e3tmerqru6t+Fbr6pgzaiQM3pZTbndoazQwODA4MDgwODA4MDgwOPB8OQFFXTgMoXvkEj+ENDgwODA4MDgwODA48Egf2QlnPAJA+0gyNzw4ODA48Uw7sJZ6fKfvGsB9wYKymsSCeCwcGIH0uMz3GOTgww4Gh8MbSGBwYHBgcGBx4bA48c0B6JlV8ps889mJ6ft8/58Se81vPbybHiAcHBgeO4MAQT0cwb7xaOfDMAelYCIMDgwODA4MDgwNPnwMD8z39ORo9PI4DA5Aex7/x9uDAdg48umZ59A5s59l4Y3Dg2XHgWvfptY7r2S3Q3Qc8AOnuLN3S4NiYW7j1VJ8ds/hUZ+Yy+jXWz2XM0+jl4MDgwGk5MADpafl7Ya0P1XhhEza6+4Q4MHbPhsk4J7PO+a0NLBiPDg4MDjzkQAakX7iU8tl7MinJgi9bSnnLnu2Ptq6eA3+olPKtwih/ainlo65+1I8zwL9VSvlq4dM/sJTy8atdGQp/lUULD3zHUsonh9//bSnlHY5pcLz7JDjwP0spnyf05L1LKZ96SM/G9jqEa+OdS+TAyQFpYsoApJe4Sh63zwOQHs9/AOfHTf+WWjsMkB7fv2tt4buVUv5bKeXN1w9Ij4JNgNtPKKX8+lLKP7uSxbAbIL0SfoxhHMOBo7bXpg/36opNjfY+PABpL6fGc4/FgQFID+L8vQT7HKWUDyml/Mw7MPpf77yd77jS1ACkB/H6tZe+fCnll5dSvmUpZc3L/Hw8pG2l+r4Tr75SKeUrllL+0T5T8OitDED66FMwOoADnVh2q644CXNPBkhnmDA8pL3L4yTTfZGNDkB62LS98134/ZNKKV93ev1fDkB6GCMfvLUu3X/0ZAB83um9AUjbbH9DKeXXlVK+V/h5ANIdluho4jo4sC5qdhvnIbpit4/HhnoA6S+YLNg9OiB/9P/s0dBo49lw4AkA0jOKhv2mNXveBiDdj7dLLX36XU7o1wwPrAHSb1dK+a3heTmkPKxddJEr88XIWucVBiDtmvXx0ODArhx4qSsmedKjK3btQG3sJjnsWkJiHCI5CetHo50ceAKAtLOnT+uxAUgfZz62AtLH6eXjf3UA0sefg9GDS+TA/lboIbriJJzr8ZA+K0C6/1yfZN6mRrf2duvzp+z7q7ZXenUwIH2aoz0PT0sphwiZkUN6/PRcESC9KeXmtpTb45nSaGEA0pOwdTQ6OLCZA4fois0f6XnhKgDpMwcePfN8yc8EQHo/0w8MpKud++MHdoiQGYD0+J1yRYD0eGYstPAsAenx2/qkczIaf54cWNUV51q3LwHp9MGLCtnPM+lc7Hueq3d+1Cfh+8Ee0mc+O6tCpsGfAUgPXTSvlv4ApH083A5ITyJe+jp7wFPjlP0BTBuvPAoHVnXFubbeU/eQOv3llPDbl1LetpTyH0sp/66U8mmllM/Yeeq+TClFCRJ1uP713f/+Myf4xs5dbjb3hQLPvujEt/9dSvms6VKCv1ZK+cydOvI2pZRvW0r5cqWU/1xK+SullL/c2faXKKV8/bvag+9SSvn8E8//4V0R/D9fSvl/oY3HBKRfupTyHqUUfPRPPykaa1B5GuDjv3eO9ySPLQiKVSFzACD1ua9dSvkqpZQvOb3vEM5fn/7tEdxVfsSed7DHvv/cpRTfUJ/yz03835uX5tlaJG/UxPz30/fIgK3z+1iAVAWTr1VKIcfsS/sR3+zHf7IDw75qKeUrh73wuaYaq2Tl3y2l/O1Syv/d8J3tgHS5cfLk601r5ouF8ZuPzlJSa2r3/ncHr6zPLzVV1PnnpZS/UUr5O6l7jwlIj9Vl5vmrT7ykT+iLfzPJ5r10B2a++yRfv/i0r+1xOgRPL5lOzT8yil5yickXKaWQmf9hkluw0Vb+HaIr8vzoA72gX+bz802XLFkvf7+U8jdtnrVJfYqA1Ab4wdO/pdOmwMtvuDut+QunGotrY/W7U/6UDjKBBBcefHQp5cdOyi+286fuflOe5BuEP/7GO6D6gR0f+5zTRiZ4K/22Usp373jXN00kXlT6CqWUfzzzrnH8oFLKd5gAg2/PkUUB9P3S6XTv2iJRrPqDQmMEFU/ad71beL9s4mH8lnl5Uyk3nziz/r7xXaWFnzKBf4s40z+922S/uJTyiyYFd25AalP9kOl2KLURl4jS+YOllJ83gaW1qTWngG2l91spmp7by0rufUopfzI8pObor1jrRPg9l2Gb85AChfaH9t9ppv1/Mc2ZuftfG/pQH9UX68IajjyKTQGHf6SU8pGTUdrzmQ8o5eaTwlr8SaWUnz29+M3uhORHlFKsyRb9j7v99Pvu1qE0kX+w8DHKGnjuoU+4k0PfNzx4TB1SwNMp/h+QbtjK/fh70179VaUUxmkvffM7YP79p70K8C0ReapawMeUUuzhFr3rBF57v//9pmL5c8+TH2Sx/QokZn1W36MQf+0kV+yhreQ7ZKCSXuRfiwD/nxH286kB6SG67MPuHAh/aab/X3Da4997ocoDR8FfvNNLP7+U8ju2MnF6nlH/I6c5A5wz+canTLKgOjeAVIZwpbl51qf3D8997P1lIGt2xqsXsq55091PP71znOfg39e5M7R+zHQ+AOCbI7LK7W90KIOxRcfqitomw8ylK99zRQZy4tCV+sQp1qSnBkgJ51/dADlLa8JAP/ROUPzOjoXzlptS3nlCYBWQKhpOSc3Rb7qzsG3SSrwOvENrQI61DvhF0tcexUVR/rHwIu/Du8100Nh/VgKvHay4f+TP3nm2vtNkWc290wKkCqz//skya733m1N9Qc+oywgEf3CnfOAN0zdGxzmuDtU/gpYx1ALKazwFBH/4ipfo8QHpQ+b3ANK/MCkfVn8PsYTfuMFKx2uK/Mc3DMK579l7AMYPvdu7b13p1AdM9VjrY/Y60GSuf0TPgCYQR4nOgf2dAenNO6yLl3sef9zkqescxr0nmyG5BK61BSgAzgyerQSImRfzk2lPQPo17oAT54D/9hIPHGAZjbi1d/Hit0/e17Vn/W5OyGQ3dO1ydejMR1uAdE2XcVrQr5msiV9yV95xzeiI79EdnCsM0V6iExkt1Sm09B7DCYDmcDoOkPb2rpRDAemp+Udqm1u3mc2B8dYoXYZCJ9HhmfYApMA/OcEw7iWy21rj4HitBOgBgLQTTvR279VzrJGftv21+zcMknfFpC1R3sTfeRJOc5NM2QkrCMfEZ/yNcF8iXhWKNhNgCWAuEcuOJVSJB9f4MuXnDmGfsOQ3WQDYGZB+00lALwkvYXzWUCVgD4AFtLfQX51COd8wvHSKqg+s9j98Z5l/o57OLeyAj5q8aXPNPD4gfdizNUDKA+76Sx74LSSEy5pfC3dbF594F/K0Dw8ha5dH9bMXXm4BUp5v3rctRMZ8j7uwlChHpp0B6epd9pQMT8MW5VT7rK/2MK9hi4Sk8bXHcJ7jH165pYqnK9JegJTnlgMiRpB655L33twzmtfI/sALKR1biCeaF/ycgLRHl0lHk/YWCcjh0DhkLalXyTBa04W+Z85EG+qFEbEPUj2AJ2l5mUQAgKfDPaT9M3cIID0H/xjQvJCHEocaORvpWED67Scv7CHOG/1gGDGQHtABgPRQniy+x6LmPcv0JyYPmTABj6ZQntCMzd6y3nm3WKhzFAEpJca6yyEYIYPK5N81hQCEDijYShbhz13hxJ++83K+d+MZXhkWwhJRFjFcbMysxEjfZQKG8W9CjL+mlPIHJi/If5qEIuXynqXcfFApt6zUTEAHL0CLMiA1rhziJFBqmgAvMAEerR9zQrDkvrpeEY/luAGFCop/8JSXOsefUwBSwItXIxJh+yvvQLTxWjc8HixB1r3xC5PKf41E2UkzmfManBqQ+na9mcl6ZYVWkkNsn0WiIIyrUg7Z5zkAMITFpI7wYEgjsXa+RWOyeuZJ9CHe1KMZisl60Te5f4xCYSEKjRD1zUhC+N96waDKgJRxKR+ykvDyb5lyLSlr0Q+ATQjKmsxrAmCzzyIBxTWEJh0geoCMhRyrZK2TZ5W2hux963c3+P2p081HIgv2ILAm1UiYOcourwIQ79lIrZAXSs7Ewv6e9zceT+FegNacaF96i+gFr2MGh4ySyGftCGsCMAhvyapIP2rKe61/w6ec/0pe60cGNjz5lFwcv+/z4lljUXGSV4xje3uOgEnjzpEp+XnSUqw70TI5fAx68mMunO8bdIE52osO1WXx+2Ry1pf0nz3Okym0KheZQUpvSN8w1kj/anLayLueI3JSLm8GnNaxSIU5MyfWkP0gTM4YQOTMf5n4XNvfFrLv5/hLQDo5HdZC9ifk30u3ByeJdRrHbG/RWSKwdI39+HZT/ia9xCEUqV62EWX9MbpCGqIoi1zRSvAUXPNHpz1LjtOXImtkMF5JRYz0Gq7pAaQscYr5UCLkCbE5Ivwk4kaBQeCzYlveiNoORejquZhLYWIcTpjLUYibOPZH3uNPnJipDUy0+Qgdnr7s7RROpyDn6AtMh4jyBHjeJhSKniMLJSbhA0bCRjFFgOKwIOqm1ZaFScgayxL9sAYg/j2TIGi9lwFpfQbYtWFZXoDWO92U8v63pejbzwkNEWA5RKbvNs1cTqy5FaqXu5ipB+hsWasAhg0e827NL8FoU80RhUiYf5/0AAAgzNSiUwPS+M1DEtXnAClQwADisW4RAxFgifLEXovrM79nf2VAwhtl7ufynoAE3gIewkgxLzR/JwPS+juDSURG/m8rr9JBPV59Xr1IwnOuZJ2jrYeatgBSCt2eiTm2+i6HMvOy9s+6th7t+0h4mJ0AjMGPT88B2D95JUVJCg8DQuQo0nvclPLpM7lNhxxqAmKtwTgn5DVDa278+gOQk3EMm0qAFADJUGuR3OKcP6gN+x1AykTu8TTOebJOCUhjX9Z0WX3WgRiOlqg/6RD7HLifI8YH4B91GyD3bRbeyZ5HS8L6A6paBMgAxG4xa9HJAen00SVAei7+kTVkWCWYhHdyKVWppeNb+722uVVXZAeidcP4XTpMBZfpO2xUSZQjju01N31LSCyss66fCAqofY5scgyuxFIS7vnjHa0DYAYZwQTvYLXCcxMtQGoDCwkvWXhAM0VTyWJgGc+FJG0kAjqOqfaRJcHijCfJYz95CVzXWokXMXu2jO/NaXB4ET0x9z/PhJdtdoq/Us2nbbG8BUjliflezpFtvW8eX3mzb8pnldv7vC9Ae4nkp7QS5/cGpDkcQkHxTuPJGhHKqj1QyJVe22Tht0sEpDyIwmVr/LBOAaNIPIXy9jIB89qNaR+UoHXSc+iEhyqCUl4cRpv/ZpoDpHP5dPF9HjbeRGCjkv2wFO4/AJDefHKwN3kzhFZb1Epr4snl4V0iYoCRFaNKgG32NudIkEOd3lnLl/dtvGLQRLCwpAQPAaTSmKQpVdIv8yvKskYMfR7PeMh0DnDw1Fmf8VneTTJv7VAYL1EG//o2D0gPy4I7VJdVPv3eO3DvUGUl+5sXtKciQUs25wOWtV1ARb5ppLkUtPgMZwRHBiCT6SkA0oP4N031Fv6ZF1ijkqiEQ4pr5FAToFkJHok4K76/FZDScTHNitzvcVrKw4/OGs5KWOhldY4eD+nawNd+XwKkwiEOQUTiXeOt7CVWaX5+LseztYktjh6Blt/NeZKxv7zK9cAE8GoxREuAgucVbhGXd/S+Auf+FimHwG34rvzHqRFenux9Bq5eSzKeEqLjKXtNELo9B0J4mbIXtAcI1LHqo75G2huQ8tbyklb4/kpY9imKDMQorlaqhg9cIiBlXPEUrlErP1A4l8GYKYe6KHmApkcZaoun1LPREOCZimClfjMB0vtJFSKMeclLY8sGMyMsVt3I7x4ASO9PxFaaA6QiSEBSHHNNKVqbG7+/V8PzxctTyxXxHmYjUSpGzgNd+pa2KMxKSznVWwEpg54siekQImQ87b2UPTucEKpGZCMoe+85D/BqEQhM4oIX1xmBnM5zDg9pry5jcBtL1P9kvKhUL2XPHQdJBLi1HXMUq0rQo2TF2mFE3XvXUm6V1MqRxscGpNv419YjPfwj5/LaFJrPecCtOSO3RWM5BOwbUWOHxFq0FZCSgTH1T8S3lUaUvyXCU8tT6ZN/5PZLZ+BjA1IMiuFdOXjyD7fUOmM9EKQxp0hZmNYBqQwqeVRM8Jy3MjI0W76QvvBsi6JgZuUBVvGErhPFQoWZ5FgZew1VC4vL08hWuXqDvLasfv8oTV7PXpI/FvPYvGextDxMLQ+pENhc+Db2wWLjgawk1CWfNefgzfW71c+9ASnQhIfAs/8KTwrhL1PdObf3mzyuYRvf/LTo0gAp7+9S6bU8xmzNU0Sf0HDT5/zqVlWGtRnI3kLruZUf3fKQAhwUZQ85TEieVKLII+jKbZwKkLaqdkiHWcqDzH2zrskWY/BP6LWCLF5BXq4qU3hphW+bsnHGVhOdiqFbkZ54ODP2ZysgzZVHtAUYrKUoxW8Ci/ZgDFPrr5ByJODqjSG+BJS38qTb6+emfFi5fSATPHdqQLpFlzlsS45WEnIFzHs84fUdayVGMXm5zGlMc2JE4TcdW0kahL3bS4yunOJ2ICBd9TD0Hmo6F//wyLzCBZWWUsIiTxlw+L/m0ffOVkDKwRbTKYBRHtOe9QOnzUbBjgCkq5NbmbPkIc0LYCmXcWkB5/pjhHROvqYX33L70MLmeeSB7CECKXp7gE5WcyYejJhLYeMbF0uv0lxagUmN5auE4oTk9ia5U7E/2peX1sqnyoBUmgLw2vKm5n5m75J5ouS2EFAUcxH3BqRb+tJ6VlhSCLkSj/9cKZpLA6S5ZuYar4w9HgLhkeJBjgQQMbSiAengyVK+eOu7FHwEYwSvdZmNnRYg7Q17+a7wfCxhxEuZvV+xf6cCpNnw4VVg3PUogdq/bqG9NtEzv+dQ3lIkZSsgzTmda4bB3BCkLsRqHzl8jEfkYAzXC8HP5Tu2vsOL+5ZkiJ0akG7RZVK7HNyrJNya023ml8CLVdTax9mjTg7mE/i9zoz6/VZ4+0BAurqqewHpcfx70Y0m/25K+ZS0obPxzkBUTYixN5f/vDrQ9MBWQJoBueYYDnL510rKLfbtfmKDlDr31aHZo8I7JQS/lbInDgJvFY7NHlIJ+0s1SGM/WsXq5a3lE9VZgQnv8d5YPPWUYT01mEEdxRfz05ZOv2/lkQ0glUGoEvDNIX6e2JZnOgNSuX6tvJ5WfzK/eZsogC2UQxtPAZDyJvHeMnqAqZiLt1Qz9nEB6U15xxX4kg81iTJE7+DavFkbQsOV5ENLX4lk7QiZR6K4curO2rcYUHm9Wtu57QxICXR7uScqog85vcV+bxX0rv09FSBVczPWQ1amTHWBw2g/aCrUz3srzcheiN4wIK6VT6nPWwGp8UbnwZZ0hcijHOnKQI6xkU/2k5U5D3KN7wyGWC7t1IC0V5fxnPG6xQoSPZVfWuNNBujNh5dyG0svcqbEckP0nUMtzXD9zJK013Ie+mMC0qP5F8aZDfgPb5SutKdaOeJ4SdY5dM1RJjK3xTiN87kVkHK62SMxt762R4fok/0qfa0jNeNVV3o8pKcCACaWVyP2AWN41baSfM6c58bNnU9JTwDpZbxVWRxlJ3op5zQ6lZoLQAs/qleIIvCcwkAvPwWoxkNBOuXkZz3QIH2BQGud6JzrrzZY53IihaDrP/l5wlutBVTb6gWkS8nRsV++xTCIB84OAdhCPLwjlU61HjNPAXhAs4bz8dL/5xUX3poTik8XkD7MP2ytoQxIt3qGMiBthZda+cu9+2/tuVYOXQakvLPR+7XWZn5felDM48zvnwqQEu4x79UJ+VxtYG0sh/4ORKg8EvcCGcMbvlSjdk9AmvNTDx1Lfi9HNHIo2vM80UppbSGpWjFKd2pA2qvLHCSUp3wkNeFj9ohzMEUHBGDZUxQ/903OZCwZtRsgTaPo8ZDuxL8m+1sRBWF3kcWlyjwasz4ZV8Cgf1u8p1sBqe+R7WvYSTTVwUh8ffNNKZ+xhpj3B6R1htctcAAob/KtOVF1Vlsn+Vi6+Qq77LFbu5ourxr17NROrKR2ZzytbtRKXNXTwzHRO09gtobU5IrXuq2V0qh94AmmNFlShF7MN9kidHoBaW8YV25vPpndytda62M+mXdKQMoY4IXCT3fytspOrfV3AyC9eb9SbnO1hKX2164Oje8eImTmrg5dG3P9vQeQqhXccyJz/pvzskU1j1z+JwNKRl9/ofOb8gHl9kGZp8cCpHlueKLIkFMRsOmgi4MqjNk5ELD0/T0BqVJgc9UHjuFB9nhPaVMPFhkZ21P9IfYjn3I+NSDt1WUMi55T2ofwlG6MZfB4bdXsrmQNL9Vqnfsmb1xMk9kNkKYPPgSkN+VNdz7HXPrrnPyr3ePNJjNzicE5fsnnlVZgPjjR1tbuIbrCt0WmRdBalx20+iZ9g7dX1LVpFO0PSPuXca636c2t+SX1a0LRufaok3z5NpIMSHkytxwGEo4CoqunEeACPmv4L/cjeohy3mauZZoPaSgC7saPF/RSPj4QlDxCckmWQoh5Rihkrv4H9b8cnrop5TMbFkwO2euTvq2RAuO+FUneEotpC+UUiFMAUlYo5a5aQy6GvtRX3hVrIOZjbQCk98r+uQFSCqreJb9lHfQ86wBNLJnmna0ezvydre/v7iGddrwTqbz0lQ5Jf+nhIUNSTrRway8IpQDta0A/XjF7JCB9IOvkBvcqvofjzAbMw/8vfB29b3RCvMWJSDzkNhqG+weGjpwakPbqsla1hZ510fOMUkgubqiUS+opu1Uv7rh/Zt1vdf8YIBPz8s8DSF8cvsqAtIN/naN6naOZf/kJuc9knIO4S9HO+B6nHKfOUuT5UEDqOyIl8ttFvnpvThO5ZlA7DPwgdeoxAakwyKuC+S/m8FAPaT7ggFHCqrlQ60ZA2lxYD+tqvsglVL8POT0fb3CKuXEaY+XXK/kI2Lcr5eatU+pHvK+XECTc5wqE+xbwtJZva+KBchta+8J+QFQLwPd6SHsBKfCewwZLpbLmBF4uEbQ3IJVP6DBGq2RJ7JOcMKeUAQ6ebAqYdyXXjT0lIJXGEUugzNX+0+9DhMw5PKTy1WJeqdtDjvOYvpolQldx/UhbAWVeh1vf3x2QTh3KSrmnlmMPiIjPkJnCfvGWuNwG2ST0KoSudB2vuIMXgJ3TthGQHAlIH3yaLIn5qfqZD2ZuHa/nyeF44lxoNJcBZKT2VgapfZA7GQ+kPhVA2jpoJO1s6frdXr6SH/HedEa+0l+VDj2IltM1TgVI5WLGagotQHpO/s3xXf48feWk+/t2pCDZsyqezJX1OkRX5L4pUSXHW5/ktpMla+QSjgc3OD4mIBUOzQmvh+aQKviaLQB5YvLFIm0EpE1+ZgASAVJc0DypQkzR6RjzSzVeAQVvolBgnY+5Eja1Q62cWb8BSjxu/gsYzV1hmdMDvLs3IJU7an5jDmlPEe/M9HxgbW9AyoBgSETi8VEJQbkX5a0A0bmcnGyEbAGk1m28QGFpA1sb+SDOJQJSKREO6FSSR87z1XvIaE3I5d+3Aspj3z8VIM05ib21gHv5ZZ8ClrnGKhkKoPnN2JyinbsQRB5/vLZwT0Cq7mwsQba3HKh8at0s5+DWknOgxeN8ZuCpANJcBUbf9+5b5YeT+7HKBgcUXbeV6MZ4y1YvIJXjGK9PXvsuJ0O8FrsFSM/Jv7X++p33Xl1zwBSYNpetGyIdghKlbaVr7AFIc195TvXJYUf/8rWx9fkHaVaPCUh1KFu9h56yz5YYay/eblAHvwcgzcXeeWQsYgDbd2vIVypAPdxUv//war6b8pHl9r5ear6yb+kqRHPG6zkVc79vGvCj6Fs3G7UWdaum396A1HezEpmrD7u08fKtPHsqIlac/KQYkrNGAMXeU9+5BMYSIM0nb+WrxaLoS3xweCTfJnaJgJQV7QRmJHsqn2zuEcY9z1wLIM3VJhxcyHdWr/GDTJQPKZUmZ+dkQ0Fb5snfe+tC5xI1ewJSaUaxugdvT76wY238Pb+3AAfFOtXc7A7H8t7GfMlu0Nf5hUN1mfkXOYsyb0td3h4e1mecGWDYR7IGt3hj6VPe9+jYmAOkeY/QHcLVvZQjRC1Aek7+9fY7Pgf4kXmwVEzx8czcQchTANLYJwAZWOa8ieltnnmQV/zYgHSvOqT5Gq+50kSHbuK8MOLC5eHhQhcGj3URuaLzvdAv6tO9onpjTE6Adyp+rji7EiQ5LDl3S83cgm7dWT13kvTQHFLfdugr1h3tPagV+63cSvTa7AlIc9Fz3+U9lt7QS7kcj3kzfy3iIagpG36XpB4PyS19s5W7dImAlEICcKLsaR1GWuM/hSoKsnaa9FoAac695bGLXqM1fvnd3mFAMWDJISH2esudaADgVcmhAx5JKRW9JEUqViBwGciHzry8texTvP1Ok2vlt+b6TGHz8C4VDDf2eK0tHsXLL9b4AbQAUTHPrxuQrjU+/T6vy9YRbU7/yIeROrvwsnb13OHpuj/jXhfOzQbp0vdaZeLmAGm+Envt2vL4XfLEnL1N+OPc1bLn4l/sn0oX1lPPLU3ek97iXE2sajB3acuhgBTQJM97qzbgsWhLTOvR15eX8vQD0vVF3ruI43MZEBCUcifX7s2ObfDsEU7xRPTc9aN7AVIJubF+KQYDpPEGijmvj5tFat1KbnRhff2y4JCQ2HQwoMn0HAbxztayJDnhXhtzYaljAKlrQl8dzHqhBMxv9vTNrR3hHflqUbDvCUhzGa8lMNnqowni2YubPszfa6/k06KtQzhzvGiV2bhEQGp8vMgRtPPKG35PAAARIklEQVQ+RTDUI0tqrp+yaPaPf7wh2dN6LYC0lSfPSImVOdb4lq8llq5ST0FnELYEJlvfcXmFSywiueJYVYUWbQWkDFsGbiSRqWycr/FA2oEKArzE1ozQesz7935OrQJAyPdeavX11HfZ9x5qMgae62goADmiRVtKDALsDJCaU4yXbi/MHtEM3rZ6tt1omMPuc4A0X1O6dkgozud73JTyaQlZzwHSc/HPHAGLLvJg6G1NQRCRhLEqzRlxWwCp6KpzAPoE44gESBnoJXI+X0cMD91fMd4PSHs/t+05g6KcYj8c1OFu7qVWDiCripc0016ANF/jZ4FSsAACohSzu7z2xQGOKKSFFeK98FFJtHhQvRzxt7l76FvvW9hC/vk0OVCVCxB7/zVAelPKh6zVE5s+zHoi+CU8V9pSriZvKG3sCUjzrS28sfnCgKV1mG/WWpt7h99Ukqj06uaqZYOPsUWwqxwRKQHSB41IeieQK/WUOzrHoSb9yRUl/G0LuDBQ+9uBwkqMHEZVvmzi3IBUznG8OpZR5orOOcrKYO4ue3vcidmYg9dbgs23AQ6AMYY+4806+BZ/23poKqfW+ObSXfPK0+WripeuAuVFAYBiWbtcqWRpr/rtjY2qFoyYeNPa3HNSTQD6HsqpC945n4d0vYetWqtbL8HIJ+h91XXW+aBZPnPhcJhazj0pOowWDpxc67YNSG/Kx5Tb+1JElUQRrPueWwV5U6UuRJoDpOfiX9Z/UuDskU71e18hINbwnrtdcouuyIBS7j+sk0tszq1CIXslqSIxbu6dVI8NSPUhJ8I7UGLQPeWBoHUHiaIgfa20RBj5XoA0n5jXLk9nLUvy2umx0IesIHkNYxJy67aZOHktD+naO/V9wEa4JOdx+J1XtnXt1zEeUu3ihRSBSoQD4dwyGOI4eSQc7sq1QPcEpNlDSkGax54TtUpt8U7l2ohLodTsmcYL1uHyZr4pH11um0bakodUaZB4R7e8sbUatUcA0nsw3FOH1BwTQMYcy/gwhoD1Hu95rk2rzbmbavYDpC/w/lodUpddMFgrraXT9AJS7bWM0d4QaE6fAU6tvarcsod0y1WU+sDTGOWw/i5dfcxIzfUR18r+8RCJFETqDacLYTIW4jXE9oT/n3NkjYPyjtUGrFeeoLXoHa9W65rRpwRI8S8bTvQQfaoSyxpJa/JclM1zaXJkDs9cLAlEtwP4qoYsUU6Hqs/OeUhziUDPqx0ey3i1vqcvZGVudw6Qnot/2fHlu63LeFpjEh4Xoo/lsua801t0BZkt9SweUjJPscTZ0pzKY3WldCVG5ssT+U8BkBJCcikjKJPjI78ul9+IA6VoMDheEUq42vhz17ztBUj1IwOt2Lel8AmvIaXbqm1HKfDyLJ04bpVsogQJk6UCuELlcoVaYFTfCVtlXDIdC0h5ZJ3si7k5Tu4KuWZLqX5bKJKCa90Csycgzda776tjKZS+RDzwwGyr/quw11w9Npco5Lq3FJ+5a+Xh4BklzMvWoiVA2so5XTNcjgCk993rBaSezWkv/sYDYF3oxxzJNxVOjmkcQo6s9NZhif0A6YserQFSh43ilZ4MQIc75rwaWwCpXHURpZiHTFZaV3P1bIErKUw57JkVWy7ZZKw9VU94lZykjlGQOndrt7rl2qKtqxPjOuAddtgQHyIpLQQ8zHnCGI3G9/Ja2ymWsAQ4HszL9Lxv8ybNGZDODVibGZjr61MDpECItRoxgHxh5YGWDsfiochLzLE1PjJsTp678U1ViEhC+8BiKycSFpAzzPnSojlAap5FguLvjA6AM96KWNukg0UrpRq0LkFZWh/n4l82HOh4+z1GvzKPjMuY8k1uMSIS39mqK1qGIW8uj+wSdtFv5dBmIzFPAZBiTAsY+DsrHSDiiXJ4AZhjnbGEYr2wylwMiXmceaL2BKStUlP1e2s5nXmR1feE9ubARxxLrFla/w5MyhchFCowfcNNKe9+++IWJ+3WPFXv8ETHhTHnaTkWkPqW07CxPp2/UdAWJ68hJYuEpAkp81sBu7FET9qegJQAA4IiWNYP3iSpEyzMusHwTjhf34Cc2r/MR+/P3ewiTUIIKh9GITTNPY8wYArEW+f4Vi1R/QD4Xh7wuinlfW5LUQ6oRa3TwjzATqLyCFHqFHlUrucEpAClvsfrMOu6tC70EwBgvOgroWkNx+sY67hfVCtopz2cG5C2DFUGNyPZmHkEYvH+LYDUeJVQERXKspuCspesWUqeMQcESQcSSo3UCnXnsJ3nec3sA2N6cRjzBY+BEQqZp+MlyGvIlDmvWe1LrsJhjTvg6e/2m+gZ0BQJuPf3PH77SjqUsdUSeiqRqIvIa5nLztAp+BO8dK8toJyTqB/2Ki+P2sV4QnZwqgBPMQ86y61HA6QL2UD5JqXKZzrEWgLiOE/ILZ42eoR8zoAbeKTDlygfPPasaJJ3gVNAkhebw0RbwvpzNAdIPZ8PCPubdQVkW0vkHRwhxY4sjx5z+cjmqdISIPXMOfjH6WBN5zEz9shJWILX3pzQZ5wlLq6JaUP6unSgeKuucG6HzvbfSJ9+U8rH3b6QdeaTbsRrTjTrJl9/ytMqbfOlUfJUAKlBtTwmK2v8wc8fO11ltfTOnoAU6LAQoofWt/PdyK3+8Fi43SAT4UnYrhElIOzR8krwEhAi5pYif0NS1A6OsVhZK5RbpbnQ1x6A1DfksuRbL9bGKc+IVzcWrt4TkPp+K/xb+8WDwxBiPVPweb/YdG6okKQdQbNQC3DZIs/zki4J1dZ7PFw2d7wucslDqg2hsqVrMgkInqNKTUC6nN76oKtbPKReBGwoqghq1tZE/J1RIyS+dKfyuQFpvsghjycfkFkHpK9PwKwnrmOuHOqxblqeqZYyr/1nGPD+A4py+/I9O5QQoB29a8AbkDHnuczF4zOv5oAO7y5PZKveYs/6EZXg0Mg3yeV3yVf1rYHvLWRPMVg5LSo9GiBd6DgQg48PipNvGeg03+pLL1Ut0KR1gy9bDy+KMGT+L8lORghjY1qj3aOx9hk0sQLAGiA9F/9yacHuQU0POjNi/S2lQ23VFRxY9sYh12vrFtlgXhnrL+n0gLRDQob+CNNzNbdqiM5NAlDIC7CWJ+L9PQGp9lpWn/7nPKfc91YtRhME9OTLAubGTdgBayEvcJXZNiphDng4PFZLvvgGgNsK5+8FSH1DeE/opud6TjluxkhxRI/S3oBUv2x43uUtIJEyte4A1pw3uCbI8EGeWc9ViAQ9j4GwKI/mFkBqP83dzmHcue7vOT2kdV3jAY9T9Ir3CFzClYeOJ3WJzg1IgRheSpZ/i3jOeNWq530dkLbboRB48N6h+wLGF1494GOuDiTj2jO8kL3EaONMIE/sa/K49zYxOZoAcjbq67d5gufAIFBt/LHCRU+fpYHhwVq5sNoWheukNyO+Rz6I6rnSWV5dLG/zFAFpHSOjnGyJEbQ1XpJLHCscDa+FaWc0kb1B7pF/a7xkbHIyWY853L72Lo813dxbhN864lV0sDIeXFuT4yfjX2NPc2AJi28FgLzP0jDWcvO36gpjtzd50mMK0dq68TuAzIh5LUWwG5CuQp3aje4HZ/sttCKHT0HmuZPqXnYAx0Ji4eUbmeYa3weQvhpjq55nz+07BDClED2cr05c90zpi2fwh0Dg7Wx5S+36t96+qI+q/BJhXHPZhPEog0itU5J7AlLfEh5wolOebUsA8sIA2sCyEPPSzVj9nFp/EhgHduVCzZE5s8EZHbFWafayCkW9y0rSvt8JGF7KnDLg+8IdhCqgzKODtgJS7xD+AH0rrzUnuT8GIK28FqJTSk2x93hFZJ4LIW9XHToZ3QMqzg1I9VfozBqe8wbFknCHAlLfAQAZvxROLSWX+WW/C0U6FT2XZxrfId3INR75XNUhPkeWklm8mPFGuOxlJXMAtDniHedMaMl6B92WACflLKfYP2HBOaBiLwnXMoaB3ENIP8ktSriVI2pd4oW9BqDlnNynDEjxgzNE4XIRHLJpjshnER7jnKuVvcZfaTqiZYyKFi95zRjeUnpaB3vWAKnv0y3kCUN3DpiS4fpRo5IihocA0hPwrwmkGHCwEX2/5AEWkTAOMjIebF2bly26oralH/SfQ01LeM3zAKhScOR306PeM7Frgzjl79zvBI3QnoFL4Cf8eCDkGR1Ix6PmAz98qtcAGjmHTspT5gQwi4hAZ132nBo/Vd/m2qVMCRu5PIwQnhX5PTy1c1cTHtTHjbNtrVE+FCEQpy94yQCSr7P3FZc8hJQVJSAnhwdNTTanWNdO9M7z4+GgedHlXhJo1gpvPAVKQOTakQfxeMeXKCgH7AAsSlLfKUG5tforV/BA2rgSDvxKeO3dyk15r3J7D1DtSQDaOpLasHQA8ZAvV1n59uWmvG25vTfSyUrrqPempfxdc0Cu8IBYN8L8rkQ+Uv6+Njy5tXKj5SmS86JE5psh1ntJRd23+mrd2KcMSOtFG9b8HmSP6ivlW08c+wYQtbds2KO/h7RBTpgLYxWtpD/IIuloyjr1lFHq+a725eVLK7K+yCRzFau9HApI6/dteuXh6MYKTH1HStV97csT0Kn5R0YyFt0EhodkJMOTfLEWRUIPXe/H6Ao6E14zn3Snfc2pJPXOvK5ev3sCQHp2oX+C9fSMmhzT9Ywmewx1cGBwYHDgojhwLCC9qME+986eAJBeP0sHhntKczxm4ynNxujLJXJg7KFLnLX7Pl//1A1AerGLc3vHrwKQXv+e3D6xp3pj8PpUnD1du2POTsfb0fLgwODASTlw0YB0yN5ta+OMgHRMzbapGU8PDgwO7MGBs0mes30ocuVRPrrHtIw2LpQDZ15xFw1IL3SKH63bZwSkjzbG8eGL4sCZxd1F8ea6O3tdM39do+laec9wyF18aT50xczad2iLgHTfTx0+m8/mzRMz/PIB6W4M2q2hZ7M280D34+B+LT3byRgDHxwYHBgcuHwODA/p0XN4Ofr08gHp0ZM1GhgcGBy458BTlVtPtV9j2QwODA6cmgMDkJ6aw0+o/SsDpENzPaG1dWFdGWtncODCluzo7uDA9XNgANJpjp+DfL4yQHr9u3NthM9h0a7x4Hp/H7N7vXM7RjY4MDjQ4MAApM9oWQxA+owmewx1cOBJh+bH9DxTDgxD65lO/Bj24MADDlwcIB2ia6zgwYHH4cBj7b3u73Y/eB7+nbw7HR/oeOQ8zBhfGRzo4MBYrx1MuuJHHgmQPuNl94yHfsX7aAxtcKCPA2P/9/FpPHU0B57NUns2Az16STz5Bh4JkD55vowOPhsOXLs0u/bxPZuFOgY6ODA4MDhw1Rx4voB06OknuLDHpDzBSRldmuHAWK0nWBqDqSdg6mhycOAyOHAGQDokzGUshf16eXNTyu3tfu2duqWxQk/N4Utsf6yKS5y1uT4/qdl8Up25plkeY8kcONdS2+s7ZwCkxy+SvQZ7fE9GC4MDgwP7cWDs7P14OVoaHBgcGBw4Nwf2leEXAUif7hUy55788b3BgcGBwYHr4sC+Ku26eBNHc418usYxXe8KPP3ILgSQnp4R4wuDA4MDl8mBodQuc95Gr0/FgbEjTsXZXdq98Ok5ZfcHIN1lhY1GBgcGBwYHBgdWOXBKbbb68fHA4MDz5MClbLsBSHvWZ+XSBR3U6RnW8c9cyjI/fqSjhR04MJbLDkwcTQwODA4MDlwnBx4HkA7FdJ2r6eBRjQVxMOvGi4MDgwODAxfLgSH7L3bqTtDxxwGkJxjIaPLSOXBlgunRh/PoHbj0BTn6HzkwltNYD4MDgwMn5sBFANIhC+sqGJw48X4YzV8IB8ZOuJCJGt0cHBgcGBzo5MD/B7pKhfmoAdgsAAAAAElFTkSuQmCC"/></switch></g></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-36"><g><path d="M 895 229.5 L 895 158.37" fill="none" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" stroke-dasharray="3 3" pointer-events="stroke"/><path d="M 895 153.12 L 898.5 160.12 L 895 158.37 L 891.5 160.12 Z" fill="rgb(0, 0, 0)" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="all"/></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-37"><g><rect x="840" y="229.5" width="110" height="40" rx="6" ry="6" fill="rgb(255, 255, 255)" stroke="rgb(0, 0, 0)" pointer-events="all"/></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-39"><g><g><svg id="svg-image-sCsqmCaBU5WXqcMXGNIv" data-name="Layer 1" viewBox="0 0 840.55645 412.45904" xmlns="http://www.w3.org/2000/svg" x="853.68" y="229" width="81.65" height="40" style="font-family: initial;"><defs><style>#svg-image-sCsqmCaBU5WXqcMXGNIv .cls-1 { fill: rgb(51, 51, 51); }&#xa;#svg-image-sCsqmCaBU5WXqcMXGNIv .cls-2 { fill: rgb(124, 124, 130); }&#xa;#svg-image-sCsqmCaBU5WXqcMXGNIv .cls-3 { fill: rgb(6, 237, 148); }&#xa;#svg-image-sCsqmCaBU5WXqcMXGNIv .cls-4 { fill: rgb(5, 155, 97); }&#xa;#svg-image-sCsqmCaBU5WXqcMXGNIv .cls-5 { fill: rgb(25, 87, 186); }&#xa;#svg-image-sCsqmCaBU5WXqcMXGNIv .cls-6 { fill: rgb(108, 168, 255); }&#xa;</style></defs><title>OAuth2_Proxy_logo_v3</title><path class="cls-1" d="M474.20933,196.63116a41.46679,41.46679,0,0,1-16.33506-3.18964,39.80757,39.80757,0,0,1-21.67092-21.83518,42.99409,42.99409,0,0,1,0-32.23,39.80765,39.80765,0,0,1,21.67092-21.83518,43.41665,43.41665,0,0,1,32.67012,0,39.8101,39.8101,0,0,1,21.66989,21.83518,42.994,42.994,0,0,1,0,32.23,39.81,39.81,0,0,1-21.66989,21.83518A41.485,41.485,0,0,1,474.20933,196.63116Zm0-14.07985a26.63714,26.63714,0,0,0,10.28431-1.9799,25.89889,25.89889,0,0,0,8.36072-5.50012,25.04229,25.04229,0,0,0,5.60963-8.525,31.04294,31.04294,0,0,0,0-22.11,25.07963,25.07963,0,0,0-5.60963-8.52549,25.9145,25.9145,0,0,0-8.36072-5.49961,27.6962,27.6962,0,0,0-20.56965,0,25.89233,25.89233,0,0,0-8.36072,5.49961,25.03434,25.03434,0,0,0-5.60962,8.52549,31.04279,31.04279,0,0,0,0,22.11,24.99714,24.99714,0,0,0,5.60962,8.525,25.87675,25.87675,0,0,0,8.36072,5.50012A26.63112,26.63112,0,0,0,474.20933,182.55131Z"/><path class="cls-1" d="M548.12931,116.11083h16.94044l29.59051,78.76048H578.26942L571.77961,176.061H541.41945l-6.48981,18.81033H518.53983Zm18.81032,46.3104-7.03941-19.69-2.8606-9.56994h-.88018l-2.85957,9.56994-7.04044,19.69Z"/><path class="cls-1" d="M636.67873,187.83138h-.88019a18.26469,18.26469,0,0,1-6.82039,6.43506,19.94541,19.94541,0,0,1-9.78947,2.36472q-10.23059,0-15.23483-6.26977-5.00682-6.27052-5.00527-16.7204V140.97087H613.359v30.91027q0,5.832,2.58477,8.635,2.58321,2.80482,7.53425,2.80533a10.50006,10.50006,0,0,0,5.22532-1.265,12.21407,12.21407,0,0,0,3.85029-3.41019,15.44293,15.44293,0,0,0,2.41947-5.06,22.69746,22.69746,0,0,0,.82543-6.215V140.97087H650.209v53.90044H636.67873Z"/><path class="cls-1" d="M669.01723,153.29138h-9.461V140.97087h9.461V124.471h14.4094v16.49984h13.2007v12.32051h-13.2007V174.829a15.54561,15.54561,0,0,0,.38534,3.57135,5.7936,5.7936,0,0,0,1.48454,2.77744,5.44914,5.44914,0,0,0,4.39988,1.81357,8.00547,8.00547,0,0,0,5.06-1.4303l4.07034,12.65007a23.83924,23.83924,0,0,1-5.44434,1.81512,31.8029,31.8029,0,0,1-6.43505.60487,19.66528,19.66528,0,0,1-7.31524-1.29084,15.54151,15.54151,0,0,1-5.44537-3.53675q-5.17107-5.05331-5.16953-14.37272Z"/><path class="cls-1" d="M707.735,116.11083h14.4094v22.1105l-.87915,9.79h.87915a17.85447,17.85447,0,0,1,6.65511-6.325,19.31492,19.31492,0,0,1,9.73574-2.47526q10.44909,0,15.45488,6.16026,5.00371,6.16128,5.00527,16.8299v32.67013H744.585V163.961q0-5.60962-2.64055-8.525a9.44018,9.44018,0,0,0-7.37-2.91484,10.82482,10.82482,0,0,0-5.28007,1.265,11.76092,11.76092,0,0,0-3.904,3.465,16.09429,16.09429,0,0,0-2.4205,5.11478,22.748,22.748,0,0,0-.82544,6.215v26.29034H707.735Z"/><path class="cls-1" d="M769.77353,194.87131V181.78115q6.48979-6.37824,11.98992-11.87991,2.31048-2.3097,4.73048-4.73,2.4174-2.41818,4.50939-4.50991,2.08888-2.08889,3.74078-3.795,1.6488-1.70458,2.53-2.69531,1.75726-2.08811,3.13436-3.73975a18.16413,18.16413,0,0,0,2.20046-3.24542,16.47472,16.47472,0,0,0,1.26449-3.18963,13.02445,13.02445,0,0,0,.44009-3.465,8.4276,8.4276,0,0,0-2.85956-6.325,10.93308,10.93308,0,0,0-7.81009-2.6953q-4.951,0-7.70058,2.80533a14.59773,14.59773,0,0,0-3.73975,6.325l-13.09015-5.3901a24.55547,24.55547,0,0,1,2.8606-6.105,22.76637,22.76637,0,0,1,5.06-5.61014,26.44875,26.44875,0,0,1,7.31421-4.07034,26.86184,26.86184,0,0,1,9.5157-1.59456,29.71878,29.71878,0,0,1,10.3401,1.70458,23.00883,23.00883,0,0,1,7.81008,4.67521,20.92923,20.92923,0,0,1,4.94949,6.98517,21.28551,21.28551,0,0,1,1.76037,8.635,25.00612,25.00612,0,0,1-3.465,12.92486,56.87664,56.87664,0,0,1-8.41546,10.945l-9.45992,9.46043q-3.74077,3.74077-8.47022,8.35968l.44009.66014h30.4707v12.65007Z"/><path class="cls-2" d="M447.03623,265.05824v31.9h-10.12V218.19774h26.84045a24.25664,24.25664,0,0,1,17.38054,6.82039,22.75761,22.75761,0,0,1,0,33.32974,24.22463,24.22463,0,0,1-17.38054,6.71037Zm0-37.18055v27.50059h16.94045a13.378,13.378,0,0,0,10.01054-4.07033,13.80577,13.80577,0,0,0-10.01054-23.43026Z"/><path class="cls-2" d="M507.31645,296.95821h-10.12V243.05777h9.68v8.80029h.44009a14.60805,14.60805,0,0,1,6.32451-7.31523,17.56035,17.56035,0,0,1,9.40516-3.02486,18.97706,18.97706,0,0,1,7.48054,1.31976l-3.08065,9.7905a16.79182,16.79182,0,0,0-5.94021-.77017A13.09674,13.09674,0,0,0,511.551,256.478a15.45278,15.45278,0,0,0-4.23459,10.78019Z"/><path class="cls-2" d="M530.74567,270.00825q0-12.42951,7.81009-20.57018a26.6222,26.6222,0,0,1,19.91055-8.14015q11.98785,0,19.8,8.14015,7.92011,8.14172,7.91959,20.57018,0,12.53952-7.91959,20.57017-7.81164,8.1417-19.8,8.13964a26.616,26.616,0,0,1-19.91055-8.13964Q530.74412,282.439,530.74567,270.00825Zm10.12,0q0,8.691,5.06,14.07984a17.28222,17.28222,0,0,0,25.08008,0q5.05952-5.388,5.06-14.07984,0-8.58025-5.06-13.97034a17.04544,17.04544,0,0,0-25.08008,0Q540.86469,261.429,540.86572,270.00825Z"/><path class="cls-2" d="M619.95626,269.56816l19.25041,27.39005H627.32625l-13.3102-19.91-13.09016,19.91H589.04651l19.03036-27.39005L589.4866,243.05777h11.43929l13.31021,19.03037,12.65006-19.03037h11.88042Z"/><path class="cls-2" d="M694.4248,243.05777l-33.77035,77.66076H650.20484L662.74437,293.548l-22.21949-50.49024h11.00024l16.06026,38.72036h.219l15.62017-38.72036Z"/><path class="cls-3" d="M211.931,392.63536c-101.38027,0-183.85932-82.47852-183.85932-183.8588S110.55071,24.91776,211.931,24.91776,395.7903,107.39629,395.7903,208.77656,313.31125,392.63536,211.931,392.63536Zm0-354.70389c-94.2045,0-170.84457,76.64111-170.84457,170.84509S117.72648,379.62165,211.931,379.62165s170.84457-76.6411,170.84457-170.84509S306.13548,37.93147,211.931,37.93147Z"/><polygon class="cls-4" points="244.602 112.007 239.295 131.843 281.959 166.856 322.055 161.912 244.602 112.007"/><polygon class="cls-3" points="348.449 195.562 348.449 158.734 290.209 109.179 244.602 112.007 300.209 156.67 76.642 156.67 76.642 198.05 348.449 195.562"/><polygon class="cls-5" points="180.489 297.175 185.796 277.34 141.87 240.558 103.037 247.271 180.489 297.175"/><polygon class="cls-6" points="76.642 213.62 76.642 250.448 134.882 300.004 180.489 297.175 124.882 252.512 348.449 252.512 348.449 211.132 76.642 213.62"/></svg></g></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-41"><g><rect x="889.99" y="182" width="90" height="30" rx="4.5" ry="4.5" fill="none" stroke="none" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 1px; height: 1px; padding-top: 197px; margin-left: 935px;"><div data-drawio-colors="color: rgb(0, 0, 0); " style="box-sizing: border-box; font-size: 0px; text-align: center;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; pointer-events: all; white-space: nowrap;">Authenticate</div></div></div></foreignObject><image x="901.5" y="190.5" width="67" height="17" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQwAAABECAYAAAB08AsmAAAAAXNSR0IArs4c6QAAF0VJREFUeF7tnQe0PElVxr9GVBRRQUGURV0JKua4hiMqJoIIKmDGxCpiwIgZJYuZZAJBFAwY1pwRE+uKiVUEUTBiQBEVAyYc5/emat6d+6q6qrp74ut7zju7/5nuqlu3bn11U9V0mmk6CXSSFtM1d9lbmsV5eBrAnMwk6YJyHo225hk9miHkNPDoB3B6S2sGjB3P6bwGdizwo+jueLRiBoyjUKjLyeTxLKPy/NSMpeaZck/bfWIEYBzD8LYrvN21PkTWQ96ZdkT752Da8cytrVz3mS6xBOZFfaSTv6eJmwHjSPVlSrazurcnpZxybHNb00rgxADjsDT8cLg5HE6mVd9Va9Wjq35wG1yeRpsnBhjbnpRZ47Yt4W20f2qzts/xDAGMm0v6a0mv7ib3vSVdO3TC9ymEBp6fJ+ltzp/vrpYWT2p4f7JHW+XV+vxkjI5v6J6ddI2ph3uppFuOb/YQWji+WTkHjHreP0/SNybE/d2SPrHJRDyEOVvxgAJ+Yfjr48oBhq6WtBfA2Jvo6vWkhsWPkvTvkn6y5+F7SrrGfH9CgFEjoib9rG5w48GGOR1iYVwv6e0TnP2npDeR9E/DuN7yW2mh3EDS/SU9cgkW/7Zc/FcUuJgBY5ppuo2kb1lapB+8tFZLoHvAgNGw0gpyy7R0A3W6vxbV+jnN7PS00goY7yzpd0x7/yHptc2/P1fSY7bO9TQdvNnSvfhBSe8WmsPNmgEjK9vJFgcWKgB9o9CVAYxkHwcMGNMoYqaVIfq5VYai9xA6qVKIx0n6LMPVIyR9ufn3CyTdYetcD+5gY4xeEQ8GMKpmYrAM9v7ic5cuxjsYLkoWxodK+n7nkmChHAnlZrM4y0P0c2KZXOSxxcJ4DUl/I+kNAlf/I+kNJf350qq4qeH0jpJ+rZnzovyaWyy9MGRCZpekJNXy962AUW7xNJ8Yop9bl0QLYNwrmPCRqd+Q9F6SvlPSpxhOny7p47fO+fgOhkzIDBiD5L6xGxQAY/c7x6Ahbf+lIfpZxdUYCbcAxk9Juqvh6CuWqVVckg9aAsfPm88Jft5K0suruN/fQ0MmZAaM2vnKa+VsYdTJcIh+1rU84qlawHhjSX8l6dVMX8QqiFnw2UtcbvzzJX3TCL528eqQCZkBY/zMtAHGmO2wktcddFHJycZjQ/RzSD/ld4yAagHjQZIebVp+/mYBk75e0hfE7zvphQvprcqcTPhE+6wPmZASYMDFu0h6a0mALETdwPXqdL0Wk9zHRSqYzA6BvzdaZhyILdHHX4bCOSy8EZQUJBbje0oicv+akv4h9EesikxZC7UBRkvL/c9eKYks360l3VjSK4LcfmtZP/RnE3TDBvqWIcZHnO+Gocbkb8PG+oeSXtXQzxD97Gv+FpLeI+gMscc4fubjRbV81QIGg7XZj6+S9FDTydtJ+n3X6ftJ+pVaRsJzLzNBVT66e6GoxzfPYkGhI72/pF82/6bm4lsbeELJCOpGygEGixbApP03zbSPFUbK+bGS/ruBh/govOAG3sPJyDbF4sU9fJik363sw8emvnSZ8vya8O6dlpcOMtcEsi9QJ71yIf3EciF8paQ/7unv74Ki1rD01KXMP8k8OCatemN1uloL3c9tcJ6PP5L0hCXIf/sy60cwv5Y+MMTvPmBZV8KC7KN/DNmer5P0F5kHx+qnb5bN5b5LYPyMsMnk1vsLl3r75KCbvRtODWBcJek6wwlVuiivH/Rvh901Pvp9SyX62FrJh+cOCzA6XalFETCQzQ+F3aVmuH8g6W7Bxat5nkkHnL8oWBM17zBHKMBnSvqvwgspwECpqeb9nJrOwiJ7YA8Y7wMwkPF3hGLCymGIosT7FMCPtrBSADY2pFZiQTIvzI+nJsDopCsXmxuabY/iyu/JFFnmeMZKpVrbbrIbz9YABjsyA4n0rE66U+KuW+ozqNOIxC56q056WcO9uPWAkXZBdm1hsCtR3oyJ10LEft61wpynuIms00e0NG6exWXAIumrvg2AsRYoFsbtlxvCJzf2yTR/zNId+4HEe3WAsWIhb2Gsvr9QGp5Qhc8O1lyNfnt24RXrmF03RbcLZQO4gw1HZU1T3ZlzSpXrL7oOmgAjbNzWAo7NYfn88BL0X7dxDnmcdcvcf2/q3ZJAUVh8sNc3L4NAnBvxdLNQp2FdAnZF4hu1VA8Y6RZLgIHfHys7WbDruEvI6oD8ljC3OesQybskngsUAGvjxWHXvW0AFDJJnjDjH14QzNMkfZx7hhJ2dk54w/fEgqAkHyVB4ejTEi7KnXvuM/cWxvOl7g7m+nMsSaxFfP1/DrEZFhTWo63ypU+K31hQr3Q8AFqvFT7D3SEWEomxPMv8m3jCb5p/t7ok9PWjCbn++rLfp4Q4z9+HxURZAJWn6IIlLI13T7iOxCWwpG3hGe/xGRbDc5ZzAOAwJyxWYlkfEnZtv3hTRY5j9RNeCA/AR6ykjePCEn6iGz9hho8OOoYlG4lYC+7or3o5lgCDHcMiDcrKQS27iGybz5B0b/MBfi2BoFqaEDDO9h0fw7B8DAkq5QADJWfctmze9oVPjkJZebMz4NrliNoWalzsLobFgEUDiKcIsMadYIe1ZOMS/j0PGPH7/5X04AD4Kb/+LZbgS6p9Fdw+3+Yx6Sm5z1F90HPVZgtgvF4A61hcCA/wjg+/kuVFIsv3za6CmaeQ4ePd45+aOGwIAH5Z4QcmOHIAwL+ja++dJD03E68fop8AODpoEw6AFxthbvywBGD+mHPfKNIEfDbKI0qA8XPhgFAcJ0qP0HJ0lyUy/7T7EqSyO0jP65oQMM66mRYwOj1PC3u8/awPdmAyIwS1+ojDViiuJXZa/EZP7A60awNp7BCMpyYLQmDVggYRcfxu/uvt6BxgfFrYkfrGxA7FbszOG+m7Cu5MPWCsWmwBjIcEkLM8YwlhIfUR6+CZLiaBleitNawsa40Q1GdOnNedhABkxYZj11wKlCKfQwCDcoZvMAOFL+b3Rwrj52usGywl600gz6+27/YBBqiI0hpTpbujtOgr+watWQCYyJHwaTF7amjLgLExkUMmJGVhcNaBnbZEoD5mqCXMVVv0Fr/jfAWmeiR2SRSuNv2FpcGz9jAdx/etMsW2U4DBvSbcb1JD7EwfZh6MFcC5d9sBo9M1Zknmjrejp+irHTML5SNrBiHJB/d5jbtPKCGA0GlcLku4mj4O0dcdbeGmRMIlxTVNUat+svYAOevu4YLZKuzzftJmDZaItapIn5P1W29SfYCBmUUlZ6SLiJvu9FHLDr7EvEcQhUmk8xJtGTA2um+dEF72gPGnAZlL44rfY4UQ64mEq0KQzxO+4/uYD3ELfSyjv89OD9HizKWIRFyAPLynFGCgZChbDZHqJY0biRSlXRS+jXbAqLsPg7EBVpbeN+WH9wwKQCdFzhj4w+fnvxAxCKwJdmL+cM1xQ/+vRkjhGaxvrPBIFDdiFaTogn520hU9CQQseawkSwSv/6SBP1wa1mCMN/Eq/P5sbKMPMIg/EMCKhPJZxcjxQcwiCjk+88XLANnXVjB+bIDhI/qlIZJSfVvzEIiOq2IJhf0XF7TCQktlH/r6A3Bs0AorBR/fByRTgMGC93OY64uIuk0Rssu/eQ9jFYDRawnmLIwHSd2jjXfABkUmoyFJV389aGmiM9+TubAZL7KKudR164ZGvYx1H0rAvcniucgBHcAnEkYDm8IZ5QADc5SociSEjhJs+NuZYA3vYNJSGRi7ebG0AHxKkzccMFbMlLIkVkitE8K73sKoBdHYL3EITN9IqftDkNu1Ll9HTh2waSECf8jTUuoaxXPAWMmQHZPrF2t3ToKcFswoUCNekqMKwNh4tTaGQc2BPfRI/I3sUJF69Lj4bsUDuDJYP2SxAH57spu0vL0uYox++nhjwh2rGmm4wmL97C/YOGYOMLh2zgY3cSt+r0I48RH8nlgaHT+r8feGA8aql10DBpPNpNeSBwxSekToLfkFWNt2zXP48z4A5i0MrBsb+Cq1698v3SuyLcBgg7NxF3xxny0qjWXo968TsoG4KmSP+GODxJpM1uiE5TglYPj4yNCx+PfYqNY37KUAAz+GXPJNpuoxtEOqjcXQV+1ybIBRuvzFi7AGMD596R9/28Syj81RIu3Ta37Bk07j7EgtHQpgeOuPW73s5U6146l9DjCgJonjC8QKShnHVLttgNHpih4bnVT7Ni5H3rAYU4P8hExhVmLA0WypMnXwoTFV8UFzNAOGRLwnnuWoVd7a51KniFsXvO+r9f1pLIyLKkdQnp09Urx+oVY2tc8RtCZtTbq2FiQohCIFCxDbuqQ2wOi/QpLYlC/Wqh1T3yZOKp7Y13qr943+0sAa+Rrm+gqIeH8sYOA62Z8/uFiHca5oU8Qwmi2MTrrKBHJSLglBMHsvKkVyU1kcpEB9Wrx1we8VMDrppYv0Tuovp94I1lmmq7a3tDbjauPTY1HkiOkl1oeLwAFArEqCzyw8KlCpRI00JWC8XJ1uaiwQ+PQHQteLvhRMNDwCROvUr0dIcrhULdrPCSRxnqGVyAtzh4aNZZCGpBgmx68HDPL7VMjVEDz7QN20hVsXg55NgNFJ1y02g54pwEDeBPAiYZmxc9QGIbOySi2UTrrXYrMysxSDGA4YKwamsTAujpIDU6RRI/VlIGr0yT+DPrPwKSe3RMyHuBDfMTayi7kj//4SqikBg7obe9fp+ujBCIC8ICcPGD41QxCRasN/Xb3Z3PXGPRmh91yxEl+TCrNBIlJQ9jcp+iaa93ytx0EBxmq36a4yeJkCDA4lEfG2hKk9xZ0NKfkdlYURXNqUr06MjLFE+hl3Q1wNSOBuUINAHMdvah7IaY954nOfjcr15etrpgQMl5k8O+919jtBU5IFDP4flLJ+IHljOwmtfXNIB9S11Fd95081Ek/hAFYNpSr1DhAwNtKqKcBAaVFAOzepYGVJJlQ+ku0oXZV4KoDhYz8EAW3FcUlefM+uzFUCnL/grA8uRCxCpKKTey8iEYtjR8+dq0r1h8VtK1E5Cf6ADGOtLjNu7KqmY7Wvv0Sdbl0sZAidG1OAeAUWUvJeEKuUnEDcPPPR6T7LsxN9B4myk2AYwI/iEEskDjUR/AQcPLGL2qKflqv+Ur/ItgkYmwZS64TAa+nGrZJS1mRJaMNfWERcySprqR++//BgKmMdovz8cWeFt1ROBTB8oRoyYBPh5GYt4fdTLxGJYkOACAIg7NmevsWe6o+Dhrjklij/JyuWolb9pOqUw5+WhtzgzwZPBggrC53hV+nWRZcBMM5WElWL3M4TiZOpCMhXBtYKPz7HEXdf5Um6i7SXp/XhnrC2OSpuT7/m+qY6kqCXvxawz8IgHfbjpsGadOKuACN1iKpl8hEf4MQR7Ui4a+y4ALalXQMGpym5Ki9uhaVDbonCre6WiTAYwW6qTG3MrKUSl4AmC9reW2trh5Cb/S4bVM0oqT8QyGP5sx6rdG2LfmIZYMHYcgiqNi0AltYulw75n618oNQ9Nso7WhgUnrDjc9dhpPbzC2l2SCURNbbn7UEuzDkfyPOgxSQRJM1daRZ7ZPI4++KpDzCIpaxr5MNPJZZqT+oAIx/quU6drjJmYsolwaS8hRZnY7ZpMmTIScmaMzlYEr4gjFQtWSpPuwYMznvYMy25Q3GRz9pKT56PLoUdI9WePiaU0tRndNK9TeDCB+i9hbFRAVlYifDAQrSAwyt9t9IN0U9uSUOnLOFSre/j7YlCUoEKmNsrFzAa+Pc6RhMB4/zuhfOuSP9YhOuVSSEc6k092to41BIa564H+ytXfEx6itr2VP0GAIeQ2KVS1AcYqZhH6Rfo6wAjL6kKl2QtSSwwv8CJMeFqwEeOiHdgLt/QBKm5+IbYVOrmrUrAyM5w5ftrdglG2pJtFjO6kMuctQAG5fC4c6vbsFaEP45e5X7wmUXMgrKXKfEelc72jIxPifIMvJGq7iPWFueF7MVS8XkygPakr21niH5iXVGZae8DoU1OxWK1eusy9kcQmfHZYwt8lz3e7qO3KBhCT1xW25wpoWNcnae6N2EQ5bdElSmn63ywCqTj5CAnLgEOAkfcnEUUOBaVYK2wIG3aqw8waAMTzhK5cmI2Mb2LoK11swPAWLPDHROkCv0xc4qASHPDJ8pBWg8FYbIBTptajI31ZZtaF3xocz2ble+vn/fHDmjvWnV6thZn92owJ/YnKjYAo6cOI44VE5wrA3wGkM0PC5YjDug3WTXiHgQK/Q1aKVPeuwj0R2AQd5sx2avycOWxEDhcaBchc2etDPTVnLna0MUL+tlJrwgp8Jx+0gDgS/rWj591RT0PYyN1zveUr3M9A4HXdXFW4ILYD/LZwABewjXw9yz0+VYFQE1+jcvDQrdXuoF21H0QO7BE+ThWhh9wqV92CDIMthy4DzBoj7LXvjJoAM1e97ZLwIA/FA9F98hfkkX8nl0bkx8rLEeVC36y9/1dH75hYlH2ZqoWCyO2RR9YWd4FqJEbQT/0BlDxRIofflIEcBNgRtdTZ3GeHYCQuFwkNkJcgdzO36qfsV2sI8Zvixhrxh6fwaonfuPX5tmi5Mj6+vhqeKPW72thInU/5flpz03zAzOOHHVNqSsoz6lPzD4sghbAKJXBExfhfo9IuwYM+kUGHKTiGLmNA5VkT6yDHa6U5ZoMMMIUlgq/MM3Z5XN3ZlD7g6sZ41tDAAPZoMNsfC3nKygjAGxylyZTo8Ez9k6L0jyQNHik1D1KWrBhcidKfzXyeYut+ml5AfQYv71Qp8Qr31P2gAyS6XjmGJPb/pYG5g6+0Ar1BnkgSb58EIeHCOQRVElVMZJeBczY5W0wNjaOecfuC9jFW5FaAYO2ACdM4NQNy6b45UwQK8A4l0lTpWdwmay1kA56pqeV25+IafBzlfaItH8akz7+xkSpBoOhlCs9+3VgCOCwiNlAcqliW6g2FDCQCwsUGXNRkb9uL8oNK4xyee5CDXGO3gHzJTs4Fm3fj3XhomBNUB+BpRDJWymlW8Eq9TOpNGQPiWnxh9WWs9pZS8SWqI5N3QC3brzV7K9BqPQzw4GHHRZfCgC5eTjCzkEjjjOX7tGs5Le7ibTA9+eMAOCEqcjC4yyAz51Xtrm1xzCzuUOUBYAfTmYHUxiXD37Pb1jKynz4ZEw8KvL9ACgAgtICcJRW49uX7y5tGwb+OouG2Bz+Oi4ECxk9qq3U9MNnDoil0SZ6gxvDjeRYUC+qYq/qobM5HqufuLfIGl7RGzZpLCn0hbs80fki7Q4wiqzMD8wSmCWwLwnU4VZ7YHFf45n7PQgJ1KrVOGZ308s4Hi/r27OFcVlnfh73LIEBEjgtwDjGrekYee5VtAMe0AGzNmDtbu2VPjGdFmBsTYRzw7MEZgkggRkwtqAHk2xkO25kku62IMu5ycOSwGkDxt5Xwb4ZaOi/4dHDUuGZm8ES6KRuUf7tD9v+dIDRrHDNLwyWy/ziLIFZAtNIYDrAmIafuZUTlEDXSYuGW2eLIpj3mqKImh5okOcMGE2SnR/enwQatHp/TJ58zxnAOOLJOVTWD5Wvo1XxExLoBEOZoIkqTbi8FsauJFw1DQf4ULN8ml/YHPTI1w9QggfA0vRCvbyAcQDTeZlZmF6VdyfNY+Z9rJQ2AOMyC2KsINvfn6XdLrP5jbUERqnP8JdPzMIYLohZFWcJXJTArE9eJhMCRl64l0nshzzWQ+btoOHqxAQ3ZjgTAsaIKR8zghHdll89WMbKrB/NE3uS8YBuB7xyNLNQy+ieAeOYpuCYeM1N/57GsINuq7uofrB2CU313A4ZG9HVngFjKmHP7cwSmCWwCwnMgLELKe+1j9R2MmKL2epYpudr+hZrBLCfXms4G/vM1gHjdEU3VvTz+5dLAqexErYOGJdLKc5HO0Y9xrx7CvK+7OOfbA63IMidAMYW+J5MpnNDswQOLEQ80YRsZ9X9P36fzZClWpGnAAAAAElFTkSuQmCC"/></switch></g></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-45"><g><path d="M 680.01 239.5 L 833.63 239.5" fill="none" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" stroke-dasharray="3 3" pointer-events="stroke"/><path d="M 838.88 239.5 L 831.88 243 L 833.63 239.5 L 831.88 236 Z" fill="rgb(0, 0, 0)" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="all"/></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-42"><g><rect x="570.01" y="227" width="110" height="50" rx="7.5" ry="7.5" fill="rgb(255, 255, 255)" stroke="rgb(0, 0, 0)" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 88px; height: 1px; padding-top: 252px; margin-left: 591px;"><div data-drawio-colors="color: rgb(0, 0, 0); " style="box-sizing: border-box; font-size: 0px; text-align: center;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; pointer-events: all; white-space: normal; overflow-wrap: normal;">nginx<div>istio / envoy</div><div>traefik</div></div></div></div></foreignObject><image x="591" y="231" width="88" height="46" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAWAAAAC4CAYAAADdeza6AAAAAXNSR0IArs4c6QAAIABJREFUeF7tnQfYbzlRxt8rHQSRjoBKVUAQRXoTpEsXECnSiwu6ghTpVUARkKJ0BARBei9SpChVkC4KIkhTmiBIx/X87k0u82VPyelt5nn22d3vn+Qkb3LeM5nMTA7JxRFwBCoROCTpOMfHERgJAdaXiyMwDALOVsPg6K3sBgEn4CmneoMEtcEhTbki/Fk733s4Afsr4Ag4AttAYIXagBPwNpaej8IRWC8CKyTOocBePAFvf27yRphXaqhl4e1MhoBP7GRQL/FBiyfgJYLmfXIEHAFHYAgEnICHQHENbbimtYZZ8j7uDAEn4J1NuA/XEeiMgH/EO0NXVdEJeHBIvcE8BAZ5m98v6RfN835H0hPznu+l5kdgkDUw/zB69MAJuAd4XnV2BAYiYCeC2Wdypx1wAp594v3l7zEFAxFwjx4suKqvrAVPTuiaE/Dy52jCHg77yg7bWikMTsATrg5/1PAIOAEPj+mmWpyARPvg9XZJFzQNHCvpaX0a9LqOwJQIOAFPibY/a/cILPyDtvv5KQdgvFnrTMDjdcnXgCPgCDgC+0CgMwGvFR7/cKx15rzfjsBKEaghnd0R8Eqn0LvdGgH/1LaGzCtMjsBkBOyvw+Rz2/aBp5R0KUnnkcR/f03S5yX9g6Qvtm2spPzpJF1M0jlC+1+W9GlJb5X07QHa79vE2OPv27+F1/c3vMsETUbAXTrndQZDAPL7kmntdZKuGv7/nJIeJOn6kk5c8sT/CyRMmTd06NElJN1X0pUlnaCk/jckPU/SvSRByj8v6Z9NuTdKumLFc3Pd0KYYP/1+n6STmb5+V9IvS/poBm6nkMR4zmXK8mG6iKSPZNT3IitEwAl4hZPWoctVBHQzSU+WdNLMNp8p6dYFof4wozxk/qiC+O9YV9boTXwg6A9a8VQEPPT4Gevjk/G+M+ws+JDVCe5zt0oK3D7MTwbcXmSNCDgBr2XW+u3wygj4uZL+UlLbNfCEwiRxTANsJ5L0MklXawkvGuPdJD12Ag248/gPScfUXNT56pJx30XSo2uwuJ6kFyW/v7DQfG/QEj8vvjIE8l6+fi//rJCsuOtD4pYS8CclnUXSScJDMANASNhj/1PSqSVdKGi7Z046giZ34bBdrurjn5eQNOSKtg2x/JskSPr8Qeu9ofkQwG12XY5hghhz/GeS9KFCEwbzKN8qCPYCknhuKszDB4uPzmnMD58qPmC/FOzwQ66DjbbV4Gaw4Gut8wh4kmlzqhwR5pSA7aOwv7J1/mrJ808u6TkF2V4n+e0vakwLl5P05qQ8hHsNSR+rGOPli4i2FwfiT4uMQcBjjp+2weslyUD+TtKvJbfcs+hfH/4ei/9A0mUlvWP49eDv2PCY9mtxQQTcbyBeuxaBKgKGXG/agB32YQ6Rzp5oaPb/bRNvKw7rLm3+gG0Xbe5zDc9Bqya0OD0IHJOAxxh/HOZTww7CDju16d5V0iMSXDiMfNhu1vPOvwkTE/DO0Z7vrSojYLbFbH9xN2uSO4cDNVsOYsasYOUXwvbb/u23gpdD0zP4/d6SHpIUHIuAxxi/7fqPBzMNXiZRvi7pvJK+EEw870o+OIwVb5GmA7scLL3MChCYmIBXgMg2u1hGwM+SdPPM4aLRotlawdb5X8nfHizpPuZvn5H0sy0I5VTB9xiXrChjEfAY40/hvHjhQvf3ifvdC4Ld+73BBh7rsFMgsRA2eJedIOAEvI+JLiPgNrdHYG5ID5D4G4dFVgjauKT5w2MKDfv3W0L8/OT0fywCHmP8h4ea7PMeWHyA7pdggN33SuZvHBP9ehGo8pqWWK2++N73xE7AMy3hiRdeGQFz8JUellWhcYYSbZeAAQ7XojCkb0ri4C4KfrbPbglxahcdi4CHHn/VME8YAlkuWoPDIwvsGLfLzhBwAh55wicm2qrRlBEwB2NEXuVIWf1zFwd4nzCVcVcjdNkKoc0crLWRawUf4lhnLAIeevx1YwSrfyoO3KxpJZb/x7Br+H4bkLzsNhBwAt7GPDaNooxAyfnw8aaK4fccAj5fScgsvq8fznxGLJa6sY1FwEOPv2mYt5P0pKQQLmccytkPWVM7/vuGENg9AS9EQx17SeUQaF0fcuoTuIGWZwVStmHFOeMkd4TVmsci4FSD7zv+prGVETB17nCAmHeyIJvA2svvuyfgnUx0DoH2JaCygzq8AHC1aiNXkfRaU2ELBIy9HHNPmQnif4OfdO5upA2WOyq7zi+XE/A+lmgFAR/6hJQVp5lD4LiQ4edqhei3V7WE+MYh+i5WWzsBkwEO7xBScVbJu0PCHkwSLoMisGxidgIedLIX21gOgfbVgKmP3+9ZTUNdoroeXuQHvseGNOD7F2N5QAIukW73TP6Gu1pabrELyjs2DALVBLzsD8cwo99PK1MRcOrDi/aLFtxGCFzAe2ILGjCuZ2i/uKJFISERIclPL1Jv3tL8nRSfBLyQvtJlowiktOoa8EYnOhnWVAR8i5DiMj6eLTUacRoxV4U6ttLUFrpWEwT+0Nh9OeyLwg6BDHBknyPjHDk2bLY5vCE4zMQu7LIDBJyAdzDJITWivRGDUY/hBcBtECTd+UkDK4nGb5MJMxnE0sxrayXgJwZN1w6dW0i4jSTKtQvCfWmCzVMKf2o8Jlx2gIAT8A4meUICBs00HwR/y7nZoSwRD3XXSMCEFb8yWVpVHyLyMN8oKUswyiv2sTT3PUon4FnnP9PQnlmsZihTmSDoAlnSSEhu7zbj7+QQJifCV5J+kpHtTyTh/VAmayPg04fxn9EM5rNFInoyxaVeIhRhbrjz7QxmmtmtEMSSa7qZdBX3X46TdnfRD3MCXvT0DNa5KQmYThNMwQWeNi8Efyfclls3SOyDexbRaJS1l3ViH+WG4ii0YxPXWFC6XspJG2OYYGgXkwKmBStoxFxVVCXcCPI3yY9o0NccbAV4Q4tEwAl4kdMyeKemJmAGAGm+vMWFn9Rhmw4B2wxqZAi7egUiSyNgbN3YcK08I/F2qJpc7oTjbjgrB6PkcpbFmOrpmG3njG2DZdoRsE/AWpfAHAQMVlzVTv4DrtipE7KokUeYyzi5vPJYUxiN8rorIGASr/NBIBF7FJIT4fWQk/QekwVeEfZuuBVEyW2IFGYYSjsCXiv9eL8DAR9YYWNtwVO0eSh+vdcvDtQuE9yuThvuoMMUwe3JfxVuiaBu6j3AnXXcqlEmS9GAMaGQsB5zihVMCOlhXN1q5HoosLCSGSU3A3v4e9UbASfg3hAuoIEVvHstukj+4JsYVNGKrUa8AMC9C2tBoMW6m2VIyyHgpSM1y/Ts8qEcunF7cBRCdglPdnEENofALATsXLu5dRQHdMXCzex3w/XzXEH/vsJ++4EWo2Urz51omEyiEJiBmWIV4mt7FdO0mE7OQsCLGf0mOrKoV54bfY9Eeh3pFv6vZ2sBM3kj0gAEQpmbrrRv8YjMoouCNbPPXmx1CDgBr27KFt3hnym5qPNXJb2lvNcHWA6f4fdIIol7FK7ruciiR+ydcwR6IOAE3AM8r1qKAFFdlkS5uBPNOL1V2VYmdwSBCGnARZdLPX1ashCYU8Wf89lZ4ExWaGcE7BM/wcpKE6rzyG+F9IuYF7AN49/K7RCEK2M3vm1i96UOh3EQd1bG+AnG5Y9wBAZHYGcEPDh+3mA5AqkrWVucuFsOYv5q24pe3hFYEwKtCdh1yDVN72x9/TFJf1wkn7lzkuchp0PPDJ4UhCS7OAKbRqA1AW8aja0MbjlfyQuGvA43SEJ0U6QxSXB7xqM6XOK5lVnbzDiWs/yWD2k1ATuKy5+99fTwRCG9IikZCUPG/vsdSV8O19YTUvzdpQzHl/5SZmL7/XANePtz7CN0BByBhSLgBLzQifFuTYyAq70TA+6PAwEn4C2vAyeVLc+uj20DCDgBb2ASfQiOQC0C/iFe7AJxAl7s1HjHHAFHYBsIVH8BnYC3McM+ik0h4CrrYqdz4KlxAl7sTHvHHAFHYOsIOAFvfYY7jW/gz3ynPnglR2D7CDgBL36OnQwXP0XeQUegIwJOwB2B82q9EODm4LuaFriIkrSVLkdz2beAYpXf6FV2usWk5BXdIgH/WXKJI3lmb5QHxyJKtez/Khfytcw1Q6SbPEMIS17EBPyoE6vEdmEYbr07/daIE3A//NqsrpNIuoekZ0j6j5qKLQm4TRcWU/bxku4YevPe4ur2X1lMz3bVkekW/65gbTFYJ+AWYPUoyi2/fyHpPJLOLekTOyfgfw04AMPDJN2rB7ZedXYEnMi7ToETcFfk8uqRBewvJd3EFF8nAQ/3jqX3xl1B0t/lwemlHIFtIbBFAiYReNzeMlsvLC6KvMVM03bqwh7938mzmwh43P4PR6RdIb2dpCeFyuQBPk2hAX+va2NezxFYMwIjEfD8b/lCJqULAS+k66N1gw/ib4TWX13chPzroz3JG14FAntmi5EIeBXzPkUnnYAPonyCYnfyJUncgoz8fvHfj5liIvwZjsASEXACHndWnIAP4ntxSe8wfzq/pI+OOwXeuiOwXAScgMedGyfgg/jer4gzeGD402clnW1c+L11R2DZCDgBH5wfbvM9bxEk8EuSTl/c7HuycIjG3WX/UtguPySJwIFcmYuAmVcuxOQONsZx0hDo8J9BA/1K7gAGLvf3ki4V2sQ75Fad2m9nNDy5pEtKOoukM0r6vqT/KjxTPi7pH1vOZ2530ewvXBw2njm0z/NwvXuXpP/LbWTGcktdPzNCMs6jl0PA7V6qOjS6BDL8VAiNvXF4Sava/6Kk1wS75T9VFPr5cNFk7ozdMgRnxPJd+h/r/qykuwS3N7wLygQCeLckgiH+eiQCKnvuqYrr5iH+E4Yfwfq5uSB1KHeZ4uLPP5SEmxsfoDJhPjkUfLAkPk45YoNIKH8JSe+UxMf71pLuZnyc0/Z43rMk/VFh//5axcMISnlP8ttlJb0tp3OmDNGFnzN489OvSnpLTTtDr5+rSeKg1crli368eYCxNHkTtXzEPMV7EfBwnDno4NsSGCfyzww39eZ2BC34cZL+QNIPkkpzEDCHWwQzsMWPBJczlg8WmhlE+JGcwj3LXFvSS0Mb4Ic2yoHc0MIB39MkXbdFw7jD3TPMaVO1MgImsAYiv9yRW74aN0nsqK4ZiLvseey02L1EwW3vDk0dS34/VhLvQpR/l3TOis6NtX5ol6hPFJwoTy0+DLftORbOEdjVrF56EfBCR9+GgMlJ8JKgvXQZzlMk4ddqZWoCPnERyvtKSVfqMoBCY/6f4iDshoUm97qO9XOr/bmkY0Lh94Utem7d3HIEebBDwYzURR4r6c4NZoKUgK9SmKrw3b5QyweCO9ouppBU2MU80vzxq8Gc0cZfGvMKZpAo9y/W+YNKnjX2+gGbu5vnovnz8W0zFnYENlydj1H0JW8J+7KK75mAsc9il8NGGoWgCTTb10tCY/hm0Ix/TtL1w5eb6DYrFwm2xPi3UxrfVuyPaGNWcL3CJhgFuyDPitLmA8L8sY3/zeQZPyy2wc+R9IJgDmEcaCFsx/lgEBJt5dthK/2BEZcnRHOu0D4vJeaBXpLommRYg3SYKytoYJD/GwoTwWeK7T/zd/aggf6OJEwjVu4TTARVfUsJGC+O8yXz+eLg3fHdIhKSj8L1Cm33qiWX4PLx57dUMB9wSGnX2nVMAqMm3PgAWe8SVHLG/Omk4hTrB2zSHRa7k7gbahoL8/kxUwhMz1Rjwmlqb1G/75mAiZbjZYrCgmdbw0taJdj7/lYSL3uUFwVyLqvT5RCuDQHfqWTbDJmzwKvIFI0HTYjEQFZIB4kWB1kPLdgW7UeG3BhvGvgh2FZvlrQJ8aJNVmlbvMhky8PGGoWP1+WKHcU/VPQvJeBYDLMCNuCXV9RDU+aDyAc6CvZ4Poz2gxx/g6Aw20ShLjuVHHloMKnEsmAN5qlMtX44c0BRiYK55gZH/qfRZPOQ4uD03uV1c6BYdpmNEvChY40driodJcRptQ+0oSdmTFdqW2NLdTpJvLipjEnAeGh8MmgD8bkculy00HI/nzEOtqQPSMqxVXxERt22RW5vsP1WCD9GkxlKfrnQaMmqZoUAD3YbTQKO5KK4mCnIQRUHVmVSRsCMCe+O9zc8zOIQixImzxlEKtZmzm/fCVt3TBd1wjvNxw7NO8pvF/Zfci5bMevnKAmOtX5SZafNWFjjfMCjYDvH5DafNH4z8ru2UQIWJBmlioAx5BMYECV3W/QT4TSfAyS0Rv4huXjZgdKYBJwuasbBqfNrM6efU/u3GrcwquEJwGIfkhxp137ssNFePbOPucUwt3CYGAXTEq5g6QFpVXsceHEgad8HbI4pqVO/jIDROK2WVvWcNBKQclXZ4DhMhRAxR0TBbQ/3vTpBe7deBt8IH2k+ElamXD945HxBEruvKKn3T9mY8GRhjUbBiwR3wtx5zV0/s5XbMwG/orAZXsMgz5YPjbjxCDu4NfEVb5LRCPiQ9OrjjhBulC4HWxDhq5JBDG0egHTYnoMFgkng0U3AtfgdF7OvJy83dm4OSNsIWq81RVTZqcsI+ByJiaXuudiirTmAXRe7rzLhIA68olSZEmxdvAwwhUThDOI2JY3jHjbl+rE5QOgOODQdHD858ZjI3dW0mfdZy45PwAOq65lI5dpQsYPeN2mTwxPckdCghpCxCBjtiANDa4vm9N66HeX0Hy0YrdceRIIL5omhBLv5201jaJtDur2lGh+PwrZbZletGxNrwXoJYAO+dEmFlIB5Ds8rlZLlj7kBk0AU/r8qWx9Y4ZIWBZsx0YNVJiY+Rswnu7QojCG1Z8+xflB2UHrsWNBmq/yvucAArTnmDaEepqYq//uh1uuk7YxPwJMO5/DDcgn4rEFrKfOb/XBwZ8I1i+itrlvysQj4AmHLbNHlANHmWahG/iArYE+zGckwYVjNqO8MWlszxMFLN6TwwcQEEAWXrdN2eAD+4GhpUZhzvFjSyLWUgOvsxWXdIDG/1XifXXJ4aOulLliYu6yLmi3LwdbzzR/wPEk9Xvi53/o5OKrc9cN7xkE3LmhR6pSGdD54J+n3pmTPBMxEsgAe1TCj2M54ySAmFhuHArkyFgHjTvbGpBM8i61487nywYp/EqK34l+HviII7Ss6zddpe7mYpuVSQmvXTv0ODSKH0K2kBPyy4vANF7FcSetjv75pTWV8p/HmiMJBH6HyZYIHBodUUbBL249T/Hvt+skdSCjXZv2kJhXcBq13hH00LnoWVyIM/7Rl3xZffO8EzAShURCKWhWumk4i7l343nK3W9M2dywCTjUdtDQ0jBz7dToeIugIjY3yqeAzOsTiTcOPuRmE8OchhbnofelqBQ/jt5ze1pwSKOOxN540ja0tAbMFZyvOljxKWRY5PHHYYUTfYdYEnhBonanMtX7KNG/8fFOTX3poh4cRphdwWJnUf+GdgI9MJ3HluGDhZ5k65ldNOP6yaBcc1lQlWKkm4Op5yTGhcMjCYUsU+mL9S9ssUly17KEYNjmSyAwheJZgV0f4OGAr5SR7SMGrgiCHMaTM5tiWQNN+dan/vCTYpsxzIvXpxV8d3+MymXP9cFhsNXiy46XukES6PcF0HFPgWHM8xrrJbtMJ+CBUaBlXDt4RTPhPZyBZF9s+lgZM5BsvZZQ+GnB6+ISJhZwBQ4g1D9Rtnfs8C4K3eR+Imko9O7q2j3kqPfDqQqD2+V3qQ6TWvZCINiLb7I6HhEDWl7ku2dGc6+f3kiT8ZXZqa7YCu7ETN3VdH73rOQHXQ4hmjMvQFcM/9nTZ1sTNJw055vexCJiPRJq74agNuOWqgGSwhUcZkihJUhPJHFthGn3XsqulxVO3K2zjzNdY0oVA+xIw3iqQLgfHUfCR5YAYYZ3abTxnAew2qlwl51w/qamE/hM8FDPA8WGx5ywEnjAWwuU3J07Ah6c0y1cO2xp+ixwGpFFSH9YhXaDEAjsWAZPrNw01zveCOLiMyXthCasqP0HbxZ++SDwjPThs22ZZ+TTsltwPNgpsiGf0JdAh6mOnx14fhZwlaJMI23gy4UVpyp429/pJD9g4nOMsBiFHCCaWKE9P/JqHns9Z23MCPnJogdG/6UAtThTaCNteG6fPb2jHaZjoWARMcAMh0H39gMsisx6e5BHoukCtHQ/thcOkru58dX2wduZYruzwrGkcuJwhacRYWm8ODZg+pFouOUuiiQztl9+jEOFJkqcqGW79HNKXdNwBX92c9ZOGWfPRJAITkwpeONjeo+DnbaPhmuZxVb/vlYBxw0F7IGsUUUyEodrUfU2TiFmCSB4rZS99DwI+qpVXhVKnEVVd3MfSF4HxtAlnrsPJ2mbHPEQhiCQ92EMbxLOljRBlxZogpBxPEGzJNy/xLJmLgBkLSdltcEh04bIJ3Ol3TjrOOdcPSg9h1jYAiI8GSpBN2sQ88H528e5pM/ezld0rAacEyiEWE52m66uaGEwQJHCxQsx+mg8Cz4RUK8YxviwHbGwrxwuCsulJMX/jsIbT7xxBk8eGSKRaFKLrCJToa29Dw+L2i2gzJ3F9k791Tp+ryqRhxDwbjZDx5AjBAcyJ9SSpMsXMScDkgrBnDZhfwNra1vlv7O1NMvf6Sdc5UYi4mVnvBz6i1rTSNKbV/X48As6yhi57mDkEVhaySbYoGyJaN8r0JbTbQVsPr4r0IKQqyUtbAiabFVs3DjWi4POJVpRzvU5ZNjQc3bFx9xXs0Tb8Ff9PIpnGEhLrExBhBU8INPyyLHVpP45q62b94wVTlqR+TgLG5MTcniIMgJy/fEi5BABp4y879/rBFQ2XtCho8axf69GyiWuH6hb9XjVgMElP//kbX1x8EusuTsSFh+glNI8oHJCQyLtM0CZtkEdVdFKsm/MBiWWPuvQY4sDzgEVcRXgnKs4cH6DjDhzo0B7beJziq+4qa0OeYBjzSaDV2Ctp2rSTW5bhsz2PF37GeiScIUfwgWg2gxXZuSDU9IocbI7YHstkTgKmPwQAYRopE8Zrw8qb8EtdwijfvH6OvCP2QLDr+uEgmQNBhHcO+3s81yB/SDqfTeNZ3e97JmDsTySFsXYoJhA3LLIwocHhA4pWwSEdycqJeErvGkMjweZWRVzWFSsuNLa3/J3FhqZGMEEXAqZOeqLM30jXR4Jy8gL8c6HVcucZwRXYvtl6pjZCymP7Te3aXRc0L080bdCPKsLo2n5ZPVy0SNRidwSUY17IOAbOuDexI8HMAhYEL8RbOmKbmC04D7C2SPu8uQm4LPlQ7B+BRCRuz5MjX6I510969ZLtN7mTeQ83LXsmYCaWbSZbV5untM2EE4GG3dVm+0rrp7lq09/TFHttNGDawm7JS1cV9dQ0HjwTyEVgE9E01an7PeZLjjsE2gaDKQR/UvIh2IQvbZ6LvR5zRt3NwXMTMO8sH2/OLKyg5bPTaOtpMuf6Kbu5mTFt6tqhugW4fAJub5RuS2AQF0li2r60/xIidKwdqwxrDt3QqrG5lUkaMtq2/7QJ2RESTSL6Nrcik+qQxNhlicfbEJctS05lErAjnF6jeee6+HV9pq2HaxaEX5ZKsq59PGEwV/DvOpmbgOlbGr3I30jYc6f2r8vhoc65ftK83PSnzfVLQ6yZ2dpYPgG3h6YLgeEuBnlxCJdqFmkPIFy2RjiIfz+ze4SIkrSlrO00cKBL/2M3iDrDNsfhU1VKRmxtpK0kTBgXt5xDqsxhHi7Gdp/tI4KNr+VtwR0p5Pg9vPoh6c7HSUSM2UQ2aUk+PgQucNNEzk0LSyBgPjKYSDiAi5JeDttmzuZcP2naSfpC7uChwsm74DBZnS0ScF/wiKKCNLATkpgHjZKtKQue9HldMzLRDt4BHDpA+Gyz0Aw5yabdIYUXEzsm2jc2bk7NGQOZvXjW0AlxbN95RvzQcL+cvZJ8yDHmtkWABfZobMRggQ8qobp8+Dh5n1I7z+3z3OWmXD8oDZhUomzu2qG6yXQCnnup+/MdgX0jkCbUJzOfvYZp0+g4AY8wvYNtokfomze5dQRWt/rwRDqfmRV2iPYaphYTtrqxH7gFtsVAvagj4Ag4Ar0RSO8LfLd06GIbjjw+HmAL14DX90XrvSRX14DP0eqmbBkdZuFw0GbvHyTUmsPQ3cjCCXg38+ADnRsB/46MOQMc6tnoUgKQiES1EYgchpIRrSqH8Zj9G6ftjDXlBDwO9B1azZitDq3OUmWKoQz+jMEbnAX6hT4UF0zyVeBBhGcR6SZj+s/YZQ7e7NVYCx3KsN1yAh4WT2/NEXAEjo9AWd4VWwp/cfyYc/3qN4OxE/BmptIHsmwEdq1hpxe/2qnC9EDUovUFXvZUDti7WgLe9ZIZEGRvyhGYD4FFvMU2PN1CQRKqY0IC/PkgmvHJrgHPCL4/2hGYBIH5OZgeEF1KsiSupuI2DCIyydS3a3EC3vX0++AdAUdgbATqvn/DEPD8X9ixMRywfQdrQDAHacpnZBAYvZEOCAxDwB0e7FUcAUfAEdg7Ak7Ae18Bixy/66SLnBbvlA4nbxjwjmYnYF9UK0Igb/XnlVrRsL2rm0XACXizU+sDcwQcgaUjUE7AW1Mhtjaepa8q758j4AhkIeAacBZMXsgRcAQcgeERcAIeHlNv0RFwBByBLAR2TcBumchaI17IEXAERkJg1wQ8EqaLbtY/OouenvLO+aT1mrQlw+cE3GtqvbIj4Ag4At0RcALujp3XdAQcAUegFwJOwFXwLXnf0mvKvXIHBM4m6ZKS+PdJimvT/0cSeWw/FjJ6jZdIfOR1OHLzHaDeVxUn4AHn2xfzgGAuo6kzSHqypGvpSBBqmXDVDmT838mP5w0Endb5s6LsseaPf1OUu9Eyhru3Xsz/xjoBb23NHVlTZ5J01/DP1kY41XjOIulNks5T88DvSTqFJC6ZdAKeamY29Bwn4AVPZofvM7fP3kHSQwvy/aaksy54eEsnjmPLAAAMlElEQVTv2gskXb+hkx+SdEFJp3YCXvp0LrN/TsDLnJcuvfoZSZAGlxsi3DoQCLgDlXfpwXbqYFZIb2vgWvVXh5scyId1ZkmfLDTgRzgBb2fipx6JE/DUiI/3vOtIeolp3hDweA/daMu3kfSUZGzYabHXlslPhA+e/Y2r1/+1pLDbgPssmo3pEvUEvLHB9pn3FdR1Ah5ukh4k6b6mOTTdcw7UvBPwQEBuoRnXgMecxWk/YE7Aw83loyVxlXqUl0q67kDNOwEPBOTxmunyvnWpM2D/Ryfgmcc3IFSLb6ojAfsMlczs4yTdyfz9WZJuPtAKcAIeCMh5mxnmvRmdgOcFaVdP70jAM2E0zPodq/OPl3RH0/gzJd1ioIc5AQ8E5BaacQLewiweGcPQBEzU169Jh32Kv1D899vCqX8OYieS9Cshcuy0kn4y3KRFBNlnJX2w0Cj/PaehjDK43uH5gY32jIUL3olDYMR/SHq7pO9ktJEWmYeAl/1R6gCjV2lCwAm4CaFl/47P7xNadPHshSb3KVOe/8Z9DfmKpNOFiK8/kvQHgcxs82+RdHdJ7y55JsR34xDVdekQoFDXtU8UBP204pmQHT7LB6WZjBjLfSRdWxIkXybfKkKI/1bSg4totvfVdOYakl7RAkeK3lPSw0Odsf2A8bJ4vXExjF19oqRjhr0msiUKXrwXAk7AveCbvfIYBEwQB+RSJbcrcdG6XCDTLp4CaMTXk/SeTDTRePFSuFvJB6KqCfx2nx7MCt8tKbRkAj5l+IhcPOn3Y5OQ5kz4vNiSEHACXtJslPWlXhMcmoAhwjfX5D2AvDBJfM10Fe+A50s6YQ8ovyqJ4IcvNbRxUknPCYTd5XGYUdCY07DhpRIwIc6vLbTfSyWD/dPwAeqCgddZEAJOwAuajA5dQeOMkW/YXDEbRIHU7EESf2eb/b+mjDVBQEpooxdI+kEEGFon8mJJv2F+xwxAOC75EKKgbeK2BSlj68W0wd8wE/xiqA/RxzZjPUwpbKfr5NmSbpIUwHxBwhzGhlmDj8RPSbpiCMs+V1Iek8RVk2075S9ryt2ysB9f2fz/W0tMPR8w0XJjmCBOHiLv2F1YYYdy7w5rxassEAEn4AVOSscudTmEswRsH/vx4vDqD4PdEUL7OUm3Clvh15iCf1WQ3k3N/5OWkfwJL28YAxrdqyRh24wCUaNd/6CiLs/HZmwFjfY3wyFhWTVSRxIq/LvJj9Z+W1av7SHc0AR8suIQ85WSrpB07gHF7uSBHdeHV1sgAk7AC5yUjl0aioAhXwiyyRxwmkB8HL5FgRwgiRwpM5+gfX+4pDKmh09LIj1klHdKunymlwP2UkvCeGPg5cG/l0bAjPVliQZOH5s+Gsk4mk8xcybJy4yLwI4JeHMLdCgCxsSAqaFJ8HjAHhsF0wYpHL/eVDH8DpmSR9cKZoM3ltS/bTAzxJ/QtM8XTA45j0MTxjxhs8ORrvORCyNgPmaYb66W9AvT0qNyBrqOMpt79zrDvmMC7ozZSBV7L8ohCBiNEJ9d7L5NgvvaJYL/LbZofIXb2iZxE2O7HYUDsjLzBTbYy5hyf11iC27qL9r5/UyhdxUHXKlnQfx5DhMEvtMvknRN00ds578XXPWaxue/rxABJ+AVTlpFl4cgYHxN7eHT2Ohg98WUEaVM+0YrRKtmax6lLjNZVZ8hcIg8Clo0Nuhvl1SYmoCxo5NKlDmMAvlipuGAcTjp/Z0fris/aimjUxlFxujZ2G06AY+N8HTttyPgIws6PYQjsKDOB7jvaHgqB3pozngicGBnvSFuIOmFyUMoS0SbFZKg433RRvDC+HJSAVt32jZFpiTgON40+TuBIxduM0Avu2wEyr4hTsDLnrM2vWtHwEdaTgl4KFsj9l2IFje1c4R/8PPFbmtd1tLxHSTgIyv2hjV5eNvgU1a2yt49JQH/sIjUO0HFQNCAn9R3kF5/uQhsmIA3umepXktDEDD+r8/ouFwxXeCje6VwW0SXZso04NsX7mmE3DZL+ykn8Xrq2ja1Blw3rm8Ev2w8QFw2iMCGCXiDs1U/pCwCTjgq1YB/q4hIe15L5DAHoKVVHWiVNUfwBH6u9NnadssI+B4m50LLrjUWv0thByb3bypTasDx2WjCmIDwv7Ya8RvCR61xMF5gfQg0EnB7pWJ9IGykx1kEfGSsR2e1LwHjNsY1SITMVgmHXbiA4d/73mBzxYeXvxPSbIMxyggYL4DHmMZxd8vTiJsnFn9bgjnmJmCwwK0Pe/Afh4RHtk9uimieywFLTMd6jQQ84Ki8qXERaEHARzvSh4Dx+SXU2Hox0DBt4k71jkC6/1YT3QaZEnIbpYyA8RAg4i4KZIXWnOMq1xXxKTVgIg0Zd8zGhlseuNoQakwRv1BEI5Ji02VDCDgBb2cypybgp0q6dQIfW2h8bSHJJiF5D+TzYz9SyA8TUeoFgW35dUljHOwNlU+4rJ+VBFyhG/UJRSZnBuHUVojwe1PyNzdFNK2oFf4+EQFPp9KvcA6G6vKUBIwGSqiyNT1g07VBBE3jIngD04QViAhCsoKGjfuYXatVh2d1z8TdDaIkSVGTTKkBc9Myfs2pcCsz47TCgeSwfsFNSPjvoyIwEQFXjMF5ecjJnZKAzyvpoxnkWTc+PC7I0WsFO+hzSyp9JLiwxZ/QDrmto42QNpMQa7bzmEn459gKTXoJBMzHAozPbAbppog2M76CsvMS8AoAWlEX0T5tGO/nQ26GuiF0tQGnUWU8A/cztsk5gjbKgdyFksJcfMkFmKmkYcT8TvrIsgO0suezzjn4u6j5EQ2eNJRl2deWQMB0lbSd2NOtTB2tmDOfXqYjAgsj4GWpxMvqTeMMX+VI8u6jvcbVi9sUxiDgMg2YPBDkqs0Rrjy6V0nBqi02gR34wlqXNQ6kyIHclLWNx6DpchmmlSNRf+WTvBQCpr9o7WjvVtwUkbPKVlBmYQS8AsSW28WLBS3P9rAq1DaW6aoB46dKJjN7Fxt5HUgOX3c4BoHiZoVrWZnUReKVXZWEDRlyKkthGdvHjkqyd3tjB+5vHOSlN2PEOjMT8IGvAiYITBGYJKK4KWK572Grnu2QgFem1+ZPJ6kWP5MUJ7sZSV44xIIsHxI0yb4ETH1SORLIYOWLISMaWls87AJwDtywUZOT96dNhTQMty4XBQTKdUnp9Ty0QVpMxkl+CBL3MFY+SNxfl94owePZ2uO/XCUzE/DxusVHhEM5K26KyH83FlcystABAp6emqZ/4uJmYtgOcaUQ/rlVgrZIvtkhCJi0ldhxyfdQJpgGvhfSW1pf31iWYAq06Pubytx/lubCtW1jisDODbl2ETKMkQe4KbfuKAQcVjumEEwiUaq8INLxcfCIe5qVsgtSu+DidWZCYIca8ExIT/PYm1UcYsWnY3d92EAETDPnDveWpfeu1Y32c0ETRgMNduujxQnMOGNyb13aFmYMCBIvivReubrn8kHgjjw05SYZhYDDQ7sSMBgToGHzJ7PDIUAj3fk0jc9/XwgCTsALmYjD3RhmQ8DdaeQ3OFXJ0PAwwNMgSlcbsG0aX2BSWKKNna4CTjTP94ePA36sJGJHSEIOIZ/e1MM+/LiMaTl/eO7Vg5ZdVQVywt2Na4lyfIBpZ4kETL/uHmzodqxcMsqHzGWFCDgBr3DSMpga7wdsn+cJ6R/xiICIyDH7yZGGjI2WxDzcfIwNFnLlYI6bMghLTnPxDtUNDgTJm4uGyAeAsXNIhXmD8XLHnYsjsEgEnIAXOS176tQwav+eEPOxjozAhEvSCXjkufTmHQFHwBGoQsAJ2NfG9hGYUKPZPphbG+G8i8MJeGvrycfjCHREYF4q6tjpltWWNkYn4JYT6MUdAUfAERgKgeMR8NK+EEMN1NtxBBwBR2BpCLgGvLQZ8f70QqBZgWgu0asDXtkRaIGAE3ALsLyoI+AIOAJDIrAsAnblZMi59bYcAUdg4Qgsi4AnA8uZfjKo/UGOgCNQicBOCdhXhCPgCDgC8yOwYwJ2LXj+5ec9cAT2jcCOCXjfE++jdwQcgQEQ6KnHOQEPMAfehCPgCDgCXRCYiIB7fia6jMzrOAKOgCOwcAQmIuCpUXDCnxpxf94WEPD3ZupZ3CgBTw2jP28PCDg97WGWpx3jbgjYvjz+Ik27yFb1NF8cq5qutXd2NwS8hYniYjUXR8AR2A4CMxNwVDdc7djOkvKRrBuBrb6LyxzXzAS87qXqvXcEHAFHoA8CTsB90NtS3WUqCFtC2McyOgLrW8ROwKMvCn/AdAjM9wLO9+Tp0PUnDY/A/wPiSfpAwnui1gAAAABJRU5ErkJggg=="/></switch></g></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-44"><g><rect x="577" y="238" width="22.5" height="30" fill="none" stroke="none" pointer-events="all"/><path d="M 577.09 259.29 L 577 252.93 C 577.08 252.48 577.47 252.16 577.93 252.16 C 578.39 252.16 578.78 252.48 578.86 252.93 L 578.86 256.26 L 587.24 247.95 L 587.24 243.58 C 585.9 243.14 585.07 241.79 585.3 240.4 C 585.53 239.02 586.74 238 588.16 238 C 589.58 238 590.79 239.02 591.02 240.4 C 591.24 241.79 590.42 243.14 589.07 243.58 L 589.07 247.95 L 597.67 256.48 L 597.67 252.93 C 597.78 252.51 598.16 252.23 598.59 252.23 C 599.02 252.23 599.39 252.51 599.5 252.93 L 599.5 259.29 L 593.01 259.29 C 592.59 259.19 592.29 258.82 592.28 258.39 C 592.28 257.97 592.56 257.59 592.98 257.48 L 596.12 257.48 L 589.01 250.42 L 589.01 264.56 L 591.42 262.21 C 591.77 262.03 592.2 262.09 592.49 262.35 C 592.78 262.61 592.88 263.03 592.73 263.39 L 588.07 268 L 583.52 263.42 C 583.35 263.08 583.41 262.67 583.66 262.38 C 583.92 262.1 584.32 262 584.68 262.12 L 587.27 264.62 L 587.27 250.42 L 580.11 257.51 L 583.55 257.51 C 583.95 257.63 584.21 257.99 584.21 258.4 C 584.21 258.8 583.95 259.16 583.55 259.29 Z" fill="#00bef2" stroke="none" pointer-events="all"/></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-46"><g><rect x="775" y="102" width="240" height="50" rx="7.5" ry="7.5" fill="rgb(255, 255, 255)" stroke="rgb(0, 0, 0)" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe flex-start; width: 188px; height: 1px; padding-top: 127px; margin-left: 827px;"><div data-drawio-colors="color: rgb(0, 0, 0); " style="box-sizing: border-box; font-size: 0px; text-align: left;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; pointer-events: all; white-space: normal; overflow-wrap: normal;">Auth Provider<div>(Google, MS Entra, Keycloak, ...)</div></div></div></div></foreignObject><image x="827" y="113" width="188" height="32" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAvAAAACACAYAAABtG12SAAAAAXNSR0IArs4c6QAAIABJREFUeF7tnQnYdV85/+/HkKEQSpQxJZWhyVSUNCBDMmQoqTTKvwmJkimS0qz8NdFEyBRKNKg00ECSIdFAKtIkRHmdz/vu9et+7netvdfae59z9j7ne1/Xe9XvOXuvvdZ3rb32d93jiUmEgBAQAkJACAgBISAEDhCBEzM7c4Dj0pCY2f3LWtfXWvu9/xlXD4SAENgzAtq+2iZgHXjV9bLuqjZ8dLUQEAK7RWAZBL5mzNpxalBa0TWa0BVNlroqBISAEBACQkAILAiB9RD4BYGmrgiBdSGgw9K65ku9FQJCQAgIASHQj4AIvFbIeATEC8djpzuFgBAQAkJACAgBITASARH4kcDpNiEgBISAEBACQkAIHDYC0tQNz+9+MDowAr8fEIcnV1cIASFwWAhorzl/PoXJYa1xjWbfCOiN2vcMLPv5B0bglw22eicEhIAQEAILRkCMaZGTo2lZ5LSoU1tFYHjVL4fAD/d1q1CpcSEgBISAEBACQkAICAEhsAYExhD4i5vZP5nZB4cBXsPMXrCGQU/o4yvN7Iru/lub2aMmtDf3rV9tZk8d0ej7zOx/zOzdZvavZvY6M3uRmT2j+19+l9QjcFEze1u4/PJm9tf1TVRfeXczu4+7+plmdt3qu3WhEBACQkAIHAEC0pIe2iSPIfB3MbMHZIB4nJl9x0oB+ngz+97uX98QDpXA94357zbk/h6bg8uvqpxb9eoWga+GShcKASEgBISAEBACrQiMIfB/bmafk3nQf5nZJTOax9Y+7fL6DzCz25nZT27I+79vtOmfOPDwYyTwCZLHm9ktzey9u5yglT5LBL44cdICrXRNq9tCQAgIASGwIARaCfxVzOylrv//YWYf7v77zmb24AWNr68rn9JplT+vuwi3IBH4/sn7ZTP71pXM7z67KQK/T/T1bCEwCQEdMifBp5uFgBDYCQKtBP6hGx/p73Y9+4nOvSL96a/M7Ao76fn0h3ydmf2Ga+ZQCfxNzezFA3CxDohp+Agz+wQzI54BbfvHZO77RjN7ynT4D7qFj+riRPwgOfz+7RZGLR/4LYCqJoXALhDQUWEXKOsZQuAwEWgh8Bcyszea2cd2UBD0eDEze+1G6/7RDp5rmtnzVgDXsRD4a5vZc0bMB3MLUWc+vfyjmV26C3od0axumRmBagIvsjAz8ituTmthxZOnrguBvSCgXWMvsPc8tIXAo3klkDHJCzdZSq5uZo/utLXp7080M7S+SxcR+OEZ+kgze5mZfXq49Bs2cRC/Pnz7uSv02tciNeq6agI/qnXdJASEgBAQAkJACMyHwEykqIXA/66Z3cCN4J4btwtcaK7XpRtMPxHMeikz+7f5RruVlkTg62D9ZjPD990Lh7Zb1d2uq7aMgAj8lgFW80JACAgBISAEtoPAeDZfS+Dxi36DmX2gGwC+7vi88zfcKkjFmOSuZvbA7Qx2tlZF4OugxHXqHWb2oe5ytPJXrbtdV20ZARH4LQOs5hsQGP8taniILhUCQkAIrAmB7WyMtQT+bmZ2XwfXq0JBo/ub2fe43/9mo7X9zIXDuw0CD54QW4r2cOhB3mxmpN7k35ktY5Ir5DTWB9539c82Ab+f6/7wz13K0JbhfNImNuI63UGP+4mT+PvKBsCV1KWfZWYUEuMwQcGpN5kZrlxvrWxnTZdd2Mw+v1tLZLVhjK83sz8yM7I/JZmLwH+cmX2hmV3iXGzLyTvNzrB2mXtqAcwpV+6eRdD0a7oYjUOcwzkxU1tCQAgIASEgBC5AoJbA/2XILvPDZvZjDsfPNrNXBFy/tCMbLXBDylKQLPd9jZn9TkMDuO98iLs+kldyvj+iob1P64J00y2lPPBoqTnA0P4nF9rHSkGKzYeY2X839KHl0m0R+D/u4h1SX97SEb3YNwKaSc+JQMgIhGWN4WoFPuDkBTLK4fBPCoP8VDPDmnOTQkYcbvvf7v6HmdmTBg5JFOu6n3sWuf8hrJ4Q1+BNDMCvhXawQFHJFpmSRpI1dy8zu3FI0Zoe985NTAI5+XFhe7uZTSHw1EG42eaQeXszI51qaT/gQP6Ybu3yjg0J8/YP7iKCoYmhAZdf3MRVfG1ogPfhyWb2/WbG4W6Lsh1NyBY7rKaFwFYQ0JuwFVjVqBDYGQI1BP4LzOxFrkdokSEZrwu9fElwq/ilTdq8b2scyRoJPNhA5i5XOda/MLOv6lySKm+pvmxbBB5XKW9RiRaY1MEcgadI1g/0jOA2m5iJR4bfccv6wY7IflD16M8dIllzHDhzAlnnIOXbJK999PEfeiTpR7HgJPmFzftwC/ffYwk8KVp/JnPQyfWHcXzTRnvNQfk+7oJnmtl1hwbQWTQ4COSKspVuxwJAteVzWY3KDCBH4L/FzOhbzGrkn8U7tI1UmxVw6BIhIASEgBCYAwEdDudAcbiNGgKPxhrNcpJnm9mXZZqGfJAnPglaNYJZIeW1sjYC/7ObOACCPNE0twiE+GojNL9Dz9gGgYeMMi8+/uH3N4e6r4idOTF77ZnTGviv78heaZ29p3OpQZOcBC09VheCo8cIGmq01/QxJ7/dWXbSbwRng1utkBsfLbG3Jlxr80481zUwhsAPHXRy/Xtbh9W3ux9rCDwEH604WYZahfeawwrWjpLkCDyuOD/ecw9WGJQFkmNAQF/4Y5hljXFhCOi1W9iETOzOEIHH1xiyAiFJggbucZnnQmzIE+9dWL7PzPCPr5VtE3jSIabKqxBo77dP1pw7hI4+1blF8FN0oYnj+sNOG49fL3nyL9MR/BwZ/aGNJvjetcBUXrcNAh8PZnQFjfpPZfrkNfCQS7TEuFd5weUF1w2EVJS4oyRhPWK54VDk5X1mRnpS0phy+MH15ZLdQRIN/meE6/9zQ+C/qIs7iN28UUiB+d4uXqH2oIm7ycNdo/jxM88+vqGVwGM1YHxRfqVzOcHiQT8v2x1OvrMrvJVbFkMEnvmALPugZNrBkoQl5AVmhosU5J5AdTTnuDClOeNa5oNDvD+0+L5EAv+nXfzCh7mLaMMfCu8YFACVS16XCQEhIASEgBA4PgSGCDzuBV7TBnHyvr45woFZPwnm8FrXEu7ZNoH3/Z0jiDW1h78v435pYQndvPMh9nhDdnFFmlPmJvD0D7IXLQyQQA4zUTyB97+9uvPV/oMN+Ufrzpqg0uszNlrXp7kLc4cFsIV0EwScEzThxGPgP+2FQ9SVOrLv/07FWaruEgybhIObJ+V9cwLB5XCQBH/1qFluIfBcyyHAF0PDlx6f8acXOgL+WA4IDI7SR+A/vFuj3h2K+WD8pAYtCYfd3wqByxzW6UcuXWwk8L5d1gCYkcmIwz5B3xyKmPt/6QNevwkBEJAWUetACAgBIVAOWkvY4IZwfQcUgWxo/0rylZvMGb8XfkRT9+zKTXeNBJ5YAEjIUBYNCCJExQsBn/gVzyVzEnh8lbG0pKDU1EfmFx/+nOQIPOT9GhXkDO0sRNanI4Vok4kFsjgkBFb/SLiIAFkftJp+JsXpnd21qSjZ0DOw4PiMLGjdIatxDlsIPGT2R8ODqbfgDza5flENFxL8UeHHPgJPQDA+9knoPweFmqJcjJ04F2+No98Rc9ouEXieg3sT2neJEDiLQOW3QWgJASEgBISAQ6BPA/+JXaCqN51D6kj/VxJM4pAZ3BuSkF0CM3yNrJHAQ5rRhg4JWk/cP7x8eSiCNdTG0O85Ak9V3BcP3EhQJyn9SH1Jukiy/yRXI38r2lr8lEva8ByBr63aihaYTDJeOBCWtNBxSKxTXDo4LCQhzSRkkn57IXAzjgGCOpTWMh4SSmS5lsDz/mFh8IckLF64rNRIdOfhnlKfeDexSvhnPTZUUR56ZpwjNOZkXYqZaXIEnjnAorPlLDNDQ1jy76KyS54d9e34ENAbeXxzvqYR9xF4soCQ/i8JH398fYeEjBiktktC0BuHgRrz+NoIPIQP4lcraOmJFUiCaw1p9dolv7PkCHx72+U7hlxNIoEnoBTXEPzehwTNPoQ9yZhiUWiu42GK3PPPyjwcd6eruL/nXGHibVgT/DtA8OgTMm3XEnhcU/AP9/LFmwBe0nbWCC4oHFK8VjxD4M8uFixh/OaF2AHGVCu44PCOel/23CErR+AJTOZgKBECDQiIQjWANeOlwn1GMNWUENgKAn0EHv91guaS1BAcrsW/+a9Db/FP/umKEayNwEO+IeG1QgpJihElGSLEte2m67ZF4HF5IO94LnDV9zESePydvQtWaTxYAAh6vYi74C4bYvqgRgDQwkNovX87/vFozqNEf/uh4mP4veP/noTDCRaLXA75WgLPGB/g2uSQS0GlFkGL7tdgSQMfrQe8oxQcaxXa91moOOSzNrzkCPw9Npl7yLRzRCISdESTraEKASEgBHaKQInA44bwfNeTkq9vqbMx0A/tPYeBoUqkayPwtYeahBOZPnyqPPywKe40l8xN4JkvMutAvqKmONfnSOAh/H054FMbuUJgV++qrLZig6bX++jjguM1+6m9XNYkNOKlQGRShn6X68yjNsGwty50rpbAkz+erE5JwLo1fWZ0aykR+BjPEjMADeLc0VFSxXL4SZI7pOUIPGlHS6k9B5+tC4TAfAgcycHqSIY537pQS0JgXQiUCDzkxAer4gbz8oah4ReLdtILxASC0idrI/AQGYhdrUQCP0bL3PessQQeFxd8lMkoQuAovvr4zePWEgt29T0/EnjSdHoNc+nenHsHJPgdtcC667D0kL40CYQcYp4T0jT6rElo/JmTKGSuwXfbVwnmkOs18v6eWgJPJVpf2IiaC/6QUDN8CjlRmyFJicCTinKMxn2oD1iVYjGoHIEn0Bu3KIkQEAJCQAgIASEwEYEcgcfPFTcEghrnFHJ4k4GiT9ZG4NHActipld0T+BO7tp3pKmfW9nL8dZHAU/AHLfOQQKIh00k4UOBWM2SxybUbYzf60nXGrEmse+I1YpaUG25SUv6me9hQetRaAk/lWJ8n/74hfmQIN34n6JgiSUlKBJ4DiM/wU9N2zTXk+o/pLHMEngBW5kJyJAhIAXwkE61hCgEhsBcEcgSewLxcoaapHaSwER/6N/c0JAI/DeU500iO6Ukk8NQR+OWKhrD2+IMQ9QbaDpDvZwu4JZEmMgmkPFqD0m+5rEm5zEC/FgpOcUggWLsktQQev3tfhIqUjDGl5BB8EGOfPadE4CluFYs3DbVd8zuxADGVZY7AMwfMhUQICAEhIASEgBCYiECOwJOx49oT2y3dXqrgma6fSuBx9cHdIQnjeE6hM3MUclq+Bv7cXJYwmHuaxxJ4Kq96oj9FA0+FWwJXkwxlCopZkzi8er90yDjEM1UYpm+4iOFqNJXAk8rSu5/g/hMLUg3NEbElWASSlAg87lG+WBS+61gApgoHAzD3IgI/FVXdLwSEwCwIyBI0C4yzNaL5mA3KszU0vJAjmrzU/u/kEc+VeR/qBdrNNwTtZ67svG8nEviv3RRJeurQg7rf6XNMVygCvw4CT6aaGOA41gcen3vvx457yZV71hAacDThSd7VuZqk7DIc0n7e/U4/Ccjsk1oNPL7r+LAn4Tm3rVzv6bKYirJE4ClA5VOeQrrv3fis2stF4GuR0nVCQAgIASEgBEYgEAl8TDVHgRbS2kFqxsj9N/cSyOilr3gRafQu5i7++o2P729UPpj7Yq55Efh1EPhcYaWxWWjQLF/XrRnWD+uoT8i7zvOS+OJTMdC0xi2olsDHYHGKpPmg1pqlz9ie4i4sEfiYGSpaGmqeVXuNCHwtUrpOCAgBIXB0CEgPP8eUewLP/0dLR4n2JBADSq2PlRhgRzt96etwVbiEe1ipUE6uP6RnfFGoyy0Cvw4Cj7Xm7TPkgacdDnHeVaQmleWtzOyRblFRnIm1R0ArlYXTe0If8eWOlUfjeqwl8GSc8VmMOCiT3vK9DS8cedjxyU9SIvCkK72juy4XfFrzWPzdsU4Q01ISEfgaJHWNEBACQkAICIGRCHgCH9PR0SRZY8geM0Vipg3ICcGsuYA23Hf4+Ce5awhI7OtHLIrDtSLw6yDwzBUpRqmamqQv/WNpHcRsMVyXqxQa7ydglvVIBiYEoo7l6U5mdj938c9tgrBvX/Ey1BL46L5D0zcKGW+GHvfKzTt6RXdRicDHTD/cgrYfrX+L4JJEMbI3dlllyLsfi7SJwLcguuJrpUdb8eSp60JACKwaAU/gqSp6MzcaMoFAYghSmyLk5I4f+FJVRooF+ZzdZP/webpL/bjQhvgQEPiZ4YI+Ak9Z999217/RTuxSA4kLI1lSEOtpwMcGsdLK7TbWF/Kge+lzt4prgSqsFB+jYmoSqrteqnIN41KC1j0Jfvk/HgpvYeX5k4qXoZbA01Rc87jzfEllCk0OPLG2QonAozknJsVn9yldWxoiBbIg7F445Dwk/E0EvmKRzH+J6PT8mKpFISAEhMAyEUgEnhL2aCAv7Lr5JDO7yQzdhkDhhgDBSgLRI6AuBp3GQwTa+stUFBOKbgTpOX0EHnJIlc4kNakLReD7F8QUAv9h3TrxMRC4eXxeZfrBGL9BT4nB8EWd+nrPWiEDUxJ858lUlN4RiltdofJ9aCHwBIk/PrRLn+l7n3xkVxjJB6ZyfR8pjwG+XH93MyP//JDgloRVhLSV/p3hvwk+9yICP4SmfhcCQkAICAEhMAGBRE5uuXFreXRoB3cEr6Ge8BiLgYW0lXNtiOkEuY4KklTqzOWP58ABKblNoXN9BP6cz/xp6auuyZUi8P2rYAqBp2V8tPHV9kJcBm4lYJ8T0oaSP937gXPdW8zscp07TM3a5V0gS5J34fL33S240/S12ULgOdi+JGTKoYDV93buY7liVhRk4t3kcBOlj8Djv0/lVF9RlvvJRkP++ZLvPc+jkBXvzFnpdL3cA/ZRROBrVtwSr5ESf4mzoj4JASEgBM5DIBH453Zm+3QBPsAEk5JXfQ7BNQftuhcIAcTMCz7Ir96k7btk+DvacYIMX9wReYILIS/k605FZNDmQ8h9NpE+Ak8buBR4oSgNPv8pnSXE5nXuAhH4/tUwlcDTetJ8+ydBLHFxoVormvB3d8GkHOxwvbl86BbXc0CM7iVDazmnxeceKrMSt0E10xppIfC0h2YfV5rkg5+egUsQQa6sawJcSfPKwRq3lbTuCaj1BZqG3GLA5XdDqliex3uHjz/3k+OevYEc8xQHI9g2FmvClQhXn9weIQJfs0p0jRAQAkJACAiBkQjwkcYEj5bTy2M37gxo5ecSXHTQoHuCAsmCkBAM54XAWYr65IpM9fWHdJVk8MC/PslQESNcNHDxKUkMKNw6gZ+oAFtrJVaPPz7aHKJwcRoj79msZ9xSiJ9oFYgnWvi49iC8YFsrrQSedvG5R6ueCkbVPIuxQuYh3kmGCDzXUfmWeANf9KzmeekarGLXy7y76XcR+BY0da0QEAJCYCwCE0nD2Mfqvv0jwNQTqHfP0BUK1cTCOlN7S2q+6FN/r+75sW0OD2gea0q/k87uzpuA24fbid3bzjQReIIW0eyWBLcMKnUmGU3gu3cMTeoFbghdwaEHTQXW3X8IBJ7hkA4Sv2zI6Qc14IN7yC06X+2G205dCgFGs++FQOqWA8EYAs/zWBtPPnuwHd6UsULcvDt8v9x1tobAczmHWw7qHKJbhDSwBG9T2bUkIvAtiOpaISAEZkdgeAud/ZFqUAjsFAHWOC4ilIZPgvsIvrItuahrOh2DRrmH4FaC4GIwK79BAjhcoAX3wbXpWbg1oLHk8IFGEMHlpUUDzz0cFh648aUnKDBKLHYzmsB3DYvA16yU91+DdYhDFG4j0W87XcXaeeHZA9w58su66GTUFh6DSiGqvA8t7mRjCTz9xkpFSlRcg3DzisL4ntb5yFNB9kobfMYQeNolexM58PlHOyWrV3rmQzcuas+omEIR+AqQdIkQ2BUCo3bCSdvorkam5wiB40Wg1U1lH0ihhcfXFlJw8a6Izmu6lIFvHd+hU1sabhvXMjPycnNYwOce//iXdS4V4x+jO+dAgEDPq3bzwxpgjohXYB0QAErA6qEJY75KR6wZM8WTcPkizWSuhsLU8ZMyFgsAsS9kAuJgRBpOfOPBmHfi6GQS8Tk6tDTgfgS0mrRChIAQmA+BNRD4+UarloSAEBACQuAUAqKVWhBCQAgIgfUhIAK/uDnT53RxU3KoHdJSO9SZ1biEgBAQAkLgwBEQgV/cBItVLW5K1CEhsCcEtBvsCXg9VggIASGwcARE4Bc+QereASIgVnaAk6ohCQEhIASEgBDYHQIi8LvDWk8SAvtBQAeG/eCupwoBISAEhIAQ2BICIvC1wIoE1SKl64SAEBACQkAICAEhIAS2iIAI/BbBVdMjEdBhaSRwuk0IgMC0F2ja3W0zsMtntfVMVwsBISAElo2ACPyy50e9EwJCQAgIgW0joJPEthFW+0JguQhs9f3fXuMi8MtdUurZWQS2t/gFsBAQAkJACCwMAW35C5sQdWepCIjAL3Vm1C8hIASEgBAQAkJACAiB0wjokHeBelNLQwgIASEgBISAEBACQkAICIGVICAN/EomSt0UAkJACAgBIbAGBLyCVMrSNcyY+rhGBA6ewO9k89jJQ8YtrwV3bdyAdNdsCGhtzAblwTa0mDWymI4c7FRrYEJACCwYgdwWuB0Cr812wctAXRMCQkAICAEhIASEgBBYMwLbIfBrRkR9FwJCQAgIASFwiAhIuXaIs6oxHSkCIvBHOvEathAQAstEQBxrB/MyBuQx9+xgKHqEEBACx4mACPxxzrtGLQSEgBDYMQJiwDsG/AAepzVzAJOoIWwJARH4LQGrZveBwBFt9kc01H2sJD1TCAgBIbAMBLTZL2MeltcLEfjlzYl6JASEgBAQAkJACAiBOgTE8etwOrCrWgj8Z5jZy83sw83sLWZ2WTN750Q8LmpmVzSzy5jZR5nZR5jZe83sXWb2ejP7GzN79cRn6HYhcOwIXLp7zz7ZzD7SzHjv/8PM/tnM/s7MXmFm/3McIOlL1zLPQqsFLV0rBITAbhC4YGe6kZn9evfMPzaza5rZ/+6mD/t/Si2B/0Aze76ZfWHX5dub2c+N7P7nmtm3mNnXmtkVKtrgsPB7G5L/BDN7ZsX1umReBL7bzB7qmnypmV1t3kcsvrW3dwfM2NH3mdknmNm/zDSCO2+e88BMW6/pDrktj/ksM7uVmX2DmX3iwI3/aWbP6d6xX90Rmf9eM7tfy4BGXHvrzdgfNeI+3bJMBL7YzJ53qmsndiM7Y785obtX6r4rHxPa+Cczu7YUSKOR/dfNd+Nj3d1fs/lu/M7o1tZ345+ZGVwnySBn0mF59CT/UUfcaeBuO/iujO7o3DfWEvgfNLOf6B7+V2b22WYGeWmRa5jZD5vZ9VpuCtdiAbhrRzYmNFN3q16osziJwJuVCDz43NbMfr5uRZ2+KrO+XmBmX5Rpq4XAf5yZPcTMbtxp2lu79g8bC9j3bD4+v9F6Y+P1x0rgr2Jm1yoc1BohPLrLzyfwZmjgxhJ4vmPPMrOLBSTf0JF33jvJOARE4BsJ/DiYdVenUPyT7nv3nu6/X3kMyNQQeNxb/tLMLtQB0rphXtjM7rtxu/mukYQiNw8PMjMIQOsh4hjmdO4xisD3E/g/MLPrzwD6J5nZ6wrvSC2BR+Pz+2Z2iRn6g9XlTptD95kZ2so1sRUCHw5FS9LA47r04xtrzR3M7Jc3rks33RKuh9zsnAQe6y9Wp4sHwHgH0bxzkJWMR2AxBH5Pirg2DfyeOjl+ehd355M7pRUde5GZXX2L367FDL6GwGP2+qquxwCT0xCWBoQJ7Wlm9nk9I0ajzz/cEPiHjz0EBJ97XDVKfeQj+G3HMEl7Xi0i8P0EnpgN1uu/TZwntN73L7RRQ+Dxb39ZMFun5ugjsSR/28Wt/HfnC49rDaSfdy4nDzYz3Hq2IVsh8KGjSyHw1zGzx20sNZfs+vdEEfhRS2ouAv+ZHXmPB11IO+QdEi+ZhsBiCPy0YYy+u43Aj36MbuwQQNEMj/yg7r+/o9tzDxqgIQL/lZ3/eQIBTSMaxxpB4/TCgp/7Gzs/pd8a0HSwweLDew/38fPP/qHNhN27pjO6ZjQCIvD9BB5gv9PMHjMa4XM3vnjzrn1+oY0aAk98yJeF+9+0OQD/qJmhnXhboW02vK82M9zkcgftG5rZb08cW+72HIFHOcCHfy4hfmZqoP0cfcFiiDUjiQj8OFTnIPAohtC8E7vihWBu3h/cZyTTERCBX5MLzYAFYCUGgkdvkp/cslu6fPt410mIcrDSR+D57c87f3cAwMfoCyqR4F4ig78uXI/LC4QCTSOBc7WChhAf/KgNJHMGfoxkqzlQ2furIwJ/PoEnwO1SbsFhZbrBhAX4qeEgy3tC4HiSIQIP8YgB3n+6OUB/eQ9xj93leT8TiCbXQGzQWM7trpYj8JAqNt5DExH4eWZ0KoH/9I2GnYA3/+7SMyxTaN5RLEnmQUAEfk0Efp4533craOHhgh/QdQSu+SP77tQ2n99H4NF8/5p7OD6baI5qhOwXjwwXvnsD7rea2VNrGihcw2QQCOsF7SJZbSTbQUAE/nwCj384uKT3h4MkwaMEu44RIueJE0mClcsHew8ReNwzvt3d/47O8jWGkPymndgNg+f7NjJIiMCPWSnHfc8UAv9pHXkn1sTLX3ead1KqZmTvCpS1zrgIvAj8PtYu1mK+Vwjf409ZiBV2K1j0EXgyvpBiC8EM/fGVWvOLdFq76F/49VMyW7ht9BmB3ODfi/9vYQOeF7cj3M5F4M8n8N9nZt8YLFJTfO5esjnYXrVbqfiqY736frdyhwj8a7uNKt3y8C5YcszixxrA85IWgzYwTXIon1NE4OdE8zjaGkvg+Yijeed/vZCcgfiENx8HfDsdpQi8CPxOF1z3sKh4vqfLoLiP/mz1mSUCz6bQiTtWAAAgAElEQVT2h+7JpMkjXV6N3N3M7hMu/NlOY1lz/9A1BN0RIPJ+ObG72BnDTC2ZHwER+DyBJzuLDzrFskRtg1ahyJJPV0dMxwc3EHjeYSwA3uXmNhkLWEu/SK2HS0GSv9gcKj6npYGKa0XgK0DSJacQGEPgCdSGvPOeeWFN852bq4ZD5VQdjQpIBF4EvvKdmPUysiVieU41CDicY3U7yEKFJQLvU/KA7pd0hZyGkEZrBxlBi5eEIALMl28durnh9+d2fUq3PGmTZeMmDfenS9HIELiHtYBKsJhcCHwjm8ffj2ivdAs4Q4AorkPasg/tgvXw9yXQdy5swJ/nYDnhOVQkw1+bAw+m4ibpPjVzEfjLdfEKYE2AMxt8Gv+cgYtNY6y8OOaBRwP/K2aG5ju9Q+SfvbjZybsaMy/+wCZF60+6fhDTgbtarQaeOccK5d/lO4biW5XDvOAy0h2iuUiCdStlUGltq3T90gk8VaGpXUEgFP+fNcCHgWp/7BFV0r1Dc/vAX7krqke/2G8JyqzdQ3j30p7HR459j48bWZRYz1hel/o+DhL4QI9Zs5B3fGO9sB9etwGzmrnGhY5Ch+xv5JXHag154FnEkaxF2E/Yg/iOMBYIEQHwZOYh0L52nc1B4D+6SwdIzAJrlerRvHtYKSkoOGeKW9KK8o3iOfwjuB+3X/Y+sptgrWmJA1pVFpoDO1aiMCZteRKs5U9Zywt4tp+VE5Ij8Gw+kL6U950PF3+rWbxsijFLzU8HMjIHjrgrkB2DZ/GvZYPkA4Y1gX8ENZWETQLfYj6+/z6y0xxkKDzF4SJW+ktNQrIJEH7YhixwEBmzKZFrn+egeS1V3eRQAlFMC5k0nN/sxlU6pE0h8BAM0iNCSEtYM34+DA8IMRcjId/KbTkCj/adtKo+sJt5Zg57Jbyb3lXtVWZ2xc0B76caCDzP4iODi1sSKhen1K9D3cn9Tlt8vPlY8yH+rzGNDNyzTwLPfuY1r+TO/4quv6zTH+tcpNIe6IfCeoXEc423UsbhxverDw7IkVd6xKBm3lk+QhfdKEN+MWPpIS0oShcOfTlXQsbL3sCeiauWt9bEfrH/oFRgP2IMY/ajLSyXs00OEnj3YNYw5J0DmBf2QeJLpqZ9pU3I7s02RJ0qmxyKSgoxAuvIUkWBtb53iflFqfEhrsNjA/Fe4RJQ0NxQSlW+G3fpUjP7vSTOJdY59urfHZjksQSetclaJ2EFWbm8K59/JO8vxeZIbvH6kQsOvkLWEiwxHMD6hL2Q94Hq0V2a0V6WNYbAc3B6dkgFDO+C79TGH46E4qBu49vnq/7idk1Ch4OT3IZzu83H+xFupASyflPlyKOmidtYlEupikVWHIJrY+W9vuFx4uc013KCYxMiLd+9XF7SGgjZdMltz2m/VtD6oA2OwVml+7mWDeEXtkzgqQRKsOfQxuj7CTEiIPkfawe/o+tKBD7mbqciJIXOauWyXQaMdD3rBe13K4HnHcX3zwv4/2ptR/Zw3RIJPIHAuAtiIasRyDQpRHPKjbkJPO8FmYau2dMxNIhkVPHC3oVLI4qLVuF9ZD0PuplUKoxanx+vryXw7DlYJS4fGiAzE6mQxwab++bQUD++0bUMosneS99KEq3fKKfYJ1okuplyaICUE9weBYKMRZGDgj84DD2PveUWnZY6d+0YAo/yAqJK/2sFyycJAEhwUXvY5FvJu+vdBGufB5YUYxtKG9xK4HOFxbCsohTimy2pRwCFJgf0pIBB6UKGs2rLaf2j9ntljsBzsvYp8YZO7n4EaBD9phk1S/scLRsUBGmMsDHgUuBdHUrtsGg4/fksIi3PxPQK+UIrOCRoDpivlo2XNkl7yEbkyeacGng0gZCGoToDufFh/eEETQrTpUiJwBM87d1oSI0Keai12LCmIOxJEgFrJfBE3cdc7ZBKCjGRGnJMNpptY780Av9LmyDHx45Ysyg7vLk24TY3gYcQ+LUS5yeX5pe5xzI3RZ630Qpeq4EcTXnW0L01BB7XQbSYkEEvWMuwsuRI7NBz4+9oblHojDkUYS2B+JYsdbH2Cs/Gysf81gpaYt4vvxbJABcFNxEOIWOzuHHA40CEa0uUVgJ/A7OTp5idqT08x+ehjcfSm+uLv5bDEGt6SrVq+ADj7rPAtRB49n2sRb5PuLVhIWdcknYEOCSzbyXhnUNpeVASCdaHdScX/xKxEULMh4Rc7RAX3+ZSCpZwYsYkHIWNHjeZ5NuH7xum0JsXTue43aChKwljhwh41xSuhUyBBVoL/OnACf9M8ndj2o5mXoggRW36SCxBWWwSuKl4wSWDLCTP73wX0byw2eAKA+FMwibk52ouAs+BL2LECRgtMaSG/nFIwQqC9eCWdmLXCroTCCd+/IOav6FFOdPvJQJP89GNho8hWrQa8WZu5hLfZqSVwHNP3LDS81l7fGjIbPP0CebmmvG0XLMkAk+8C3626SBM3A7vMbE2uDTg2sB6RNseCwCxtnFLOR1Yf+79TVlPcLOAmCXh3cRPMwm+tj69bnShQXNM/Az7s59X7woT4x6wmkbNHfvKo81Ofs/sDJp6yCxjhjjgroB2mHcyCvvZErSAQwSe/RsXjxhwDdEE/zmKumBRhkxHosk+gHX3BZ2mD3KPVpX9AC2qdwXhnWTvZ31FYU4pJuXXWUtFZJ7D/T5mBYUcSpsoD8zUVmE9s3+xV2M5x/+dvuCCwDsbY2F+rnMhim23EHjWHvOG5tQLbqx8S7A84RrG79SkQMEFptEVjHcWC3ZJOLCQ8Stq+PkbGnXmlfcdrT7zhzKScfNexMMa33HmtyS1BJ4DBXu3x5Xn40bk3UB6HqWfMgjEOK4WT5LVABoJPOZZToJJOAXy0tRE8PIR40XwghvJfXZkXi2BzsuK32O3gZ7tDR8yTmR9RIuPFho5/9HkxeLDDAnNSfQX5xrKc6PpLpFxNPb40/qgRe4jOA3SUNLmxkwh3MOixdKQM+kzj2yGpQ1uDgLPYQ+y4THDHQYywQeuJGyQfPzIvpIEsulJzz5fqnME/v0LGZNzykCDhhNNZ5LajYIPER+BJASzQtyRMQQeAgpRianyIm6sK4gDWij+12fA2SXGOQJ/lRkPbXzwS3E70QfejxviwoE/5yONkoKDeCxQN5S2szWINRJ43z9ifrAksqdBvtl38cFm70kHXogKBJ3kAUl4DyGNkKI+ye1hVMyOY97lWknP6iPwBDxC9NIh2PcPP2f28qnC/BM8ybubhG8C64VUqyW52qZfYOhJGkoKDgO5dUbcGHvMOTmxN9uZswfMMXFoEFL82+O9OSy5lnlGoZUTMIZUXj38yIGJrD5eagk8ByHWZIzdwi2GdY7FIid813FZ9LEjXIc1zLsA+3s5gD8qNMZeC0/pc7+hbxywU1rt1ARrLR7c0281BB4lHHzLjx3LOHNQY4HvWXJH/xMYeuvFNhIx7B3kSOCjT28KqqvpKHneo584Zjs+iPsUNk6f3o+NDI00BHhI+OARAOFP+qUAQUgrmjwfAIQ7CNqFGhcGClTFqmEU+MEcGiWm+eR3XFbYiPqEQwzzkYtpmIPA+yIK9IPAHzR6NUHGMX8r9+OjeIG/6B4Pgn0a+OhGgwkXM/6QKTfON5s5hz1kDIHnPnw7eQexItUKxA5SyIEJLd0cWsrys98/iTkCX9vnmuvAohRLUSLwNRZDCAf7oifHuFH5/479m4vAY0VB+zhE5GIQF/1hL8PiWCPR/Yf3uCVuqOYZY64pEXjGBXlPtRRi21j8IF/p/RrzbO6Jh3VIH5pS5mVICI5GwYU1J0kpQBVFSIwbQxPMt2hI8O3G4pME5YJ3p0l/hzj6eAoURRyghw547G3EaPG/SXJ1ImoJPIGzBMV6YW9EqTUkHIjQmvvKujwXJUZu/0W5xGHKY8A3psZ3Hm07c+I50/8rWPZpf4jAc/BgDrxVnD7DVWJV7SEc9Pv5COSUIH3fhFViGAk8HzCvocXlgw9GjaDRjoEdJdNdTXtzXIPZOWoGONmTq75WIMbxej4GUaOec9NBgwwxqhHINRpRUtclQSPCQkTL4wWSxoEpCRsLm2+NpQQtCiklY3DpVAKPGxDt+jXVWtyI9cYHMQnanlRVrQbDbV3TR+B5ZnSjqUlbxUcwmWCj//JYAk9fsGLgTsGabSVdrDMOvJjW+ywmc+C8NALPxxMiUBPgeI50nD5RQuzje5pwmoPA0zaHhJqCdVjacGVLgmUG8lsr7PnROsm6Iqhun5Ij8Owx7L0oSvqE9cweN3YMKHGwVnkLF1p9tPu1Er8RWEwgcLnMNJFsQsxx7ewTLAR8M7xbJZpqXPW8sFeTGcdLS+pZrMXJWkgbBAeiuPJEuIbAgylKLu/7TQYk5hlXnhrhYBO/sXfqMv74+yH7PMsLcWp9fuzx+THGj5odP1ToZB+BZ84h7956wAGKg3fOraoGB11zGgH4FHu6jw/kcORdFVePWSTwvDzeB7JvgcbB50yvaIprNN2pLZ5NH8ZITtsfS9RjjuMj3ZLnmPSPvPje5xFXlRgQi2beu3xg4i5phErj48AT03NFDHGFQSPmF2Zr4Z7oH0Z/phJ4NCZ+M0P7yUZVo91IeKAN8esFTSMaq9qg0DHrpuaeIQIfNXNoMHNBY+lZ8WCJ5ctroaYQ+PQMLEJYWugHuLYGOuMKhDl6W3EISyPwxMJABmskRyQhMKWKnnMQ+JbDLId5iBtaX/5xKGuxhEKGoxsF+eLRZO9TcrjzbnqtNv3jI40WOxZvIuWgr2/QMhYsGFEzChEe0lj7Z0Cw+fZ4F8OSkid+T7GMQXRx/ywJyjefbhAlU3T74N5YbJH9lfVLLEaN8A3Fqso/lDb8Y8/y99cQ+Nw6G0OyUIB4qyPugTFbEz7s7IPpnWC87I+1BwVwid94FB2lIPESgQc7yLtPq8x7xTogfuIAZW+2c1xUvbtb7mC3arwjgcfVwwfPsDhZpDWSC15Ee9oSiDE3gedk7vN/jvXljGn6OCX7CGd8Tgn2uYgDCi1da3VYTo1oULx5EmKMSTEJWoNoSuWQwfNrBc1vTFU5lcBjxv5S14FScFNfH4kHILDOH5ZatSS1GLRcN0TgoxsNH0TmsJTz2R92OOBwv3f3mIPA+/GxLsmcwWEQItIXfOXvYy2SuWMbGYGWRuDxI2fN1gia8Fjojb/hSpOTBgJ/9mOXM//eozILVk3/h67BNztqbQkQnSN3+tCz+37PEfh4PXs8xAxyyD7tY58ga7wDfWkcS8+PLm+Q1pimsmZsHAJ4B5OUDhXs6VhbfC2CoWDiSDBL3+94XW3cjh/fECurIfDxIMH6wjI85CIWcY6HHaxVHOrmrl8RLd+kScZykZMcgWdtQt59WlC+LXCUlixDFetsaHoqmlj/JTGxA0oylGUHI5HA8+L4aPlbDQTneCCIticK3Asagfi3PvDmJvBoqn0BpbNBtSNmL5INNgavRcl98Aj0GWNN4MBztghP9wrGYM5oVcCsGysNDg2ROWbj8KbWKQQeUyhaBDRMSVpMsr6/uDyhoU6yS+JSwm2IwHNfdKMhiIYNOyd8/EkdhpCRBOy9zE3gYx/4SHIAhdTzL2oq/fV8VPEbneo/HPuwpCw09O1UvMXACwR+UdvOO1gKCG4g8GefnCPwHKS2Gdh2oROzK50558KHe150ueFA2mK5HNqDxvw+ROAJasT9J7kSxveIZ3JQxjrRehgB++u7Eon4vcfaCzVjgvRBOJMQf0JMVk6i4qhPAcWaxFKMMgnBVYjgyJxViCw1PnDSB9DXjKHmmhoCHwnx2II77E+4HHmBS5SCcWv6n67B9Ya22CfhOLigJiGTlJ9L324k8MS3cb/XCHN9nxa/pZ+69nwEokvuk+zEbtLkE7BwVD2Bh5DGwI+WYjDR/YGhtxLmOQk8pJKN3I+xj1T1TVXOtQXym1w7cuZVNABjcg6fzkBwLuuBD7z5/13qycwHoOnUjYuPz9gwhcDnCM1cS79PyzHXM4baqSHw0Y3mCRtCR2GgKLHISi4QatsEPvYppWYjTWpME8e1rT7UeTxPL8+lEfi+jBJxPLkgWLRqpWDtOQg87ni8s1OEGcCHm75e2k7s0nbm7OENiwzuIIn85Z6xdAIPoYYg+TggtNdoNmPawNaCa+AR/Z+nzIO/F4VFTHuZfo/1HXABxfUjZ23FPcBbfHHF/OpMJ8EEBZT/LtbE7LSOt4bAYyHxygv6j+W6VVAcRfefFus/FkoUKri18D7wj3cERVJfHFELgUc5mquAzJzyfY+xeq0YnLq+iQlMetKibybvu3eLHOuBsdhB+pcYE2nUsLRoffDPw+TupT/w5vxVhp9uzLOcA49NLGq3ow88H5xYeQut45ggEbTpkBgvaMm6kspnTbY+TzKmWj6GLf7fqW0OPZhVk8QMFzzHZ5FJZdZbF1l0eZlC4Nn80CpvQ0pEeBvPKrVZQ+CjGw0WCdZgTIPG3KZsQawTfCLje7NrAp/GjesSPsJo5GIJ87kD0rdG4Cs+XjkC3uLPvA8Cf9pFp2KQ3aSimIGgQW55x2PdiNr3aMkEHvKOe0kuQBXrKNrZGAPS4jIFRriz+AxjtbgNXYdFoFRFm28IWnWfcKAU70SGGx9zVXK3ya1dLABYAuaUGgLvA/l5dm32mVw/cZvx7kYE/MI/SgI5h9xB9Hn3ozdCDRYtBL6vPQ7mFOsaG2Bd09djvAaXSJRSSfqsXavExy9aXE1wOfHS6n8MEfER5Zjd+8zzY0HD/IcZ0Esk8Jymo0aMky4a7VYhECjmfkdrmSL5Y35ZNPNjP5R3DnEHYOoPNWiPbugGAKGPhaNqxteZhC+4dAqBZ/PZVtYSUlP68daMbe5ragg8z4xB4DktEEFvyeWJQ5T3h039Hk/g64ldH0a5gHQqR1I8ZS7ZGoGv6ODFTsz+JZyu+zToscl9EHj2gHjQGxoqLh6Y6EsEMXc/cVAE0/lsUFy3VALfR97T+KLbIX8nGJTAxxgLVMKU68dWCe2bJw76BAiXBL9dr5XGh9rHGnFfrCmB5ZfDRs4HnLXw+vAwXJOigirfn/r9pYbAR1ce9gRfU2Noffvf4x59u813E2t1FHjOQ7pse7WkHe05uKNsSa6PtDuGwJMUgIByLK9eSABB0hDJfAjEbFxjXbTm69HMLfkFTJqwqC2EOMUS7X1dQFsaP/Ke6M7V/RoCn7MIVGngM3sU5DZq7tG4pkMEBNpneZiigedF9jlwCZbzEesxz+/YgkeRbE4h8JiAY6AjKUVbAmtLa4MUmfsugVxL4E+70ZzYL9qZU6nfyA7iD5Clyr61BB5Sh+saax0tHSSLD9dUTQ6vAD6c3rQ/92F8rwQ+k13n0Ah8DBDMvV8oGlBC8O6iwSUeA1N+TmGxVAJPkTyUGn2CNYmAthhrwlgJdj2P6Ga+AfjMe/9ntHkx0HfM942DQSkVIe3FvTUX9O6tetwDcfGaR98vxhD9/1sVdTXjrCHwMUvIFA08e553USEX/uNDR/lmM2+x8rm/DHw54OAyhWYcxRTffg5aUXnWSuA5HONLzzvHgcln/NuKK03NRE2+pv5QN/lRjQ1EPjo2bqXxsbu7PJ5AWUS+GmZrISauR1PnZRuRvzUEHnNazMs81gee1FYxINH7uGOCjAFmY33go8YFIuV91ePvfHhbCvekuaFSo4+Gn0Lgc/NRam93q3u+J9US+OhGwwEGcp0LquODAwHPBQbWEvjcupvDVxrkIilgb2hNRdk3AyLwZXRyQawtGvjzYna6byz+4ATJ879onkuFrthPYlaMNRN4kMYFiYNKtIz2kTA/Q1hzvSJllxpTrL8+HaQv8MfUouTxOcX7NOocZth7/LcfS01NMaqWHbWGwGPpobJ5krE+8KSIjPFm8VsPuYeIxyqy3MfY+Y1vLd/FUhE+4gp4t5K0EHgOBWRASl4BxJ0wr97tB+UOpH6qAqZlng752hgk3ZIquA2XPR1iIoHH384HsbVmEsHfko+Cz/zCyZUTbylHchtQ566uIfBcF7UmrUG1qW9kQvHmLYiZH2NOAz02Cw0aAk7pSSgH7Is2kRnoke53NDh8lFpSbxH0Q15h7+c8hcAz72jzfHtzlS8fsz7mvqeWwPPcaNnwcSR8aFPFTg58/JaTWgJPGjs0RV5wf+HDMlXIAe/b4aPiD/dT2xeBLyM4hcCzp6Ph84dzFBk33QTlkdWkRnJB+Wsn8Iw7ujomLGoszZFsbo8MnD9DMUDVJzaIiR9qspLhxuGDMynMRPKEFuEbDNEtZfOpIfAQZywoSca6OJA5CeuRl1jAivUfNfLswfy9NrtSDLptIfDsp48IfSQzjU8Rzc+7PBi2zPcar6UegM+mVapKvMaxne1zJPCxvPL9Ni8pp/0WyaXuIpWkr/Da0l7u2loCP1ceeNyIfEVQzGpec8DpHpI3NQ887bC5elMteBJUmCSXwx2NGZr4WuGAEIOWphB4not2y7tcjA0+TfmmxwQA146/9boWAh+z0SRzdkx11nfAqSXwHJj4gHofWlyOmIep+MVsSH3Bdq14cr0IfBm1KQQ+l2qx1bc4R3SxJMWkAGPmfco9ubHVuND4Z8a9nN+I/eKdwcWhJA8OOb/Hvg+8qxDfmqrZqS+QbfrmD9ApbSmkxBcTqnFDeVpQHgwVnsthkvLZo6BDMUGFc+9GWkPg58oDH/dclFng7DPTUHEVDXgSFIpYVGqLV3Ff9NmHkEPMc9JXiTVdj/YdLbyvy7FeV5opb/Z27iUBiK+cXIqLOPf0PWnRpwz9FIE/MXv0mdOloSmnTfaCFmGzQQPkNdTcH6tNtrQZr83lXc+5+5BRg6qjSdBEEYgSg3X7+oLmic3am7rYrNh8vMQNIqZ/rBkvmqDozxkr9eVMpq2pFnOxClMJPNoIv5lBenEpQdNfK/hxs0kmP0ReQMyqFB7Zo5y83eyMJ8nftzms3b/QIYLEyE6U3i1ID+4PP7kJnEPThbBJQ4jAKCe1BJ57cVmLVV/JUlSrbc09n+wXZBXyLgPREjR1PkTgywhOIfBkV3l4aLqVfMc4G5rDMksmll7Z3jfwbMtzEHiw4JAb0wNSARpf8FJlzphpDByo9omWr0UgdmRAgZCzv+HSVKP9jv7XfH/4DnmSwr7JOztUsyHGWbEPEfQaXU5L4yKYl33NuyPFLFU1BD43ny3pH1P/oosR+d+9fznXQdh9Np8+8p0bd654W1+sQQ2B5zn0E394b72WK80FMzB6R0EZineCP/SiuIzVlFve3cVdGzXw8STLRgdZbhVSXeUiwO8VCHVru1zPC44Lic92w99zBB4XA3w9/Tgp5JTS+NU8P2oiuQfte8y6wukumsiosBarppaeyQuMGdBr9nHV4cARy2dHzQW/YzKsKeuNJhg3j5jzeSqBz9UBaJ1vLD4QOy/RFFozZ3Nf06KB59m5AOHHuuwzlHonrqIkLQSejBRks/HCukHbFDMn1eJC1gtiLby0FmUbetYxEfioJR3K6DOFwEdyxjzwEav1q8W6iQLGF2WjDTRZMXvJ0BzP/fscBJ4+obXP+Xz3FTTiAI9ywZNWyIB3dxwaLwX6YmXy2vLu+HRziE6COweBqgSCJuEwwaFiSHIKsFs0JAtgL3iiewjfHw4AaOOT1BB4vkEcNnxRKcgsYygdpOLYcjVacvMYg1xLFXBL2JG5JmaOYU/HkpqTWgLPvbm2UT76dNJDc6rfTyOQcy+tUkKsCcgLiG13ziEi31cvY9GzYbWWJKY53GZy6Q3ZePCtby3Pjp8bhLBUta4UcBsDTzCvQW5wFxoSfEEh4D66vRQ0ih84Hziv2UFzj3tLTfq3WKqbvqHlRdsbhWdA1gmUTQKeaJBwwSkJGnE0TV6zmq6dSuBpB80BmVaSYCYGw+ifmOsfOHGdt3S8yOzki6Z7gwxN89DvTRp4GosHYUzWWFKS4HfpP4CxAy0EnntjSlD+RkwCJJnDbu3HkPeWNKYcpPya5yNLNqmYpWoIuL7fj4nAozTwFjtInHfJizhNIfA5DTx7Jz7cQ8K7x1qKaQq5j/R5BPjtUzIE/uRGZmeGstDk+hyLvHAN3zuwKpW1jwkEuCdpwodwwS2S/THFwKR3lP+u8cHmEIbWPn1f6OuPBoVYS+X05AKT+k0fUJb0uRFxLXwAcurTQ+eIbA2Bpz2+b9ECUUtesWzyPfZxexwmOGzG72DUwLfkBCdWiXc2FmL6JTuxbys4K7YQeFxvUTTyfU7CXktCApSoy5HRCvGdDyEeMgke9nFBO+/QNh4YNfCciNHeeV9ucnyXNrS+PmFm4yWJJbnTPWwguHJAbkoBrpAGiA+ExxPD+Fx8727tKqP639E48/HyphR8EKmS2Rd5Tx5kApUg5kkwUUJ0SzlzOZjgK+mFhYPGp/Qi0i+CWaJVABMlH82SmwXjxYTnBV9EtATR5QTtPiZgckKXCmXNQeCxODCffl3hY0hRjT6XDtYYvqnexMm4IP9Ru+zHywHJWxJw+8iRj6nvTqsGPrrR+OdzGGacfa5FrQQeEkDKM3+gS88EEwpaoL0raVDRgPGRukPIdpHawFqA1WBOyRF4rE81ZKanH+d9YRhzPHi05nGPz2u9H9cp5jQJ5IKPSalS8xQCn0sBiUWId6lPEYOlj/249P70ZTdC8RPTDZNGtsXSWbO25tLA8ywyl5BG0pMm/s4eCoa595O9k3uI0/FCggPIdMnKgXaaQwb7nBfuYe+vleiHj8abcSA5LXhfu+z3pNb0rhsohajeWjqo4RZLeXpfu4J3C7y8JYDn1hJ4+k86Tu+rzP1gSjrlUqwAVgQwjXVmSDiBu2KU6ILE7zVZ6dCw45KWy8DVZ0ltIfD0BZ4Tv9tDrjTUgIkWF/zpS4HFtessXsd+FD0OGDscpE8elqknQSrvVD8ndy/EO1p/sahwSGwRlJ+4bSd59MYVmgPuQUmukIogEXwAAA2aSURBVEHUWNdqGHLAQH75KPgsKrnr8K0kep4NiQ2FDZIPXI6Q+Pv5AEIEHjUwK7E4UrqcAwaaGA4oLHo2KDTBmBPRZkdhs2XT7ROIEhuDFzZ2DgO8cGx0kFo+BmyEuN5g7onX80LjV18S5g5SnMMWH2w+2hzGIBts1r6KIB+nmE6tlHosFvUZ8u3PBTEzBog4vrX0CwKDiZ7AMWIsqB0QtRt8rJi3PolmUbQY+JfOLa0EnudHN5rUp5rKua0EnrZZr5CovmIzZJniI8264D1jbbAO+4qt8THkozhZArXOEfjJz8g0QApWPqZeWgl4bLb1/lwGDKwafATxO0Zh4uNHphB4+hqrcvI3DnhoNnkPE5FHeQD54h3E7dErbmLp976q3DliXZuesWXO5yTwPBe3PxRJ8TvYF4DPvsw3Mt7De8VBmfZ4z/idbxiEmLmNxZr45rAvt1i1Yh0Jj92YRBHEh7EmvLAe+Z6yT0HkWSsoJBg3CqpYjbaUNaWWwPNsDoC4/3jrK3/nWwmmWI3hCBfuLIE37qqoRjdQvpf0M3eQwuIVD5kcDtD+M15iCZKgYEEZhULDH7riOxGTWXgcWwk89+Zi0/qsETHujja2kS2KgOnonlvzHcuNh4NXn1UhZtljTCglOQy0SPQGmNsFtKUvW7s2R+ApL+wL57BIcmS2tlMQBV4E/LnGVieNz0ITzoaF+W3I5JfuhYj4bC61/U/X1aYgYoxoKdgAxkh9yrcTu5CdOauF8O4ZQ8/koALpR/vipWRpaSXwEHFiAYZO53395GDCCzeUqWHJBD660aTx8vFhffTJGAJPe2g3CDyP8SFDayL3O243fOBbNIQtzzkmAg+RG3I/wcUiWdumEnjeZVwEc1pD3hkO0Oz9KEpialD2H9553B+9f3efImetBJ71mnOL4e9YaCEgOSFLD3vc2LSqpH7lm1r77fJ9QFudi0uLyQ5q3kX2alzsUFiNEbSiYJHLeNVC4Hk2VmrwjrEXtf3iYIrizPvhx3tzyrV0DcpAFFscYnOKQ6zuWLC9JRk3Rd7b3IFhDIFHMcChxbvh9rnSLI/An9bS7IvAo4hlj0vWJaxTHMqYr4OSHIHHpIVLS9LkcQJnoy8VN6gFBBMtJlXcKca+pLwonPwgOFGrVtMPNmWymsQMOX33krEGzUMsUNV3DxsjGQIIUIpagr77MM+ymfpqnUPj4lk8B3MjGoo+gbSjaWNxxyqpaOJycQmtBD49nz5hBvVavaGxQNjBjXiAGr/tJRP4nBsNlhc2kqF3aSyBB1/ax+eag3i0agzhn35nHTJ/fe5LtW2VrjsmAg8GmHBLAW/87utGTCXwtIfbEx/QFqUJWmEIGRqy6LfPgaDkXrNmAs93jv3Wp/IDP8gc1hsswzlBew+Bja4fQ+8FbpsoN8a6OeAWEDNgoZ1mv2mpBeL7yeGMPbfPeuev5zkc7vlX2qdbCTzt46bFmsV1tlb4BqBFxzI+ZM3AIwD+0KLwgvyh/ON9gLfAB/zBjXUQlWH0fQyB5z6s0fHgWHKlWR6BPz1r+yLwKB98SlM8H3LxmLVrbLHX5Qg8nWXA+EwnYfD8bQ6BPNMeKRP5IAxVd+QAQWAtmma0i4OpzAY6iSkT7Shm7T7XATRmbNBoWkq+qkN4ECzKoYWxRr/JdC8bIO4W+NkxvrGbMKd2NOs8C40frhHML1oeTH0cQAhQQ1uCGTTiyKaZ800bS+AZH33CSoLW2VcKjLjxseSFQ8MRfSn7MF4kgXdKiOhGU5tveQqBT3iBN+XE0UrhqjRE5jlcYP6HaBKwVXOAGlr/fb8fG4Hno48VD3eK3Fz4ugBzEHiwZ3+DmLHflvZZNO4kFiBrGOQyaVMJaIxKklJGqDUTeHDCNYU9MmrUOdAwtpIlEJcPTP78QwFS+p6ypxMbRLrf2qxkpXcH61qM/SklO2h5PzkA4K7BNySm2EztQJCTAg1LQJ+MIfC0x7uB8gHXUuLXSpiihIKT8E4Npc30/aQ9DqkchPoOCrjUoG3HldNXLI5afN4ZKtlGGUvgaQdf+HjIyPn2i8DnV2CswLqNGK6Wd2tr15ZeDnzz2NSTzJ0DOrWLdppATbQf+G6h/ecFxtSBFQC/K7SBQyfrsQBBdNl40VpiNkMzystK+r1U8nhs2/4+TDloF6hIyzjRlGPqQ7uDv+quC6TkfNo4WEWt/BxjT20wdogk4+dZaDbQZjC/fAxq09zl+pRyoePnC86rkR0F9WMFuWKXAYO1jiaJd4/1znvGwQ3ry5DL0mpw3WVHG+eQjBm4OhE8yRygHCBwErI4MYC3OGr2G2J72Gsx+UMoIUAE+HLIjGlqp8CHwgDlAa4pPohsSptruJf3CtclCDYEmAMw+ynfMPb4Oc33saAQ+yr76Bziv1WMCa081gK+hySDmHOtDPWXbwWB7QlTvhF8Kxkr+9VYZVd6Lt9B3gva5x3BhY325/7+D41z6u8+bTccqqX2ytRnz3R/4y6aeWrXAhZH5jBZk9hb4XnbVkjNhENbMyUCTys+EAotOB+ebRK8tp7r6ikIRI0ZWrha8+mU527r3lRBeGq8xrb6p3aFwDEgwIGEvQQSWJsK8BhwmXOMEFqfEhSy2Zehbc5nq61lIoD7ECm2UXTiJnSQZLUSely0fcYaaprgNn2Q0kfgyavu/b5by3EfJGALGRTZXNBGkCKQf/jgtZy6Y7pLzH34e65R0Jxw4karXJO5Zo1jVJ+FwBoQ8MXcCEock599DePcZx9xtSTXfxL2clxzJMeLQFJgYZXAo+CYBUsmVhUEhTPuiH2BzavGqo/Ao0VhQaS0fLh7YIrIRZyvGoRdd366seisBsZXbG0p4MFw/7TzL0xDJ43WlKwxu4bQP89neyGzQ1/qzX32U88WAoeOwG91wbO4ZmGxHRs7dOg4jR0fSgpSVKYsKbKMj0XycO4jTgDSCq1orS57OCicGwnE3dcsKtUEOJhx9xF4BhlLTtcUPjgYcBY8EExEmIqSkC3EF9fo63pME8q15Comt/GaJAUjoZEi+IxAZw41OmDGWZzhxLimhaG+7hwBiCXVe1Mue7KCULxKMi8CsSAYtUXYzyXHiQCusKTTphAfh2XqyUxN8rFmJFMsHGMgxocg/jljTxaHzRCBp8MEsxLUigwV8VncAA+0Q2QIilmB8IEjbWMfgaW67OODvzsBjFhZ6oNIl0EICYQlUxDZfQjGIzDQF+M40KnXsITA4hAgm1hKOUqWFbI+4AvfJMvYVpq6vK2LsX57P2YSO2AhxVXGpyXG9x0feMlxIsA7x7uHJYbsQWQ6Ola5nJ3Yq+zMBbnfUSaQQXAxso39rYbAQ+7YJNLGsUZt7WImcaaOMBe4N8XcxQQe4w5DZok3dWY1IvnJzEJ+2ViQiyh+/rbNfN8zDTnbDHn9r9NluyCjjWQBCGxjo1rAsHq6cHwjzoDxkG7PQfterwxY9sTuq3eQD+owkB4R6yIZpGJxNqqKkjJYcrwIkFWKCqVkexpK63noKPmc8/AgMkIdfDBvDYFn4imuc7duBRDwCCE8eHAWvuLxfcPfO5boru0283fbjvDX3qPrhIAQEALrQGC95yosGMQTlAS3AHLykyJPIgSOHQEqE6NkxlKFUvILuyyKB49LLYGnCAg+xmwaCOY8NL2S/SKACfWJjZXr6DGBUAS+Pn2/3dfTjxuB9TKs4543jX7LCJBJpOQaA0HBFVIZfrY8CWp+NQj4glZUpKd43VFILYEHDAIk8IEnzyjFX8hI05K68CgA3cMgfTXAoVSQr9oUkHlMV3XxoIM79jAPeqQQEAIrQWDhR0fie3IugRQwurOZPWslMKubQmDbCOBGlg6zVFMmXvNoXPhaCPy2J0LtT0cAP0lca6jyiGsNwVAcsgjuxPWJCn6SGRFYOBGYcaRqSggIgR0iQP5qyMilukqoKF+ev8Pn61FCQAgsHAER+BETJNI2AjTdIgSEgBAQAkJACAgBITALAiLws8CoRoTAkSNQOtXqtHvkC0PDFwJCQAgIgW0gIAK/DVTV5lEhII56VNOtwQqBPSCgXWYPoOuRQmDRCIjAL3p6hjunbX0YI10hBISAEBACQkAIHA8Cx8CN9k7gjwHk43llNFIhIASEgBAQAkJACBwmArvgrLXP2DuBP8wp1qiEgBAQAkJg8QjUfikXPxB1UAgIgWNDQAT+2GZc4xUCQmCvCOyUM+70YXuFVQ8XAntFQK/aXuE/yoeLwB/ltO9o0NrRqoAWTFUw6SIhIASEgBAQAkKgQ+BwCPyBsqADHZZeQCEgBISAEDgPAe34WhRCQAjUITCSwGuTqYN33quWgfoyejEvsmpNCAgBISAEhIAQEALrQWAkgV/PANXTtSKgg8JaZ24//dZ62Q/ueqoQEAJCQAjsA4GjJfD63O9juemZ5yOglahVIQSEgBBYNQLaxlc9fWvt/G4I/IEs7gMZxlrXqvotBA4UAe0stRO7M6R29qDakes6ISAEhAAIvH9z2g2BF+pCwCOgj6PWgxAQAkJACAgBISAERiOwVwIvHjd63nSjEBACQkAICAEhIASEwJEisFcCf6SYa9hCQAgsDgGpExY3JVvqkGZ6S8CqWSEgBHaKgAj8TuHWw4SAEBACQkAICAEhIASEwDQE/g+/wziA8OWnHAAAAABJRU5ErkJggg=="/></switch></g></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-47"><g><g><svg width="35" height="35" viewBox="-0.5 -0.5 28 28" xmlns="http://www.w3.org/2000/svg" id="svg-image-1hA1hJf9LLPQGJtWkHpP" x="784.5" y="109" style="font-family: initial;">&#xa; <style type="text/css">#svg-image-1hA1hJf9LLPQGJtWkHpP .st0 { stop-color: rgb(91, 115, 139); }&#xa;#svg-image-1hA1hJf9LLPQGJtWkHpP .st1 { stop-color: rgb(34, 53, 72); }&#xa;</style>&#xa; <defs>&#xa; <linearGradient id="A" x1="2.039" y1="3.474" x2="23.454" y2="25.309" gradientUnits="userSpaceOnUse">&#xa; <stop class="st0"/>&#xa; <stop offset="1" class="st1"/>&#xa; </linearGradient>&#xa; </defs>&#xa; <path d="M21.747 13.2a11.35 11.35 0 0 1 4.164 3.945c1.059 1.68 1.589 3.579 1.589 5.699v3.123c0 1.022-.53 1.534-1.589 1.534H7.282c-.475 0-.859-.146-1.152-.438-.291-.256-.438-.621-.438-1.096v-1.589H1.034c-1.022 0-1.534-.512-1.534-1.534V19.72a7.27 7.27 0 0 1 1.261-4.166c.803-1.209 1.921-2.175 3.233-2.793-.464-.528-.818-1.143-1.042-1.809a6.88 6.88 0 0 1-.33-2.081c0-.877.165-1.68.494-2.411a6.17 6.17 0 0 1 1.315-1.973c.568-.573 1.237-1.037 1.973-1.369a6.06 6.06 0 0 1 2.411-.493c.256 0 .493.018.712.053a2.65 2.65 0 0 1 .712.11A7.41 7.41 0 0 1 12.926.377c1.134-.585 2.394-.886 3.67-.877 1.096 0 2.12.202 3.068.603s1.771.968 2.465 1.699c.694.694 1.243 1.515 1.645 2.465.403.912.603 1.918.603 3.014.003 1.152-.239 2.291-.712 3.342-.422 1.001-1.08 1.885-1.918 2.576zM16.594 2.623c-1.315 0-2.428.456-3.342 1.371-.877.877-1.315 1.973-1.315 3.288s.438 2.428 1.315 3.342c.912.877 2.027 1.315 3.342 1.315s2.411-.438 3.288-1.315a4.54 4.54 0 0 0 1.369-3.342c0-1.315-.456-2.411-1.368-3.288-.877-.914-1.974-1.371-3.289-1.371zM8.651 5.749c-.842 0-1.571.31-2.192.931-.584.584-.877 1.315-.877 2.192a3.09 3.09 0 0 0 .877 2.192 3.09 3.09 0 0 0 2.192.877h1.753a7.98 7.98 0 0 1-1.15-2.137 7.63 7.63 0 0 1-.438-2.52v-.771a4.01 4.01 0 0 1 .163-.766h-.328zM2.623 21.311h3.233c.33-2.521 1.369-4.603 3.123-6.247H7.283c-1.315 0-2.43.456-3.344 1.369-.877.877-1.315 1.974-1.315 3.289zm21.754 1.534a7.4 7.4 0 0 0-.603-3.014c-.383-.921-.942-1.758-1.645-2.465a7.26 7.26 0 0 0-2.465-1.699c-.971-.406-2.015-.611-3.068-.603-1.096 0-2.118.202-3.068.603-.912.403-1.736.968-2.465 1.699a7.67 7.67 0 0 0-1.645 2.465 7.4 7.4 0 0 0-.601 3.014v1.534h15.561z" fill="url(#A)"/>&#xa;</svg></g></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-48"><g><path d="M 840 259.5 L 770.06 259.53 Q 760.06 259.53 750.06 259.46 L 686.49 259.04" fill="none" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" stroke-dasharray="3 3" pointer-events="stroke"/><path d="M 681.24 259.01 L 688.26 255.55 L 686.49 259.04 L 688.21 262.55 Z" fill="rgb(0, 0, 0)" stroke="rgb(0, 0, 0)" stroke-miterlimit="10" pointer-events="all"/></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-49"><g><rect x="685" y="212" width="150" height="30" rx="4.5" ry="4.5" fill="none" stroke="none" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 1px; height: 1px; padding-top: 227px; margin-left: 760px;"><div data-drawio-colors="color: rgb(0, 0, 0); " style="box-sizing: border-box; font-size: 0px; text-align: center;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; pointer-events: all; white-space: nowrap;">Request authentication</div></div></div></foreignObject><image x="698.5" y="220.5" width="123" height="17" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAewAAABECAYAAABDEgZXAAAAAXNSR0IArs4c6QAAIABJREFUeF7tnQe0NUlRx2vEHFERc0IwK2Yxi7qIAXNAUVHMrooBjwHUVTGDqCyrYs45oWJCRcGcMWGOCLquCTGw6uP+7pt+r17djjPTfWfu6zrnOyzvzkx3V3fXv1JXD9Kpc6BzoDEHBhE5a9xmb65zoHNg6xxAcnTqHOgc6BxYFQe6SrOq6eidWQkHOmCvZCLW0Y0uJtcxD2vsxdbXxtb7v8Y10fvUmgMdsFtzvLfXOXAMDnS8OgbXe5twYNG1t+jHNjc/bQB7Uzw+cmeP3PzxV/C1Z8Dxp6D3oHPgRDkwXbpMf3NJVrYB7CV7vJJvrWP6VsKM3o3Ogc6ByhzoEqcygzfw+WHvrOjUlAN94zVld2/sCgf66usLYvUc6Is0OEXVAbvzfsnt0bm5JDfLv9X5X86z/De2zt0m/T9opEmr+ZPYn6zKgeqAXbX3m/l431SbmaoNd7SvsozJ60zKYFJ/ZK0csIB9DxH55Rmd/T8R+R8RebqI/IOI/KWI/I6I/NT43V4tYgZz67/apVl9Hm+ihTuJyK2mp3cTkT/bRO+328kvF5EHqu5/t4jcd03DaSkhEm2BK3dXvPloEfnqEl61HEtJv2LPLg3YsbZ+X0Q+UUQet1Tn+3euJQdeT0TeSkQecS1HP3/QOfzrgD2fz/oLzyUinyoi3yQif3P46QvoWD1gL8sW79deQkQexL/agN1gLIs30RKw6TwWNpPxZYuPpH+wKgdWoI2+oIh83s7yu1FEvmtn7X1A8YBXMIjiPi/3Qgn/OmAvx/e3FZFbROSVRSTlpUgD9umu4WcTkY8SkS/YYcR/iMjLJKZgtoW93BS3+1IOYOMa+8/MLj37DowRDC+QeP69ReT7Mr/ZH+scQOh9i4i81MiKb58E2NeXjwX82yOCB7CHu4mcJVzip4smE5bOc4jIN4rI/dS78wE71JFts/7lReR7ReQNx+E9pQO2f6JzAHsKuL6IiLyRiHzgGINBe9J0204A30VE/n3CRuivbIwDC8gSa3l0wC5bA6X86xZ2GX/N0/sVf8ddPPpfzA8pwP7i0YPkXsOo+eBZXdnGy++2i0f/oOpqDmD/koi8tnqH2P/Xb2O403s5GGHqSzqbAti6R28hIj+yizm+kOnmZ4jIF9quLyDcp3Ojv7lWDpQCzlrHcax+lfKvA/b8mZoC2PNbXdUXsqX5FMBe1UhbdaaWhW37/w47i/ux5o9/uHODvEargR67neyle+yOFrXfbFSlgHMwimY9LeJfrYcPRlvKvw7Y86emA3Y+DzcM2G0lSyvAZupwYbyJmcMXFZF/zp/X/uQ15UAp4GybTcvLgFL+dcCev4I6YOfzcMOAnT/IJZ6cAdjFUoXsv083neaIyW+HBlLcwhIc8X2jYkcqfroWN6p/18OTUsCp3seNNVDKvw7Y8yc4Adh95ysWbwyw58zdnHfPLz7TVCOG7b4PWAPamt40t1CLGiYJbGQTvpKIvPjum885FmnhfCNW/H/P32v7LyC04AftPK+IPFVE/kJEflFEKBCzVWrBvxce54jEQv6bYjq3iQxPEzn7ld15/H+DeQVLtxRwlp4bMn7fYJfU8rIigleIMXFEkaTJvxORJ41FgvztFgx06Y6P3yvl351kkFv3I7wkmzDFviM/5RXGfcgc/62I/NouUeqvFhoH+w4Z8dLnbQy3i5xRkOlPReQ3xjlYqKmLzxCme30Recnx+7T3JyLyqyLy/wWNHcvCZn+/1piQ5eQjyW9/PY6BhN85NG8v+Fs+FmBzPv6NRxmPvIf+cTwrTwGxpbBEj3rW+moJ2F+329AfaubrVcbNkLOAXlFEHrKzyN91FJq+dzh+RlU1zuv+Vs5HPc+Q3f6ZInJvEeGYmiWA+2vGhLln7gTHO49Jde65z9n9x02Btv/J9P0+OyD40YJ+soBYZI7uKSKPz3y/Bf/ea7fgP2bXp7ce8djXNZQdhC2Z3qyJ/wr0n7PW75s5NoQRwLEkAUjvP55yeHMReb7ExznyRJbqzeM50tjjrykiv2ce4Cgk509zyKdY2708h38xCxsQYH+9jyeR1PWd+SWh9AdyBuN5BkXg00TkbUTkufXvSvdBsJJFTV+eltkOc8M5fkeE6FAgATlk06eMZ6V9n6M9jhZ+voj8a6C9V92t2T/K7AuPfchYTMW9kj6HHf4455YpTMWapfhIiH52rIPxYwX9zNsLl5OTsxc4c/1VBX1AfmlFsOwc9lWlGSWQeiDkVl1ZX6o/yCWKfLGOc6t/1l5fzSzs5xmZfWfFkGeICMe/AL0YsZk+d9xMLJwcwjb4hnFzovnnEN9+2M4S/Lich0XkN3dC9z1HbZYseEdrA+wk/zwGYCn/ABuE573ivDtoidK1CH4EvKU5gJM5hcHHqKQG+OJdKRzS3uJ+DxH59ciLWwXs19lZu18rIliPOURpzfuPHpaL5yMOBzwX8P3dcz4+PoMcwXv3yIx3fAIVcGHtMuc5hNKNog3QWzoGYLO/UTSQO1qZT42Fc88oDPAvRvl74fArsb3QFrDP+8b6wtji5FMJff+o0O09gxGqvb6aATZaKce4ND1mtJZjDED7wRJDAE6hJ4xt2POQ9luANecA3zHQCLXR2QxWYSDTnbHRR0drAuwK/DsQt3ghfsGTUJg7X7iVcUs92bxwLMAGLL4n4F3JHROJlAhvW4/bvb9FwMaSffBojebygeewSgHtFFE848dF5NVSDwZ+/8rRwoy5ra1AfXsR4ewzikgJsWYJkeCa19QasNl73zqj3jjhPZTsUGGsmnuhNWCzvpBTL1cy0epZPCd4UwmLhmja+jrUYEPrqzpgA3C4tgAxS28pIk9IRDK/zVQK4hu4DR89uqHRjrGgqYD1dmNpu7uahnCR496OXTzCZreWNbEe+o2VgDsMtnJQH5fahymXLzEu3ISO1gTYLfiHEH+oh+fUTSahEIsEIQqP3my83ADA0kRYAKtFE+5KNhn0QaP7yv3+RBF5lHoYK0F7OSbuScHthqtau79ZNz80gjixatYFfyOWzeUDeFlQKG1xINx9hAd81AKw5/DP5xLX42DPfefOKv25MXaPMgsv2BeAliVc3MxZiJ5/9LIQItNEXgrzjGuS+DjxU+aItcJlD1RV1ETIDAU6RFagonC/unqYODVufP7OGFl/zO29B5HBCBAUfGtI4Gl6p/F7xN9tIY9PGPNtXJO0h5fJUalLnHr6fFMTew2ZhcLL/Q0YK8TjUU5wA7tqge4dLsyAl5Zq7wW8V66yGcrPJ6sOoPDq0AU/sb+1N6DEJc5eZf3ZtUloAyxB/uBuZ4oJrQHMH+nxJP3x2GcMOB9NXl+eEKJvfS0K2AgsLLoXExFAkzgBcSEndPUA0QoRwjF6gGfBYzET1ySO7CMEx5d6wBeX2RcF3kGwkaymCaF9g9lc+ncUADY2rn5LawHsFvy7wyhIEQiOYuPnGawCFAkbnyZRBgHjo9KkqcTSCv7MutQ1ym/f9Ym4PN6gGKGIEBPUxYEAdmKJ/+t5sQVgj83u1fdS/sUAG/CERyiqllgPAADArQnlDfdriLDCqYqoCaD+pEjIDN4CTCj+jsiPwIWL5egjK1DdMyiVyKrzeT60eAA7XMi65DLACPj5+MBXpiSdlQA2eRXIQ03E8kngQhHwES5hwAnZrAlDxOZUtNoL9GNK0lkJYBPyQLHW9JPjmgt5wcAxeMDca8L7FsqtyVtfhzOTvb5yks4Ccz/5z7glALxQshEfBvhJJNIxb2JGJFnlZO5ZixkXAxm+vlKoWOCAsyMELZl8oY3onkPL9wnyNQB2K/4BslidjlCkSH5JZdNifeBO1No+GnboUphSwJmyOMmnoP867JFSPnQ7PhdfSAlpCNj7LpbyLwTYPzwKvtgpCRQy8jt02UisSE4M+IijnTyv6Ss8lqPvXRRmrHxCKg5of35MevQ97xOouINRuACAGGFx2esbKRv6zYGXagM249TKCp5HeGnd9LZ7ANEfjIaV+w1PgFayWu4F+lATsOEJOTIa65D5WNEo5DHCo4OCY3NzSEz25ahUX18tARshjvvhgSLDM+Meavnw8VnHTBiL6yr3Pl4sbZ7VN748SGR4uGkX9wcxCc0HNib9PCBPsozVQnlnDYBdiX/ycMMUNMOfUH/73YJ4IAl+uIxxRf356LHgsgQflQJOYh96fya7Vuci4H7jOFEq0cR9DOXSKnmEaX7G09oWARtlF5diyLulh2mVF1yNgKsvARSew3tHHKFCYfZ5JnwTBy9RGvUexsVqlQDe9QlUjpoS1kkR3gOsMaxUR2QQ29wc91tNwObmL9yzmj4+M/GOd7jqU3scCfnhsXBe/5Z7gf7UBGw8I3jJHOEGB0ty1jHvwBdCJHrez93Vh4AQX1/x453x9TW+mwXYc46RDiJPPzuPAeKqtm6X0CbBCifu5eg7PLHs1AYDOD9LPYSbiOMwmoj/6HuVEdLEWlOZk+4b1sLk78cD7MuJasU/zqvqDG+UMrRPn7C084VSxQmBWG6Be2cP2God1rj8g9AN4RFia/xjQ+cIcj0urDUdJuEIos8Ls0XA5tSFPZYZ2oO+fYFyjNdMyzk8QShE2qvxEWMmemp/69+ttUkiGbkzlnwCFctfx5Fj7RIO4OYzR6H4L7/XBGzGpu9hwLoGWOJy63IDoYhi0PCPZE/+AeDu/ZZ7AV5NBmwlE4jDWw8IIEg8XOc64MXT8fKcdfYlYya+exa5xfxaL3H19ZUF2DkjMs/AJAAatwHxpBw3tvsEm5dNrM/H3XeMV5V0BcAHuBxhpRNj1EwmDq2PkPiSn7xtqoWCEqKTqI4H2Oc9bck/koWwKnFxOyKkQHILSUm5R+pS89rCwk71Ied3xo470RFxM99Z5C0Ctj0zHOMHST7EhTVhNWOpaCLebOsIADypcJRtm7oJHP10hMwhxmvJClTaiZ1Ztu/j/ta5N/z/0G1aNQGbexk4Q+yIGG3pUaU5dtiSe4FvTQZs1REfYPvqFbxuRvjDjs+3X6kRQDhGU/X1lXNbF+4RffWZ6yDAwKIk04+rzbRFzDO4R9GWqXxUQr4kMF9SROqbPqFBrEonmOF+o4KTI7Kd2fwXlLGqif+Q4OXo2IDdkn+MGa2WMIIlMimxSHCZEzOKVL9KcnmtgE3HyWyG5+Rl4HrT2eKhm+62CNjjqY7Uttv/jrJtrQ+OTiETNNnqhyj67NtSQjECtByhKKJE2lwKK1Bj8W5fH24xGdUkT9pkOfdeTcAmY16H+2JJtaW8nPr81L1Ae7UAm5M/5DM5wgOGtV1aqZI9jStdJx3i5cCTo6l4fRnJl1xfORZ27vWagPMtIsMdlJcT1wGaOS7tXKKQBtmfNchaPGxs7Y4DeENx1FB/qC6kk6WODdgt+QdPSFAiIfBKkREPBKMckZmJdYBmWmJ9HxuwiU8DzBx1wYXKP+K5xMJiFdBOCbBRMkhWyiEfYPssGyugcr6d+4zvYiErUEmiAyxGSiqO9v1YaKYWYCOv8Fhq2Y2iSHGPFrTwXtjzvBZg43XRBhiJhazDKYTh6Y6h8T75PHgSNSXWV7LZ5PpaErDpDe4imzVJ8ggZ1To5KdZzXzZmcqSZD5AJ6c5G+oRKdOEHtjNFITi24ujYgN2Kf5rlgDXC6zxbN03E3IjtslawvlN0DMAmM/R+4wkCfWwt1Vf9+ykBtq0lHuNDGrDPNxNhE8JdNYijpSQzxgRqaW7MzSLDjcogOQZg+zL4Was/XYOJ4zdr7gWaqAXYHA3UtRAwFHBlTyF7msh3VNEC7oT1deX8+cH6OgfsSyRa4vIPrE2sTk0kM+AyD97MpR62GYxTmBt6h3OdLskMy8jWbibVv6TGLu0QA9dxymMDdiv+WR7jNsKbwgbhKEUuUdCA+FPoDDbfaQnYhF8oX2gTFGPjYR2R/4Dg0bkXHbAvueazsKlsRiihBvluAkxaMImOlLxfy8LmeCoFZTQRrw+dPZ/D2xZ7gf4tB9hXrSp7iic7R8nDNBKnSSJ1RGGa9zPPlawP37wk31/awqYTnF2jWDoZxJrIRGQTxc5f8zzHEziH6Qiwt9l/UxchLjBdbACXPf11NCW5zbqgawK27a/v8o+W/AvNA9YNm5BSr+QNpGrAU42JC0OeFKh81wqwOYZFvgbJdCEieZHsWhQMsuHJiSAkwN+Jc+niKbUAm8IXVkDbvaz7X8q/8OUfSa/xvtm0hX3eO5v0iYzIVJiTHcFw+PvWAlW1VwuwOV5ErF/TDTLI47LOW+RLzlZ7gR4tB9hXx0e1QY4YOppjYXM8U1vnvlMTScBNsD/5fg3Apk/E9rgtyxajp0OpyzWoooRm5AhBiABIFePIX4qXT5IlqouzMLlYVyMlhQLP2TPPJYD9LgUlNemM5YEPsFvyL4fnJP9gASAAcK1RwtJHnIenjrTvMphSwMnpl32Goy6c59VZ3jxDshzxQZRQQBo3a+iMMMqlzpgvAWySYUIlD21fmXduXdLUBrD3LSb3RS5g2xv8EIqsk1qUFIhzBap6vxZg48li/en5Dp1GmMrHlnuBPtYCbM7Yk5DnaE4MGzzT8W9kkvUkV19ftQAbBlFQwNb15cwtWkrsSkiEOslJmkrOSpYsUs5mc27YERmFZLyXEOch9ZnPGGBTeMHdu0ob1CL2ZeD72vdZPT7Absm/Ej65Zym+z1EYEjZ01iW/h3IIWgC27/pXzqZylj9VEYm+U+GLRLqcLHGOONkQAIpC6pIax0P4REEITQ0BOzntuYBtBSquXl8p42SDmQ9UF6iqH7UAmyasHCEMxlnhEiLLnKxpa63zjZZ7gfZqAbb1Nk7NEmdvUzhI11gAJ3QGOuOovr6ubPJB5B5nh3d/5maJ28XCINFKKKKgiVtP7j6I3B6omIHg4gyn7ptOFstdlAhONo1vQbpv2OL5uDY5olNCKBe6dF0MsKn1qy8K4UgIR0NyiIQue6WfD7Bb8k/3m5KHLOrc7G8UJdzJFDfQ80GegaXagA3AIAS1K7w03kXina3ER81hag9b8t3qRGyS6whzyJensEXAtvkfjN2XLJbiifNqhG6dcu9XF6iqozUB28b+ffHUFM+ci5c9i3eLI0p8x78XBrlPgcu9ZC/QzxGwLzw3TzHH1nxjyaklvtQ5bF/5XHIvrGFZfX3VtLBhMgxDKNt2UucGOT6ib9HB/acrDKUWI787YYCbEbcm/9CKdFUjKzDQIRAYsSvUdNscHWFxadd/DLBpm4pPjnQSXGpM9vgYz/sAm79X5Z9yiJKFiYsbVzaKQomLn36ST6ALXITOtdYGbPpvi3qEwDY0TyTcEdfSRA0DMqEtYUXac+m+JKlQW+RiwGtNWwRslDzKYmrCo8FVniVEzgvWFEoXfH2yDHJ/OTuAmCKB6nH8l7xfE7BtoRhyJygAk6ssA8rwXXu4yDdx15u23AvMcy0Lm/wkinBpy9h3HCu11i4Nu/NFQUiCXAKbtFyyPnxtJt+vDdh0igvv7e09aMIA8r5UoYdsWVEeKSncwLiwRrW7m83MZRM6/gjQ4obTcexYuUHbVd/VkjHApvIbdY4d5VYoImmLohP2ergQYLfinwVce4lAaiMQGqHalSPO5dpr9fiNTaYt78PjEsmwarQrtioeD3MhDIVfcghvDglo9l5ljvxxE5Ul3wmFjzVXhobaRaHEnW7zQ2KAnebf1dbCSWc53MhPOuNrtqwo1eI4QpYbHsBjxYUXGny8VxO2cFkq9tAfe9kQNcBjl3Pk3tblK/1aUonO1gonERjAp78He2EQueGs3l6AZfYiJZIFiaPHKMfC5n28Bvp2LdYVCnpuNT0wAwMIBcwRlrXvdEMScBNjSr7fArCxQilUbysYcb+ptRLceABQwFwfkQFYAbvQdWiaF1jSLH5NxCN1AoL77bN3/3GTehArG20zdW6cQhIAsO4jn4kBti1tiPKAAA4pLq5b5AL4LhkIAXYr/tmaxmj4JGYQ9kgRG5IELg08ocI1Nk+g1F2d6ovPwkYZI8aaQ6H5CV4kM8458XxHWDV4K2KXXqC4sS6Zd0sxwC7lX0vARgbgMdBEpjhHaHIqUtlMc74zuisPtLikQExMdsn7rOt9SWbViyuXknh0zFzA5rM2a5kwIuvHZsbbIaFIAHb69jSKRblqjcfYC/YSISxXm99ix5EL2BQ7sdU28SSw7lIXzIRu6wod/y1ZH76llny/BWDTMSxsLG1L+8sRAsaRTUjhXWKEuLFjZ3Zpi3R+YuiOcBmxQH1aO9m5TD5VrByhcXLGzgoS9ztH1hAq+3i06X8MsNH00Pg0IahJxPNpfFhiHE+hipyPQoDNsy34h0uTMokadHH7U+fY3iak+8/RJyqe6Xt5ybAmEYa5smRjtihtWGG5N2kF2HfxZ+Lo8F8rlVh6bPbYxRAoa8T+cMf6kqdjV4baIyd8Afc5VrkvyQ1wZ+2EcixigH2Vf4PcKmdR/rUEbPqNp4bjf5pYH+R4hHJQUF4QcJzS0MT9Adprc/HbIHLz2VUPTuklMkmBavqCHNEKfUoJLAFsLGE8VDrJEesdMKGqoI8IW5GsqI8ncSoDz5BTspfZC4etx/aCLz/HlpG2X8wFbN7zKXXIb/Ya+/wKjfIcWcBpJV2znecooGLvyHbvl64P27T3fY0vrQCbdohl22IUWJa4xn3JIgAuC9JuZLRuNhoLj4s3ENowl0kH2HybNZWNzbsU8NAgDzNxreHm5bgP1iMuLdxJCAn7rGN+DLB990DzHholCg1Z6wAHwAVYsKDcuV6OdOHm1yAXA+xW/MM7gZdCE5YFlYAoNoBCgqsNwYVShLDA7a3vwuZdX21e9017VI2/A6R4aZgXksV0RaOAvIr+2bqNeZg4H0KWDe+Ag7VMUg1xN44oaiuZtamT6EJeHb6NJwI3ut2DeJIIy+CGQ4mBZyQ1oqi6NccaYd2zHh3FALuUfy0Bm/6z3imqpE9Q8HeUN3iBcCWvhHWFZ4Y1RAgB75QmFHKU6ZCSVUWgRlYVBoYu2cseRqbwd9Ys48Lac1QC2LxDrP8hpn32A1neHEUEuOEZCY0AD4qlveyEeDh3KGhqvReYfxR/TcgMZDyeA+Q7fdSeyBLAxp3N+tL5Q7TFnkZxxmNH7gPeVZ5B6UGe2COeeC+QyyEvRvX1lXP5x9QscbuO0eK4ilELNJ4JXYXHb7h2KWGZW/LStskEcHxI1/oO7S8EIhaOjQ1G9uN+4tDQdCZ8DLD5FoVWsJRiAtbXJhoqC0hf+XhPGeTxkezNOw8ijzmryz/cRgid0qRAPUaEC3wJnbXHmg5ZDe47JIH4rPPY/OnfeB8A1Z4W/TtWPdYIz+mz1u4ZgAUg1coL7muroetv2g2e01esNgAcZUArs7H1VMq/1oDNuMk3Ya/rUxQ5/HDPIOBxcxITD9HI7wubpbaFbe/6tv0iWY4rfh2VAjayFEWf+PUUwhXOlan2wM4x9gInJGJxa+QzBoCjEsDmHfJ/UJB0KKCEZygUhFpsQl5sPy++vlpZ2G5QnFuzhVNw/wHmIUZgmbHRWJTa/ZNiNgIWS86eV429R7UtkoTQSFOExo9L/2HGRZICbL77ABnkUXJ2EP/2tQl/2NQkZKFlXgXs+Jl2vuflX0aOVgn/yMLEE2FL9aV4CEDDP+LzqXilvRXNfhvPA8VN5hDA9liR4a5513Tvm+KUAGsay8nG4lL3q7OemVffbWe+caAQUCSDKmd4hHIBm2+V8O8YgE0f8VYg5HxXY8bmFQ8Y7nP+N0ZJl+OU9w/fudhdeEAAFp2lrB+37tVSwHbfwjuFomjzaULDYa9hnfMvpiQTlrBejBiL5uwF5s+XoOnaQ0boO8BLAZvvsK5pI6ZE+8bH3qZ8cipRbb6FPciNSn0K1BK/7OIStcRjE0q8mNimdcvkXHNHsQmSxkgIQwMMEZoQx2tQDmJnsEPvEzdmA5CEYd22vIPbDeF3kwzyDDnbJwHpmEYOYPMdXC9sGDRH341PbCosDlxeTpl56O78+oOVOhxzidvxteAfVapwVTJHuuSr7QtH7VCkcL3FNFb9Ht/jeVxV1kvDc1NuWvOtAVyVrDPCK9ZF655nChAYbP5Hq5AOfURoEdt3hBvykQkg4AQEApdwjm9shExYc9w+5NZ0KWCX8O9YgO3YxPrhGCNx2pjHC48IlQmxFK8mEPk10vkCtTwGjneQUw0+y84WipkK2PANIwNZQfgvtG7xEOHNwjuTUm74Zuu9wB7mCBU4YYm9RojQ0RTAdu+yz8jrQH6GlBxCCSgs9Ie9lkPV19e5hZ1hbuX0dtYz+X1AoBGnQvNjYZJNCACg/VCoJXZs4rCL4XaxfthsaMnuyANWNXF1fd5xKmC7vrBgEEwAOIKehUL29BNlkNvkLJ8xmfxfln/+RrEouDiAjFOUKxQShAVzRHIL85TK0AwNByWKDYc1RkyXWC7zQiYo8a6liG8zBjJviaEBeIQ/njpa8ku25frMesa6xDVI3I2xwS8s6n3G8QLUin8LdHUfeiDJjhgne8OdqwXoOKGRsniW6MMS32At4QFiPTGvyA/6jrJKmHBJQm4hH5FbhBSRLyh5xM3JI0rd5eDrS8u9gDxnf9N/d/wRIwyZkVsfI5efyCnmBWWH9cU44RV7DmUQD9mqqDSOWgJ4qxpoxc7MBeyKXVvHpxdXOTKHdax2M7u38GMLjHaBTyw8qJV8rjNm6kR0zk3lnP+9+YC9bH+2+LVNAvacjeR/d84Xtzjtvc+dA50DnQMtOTB4MpW73C2dgU0Cdukg+/PTONC30zS+9bc6B2pwYOv7sVvY81dFB+z5PLzWX9i6ELnWk+cdfJ/RvibqcKANYJ/2+u2AXWdt9q92DrTjQKmMKn2+3Uh6SyfMgTaAfcIMHGs7TznWdRJc6XLrJKaxD6Jz4FpzICTH1ibfOmDPX6bbtbDXthrnz0XGF67RoK/RUDMmvj+VCranAAACFklEQVRy4hyYvty3Atfl5TG3O+XTZzM15izArtd8qnsb+r0zSU1WmBmdTRta072rnQMLcmAzFnapkCp9fgZPswB7xveP9GpDDpaMUHdrpV30D2dTnfUMYev9L1lkbZ6twdEa32zDjd5KDgc2A9g5g+nPdA5shQNdsG5lpno/yzjQV3aKX3M4dBqAPYcDKe5u4vcTZMAJDmkTS2nlnezLYuUT1LtXlQOnAdgji/abue/oqgvG+/Gt83zr/W8/4w1b7JPTkNm9qZVz4KQAu5TXXRSUcqw/3znQOdA50DkQ4kBtTLnWgH0Syy57hWQ/eBJs6YPYGgf6+tzajPX+BjhQcSl3wK6x6ipOWI3u9m92DnQOLMSBI+/9Ize/EBNP7TPLzUoH7BprY7n5qdG7DX2zM9I3Wavnyuo7uKEt0LvaOaA40AF7w8uhy8UNT17veudA50DnQCEHOmAXMqw/3jnQOVCDA139rMHV/s0trqtwnztgr2hFb3FpNWFfc8Y0b7AJG3sjnQPn1ajPOiM2yoEO2ItOXN8Mi7Kzf6xzoHOgcyCLA4MMcnbyqsgmAbvDYtYKPuJD9WeofguV2Leajq+mI2FGb6CLlVZJ/6zhQF8K5wzZJGD31XzKHOhb081u50SLdb42Lq+tPy3mYBttlM5M6fM5XOiAncOl/kznwBo4UEMCrGFcvQ9ZHGg3/e1ayhr4SjTYNXDlWVpSqc691KAiAAAAAElFTkSuQmCC"/></switch></g></g></g><g data-cell-id="wUbSNccMbzvjAEwLt-_H-50"><g><rect x="685" y="252" width="160" height="30" rx="4.5" ry="4.5" fill="none" stroke="none" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility" style="overflow: visible; text-align: left;"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 1px; height: 1px; padding-top: 267px; margin-left: 765px;"><div data-drawio-colors="color: rgb(0, 0, 0); " style="box-sizing: border-box; font-size: 0px; text-align: center;"><div style="display: inline-block; font-size: 12px; font-family: Helvetica; color: rgb(0, 0, 0); line-height: 1.2; pointer-events: all; white-space: nowrap;">Respond with 200 or 401</div></div></div></foreignObject><image x="698.5" y="260.5" width="133" height="17" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAhQAAABECAYAAADZa6w7AAAAAXNSR0IArs4c6QAAIABJREFUeF7tnQe8PElRx2sPA5jOLCpgDigGFDNiQD0jnop4pgMUTAiKWRTlMGJCBXM6RExnVgwoomIOGBDjYcCsKGZRkXW/702/V1uverp6wu7sbtfn8/9wvJ2Z7q7urv5V7JU0ahxYEgdWIrJeUodaXxoHGgdOlgMReXTlmchLx8lRRt6oceBkOHC6W/1kprgNtOPAaiWybuB8+HpowqKadw1QVLOsvdA4MJ4DhyKrDqWf42fkiL8w+yTO3sART85xDa0BiuOazx2PZk5B0v/tOVuenYkH3fnZudMaaBxYOAfaBs5NUAMUC1+6rXuNA40DjQONA40Dh8CBvQOKhvUOYZm0Pu6UA3vYFPVN1r+xUx4eYGONowc4aa3LWxzYO6Bo89E40DhwqhxoR+ipznwbd5/T4HAjaRugaCt7JAd2dyiMayn+dvzJkaxrr58OByZYVBN84nT4fZAjPfwZboDiIBfeAXb68PfKATK9dfnUONC22bJnfCUrWWcL7Rz+7FlA8ZYi8ksjpuT/ROS/ReTfROTvRORPReS3RORJ3XcP15Yzgint1b1y4NNE5AtUD54sIu+01x7N1/iXi8jHqc9/l4jcMKY5I+IeKyIPUt97goh8yJjv7+DdlxSR+4jIPUTkTUTk5UTkWhH5DxH5RxH5fRH5GRH5XhH5s5H9ednNN+4nIvfcfO8NRORlRAQW/oOIPF1EflREHi8i/zKyHV5/3a4txvUaIvJSIvK/IvKXIvIbIvL93b/nTdDWMj+x3PP3SzZn4Ccqpr3tRub8/Agmsp5Yw28lIncQkRcXkf8UkT8RkV8Qke/o/ndEE72vvqaIPENEXkhE/qrrg/vC1ICi2z8ubvjdzUZ6qIj81FyjHvzd5S7MwUNqL15woAGK8mK4vYh8Uvev7+lDAhS3E5HPEZGPEpEXLbNAOHgBSJ/cAYDAKxeP3EZEWGefKSK3Lbz4rxsg82AR+daaBtSzL70BKo8RkQ/shG3fZ/5YRD5YRH5tYFvZ15rIzLLm7iLysyJyzQSA4vVF5FtE5M0C8/fjInL/zXr/28CzNY8wDgwCgBpo14Cit68gDQTXl9WM6PifnWd7zvPVitnYdQf89hqgyE8ZwoID9/M3+/Lf+zSP7hOHAiheS0R+UETuXLFa06MIzPcTkV8JvguA+L7N8+8WfD499jgR+TAReX7Fe6+6sbT8tIi8WsU7WC0AMF9X8c5pPjpeXgFcf7uzGGkeDrFQvGu3rgDGUcISdi8R+eXoC4HnAOUAZb0/sJK4FLFQ0EnMKxF6gQ1YeInOJNP3/PuLyPdEPtieaRwYyYEGKHwGvoqI3KK0n17No/vEIQCKVxSRXxQRDl9Lf7gRuE/buIWe08mpN97Iobs4z/3zRit7684dUlp+gIn3MQ8BEjBF/1FnsaAdtE1LX7hxEX96qYHud1w39N2CCWTzUzpXBy4X+g0PNNGf9xSRHwu21R4bxoGv6QC6fbsWUGCReOrGVfvC5kNYH/j7P4nIHTeuurcXkRcxz/y9iNxNRP5i2BC23kLZYEyaRlsohhz+mOXeXEQ+FB/uSuQa4wTBd/nqIoL5r4KuQsjxoLKi+SN59MR4dkqA4lEmxgHQjk/fo+s7H3v6bTCgWNh64tBEuzun885hgsbd+psOIzjoH70BAO9sfgMMADbQ8HP00SLy1eZHDvcP7+LH9E8I/5s3JmyAnCYO+icGRAvxMPjRNeH6+IwuZi39HaUO0zfxNPqwIW4Di83fBNpqj9Rz4F02MQ4/kXmtBlAwZ8QraEBMvM8nbEDEN4kIcYqJiAV65AZgPMS0+6siQjzkmJhFYrHYF9bosBdAoccHM3+4C4TSf3+YCZarn8L2RuNAmQPLBBT7PoVXcr2szwL3Eg0GFOUp6HliWj7gdiDwUdO3bw73+27Mtn3Bibh+vqFzQeh3P34T7PgVmd5jMbi1C7xMj3CgABCelxkWFgSC3glyS0Sw5hsVhD8y9OdMPx4uIp/bw1kOFNwj2mT+VSLysaPmq73scYC1QIzgK2fYUwMomFdAQiIALQCZucwRgMKu0yGGAL7PegEk5xSRvQMKOult9N/LmAHbkm0cmJIDIUAx7bk2Zfdn+9ZkForZelj/YeIm8CEnwsrAYf3cwKfQ7HEpkJ2RqE9G2XWFGZrYDf63j8jOIPNNm7M/QES+u+clAu6uU7+TlfIOgTFxKBDUl+h/Ov8+mSBHSDvcxdtNkbnTl+0UBRQc5n+9sS4BUBLdtPmPRwQmC+sXwDmydnOfI1sIqyYuuhwtAlDQOfyapL1oIq2qtAEDvGyPNA5kORACFCfIv2MDFKTSEe+lD+oHdGbi6PR+UJfpoZ8nZsFLJ8U6gQBOhFb52cGGbCwKVpX3yLyLi4T0QJ018I5d3ESkuaevRO6ibN+fssl6+eLIi4f1zA7BxDZjiJ8hjiYR//3emwwjMn8SRQEFIQI6+4dAaawekdAA4mb+XEReULVL2EEkw4e9g5zErWKzlIjR0a6zxQAKIsltABJ54Z5f87DWcuvtkjkwAaCoFFaVj++JeccGKKjHQKyEJtJhqYcTJWpUENSmidgKm+qOFeN3zHNYJwAZESJoTgt6LAcvn6lPQYbGV6qPYl0gIC9KZNVpAEH2Cu6QRdJhbJ0L1jFnuDpYN9CzO6s7VoYhgIJaKO+rJqa2zsuPGGBKTBXyr48A0WRdvoLzEN8DIH2z+m0xgAIwAajQRERybSEtkDpRsGgHMIFiGwiNZ3VWkIh5s7SZ2LC08Upd7AeFulgstEHACwJgKsLMhTCkTRYobaGRkPpD8OoUxD59wy7IjMUPCmU8RA3Df6ed0Vsb1Ps2IvLaXdYPkfNsNKLfrdAeMkZStEDgBJphImQMzA+His5KmgBQDOne4t+ZC1CwL9+02zusbTIqKB7Feqbo3VxkI9JZD8Qs1BCLnlgLbQ1A4FI4SBOa3JeqPzzTxEX0trkSWa3PrSlYaBNRV+I7nRd/aFOo6r3U3wnMw/ISJQt+MFag9e4iOJNiW8h42mOs7Ev2PvUxKL41JmjQjh958O4q2P/Xg9p5lI/eczbDh6BZMqdYQ7WAgjXHmtXuDiwW31bRQQs+yWrCxdZHFNxCTmtin94ksnqUyBqAw5gSLQZQfGMX/aw7/jpdalWEZ5geyYfFnKQ3on6XBUsRDnJn8YfWEIcsVQDJDX+9nhdpAx/m13e57qU2rHkzaTyk135elwlDtK4lonmJWMeUGjFbef0gUhjhR3EbMm88IqUMkEQ/CWCLbHIENQIxEcFoKbKeA4U+37sDe7bNlFLHM0OKnLEOPquLeLcpU7SFeRCfJmsFEDMHoABswjNNBNpxsJSICnpU0tMEKPqD0osbgYy5Gq0jEcIGoZOoVCnTSwPra9aa+/vSRgkC+9QOTHjfxHxL7QX25pnVYDRk3W6FPcQccHihCOD6yAVU5saMMAcAacIVcRboqfoLwNAVSGs1ST63nY1yboXQVU5THzj4sbQkeuCmXgiyNEocVOwJXdyLQ0IH5Ea/FXmOg5S9T0ArgF+DM/0+8oM+IANRBCJk4wQAS1gIOMgJOLUAEuBCDALzMzXd2K3n9F1iYIiFgYYACs5CKwNqrF60+xZODYpSWIEFFIQmsMaIH4KYy8UBCjQV/JBo4IlIheGQK2n714isHimypoId1ogIcShipgEgRLQiBDqpWzUFY+gHkbdoFn0atwcosAz8gFMAxRsbY0Eb4mDUKUN9fGBTk0XDwUuwWZQw46KRkbbURzlAweEG0CpVC0zf5oAhxS46LiLU4UVkHWAa5pAjXW/q0tucLXyfgyvRxzg52x4PbYAdz7BObfqh9y6R/vhjE9lI7n0ACsbNAYt2GCEObIRUX9R65DtzPAN4wMyrCcsemRia2Cc6eJPUTWt9LfXPzhWWNdaqJuSjtR6iTSL0a4ggUIJTE0UD/Wra4FlScDm8dVulbyCfAckEHpaUGQ9QUGQJ2Z0DLihJKFRTEm2yJpI1AfnP2LH6QkMABSAPl0ciLO2AwJrCZ4BqlChNBO+iAG/TJTpOgAJ3HWeGBg+8s0hAAQqls5ow5WFt6CMOJhao9ivVLAyKgNCG1Tr0N+7UWTNyVo9SewgXkGHnarmid1lAQeQ1/LApRmgRpAjl+gECBryUFhiHLULR5tWXxpF+px8g/lxONc95gIJDhYhym7dcapfCKRxKJfJicErvMO/wQmvxU93lQeXBj1AdACDaAke2f2jNBCFbywqR1YCDPsJ8jFaXTKkIYuYBzT/RrgEFmjsutEhpYD02lAn8+GiXYZrYouG1i8shaZn8zkFBsJvdc1gpdTpmzl3RNzasEcxXIrR0W6MCDd9W7KQ/teWVsQTg4kpE4J/OCAjPQc+DAEoOxKgyYT9FH8mU6CuiaAEFAAy5qBVV+136NXVBL2QjdScSWYvPEEBhrY8Rd4U3Hcg87TbB4q4zfew7xE/gjmTuPMVuP4Ais9k53NCsb3Lsm8QNcOCfUeZ9TLoWXSJA0YKpbQGqQrCiKXLhEyZdnePNp3GBYI7Pod+fNJdFsRhYuPjH8P1SEIbIWYAHi4gCOda0RuCT9qnqSbOAggMbdwfEBFKcBnNdCuhCQGNOw7qQnkvfK2kWsJGDXQvF1A7ADPTJmOAhPCNanEOROAdN/9Vl5FBG1iMLKIj5ACClCHviQOgHGjXCjwVOKhLWCK+KHz53tKgcedH3PIswwcqBeY55w0QIGKIdHe2svzsVoLDaLPMKGOyrdwC/ad8Smg1CsU9D49BC20r75Ynr85oHmkqAAnfU+eG/krvJeusCI4COvviLp9hjHP6J7Fq242Ae2DuYbvkea4K9x0Fh52OqeehZNlU/UcSKNah937gWMP9qYk/ay7042GxAaKlxXCY6NoN1Y3lECiypsImQF8jUklJh2/7aTczER6o/4mocqnB44wL4YHGyd6bgckBWM9e4bvgdnz57FLmuec134Qd7PUcWUCBfOEc0waP0XQAha3DKC9JsMTPPAjIEUHCwc7YkiqYGW16x93CfJML1iwI7lPYDKDqTE+iUA5FDnWAcBLtF3QwMH/eNBY0DZEUA0jmdPwwA4bDMBRRxoBHRTHCKJgJCKXNriVgJbd5nMSIA+3z7BIKyeXScBZrj7WUlz3eOhJwQ5tDlQLAFa1IfiX9gI1JRNBELFRMsoMAjXAIAFE3c+IrmnAMHCCjiGfB/ayIeABCgNeD0uwUU+j20PA4mLx0YzRxgo7Ul3sXcbw+z9E3ACIAFDT0RhxwLHfeBR5ijMYN60fBTHWQpsFUL0VJ6GK6XXNQ1vM7NEWO04BogSDEmTSVAoZ+dIigzfQ+tkv7kfNVkc6HVWSCeS8nMTKv/5wksFxxAmH519gPgjjmx2RzINg5KTZ5bpDQG5IzVnAlk1vuN4Es9x+ypjAWzlwvIPr2/CYgk02QKYh/AD3u/A24MlKKcSxu3CFa9y4qQq5XIet3nOrSAIvUfgJdiJQDnKH/cx4K7V8ccjR0vgJw9mvY8yhKuDivrhgAKu79RaBlDLWFtwGKeCEUXhXcoTQ4ohnYk9x4HKJsJLThHLFJyarUpC0bhD7qSxeFsJQKcNKhAe+Rwsfm8Nio2et0zgsamu6Jle4GgHqBAWGFRKfmRARMINH1o5XyCmGA5eHUAFxG5aA9kV5SIHHpbQCWXs54DFJHgNOYWTVbHqxBfk4tfQSghLDRFzJjw7mkiq2uN4l8AFFXHkzUlE3BIf3NE5DnrBNKaFP8f7USbwPU3OPAIZEyHCRoqFiabErkPQIHwBEiVLiRCK2V/acLsPvTWzdJ6rvnd8o13PesEf7+rs885FJFXNUQshL3SmkOZPZuINaEvUuzbJ31tE+Ohq2piDcWaNwXZPvJNZImu9phrhzVMcLN2/wIIUEI914cHKDgPsPzVZgvWjp0YDc4unRGBBQkrnqUhgMIWZWOslFCvJWtxz63j6HcXCygQgpi/8B2WAjExM/JsImILsAhE87yxVPCsRs2eW8JqjESFE50cIQ4HECuHONo8QskLlvIARU0JXJtHDu8ADTYuBA2ftjRRoTSnxdsxehsGBI6wtIGtHqBAACAYbFCQx0tPCAE0bDuc7lhYtJWrJsjKu2thKgsF42LD6xxthKPWDvTYAQOYYFPwGOBLu/MQTLrKo37XHj6sM5vqxfP7ABRkrBAwXSLGzYVFOpCV/Wdjq7LfqYJ6pd5c/u5Z9Ti4URqsa4O3sGLYw2tIXIOXKQQIZr0nshlKQ/3qzM8Xqe968Rpxjl0+CdAFAOkaBvCGK7yjbhkqgFoZxRmha2+kFq8AipXIY9ZX77IYMpbSO5aHfXEoQwCFDdYmRgsXfi1hmdUB0mPjZRYHKDDtY9rCFWGjpXPMstHsNYdI+iZardYWvYIuNoWPjYa5PFKZ7Laykuf2xyWfiUALKLBOoI1HNRpM/rh4dLATgZ3EDmgiQE5foYy1JGnD0UXJQrQXFd3TsaR4gKJm4SJwLuJnus55RYhsASBcX3eX9VktiwgBLFMMR3p+SkCBe4/vJ5CAEOVvnrvHauj43XEP4SrDiMLhBejwAqMs8MV8rQ+INLZRgGIlcodCmL0HjjEvR282tIV7hmphkbmPPINLAcVFBxIDjLG45NLOvQJazPmzKxNhPUuHTaO31jncs97tqKWxWgCPPNHArvR+7ncvaDSntfe1ARDXgb3IBhsbwfuehQIZgQtnEAVBKm4N2kgxYlh8+VtOeRoCKLBW63LqNUqnHvulpeN8cKW4lBLfFgEoEKgACOonIPxrik3h00e46gOUACZrLi0xwl6og5WDtBrtavGC5PCRsQEJiimlMZX6wO9WCD91JXKPyg9bsHCzyOr+qnv4CrFYvJjqUJ8JPddvDkYOyFT5jee8ksIeoMAaQPBXhABUWHY0ef50KwiJVemL6PbaJsJZX3QzJaCgPdY38UKJUnEb2xddh4VDi5gQNrvOYMqVyrVpirn6LaMAheMHt2OwaxlQ7F0TnlsDxPfoy6kIErY3aEbWz6BnzOGBRY/+aDDBQcB8eGbs1KYHhtHQa4u1AfaxcmpKFs/0NwLqcKMlInaqr0ZOji9WcQIA3mmCQiDefSbsz2gaeOqvtRJhqUSRsueGBRTsI2R6IegyCBt87iFbUUaJA0p0UZskw/AhgIK4PZS3RNHsN9sF1q4O1j6LVxy0Yc5fmhxQEHXrFUHh4GfSQZaYqHR+PB3hYCZQ67IAUGxeue/Dug6GBD2h7aW84MRPm8NNj/Dne9XEQKEETRFMxmT3pZ72zZcVwgAtYhNqyKbdWuuDVwp4SBVS+mTLt2KKO7N8qOnzAIWf7+yPEqFj/f9eYSgrQIZEp1tXUBZQxJbnlQFhLdABv7lKhpjRk+uGzCNMvVbQI6BtEBkWAG3N6jtUdg0o0Kq0ECytaRscqFJtB3K/1KL/uz2oeYpDgGyUkuLiFQ9C26+tPOl9x8ZQ2LXFZWc6gj86evudYgxFcDasxSmt62i/0nNXLZHnriWbMmvlAXE79n6o2rZLz1tLNy5Okg36aAigsIXOsJzpzJxSP9Pv9juLi6GIXoMKeCBaX6cC4e/Hz3yR7hbgihe8FXjNPuJuCaJm9UUuvMSCRDD25U+DuLG2AC5wCaBZRI0MFlAMCUTbzng5Bze68qVnaQHseT7gEi8xpWufuBcR7gEKTLh9qZ+6Xe99ryocqXja9DkEteNaeIpqfGoLBUXRUlU5mjnX/raJtFz834mSy8IKUk8gE/WO+TMRh7K9Eyf9tmtAEamfoTlhAQXm2euDh1dp3UZ+R9tkP1pBjZwiLdfKBu+buBys6zZaJVV/DwBug7I718nFY1Zzr73HI33IHornrpPxjLeuadafTn28GEihKbK/dHoy71Fu3BQZW928kvV9leDtizuKrIfSM1iRAC2pOCB7m/kvucSHAAr2ks7qsFVwS31Nv1uZOdR1kr43uYUiCijowI2ykseZoxbmsjiiwYFs9qjpPMrk9Fzu9kHqS2Aaj/oVCUTCXIs2WirOYwHF2Uap3Mt2UvHVa+DGHOnrj/mdTRAFPZqPBMnpvGUvstwDBByaNp3uyvx0444CCmvqj1x2Y9skPU0DnakBBe2hOeqoeczSOrXXWkmS3xcXE1a0lBKLCRcgiHsukQ2y8jS3aQDFSu5QWDF9pbcje9EFFNFTJ9JAzzOkZN6yErnObArSNEmrjpaBJwDTZk0NueTQ1phgz2L11e6Crdoj3UHmlekvscbWOPCqcpa+4f0OMNEumGh2h/ct3By6Aq4XJ2YtFMSRaXfmkDHk3kHBRJnS48OqCOgv0RBAYQvlRQo/epgQ6zXKXaJS7aLSWPYBKLaOR7t46TDoE5dI5GZRa54rDbjmd+61eHTmhWtlJQ+V9dldHtHb/JBNLHI0+txFXlYIDymCg0/M+nUpgpN8h5jgdH1/hCQCdAiR5aJ5REyFLUYVBQS59qPvo9XroluktdoU0tIYbbyGARSV0M5vjUwH3BeJ4KG+RwLTfqoKi3WJ8acoeGs21rUsSAVmXaWqjJjVyaTJAcVdWygiacKaY/2AojSTw39nPwPMdLlsvobbjb1lYxn6WmLf4dvXpZ6vk5U8qRK+2xoTxGDYGx9xJ1mgQ2BgKUvO9t/WOND3Tgzn6rk1rpRJF/0+AY4aLJHhwCGryQKKoZkQkT5Rv4HzIlGNC2IIoCBWBldcIrJldGxWpM88gxVLp+FGrwTIfX8fgGKrL2w4mGEzDKjgBZLvqz/Bhx5ihDFgZCqLBSZWm11gGckJg38TDYKsB+I3dOCWx3hQISZMzxRmAQU1OPrKWnvft5UiESgp4pjnKfalbyocY6F4uMkhJ3iSYDFNUUCQW6TR94nDgf+JcMfYAlyljYblAAtCojksFDbynyBaArcgLEWAglT11BassS4NreVZIFkSoA1QXF0NyBxM5xYUI4/Y3zpNs7SW0u/2IMWty2FXQzaDw8vKYt/ZVPkhxcBsBgFKnwbANf3Wz2KF0/FnYywU9hAmkJCAQk1VgGKkqmAP5qE88t7zgpmtUlgb8Ew7WK05X3XF1SFZN7rPewcUdAYzERtEH3r8ncPVVrG0DCcwSi8kzL+Yn6J5zVNOPN/Cr0mMAoWoMHnlrBc5n5cFFLksgL5+20MHk6tGobhsLEgZGkNhLUy4C7QJjX5GAUFuTNH3iX3QFybVaAmpbRunMAegsIWnUhYHwA8tQ6e52ovAbHyFNkcTM6Jz0Ut1RRqg2F5xgHyUCGutg8e4OYYGWrOGkAmJcBFq7TIig0iz1nfMePIDMIq1UcvRdFtxpI30DOnwWm7lXL813+RZgud1UGQ2hqLwYa+cOZVcddlxPlEFKGoHY57fNaCwWYmcd8SWRC63TF2njom98XhIfM/iAAUdsr54/oaplo149fazyyF4h6Mt+DJyrYx6nQMKIY9rRFsu8H0Sg2HTxx67EnmQslHDF337ZaQzBNboC7SsDxQt3pZtHprl0VVau8D3ZPjYy9migGAsoLBX3ufy0y/acbQSe4vfHICC9u0Bkep32IwCNDodoMm7WuAjQIipQNN41krkjt3aoZ4LfO8zdzdAsS1HOJBssPXjZSUPkHW120CvZTK1dDljLCDERtWQjQ/K1RYhGFyXye67N8hr37uxFAvsZfZdTa+3n8Xapi/EG5rl4VUNJfbJlj0/ZkAB6MXto11ptTU2rKzDug9YG6OML8JCwbIDXWOlsH5LzGQsFh14ppcpG4BANX1YD0HUTAxauldkyG4h2gIM6LK3pW2Gf81eCIafnGAaTdZCMST33tZnt6mnaMgsxrF1KPgOtR70vRleVsGuAIW1zHCosj5qLvuxKbdzAQq78VIAqdZmWV/2zgPWiq2VAagGmOpg0ojfe0JA4RqM5w3KLO24+O9v1wWBWzDBjbWUoR5L9h4UZAyWTF9wX2WlvTmW/uQOeTunZ5kxFQOwwZ9D9lCuuanqUFhZinJGPIXN/AgCihpnR/ZZQL+9ETrKdntJGsqBXhu4MyiMZcleMx+oJdQbv0gKqa6aGe2/fm4xgIJOEZGOWczGIOQu60oDsdHDtfnufAfkDIJmA5GpwD/qZSSfKYIdnzwaI7ndBL6x0aOplpghWfA628IDPlYI0x+qQvZd06snFD8q2ROah160sS2MMuQCIAARAYSaPDP7hIDiYkN4aaPWHZDm1faxb6OQhaM371yAAjAHEE7maQKQMQdjVk9BlblqopTgxuSdCDBCPI7OtiGORt9O6Y15QkDhsvQQAAX7GQCuA/ww8rD37cV5QwQs76BNEhejfdU1dVhIHdcxF3yL2iweILGXiCFzkB/epX3eeCxYVbU/6obvHL1ekS8n3bPYDnuFUueJvKrG/BYEFMX2ZnrggkNDgjLpkw1arsnGoXHibfRlkjY4fMi4FwUoGAC35XHQauIwJc4iU356dZPI2l6ytHXdeYEzMBehQuXBVJIJzRsrRNJuEfJo9TpVCZ+mFux9zWCBAXmmHGWe9eIjvHLF1o/e1w61PahCmYisC8CQrUaHGwafu6ZomhPvYNHhsiLtE+UwBKXbQNoJAcVFdztAcUVsWZMv8Qj4GyMpsV6U/FyAgoHoevz0z66HXA0SDghdGImsgxR/wXex5qEBl8BuDaBA8Gtrmo3L8dbk0gEFexre2WqSNVVco0JXZ+7wTijNr9tn9PGuKuePeysAPB4BWrBs6eq1fdlq+hvIu1tFVrdT2wWzuFeoMDpu/RyyDwVNW93Yn8jqqJndK/efUzgXDiguWDMUUNgUdz6Yu3TSzldSoNPfkRnMi3LB11huLj6/OEBBxUrMR/ba3b6iJKB1wIY2WeJnxqcEMCgRm9Pe3OiZ7u2FLGQDMKmRUuGW0fTJls7lbx6g4GAAkWM16SMCsAi21NYJsjD0zYHpfYQpPNJXRBNYRCVTQEiJvNtGcxc/zQgornTTBunyAGnZp3HXAAAKd0lEQVS69K2P8B3icrMZKnMCCuuiwb1H4atEBMYxJx5pS0oSxsmfSlwLbpASuYAiI0bspUyRVONFAgo1vvOibNsDHpIZVOIzv3uXWkWK1tksKuYaCxpZJzmyd7lg5QT4Y8nNEZZTso30ukE+sB9qXIYlXthLs3ieuCFtXct9g8wbwJWu/4PyQkVZT84fO6CAT2RIYtlPRBwJMSZ9FikUEhQvDeyG3H/lzdPiAAWdtDnXqeNezEH6DX/ndkXAldwq6zNXRl8xKdpCU9eWAywRmIJsVLf1L9I2ficKyvRpgwgA3DD6XgmQOSZASx6g4BkAE+hcV1nU75J2iN+cSN9EaJG4Z3KLy6bc8h5msD6eoQE9YiXyMKPyg2xpy7sAZ5eAgkP1XKO7JLpKcBr1MjxLBRsMjVFfOJTeDgOKAXieDZ27KKt0UyR1K5g/j6IWrRoLhVf62ZamP+uL4sMiAUXHMPY3AE5bHIl4J/V2zAHKwZaTBVj09K2vWJVwX1H1MDeP9v6QSClnlDHGot04yA/G5slCFDEyonQWCf3xUjEzXQ3/GeDOoadvBOZllB7uAcrFyhFbh5Xn0kR/vtCIcUH2e3QKgIJsQhQITbiz77MSeY4j7JA5yDotH+H5nUVWz4wZcnvnem5AMUDMnsskYik08mIUbArMk148AYCAbBB7TTOmfgrqENxICdx0SyMCkvLfBGRZypn56BcHjL7ljXcxP1P7gomkDgOoGb8p/tl7rUQeuN62ntAnzHzR68tT/xBAtANwIE4CYchGI4OEidSEJoO2QX/7CHOmDdpCoOK/px2ELn5YtAMybnCVaC2ab/M8sRO56oG7BBT0hzUCAtfgir8j0MmAwb2F1oZQA6RioUrCF2uTtnSFAUVYpG4/aCvVpV9xXQEMcmRdEOk5ZAiWjUjAcA2g8MAPcRvsK2JBOMQ4FLRbcsmAIgfcB07jxWukufNtj9g3xCqlGJn0DPeBcKBz2GMpwBrJd/RtwDyLtYrfckXxdJtUhCQeQhNyib4RW4O1kyB05B9g2wb9UdiLNRZxFdbyDNcyGVgazPENZA3yDeULmUqwIjIUVyDWHK308TzyBh7lAOApAAr44N2qiqJCEgAKLwXZcEUj5wnc1FZp3s9lDNXOK8/PDSiG9OnsHTYOmqYOYuTvfeWUsQCAvgALQyhpstRWyBGHEAeTF30fbbMv+MUKOiJ5QeWp0FGkDcAEhU8ixXPOSgx3JtnIt+0zpC3iZshpWTy/a0BBm4Ap1oKtbdI3RsYCuNCF0eYGFFTzxH1kybtHRj/DvJEtYIUse8aztGzbDs6/VAMoeL6Ua49lSwfALhVQoBhgUbOCdcj6t+/0AQqe5QCER/YwLbWNIoRLE6AcJTR+XCa1BLChnksEuNR+Oz3PWiH+zIL+6PeoOcMB2XdPxnyAYpCenB3a0BiK9EEUIGQd66OWULaxTE0FHBcLKGAMwUe2sBXmGcBGzvQPcxFkVKPTObolRmOqRCPkcC0RBzzP6StqS+/wO0IBv3nf5WeeEEZbJQPFltr12iT+ATQfqSGf3ge0AdQ4TM8OqOB+weIDn9G6+mjHgOKi9wBLtD9rXvX6ihUGrQ6Xz2XJ95U8WdZnRcrmItaQ5R+AkKC6UgqzLRREH6P+aJ6tBRQIHixXObI1U5YKKLwLu6aa3xKgoB0yMTjsIvuZ5wlk5P6d0j7zxoD2CbCIAhgOaiwC9ublqfijv0MAIaDCu7051x6HL3EulNQvlRSfD1BMy42xgILeYPXCHXZDsGsACNxpWCzyAbHBg0C1uWhAgVaOLxkft6ZIegwmPGIqiDvQdRIsvzENMRGAl5IA1+/eRlZyP1mfxXtY14zXBoIYH34J9eeEMIcyhz7xGtZkSnuYuDGb0gbm/CFEABaHAm4AGxSbvsfiIxAIkMNhbbNHvHZ3DCi2uoAGxKbBVeNZleg/ZkHMvqw1wKq+Q2ZuCwWdtZUJvbLKHl89DZRbIZ8R1DeuAIqVyA0FVQX3GmvMs5jZNNelAgovm2fIfnHeWT1YZJ1zeejncTeQmUZ6bw5YoORgLaOOzNA9TZvENnH3A3FWOYsAChomctwkU2mrEZ6izKAAsT8JorclA9I34AUuWPoYLX++M0BRf+5usWYwoHDaJfgXGU58Xk6hJuaCuJO+gpGRufOeubfI6ha1hHK1dM7ezU320MZ38R4LFiRMSVEONkzFbE78Sgju4o2XgU5y+BLkQt18fPFYSYjzgJlUpOyLyLafLwlhBDnmSLRuahmw0TgA+RdNvSoNiYUIz6jrgKaMLxPTIoFemNRtdc/S95bwO2PCGgBgYEzMDyZ8gmMjWS1LGMOAPowUdX6L7CF876wP1gZBvwBz9hMxRI3iHGBdYklDPqE4pRtlcXXyLwLYo60BJkihBljjHsbFhxykjoO9AyT6zSmfY1+SjQLAQlZz0CJrsIQiR6fkxZT9jlp0J22z8DF4CC+JfaO4H2ce8U1YNSOZj5efn0WEnH9+h4BixlHsclq7tipGUwIUe+h9a3J/HKhYORN3cn8tTzyQ9rnGgcaBRXJgh4BikePfRae2AcVKniDrs6DHwXQqB8OpjHPwQmgvNg4M4kDbWZZtozky+gODJnKGl8YNpAGKGabEfLJZKObn8cG2MG771g17l23V9WyKp497dFNwqH2jcWBuDjRAMTeHr1bKJK0nbKGYR0wO+ap6Z8jr8/P5xFpok3BiE96Ge4QcWM4unqYnDVDMv0j3ZKGYZoHMz57WQuNA40DjQOPAMXCgAYrsLE52ILuAYrKvH8MqbGPoONBWRVsKp8qBtvbD1YLidYV2vpgOD1Ac3rrbk4Vi52tpbw0e3pLYG6vma7hNwny8Pfkvt8V1KEvg8ADFoXD2sp8NUGTmrImJw1vMrceNA40Dx8+BobJ5MkAxtAPHPzVXri+vCso8Af60ITYONA7UcKAJ2xpuLebZU5i2yQDFYmZtro7sYzXso825+Ne+2zhwzBxoe/WYZ3chY1v+ImuAoi2VhXCgdeN0OLB8wXg6c9FG2jgwHQeGAYomD6abgfalxoEpOND25BRcbN9oHGgcGMGBEKA4DFl1GL0cMVcn9mqbz6VOeJuZpc5M61fjwH45EAIU++3iMbS+JxG8p2aXPmN7Z8uEHZjwU0uftkz/GgcWPXF90xOYusAjix7+qXWuAYpTm/E23pPhQBPGFVPdmFXBrP082qZoP3yvaXUaQNFmuobn7dnGgaPkwGLFwGI7dpTLoA3qhDkwDaA4YQbmhz5Cio14tU1F44DHgbak2rpoHGgcmJsDpwcommSde00t/PttAYydoNk4ONuHx474iN8fy/Ox7x8xa09xaKcHKE5xlvc55iZw9sn91nbjQOPAjjhQLeqqX9jRQEY0UwQUF2M+wsGP4NviXm3Ts7gpaR1qHHA5cCh79VD62ZbZcjhQBBTL6WrrSePAAA6MloqjPzCg0+2VY+NAW0XHNqMLHM8CFlkDFAtZF7m1sIA1shAOtW4cHwfa6j6+OW0jGsSBBWyFKbpwdIAizJTwg4OWR3vp1DnQ1tdsK6CxdjbWHuSH23pYzrT9P1b8I9tSXBpsAAAAAElFTkSuQmCC"/></switch></g></g></g></g></g></g></svg>
docs/versioned_docs/version-7.0.x/behaviour.mdnew file+11
@@ -0,0 +1,11 @@
1+---
2+id: behaviour
3+title: Behaviour
4+---
5+
6+1. Any request passing through the proxy (and not matched by `--skip-auth-route`) is checked for the proxy's session cookie (`--cookie-name`) (or, if allowed, a JWT token - see `--skip-jwt-bearer-tokens`).
7+2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with `Accept: application/json`, in which case 401 Unauthorized is returned)
8+3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
9+4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)
10+
11+Notice that the proxy also provides a number of useful [endpoints](features/endpoints.md).
docs/versioned_docs/version-7.0.x/community/security.mdnew file+49
@@ -0,0 +1,49 @@
1+---
2+id: security
3+title: Security
4+---
5+
6+:::note
7+OAuth2 Proxy is a community project.
8+Maintainers do not work on this project full time, and as such,
9+while we endeavour to respond to disclosures as quickly as possible,
10+this may take longer than in projects with corporate sponsorship.
11+:::
12+
13+## Security Disclosures
14+
15+:::important
16+If you believe you have found a vulnerability within OAuth2 Proxy or any of its
17+dependencies, please do NOT open an issue or PR on GitHub, please do NOT post
18+any details publicly.
19+:::
20+
21+Security disclosures MUST be done in private.
22+If you have found an issue that you would like to bring to the attention of the
23+maintenance team for OAuth2 Proxy, please compose an email and send it to the
24+list of maintainers in our [MAINTAINERS](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/MAINTAINERS) file.
25+
26+Please include as much detail as possible.
27+Ideally, your disclosure should include:
28+- A reproducible case that can be used to demonstrate the exploit
29+- How you discovered this vulnerability
30+- A potential fix for the issue (if you have thought of one)
31+- Versions affected (if not present in master)
32+- Your GitHub ID
33+
34+### How will we respond to disclosures?
35+
36+We use [GitHub Security Advisories](https://docs.github.com/en/github/managing-security-vulnerabilities/about-github-security-advisories)
37+to privately discuss fixes for disclosed vulnerabilities.
38+If you include a GitHub ID with your disclosure we will add you as a collaborator
39+for the advisory so that you can join the discussion and validate any fixes
40+we may propose.
41+
42+For minor issues and previously disclosed vulnerabilities (typically for
43+dependencies), we may use regular PRs for fixes and forego the security advisory.
44+
45+Once a fix has been agreed upon, we will merge the fix and create a new release.
46+If we have multiple security issues in flight simultaneously, we may delay
47+merging fixes until all patches are ready.
48+We may also backport the fix to previous releases,
49+but this will be at the discretion of the maintainers.
docs/versioned_docs/version-7.0.x/configuration/alpha_config.mdnew file+212
@@ -0,0 +1,212 @@
1+---
2+id: alpha-config
3+title: Alpha Configuration
4+---
5+
6+:::warning
7+This page contains documentation for alpha features.
8+We reserve the right to make breaking changes to the features detailed within this page with no notice.
9+
10+Options described in this page may be changed, removed, renamed or moved without prior warning.
11+Please beware of this before you use alpha configuration options.
12+:::
13+
14+This page details a set of **alpha** configuration options in a new format.
15+Going forward we are intending to add structured configuration in YAML format to
16+replace the existing TOML based configuration file and flags.
17+
18+Below is a reference for the structure of the configuration, with
19+[AlphaOptions](#alphaoptions) as the root of the configuration.
20+
21+When using alpha configuration, your config file will look something like below:
22+
23+```yaml
24+upstreams:
25+ - id: ...
26+ ...
27+injectRequestHeaders:
28+ - name: ...
29+ ...
30+injectResponseHeaders:
31+ - name: ...
32+ ...
33+```
34+
35+Please browse the [reference](#configuration-reference) below for the structure
36+of the new configuration format.
37+
38+## Using Alpha Configuration
39+
40+To use the new **alpha** configuration, generate a YAML file based on the format
41+described in the [reference](#configuration-reference) below.
42+
43+Provide the path to this file using the `--alpha-config` flag.
44+
45+:::note
46+When using the `--alpha-config` flag, some options are no longer available.
47+See [removed options](#removed-options) below for more information.
48+:::
49+
50+### Converting configuration to the new structure
51+
52+Before adding the new `--alpha-config` option, start OAuth2 Proxy using the
53+`convert-config-to-alpha` flag to convert existing configuration to the new format.
54+
55+```bash
56+oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg
57+```
58+
59+This will convert any options supported by the new format to YAML and print the
60+new configuration to `STDOUT`.
61+
62+Copy this to a new file, remove any options from your existing configuration
63+noted in [removed options](#removed-options) and then start OAuth2 Proxy using
64+the new config.
65+
66+```bash
67+oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg
68+```
69+
70+## Removed options
71+
72+The following flags/options and their respective environment variables are no
73+longer available when using alpha configuration:
74+
75+<!-- Legacy Upstream FlagSet -->
76+- `flush-interval`/`flush_interval`
77+- `pass-host-header`/`pass_host_header`
78+- `proxy-websockets`/`proxy_websockets`
79+- `ssl-upstream-insecure-skip-verify`/`ssl_upstream_insecure_skip_verify`
80+- `upstream`/`upstreams`
81+
82+<!-- Legacy Headers FlagSet -->
83+- `pass-basic-auth`/`pass_basic_auth`
84+- `pass-access-token`/`pass_access_token`
85+- `pass-user-headers`/`pass_user_headers`
86+- `pass-authorization-header`/`pass_authorization_header`
87+- `set-basic-auth`/`set_basic_auth`
88+- `set-xauthrequest`/`set_xauthrequest`
89+- `set-authorization-header`/`set_authorization_header`
90+- `prefer-email-to-user`/`prefer_email_to_user`
91+- `basic-auth-password`/`basic_auth_password`
92+- `skip-auth-strip-headers`/`skip_auth_strip_headers`
93+
94+Attempting to use these options via flags or via config when `--alpha-config`
95+set will result in an error.
96+
97+:::important
98+You must remove these options before starting OAuth2 Proxy with `--alpha-config`
99+:::
100+
101+## Configuration Reference
102+<!--- THIS FILE IS AUTOGENERATED!!! DO NOT EDIT!!! -->
103+
104+### AlphaOptions
105+
106+AlphaOptions contains alpha structured configuration options.
107+Usage of these options allows users to access alpha features that are not
108+available as part of the primary configuration structure for OAuth2 Proxy.
109+
110+:::warning
111+The options within this structure are considered alpha.
112+They may change between releases without notice.
113+:::
114+
115+| Field | Type | Description |
116+| ----- | ---- | ----------- |
117+| `upstreams` | _[Upstreams](#upstreams)_ | Upstreams is used to configure upstream servers.<br/>Once a user is authenticated, requests to the server will be proxied to<br/>these upstream servers based on the path mappings defined in this list. |
118+| `injectRequestHeaders` | _[[]Header](#header)_ | InjectRequestHeaders is used to configure headers that should be added<br/>to requests to upstream servers.<br/>Headers may source values from either the authenticated user's session<br/>or from a static secret value. |
119+| `injectResponseHeaders` | _[[]Header](#header)_ | InjectResponseHeaders is used to configure headers that should be added<br/>to responses from the proxy.<br/>This is typically used when using the proxy as an external authentication<br/>provider in conjunction with another proxy such as NGINX and its<br/>auth_request module.<br/>Headers may source values from either the authenticated user's session<br/>or from a static secret value. |
120+
121+### ClaimSource
122+
123+(**Appears on:** [HeaderValue](#headervalue))
124+
125+ClaimSource allows loading a header value from a claim within the session
126+
127+| Field | Type | Description |
128+| ----- | ---- | ----------- |
129+| `claim` | _string_ | Claim is the name of the claim in the session that the value should be<br/>loaded from. |
130+| `prefix` | _string_ | Prefix is an optional prefix that will be prepended to the value of the<br/>claim if it is non-empty. |
131+| `basicAuthPassword` | _[SecretSource](#secretsource)_ | BasicAuthPassword converts this claim into a basic auth header.<br/>Note the value of claim will become the basic auth username and the<br/>basicAuthPassword will be used as the password value. |
132+
133+### Duration
134+#### (`string` alias)
135+
136+(**Appears on:** [Upstream](#upstream))
137+
138+Duration is as string representation of a period of time.
139+A duration string is a is a possibly signed sequence of decimal numbers,
140+each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".
141+Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
142+
143+
144+### Header
145+
146+(**Appears on:** [AlphaOptions](#alphaoptions))
147+
148+Header represents an individual header that will be added to a request or
149+response header.
150+
151+| Field | Type | Description |
152+| ----- | ---- | ----------- |
153+| `name` | _string_ | Name is the header name to be used for this set of values.<br/>Names should be unique within a list of Headers. |
154+| `preserveRequestValue` | _bool_ | PreserveRequestValue determines whether any values for this header<br/>should be preserved for the request to the upstream server.<br/>This option only applies to injected request headers.<br/>Defaults to false (headers that match this header will be stripped). |
155+| `values` | _[[]HeaderValue](#headervalue)_ | Values contains the desired values for this header |
156+
157+### HeaderValue
158+
159+(**Appears on:** [Header](#header))
160+
161+HeaderValue represents a single header value and the sources that can
162+make up the header value
163+
164+| Field | Type | Description |
165+| ----- | ---- | ----------- |
166+| `value` | _[]byte_ | Value expects a base64 encoded string value. |
167+| `fromEnv` | _string_ | FromEnv expects the name of an environment variable. |
168+| `fromFile` | _string_ | FromFile expects a path to a file containing the secret value. |
169+| `claim` | _string_ | Claim is the name of the claim in the session that the value should be<br/>loaded from. |
170+| `prefix` | _string_ | Prefix is an optional prefix that will be prepended to the value of the<br/>claim if it is non-empty. |
171+| `basicAuthPassword` | _[SecretSource](#secretsource)_ | BasicAuthPassword converts this claim into a basic auth header.<br/>Note the value of claim will become the basic auth username and the<br/>basicAuthPassword will be used as the password value. |
172+
173+### SecretSource
174+
175+(**Appears on:** [ClaimSource](#claimsource), [HeaderValue](#headervalue))
176+
177+SecretSource references an individual secret value.
178+Only one source within the struct should be defined at any time.
179+
180+| Field | Type | Description |
181+| ----- | ---- | ----------- |
182+| `value` | _[]byte_ | Value expects a base64 encoded string value. |
183+| `fromEnv` | _string_ | FromEnv expects the name of an environment variable. |
184+| `fromFile` | _string_ | FromFile expects a path to a file containing the secret value. |
185+
186+### Upstream
187+
188+(**Appears on:** [Upstreams](#upstreams))
189+
190+Upstream represents the configuration for an upstream server.
191+Requests will be proxied to this upstream if the path matches the request path.
192+
193+| Field | Type | Description |
194+| ----- | ---- | ----------- |
195+| `id` | _string_ | ID should be a unique identifier for the upstream.<br/>This value is required for all upstreams. |
196+| `path` | _string_ | Path is used to map requests to the upstream server.<br/>The closest match will take precedence and all Paths must be unique. |
197+| `uri` | _string_ | The URI of the upstream server. This may be an HTTP(S) server of a File<br/>based URL. It may include a path, in which case all requests will be served<br/>under that path.<br/>Eg:<br/>- http://localhost:8080<br/>- https://service.localhost<br/>- https://service.localhost/path<br/>- file://host/path<br/>If the URI's path is "/base" and the incoming request was for "/dir",<br/>the upstream request will be for "/base/dir". |
198+| `insecureSkipTLSVerify` | _bool_ | InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.<br/>This option is insecure and will allow potential Man-In-The-Middle attacks<br/>betweem OAuth2 Proxy and the usptream server.<br/>Defaults to false. |
199+| `static` | _bool_ | Static will make all requests to this upstream have a static response.<br/>The response will have a body of "Authenticated" and a response code<br/>matching StaticCode.<br/>If StaticCode is not set, the response will return a 200 response. |
200+| `staticCode` | _int_ | StaticCode determines the response code for the Static response.<br/>This option can only be used with Static enabled. |
201+| `flushInterval` | _[Duration](#duration)_ | FlushInterval is the period between flushing the response buffer when<br/>streaming response from the upstream.<br/>Defaults to 1 second. |
202+| `passHostHeader` | _bool_ | PassHostHeader determines whether the request host header should be proxied<br/>to the upstream server.<br/>Defaults to true. |
203+| `proxyWebSockets` | _bool_ | ProxyWebSockets enables proxying of websockets to upstream servers<br/>Defaults to true. |
204+
205+### Upstreams
206+
207+#### ([[]Upstream](#upstream) alias)
208+
209+(**Appears on:** [AlphaOptions](#alphaoptions))
210+
211+Upstreams is a collection of definitions for upstream servers.
212+
docs/versioned_docs/version-7.0.x/configuration/alpha_config.md.tmplnew file+101
@@ -0,0 +1,101 @@
1+---
2+id: alpha-config
3+title: Alpha Configuration
4+---
5+
6+:::warning
7+This page contains documentation for alpha features.
8+We reserve the right to make breaking changes to the features detailed within this page with no notice.
9+
10+Options described in this page may be changed, removed, renamed or moved without prior warning.
11+Please beware of this before you use alpha configuration options.
12+:::
13+
14+This page details a set of **alpha** configuration options in a new format.
15+Going forward we are intending to add structured configuration in YAML format to
16+replace the existing TOML based configuration file and flags.
17+
18+Below is a reference for the structure of the configuration, with
19+[AlphaOptions](#alphaoptions) as the root of the configuration.
20+
21+When using alpha configuration, your config file will look something like below:
22+
23+```yaml
24+upstreams:
25+ - id: ...
26+ ...
27+injectRequestHeaders:
28+ - name: ...
29+ ...
30+injectResponseHeaders:
31+ - name: ...
32+ ...
33+```
34+
35+Please browse the [reference](#configuration-reference) below for the structure
36+of the new configuration format.
37+
38+## Using Alpha Configuration
39+
40+To use the new **alpha** configuration, generate a YAML file based on the format
41+described in the [reference](#configuration-reference) below.
42+
43+Provide the path to this file using the `--alpha-config` flag.
44+
45+:::note
46+When using the `--alpha-config` flag, some options are no longer available.
47+See [removed options](#removed-options) below for more information.
48+:::
49+
50+### Converting configuration to the new structure
51+
52+Before adding the new `--alpha-config` option, start OAuth2 Proxy using the
53+`convert-config-to-alpha` flag to convert existing configuration to the new format.
54+
55+```bash
56+oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg
57+```
58+
59+This will convert any options supported by the new format to YAML and print the
60+new configuration to `STDOUT`.
61+
62+Copy this to a new file, remove any options from your existing configuration
63+noted in [removed options](#removed-options) and then start OAuth2 Proxy using
64+the new config.
65+
66+```bash
67+oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg
68+```
69+
70+## Removed options
71+
72+The following flags/options and their respective environment variables are no
73+longer available when using alpha configuration:
74+
75+<!-- Legacy Upstream FlagSet -->
76+- `flush-interval`/`flush_interval`
77+- `pass-host-header`/`pass_host_header`
78+- `proxy-websockets`/`proxy_websockets`
79+- `ssl-upstream-insecure-skip-verify`/`ssl_upstream_insecure_skip_verify`
80+- `upstream`/`upstreams`
81+
82+<!-- Legacy Headers FlagSet -->
83+- `pass-basic-auth`/`pass_basic_auth`
84+- `pass-access-token`/`pass_access_token`
85+- `pass-user-headers`/`pass_user_headers`
86+- `pass-authorization-header`/`pass_authorization_header`
87+- `set-basic-auth`/`set_basic_auth`
88+- `set-xauthrequest`/`set_xauthrequest`
89+- `set-authorization-header`/`set_authorization_header`
90+- `prefer-email-to-user`/`prefer_email_to_user`
91+- `basic-auth-password`/`basic_auth_password`
92+- `skip-auth-strip-headers`/`skip_auth_strip_headers`
93+
94+Attempting to use these options via flags or via config when `--alpha-config`
95+set will result in an error.
96+
97+:::important
98+You must remove these options before starting OAuth2 Proxy with `--alpha-config`
99+:::
100+
101+## Configuration Reference
docs/versioned_docs/version-7.0.x/configuration/auth.mdnew file+528
@@ -0,0 +1,528 @@
1+---
2+id: oauth_provider
3+title: OAuth Provider Configuration
4+---
5+
6+You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run `oauth2-proxy` on.
7+
8+Valid providers are :
9+
10+- [Google](#google-auth-provider) _default_
11+- [Azure](#azure-auth-provider)
12+- [Facebook](#facebook-auth-provider)
13+- [GitHub](#github-auth-provider)
14+- [Keycloak](#keycloak-auth-provider)
15+- [GitLab](#gitlab-auth-provider)
16+- [LinkedIn](#linkedin-auth-provider)
17+- [Microsoft Azure AD](#microsoft-azure-ad-provider)
18+- [OpenID Connect](#openid-connect-provider)
19+- [login.gov](#logingov-provider)
20+- [Nextcloud](#nextcloud-provider)
21+- [DigitalOcean](#digitalocean-auth-provider)
22+- [Bitbucket](#bitbucket-auth-provider)
23+- [Gitea](#gitea-auth-provider)
24+
25+The provider can be selected using the `provider` configuration value.
26+
27+Please note that not all providers support all claims. The `preferred_username` claim is currently only supported by the OpenID Connect provider.
28+
29+### Google Auth Provider
30+
31+For Google, the registration steps are:
32+
33+1. Create a new project: https://console.developers.google.com/project
34+2. Choose the new project from the top right project dropdown (only if another project is selected)
35+3. In the project Dashboard center pane, choose **"API Manager"**
36+4. In the left Nav pane, choose **"Credentials"**
37+5. In the center pane, choose **"OAuth consent screen"** tab. Fill in **"Product name shown to users"** and hit save.
38+6. In the center pane, choose **"Credentials"** tab.
39+ - Open the **"New credentials"** drop down
40+ - Choose **"OAuth client ID"**
41+ - Choose **"Web application"**
42+ - Application name is freeform, choose something appropriate
43+ - Authorized JavaScript origins is your domain ex: `https://internal.yourcompany.com`
44+ - Authorized redirect URIs is the location of oauth2/callback ex: `https://internal.yourcompany.com/oauth2/callback`
45+ - Choose **"Create"**
46+7. Take note of the **Client ID** and **Client Secret**
47+
48+It's recommended to refresh sessions on a short interval (1h) with `cookie-refresh` setting which validates that the account is still authorized.
49+
50+#### Restrict auth to specific Google groups on your domain. (optional)
51+
52+1. Create a service account: https://developers.google.com/identity/protocols/OAuth2ServiceAccount and make sure to download the json file.
53+2. Make note of the Client ID for a future step.
54+3. Under "APIs & Auth", choose APIs.
55+4. Click on Admin SDK and then Enable API.
56+5. Follow the steps on https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account and give the client id from step 2 the following oauth scopes:
57+
58+```
59+https://www.googleapis.com/auth/admin.directory.group.readonly
60+https://www.googleapis.com/auth/admin.directory.user.readonly
61+```
62+
63+6. Follow the steps on https://support.google.com/a/answer/60757 to enable Admin API access.
64+7. Create or choose an existing administrative email address on the Gmail domain to assign to the `google-admin-email` flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why.
65+8. Create or choose an existing email group and set that email to the `google-group` flag. You can pass multiple instances of this flag with different groups
66+ and the user will be checked against all the provided groups.
67+9. Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the `google-service-account-json` flag.
68+10. Restart oauth2-proxy.
69+
70+Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour ).
71+
72+### Azure Auth Provider
73+
74+1. Add an application: go to [https://portal.azure.com](https://portal.azure.com), choose **"Azure Active Directory"** in the left menu, select **"App registrations"** and then click on **"New app registration"**.
75+2. Pick a name and choose **"Webapp / API"** as application type. Use `https://internal.yourcompany.com` as Sign-on URL. Click **"Create"**.
76+3. On the **"Settings"** / **"Properties"** page of the app, pick a logo and select **"Multi-tenanted"** if you want to allow users from multiple organizations to access your app. Note down the application ID. Click **"Save"**.
77+4. On the **"Settings"** / **"Required Permissions"** page of the app, click on **"Windows Azure Active Directory"** and then on **"Access the directory as the signed in user"**. Hit **"Save"** and then then on **"Grant permissions"** (you might need another admin to do this).
78+5. On the **"Settings"** / **"Reply URLs"** page of the app, add `https://internal.yourcompanycom/oauth2/callback` for each host that you want to protect by the oauth2 proxy. Click **"Save"**.
79+6. On the **"Settings"** / **"Keys"** page of the app, add a new key and note down the value after hitting **"Save"**.
80+7. Configure the proxy with
81+
82+```
83+ --provider=azure
84+ --client-id=<application ID from step 3>
85+ --client-secret=<value from step 6>
86+```
87+
88+Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the [redis session storage](sessions.md#redis-storage) should resolve this.
89+
90+### Facebook Auth Provider
91+
92+1. Create a new FB App from https://developers.facebook.com/
93+2. Under FB Login, set your Valid OAuth redirect URIs to `https://internal.yourcompany.com/oauth2/callback`
94+
95+### GitHub Auth Provider
96+
97+1. Create a new project: https://github.com/settings/developers
98+2. Under `Authorization callback URL` enter the correct url ie `https://internal.yourcompany.com/oauth2/callback`
99+
100+The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with `--email-domain=*`
101+
102+NOTE: When `--github-user` is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators.
103+
104+To restrict by organization only, include the following flag:
105+
106+```
107+ --github-org="": restrict logins to members of this organisation
108+```
109+
110+To restrict within an organization to specific teams, include the following flag in addition to `-github-org`:
111+
112+```
113+ --github-team="": restrict logins to members of any of these teams (slug), separated by a comma
114+```
115+
116+If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:
117+
118+```
119+ --github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo
120+```
121+
122+If you'd like to allow access to users with **read only** access to a **public** repository you will need to provide a [token](https://github.com/settings/tokens) for a user that has write access to the repository. The token must be created with at least the `public_repo` scope:
123+
124+```
125+ --github-token="": the token to use when verifying repository collaborators
126+```
127+
128+To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma
129+
130+```
131+ --github-user="": allow logins by username, separated by a comma
132+```
133+
134+If you are using GitHub enterprise, make sure you set the following to the appropriate url:
135+
136+```
137+ --login-url="http(s)://<enterprise github host>/login/oauth/authorize"
138+ --redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"
139+ --validate-url="http(s)://<enterprise github host>/api/v3"
140+```
141+
142+### Keycloak Auth Provider
143+
144+1. Create new client in your Keycloak with **Access Type** 'confidental' and **Valid Redirect URIs** 'https://internal.yourcompany.com/oauth2/callback'
145+2. Take note of the Secret in the credential tab of the client
146+3. Create a mapper with **Mapper Type** 'Group Membership' and **Token Claim Name** 'groups'.
147+
148+Make sure you set the following to the appropriate url:
149+
150+```
151+ --provider=keycloak
152+ --client-id=<client you have created>
153+ --client-secret=<your client's secret>
154+ --login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"
155+ --redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"
156+ --profile-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
157+ --validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
158+ --keycloak-group=<first_allowed_user_group>
159+ --keycloak-group=<second_allowed_user_group>
160+```
161+
162+For group based authorization, the optional `--keycloak-group` (legacy) or `--allowed-group` (global standard)
163+flags can be used to specify which groups to limit access to.
164+
165+If these are unset but a `groups` mapper is set up above in step (3), the provider will still
166+populate the `X-Forwarded-Groups` header to your upstream server with the `groups` data in the
167+Keycloak userinfo endpoint response.
168+
169+The group management in keycloak is using a tree. If you create a group named admin in keycloak
170+you should define the 'keycloak-group' value to /admin.
171+
172+### GitLab Auth Provider
173+
174+This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see [994](https://github.com/oauth2-proxy/oauth2-proxy/issues/994)).
175+
176+Whether you are using GitLab.com or self-hosting GitLab, follow [these steps to add an application](https://docs.gitlab.com/ce/integration/oauth_provider.html). Make sure to enable at least the `openid`, `profile` and `email` scopes, and set the redirect url to your application url e.g. https://myapp.com/oauth2/callback.
177+
178+If you need projects filtering, add the extra `read_api` scope to your application.
179+
180+The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow [these steps](./overview.md#generating-a-cookie-secret)
181+
182+```
183+ --provider="gitlab"
184+ --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab
185+ --client-id=GITLAB_CLIENT_ID
186+ --client-secret=GITLAB_CLIENT_SECRET
187+ --cookie-secret=COOKIE_SECRET
188+```
189+
190+Restricting by group membership is possible with the following option:
191+
192+```
193+ --gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma
194+```
195+
196+If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:
197+
198+```
199+ --oidc-issuer-url="<your gitlab url>"
200+```
201+
202+### LinkedIn Auth Provider
203+
204+For LinkedIn, the registration steps are:
205+
206+1. Create a new project: https://www.linkedin.com/secure/developer
207+2. In the OAuth User Agreement section:
208+ - In default scope, select r_basicprofile and r_emailaddress.
209+ - In "OAuth 2.0 Redirect URLs", enter `https://internal.yourcompany.com/oauth2/callback`
210+3. Fill in the remaining required fields and Save.
211+4. Take note of the **Consumer Key / API Key** and **Consumer Secret / Secret Key**
212+
213+### Microsoft Azure AD Provider
214+
215+For adding an application to the Microsoft Azure AD follow [these steps to add an application](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app).
216+
217+Take note of your `TenantId` if applicable for your situation. The `TenantId` can be used to override the default `common` authorization server with a tenant specific server.
218+
219+### OpenID Connect Provider
220+
221+OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects.
222+
223+This provider was originally built against CoreOS Dex and we will use it as an example.
224+The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below.
225+
226+#### Dex
227+
228+To configure the OIDC provider for Dex, perform the following steps:
229+
230+1. Download Dex:
231+
232+ ```
233+ go get github.com/dexidp/dex
234+ ```
235+
236+ See the [getting started guide](https://dexidp.io/docs/getting-started/) for more details.
237+
238+2. Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the `staticClients` section of `examples/config-dev.yaml`:
239+
240+ ```
241+ - id: oauth2-proxy
242+ redirectURIs:
243+ - 'http://127.0.0.1:4180/oauth2/callback'
244+ name: 'oauth2-proxy'
245+ secret: proxy
246+ ```
247+
248+3. Launch Dex: from `$GOPATH/github.com/dexidp/dex`, run:
249+
250+ ```
251+ bin/dex serve examples/config-dev.yaml
252+ ```
253+
254+4. In a second terminal, run the oauth2-proxy with the following args:
255+
256+ ```
257+ -provider oidc
258+ -provider-display-name "My OIDC Provider"
259+ -client-id oauth2-proxy
260+ -client-secret proxy
261+ -redirect-url http://127.0.0.1:4180/oauth2/callback
262+ -oidc-issuer-url http://127.0.0.1:5556/dex
263+ -cookie-secure=false
264+ -cookie-secret=secret
265+ -email-domain kilgore.trout
266+ ```
267+
268+ To serve the current working directory as a web site under the `/static` endpoint, add:
269+
270+ ```
271+ -upstream file://$PWD/#/static/
272+ ```
273+
274+5. Test the setup by visiting http://127.0.0.1:4180 or http://127.0.0.1:4180/static .
275+
276+See also [our local testing environment](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment) for a self-contained example using Docker and etcd as storage for Dex.
277+
278+#### Okta
279+
280+To configure the OIDC provider for Okta, perform the following steps:
281+
282+1. Log in to Okta using an administrative account. It is suggested you try this in preview first, `example.oktapreview.com`
283+2. (OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,
284+you may wish to configure an authorization server for each application. Otherwise, the provided `default` will work.
285+* Navigate to **Security** then select **API**
286+* Click **Add Authorization Server**, if this option is not available you may require an additional license for a custom authorization server.
287+* Fill out the **Name** with something to describe the application you are protecting. e.g. 'Example App'.
288+* For **Audience**, pick the URL of the application you wish to protect: https://example.corp.com
289+* Fill out a **Description**
290+* Add any **Access Policies** you wish to configure to limit application access.
291+* The default settings will work for other options.
292+[See Okta documentation for more information on Authorization Servers](https://developer.okta.com/docs/guides/customize-authz-server/overview/)
293+3. Navigate to **Applications** then select **Add Application**.
294+* Select **Web** for the **Platform** setting.
295+* Select **OpenID Connect** and click **Create**
296+* Pick an **Application Name** such as `Example App`.
297+* Set the **Login redirect URI** to `https://example.corp.com`.
298+* Under **General** set the **Allowed grant types** to `Authorization Code` and `Refresh Token`.
299+* Leave the rest as default, taking note of the `Client ID` and `Client Secret`.
300+* Under **Assignments** select the users or groups you wish to access your application.
301+4. Create a configuration file like the following:
302+
303+ ```
304+ provider = "oidc"
305+ redirect_url = "https://example.corp.com/oauth2/callback"
306+ oidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"
307+ upstreams = [
308+ "https://example.corp.com"
309+ ]
310+ email_domains = [
311+ "corp.com"
312+ ]
313+ client_id = "XXXXX"
314+ client_secret = "YYYYY"
315+ pass_access_token = true
316+ cookie_secret = "ZZZZZ"
317+ skip_provider_button = true
318+ ```
319+
320+The `oidc_issuer_url` is based on URL from your **Authorization Server**'s **Issuer** field in step 2, or simply https://corp.okta.com .
321+The `client_id` and `client_secret` are configured in the application settings.
322+Generate a unique `client_secret` to encrypt the cookie.
323+
324+Then you can start the oauth2-proxy with `./oauth2-proxy --config /etc/example.cfg`
325+
326+#### Okta - localhost
327+
328+1. Signup for developer account: https://developer.okta.com/signup/
329+2. Create New `Web` Application: https://$\{your-okta-domain\}/dev/console/apps/new
330+3. Example Application Settings for localhost:
331+ * **Name:** My Web App
332+ * **Base URIs:** http://localhost:4180/
333+ * **Login redirect URIs:** http://localhost:4180/oauth2/callback
334+ * **Logout redirect URIs:** http://localhost:4180/
335+ * **Group assignments:** `Everyone`
336+ * **Grant type allowed:** `Authorization Code` and `Refresh Token`
337+4. Make note of the `Client ID` and `Client secret`, they are needed in a future step
338+5. Make note of the **default** Authorization Server Issuer URI from: https://$\{your-okta-domain\}/admin/oauth2/as
339+6. Example config file `/etc/localhost.cfg`
340+ ```
341+ provider = "oidc"
342+ redirect_url = "http://localhost:4180/oauth2/callback"
343+ oidc_issuer_url = "https://$\{your-okta-domain\}/oauth2/default"
344+ upstreams = [
345+ "http://0.0.0.0:8080"
346+ ]
347+ email_domains = [
348+ "*"
349+ ]
350+ client_id = "XXX"
351+ client_secret = "YYY"
352+ pass_access_token = true
353+ cookie_secret = "ZZZ"
354+ cookie_secure = false
355+ skip_provider_button = true
356+ # Note: use the following for testing within a container
357+ # http_address = "0.0.0.0:4180"
358+ ```
359+7. Then you can start the oauth2-proxy with `./oauth2-proxy --config /etc/localhost.cfg`
360+
361+### login.gov Provider
362+
363+login.gov is an OIDC provider for the US Government.
364+If you are a US Government agency, you can contact the login.gov team through the contact information
365+that you can find on https://login.gov/developers/ and work with them to understand how to get login.gov
366+accounts for integration/test and production access.
367+
368+A developer guide is available here: https://developers.login.gov/, though this proxy handles everything
369+but the data you need to create to register your application in the login.gov dashboard.
370+
371+As a demo, we will assume that you are running your application that you want to secure locally on
372+http://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that
373+you have an agency integration account for testing.
374+
375+First, register your application in the dashboard. The important bits are:
376+ * Identity protocol: make this `Openid connect`
377+ * Issuer: do what they say for OpenID Connect. We will refer to this string as `${LOGINGOV_ISSUER}`.
378+ * Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.
379+ A quick way to do this is `openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'`,
380+ The contents of the `key.pem` shall be referred to as `${OAUTH2_PROXY_JWT_KEY}`.
381+ * Return to App URL: Make this be `http://localhost:4180/`
382+ * Redirect URIs: Make this be `http://localhost:4180/oauth2/callback`.
383+ * Attribute Bundle: Make sure that email is selected.
384+
385+Now start the proxy up with the following options:
386+```
387+./oauth2-proxy -provider login.gov \
388+ -client-id=${LOGINGOV_ISSUER} \
389+ -redirect-url=http://localhost:4180/oauth2/callback \
390+ -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \
391+ -cookie-secure=false \
392+ -email-domain=gsa.gov \
393+ -upstream=http://localhost:3000/ \
394+ -cookie-secret=somerandomstring12341234567890AB \
395+ -cookie-domain=localhost \
396+ -skip-provider-button=true \
397+ -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \
398+ -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \
399+ -jwt-key="${OAUTH2_PROXY_JWT_KEY}"
400+```
401+You can also set all these options with environment variables, for use in cloud/docker environments.
402+One tricky thing that you may encounter is that some cloud environments will pass in environment
403+variables in a docker env-file, which does not allow multiline variables like a PEM file.
404+If you encounter this, then you can create a `jwt_signing_key.pem` file in the top level
405+directory of the repo which contains the key in PEM format and then do your docker build.
406+The docker build process will copy that file into your image which you can then access by
407+setting the `OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem`
408+environment variable, or by setting `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem` on the commandline.
409+
410+Once it is running, you should be able to go to `http://localhost:4180/` in your browser,
411+get authenticated by the login.gov integration server, and then get proxied on to your
412+application running on `http://localhost:3000/`. In a real deployment, you would secure
413+your application with a firewall or something so that it was only accessible from the
414+proxy, and you would use real hostnames everywhere.
415+
416+#### Skip OIDC discovery
417+
418+Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata.
419+
420+In this case, you can set the `--skip-oidc-discovery` option, and supply those required endpoints manually:
421+
422+```
423+ -provider oidc
424+ -client-id oauth2-proxy
425+ -client-secret proxy
426+ -redirect-url http://127.0.0.1:4180/oauth2/callback
427+ -oidc-issuer-url http://127.0.0.1:5556
428+ -skip-oidc-discovery
429+ -login-url http://127.0.0.1:5556/authorize
430+ -redeem-url http://127.0.0.1:5556/token
431+ -oidc-jwks-url http://127.0.0.1:5556/keys
432+ -cookie-secure=false
433+ -email-domain example.com
434+```
435+
436+### Nextcloud Provider
437+
438+The Nextcloud provider allows you to authenticate against users in your
439+Nextcloud instance.
440+
441+When you are using the Nextcloud provider, you must specify the urls via
442+configuration, environment variable, or command line argument. Depending
443+on whether your Nextcloud instance is using pretty urls your urls may be of the
444+form `/index.php/apps/oauth2/*` or `/apps/oauth2/*`.
445+
446+Refer to the [OAuth2
447+documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html)
448+to setup the client id and client secret. Your "Redirection URI" will be
449+`https://internalapp.yourcompany.com/oauth2/callback`.
450+
451+```
452+ -provider nextcloud
453+ -client-id <from nextcloud admin>
454+ -client-secret <from nextcloud admin>
455+ -login-url="<your nextcloud url>/index.php/apps/oauth2/authorize"
456+ -redeem-url="<your nextcloud url>/index.php/apps/oauth2/api/v1/token"
457+ -validate-url="<your nextcloud url>/ocs/v2.php/cloud/user?format=json"
458+```
459+
460+Note: in *all* cases the validate-url will *not* have the `index.php`.
461+
462+### DigitalOcean Auth Provider
463+
464+1. [Create a new OAuth application](https://cloud.digitalocean.com/account/api/applications)
465+ * You can fill in the name, homepage, and description however you wish.
466+ * In the "Application callback URL" field, enter: `https://oauth-proxy/oauth2/callback`, substituting `oauth2-proxy` with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL.
467+2. Note the Client ID and Client Secret.
468+
469+To use the provider, pass the following options:
470+
471+```
472+ --provider=digitalocean
473+ --client-id=<Client ID>
474+ --client-secret=<Client Secret>
475+```
476+
477+ Alternatively, set the equivalent options in the config file. The redirect URL defaults to `https://<requested host header>/oauth2/callback`. If you need to change it, you can use the `--redirect-url` command-line option.
478+
479+### Bitbucket Auth Provider
480+
481+1. [Add a new OAuth consumer](https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html)
482+ * In "Callback URL" use `https://<oauth2-proxy>/oauth2/callback`, substituting `<oauth2-proxy>` with the actual hostname that oauth2-proxy is running on.
483+ * In Permissions section select:
484+ * Account -> Email
485+ * Team membership -> Read
486+ * Repositories -> Read
487+2. Note the Client ID and Client Secret.
488+
489+To use the provider, pass the following options:
490+
491+```
492+ --provider=bitbucket
493+ --client-id=<Client ID>
494+ --client-secret=<Client Secret>
495+```
496+
497+The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: `--bitbucket-team=<Team name>`. To restrict the access to only these users who has access to one selected repository use `--bitbucket-repository=<Repository name>`.
498+
499+
500+### Gitea Auth Provider
501+
502+1. Create a new application: `https://< your gitea host >/user/settings/applications`
503+2. Under `Redirect URI` enter the correct URL i.e. `https://<proxied host>/oauth2/callback`
504+3. Note the Client ID and Client Secret.
505+4. Pass the following options to the proxy:
506+
507+```
508+ --provider="github"
509+ --redirect-url="https://<proxied host>/oauth2/callback"
510+ --provider-display-name="Gitea"
511+ --client-id="< client_id as generated by Gitea >"
512+ --client-secret="< client_secret as generated by Gitea >"
513+ --login-url="https://< your gitea host >/login/oauth/authorize"
514+ --redeem-url="https://< your gitea host >/login/oauth/access_token"
515+ --validate-url="https://< your gitea host >/api/v1"
516+```
517+
518+
519+## Email Authentication
520+
521+To authorize by email domain use `--email-domain=yourcompany.com`. To authorize individual email addresses use `--authenticated-emails-file=/path/to/file` with one email per line. To authorize all email addresses use `--email-domain=*`.
522+
523+## Adding a new Provider
524+
525+Follow the examples in the [`providers` package](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/) to define a new
526+`Provider` instance. Add a new `case` to
527+[`providers.New()`](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go) to allow `oauth2-proxy` to use the
528+new `Provider`.
docs/versioned_docs/version-7.0.x/configuration/overview.mdnew file+583
@@ -0,0 +1,583 @@
1+---
2+id: overview
3+title: Overview
4+---
5+
6+`oauth2-proxy` can be configured via [command line options](#command-line-options), [environment variables](#environment-variables) or [config file](#config-file) (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings).
7+
8+### Generating a Cookie Secret
9+
10+To generate a strong cookie secret use one of the below commands:
11+
12+import Tabs from '@theme/Tabs';
13+import TabItem from '@theme/TabItem';
14+
15+<Tabs
16+ defaultValue="python"
17+ values={[
18+ {label: 'Python', value: 'python'},
19+ {label: 'Bash', value: 'bash'},
20+ {label: 'OpenSSL', value: 'openssl'},
21+ {label: 'PowerShell', value: 'powershell'},
22+ {label: 'Terraform', value: 'terraform'},
23+ ]}>
24+ <TabItem value="python">
25+
26+ ```shell
27+ python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'
28+ ```
29+
30+ </TabItem>
31+ <TabItem value="bash">
32+
33+ ```shell
34+ dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\n' | tr -- '+/' '-_'; echo
35+ ```
36+
37+ </TabItem>
38+ <TabItem value="openssl">
39+
40+ ```shell
41+ openssl rand -base64 32 | tr -- '+/' '-_'
42+ ```
43+
44+ </TabItem>
45+ <TabItem value="powershell">
46+
47+ ```shell
48+ # Add System.Web assembly to session, just in case
49+ Add-Type -AssemblyName System.Web
50+ [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")
51+ ```
52+
53+ </TabItem>
54+ <TabItem value="terraform">
55+
56+ ```shell
57+ # Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret
58+ resource "random_password" "cookie_secret" {
59+ length = 32
60+ override_special = "-_"
61+ }
62+ ```
63+
64+ </TabItem>
65+</Tabs>
66+
67+### Config File
68+
69+Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (\_). If the argument can be specified multiple times, the config option should be plural (trailing s).
70+
71+An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example) config file is in the contrib directory. It can be used by specifying `--config=/etc/oauth2-proxy.cfg`
72+
73+### Command Line Options
74+
75+| Option | Type | Description | Default |
76+| ------ | ---- | ----------- | ------- |
77+| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
78+| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
79+| `--auth-logging` | bool | Log authentication attempts | true |
80+| `--auth-logging-format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
81+| `--authenticated-emails-file` | string | authenticate against emails via file (one per line) | |
82+| `--azure-tenant` | string | go to a tenant-specific or common (tenant-independent) endpoint. | `"common"` |
83+| `--basic-auth-password` | string | the password to set when passing the HTTP Basic Auth header | |
84+| `--client-id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
85+| `--client-secret` | string | the OAuth Client Secret | |
86+| `--client-secret-file` | string | the file with OAuth Client Secret | |
87+| `--config` | string | path to config file | |
88+| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
89+| `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s |
90+| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
91+| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
92+| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
93+| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;[^1] | |
94+| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
95+| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
96+| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
97+| `--custom-templates-dir` | string | path to custom html templates | |
98+| `--display-htpasswd-form` | bool | display username / password login form if an htpasswd file is provided | true |
99+| `--email-domain` | string \| list | authenticate emails with the specified domain (may be given multiple times). Use `*` to authenticate any email | |
100+| `--errors-to-info-log` | bool | redirects error-level logging to default log channel instead of stderr | false |
101+| `--extra-jwt-issuers` | string | if `--skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` (see a token's `iss`, `aud` fields) pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
102+| `--exclude-logging-path` | string | comma separated list of paths to exclude from logging, e.g. `"/ping,/path2"` |`""` (no paths excluded) |
103+| `--flush-interval` | duration | period between flushing response buffers when streaming responses | `"1s"` |
104+| `--force-https` | bool | enforce https redirect | `false` |
105+| `--banner` | string | custom (html) banner string. Use `"-"` to disable default banner. | |
106+| `--footer` | string | custom (html) footer string. Use `"-"` to disable default footer. | |
107+| `--gcp-healthchecks` | bool | will enable `/liveness_check`, `/readiness_check`, and `/` (with the proper user-agent) endpoints that will make it work well with GCP App Engine and GKE Ingresses | false |
108+| `--github-org` | string | restrict logins to members of this organisation | |
109+| `--github-team` | string | restrict logins to members of any of these teams (slug), separated by a comma | |
110+| `--github-repo` | string | restrict logins to collaborators of this repository formatted as `orgname/repo` | |
111+| `--github-token` | string | the token to use when verifying repository collaborators (must have push access to the repository) | |
112+| `--github-user` | string \| list | To allow users to login by username even if they do not belong to the specified org and team or collaborators | |
113+| `--gitlab-group` | string \| list | restrict logins to members of any of these groups (slug), separated by a comma | |
114+| `--gitlab-projects` | string \| list | restrict logins to members of any of these projects (may be given multiple times) formatted as `orgname/repo=accesslevel`. Access level should be a value matching [Gitlab access levels](https://docs.gitlab.com/ee/api/members.html#valid-access-levels), defaulted to 20 if absent | |
115+| `--google-admin-email` | string | the google admin to impersonate for api calls | |
116+| `--google-group` | string | restrict logins to members of this google group (may be given multiple times). | |
117+| `--google-service-account-json` | string | the path to the service account json credentials | |
118+| `--htpasswd-file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
119+| `--http-address` | string | `[http://]<addr>:<port>` or `unix://<path>` to listen on for HTTP clients | `"127.0.0.1:4180"` |
120+| `--https-address` | string | `<addr>:<port>` to listen on for HTTPS clients | `":443"` |
121+| `--logging-compress` | bool | Should rotated log files be compressed using gzip | false |
122+| `--logging-filename` | string | File to log requests to, empty for `stdout` | `""` (stdout) |
123+| `--logging-local-time` | bool | Use local time in log files and backup filenames instead of UTC | true (local time) |
124+| `--logging-max-age` | int | Maximum number of days to retain old log files | 7 |
125+| `--logging-max-backups` | int | Maximum number of old log files to retain; 0 to disable | 0 |
126+| `--logging-max-size` | int | Maximum size in megabytes of the log file before rotation | 100 |
127+| `--jwt-key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |
128+| `--jwt-key-file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |
129+| `--login-url` | string | Authentication endpoint | |
130+| `--insecure-oidc-allow-unverified-email` | bool | don't fail if an email address in an id_token is not verified | false |
131+| `--insecure-oidc-skip-issuer-verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
132+| `--oidc-issuer-url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
133+| `--oidc-jwks-url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled | |
134+| `--oidc-email-claim` | string | which OIDC claim contains the user's email | `"email"` |
135+| `--oidc-groups-claim` | string | which OIDC claim contains the user groups | `"groups"` |
136+| `--pass-access-token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
137+| `--pass-authorization-header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
138+| `--pass-basic-auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
139+| `--prefer-email-to-user` | bool | Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with `--pass-basic-auth` and `--pass-user-headers` | false |
140+| `--pass-host-header` | bool | pass the request Host Header to upstream | true |
141+| `--pass-user-headers` | bool | pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
142+| `--profile-url` | string | Profile access endpoint | |
143+| `--prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
144+| `--provider` | string | OAuth provider | google |
145+| `--provider-ca-file` | string \| list | Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead. |
146+| `--provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
147+| `--ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
148+| `--ping-user-agent` | string | a User-Agent that can be used for basic health checks | `""` (don't check user agent) |
149+| `--proxy-prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
150+| `--proxy-websockets` | bool | enables WebSocket proxying | true |
151+| `--pubjwk-url` | string | JWK pubkey access endpoint: required by login.gov | |
152+| `--real-client-ip-header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
153+| `--redeem-url` | string | Token redemption endpoint | |
154+| `--redirect-url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
155+| `--redis-cluster-connection-urls` | string \| list | List of Redis cluster connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-cluster` | |
156+| `--redis-connection-url` | string | URL of redis server for redis session storage (e.g. `redis://HOST[:PORT]`) | |
157+| `--redis-password` | string | Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url` | |
158+| `--redis-sentinel-password` | string | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password` | |
159+| `--redis-sentinel-master-name` | string | Redis sentinel master name. Used in conjunction with `--redis-use-sentinel` | |
160+| `--redis-sentinel-connection-urls` | string \| list | List of Redis sentinel connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-sentinel` | |
161+| `--redis-use-cluster` | bool | Connect to redis cluster. Must set `--redis-cluster-connection-urls` to use this feature | false |
162+| `--redis-use-sentinel` | bool | Connect to redis via sentinels. Must set `--redis-sentinel-master-name` and `--redis-sentinel-connection-urls` to use this feature | false |
163+| `--request-logging` | bool | Log requests | true |
164+| `--request-logging-format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
165+| `--resource` | string | The resource that is protected (Azure AD only) | |
166+| `--reverse-proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-\{Proto,Host,Uri\} headers to be used on redirect selection | false |
167+| `--scope` | string | OAuth scope specification | |
168+| `--session-cookie-minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
169+| `--session-store-type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
170+| `--set-xauthrequest` | bool | set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with `--pass-access-token`, X-Auth-Request-Access-Token is added to response headers. | false |
171+| `--set-authorization-header` | bool | set Authorization Bearer response header (useful in Nginx auth_request mode) | false |
172+| `--set-basic-auth` | bool | set HTTP Basic Auth information in response (useful in Nginx auth_request mode) | false |
173+| `--signature-key` | string | GAP-Signature request signature key (algorithm:secretkey) | |
174+| `--silence-ping-logging` | bool | disable logging of requests to ping endpoint | false |
175+| `--skip-auth-preflight` | bool | will skip authentication for OPTIONS requests | false |
176+| `--skip-auth-regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times) | |
177+| `--skip-auth-route` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods | |
178+| `--skip-auth-strip-headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy | true |
179+| `--skip-jwt-bearer-tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
180+| `--skip-oidc-discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
181+| `--skip-provider-button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
182+| `--ssl-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS providers | false |
183+| `--ssl-upstream-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS upstreams | false |
184+| `--standard-logging` | bool | Log standard runtime information | true |
185+| `--standard-logging-format` | string | Template for standard log lines | see [Logging Configuration](#logging-configuration) |
186+| `--tls-cert-file` | string | path to certificate file | |
187+| `--tls-key-file` | string | path to private key file | |
188+| `--upstream` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
189+| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
190+| `--validate-url` | string | Access token validation endpoint | |
191+| `--version` | n/a | print version string | |
192+| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` to allow subdomains (e.g. `.example.com`)&nbsp;[^2] | |
193+| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
194+
195+[^1]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
196+
197+[^2]: When using the `whitelist-domain` option, any domain prefixed with a `.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
198+
199+See below for provider specific options
200+
201+### Upstreams Configuration
202+
203+`oauth2-proxy` supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as `http://127.0.0.1:8080/` for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide `http://127.0.0.1:8080/some/path/` then it will only be requests that start with `/some/path/` which are forwarded to the upstream.
204+
205+Static file paths are configured as a file:// URL. `file:///var/www/static/` will serve the files from that directory at `http://[oauth2-proxy url]/var/www/static/`, which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. `file:///var/www/static/#/static/` will make `/var/www/static/` available at `http://[oauth2-proxy url]/static/`.
206+
207+Multiple upstreams can either be configured by supplying a comma separated list to the `--upstream` parameter, supplying the parameter multiple times or providing a list in the [config file](#config-file). When multiple upstreams are used routing to them will be based on the path they are set up with.
208+
209+### Environment variables
210+
211+Every command line argument can be specified as an environment variable by
212+prefixing it with `OAUTH2_PROXY_`, capitalising it, and replacing hyphens (`-`)
213+with underscores (`_`). If the argument can be specified multiple times, the
214+environment variable should be plural (trailing `S`).
215+
216+This is particularly useful for storing secrets outside of a configuration file
217+or the command line.
218+
219+For example, the `--cookie-secret` flag becomes `OAUTH2_PROXY_COOKIE_SECRET`,
220+and the `--email-domain` flag becomes `OAUTH2_PROXY_EMAIL_DOMAINS`.
221+
222+## Logging Configuration
223+
224+By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the `--logging-filename` command.
225+
226+If logging to a file you can also configure the maximum file size (`--logging-max-size`), age (`--logging-max-age`), max backup logs (`--logging-max-backups`), and if backup logs should be compressed (`--logging-compress`).
227+
228+There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with `--standard-logging`, `--auth-logging`, and `--request-logging`.
229+
230+Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log.
231+
232+Logging of requests to the `/ping` endpoint (or using `--ping-user-agent`) can be disabled with `--silence-ping-logging` reducing log volume. This flag appends the `--ping-path` to `--exclude-logging-paths`.
233+
234+### Auth Log Format
235+Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:
236+
237+```
238+<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] [<STATUS>] <MESSAGE>
239+```
240+
241+The status block will contain one of the below strings:
242+
243+- `AuthSuccess` If a user has authenticated successfully by any method
244+- `AuthFailure` If the user failed to authenticate explicitly
245+- `AuthError` If there was an unexpected error during authentication
246+
247+If you require a different format than that, you can configure it with the `--auth-logging-format` flag.
248+The default format is configured as follows:
249+
250+```
251+{{.Client}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}
252+```
253+
254+Available variables for auth logging:
255+
256+| Variable | Example | Description |
257+| --- | --- | --- |
258+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
259+| Host | domain.com | The value of the Host header. |
260+| Protocol | HTTP/1.0 | The request protocol. |
261+| RequestMethod | GET | The request method. |
262+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
263+| UserAgent | - | The full user agent as reported by the requesting client. |
264+| Username | username@email.com | The email or username of the auth request. |
265+| Status | AuthSuccess | The status of the auth request. See above for details. |
266+| Message | Authenticated via OAuth2 | The details of the auth attempt. |
267+
268+### Request Log Format
269+HTTP request logs will output by default in the below format:
270+
271+```
272+<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] <HOST_HEADER> GET <UPSTREAM_HOST> "/path/" HTTP/1.1 "<USER_AGENT>" <RESPONSE_CODE> <RESPONSE_BYTES> <REQUEST_DURATION>
273+```
274+
275+If you require a different format than that, you can configure it with the `--request-logging-format` flag.
276+The default format is configured as follows:
277+
278+```
279+{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}
280+```
281+
282+Available variables for request logging:
283+
284+| Variable | Example | Description |
285+| --- | --- | --- |
286+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
287+| Host | domain.com | The value of the Host header. |
288+| Protocol | HTTP/1.0 | The request protocol. |
289+| RequestDuration | 0.001 | The time in seconds that a request took to process. |
290+| RequestMethod | GET | The request method. |
291+| RequestURI | "/oauth2/auth" | The URI path of the request. |
292+| ResponseSize | 12 | The size in bytes of the response. |
293+| StatusCode | 200 | The HTTP status code of the response. |
294+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
295+| Upstream | - | The upstream data of the HTTP request. |
296+| UserAgent | - | The full user agent as reported by the requesting client. |
297+| Username | username@email.com | The email or username of the auth request. |
298+
299+### Standard Log Format
300+All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:
301+
302+```
303+[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE>
304+```
305+
306+If you require a different format than that, you can configure it with the `--standard-logging-format` flag. The default format is configured as follows:
307+
308+```
309+[{{.Timestamp}}] [{{.File}}] {{.Message}}
310+```
311+
312+Available variables for standard logging:
313+
314+| Variable | Example | Description |
315+| --- | --- | --- |
316+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
317+| File | main.go:40 | The file and line number of the logging statement. |
318+| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
319+
320+## Configuring for use with the Nginx `auth_request` directive
321+
322+The [Nginx `auth_request` directive](http://nginx.org/en/docs/http/ngx_http_auth_request_module.html) allows Nginx to authenticate requests via the oauth2-proxy's `/auth` endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:
323+
324+```nginx
325+server {
326+ listen 443 ssl;
327+ server_name ...;
328+ include ssl/ssl.conf;
329+
330+ location /oauth2/ {
331+ proxy_pass http://127.0.0.1:4180;
332+ proxy_set_header Host $host;
333+ proxy_set_header X-Real-IP $remote_addr;
334+ proxy_set_header X-Scheme $scheme;
335+ proxy_set_header X-Auth-Request-Redirect $request_uri;
336+ # or, if you are handling multiple domains:
337+ # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
338+ }
339+ location = /oauth2/auth {
340+ proxy_pass http://127.0.0.1:4180;
341+ proxy_set_header Host $host;
342+ proxy_set_header X-Real-IP $remote_addr;
343+ proxy_set_header X-Scheme $scheme;
344+ # nginx auth_request includes headers but not body
345+ proxy_set_header Content-Length "";
346+ proxy_pass_request_body off;
347+ }
348+
349+ location / {
350+ auth_request /oauth2/auth;
351+ error_page 401 = /oauth2/sign_in;
352+
353+ # pass information via X-User and X-Email headers to backend,
354+ # requires running with --set-xauthrequest flag
355+ auth_request_set $user $upstream_http_x_auth_request_user;
356+ auth_request_set $email $upstream_http_x_auth_request_email;
357+ proxy_set_header X-User $user;
358+ proxy_set_header X-Email $email;
359+
360+ # if you enabled --pass-access-token, this will pass the token to the backend
361+ auth_request_set $token $upstream_http_x_auth_request_access_token;
362+ proxy_set_header X-Access-Token $token;
363+
364+ # if you enabled --cookie-refresh, this is needed for it to work with auth_request
365+ auth_request_set $auth_cookie $upstream_http_set_cookie;
366+ add_header Set-Cookie $auth_cookie;
367+
368+ # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
369+ # limit and so the OAuth2 Proxy splits these into multiple parts.
370+ # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
371+ # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
372+ auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;
373+
374+ # Extract the Cookie attributes from the first Set-Cookie header and append them
375+ # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
376+ if ($auth_cookie ~* "(; .*)") {
377+ set $auth_cookie_name_0 $auth_cookie;
378+ set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
379+ }
380+
381+ # Send both Set-Cookie headers now if there was a second part
382+ if ($auth_cookie_name_upstream_1) {
383+ add_header Set-Cookie $auth_cookie_name_0;
384+ add_header Set-Cookie $auth_cookie_name_1;
385+ }
386+
387+ proxy_pass http://backend/;
388+ # or "root /path/to/site;" or "fastcgi_pass ..." etc
389+ }
390+}
391+```
392+
393+When you use ingress-nginx in Kubernetes, you MUST use `kubernetes/ingress-nginx` (which includes the Lua module) and the following configuration snippet for your `Ingress`.
394+Variables set with `auth_request_set` are not `set`-able in plain nginx config when the location is processed via `proxy_pass` and then may only be processed by Lua.
395+Note that `nginxinc/kubernetes-ingress` does not include the Lua module.
396+
397+```yaml
398+nginx.ingress.kubernetes.io/auth-response-headers: Authorization
399+nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
400+nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
401+nginx.ingress.kubernetes.io/configuration-snippet: |
402+ auth_request_set $name_upstream_1 $upstream_cookie_name_1;
403+
404+ access_by_lua_block {
405+ if ngx.var.name_upstream_1 ~= "" then
406+ ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")
407+ end
408+ }
409+```
410+It is recommended to use `--session-store-type=redis` when expecting large sessions/OIDC tokens (_e.g._ with MS Azure).
411+
412+You have to substitute *name* with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".
413+
414+## Configuring for use with the Traefik (v2) `ForwardAuth` middleware
415+
416+**This option requires `--reverse-proxy` option to be set.**
417+
418+### ForwardAuth with 401 errors middleware
419+
420+The [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/http/forwardauth/) allows Traefik to authenticate requests via the oauth2-proxy's `/oauth2/auth` endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:
421+
422+```yaml
423+http:
424+ routers:
425+ a-service:
426+ rule: "Host(`a-service.example.com`)"
427+ service: a-service-backend
428+ middlewares:
429+ - oauth-errors
430+ - oauth-auth
431+ tls:
432+ certResolver: default
433+ domains:
434+ - main: "example.com"
435+ sans:
436+ - "*.example.com"
437+ oauth:
438+ rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"
439+ middlewares:
440+ - auth-headers
441+ service: oauth-backend
442+ tls:
443+ certResolver: default
444+ domains:
445+ - main: "example.com"
446+ sans:
447+ - "*.example.com"
448+
449+ services:
450+ a-service-backend:
451+ loadBalancer:
452+ servers:
453+ - url: http://172.16.0.2:7555
454+ oauth-backend:
455+ loadBalancer:
456+ servers:
457+ - url: http://172.16.0.1:4180
458+
459+ middlewares:
460+ auth-headers:
461+ headers:
462+ sslRedirect: true
463+ stsSeconds: 315360000
464+ browserXssFilter: true
465+ contentTypeNosniff: true
466+ forceSTSHeader: true
467+ sslHost: example.com
468+ stsIncludeSubdomains: true
469+ stsPreload: true
470+ frameDeny: true
471+ oauth-auth:
472+ forwardAuth:
473+ address: https://oauth.example.com/oauth2/auth
474+ trustForwardHeader: true
475+ oauth-errors:
476+ errors:
477+ status:
478+ - "401-403"
479+ service: oauth-backend
480+ query: "/oauth2/sign_in"
481+```
482+
483+### ForwardAuth with static upstreams configuration
484+
485+Redirect to sign_in functionality provided without the use of `errors` middleware with [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/http/forwardauth/) pointing to oauth2-proxy service's `/` endpoint
486+
487+**Following options need to be set on `oauth2-proxy`:**
488+- `--upstream=static://202`: Configures a static response for authenticated sessions
489+- `--reverseproxy=true`: Enables the use of `X-Forwarded-*` headers to determine redirects correctly
490+
491+```yaml
492+http:
493+ routers:
494+ a-service-route-1:
495+ rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"
496+ service: a-service-backend
497+ middlewares:
498+ - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin
499+ tls:
500+ certResolver: default
501+ domains:
502+ - main: "example.com"
503+ sans:
504+ - "*.example.com"
505+ a-service-route-2:
506+ rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"
507+ service: a-service-backend
508+ middlewares:
509+ - oauth-auth-wo-redirect # unauthenticated session will return a 401
510+ tls:
511+ certResolver: default
512+ domains:
513+ - main: "example.com"
514+ sans:
515+ - "*.example.com"
516+ services-oauth2-route:
517+ rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"
518+ middlewares:
519+ - auth-headers
520+ service: oauth-backend
521+ tls:
522+ certResolver: default
523+ domains:
524+ - main: "example.com"
525+ sans:
526+ - "*.example.com"
527+ oauth2-proxy-route:
528+ rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"
529+ middlewares:
530+ - auth-headers
531+ service: oauth-backend
532+ tls:
533+ certResolver: default
534+ domains:
535+ - main: "example.com"
536+ sans:
537+ - "*.example.com"
538+
539+ services:
540+ a-service-backend:
541+ loadBalancer:
542+ servers:
543+ - url: http://172.16.0.2:7555
544+ b-service-backend:
545+ loadBalancer:
546+ servers:
547+ - url: http://172.16.0.3:7555
548+ oauth-backend:
549+ loadBalancer:
550+ servers:
551+ - url: http://172.16.0.1:4180
552+
553+ middlewares:
554+ auth-headers:
555+ headers:
556+ sslRedirect: true
557+ stsSeconds: 315360000
558+ browserXssFilter: true
559+ contentTypeNosniff: true
560+ forceSTSHeader: true
561+ sslHost: example.com
562+ stsIncludeSubdomains: true
563+ stsPreload: true
564+ frameDeny: true
565+ oauth-auth-redirect:
566+ forwardAuth:
567+ address: https://oauth.example.com/
568+ trustForwardHeader: true
569+ authResponseHeaders:
570+ - X-Auth-Request-Access-Token
571+ - Authorization
572+ oauth-auth-wo-redirect:
573+ forwardAuth:
574+ address: https://oauth.example.com/oauth2/auth
575+ trustForwardHeader: true
576+ authResponseHeaders:
577+ - X-Auth-Request-Access-Token
578+ - Authorization
579+```
580+
581+:::note
582+If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.
583+:::
docs/versioned_docs/version-7.0.x/configuration/sessions.mdnew file+67
@@ -0,0 +1,67 @@
1+---
2+id: session_storage
3+title: Session Storage
4+---
5+
6+Sessions allow a user's authentication to be tracked between multiple HTTP
7+requests to a service.
8+
9+The OAuth2 Proxy uses a Cookie to track user sessions and will store the session
10+data in one of the available session storage backends.
11+
12+At present the available backends are (as passed to `--session-store-type`):
13+- [cookie](#cookie-storage) (default)
14+- [redis](#redis-storage)
15+
16+### Cookie Storage
17+
18+The Cookie storage backend is the default backend implementation and has
19+been used in the OAuth2 Proxy historically.
20+
21+With the Cookie storage backend, all session information is stored in client
22+side cookies and transferred with each and every request.
23+
24+The following should be known when using this implementation:
25+- Since all state is stored client side, this storage backend means that the OAuth2 Proxy is completely stateless
26+- Cookies are signed server side to prevent modification client-side
27+- It is mandatory to set a `cookie-secret` which will ensure data is encrypted within the cookie data.
28+- Since multiple requests can be made concurrently to the OAuth2 Proxy, this session implementation
29+cannot lock sessions and while updating and refreshing sessions, there can be conflicts which force
30+users to re-authenticate
31+
32+
33+### Redis Storage
34+
35+The Redis Storage backend stores sessions, encrypted, in redis. Instead sending all the information
36+back the client for storage, as in the [Cookie storage](#cookie-storage), a ticket is sent back
37+to the user as the cookie value instead.
38+
39+A ticket is composed as the following:
40+
41+`{CookieName}-{ticketID}.{secret}`
42+
43+Where:
44+
45+- The `CookieName` is the OAuth2 cookie name (_oauth2_proxy by default)
46+- The `ticketID` is a 128 bit random number, hex-encoded
47+- The `secret` is a 128 bit random number, base64url encoded (no padding). The secret is unique for every session.
48+- The pair of `{CookieName}-{ticketID}` comprises a ticket handle, and thus, the redis key
49+to which the session is stored. The encoded session is encrypted with the secret and stored
50+in redis via the `SETEX` command.
51+
52+Encrypting every session uniquely protects the refresh/access/id tokens stored in the session from
53+disclosure.
54+
55+#### Usage
56+
57+When using the redis store, specify `--session-store-type=redis` as well as the Redis connection URL, via
58+`--redis-connection-url=redis://host[:port][/db-number]`.
59+
60+You may also configure the store for Redis Sentinel. In this case, you will want to use the
61+`--redis-use-sentinel=true` flag, as well as configure the flags `--redis-sentinel-master-name`
62+and `--redis-sentinel-connection-urls` appropriately.
63+
64+Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the
65+`--redis-use-cluster=true` flag, and configure the flags `--redis-cluster-connection-urls` appropriately.
66+
67+Note that flags `--redis-use-sentinel=true` and `--redis-use-cluster=true` are mutually exclusive.
docs/versioned_docs/version-7.0.x/configuration/tls.mdnew file+70
@@ -0,0 +1,70 @@
1+---
2+id: tls
3+title: TLS Configuration
4+---
5+
6+There are two recommended configurations.
7+
8+1. Configure SSL Termination with OAuth2 Proxy by providing a `--tls-cert-file=/path/to/cert.pem` and `--tls-key-file=/path/to/cert.key`.
9+
10+ The command line to run `oauth2-proxy` in this configuration would look like this:
11+
12+ ```bash
13+ ./oauth2-proxy \
14+ --email-domain="yourcompany.com" \
15+ --upstream=http://127.0.0.1:8080/ \
16+ --tls-cert-file=/path/to/cert.pem \
17+ --tls-key-file=/path/to/cert.key \
18+ --cookie-secret=... \
19+ --cookie-secure=true \
20+ --provider=... \
21+ --client-id=... \
22+ --client-secret=...
23+ ```
24+
25+2. Configure SSL Termination with [Nginx](http://nginx.org/) (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ....
26+
27+ Because `oauth2-proxy` listens on `127.0.0.1:4180` by default, to listen on all interfaces (needed when using an
28+ external load balancer like Amazon ELB or Google Platform Load Balancing) use `--http-address="0.0.0.0:4180"` or
29+ `--http-address="http://:4180"`.
30+
31+ Nginx will listen on port `443` and handle SSL connections while proxying to `oauth2-proxy` on port `4180`.
32+ `oauth2-proxy` will then authenticate requests for an upstream application. The external endpoint for this example
33+ would be `https://internal.yourcompany.com/`.
34+
35+ An example Nginx config follows. Note the use of `Strict-Transport-Security` header to pin requests to SSL
36+ via [HSTS](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security):
37+
38+ ```
39+ server {
40+ listen 443 default ssl;
41+ server_name internal.yourcompany.com;
42+ ssl_certificate /path/to/cert.pem;
43+ ssl_certificate_key /path/to/cert.key;
44+ add_header Strict-Transport-Security max-age=2592000;
45+
46+ location / {
47+ proxy_pass http://127.0.0.1:4180;
48+ proxy_set_header Host $host;
49+ proxy_set_header X-Real-IP $remote_addr;
50+ proxy_set_header X-Scheme $scheme;
51+ proxy_connect_timeout 1;
52+ proxy_send_timeout 30;
53+ proxy_read_timeout 30;
54+ }
55+ }
56+ ```
57+
58+ The command line to run `oauth2-proxy` in this configuration would look like this:
59+
60+ ```bash
61+ ./oauth2-proxy \
62+ --email-domain="yourcompany.com" \
63+ --upstream=http://127.0.0.1:8080/ \
64+ --cookie-secret=... \
65+ --cookie-secure=true \
66+ --provider=... \
67+ --reverse-proxy=true \
68+ --client-id=... \
69+ --client-secret=...
70+ ```
docs/versioned_docs/version-7.0.x/features/endpoints.mdnew file+35
@@ -0,0 +1,35 @@
1+---
2+id: endpoints
3+title: Endpoints
4+---
5+
6+OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The `/oauth2` prefix can be changed with the `--proxy-prefix` config variable.
7+
8+- /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see [robotstxt.org](http://www.robotstxt.org/) for more info
9+- /ping - returns a 200 OK response, which is intended for use with health checks
10+- /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
11+- /oauth2/sign_out - this URL is used to clear the session cookie
12+- /oauth2/start - a URL that will redirect to start the OAuth cycle
13+- /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
14+- /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
15+- /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the [Nginx `auth_request` directive](../configuration/overview.md#configuring-for-use-with-the-nginx-auth_request-directive)
16+
17+### Sign out
18+
19+To sign the user out, redirect them to `/oauth2/sign_out`. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the `rd` query parameter, i.e. redirect the user to something like (notice the url-encoding!):
20+
21+```
22+/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page
23+```
24+
25+Alternatively, include the redirect URL in the `X-Auth-Request-Redirect` header:
26+
27+```
28+GET /oauth2/sign_out HTTP/1.1
29+X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
30+...
31+```
32+
33+(The "sign_out_page" should be the [`end_session_endpoint`](https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1) from [the metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig) if your OIDC provider supports Session Management and Discovery.)
34+
35+BEWARE that the domain you want to redirect to (`my-oidc-provider.example.com` in the example) must be added to the [`--whitelist-domain`](../configuration/overview) configuration option otherwise the redirect will be ignored.
docs/versioned_docs/version-7.0.x/features/request_signatures.mdnew file+20
@@ -0,0 +1,20 @@
1+---
2+id: request_signatures
3+title: Request Signatures
4+---
5+
6+If `signature_key` is defined, proxied requests will be signed with the
7+`GAP-Signature` header, which is a [Hash-based Message Authentication Code
8+(HMAC)](https://en.wikipedia.org/wiki/Hash-based_message_authentication_code)
9+of selected request information and the request body [see `SIGNATURE_HEADERS`
10+in `oauthproxy.go`](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/oauthproxy.go).
11+
12+`signature_key` must be of the form `algorithm:secretkey`, (ie: `signature_key = "sha1:secret0"`)
13+
14+For more information about HMAC request signature validation, read the
15+following:
16+
17+- [Amazon Web Services: Signing and Authenticating REST
18+ Requests](https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html)
19+- [rc3.org: Using HMAC to authenticate Web service
20+ requests](http://rc3.org/2011/12/02/using-hmac-to-authenticate-web-service-requests/)
docs/versioned_docs/version-7.0.x/installation.mdnew file+24
@@ -0,0 +1,24 @@
1+---
2+id: installation
3+title: Installation
4+slug: /
5+---
6+
7+1. Choose how to deploy:
8+
9+ a. Download [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.0.1`)
10+
11+ b. Build with `$ go get github.com/oauth2-proxy/oauth2-proxy/v7` which will put the binary in `$GOPATH/bin`
12+
13+ c. Using the prebuilt docker image [quay.io/oauth2-proxy/oauth2-proxy](https://quay.io/oauth2-proxy/oauth2-proxy) (AMD64, ARMv6 and ARM64 tags available)
14+
15+Prebuilt binaries can be validated by extracting the file and verifying it against the `sha256sum.txt` checksum file provided for each release starting with version `v3.0.0`.
16+
17+```
18+$ sha256sum -c sha256sum.txt 2>&1 | grep OK
19+oauth2-proxy-x.y.z.linux-amd64: OK
20+```
21+
22+2. [Select a Provider and Register an OAuth Application with a Provider](configuration/auth.md)
23+3. [Configure OAuth2 Proxy using config file, command line options, or environment variables](configuration/overview.md)
24+4. [Configure SSL or Deploy behind a SSL endpoint](configuration/tls.md) (example provided for Nginx)
docs/versioned_docs/version-7.1.x/behaviour.mdnew file+11
@@ -0,0 +1,11 @@
1+---
2+id: behaviour
3+title: Behaviour
4+---
5+
6+1. Any request passing through the proxy (and not matched by `--skip-auth-route`) is checked for the proxy's session cookie (`--cookie-name`) (or, if allowed, a JWT token - see `--skip-jwt-bearer-tokens`).
7+2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with `Accept: application/json`, in which case 401 Unauthorized is returned)
8+3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
9+4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)
10+
11+Notice that the proxy also provides a number of useful [endpoints](features/endpoints.md).
docs/versioned_docs/version-7.1.x/community/security.mdnew file+49
@@ -0,0 +1,49 @@
1+---
2+id: security
3+title: Security
4+---
5+
6+:::note
7+OAuth2 Proxy is a community project.
8+Maintainers do not work on this project full time, and as such,
9+while we endeavour to respond to disclosures as quickly as possible,
10+this may take longer than in projects with corporate sponsorship.
11+:::
12+
13+## Security Disclosures
14+
15+:::important
16+If you believe you have found a vulnerability within OAuth2 Proxy or any of its
17+dependencies, please do NOT open an issue or PR on GitHub, please do NOT post
18+any details publicly.
19+:::
20+
21+Security disclosures MUST be done in private.
22+If you have found an issue that you would like to bring to the attention of the
23+maintenance team for OAuth2 Proxy, please compose an email and send it to the
24+list of maintainers in our [MAINTAINERS](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/MAINTAINERS) file.
25+
26+Please include as much detail as possible.
27+Ideally, your disclosure should include:
28+- A reproducible case that can be used to demonstrate the exploit
29+- How you discovered this vulnerability
30+- A potential fix for the issue (if you have thought of one)
31+- Versions affected (if not present in master)
32+- Your GitHub ID
33+
34+### How will we respond to disclosures?
35+
36+We use [GitHub Security Advisories](https://docs.github.com/en/github/managing-security-vulnerabilities/about-github-security-advisories)
37+to privately discuss fixes for disclosed vulnerabilities.
38+If you include a GitHub ID with your disclosure we will add you as a collaborator
39+for the advisory so that you can join the discussion and validate any fixes
40+we may propose.
41+
42+For minor issues and previously disclosed vulnerabilities (typically for
43+dependencies), we may use regular PRs for fixes and forego the security advisory.
44+
45+Once a fix has been agreed upon, we will merge the fix and create a new release.
46+If we have multiple security issues in flight simultaneously, we may delay
47+merging fixes until all patches are ready.
48+We may also backport the fix to previous releases,
49+but this will be at the discretion of the maintainers.
docs/versioned_docs/version-7.1.x/configuration/alpha_config.mdnew file+237
@@ -0,0 +1,237 @@
1+---
2+id: alpha-config
3+title: Alpha Configuration
4+---
5+
6+:::warning
7+This page contains documentation for alpha features.
8+We reserve the right to make breaking changes to the features detailed within this page with no notice.
9+
10+Options described in this page may be changed, removed, renamed or moved without prior warning.
11+Please beware of this before you use alpha configuration options.
12+:::
13+
14+This page details a set of **alpha** configuration options in a new format.
15+Going forward we are intending to add structured configuration in YAML format to
16+replace the existing TOML based configuration file and flags.
17+
18+Below is a reference for the structure of the configuration, with
19+[AlphaOptions](#alphaoptions) as the root of the configuration.
20+
21+When using alpha configuration, your config file will look something like below:
22+
23+```yaml
24+upstreams:
25+ - id: ...
26+ ...
27+injectRequestHeaders:
28+ - name: ...
29+ ...
30+injectResponseHeaders:
31+ - name: ...
32+ ...
33+```
34+
35+Please browse the [reference](#configuration-reference) below for the structure
36+of the new configuration format.
37+
38+## Using Alpha Configuration
39+
40+To use the new **alpha** configuration, generate a YAML file based on the format
41+described in the [reference](#configuration-reference) below.
42+
43+Provide the path to this file using the `--alpha-config` flag.
44+
45+:::note
46+When using the `--alpha-config` flag, some options are no longer available.
47+See [removed options](#removed-options) below for more information.
48+:::
49+
50+### Converting configuration to the new structure
51+
52+Before adding the new `--alpha-config` option, start OAuth2 Proxy using the
53+`convert-config-to-alpha` flag to convert existing configuration to the new format.
54+
55+```bash
56+oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg
57+```
58+
59+This will convert any options supported by the new format to YAML and print the
60+new configuration to `STDOUT`.
61+
62+Copy this to a new file, remove any options from your existing configuration
63+noted in [removed options](#removed-options) and then start OAuth2 Proxy using
64+the new config.
65+
66+```bash
67+oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg
68+```
69+
70+## Removed options
71+
72+The following flags/options and their respective environment variables are no
73+longer available when using alpha configuration:
74+
75+<!-- Legacy Upstream FlagSet -->
76+- `flush-interval`/`flush_interval`
77+- `pass-host-header`/`pass_host_header`
78+- `proxy-websockets`/`proxy_websockets`
79+- `ssl-upstream-insecure-skip-verify`/`ssl_upstream_insecure_skip_verify`
80+- `upstream`/`upstreams`
81+
82+<!-- Legacy Headers FlagSet -->
83+- `pass-basic-auth`/`pass_basic_auth`
84+- `pass-access-token`/`pass_access_token`
85+- `pass-user-headers`/`pass_user_headers`
86+- `pass-authorization-header`/`pass_authorization_header`
87+- `set-basic-auth`/`set_basic_auth`
88+- `set-xauthrequest`/`set_xauthrequest`
89+- `set-authorization-header`/`set_authorization_header`
90+- `prefer-email-to-user`/`prefer_email_to_user`
91+- `basic-auth-password`/`basic_auth_password`
92+- `skip-auth-strip-headers`/`skip_auth_strip_headers`
93+
94+Attempting to use these options via flags or via config when `--alpha-config`
95+set will result in an error.
96+
97+:::important
98+You must remove these options before starting OAuth2 Proxy with `--alpha-config`
99+:::
100+
101+## Configuration Reference
102+<!--- THIS FILE IS AUTOGENERATED!!! DO NOT EDIT!!! -->
103+
104+### AlphaOptions
105+
106+AlphaOptions contains alpha structured configuration options.
107+Usage of these options allows users to access alpha features that are not
108+available as part of the primary configuration structure for OAuth2 Proxy.
109+
110+:::warning
111+The options within this structure are considered alpha.
112+They may change between releases without notice.
113+:::
114+
115+| Field | Type | Description |
116+| ----- | ---- | ----------- |
117+| `upstreams` | _[Upstreams](#upstreams)_ | Upstreams is used to configure upstream servers.<br/>Once a user is authenticated, requests to the server will be proxied to<br/>these upstream servers based on the path mappings defined in this list. |
118+| `injectRequestHeaders` | _[[]Header](#header)_ | InjectRequestHeaders is used to configure headers that should be added<br/>to requests to upstream servers.<br/>Headers may source values from either the authenticated user's session<br/>or from a static secret value. |
119+| `injectResponseHeaders` | _[[]Header](#header)_ | InjectResponseHeaders is used to configure headers that should be added<br/>to responses from the proxy.<br/>This is typically used when using the proxy as an external authentication<br/>provider in conjunction with another proxy such as NGINX and its<br/>auth_request module.<br/>Headers may source values from either the authenticated user's session<br/>or from a static secret value. |
120+| `server` | _[Server](#server)_ | Server is used to configure the HTTP(S) server for the proxy application.<br/>You may choose to run both HTTP and HTTPS servers simultaneously.<br/>This can be done by setting the BindAddress and the SecureBindAddress simultaneously.<br/>To use the secure server you must configure a TLS certificate and key. |
121+| `metricsServer` | _[Server](#server)_ | MetricsServer is used to configure the HTTP(S) server for metrics.<br/>You may choose to run both HTTP and HTTPS servers simultaneously.<br/>This can be done by setting the BindAddress and the SecureBindAddress simultaneously.<br/>To use the secure server you must configure a TLS certificate and key. |
122+
123+### ClaimSource
124+
125+(**Appears on:** [HeaderValue](#headervalue))
126+
127+ClaimSource allows loading a header value from a claim within the session
128+
129+| Field | Type | Description |
130+| ----- | ---- | ----------- |
131+| `claim` | _string_ | Claim is the name of the claim in the session that the value should be<br/>loaded from. |
132+| `prefix` | _string_ | Prefix is an optional prefix that will be prepended to the value of the<br/>claim if it is non-empty. |
133+| `basicAuthPassword` | _[SecretSource](#secretsource)_ | BasicAuthPassword converts this claim into a basic auth header.<br/>Note the value of claim will become the basic auth username and the<br/>basicAuthPassword will be used as the password value. |
134+
135+### Duration
136+#### (`string` alias)
137+
138+(**Appears on:** [Upstream](#upstream))
139+
140+Duration is as string representation of a period of time.
141+A duration string is a is a possibly signed sequence of decimal numbers,
142+each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".
143+Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
144+
145+
146+### Header
147+
148+(**Appears on:** [AlphaOptions](#alphaoptions))
149+
150+Header represents an individual header that will be added to a request or
151+response header.
152+
153+| Field | Type | Description |
154+| ----- | ---- | ----------- |
155+| `name` | _string_ | Name is the header name to be used for this set of values.<br/>Names should be unique within a list of Headers. |
156+| `preserveRequestValue` | _bool_ | PreserveRequestValue determines whether any values for this header<br/>should be preserved for the request to the upstream server.<br/>This option only applies to injected request headers.<br/>Defaults to false (headers that match this header will be stripped). |
157+| `values` | _[[]HeaderValue](#headervalue)_ | Values contains the desired values for this header |
158+
159+### HeaderValue
160+
161+(**Appears on:** [Header](#header))
162+
163+HeaderValue represents a single header value and the sources that can
164+make up the header value
165+
166+| Field | Type | Description |
167+| ----- | ---- | ----------- |
168+| `value` | _[]byte_ | Value expects a base64 encoded string value. |
169+| `fromEnv` | _string_ | FromEnv expects the name of an environment variable. |
170+| `fromFile` | _string_ | FromFile expects a path to a file containing the secret value. |
171+| `claim` | _string_ | Claim is the name of the claim in the session that the value should be<br/>loaded from. |
172+| `prefix` | _string_ | Prefix is an optional prefix that will be prepended to the value of the<br/>claim if it is non-empty. |
173+| `basicAuthPassword` | _[SecretSource](#secretsource)_ | BasicAuthPassword converts this claim into a basic auth header.<br/>Note the value of claim will become the basic auth username and the<br/>basicAuthPassword will be used as the password value. |
174+
175+### SecretSource
176+
177+(**Appears on:** [ClaimSource](#claimsource), [HeaderValue](#headervalue), [TLS](#tls))
178+
179+SecretSource references an individual secret value.
180+Only one source within the struct should be defined at any time.
181+
182+| Field | Type | Description |
183+| ----- | ---- | ----------- |
184+| `value` | _[]byte_ | Value expects a base64 encoded string value. |
185+| `fromEnv` | _string_ | FromEnv expects the name of an environment variable. |
186+| `fromFile` | _string_ | FromFile expects a path to a file containing the secret value. |
187+
188+### Server
189+
190+(**Appears on:** [AlphaOptions](#alphaoptions))
191+
192+Server represents the configuration for an HTTP(S) server
193+
194+| Field | Type | Description |
195+| ----- | ---- | ----------- |
196+| `BindAddress` | _string_ | BindAddress is the address on which to serve traffic.<br/>Leave blank or set to "-" to disable. |
197+| `SecureBindAddress` | _string_ | SecureBindAddress is the address on which to serve secure traffic.<br/>Leave blank or set to "-" to disable. |
198+| `TLS` | _[TLS](#tls)_ | TLS contains the information for loading the certificate and key for the<br/>secure traffic. |
199+
200+### TLS
201+
202+(**Appears on:** [Server](#server))
203+
204+TLS contains the information for loading a TLS certifcate and key.
205+
206+| Field | Type | Description |
207+| ----- | ---- | ----------- |
208+| `Key` | _[SecretSource](#secretsource)_ | Key is the TLS key data to use.<br/>Typically this will come from a file. |
209+| `Cert` | _[SecretSource](#secretsource)_ | Cert is the TLS certificate data to use.<br/>Typically this will come from a file. |
210+
211+### Upstream
212+
213+(**Appears on:** [Upstreams](#upstreams))
214+
215+Upstream represents the configuration for an upstream server.
216+Requests will be proxied to this upstream if the path matches the request path.
217+
218+| Field | Type | Description |
219+| ----- | ---- | ----------- |
220+| `id` | _string_ | ID should be a unique identifier for the upstream.<br/>This value is required for all upstreams. |
221+| `path` | _string_ | Path is used to map requests to the upstream server.<br/>The closest match will take precedence and all Paths must be unique. |
222+| `uri` | _string_ | The URI of the upstream server. This may be an HTTP(S) server of a File<br/>based URL. It may include a path, in which case all requests will be served<br/>under that path.<br/>Eg:<br/>- http://localhost:8080<br/>- https://service.localhost<br/>- https://service.localhost/path<br/>- file://host/path<br/>If the URI's path is "/base" and the incoming request was for "/dir",<br/>the upstream request will be for "/base/dir". |
223+| `insecureSkipTLSVerify` | _bool_ | InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.<br/>This option is insecure and will allow potential Man-In-The-Middle attacks<br/>betweem OAuth2 Proxy and the usptream server.<br/>Defaults to false. |
224+| `static` | _bool_ | Static will make all requests to this upstream have a static response.<br/>The response will have a body of "Authenticated" and a response code<br/>matching StaticCode.<br/>If StaticCode is not set, the response will return a 200 response. |
225+| `staticCode` | _int_ | StaticCode determines the response code for the Static response.<br/>This option can only be used with Static enabled. |
226+| `flushInterval` | _[Duration](#duration)_ | FlushInterval is the period between flushing the response buffer when<br/>streaming response from the upstream.<br/>Defaults to 1 second. |
227+| `passHostHeader` | _bool_ | PassHostHeader determines whether the request host header should be proxied<br/>to the upstream server.<br/>Defaults to true. |
228+| `proxyWebSockets` | _bool_ | ProxyWebSockets enables proxying of websockets to upstream servers<br/>Defaults to true. |
229+
230+### Upstreams
231+
232+#### ([[]Upstream](#upstream) alias)
233+
234+(**Appears on:** [AlphaOptions](#alphaoptions))
235+
236+Upstreams is a collection of definitions for upstream servers.
237+
docs/versioned_docs/version-7.1.x/configuration/alpha_config.md.tmplnew file+101
@@ -0,0 +1,101 @@
1+---
2+id: alpha-config
3+title: Alpha Configuration
4+---
5+
6+:::warning
7+This page contains documentation for alpha features.
8+We reserve the right to make breaking changes to the features detailed within this page with no notice.
9+
10+Options described in this page may be changed, removed, renamed or moved without prior warning.
11+Please beware of this before you use alpha configuration options.
12+:::
13+
14+This page details a set of **alpha** configuration options in a new format.
15+Going forward we are intending to add structured configuration in YAML format to
16+replace the existing TOML based configuration file and flags.
17+
18+Below is a reference for the structure of the configuration, with
19+[AlphaOptions](#alphaoptions) as the root of the configuration.
20+
21+When using alpha configuration, your config file will look something like below:
22+
23+```yaml
24+upstreams:
25+ - id: ...
26+ ...
27+injectRequestHeaders:
28+ - name: ...
29+ ...
30+injectResponseHeaders:
31+ - name: ...
32+ ...
33+```
34+
35+Please browse the [reference](#configuration-reference) below for the structure
36+of the new configuration format.
37+
38+## Using Alpha Configuration
39+
40+To use the new **alpha** configuration, generate a YAML file based on the format
41+described in the [reference](#configuration-reference) below.
42+
43+Provide the path to this file using the `--alpha-config` flag.
44+
45+:::note
46+When using the `--alpha-config` flag, some options are no longer available.
47+See [removed options](#removed-options) below for more information.
48+:::
49+
50+### Converting configuration to the new structure
51+
52+Before adding the new `--alpha-config` option, start OAuth2 Proxy using the
53+`convert-config-to-alpha` flag to convert existing configuration to the new format.
54+
55+```bash
56+oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg
57+```
58+
59+This will convert any options supported by the new format to YAML and print the
60+new configuration to `STDOUT`.
61+
62+Copy this to a new file, remove any options from your existing configuration
63+noted in [removed options](#removed-options) and then start OAuth2 Proxy using
64+the new config.
65+
66+```bash
67+oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg
68+```
69+
70+## Removed options
71+
72+The following flags/options and their respective environment variables are no
73+longer available when using alpha configuration:
74+
75+<!-- Legacy Upstream FlagSet -->
76+- `flush-interval`/`flush_interval`
77+- `pass-host-header`/`pass_host_header`
78+- `proxy-websockets`/`proxy_websockets`
79+- `ssl-upstream-insecure-skip-verify`/`ssl_upstream_insecure_skip_verify`
80+- `upstream`/`upstreams`
81+
82+<!-- Legacy Headers FlagSet -->
83+- `pass-basic-auth`/`pass_basic_auth`
84+- `pass-access-token`/`pass_access_token`
85+- `pass-user-headers`/`pass_user_headers`
86+- `pass-authorization-header`/`pass_authorization_header`
87+- `set-basic-auth`/`set_basic_auth`
88+- `set-xauthrequest`/`set_xauthrequest`
89+- `set-authorization-header`/`set_authorization_header`
90+- `prefer-email-to-user`/`prefer_email_to_user`
91+- `basic-auth-password`/`basic_auth_password`
92+- `skip-auth-strip-headers`/`skip_auth_strip_headers`
93+
94+Attempting to use these options via flags or via config when `--alpha-config`
95+set will result in an error.
96+
97+:::important
98+You must remove these options before starting OAuth2 Proxy with `--alpha-config`
99+:::
100+
101+## Configuration Reference
docs/versioned_docs/version-7.1.x/configuration/auth.mdnew file+529
@@ -0,0 +1,529 @@
1+---
2+id: oauth_provider
3+title: OAuth Provider Configuration
4+---
5+
6+You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run `oauth2-proxy` on.
7+
8+Valid providers are :
9+
10+- [Google](#google-auth-provider) _default_
11+- [Azure](#azure-auth-provider)
12+- [Facebook](#facebook-auth-provider)
13+- [GitHub](#github-auth-provider)
14+- [Keycloak](#keycloak-auth-provider)
15+- [GitLab](#gitlab-auth-provider)
16+- [LinkedIn](#linkedin-auth-provider)
17+- [Microsoft Azure AD](#microsoft-azure-ad-provider)
18+- [OpenID Connect](#openid-connect-provider)
19+- [login.gov](#logingov-provider)
20+- [Nextcloud](#nextcloud-provider)
21+- [DigitalOcean](#digitalocean-auth-provider)
22+- [Bitbucket](#bitbucket-auth-provider)
23+- [Gitea](#gitea-auth-provider)
24+
25+The provider can be selected using the `provider` configuration value.
26+
27+Please note that not all providers support all claims. The `preferred_username` claim is currently only supported by the OpenID Connect provider.
28+
29+### Google Auth Provider
30+
31+For Google, the registration steps are:
32+
33+1. Create a new project: https://console.developers.google.com/project
34+2. Choose the new project from the top right project dropdown (only if another project is selected)
35+3. In the project Dashboard center pane, choose **"API Manager"**
36+4. In the left Nav pane, choose **"Credentials"**
37+5. In the center pane, choose **"OAuth consent screen"** tab. Fill in **"Product name shown to users"** and hit save.
38+6. In the center pane, choose **"Credentials"** tab.
39+ - Open the **"New credentials"** drop down
40+ - Choose **"OAuth client ID"**
41+ - Choose **"Web application"**
42+ - Application name is freeform, choose something appropriate
43+ - Authorized JavaScript origins is your domain ex: `https://internal.yourcompany.com`
44+ - Authorized redirect URIs is the location of oauth2/callback ex: `https://internal.yourcompany.com/oauth2/callback`
45+ - Choose **"Create"**
46+7. Take note of the **Client ID** and **Client Secret**
47+
48+It's recommended to refresh sessions on a short interval (1h) with `cookie-refresh` setting which validates that the account is still authorized.
49+
50+#### Restrict auth to specific Google groups on your domain. (optional)
51+
52+1. Create a service account: https://developers.google.com/identity/protocols/OAuth2ServiceAccount and make sure to download the json file.
53+2. Make note of the Client ID for a future step.
54+3. Under "APIs & Auth", choose APIs.
55+4. Click on Admin SDK and then Enable API.
56+5. Follow the steps on https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account and give the client id from step 2 the following oauth scopes:
57+
58+```
59+https://www.googleapis.com/auth/admin.directory.group.readonly
60+https://www.googleapis.com/auth/admin.directory.user.readonly
61+```
62+
63+6. Follow the steps on https://support.google.com/a/answer/60757 to enable Admin API access.
64+7. Create or choose an existing administrative email address on the Gmail domain to assign to the `google-admin-email` flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why.
65+8. Create or choose an existing email group and set that email to the `google-group` flag. You can pass multiple instances of this flag with different groups
66+ and the user will be checked against all the provided groups.
67+9. Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the `google-service-account-json` flag.
68+10. Restart oauth2-proxy.
69+
70+Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour ).
71+
72+### Azure Auth Provider
73+
74+1. Add an application: go to [https://portal.azure.com](https://portal.azure.com), choose **"Azure Active Directory"** in the left menu, select **"App registrations"** and then click on **"New app registration"**.
75+2. Pick a name and choose **"Webapp / API"** as application type. Use `https://internal.yourcompany.com` as Sign-on URL. Click **"Create"**.
76+3. On the **"Settings"** / **"Properties"** page of the app, pick a logo and select **"Multi-tenanted"** if you want to allow users from multiple organizations to access your app. Note down the application ID. Click **"Save"**.
77+4. On the **"Settings"** / **"Required Permissions"** page of the app, click on **"Windows Azure Active Directory"** and then on **"Access the directory as the signed in user"**. Hit **"Save"** and then then on **"Grant permissions"** (you might need another admin to do this).
78+5. On the **"Settings"** / **"Reply URLs"** page of the app, add `https://internal.yourcompanycom/oauth2/callback` for each host that you want to protect by the oauth2 proxy. Click **"Save"**.
79+6. On the **"Settings"** / **"Keys"** page of the app, add a new key and note down the value after hitting **"Save"**.
80+7. Configure the proxy with
81+
82+```
83+ --provider=azure
84+ --client-id=<application ID from step 3>
85+ --client-secret=<value from step 6>
86+ --oidc-issuer-url=https://sts.windows.net/{tenant-id}/
87+```
88+
89+Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the [redis session storage](sessions.md#redis-storage) should resolve this.
90+
91+### Facebook Auth Provider
92+
93+1. Create a new FB App from https://developers.facebook.com/
94+2. Under FB Login, set your Valid OAuth redirect URIs to `https://internal.yourcompany.com/oauth2/callback`
95+
96+### GitHub Auth Provider
97+
98+1. Create a new project: https://github.com/settings/developers
99+2. Under `Authorization callback URL` enter the correct url ie `https://internal.yourcompany.com/oauth2/callback`
100+
101+The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with `--email-domain=*`
102+
103+NOTE: When `--github-user` is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators.
104+
105+To restrict by organization only, include the following flag:
106+
107+```
108+ --github-org="": restrict logins to members of this organisation
109+```
110+
111+To restrict within an organization to specific teams, include the following flag in addition to `-github-org`:
112+
113+```
114+ --github-team="": restrict logins to members of any of these teams (slug), separated by a comma
115+```
116+
117+If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:
118+
119+```
120+ --github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo
121+```
122+
123+If you'd like to allow access to users with **read only** access to a **public** repository you will need to provide a [token](https://github.com/settings/tokens) for a user that has write access to the repository. The token must be created with at least the `public_repo` scope:
124+
125+```
126+ --github-token="": the token to use when verifying repository collaborators
127+```
128+
129+To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma
130+
131+```
132+ --github-user="": allow logins by username, separated by a comma
133+```
134+
135+If you are using GitHub enterprise, make sure you set the following to the appropriate url:
136+
137+```
138+ --login-url="http(s)://<enterprise github host>/login/oauth/authorize"
139+ --redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"
140+ --validate-url="http(s)://<enterprise github host>/api/v3"
141+```
142+
143+### Keycloak Auth Provider
144+
145+1. Create new client in your Keycloak with **Access Type** 'confidental' and **Valid Redirect URIs** 'https://internal.yourcompany.com/oauth2/callback'
146+2. Take note of the Secret in the credential tab of the client
147+3. Create a mapper with **Mapper Type** 'Group Membership' and **Token Claim Name** 'groups'.
148+
149+Make sure you set the following to the appropriate url:
150+
151+```
152+ --provider=keycloak
153+ --client-id=<client you have created>
154+ --client-secret=<your client's secret>
155+ --login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"
156+ --redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"
157+ --profile-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
158+ --validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
159+ --keycloak-group=<first_allowed_user_group>
160+ --keycloak-group=<second_allowed_user_group>
161+```
162+
163+For group based authorization, the optional `--keycloak-group` (legacy) or `--allowed-group` (global standard)
164+flags can be used to specify which groups to limit access to.
165+
166+If these are unset but a `groups` mapper is set up above in step (3), the provider will still
167+populate the `X-Forwarded-Groups` header to your upstream server with the `groups` data in the
168+Keycloak userinfo endpoint response.
169+
170+The group management in keycloak is using a tree. If you create a group named admin in keycloak
171+you should define the 'keycloak-group' value to /admin.
172+
173+### GitLab Auth Provider
174+
175+This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see [994](https://github.com/oauth2-proxy/oauth2-proxy/issues/994)).
176+
177+Whether you are using GitLab.com or self-hosting GitLab, follow [these steps to add an application](https://docs.gitlab.com/ce/integration/oauth_provider.html). Make sure to enable at least the `openid`, `profile` and `email` scopes, and set the redirect url to your application url e.g. https://myapp.com/oauth2/callback.
178+
179+If you need projects filtering, add the extra `read_api` scope to your application.
180+
181+The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow [these steps](./overview.md#generating-a-cookie-secret)
182+
183+```
184+ --provider="gitlab"
185+ --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab
186+ --client-id=GITLAB_CLIENT_ID
187+ --client-secret=GITLAB_CLIENT_SECRET
188+ --cookie-secret=COOKIE_SECRET
189+```
190+
191+Restricting by group membership is possible with the following option:
192+
193+```
194+ --gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma
195+```
196+
197+If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:
198+
199+```
200+ --oidc-issuer-url="<your gitlab url>"
201+```
202+
203+### LinkedIn Auth Provider
204+
205+For LinkedIn, the registration steps are:
206+
207+1. Create a new project: https://www.linkedin.com/secure/developer
208+2. In the OAuth User Agreement section:
209+ - In default scope, select r_basicprofile and r_emailaddress.
210+ - In "OAuth 2.0 Redirect URLs", enter `https://internal.yourcompany.com/oauth2/callback`
211+3. Fill in the remaining required fields and Save.
212+4. Take note of the **Consumer Key / API Key** and **Consumer Secret / Secret Key**
213+
214+### Microsoft Azure AD Provider
215+
216+For adding an application to the Microsoft Azure AD follow [these steps to add an application](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app).
217+
218+Take note of your `TenantId` if applicable for your situation. The `TenantId` can be used to override the default `common` authorization server with a tenant specific server.
219+
220+### OpenID Connect Provider
221+
222+OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects.
223+
224+This provider was originally built against CoreOS Dex and we will use it as an example.
225+The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below.
226+
227+#### Dex
228+
229+To configure the OIDC provider for Dex, perform the following steps:
230+
231+1. Download Dex:
232+
233+ ```
234+ go get github.com/dexidp/dex
235+ ```
236+
237+ See the [getting started guide](https://dexidp.io/docs/getting-started/) for more details.
238+
239+2. Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the `staticClients` section of `examples/config-dev.yaml`:
240+
241+ ```
242+ - id: oauth2-proxy
243+ redirectURIs:
244+ - 'http://127.0.0.1:4180/oauth2/callback'
245+ name: 'oauth2-proxy'
246+ secret: proxy
247+ ```
248+
249+3. Launch Dex: from `$GOPATH/github.com/dexidp/dex`, run:
250+
251+ ```
252+ bin/dex serve examples/config-dev.yaml
253+ ```
254+
255+4. In a second terminal, run the oauth2-proxy with the following args:
256+
257+ ```
258+ -provider oidc
259+ -provider-display-name "My OIDC Provider"
260+ -client-id oauth2-proxy
261+ -client-secret proxy
262+ -redirect-url http://127.0.0.1:4180/oauth2/callback
263+ -oidc-issuer-url http://127.0.0.1:5556/dex
264+ -cookie-secure=false
265+ -cookie-secret=secret
266+ -email-domain kilgore.trout
267+ ```
268+
269+ To serve the current working directory as a web site under the `/static` endpoint, add:
270+
271+ ```
272+ -upstream file://$PWD/#/static/
273+ ```
274+
275+5. Test the setup by visiting http://127.0.0.1:4180 or http://127.0.0.1:4180/static .
276+
277+See also [our local testing environment](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment) for a self-contained example using Docker and etcd as storage for Dex.
278+
279+#### Okta
280+
281+To configure the OIDC provider for Okta, perform the following steps:
282+
283+1. Log in to Okta using an administrative account. It is suggested you try this in preview first, `example.oktapreview.com`
284+2. (OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,
285+you may wish to configure an authorization server for each application. Otherwise, the provided `default` will work.
286+* Navigate to **Security** then select **API**
287+* Click **Add Authorization Server**, if this option is not available you may require an additional license for a custom authorization server.
288+* Fill out the **Name** with something to describe the application you are protecting. e.g. 'Example App'.
289+* For **Audience**, pick the URL of the application you wish to protect: https://example.corp.com
290+* Fill out a **Description**
291+* Add any **Access Policies** you wish to configure to limit application access.
292+* The default settings will work for other options.
293+[See Okta documentation for more information on Authorization Servers](https://developer.okta.com/docs/guides/customize-authz-server/overview/)
294+3. Navigate to **Applications** then select **Add Application**.
295+* Select **Web** for the **Platform** setting.
296+* Select **OpenID Connect** and click **Create**
297+* Pick an **Application Name** such as `Example App`.
298+* Set the **Login redirect URI** to `https://example.corp.com`.
299+* Under **General** set the **Allowed grant types** to `Authorization Code` and `Refresh Token`.
300+* Leave the rest as default, taking note of the `Client ID` and `Client Secret`.
301+* Under **Assignments** select the users or groups you wish to access your application.
302+4. Create a configuration file like the following:
303+
304+ ```
305+ provider = "oidc"
306+ redirect_url = "https://example.corp.com/oauth2/callback"
307+ oidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"
308+ upstreams = [
309+ "https://example.corp.com"
310+ ]
311+ email_domains = [
312+ "corp.com"
313+ ]
314+ client_id = "XXXXX"
315+ client_secret = "YYYYY"
316+ pass_access_token = true
317+ cookie_secret = "ZZZZZ"
318+ skip_provider_button = true
319+ ```
320+
321+The `oidc_issuer_url` is based on URL from your **Authorization Server**'s **Issuer** field in step 2, or simply https://corp.okta.com .
322+The `client_id` and `client_secret` are configured in the application settings.
323+Generate a unique `client_secret` to encrypt the cookie.
324+
325+Then you can start the oauth2-proxy with `./oauth2-proxy --config /etc/example.cfg`
326+
327+#### Okta - localhost
328+
329+1. Signup for developer account: https://developer.okta.com/signup/
330+2. Create New `Web` Application: https://$\{your-okta-domain\}/dev/console/apps/new
331+3. Example Application Settings for localhost:
332+ * **Name:** My Web App
333+ * **Base URIs:** http://localhost:4180/
334+ * **Login redirect URIs:** http://localhost:4180/oauth2/callback
335+ * **Logout redirect URIs:** http://localhost:4180/
336+ * **Group assignments:** `Everyone`
337+ * **Grant type allowed:** `Authorization Code` and `Refresh Token`
338+4. Make note of the `Client ID` and `Client secret`, they are needed in a future step
339+5. Make note of the **default** Authorization Server Issuer URI from: https://$\{your-okta-domain\}/admin/oauth2/as
340+6. Example config file `/etc/localhost.cfg`
341+ ```
342+ provider = "oidc"
343+ redirect_url = "http://localhost:4180/oauth2/callback"
344+ oidc_issuer_url = "https://$\{your-okta-domain\}/oauth2/default"
345+ upstreams = [
346+ "http://0.0.0.0:8080"
347+ ]
348+ email_domains = [
349+ "*"
350+ ]
351+ client_id = "XXX"
352+ client_secret = "YYY"
353+ pass_access_token = true
354+ cookie_secret = "ZZZ"
355+ cookie_secure = false
356+ skip_provider_button = true
357+ # Note: use the following for testing within a container
358+ # http_address = "0.0.0.0:4180"
359+ ```
360+7. Then you can start the oauth2-proxy with `./oauth2-proxy --config /etc/localhost.cfg`
361+
362+### login.gov Provider
363+
364+login.gov is an OIDC provider for the US Government.
365+If you are a US Government agency, you can contact the login.gov team through the contact information
366+that you can find on https://login.gov/developers/ and work with them to understand how to get login.gov
367+accounts for integration/test and production access.
368+
369+A developer guide is available here: https://developers.login.gov/, though this proxy handles everything
370+but the data you need to create to register your application in the login.gov dashboard.
371+
372+As a demo, we will assume that you are running your application that you want to secure locally on
373+http://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that
374+you have an agency integration account for testing.
375+
376+First, register your application in the dashboard. The important bits are:
377+ * Identity protocol: make this `Openid connect`
378+ * Issuer: do what they say for OpenID Connect. We will refer to this string as `${LOGINGOV_ISSUER}`.
379+ * Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.
380+ A quick way to do this is `openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'`,
381+ The contents of the `key.pem` shall be referred to as `${OAUTH2_PROXY_JWT_KEY}`.
382+ * Return to App URL: Make this be `http://localhost:4180/`
383+ * Redirect URIs: Make this be `http://localhost:4180/oauth2/callback`.
384+ * Attribute Bundle: Make sure that email is selected.
385+
386+Now start the proxy up with the following options:
387+```
388+./oauth2-proxy -provider login.gov \
389+ -client-id=${LOGINGOV_ISSUER} \
390+ -redirect-url=http://localhost:4180/oauth2/callback \
391+ -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \
392+ -cookie-secure=false \
393+ -email-domain=gsa.gov \
394+ -upstream=http://localhost:3000/ \
395+ -cookie-secret=somerandomstring12341234567890AB \
396+ -cookie-domain=localhost \
397+ -skip-provider-button=true \
398+ -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \
399+ -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \
400+ -jwt-key="${OAUTH2_PROXY_JWT_KEY}"
401+```
402+You can also set all these options with environment variables, for use in cloud/docker environments.
403+One tricky thing that you may encounter is that some cloud environments will pass in environment
404+variables in a docker env-file, which does not allow multiline variables like a PEM file.
405+If you encounter this, then you can create a `jwt_signing_key.pem` file in the top level
406+directory of the repo which contains the key in PEM format and then do your docker build.
407+The docker build process will copy that file into your image which you can then access by
408+setting the `OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem`
409+environment variable, or by setting `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem` on the commandline.
410+
411+Once it is running, you should be able to go to `http://localhost:4180/` in your browser,
412+get authenticated by the login.gov integration server, and then get proxied on to your
413+application running on `http://localhost:3000/`. In a real deployment, you would secure
414+your application with a firewall or something so that it was only accessible from the
415+proxy, and you would use real hostnames everywhere.
416+
417+#### Skip OIDC discovery
418+
419+Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata.
420+
421+In this case, you can set the `--skip-oidc-discovery` option, and supply those required endpoints manually:
422+
423+```
424+ -provider oidc
425+ -client-id oauth2-proxy
426+ -client-secret proxy
427+ -redirect-url http://127.0.0.1:4180/oauth2/callback
428+ -oidc-issuer-url http://127.0.0.1:5556
429+ -skip-oidc-discovery
430+ -login-url http://127.0.0.1:5556/authorize
431+ -redeem-url http://127.0.0.1:5556/token
432+ -oidc-jwks-url http://127.0.0.1:5556/keys
433+ -cookie-secure=false
434+ -email-domain example.com
435+```
436+
437+### Nextcloud Provider
438+
439+The Nextcloud provider allows you to authenticate against users in your
440+Nextcloud instance.
441+
442+When you are using the Nextcloud provider, you must specify the urls via
443+configuration, environment variable, or command line argument. Depending
444+on whether your Nextcloud instance is using pretty urls your urls may be of the
445+form `/index.php/apps/oauth2/*` or `/apps/oauth2/*`.
446+
447+Refer to the [OAuth2
448+documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html)
449+to setup the client id and client secret. Your "Redirection URI" will be
450+`https://internalapp.yourcompany.com/oauth2/callback`.
451+
452+```
453+ -provider nextcloud
454+ -client-id <from nextcloud admin>
455+ -client-secret <from nextcloud admin>
456+ -login-url="<your nextcloud url>/index.php/apps/oauth2/authorize"
457+ -redeem-url="<your nextcloud url>/index.php/apps/oauth2/api/v1/token"
458+ -validate-url="<your nextcloud url>/ocs/v2.php/cloud/user?format=json"
459+```
460+
461+Note: in *all* cases the validate-url will *not* have the `index.php`.
462+
463+### DigitalOcean Auth Provider
464+
465+1. [Create a new OAuth application](https://cloud.digitalocean.com/account/api/applications)
466+ * You can fill in the name, homepage, and description however you wish.
467+ * In the "Application callback URL" field, enter: `https://oauth-proxy/oauth2/callback`, substituting `oauth2-proxy` with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL.
468+2. Note the Client ID and Client Secret.
469+
470+To use the provider, pass the following options:
471+
472+```
473+ --provider=digitalocean
474+ --client-id=<Client ID>
475+ --client-secret=<Client Secret>
476+```
477+
478+ Alternatively, set the equivalent options in the config file. The redirect URL defaults to `https://<requested host header>/oauth2/callback`. If you need to change it, you can use the `--redirect-url` command-line option.
479+
480+### Bitbucket Auth Provider
481+
482+1. [Add a new OAuth consumer](https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html)
483+ * In "Callback URL" use `https://<oauth2-proxy>/oauth2/callback`, substituting `<oauth2-proxy>` with the actual hostname that oauth2-proxy is running on.
484+ * In Permissions section select:
485+ * Account -> Email
486+ * Team membership -> Read
487+ * Repositories -> Read
488+2. Note the Client ID and Client Secret.
489+
490+To use the provider, pass the following options:
491+
492+```
493+ --provider=bitbucket
494+ --client-id=<Client ID>
495+ --client-secret=<Client Secret>
496+```
497+
498+The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: `--bitbucket-team=<Team name>`. To restrict the access to only these users who has access to one selected repository use `--bitbucket-repository=<Repository name>`.
499+
500+
501+### Gitea Auth Provider
502+
503+1. Create a new application: `https://< your gitea host >/user/settings/applications`
504+2. Under `Redirect URI` enter the correct URL i.e. `https://<proxied host>/oauth2/callback`
505+3. Note the Client ID and Client Secret.
506+4. Pass the following options to the proxy:
507+
508+```
509+ --provider="github"
510+ --redirect-url="https://<proxied host>/oauth2/callback"
511+ --provider-display-name="Gitea"
512+ --client-id="< client_id as generated by Gitea >"
513+ --client-secret="< client_secret as generated by Gitea >"
514+ --login-url="https://< your gitea host >/login/oauth/authorize"
515+ --redeem-url="https://< your gitea host >/login/oauth/access_token"
516+ --validate-url="https://< your gitea host >/api/v1"
517+```
518+
519+
520+## Email Authentication
521+
522+To authorize by email domain use `--email-domain=yourcompany.com`. To authorize individual email addresses use `--authenticated-emails-file=/path/to/file` with one email per line. To authorize all email addresses use `--email-domain=*`.
523+
524+## Adding a new Provider
525+
526+Follow the examples in the [`providers` package](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/) to define a new
527+`Provider` instance. Add a new `case` to
528+[`providers.New()`](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go) to allow `oauth2-proxy` to use the
529+new `Provider`.
docs/versioned_docs/version-7.1.x/configuration/overview.mdnew file+537
@@ -0,0 +1,537 @@
1+---
2+id: overview
3+title: Overview
4+---
5+
6+`oauth2-proxy` can be configured via [command line options](#command-line-options), [environment variables](#environment-variables) or [config file](#config-file) (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings).
7+
8+### Generating a Cookie Secret
9+
10+To generate a strong cookie secret use `python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'`
11+
12+### Config File
13+
14+Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (\_). If the argument can be specified multiple times, the config option should be plural (trailing s).
15+
16+An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example) config file is in the contrib directory. It can be used by specifying `--config=/etc/oauth2-proxy.cfg`
17+
18+### Command Line Options
19+
20+| Option | Type | Description | Default |
21+| ------------------------------------------ | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- |
22+| `--acr-values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
23+| `--approval-prompt` | string | OAuth approval_prompt | `"force"` |
24+| `--auth-logging` | bool | Log authentication attempts | true |
25+| `--auth-logging-format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
26+| `--authenticated-emails-file` | string | authenticate against emails via file (one per line) | |
27+| `--azure-tenant` | string | go to a tenant-specific or common (tenant-independent) endpoint. | `"common"` |
28+| `--basic-auth-password` | string | the password to set when passing the HTTP Basic Auth header | |
29+| `--client-id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
30+| `--client-secret` | string | the OAuth Client Secret | |
31+| `--client-secret-file` | string | the file with OAuth Client Secret | |
32+| `--config` | string | path to config file | |
33+| `--cookie-domain` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
34+| `--cookie-expire` | duration | expire timeframe for cookie | 168h0m0s |
35+| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
36+| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
37+| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
38+| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;[^1] | |
39+| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
40+| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
41+| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
42+| `--custom-templates-dir` | string | path to custom html templates | |
43+| `--custom-sign-in-logo` | string | path to an custom image for the sign_in page logo. Use \"-\" to disable default logo. |
44+| `--display-htpasswd-form` | bool | display username / password login form if an htpasswd file is provided | true |
45+| `--email-domain` | string \| list | authenticate emails with the specified domain (may be given multiple times). Use `*` to authenticate any email | |
46+| `--errors-to-info-log` | bool | redirects error-level logging to default log channel instead of stderr | false |
47+| `--extra-jwt-issuers` | string | if `--skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` (see a token's `iss`, `aud` fields) pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
48+| `--exclude-logging-path` | string | comma separated list of paths to exclude from logging, e.g. `"/ping,/path2"` | `""` (no paths excluded) |
49+| `--flush-interval` | duration | period between flushing response buffers when streaming responses | `"1s"` |
50+| `--force-https` | bool | enforce https redirect | `false` |
51+| `--banner` | string | custom (html) banner string. Use `"-"` to disable default banner. | |
52+| `--footer` | string | custom (html) footer string. Use `"-"` to disable default footer. | |
53+| `--github-org` | string | restrict logins to members of this organisation | |
54+| `--github-team` | string | restrict logins to members of any of these teams (slug), separated by a comma | |
55+| `--github-repo` | string | restrict logins to collaborators of this repository formatted as `orgname/repo` | |
56+| `--github-token` | string | the token to use when verifying repository collaborators (must have push access to the repository) | |
57+| `--github-user` | string \| list | To allow users to login by username even if they do not belong to the specified org and team or collaborators | |
58+| `--gitlab-group` | string \| list | restrict logins to members of any of these groups (slug), separated by a comma | |
59+| `--gitlab-projects` | string \| list | restrict logins to members of any of these projects (may be given multiple times) formatted as `orgname/repo=accesslevel`. Access level should be a value matching [Gitlab access levels](https://docs.gitlab.com/ee/api/members.html#valid-access-levels), defaulted to 20 if absent | |
60+| `--google-admin-email` | string | the google admin to impersonate for api calls | |
61+| `--google-group` | string | restrict logins to members of this google group (may be given multiple times). | |
62+| `--google-service-account-json` | string | the path to the service account json credentials | |
63+| `--htpasswd-file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
64+| `--htpasswd-user-group` | string \| list | the groups to be set on sessions for htpasswd users | |
65+| `--http-address` | string | `[http://]<addr>:<port>` or `unix://<path>` to listen on for HTTP clients | `"127.0.0.1:4180"` |
66+| `--https-address` | string | `<addr>:<port>` to listen on for HTTPS clients | `":443"` |
67+| `--logging-compress` | bool | Should rotated log files be compressed using gzip | false |
68+| `--logging-filename` | string | File to log requests to, empty for `stdout` | `""` (stdout) |
69+| `--logging-local-time` | bool | Use local time in log files and backup filenames instead of UTC | true (local time) |
70+| `--logging-max-age` | int | Maximum number of days to retain old log files | 7 |
71+| `--logging-max-backups` | int | Maximum number of old log files to retain; 0 to disable | 0 |
72+| `--logging-max-size` | int | Maximum size in megabytes of the log file before rotation | 100 |
73+| `--jwt-key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |
74+| `--jwt-key-file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |
75+| `--login-url` | string | Authentication endpoint | |
76+| `--insecure-oidc-allow-unverified-email` | bool | don't fail if an email address in an id_token is not verified | false |
77+| `--insecure-oidc-skip-issuer-verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
78+| `--oidc-issuer-url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
79+| `--oidc-jwks-url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled | |
80+| `--oidc-email-claim` | string | which OIDC claim contains the user's email | `"email"` |
81+| `--oidc-groups-claim` | string | which OIDC claim contains the user groups | `"groups"` |
82+| `--pass-access-token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
83+| `--pass-authorization-header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
84+| `--pass-basic-auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
85+| `--prefer-email-to-user` | bool | Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with `--pass-basic-auth` and `--pass-user-headers` | false |
86+| `--pass-host-header` | bool | pass the request Host Header to upstream | true |
87+| `--pass-user-headers` | bool | pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
88+| `--profile-url` | string | Profile access endpoint | |
89+| `--prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
90+| `--provider` | string | OAuth provider | google |
91+| `--provider-ca-file` | string \| list | Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead. |
92+| `--provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
93+| `--ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
94+| `--ping-user-agent` | string | a User-Agent that can be used for basic health checks | `""` (don't check user agent) |
95+| `--metrics-address` | string | the address /metrics will be served on | `""` |
96+| `--metrics-secure-address` | string | the address /metrics will be served on via HTTPS | `""` |
97+| `--metrics-tls-cert-file` | string | path to certificate file for secure metrics server | `""` |
98+| `--metrics-tls-key-file` | string | path to private key file for secure metrics server | `""` |
99+| `--proxy-prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
100+| `--proxy-websockets` | bool | enables WebSocket proxying | true |
101+| `--pubjwk-url` | string | JWK pubkey access endpoint: required by login.gov | |
102+| `--real-client-ip-header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
103+| `--redeem-url` | string | Token redemption endpoint | |
104+| `--redirect-url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
105+| `--redis-cluster-connection-urls` | string \| list | List of Redis cluster connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-cluster` | |
106+| `--redis-connection-url` | string | URL of redis server for redis session storage (e.g. `redis://HOST[:PORT]`) | |
107+| `--redis-password` | string | Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url` | |
108+| `--redis-sentinel-password` | string | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password` | |
109+| `--redis-sentinel-master-name` | string | Redis sentinel master name. Used in conjunction with `--redis-use-sentinel` | |
110+| `--redis-sentinel-connection-urls` | string \| list | List of Redis sentinel connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-sentinel` | |
111+| `--redis-use-cluster` | bool | Connect to redis cluster. Must set `--redis-cluster-connection-urls` to use this feature | false |
112+| `--redis-use-sentinel` | bool | Connect to redis via sentinels. Must set `--redis-sentinel-master-name` and `--redis-sentinel-connection-urls` to use this feature | false |
113+| `--request-id-header` | string | Request header to use as the request ID in logging | X-Request-Id |
114+| `--request-logging` | bool | Log requests | true |
115+| `--request-logging-format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
116+| `--resource` | string | The resource that is protected (Azure AD only) | |
117+| `--reverse-proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-\{Proto,Host,Uri\} headers to be used on redirect selection | false |
118+| `--scope` | string | OAuth scope specification | |
119+| `--session-cookie-minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
120+| `--session-store-type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
121+| `--set-xauthrequest` | bool | set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with `--pass-access-token`, X-Auth-Request-Access-Token is added to response headers. | false |
122+| `--set-authorization-header` | bool | set Authorization Bearer response header (useful in Nginx auth_request mode) | false |
123+| `--set-basic-auth` | bool | set HTTP Basic Auth information in response (useful in Nginx auth_request mode) | false |
124+| `--show-debug-on-error` | bool | show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production) | false |
125+| `--signature-key` | string | GAP-Signature request signature key (algorithm:secretkey) | |
126+| `--silence-ping-logging` | bool | disable logging of requests to ping endpoint | false |
127+| `--skip-auth-preflight` | bool | will skip authentication for OPTIONS requests | false |
128+| `--skip-auth-regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times) | |
129+| `--skip-auth-route` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods | |
130+| `--skip-auth-strip-headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy | true |
131+| `--skip-jwt-bearer-tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
132+| `--skip-oidc-discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
133+| `--skip-provider-button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
134+| `--ssl-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS providers | false |
135+| `--ssl-upstream-insecure-skip-verify` | bool | skip validation of certificates presented when using HTTPS upstreams | false |
136+| `--standard-logging` | bool | Log standard runtime information | true |
137+| `--standard-logging-format` | string | Template for standard log lines | see [Logging Configuration](#logging-configuration) |
138+| `--tls-cert-file` | string | path to certificate file | |
139+| `--tls-key-file` | string | path to private key file | |
140+| `--upstream` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
141+| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
142+| `--validate-url` | string | Access token validation endpoint | |
143+| `--version` | n/a | print version string | |
144+| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` to allow subdomains (e.g. `.example.com`)&nbsp;[^2] | |
145+| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
146+
147+[^1]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
148+
149+[^2]: When using the `whitelist-domain` option, any domain prefixed with a `.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
150+
151+See below for provider specific options
152+
153+### Upstreams Configuration
154+
155+`oauth2-proxy` supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as `http://127.0.0.1:8080/` for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide `http://127.0.0.1:8080/some/path/` then it will only be requests that start with `/some/path/` which are forwarded to the upstream.
156+
157+Static file paths are configured as a file:// URL. `file:///var/www/static/` will serve the files from that directory at `http://[oauth2-proxy url]/var/www/static/`, which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. `file:///var/www/static/#/static/` will make `/var/www/static/` available at `http://[oauth2-proxy url]/static/`.
158+
159+Multiple upstreams can either be configured by supplying a comma separated list to the `--upstream` parameter, supplying the parameter multiple times or providing a list in the [config file](#config-file). When multiple upstreams are used routing to them will be based on the path they are set up with.
160+
161+### Environment variables
162+
163+Every command line argument can be specified as an environment variable by
164+prefixing it with `OAUTH2_PROXY_`, capitalising it, and replacing hyphens (`-`)
165+with underscores (`_`). If the argument can be specified multiple times, the
166+environment variable should be plural (trailing `S`).
167+
168+This is particularly useful for storing secrets outside of a configuration file
169+or the command line.
170+
171+For example, the `--cookie-secret` flag becomes `OAUTH2_PROXY_COOKIE_SECRET`,
172+and the `--email-domain` flag becomes `OAUTH2_PROXY_EMAIL_DOMAINS`.
173+
174+## Logging Configuration
175+
176+By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the `--logging-filename` command.
177+
178+If logging to a file you can also configure the maximum file size (`--logging-max-size`), age (`--logging-max-age`), max backup logs (`--logging-max-backups`), and if backup logs should be compressed (`--logging-compress`).
179+
180+There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with `--standard-logging`, `--auth-logging`, and `--request-logging`.
181+
182+Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log.
183+
184+Logging of requests to the `/ping` endpoint (or using `--ping-user-agent`) can be disabled with `--silence-ping-logging` reducing log volume. This flag appends the `--ping-path` to `--exclude-logging-paths`.
185+
186+### Auth Log Format
187+Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:
188+
189+```
190+<REMOTE_ADDRESS> - <REQUEST ID> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] [<STATUS>] <MESSAGE>
191+```
192+
193+The status block will contain one of the below strings:
194+
195+- `AuthSuccess` If a user has authenticated successfully by any method
196+- `AuthFailure` If the user failed to authenticate explicitly
197+- `AuthError` If there was an unexpected error during authentication
198+
199+If you require a different format than that, you can configure it with the `--auth-logging-format` flag.
200+The default format is configured as follows:
201+
202+```
203+{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}
204+```
205+
206+Available variables for auth logging:
207+
208+| Variable | Example | Description |
209+| ------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
210+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
211+| Host | domain.com | The value of the Host header. |
212+| Message | Authenticated via OAuth2 | The details of the auth attempt. |
213+| Protocol | HTTP/1.0 | The request protocol. |
214+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
215+| RequestMethod | GET | The request method. |
216+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
217+| UserAgent | - | The full user agent as reported by the requesting client. |
218+| Username | username@email.com | The email or username of the auth request. |
219+| Status | AuthSuccess | The status of the auth request. See above for details. |
220+
221+### Request Log Format
222+HTTP request logs will output by default in the below format:
223+
224+```
225+<REMOTE_ADDRESS> - <REQUEST ID> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] <HOST_HEADER> GET <UPSTREAM_HOST> "/path/" HTTP/1.1 "<USER_AGENT>" <RESPONSE_CODE> <RESPONSE_BYTES> <REQUEST_DURATION>
226+```
227+
228+If you require a different format than that, you can configure it with the `--request-logging-format` flag.
229+The default format is configured as follows:
230+
231+```
232+{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}
233+```
234+
235+Available variables for request logging:
236+
237+| Variable | Example | Description |
238+| --------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
239+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
240+| Host | domain.com | The value of the Host header. |
241+| Protocol | HTTP/1.0 | The request protocol. |
242+| RequestDuration | 0.001 | The time in seconds that a request took to process. |
243+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
244+| RequestMethod | GET | The request method. |
245+| RequestURI | "/oauth2/auth" | The URI path of the request. |
246+| ResponseSize | 12 | The size in bytes of the response. |
247+| StatusCode | 200 | The HTTP status code of the response. |
248+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
249+| Upstream | - | The upstream data of the HTTP request. |
250+| UserAgent | - | The full user agent as reported by the requesting client. |
251+| Username | username@email.com | The email or username of the auth request. |
252+
253+### Standard Log Format
254+All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:
255+
256+```
257+[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE>
258+```
259+
260+If you require a different format than that, you can configure it with the `--standard-logging-format` flag. The default format is configured as follows:
261+
262+```
263+[{{.Timestamp}}] [{{.File}}] {{.Message}}
264+```
265+
266+Available variables for standard logging:
267+
268+| Variable | Example | Description |
269+| --------- | --------------------------------- | -------------------------------------------------- |
270+| Timestamp | 19/Mar/2015:17:20:19 -0400 | The date and time of the logging event. |
271+| File | main.go:40 | The file and line number of the logging statement. |
272+| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
273+
274+## Configuring for use with the Nginx `auth_request` directive
275+
276+The [Nginx `auth_request` directive](http://nginx.org/en/docs/http/ngx_http_auth_request_module.html) allows Nginx to authenticate requests via the oauth2-proxy's `/auth` endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:
277+
278+```nginx
279+server {
280+ listen 443 ssl;
281+ server_name ...;
282+ include ssl/ssl.conf;
283+
284+ location /oauth2/ {
285+ proxy_pass http://127.0.0.1:4180;
286+ proxy_set_header Host $host;
287+ proxy_set_header X-Real-IP $remote_addr;
288+ proxy_set_header X-Scheme $scheme;
289+ proxy_set_header X-Auth-Request-Redirect $request_uri;
290+ # or, if you are handling multiple domains:
291+ # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
292+ }
293+ location = /oauth2/auth {
294+ proxy_pass http://127.0.0.1:4180;
295+ proxy_set_header Host $host;
296+ proxy_set_header X-Real-IP $remote_addr;
297+ proxy_set_header X-Scheme $scheme;
298+ # nginx auth_request includes headers but not body
299+ proxy_set_header Content-Length "";
300+ proxy_pass_request_body off;
301+ }
302+
303+ location / {
304+ auth_request /oauth2/auth;
305+ error_page 401 = /oauth2/sign_in;
306+
307+ # pass information via X-User and X-Email headers to backend,
308+ # requires running with --set-xauthrequest flag
309+ auth_request_set $user $upstream_http_x_auth_request_user;
310+ auth_request_set $email $upstream_http_x_auth_request_email;
311+ proxy_set_header X-User $user;
312+ proxy_set_header X-Email $email;
313+
314+ # if you enabled --pass-access-token, this will pass the token to the backend
315+ auth_request_set $token $upstream_http_x_auth_request_access_token;
316+ proxy_set_header X-Access-Token $token;
317+
318+ # if you enabled --cookie-refresh, this is needed for it to work with auth_request
319+ auth_request_set $auth_cookie $upstream_http_set_cookie;
320+ add_header Set-Cookie $auth_cookie;
321+
322+ # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
323+ # limit and so the OAuth2 Proxy splits these into multiple parts.
324+ # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
325+ # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
326+ auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;
327+
328+ # Extract the Cookie attributes from the first Set-Cookie header and append them
329+ # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
330+ if ($auth_cookie ~* "(; .*)") {
331+ set $auth_cookie_name_0 $auth_cookie;
332+ set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
333+ }
334+
335+ # Send both Set-Cookie headers now if there was a second part
336+ if ($auth_cookie_name_upstream_1) {
337+ add_header Set-Cookie $auth_cookie_name_0;
338+ add_header Set-Cookie $auth_cookie_name_1;
339+ }
340+
341+ proxy_pass http://backend/;
342+ # or "root /path/to/site;" or "fastcgi_pass ..." etc
343+ }
344+}
345+```
346+
347+When you use ingress-nginx in Kubernetes, you MUST use `kubernetes/ingress-nginx` (which includes the Lua module) and the following configuration snippet for your `Ingress`.
348+Variables set with `auth_request_set` are not `set`-able in plain nginx config when the location is processed via `proxy_pass` and then may only be processed by Lua.
349+Note that `nginxinc/kubernetes-ingress` does not include the Lua module.
350+
351+```yaml
352+nginx.ingress.kubernetes.io/auth-response-headers: Authorization
353+nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
354+nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
355+nginx.ingress.kubernetes.io/configuration-snippet: |
356+ auth_request_set $name_upstream_1 $upstream_cookie_name_1;
357+
358+ access_by_lua_block {
359+ if ngx.var.name_upstream_1 ~= "" then
360+ ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")
361+ end
362+ }
363+```
364+It is recommended to use `--session-store-type=redis` when expecting large sessions/OIDC tokens (_e.g._ with MS Azure).
365+
366+You have to substitute *name* with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".
367+
368+## Configuring for use with the Traefik (v2) `ForwardAuth` middleware
369+
370+**This option requires `--reverse-proxy` option to be set.**
371+
372+### ForwardAuth with 401 errors middleware
373+
374+The [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/http/forwardauth/) allows Traefik to authenticate requests via the oauth2-proxy's `/oauth2/auth` endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:
375+
376+```yaml
377+http:
378+ routers:
379+ a-service:
380+ rule: "Host(`a-service.example.com`)"
381+ service: a-service-backend
382+ middlewares:
383+ - oauth-errors
384+ - oauth-auth
385+ tls:
386+ certResolver: default
387+ domains:
388+ - main: "example.com"
389+ sans:
390+ - "*.example.com"
391+ oauth:
392+ rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"
393+ middlewares:
394+ - auth-headers
395+ service: oauth-backend
396+ tls:
397+ certResolver: default
398+ domains:
399+ - main: "example.com"
400+ sans:
401+ - "*.example.com"
402+
403+ services:
404+ a-service-backend:
405+ loadBalancer:
406+ servers:
407+ - url: http://172.16.0.2:7555
408+ oauth-backend:
409+ loadBalancer:
410+ servers:
411+ - url: http://172.16.0.1:4180
412+
413+ middlewares:
414+ auth-headers:
415+ headers:
416+ sslRedirect: true
417+ stsSeconds: 315360000
418+ browserXssFilter: true
419+ contentTypeNosniff: true
420+ forceSTSHeader: true
421+ sslHost: example.com
422+ stsIncludeSubdomains: true
423+ stsPreload: true
424+ frameDeny: true
425+ oauth-auth:
426+ forwardAuth:
427+ address: https://oauth.example.com/oauth2/auth
428+ trustForwardHeader: true
429+ oauth-errors:
430+ errors:
431+ status:
432+ - "401-403"
433+ service: oauth-backend
434+ query: "/oauth2/sign_in"
435+```
436+
437+### ForwardAuth with static upstreams configuration
438+
439+Redirect to sign_in functionality provided without the use of `errors` middleware with [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/http/forwardauth/) pointing to oauth2-proxy service's `/` endpoint
440+
441+**Following options need to be set on `oauth2-proxy`:**
442+- `--upstream=static://202`: Configures a static response for authenticated sessions
443+- `--reverseproxy=true`: Enables the use of `X-Forwarded-*` headers to determine redirects correctly
444+
445+```yaml
446+http:
447+ routers:
448+ a-service-route-1:
449+ rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"
450+ service: a-service-backend
451+ middlewares:
452+ - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin
453+ tls:
454+ certResolver: default
455+ domains:
456+ - main: "example.com"
457+ sans:
458+ - "*.example.com"
459+ a-service-route-2:
460+ rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"
461+ service: a-service-backend
462+ middlewares:
463+ - oauth-auth-wo-redirect # unauthenticated session will return a 401
464+ tls:
465+ certResolver: default
466+ domains:
467+ - main: "example.com"
468+ sans:
469+ - "*.example.com"
470+ services-oauth2-route:
471+ rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"
472+ middlewares:
473+ - auth-headers
474+ service: oauth-backend
475+ tls:
476+ certResolver: default
477+ domains:
478+ - main: "example.com"
479+ sans:
480+ - "*.example.com"
481+ oauth2-proxy-route:
482+ rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"
483+ middlewares:
484+ - auth-headers
485+ service: oauth-backend
486+ tls:
487+ certResolver: default
488+ domains:
489+ - main: "example.com"
490+ sans:
491+ - "*.example.com"
492+
493+ services:
494+ a-service-backend:
495+ loadBalancer:
496+ servers:
497+ - url: http://172.16.0.2:7555
498+ b-service-backend:
499+ loadBalancer:
500+ servers:
501+ - url: http://172.16.0.3:7555
502+ oauth-backend:
503+ loadBalancer:
504+ servers:
505+ - url: http://172.16.0.1:4180
506+
507+ middlewares:
508+ auth-headers:
509+ headers:
510+ sslRedirect: true
511+ stsSeconds: 315360000
512+ browserXssFilter: true
513+ contentTypeNosniff: true
514+ forceSTSHeader: true
515+ sslHost: example.com
516+ stsIncludeSubdomains: true
517+ stsPreload: true
518+ frameDeny: true
519+ oauth-auth-redirect:
520+ forwardAuth:
521+ address: https://oauth.example.com/
522+ trustForwardHeader: true
523+ authResponseHeaders:
524+ - X-Auth-Request-Access-Token
525+ - Authorization
526+ oauth-auth-wo-redirect:
527+ forwardAuth:
528+ address: https://oauth.example.com/oauth2/auth
529+ trustForwardHeader: true
530+ authResponseHeaders:
531+ - X-Auth-Request-Access-Token
532+ - Authorization
533+```
534+
535+:::note
536+If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.
537+:::
docs/versioned_docs/version-7.1.x/configuration/sessions.mdnew file+67
@@ -0,0 +1,67 @@
1+---
2+id: session_storage
3+title: Session Storage
4+---
5+
6+Sessions allow a user's authentication to be tracked between multiple HTTP
7+requests to a service.
8+
9+The OAuth2 Proxy uses a Cookie to track user sessions and will store the session
10+data in one of the available session storage backends.
11+
12+At present the available backends are (as passed to `--session-store-type`):
13+- [cookie](#cookie-storage) (default)
14+- [redis](#redis-storage)
15+
16+### Cookie Storage
17+
18+The Cookie storage backend is the default backend implementation and has
19+been used in the OAuth2 Proxy historically.
20+
21+With the Cookie storage backend, all session information is stored in client
22+side cookies and transferred with each and every request.
23+
24+The following should be known when using this implementation:
25+- Since all state is stored client side, this storage backend means that the OAuth2 Proxy is completely stateless
26+- Cookies are signed server side to prevent modification client-side
27+- It is mandatory to set a `cookie-secret` which will ensure data is encrypted within the cookie data.
28+- Since multiple requests can be made concurrently to the OAuth2 Proxy, this session implementation
29+cannot lock sessions and while updating and refreshing sessions, there can be conflicts which force
30+users to re-authenticate
31+
32+
33+### Redis Storage
34+
35+The Redis Storage backend stores sessions, encrypted, in redis. Instead sending all the information
36+back the client for storage, as in the [Cookie storage](#cookie-storage), a ticket is sent back
37+to the user as the cookie value instead.
38+
39+A ticket is composed as the following:
40+
41+`{CookieName}-{ticketID}.{secret}`
42+
43+Where:
44+
45+- The `CookieName` is the OAuth2 cookie name (_oauth2_proxy by default)
46+- The `ticketID` is a 128 bit random number, hex-encoded
47+- The `secret` is a 128 bit random number, base64url encoded (no padding). The secret is unique for every session.
48+- The pair of `{CookieName}-{ticketID}` comprises a ticket handle, and thus, the redis key
49+to which the session is stored. The encoded session is encrypted with the secret and stored
50+in redis via the `SETEX` command.
51+
52+Encrypting every session uniquely protects the refresh/access/id tokens stored in the session from
53+disclosure.
54+
55+#### Usage
56+
57+When using the redis store, specify `--session-store-type=redis` as well as the Redis connection URL, via
58+`--redis-connection-url=redis://host[:port][/db-number]`.
59+
60+You may also configure the store for Redis Sentinel. In this case, you will want to use the
61+`--redis-use-sentinel=true` flag, as well as configure the flags `--redis-sentinel-master-name`
62+and `--redis-sentinel-connection-urls` appropriately.
63+
64+Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the
65+`--redis-use-cluster=true` flag, and configure the flags `--redis-cluster-connection-urls` appropriately.
66+
67+Note that flags `--redis-use-sentinel=true` and `--redis-use-cluster=true` are mutually exclusive.
docs/versioned_docs/version-7.1.x/configuration/tls.mdnew file+70
@@ -0,0 +1,70 @@
1+---
2+id: tls
3+title: TLS Configuration
4+---
5+
6+There are two recommended configurations.
7+
8+1. Configure SSL Termination with OAuth2 Proxy by providing a `--tls-cert-file=/path/to/cert.pem` and `--tls-key-file=/path/to/cert.key`.
9+
10+ The command line to run `oauth2-proxy` in this configuration would look like this:
11+
12+ ```bash
13+ ./oauth2-proxy \
14+ --email-domain="yourcompany.com" \
15+ --upstream=http://127.0.0.1:8080/ \
16+ --tls-cert-file=/path/to/cert.pem \
17+ --tls-key-file=/path/to/cert.key \
18+ --cookie-secret=... \
19+ --cookie-secure=true \
20+ --provider=... \
21+ --client-id=... \
22+ --client-secret=...
23+ ```
24+
25+2. Configure SSL Termination with [Nginx](http://nginx.org/) (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ....
26+
27+ Because `oauth2-proxy` listens on `127.0.0.1:4180` by default, to listen on all interfaces (needed when using an
28+ external load balancer like Amazon ELB or Google Platform Load Balancing) use `--http-address="0.0.0.0:4180"` or
29+ `--http-address="http://:4180"`.
30+
31+ Nginx will listen on port `443` and handle SSL connections while proxying to `oauth2-proxy` on port `4180`.
32+ `oauth2-proxy` will then authenticate requests for an upstream application. The external endpoint for this example
33+ would be `https://internal.yourcompany.com/`.
34+
35+ An example Nginx config follows. Note the use of `Strict-Transport-Security` header to pin requests to SSL
36+ via [HSTS](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security):
37+
38+ ```
39+ server {
40+ listen 443 default ssl;
41+ server_name internal.yourcompany.com;
42+ ssl_certificate /path/to/cert.pem;
43+ ssl_certificate_key /path/to/cert.key;
44+ add_header Strict-Transport-Security max-age=2592000;
45+
46+ location / {
47+ proxy_pass http://127.0.0.1:4180;
48+ proxy_set_header Host $host;
49+ proxy_set_header X-Real-IP $remote_addr;
50+ proxy_set_header X-Scheme $scheme;
51+ proxy_connect_timeout 1;
52+ proxy_send_timeout 30;
53+ proxy_read_timeout 30;
54+ }
55+ }
56+ ```
57+
58+ The command line to run `oauth2-proxy` in this configuration would look like this:
59+
60+ ```bash
61+ ./oauth2-proxy \
62+ --email-domain="yourcompany.com" \
63+ --upstream=http://127.0.0.1:8080/ \
64+ --cookie-secret=... \
65+ --cookie-secure=true \
66+ --provider=... \
67+ --reverse-proxy=true \
68+ --client-id=... \
69+ --client-secret=...
70+ ```
docs/versioned_docs/version-7.1.x/features/endpoints.mdnew file+36
@@ -0,0 +1,36 @@
1+---
2+id: endpoints
3+title: Endpoints
4+---
5+
6+OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The `/oauth2` prefix can be changed with the `--proxy-prefix` config variable.
7+
8+- /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see [robotstxt.org](http://www.robotstxt.org/) for more info
9+- /ping - returns a 200 OK response, which is intended for use with health checks
10+- /metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by `--metrics-address`, disabled by default
11+- /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
12+- /oauth2/sign_out - this URL is used to clear the session cookie
13+- /oauth2/start - a URL that will redirect to start the OAuth cycle
14+- /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
15+- /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
16+- /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the [Nginx `auth_request` directive](../configuration/overview.md#configuring-for-use-with-the-nginx-auth_request-directive)
17+
18+### Sign out
19+
20+To sign the user out, redirect them to `/oauth2/sign_out`. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the `rd` query parameter, i.e. redirect the user to something like (notice the url-encoding!):
21+
22+```
23+/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page
24+```
25+
26+Alternatively, include the redirect URL in the `X-Auth-Request-Redirect` header:
27+
28+```
29+GET /oauth2/sign_out HTTP/1.1
30+X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
31+...
32+```
33+
34+(The "sign_out_page" should be the [`end_session_endpoint`](https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1) from [the metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig) if your OIDC provider supports Session Management and Discovery.)
35+
36+BEWARE that the domain you want to redirect to (`my-oidc-provider.example.com` in the example) must be added to the [`--whitelist-domain`](../configuration/overview) configuration option otherwise the redirect will be ignored.
docs/versioned_docs/version-7.1.x/installation.mdnew file+26
@@ -0,0 +1,26 @@
1+---
2+id: installation
3+title: Installation
4+slug: /
5+---
6+
7+1. Choose how to deploy:
8+
9+ a. Download [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.1.3`)
10+
11+ b. Build with `$ go get github.com/oauth2-proxy/oauth2-proxy/v7` which will put the binary in `$GOPATH/bin`
12+
13+ c. Using the prebuilt docker image [quay.io/oauth2-proxy/oauth2-proxy](https://quay.io/oauth2-proxy/oauth2-proxy) (AMD64, ARMv6 and ARM64 tags available)
14+
15+ d. Using a [Kubernetes manifest](https://github.com/oauth2-proxy/manifests) (Helm)
16+
17+Prebuilt binaries can be validated by extracting the file and verifying it against the `sha256sum.txt` checksum file provided for each release starting with version `v3.0.0`.
18+
19+```
20+$ sha256sum -c sha256sum.txt 2>&1 | grep OK
21+oauth2-proxy-x.y.z.linux-amd64: OK
22+```
23+
24+2. [Select a Provider and Register an OAuth Application with a Provider](configuration/auth.md)
25+3. [Configure OAuth2 Proxy using config file, command line options, or environment variables](configuration/overview.md)
26+4. [Configure SSL or Deploy behind a SSL endpoint](configuration/tls.md) (example provided for Nginx)
docs/versioned_docs/version-7.10.x/behaviour.mdnew file+26
@@ -0,0 +1,26 @@
1+---
2+id: behaviour
3+title: Behaviour
4+---
5+
6+1. Authentication Requirement: All requests passing through the proxy to upstream applications require authentication, excluding default proxy endpoints.
7+ - Exception: If the request matches a skipped route (configured via `--skip-auth-route`):
8+ - Authentication is not enforced, but the proxy will opportunistically attempt to validate a session cookie (`--cookie-name`) or JWT (`--skip-jwt-bearer-tokens`) if present in the request.
9+ - Configured user info and authentication headers (e.g., `--pass-access-token`) are injected to upstream routes when validation succeeds.
10+
11+2. Unauthenticated Requests: When authentication is missing but required, the user is redirected to the configured Identity Provider (IdP) login page by default.
12+ - Ajax Requests: If the request has `Accept: application/json` header:
13+ - Returns `401 Unauthorized`.
14+ - Invalid JWT Tokens: If `--skip-jwt-bearer-tokens` is set and the request includes an invalid JWT:
15+ - Redirects to the login page by default.
16+ - Returns `403 Forbidden` if `--bearer-token-login-fallback` is set to `false`.
17+
18+3. Post-Authentication: After successful authentication with the IdP, OAuth tokens are stored in the configured session store (cookie or Redis), and a cookie is set.
19+
20+4. Request Forwarding: The authenticated request is processed based on configuration:
21+ - Forwarded to the configured upstream application with added user info and authentication headers, or
22+ - Returns a valid status code for downstream processing by another proxy or load balancer (e.g., Nginx or Traefik).
23+
24+---
25+
26+Note: The proxy also provides a number of useful [endpoints](features/endpoints.md) for monitoring and management.
docs/versioned_docs/version-7.10.x/community/contribution.mdnew file+89
@@ -0,0 +1,89 @@
1+---
2+id: contribution
3+title: Contribution Guide
4+---
5+
6+We track bugs and issues using Github.
7+
8+If you find a bug, please open an Issue. When opening an Issue or Pull Request please follow the preconfigured template and take special note of the checkboxes.
9+
10+If you want to fix a bug, add a new feature or extend existing functionality, please create a fork, create a feature branch and open a PR back to this repo.
11+Please mention open bug issue number(s) within your PR if applicable.
12+
13+We suggest using [Visual Studio Code](https://code.visualstudio.com/docs/languages/go) with the official [Go for Visual Studio Code](https://marketplace.visualstudio.com/items?itemName=golang.go) extension.
14+
15+
16+# Go version
17+
18+This project is currently still using go 1.22. You can follow the installation guide for go [here.](https://go.dev/doc/install) And you can find go version 1.22 in the archived section [here.](https://go.dev/dl/)
19+
20+# Preparing your fork
21+Clone your fork, create a feature branch and update the depedencies to get started.
22+```bash
23+git clone git@github.com:<YOUR_FORK>/oauth2-proxy
24+cd oauth2-proxy
25+git branch feature/<BRANCH_NAME>
26+git push --set-upstream origin feature/<BRANCH_NAME>
27+go mod download
28+```
29+
30+
31+# Testing / Debugging
32+For starting oauth2-proxy locally open the debugging tab and create the `launch.json` and select `Go: Launch Package`.
33+
34+![Debugging Tab](/img/debug-tab.png)
35+```json
36+{
37+ "version": "0.2.0",
38+ "configurations": [
39+ {
40+ "name": "Launch OAuth2-Proxy with Dex",
41+ "type": "go",
42+ "request": "launch",
43+ "mode": "auto",
44+ "program": "${workspaceFolder}",
45+ "args": [
46+ "--config",
47+ // The following configuration contains settings for a locally deployed
48+ // upstream and dex as an idetity provider
49+ "contrib/local-environment/oauth2-proxy.cfg"
50+ ]
51+ },
52+ {
53+ "name": "Launch OAuth2-Proxy with Keycloak",
54+ "type": "go",
55+ "request": "launch",
56+ "mode": "auto",
57+ "program": "${workspaceFolder}",
58+ "args": [
59+ "--config",
60+ // The following configuration contains settings for a locally deployed
61+ // upstream and keycloak as an idetity provider
62+ "contrib/local-environment/oauth2-proxy-keycloak.cfg"
63+ ]
64+ }
65+ ]
66+}
67+```
68+
69+Before you can start your local version of oauth2-proxy, you will have to use the provided docker compose files to start a local upstream service and identity provider. We suggest using [httpbin](https://hub.docker.com/r/kennethreitz/httpbin) as your upstream for testing as it allows for request and response introspection of all things HTTP.
70+
71+Inside the `contrib/local-environment` directory you can use the `Makefile` for
72+starting different example setups:
73+
74+- Dex as your IdP: `make up` or `make down`
75+- Dex as your IdP using the alpha-config: `make alpha-config-up`
76+- Keycloak as your IdP: `make keycloak-up`
77+- Dex as your IdP & nginx reverse proxy: `make nginx-up`
78+- and many more...
79+
80+Check out the `Makefile` to see what is available.
81+
82+The username and password for all setups is usually `admin@example.com` and `password`.
83+
84+The docker compose setups expose the services with a dynamic reverse DNS resolver: localtest.me
85+
86+- OAuth2-Proxy: http://oauth2-proxy.localtest.me:4180
87+- Upstream: http://httpbin.localtest.me:8080
88+- Dex: http://dex.localtest.me:5556
89+
docs/versioned_docs/version-7.10.x/community/security.mdnew file+49
@@ -0,0 +1,49 @@
1+---
2+id: security
3+title: Security
4+---
5+
6+:::note
7+OAuth2 Proxy is a community project.
8+Maintainers do not work on this project full time, and as such,
9+while we endeavour to respond to disclosures as quickly as possible,
10+this may take longer than in projects with corporate sponsorship.
11+:::
12+
13+## Security Disclosures
14+
15+:::important
16+If you believe you have found a vulnerability within OAuth2 Proxy or any of its
17+dependencies, please do NOT open an issue or PR on GitHub, please do NOT post
18+any details publicly.
19+:::
20+
21+Security disclosures MUST be done in private.
22+If you have found an issue that you would like to bring to the attention of the
23+maintenance team for OAuth2 Proxy, please compose an email and send it to the
24+list of maintainers in our [MAINTAINERS](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/MAINTAINERS) file.
25+
26+Please include as much detail as possible.
27+Ideally, your disclosure should include:
28+- A reproducible case that can be used to demonstrate the exploit
29+- How you discovered this vulnerability
30+- A potential fix for the issue (if you have thought of one)
31+- Versions affected (if not present in master)
32+- Your GitHub ID
33+
34+### How will we respond to disclosures?
35+
36+We use [GitHub Security Advisories](https://docs.github.com/en/github/managing-security-vulnerabilities/about-github-security-advisories)
37+to privately discuss fixes for disclosed vulnerabilities.
38+If you include a GitHub ID with your disclosure we will add you as a collaborator
39+for the advisory so that you can join the discussion and validate any fixes
40+we may propose.
41+
42+For minor issues and previously disclosed vulnerabilities (typically for
43+dependencies), we may use regular PRs for fixes and forego the security advisory.
44+
45+Once a fix has been agreed upon, we will merge the fix and create a new release.
46+If we have multiple security issues in flight simultaneously, we may delay
47+merging fixes until all patches are ready.
48+We may also backport the fix to previous releases,
49+but this will be at the discretion of the maintainers.
docs/versioned_docs/version-7.10.x/configuration/alpha_config.mdnew file+564
@@ -0,0 +1,564 @@
1+---
2+id: alpha-config
3+title: Alpha Configuration
4+---
5+
6+:::warning
7+This page contains documentation for alpha features.
8+We reserve the right to make breaking changes to the features detailed within this page with no notice.
9+
10+Options described in this page may be changed, removed, renamed or moved without prior warning.
11+Please beware of this before you use alpha configuration options.
12+:::
13+
14+This page details a set of **alpha** configuration options in a new format.
15+Going forward we are intending to add structured configuration in YAML format to
16+replace the existing TOML based configuration file and flags.
17+
18+Below is a reference for the structure of the configuration, with
19+[AlphaOptions](#alphaoptions) as the root of the configuration.
20+
21+When using alpha configuration, your config file will look something like below:
22+
23+```yaml
24+upstreams:
25+ - id: ...
26+ ...: ...
27+injectRequestHeaders:
28+ - name: ...
29+ ...: ...
30+injectResponseHeaders:
31+ - name: ...
32+ ...: ...
33+```
34+
35+Please browse the [reference](#configuration-reference) below for the structure
36+of the new configuration format.
37+
38+## Using Alpha Configuration
39+
40+To use the new **alpha** configuration, generate a YAML file based on the format
41+described in the [reference](#configuration-reference) below.
42+
43+Provide the path to this file using the `--alpha-config` flag.
44+
45+:::note
46+When using the `--alpha-config` flag, some options are no longer available.
47+See [removed options](#removed-options) below for more information.
48+:::
49+
50+### Converting configuration to the new structure
51+
52+Before adding the new `--alpha-config` option, start OAuth2 Proxy using the
53+`convert-config-to-alpha` flag to convert existing configuration to the new format.
54+
55+```bash
56+oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg
57+```
58+
59+This will convert any options supported by the new format to YAML and print the
60+new configuration to `STDOUT`.
61+
62+Copy this to a new file, remove any options from your existing configuration
63+noted in [removed options](#removed-options) and then start OAuth2 Proxy using
64+the new config.
65+
66+```bash
67+oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg
68+```
69+
70+## Using ENV variables in the alpha configuration
71+
72+The alpha package supports the use of environment variables in place of yaml keys, allowing sensitive values to be pulled from somewhere other than the yaml file.
73+When using environment variables, your yaml will look like this:
74+
75+```yaml
76+ providers:
77+ - provider: azure
78+ clientSecret: ${CLIENT_SECRET}
79+ ...
80+```
81+Where CLIENT_SECRET is an environment variable.
82+More information and available patterns can be found [here](https://github.com/a8m/envsubst#docs)
83+
84+## Removed options
85+
86+The following flags/options and their respective environment variables are no
87+longer available when using alpha configuration:
88+
89+<!-- Legacy Upstream FlagSet -->
90+- `flush-interval`/`flush_interval`
91+- `pass-host-header`/`pass_host_header`
92+- `proxy-websockets`/`proxy_websockets`
93+- `ssl-upstream-insecure-skip-verify`/`ssl_upstream_insecure_skip_verify`
94+- `upstream`/`upstreams`
95+
96+<!-- Legacy Headers FlagSet -->
97+- `pass-basic-auth`/`pass_basic_auth`
98+- `pass-access-token`/`pass_access_token`
99+- `pass-user-headers`/`pass_user_headers`
100+- `pass-authorization-header`/`pass_authorization_header`
101+- `set-basic-auth`/`set_basic_auth`
102+- `set-xauthrequest`/`set_xauthrequest`
103+- `set-authorization-header`/`set_authorization_header`
104+- `prefer-email-to-user`/`prefer_email_to_user`
105+- `basic-auth-password`/`basic_auth_password`
106+- `skip-auth-strip-headers`/`skip_auth_strip_headers`
107+
108+<!-- Legacy provider FlagSet -->
109+- `client-id`/`client_id`
110+- `client-secret`/`client_secret`, and `client-secret-file`/`client_secret_file`
111+- `provider`
112+- `provider-display-name`/`provider_display_name`
113+- `provider-ca-file`/`provider_ca_files`
114+- `login-url`/`login_url`
115+- `redeem-url`/`redeem_url`
116+- `profile-url`/`profile_url`
117+- `resource`
118+- `validate-url`/`validate_url`
119+- `scope`
120+- `prompt`
121+- `approval-prompt`/`approval_prompt`
122+- `acr-values`/`acr_values`
123+- `user-id-claim`/`user_id_claim`
124+- `allowed-group`/`allowed_groups`
125+- `allowed-role`/`allowed_roles`
126+- `jwt-key`/`jwt_key`
127+- `jwt-key-file`/`jwt_key_file`
128+- `pubjwk-url`/`pubjwk_url`
129+
130+and all provider-specific options, i.e. any option whose name includes `oidc`,
131+`azure`, `bitbucket`, `github`, `gitlab`, `google` or `keycloak`. Attempting to
132+use any of these options via flags or via config when `--alpha-config` is
133+set will result in an error.
134+
135+:::important
136+You must remove these options before starting OAuth2 Proxy with `--alpha-config`
137+:::
138+
139+## Configuration Reference
140+
141+<!--- THIS FILE IS AUTOGENERATED!!! DO NOT EDIT!!! -->
142+
143+### ADFSOptions
144+
145+(**Appears on:** [Provider](#provider))
146+
147+
148+
149+| Field | Type | Description |
150+| ----- | ---- | ----------- |
151+| `skipScope` | _bool_ | Skip adding the scope parameter in login request<br/>Default value is 'false' |
152+
153+### AlphaOptions
154+
155+AlphaOptions contains alpha structured configuration options.
156+Usage of these options allows users to access alpha features that are not
157+available as part of the primary configuration structure for OAuth2 Proxy.
158+
159+:::warning
160+The options within this structure are considered alpha.
161+They may change between releases without notice.
162+:::
163+
164+| Field | Type | Description |
165+| ----- | ---- | ----------- |
166+| `upstreamConfig` | _[UpstreamConfig](#upstreamconfig)_ | UpstreamConfig is used to configure upstream servers.<br/>Once a user is authenticated, requests to the server will be proxied to<br/>these upstream servers based on the path mappings defined in this list. |
167+| `injectRequestHeaders` | _[[]Header](#header)_ | InjectRequestHeaders is used to configure headers that should be added<br/>to requests to upstream servers.<br/>Headers may source values from either the authenticated user's session<br/>or from a static secret value. |
168+| `injectResponseHeaders` | _[[]Header](#header)_ | InjectResponseHeaders is used to configure headers that should be added<br/>to responses from the proxy.<br/>This is typically used when using the proxy as an external authentication<br/>provider in conjunction with another proxy such as NGINX and its<br/>auth_request module.<br/>Headers may source values from either the authenticated user's session<br/>or from a static secret value. |
169+| `server` | _[Server](#server)_ | Server is used to configure the HTTP(S) server for the proxy application.<br/>You may choose to run both HTTP and HTTPS servers simultaneously.<br/>This can be done by setting the BindAddress and the SecureBindAddress simultaneously.<br/>To use the secure server you must configure a TLS certificate and key. |
170+| `metricsServer` | _[Server](#server)_ | MetricsServer is used to configure the HTTP(S) server for metrics.<br/>You may choose to run both HTTP and HTTPS servers simultaneously.<br/>This can be done by setting the BindAddress and the SecureBindAddress simultaneously.<br/>To use the secure server you must configure a TLS certificate and key. |
171+| `providers` | _[Providers](#providers)_ | Providers is used to configure your provider. **Multiple-providers is not<br/>yet working.** [This feature is tracked in<br/>#925](https://github.com/oauth2-proxy/oauth2-proxy/issues/926) |
172+
173+### AzureOptions
174+
175+(**Appears on:** [Provider](#provider))
176+
177+
178+
179+| Field | Type | Description |
180+| ----- | ---- | ----------- |
181+| `tenant` | _string_ | Tenant directs to a tenant-specific or common (tenant-independent) endpoint<br/>Default value is 'common' |
182+| `graphGroupField` | _string_ | GraphGroupField configures the group field to be used when building the groups list from Microsoft Graph<br/>Default value is 'id' |
183+
184+### BitbucketOptions
185+
186+(**Appears on:** [Provider](#provider))
187+
188+
189+
190+| Field | Type | Description |
191+| ----- | ---- | ----------- |
192+| `team` | _string_ | Team sets restrict logins to members of this team |
193+| `repository` | _string_ | Repository sets restrict logins to user with access to this repository |
194+
195+### ClaimSource
196+
197+(**Appears on:** [HeaderValue](#headervalue))
198+
199+ClaimSource allows loading a header value from a claim within the session
200+
201+| Field | Type | Description |
202+| ----- | ---- | ----------- |
203+| `claim` | _string_ | Claim is the name of the claim in the session that the value should be<br/>loaded from. Available claims: `access_token` `id_token` `created_at`<br/>`expires_on` `refresh_token` `email` `user` `groups` `preferred_username`. |
204+| `prefix` | _string_ | Prefix is an optional prefix that will be prepended to the value of the<br/>claim if it is non-empty. |
205+| `basicAuthPassword` | _[SecretSource](#secretsource)_ | BasicAuthPassword converts this claim into a basic auth header.<br/>Note the value of claim will become the basic auth username and the<br/>basicAuthPassword will be used as the password value. |
206+
207+### Duration
208+#### (`string` alias)
209+
210+(**Appears on:** [Upstream](#upstream))
211+
212+Duration is as string representation of a period of time.
213+A duration string is a is a possibly signed sequence of decimal numbers,
214+each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".
215+Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
216+
217+### GitHubOptions
218+
219+(**Appears on:** [Provider](#provider))
220+
221+
222+
223+| Field | Type | Description |
224+| ----- | ---- | ----------- |
225+| `org` | _string_ | Org sets restrict logins to members of this organisation |
226+| `team` | _string_ | Team sets restrict logins to members of this team |
227+| `repo` | _string_ | Repo sets restrict logins to collaborators of this repository |
228+| `token` | _string_ | Token is the token to use when verifying repository collaborators<br/>it must have push access to the repository |
229+| `users` | _[]string_ | Users allows users with these usernames to login<br/>even if they do not belong to the specified org and team or collaborators |
230+
231+### GitLabOptions
232+
233+(**Appears on:** [Provider](#provider))
234+
235+
236+
237+| Field | Type | Description |
238+| ----- | ---- | ----------- |
239+| `group` | _[]string_ | Group sets restrict logins to members of this group |
240+| `projects` | _[]string_ | Projects restricts logins to members of these projects |
241+
242+### GoogleOptions
243+
244+(**Appears on:** [Provider](#provider))
245+
246+
247+
248+| Field | Type | Description |
249+| ----- | ---- | ----------- |
250+| `group` | _[]string_ | Groups sets restrict logins to members of this Google group |
251+| `adminEmail` | _string_ | AdminEmail is the Google admin to impersonate for api calls |
252+| `serviceAccountJson` | _string_ | ServiceAccountJSON is the path to the service account json credentials |
253+| `useApplicationDefaultCredentials` | _bool_ | UseApplicationDefaultCredentials is a boolean whether to use Application Default Credentials instead of a ServiceAccountJSON |
254+| `targetPrincipal` | _string_ | TargetPrincipal is the Google Service Account used for Application Default Credentials |
255+
256+### Header
257+
258+(**Appears on:** [AlphaOptions](#alphaoptions))
259+
260+Header represents an individual header that will be added to a request or
261+response header.
262+
263+| Field | Type | Description |
264+| ----- | ---- | ----------- |
265+| `name` | _string_ | Name is the header name to be used for this set of values.<br/>Names should be unique within a list of Headers. |
266+| `preserveRequestValue` | _bool_ | PreserveRequestValue determines whether any values for this header<br/>should be preserved for the request to the upstream server.<br/>This option only applies to injected request headers.<br/>Defaults to false (headers that match this header will be stripped). |
267+| `values` | _[[]HeaderValue](#headervalue)_ | Values contains the desired values for this header |
268+
269+### HeaderValue
270+
271+(**Appears on:** [Header](#header))
272+
273+HeaderValue represents a single header value and the sources that can
274+make up the header value
275+
276+| Field | Type | Description |
277+| ----- | ---- | ----------- |
278+| `value` | _[]byte_ | Value expects a base64 encoded string value. |
279+| `fromEnv` | _string_ | FromEnv expects the name of an environment variable. |
280+| `fromFile` | _string_ | FromFile expects a path to a file containing the secret value. |
281+| `claim` | _string_ | Claim is the name of the claim in the session that the value should be<br/>loaded from. Available claims: `access_token` `id_token` `created_at`<br/>`expires_on` `refresh_token` `email` `user` `groups` `preferred_username`. |
282+| `prefix` | _string_ | Prefix is an optional prefix that will be prepended to the value of the<br/>claim if it is non-empty. |
283+| `basicAuthPassword` | _[SecretSource](#secretsource)_ | BasicAuthPassword converts this claim into a basic auth header.<br/>Note the value of claim will become the basic auth username and the<br/>basicAuthPassword will be used as the password value. |
284+
285+### KeycloakOptions
286+
287+(**Appears on:** [Provider](#provider))
288+
289+
290+
291+| Field | Type | Description |
292+| ----- | ---- | ----------- |
293+| `groups` | _[]string_ | Group enables to restrict login to members of indicated group |
294+| `roles` | _[]string_ | Role enables to restrict login to users with role (only available when using the keycloak-oidc provider) |
295+
296+### LoginGovOptions
297+
298+(**Appears on:** [Provider](#provider))
299+
300+
301+
302+| Field | Type | Description |
303+| ----- | ---- | ----------- |
304+| `jwtKey` | _string_ | JWTKey is a private key in PEM format used to sign JWT, |
305+| `jwtKeyFile` | _string_ | JWTKeyFile is a path to the private key file in PEM format used to sign the JWT |
306+| `pubjwkURL` | _string_ | PubJWKURL is the JWK pubkey access endpoint |
307+
308+### LoginURLParameter
309+
310+(**Appears on:** [Provider](#provider))
311+
312+LoginURLParameter is the configuration for a single query parameter that
313+can be passed through from the `/oauth2/start` endpoint to the IdP login
314+URL. The "default" option specifies the default value or values (if any)
315+that will be passed to the IdP for this parameter, and "allow" is a list
316+of options for ways in which this parameter can be set or overridden via
317+the query string to `/oauth2/start`.
318+If _only_ a default is specified and no "allow" then the parameter is
319+effectively fixed - the default value will always be used and anything
320+passed to the start URL will be ignored. If _only_ "allow" is specified
321+but no default then the parameter will only be passed on to the IdP if
322+the caller provides it, and no value will be sent otherwise.
323+
324+Examples:
325+
326+# A parameter whose value is fixed
327+
328+```
329+name: organization
330+default:
331+- myorg
332+```
333+
334+A parameter that is not passed by default, but may be set to one of a
335+fixed set of values
336+
337+```
338+name: prompt
339+allow:
340+- value: login
341+- value: consent
342+- value: select_account
343+```
344+
345+A parameter that is passed by default but may be overridden by one of
346+a fixed set of values
347+
348+```
349+name: prompt
350+default: ["login"]
351+allow:
352+- value: consent
353+- value: select_account
354+```
355+
356+A parameter that may be overridden, but only by values that match a
357+regular expression. For example to restrict `login_hint` to email
358+addresses in your organization's domain:
359+
360+```
361+name: login_hint
362+allow:
363+- pattern: '^[^@]*@example\.com$'
364+# this allows at most one "@" sign, and requires "example.com" domain.
365+```
366+
367+Note that the YAML rules around exactly which characters are allowed
368+and/or require escaping in different types of string literals are
369+convoluted. For regular expressions the single quoted form is simplest
370+as backslash is not considered to be an escape character. Alternatively
371+use the "chomped block" format `|-`:
372+
373+```
374+ - pattern: |-
375+ ^[^@]*@example\.com$
376+
377+```
378+
379+The hyphen is important, a `|` block would have a trailing newline
380+character.
381+
382+| Field | Type | Description |
383+| ----- | ---- | ----------- |
384+| `name` | _string_ | Name specifies the name of the query parameter. |
385+| `default` | _[]string_ | _(Optional)_ Default specifies a default value or values that will be<br/>passed to the IdP if not overridden. |
386+| `allow` | _[[]URLParameterRule](#urlparameterrule)_ | _(Optional)_ Allow specifies rules about how the default (if any) may be<br/>overridden via the query string to `/oauth2/start`. Only<br/>values that match one or more of the allow rules will be<br/>forwarded to the IdP. |
387+
388+### MicrosoftEntraIDOptions
389+
390+(**Appears on:** [Provider](#provider))
391+
392+
393+
394+| Field | Type | Description |
395+| ----- | ---- | ----------- |
396+| `allowedTenants` | _[]string_ | AllowedTenants is a list of allowed tenants. In case of multi-tenant apps, incoming tokens are<br/>issued by different issuers and OIDC issuer verification needs to be disabled.<br/>When not specified, all tenants are allowed. Redundant for single-tenant apps<br/>(regular ID token validation matches the issuer). |
397+| `federatedTokenAuth` | _bool_ | FederatedTokenAuth enable oAuth2 client authentication with federated token projected<br/>by Entra Workload Identity plugin, instead of client secret. |
398+
399+### OIDCOptions
400+
401+(**Appears on:** [Provider](#provider))
402+
403+
404+
405+| Field | Type | Description |
406+| ----- | ---- | ----------- |
407+| `issuerURL` | _string_ | IssuerURL is the OpenID Connect issuer URL<br/>eg: https://accounts.google.com |
408+| `insecureAllowUnverifiedEmail` | _bool_ | InsecureAllowUnverifiedEmail prevents failures if an email address in an id_token is not verified<br/>default set to 'false' |
409+| `insecureSkipIssuerVerification` | _bool_ | InsecureSkipIssuerVerification skips verification of ID token issuers. When false, ID Token Issuers must match the OIDC discovery URL<br/>default set to 'false' |
410+| `insecureSkipNonce` | _bool_ | InsecureSkipNonce skips verifying the ID Token's nonce claim that must match<br/>the random nonce sent in the initial OAuth flow. Otherwise, the nonce is checked<br/>after the initial OAuth redeem & subsequent token refreshes.<br/>default set to 'true'<br/>Warning: In a future release, this will change to 'false' by default for enhanced security. |
411+| `skipDiscovery` | _bool_ | SkipDiscovery allows to skip OIDC discovery and use manually supplied Endpoints<br/>default set to 'false' |
412+| `jwksURL` | _string_ | JwksURL is the OpenID Connect JWKS URL<br/>eg: https://www.googleapis.com/oauth2/v3/certs |
413+| `publicKeyFiles` | _[]string_ | PublicKeyFiles is a list of paths pointing to public key files in PEM format to use<br/>for verifying JWT tokens |
414+| `emailClaim` | _string_ | EmailClaim indicates which claim contains the user email,<br/>default set to 'email' |
415+| `groupsClaim` | _string_ | GroupsClaim indicates which claim contains the user groups<br/>default set to 'groups' |
416+| `userIDClaim` | _string_ | UserIDClaim indicates which claim contains the user ID<br/>default set to 'email' |
417+| `audienceClaims` | _[]string_ | AudienceClaim allows to define any claim that is verified against the client id<br/>By default `aud` claim is used for verification. |
418+| `extraAudiences` | _[]string_ | ExtraAudiences is a list of additional audiences that are allowed<br/>to pass verification in addition to the client id. |
419+
420+### Provider
421+
422+(**Appears on:** [Providers](#providers))
423+
424+Provider holds all configuration for a single provider
425+
426+| Field | Type | Description |
427+| ----- | ---- | ----------- |
428+| `clientID` | _string_ | ClientID is the OAuth Client ID that is defined in the provider<br/>This value is required for all providers. |
429+| `clientSecret` | _string_ | ClientSecret is the OAuth Client Secret that is defined in the provider<br/>This value is required for all providers. |
430+| `clientSecretFile` | _string_ | ClientSecretFile is the name of the file<br/>containing the OAuth Client Secret, it will be used if ClientSecret is not set. |
431+| `keycloakConfig` | _[KeycloakOptions](#keycloakoptions)_ | KeycloakConfig holds all configurations for Keycloak provider. |
432+| `azureConfig` | _[AzureOptions](#azureoptions)_ | AzureConfig holds all configurations for Azure provider. |
433+| `microsoftEntraIDConfig` | _[MicrosoftEntraIDOptions](#microsoftentraidoptions)_ | MicrosoftEntraIDConfig holds all configurations for Entra ID provider. |
434+| `ADFSConfig` | _[ADFSOptions](#adfsoptions)_ | ADFSConfig holds all configurations for ADFS provider. |
435+| `bitbucketConfig` | _[BitbucketOptions](#bitbucketoptions)_ | BitbucketConfig holds all configurations for Bitbucket provider. |
436+| `githubConfig` | _[GitHubOptions](#githuboptions)_ | GitHubConfig holds all configurations for GitHubC provider. |
437+| `gitlabConfig` | _[GitLabOptions](#gitlaboptions)_ | GitLabConfig holds all configurations for GitLab provider. |
438+| `googleConfig` | _[GoogleOptions](#googleoptions)_ | GoogleConfig holds all configurations for Google provider. |
439+| `oidcConfig` | _[OIDCOptions](#oidcoptions)_ | OIDCConfig holds all configurations for OIDC provider<br/>or providers utilize OIDC configurations. |
440+| `loginGovConfig` | _[LoginGovOptions](#logingovoptions)_ | LoginGovConfig holds all configurations for LoginGov provider. |
441+| `id` | _string_ | ID should be a unique identifier for the provider.<br/>This value is required for all providers. |
442+| `provider` | _[ProviderType](#providertype)_ | Type is the OAuth provider<br/>must be set from the supported providers group,<br/>otherwise 'Google' is set as default |
443+| `name` | _string_ | Name is the providers display name<br/>if set, it will be shown to the users in the login page. |
444+| `caFiles` | _[]string_ | CAFiles is a list of paths to CA certificates that should be used when connecting to the provider.<br/>If not specified, the default Go trust sources are used instead |
445+| `useSystemTrustStore` | _bool_ | UseSystemTrustStore determines if your custom CA files and the system trust store are used<br/>If set to true, your custom CA files and the system trust store are used otherwise only your custom CA files. |
446+| `loginURL` | _string_ | LoginURL is the authentication endpoint |
447+| `loginURLParameters` | _[[]LoginURLParameter](#loginurlparameter)_ | LoginURLParameters defines the parameters that can be passed from the start URL to the IdP login URL |
448+| `authRequestResponseMode` | _string_ | AuthRequestResponseMode defines the response mode to request during authorization request |
449+| `redeemURL` | _string_ | RedeemURL is the token redemption endpoint |
450+| `profileURL` | _string_ | ProfileURL is the profile access endpoint |
451+| `skipClaimsFromProfileURL` | _bool_ | SkipClaimsFromProfileURL allows to skip request to Profile URL for resolving claims not present in id_token<br/>default set to 'false' |
452+| `resource` | _string_ | ProtectedResource is the resource that is protected (Azure AD and ADFS only) |
453+| `validateURL` | _string_ | ValidateURL is the access token validation endpoint |
454+| `scope` | _string_ | Scope is the OAuth scope specification |
455+| `allowedGroups` | _[]string_ | AllowedGroups is a list of restrict logins to members of this group |
456+| `code_challenge_method` | _string_ | The code challenge method |
457+| `backendLogoutURL` | _string_ | URL to call to perform backend logout, `{id_token}` would be replaced by the actual `id_token` if available in the session |
458+
459+### ProviderType
460+#### (`string` alias)
461+
462+(**Appears on:** [Provider](#provider))
463+
464+ProviderType is used to enumerate the different provider type options
465+Valid options are: adfs, azure, bitbucket, digitalocean facebook, github,
466+gitlab, google, keycloak, keycloak-oidc, linkedin, login.gov, nextcloud
467+and oidc.
468+
469+### Providers
470+
471+#### ([[]Provider](#provider) alias)
472+
473+(**Appears on:** [AlphaOptions](#alphaoptions))
474+
475+The provider can be selected using the `provider` configuration value, or
476+set in the [`providers` array using
477+AlphaConfig](https://oauth2-proxy.github.io/oauth2-proxy/configuration/alpha-config#providers).
478+However, [**the feature to implement multiple providers is not
479+complete**](https://github.com/oauth2-proxy/oauth2-proxy/issues/926).
480+
481+### SecretSource
482+
483+(**Appears on:** [ClaimSource](#claimsource), [HeaderValue](#headervalue), [TLS](#tls))
484+
485+SecretSource references an individual secret value.
486+Only one source within the struct should be defined at any time.
487+
488+| Field | Type | Description |
489+| ----- | ---- | ----------- |
490+| `value` | _[]byte_ | Value expects a base64 encoded string value. |
491+| `fromEnv` | _string_ | FromEnv expects the name of an environment variable. |
492+| `fromFile` | _string_ | FromFile expects a path to a file containing the secret value. |
493+
494+### Server
495+
496+(**Appears on:** [AlphaOptions](#alphaoptions))
497+
498+Server represents the configuration for an HTTP(S) server
499+
500+| Field | Type | Description |
501+| ----- | ---- | ----------- |
502+| `BindAddress` | _string_ | BindAddress is the address on which to serve traffic.<br/>Leave blank or set to "-" to disable. |
503+| `SecureBindAddress` | _string_ | SecureBindAddress is the address on which to serve secure traffic.<br/>Leave blank or set to "-" to disable. |
504+| `TLS` | _[TLS](#tls)_ | TLS contains the information for loading the certificate and key for the<br/>secure traffic and further configuration for the TLS server. |
505+
506+### TLS
507+
508+(**Appears on:** [Server](#server))
509+
510+TLS contains the information for loading a TLS certificate and key
511+as well as an optional minimal TLS version that is acceptable.
512+
513+| Field | Type | Description |
514+| ----- | ---- | ----------- |
515+| `Key` | _[SecretSource](#secretsource)_ | Key is the TLS key data to use.<br/>Typically this will come from a file. |
516+| `Cert` | _[SecretSource](#secretsource)_ | Cert is the TLS certificate data to use.<br/>Typically this will come from a file. |
517+| `MinVersion` | _string_ | MinVersion is the minimal TLS version that is acceptable.<br/>E.g. Set to "TLS1.3" to select TLS version 1.3 |
518+| `CipherSuites` | _[]string_ | CipherSuites is a list of TLS cipher suites that are allowed.<br/>E.g.:<br/>- TLS_RSA_WITH_RC4_128_SHA<br/>- TLS_RSA_WITH_AES_256_GCM_SHA384<br/>If not specified, the default Go safe cipher list is used.<br/>List of valid cipher suites can be found in the [crypto/tls documentation](https://pkg.go.dev/crypto/tls#pkg-constants). |
519+
520+### URLParameterRule
521+
522+(**Appears on:** [LoginURLParameter](#loginurlparameter))
523+
524+URLParameterRule represents a rule by which query parameters
525+passed to the `/oauth2/start` endpoint are checked to determine whether
526+they are valid overrides for the given parameter passed to the IdP's
527+login URL. Either Value or Pattern should be supplied, not both.
528+
529+| Field | Type | Description |
530+| ----- | ---- | ----------- |
531+| `value` | _string_ | A Value rule matches just this specific value |
532+| `pattern` | _string_ | A Pattern rule gives a regular expression that must be matched by<br/>some substring of the value. The expression is _not_ automatically<br/>anchored to the start and end of the value, if you _want_ to restrict<br/>the whole parameter value you must anchor it yourself with `^` and `$`. |
533+
534+### Upstream
535+
536+(**Appears on:** [UpstreamConfig](#upstreamconfig))
537+
538+Upstream represents the configuration for an upstream server.
539+Requests will be proxied to this upstream if the path matches the request path.
540+
541+| Field | Type | Description |
542+| ----- | ---- | ----------- |
543+| `id` | _string_ | ID should be a unique identifier for the upstream.<br/>This value is required for all upstreams. |
544+| `path` | _string_ | Path is used to map requests to the upstream server.<br/>The closest match will take precedence and all Paths must be unique.<br/>Path can also take a pattern when used with RewriteTarget.<br/>Path segments can be captured and matched using regular experessions.<br/>Eg:<br/>- `^/foo$`: Match only the explicit path `/foo`<br/>- `^/bar/$`: Match any path prefixed with `/bar/`<br/>- `^/baz/(.*)$`: Match any path prefixed with `/baz` and capture the remaining path for use with RewriteTarget |
545+| `rewriteTarget` | _string_ | RewriteTarget allows users to rewrite the request path before it is sent to<br/>the upstream server (for an HTTP/HTTPS upstream) or mapped to the filesystem<br/>(for a `file:` upstream).<br/>Use the Path to capture segments for reuse within the rewrite target.<br/>Eg: With a Path of `^/baz/(.*)`, a RewriteTarget of `/foo/$1` would rewrite<br/>the request `/baz/abc/123` to `/foo/abc/123` before proxying to the<br/>upstream server. Or if the upstream were `file:///app`, a request for<br/>`/baz/info.html` would return the contents of the file `/app/foo/info.html`. |
546+| `uri` | _string_ | The URI of the upstream server. This may be an HTTP(S) server of a File<br/>based URL. It may include a path, in which case all requests will be served<br/>under that path.<br/>Eg:<br/>- http://localhost:8080<br/>- https://service.localhost<br/>- https://service.localhost/path<br/>- file://host/path<br/>If the URI's path is "/base" and the incoming request was for "/dir",<br/>the upstream request will be for "/base/dir". |
547+| `insecureSkipTLSVerify` | _bool_ | InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.<br/>This option is insecure and will allow potential Man-In-The-Middle attacks<br/>between OAuth2 Proxy and the upstream server.<br/>Defaults to false. |
548+| `static` | _bool_ | Static will make all requests to this upstream have a static response.<br/>The response will have a body of "Authenticated" and a response code<br/>matching StaticCode.<br/>If StaticCode is not set, the response will return a 200 response. |
549+| `staticCode` | _int_ | StaticCode determines the response code for the Static response.<br/>This option can only be used with Static enabled. |
550+| `flushInterval` | _[Duration](#duration)_ | FlushInterval is the period between flushing the response buffer when<br/>streaming response from the upstream.<br/>Defaults to 1 second. |
551+| `passHostHeader` | _bool_ | PassHostHeader determines whether the request host header should be proxied<br/>to the upstream server.<br/>Defaults to true. |
552+| `proxyWebSockets` | _bool_ | ProxyWebSockets enables proxying of websockets to upstream servers<br/>Defaults to true. |
553+| `timeout` | _[Duration](#duration)_ | Timeout is the maximum duration the server will wait for a response from the upstream server.<br/>Defaults to 30 seconds. |
554+
555+### UpstreamConfig
556+
557+(**Appears on:** [AlphaOptions](#alphaoptions))
558+
559+UpstreamConfig is a collection of definitions for upstream servers.
560+
561+| Field | Type | Description |
562+| ----- | ---- | ----------- |
563+| `proxyRawPath` | _bool_ | ProxyRawPath will pass the raw url path to upstream allowing for urls<br/>like: "/%2F/" which would otherwise be redirected to "/" |
564+| `upstreams` | _[[]Upstream](#upstream)_ | Upstreams represents the configuration for the upstream servers.<br/>Requests will be proxied to this upstream if the path matches the request path. |
docs/versioned_docs/version-7.10.x/configuration/alpha_config.md.tmplnew file+139
@@ -0,0 +1,139 @@
1+---
2+id: alpha-config
3+title: Alpha Configuration
4+---
5+
6+:::warning
7+This page contains documentation for alpha features.
8+We reserve the right to make breaking changes to the features detailed within this page with no notice.
9+
10+Options described in this page may be changed, removed, renamed or moved without prior warning.
11+Please beware of this before you use alpha configuration options.
12+:::
13+
14+This page details a set of **alpha** configuration options in a new format.
15+Going forward we are intending to add structured configuration in YAML format to
16+replace the existing TOML based configuration file and flags.
17+
18+Below is a reference for the structure of the configuration, with
19+[AlphaOptions](#alphaoptions) as the root of the configuration.
20+
21+When using alpha configuration, your config file will look something like below:
22+
23+```yaml
24+upstreams:
25+ - id: ...
26+ ...: ...
27+injectRequestHeaders:
28+ - name: ...
29+ ...: ...
30+injectResponseHeaders:
31+ - name: ...
32+ ...: ...
33+```
34+
35+Please browse the [reference](#configuration-reference) below for the structure
36+of the new configuration format.
37+
38+## Using Alpha Configuration
39+
40+To use the new **alpha** configuration, generate a YAML file based on the format
41+described in the [reference](#configuration-reference) below.
42+
43+Provide the path to this file using the `--alpha-config` flag.
44+
45+:::note
46+When using the `--alpha-config` flag, some options are no longer available.
47+See [removed options](#removed-options) below for more information.
48+:::
49+
50+### Converting configuration to the new structure
51+
52+Before adding the new `--alpha-config` option, start OAuth2 Proxy using the
53+`convert-config-to-alpha` flag to convert existing configuration to the new format.
54+
55+```bash
56+oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg
57+```
58+
59+This will convert any options supported by the new format to YAML and print the
60+new configuration to `STDOUT`.
61+
62+Copy this to a new file, remove any options from your existing configuration
63+noted in [removed options](#removed-options) and then start OAuth2 Proxy using
64+the new config.
65+
66+```bash
67+oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg
68+```
69+
70+## Using ENV variables in the alpha configuration
71+
72+The alpha package supports the use of environment variables in place of yaml keys, allowing sensitive values to be pulled from somewhere other than the yaml file.
73+When using environment variables, your yaml will look like this:
74+
75+```yaml
76+ providers:
77+ - provider: azure
78+ clientSecret: ${CLIENT_SECRET}
79+ ...
80+```
81+Where CLIENT_SECRET is an environment variable.
82+More information and available patterns can be found [here](https://github.com/a8m/envsubst#docs)
83+
84+## Removed options
85+
86+The following flags/options and their respective environment variables are no
87+longer available when using alpha configuration:
88+
89+<!-- Legacy Upstream FlagSet -->
90+- `flush-interval`/`flush_interval`
91+- `pass-host-header`/`pass_host_header`
92+- `proxy-websockets`/`proxy_websockets`
93+- `ssl-upstream-insecure-skip-verify`/`ssl_upstream_insecure_skip_verify`
94+- `upstream`/`upstreams`
95+
96+<!-- Legacy Headers FlagSet -->
97+- `pass-basic-auth`/`pass_basic_auth`
98+- `pass-access-token`/`pass_access_token`
99+- `pass-user-headers`/`pass_user_headers`
100+- `pass-authorization-header`/`pass_authorization_header`
101+- `set-basic-auth`/`set_basic_auth`
102+- `set-xauthrequest`/`set_xauthrequest`
103+- `set-authorization-header`/`set_authorization_header`
104+- `prefer-email-to-user`/`prefer_email_to_user`
105+- `basic-auth-password`/`basic_auth_password`
106+- `skip-auth-strip-headers`/`skip_auth_strip_headers`
107+
108+<!-- Legacy provider FlagSet -->
109+- `client-id`/`client_id`
110+- `client-secret`/`client_secret`, and `client-secret-file`/`client_secret_file`
111+- `provider`
112+- `provider-display-name`/`provider_display_name`
113+- `provider-ca-file`/`provider_ca_files`
114+- `login-url`/`login_url`
115+- `redeem-url`/`redeem_url`
116+- `profile-url`/`profile_url`
117+- `resource`
118+- `validate-url`/`validate_url`
119+- `scope`
120+- `prompt`
121+- `approval-prompt`/`approval_prompt`
122+- `acr-values`/`acr_values`
123+- `user-id-claim`/`user_id_claim`
124+- `allowed-group`/`allowed_groups`
125+- `allowed-role`/`allowed_roles`
126+- `jwt-key`/`jwt_key`
127+- `jwt-key-file`/`jwt_key_file`
128+- `pubjwk-url`/`pubjwk_url`
129+
130+and all provider-specific options, i.e. any option whose name includes `oidc`,
131+`azure`, `bitbucket`, `github`, `gitlab`, `google` or `keycloak`. Attempting to
132+use any of these options via flags or via config when `--alpha-config` is
133+set will result in an error.
134+
135+:::important
136+You must remove these options before starting OAuth2 Proxy with `--alpha-config`
137+:::
138+
139+## Configuration Reference
docs/versioned_docs/version-7.10.x/configuration/integration.mdnew file+386
@@ -0,0 +1,386 @@
1+---
2+id: integration
3+title: Integration
4+---
5+
6+## Configuring for use with the Nginx `auth_request` directive
7+
8+**This option requires `--reverse-proxy` option to be set.**
9+
10+The [Nginx `auth_request` directive](http://nginx.org/en/docs/http/ngx_http_auth_request_module.html) allows Nginx to authenticate requests via the oauth2-proxy's `/auth` endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:
11+
12+```nginx
13+server {
14+ listen 443 ssl;
15+ server_name ...;
16+ include ssl/ssl.conf;
17+
18+ location /oauth2/ {
19+ proxy_pass http://127.0.0.1:4180;
20+ proxy_set_header Host $host;
21+ proxy_set_header X-Real-IP $remote_addr;
22+ proxy_set_header X-Auth-Request-Redirect $request_uri;
23+ # or, if you are handling multiple domains:
24+ # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
25+ }
26+ location = /oauth2/auth {
27+ proxy_pass http://127.0.0.1:4180;
28+ proxy_set_header Host $host;
29+ proxy_set_header X-Real-IP $remote_addr;
30+ proxy_set_header X-Forwarded-Uri $request_uri;
31+ # nginx auth_request includes headers but not body
32+ proxy_set_header Content-Length "";
33+ proxy_pass_request_body off;
34+ }
35+
36+ # Named location for handling OAuth2 sign-in redirects
37+ # This ensures the browser receives a proper 302 redirect that it will follow
38+ location @oauth2_signin {
39+ return 302 /oauth2/sign_in?rd=$scheme://$host$request_uri;
40+ }
41+
42+ location / {
43+ auth_request /oauth2/auth;
44+ error_page 401 = @oauth2_signin;
45+
46+ # pass information via X-User and X-Email headers to backend,
47+ # requires running with --set-xauthrequest flag
48+ auth_request_set $user $upstream_http_x_auth_request_user;
49+ auth_request_set $email $upstream_http_x_auth_request_email;
50+ proxy_set_header X-User $user;
51+ proxy_set_header X-Email $email;
52+
53+ # if you enabled --pass-access-token, this will pass the token to the backend
54+ auth_request_set $token $upstream_http_x_auth_request_access_token;
55+ proxy_set_header X-Access-Token $token;
56+
57+ # if you enabled --cookie-refresh, this is needed for it to work with auth_request
58+ auth_request_set $auth_cookie $upstream_http_set_cookie;
59+ add_header Set-Cookie $auth_cookie;
60+
61+ # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
62+ # limit and so the OAuth2 Proxy splits these into multiple parts.
63+ # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
64+ # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
65+ auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;
66+
67+ # Extract the Cookie attributes from the first Set-Cookie header and append them
68+ # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
69+ if ($auth_cookie ~* "(; .*)") {
70+ set $auth_cookie_name_0 $auth_cookie;
71+ set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
72+ }
73+
74+ # Send both Set-Cookie headers now if there was a second part
75+ if ($auth_cookie_name_upstream_1) {
76+ add_header Set-Cookie $auth_cookie_name_0;
77+ add_header Set-Cookie $auth_cookie_name_1;
78+ }
79+
80+ proxy_pass http://backend/;
81+ # or "root /path/to/site;" or "fastcgi_pass ..." etc
82+ }
83+}
84+```
85+
86+### Understanding the `error_page` redirect pattern
87+
88+The `auth_request` directive expects the authentication endpoint (`/oauth2/auth`) to return:
89+- **2xx**: Request is authenticated, allow access
90+- **401 or 403**: Request is not authenticated, deny access
91+
92+When a 401 is returned, nginx triggers the `error_page` directive. The recommended pattern uses a **named location** (`@oauth2_signin`) that returns a proper **302 redirect**:
93+
94+
95+```nginx
96+error_page 401 = @oauth2_signin;
97+
98+location @oauth2_signin {
99+ return 302 /oauth2/sign_in?rd=$scheme://$host$request_uri;
100+}
101+```
102+
103+:::warning Avoid `error_page 401 =403` with sign_in
104+Some older configurations use `error_page 401 =403 /oauth2/sign_in`. While this works for displaying the sign-in page, it returns a **403 status code** with a `Location` header. Browsers do not automatically follow redirects on 403 responses, which can cause issues when using `--skip-provider-button=true` (users see a "Found." link instead of being automatically redirected).
105+
106+The named location pattern above ensures the browser receives a standard **302 redirect** that works correctly with all oauth2-proxy configurations.
107+:::
108+
109+### Browser vs API Routes
110+
111+:::important When to use redirects
112+Redirecting authentication failures (302 to `/oauth2/sign_in`) should **only be used for browser-facing routes**. API or machine clients should receive a plain 401/403 response without redirect.
113+:::
114+
115+#### Browser-facing routes (HTML, UI)
116+
117+For interactive browser routes where users should be redirected to sign in:
118+
119+```nginx
120+location / {
121+ auth_request /oauth2/auth;
122+ error_page 401 = @oauth2_signin;
123+ proxy_pass http://backend/;
124+}
125+
126+location @oauth2_signin {
127+ return 302 /oauth2/sign_in?rd=$scheme://$host$request_uri;
128+}
129+```
130+
131+#### API / Machine routes (no redirect)
132+
133+For API endpoints where clients expect a 401/403 status code (not a redirect):
134+
135+```nginx
136+location /api/ {
137+ auth_request /oauth2/auth;
138+ error_page 401 =401; # Pass through the 401 status
139+ proxy_pass http://backend/;
140+}
141+```
142+
143+This ensures:
144+- ✅ Browsers get a redirect and smooth login flow
145+- ✅ API clients fail fast with appropriate HTTP status codes
146+- ✅ `/oauth2/auth` remains a pure boolean oracle (2xx/401)
147+
148+When you use ingress-nginx in Kubernetes, you can configure the same behavior with the following annotations on your Ingress resource:
149+
150+```yaml
151+nginx.ingress.kubernetes.io/auth-url: "https://<oauth2-proxy-fqdn>/oauth2/auth"
152+nginx.ingress.kubernetes.io/auth-signin: "https://<oauth2-proxy-fqdn>/oauth2/start?rd=$escaped_request_uri"
153+```
154+
155+This minimal configuration works for standard authentication flows. Lua/cookie handling is only needed for advanced scenarios (e.g., multi-part cookies, custom session logic). See the official ingress-nginx example: https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth/.
156+
157+It is recommended to use `--session-store-type=redis` when expecting large sessions/OIDC tokens (_e.g._ with MS Azure).
158+
159+You have to substitute *name* with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".
160+
161+## Configuring for use with the Traefik (v2) `ForwardAuth` middleware
162+
163+**This option requires `--reverse-proxy` option to be set.**
164+
165+### ForwardAuth with 401 errors middleware
166+
167+The [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/http/forwardauth/) allows Traefik to authenticate requests via the oauth2-proxy's `/oauth2/auth` endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:
168+
169+```yaml
170+http:
171+ routers:
172+ a-service:
173+ rule: "Host(`a-service.example.com`)"
174+ service: a-service-backend
175+ middlewares:
176+ - oauth-errors
177+ - oauth-auth
178+ tls:
179+ certResolver: default
180+ domains:
181+ - main: "example.com"
182+ sans:
183+ - "*.example.com"
184+ oauth:
185+ rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"
186+ middlewares:
187+ - auth-headers
188+ service: oauth-backend
189+ tls:
190+ certResolver: default
191+ domains:
192+ - main: "example.com"
193+ sans:
194+ - "*.example.com"
195+
196+ services:
197+ a-service-backend:
198+ loadBalancer:
199+ servers:
200+ - url: http://172.16.0.2:7555
201+ oauth-backend:
202+ loadBalancer:
203+ servers:
204+ - url: http://172.16.0.1:4180
205+
206+ middlewares:
207+ auth-headers:
208+ headers:
209+ sslRedirect: true
210+ stsSeconds: 315360000
211+ browserXssFilter: true
212+ contentTypeNosniff: true
213+ forceSTSHeader: true
214+ sslHost: example.com
215+ stsIncludeSubdomains: true
216+ stsPreload: true
217+ frameDeny: true
218+ oauth-auth:
219+ forwardAuth:
220+ address: https://oauth.example.com/oauth2/auth
221+ trustForwardHeader: true
222+ oauth-errors:
223+ errors:
224+ status:
225+ - "401-403"
226+ service: oauth-backend
227+ query: "/oauth2/sign_in?rd={url}"
228+ statusRewrites:
229+ "401": 302
230+```
231+
232+:::info Troubleshooting: Browser shows "Found." instead of redirecting
233+When using the Errors middleware without `statusRewrites`, the redirect response from oauth2-proxy can be served within the original 401/403 status context. This causes some browsers to display a "Found." link instead of automatically following the redirect to the identity provider.
234+
235+Adding `statusRewrites` to rewrite `401 -> 302` ensures the browser treats the response as a proper redirect and follows it automatically.
236+:::
237+
238+### ForwardAuth with static upstreams configuration
239+
240+Redirect to sign_in functionality provided without the use of `errors` middleware with [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/http/forwardauth/) pointing to oauth2-proxy service's `/` endpoint
241+
242+**Following options need to be set on `oauth2-proxy`:**
243+- `--upstream=static://202`: Configures a static response for authenticated sessions
244+- `--reverse-proxy=true`: Enables the use of `X-Forwarded-*` headers to determine redirects correctly
245+
246+```yaml
247+http:
248+ routers:
249+ a-service-route-1:
250+ rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"
251+ service: a-service-backend
252+ middlewares:
253+ - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin
254+ tls:
255+ certResolver: default
256+ domains:
257+ - main: "example.com"
258+ sans:
259+ - "*.example.com"
260+ a-service-route-2:
261+ rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"
262+ service: a-service-backend
263+ middlewares:
264+ - oauth-auth-wo-redirect # unauthenticated session will return a 401
265+ tls:
266+ certResolver: default
267+ domains:
268+ - main: "example.com"
269+ sans:
270+ - "*.example.com"
271+ services-oauth2-route:
272+ rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"
273+ middlewares:
274+ - auth-headers
275+ service: oauth-backend
276+ tls:
277+ certResolver: default
278+ domains:
279+ - main: "example.com"
280+ sans:
281+ - "*.example.com"
282+ oauth2-proxy-route:
283+ rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"
284+ middlewares:
285+ - auth-headers
286+ service: oauth-backend
287+ tls:
288+ certResolver: default
289+ domains:
290+ - main: "example.com"
291+ sans:
292+ - "*.example.com"
293+
294+ services:
295+ a-service-backend:
296+ loadBalancer:
297+ servers:
298+ - url: http://172.16.0.2:7555
299+ b-service-backend:
300+ loadBalancer:
301+ servers:
302+ - url: http://172.16.0.3:7555
303+ oauth-backend:
304+ loadBalancer:
305+ servers:
306+ - url: http://172.16.0.1:4180
307+
308+ middlewares:
309+ auth-headers:
310+ headers:
311+ sslRedirect: true
312+ stsSeconds: 315360000
313+ browserXssFilter: true
314+ contentTypeNosniff: true
315+ forceSTSHeader: true
316+ sslHost: example.com
317+ stsIncludeSubdomains: true
318+ stsPreload: true
319+ frameDeny: true
320+ oauth-auth-redirect:
321+ forwardAuth:
322+ address: https://oauth.example.com/
323+ trustForwardHeader: true
324+ authResponseHeaders:
325+ - X-Auth-Request-Access-Token
326+ - Authorization
327+ oauth-auth-wo-redirect:
328+ forwardAuth:
329+ address: https://oauth.example.com/oauth2/auth
330+ trustForwardHeader: true
331+ authResponseHeaders:
332+ - X-Auth-Request-Access-Token
333+ - Authorization
334+```
335+
336+## Configuring for use with the Caddy (v2) `forward_auth` directive
337+
338+The [Caddy `forward_auth` directive](https://caddyserver.com/docs/caddyfile/directives/forward_auth) allows Caddy to authenticate requests via the `oauth2-proxy`'s `/auth`.
339+
340+This example is for a simple reverse proxy setup where the `/oauth2/` path is kept under the same domain and failed auth requests (401 status returned) will be caught and redirected to the `sign_in` endpoint.
341+
342+**Following options need to be set on `oauth2-proxy`:**
343+- `--reverse-proxy=true`: Enables the use of `X-Forwarded-*` headers to determine redirects correctly
344+
345+```nginx title="Caddyfile"
346+example.com {
347+ # Requests to /oauth2/* are proxied to oauth2-proxy without authentication.
348+ # You can't use `reverse_proxy /oauth2/* oauth2-proxy.internal:4180` here because the reverse_proxy directive has lower precedence than the handle directive.
349+ handle /oauth2/* {
350+ reverse_proxy oauth2-proxy.internal:4180 {
351+ # oauth2-proxy requires the X-Real-IP and X-Forwarded-{Proto,Host,Uri} headers.
352+ # The reverse_proxy directive automatically sets X-Forwarded-{For,Proto,Host} headers.
353+ header_up X-Real-IP {remote_host}
354+ header_up X-Forwarded-Uri {uri}
355+ }
356+ }
357+
358+ # Requests to other paths are first processed by oauth2-proxy for authentication.
359+ handle {
360+ forward_auth oauth2-proxy.internal:4180 {
361+ uri /oauth2/auth
362+
363+ # oauth2-proxy requires the X-Real-IP and X-Forwarded-{Proto,Host,Uri} headers.
364+ # The forward_auth directive automatically sets the X-Forwarded-{For,Proto,Host,Method,Uri} headers.
365+ header_up X-Real-IP {remote_host}
366+
367+ # If needed, you can copy headers from the oauth2-proxy response to the request sent to the upstream.
368+ # Make sure to configure the --set-xauthrequest flag to enable this feature.
369+ #copy_headers X-Auth-Request-User X-Auth-Request-Email
370+
371+ # If oauth2-proxy returns a 401 status, redirect the client to the sign-in page.
372+ @error status 401
373+ handle_response @error {
374+ redir * /oauth2/sign_in?rd={scheme}://{host}{uri}
375+ }
376+ }
377+
378+ # If oauth2-proxy returns a 2xx status, the request is then proxied to the upstream.
379+ reverse_proxy upstream.internal:3000
380+ }
381+}
382+```
383+
384+:::note
385+If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.
386+:::
docs/versioned_docs/version-7.10.x/configuration/overview.mdnew file+403
@@ -0,0 +1,403 @@
1+---
2+id: overview
3+title: Overview
4+---
5+
6+`oauth2-proxy` can be configured via [command line options](#command-line-options), [environment variables](#environment-variables) or [config file](#config-file) (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings).
7+
8+## Generating a Cookie Secret
9+
10+To generate a strong cookie secret use one of the below commands:
11+
12+import Tabs from '@theme/Tabs';
13+import TabItem from '@theme/TabItem';
14+
15+<Tabs defaultValue="python">
16+ <TabItem value="python" label="Python">
17+
18+```shell
19+python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'
20+```
21+
22+ </TabItem>
23+ <TabItem value="bash" label="Bash">
24+
25+```shell
26+dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\n' | tr -- '+/' '-_' ; echo
27+```
28+
29+ </TabItem>
30+ <TabItem value="openssl" label="OpenSSL">
31+
32+```shell
33+openssl rand -base64 32 | tr -- '+/' '-_'
34+```
35+
36+ </TabItem>
37+ <TabItem value="powershell" label="PowerShell">
38+
39+```powershell
40+# Add System.Web assembly to session, just in case
41+Add-Type -AssemblyName System.Web
42+[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")
43+```
44+
45+ </TabItem>
46+ <TabItem value="terraform" label="Terraform">
47+
48+```hcl
49+# Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret
50+resource "random_password" "cookie_secret" {
51+ length = 32
52+ override_special = "-_"
53+}
54+```
55+
56+ </TabItem>
57+</Tabs>
58+
59+## Config File
60+
61+Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (\_). If the argument can be specified multiple times, the config option should be plural (trailing s).
62+
63+An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example) config file is in the contrib directory. It can be used by specifying `--config=/etc/oauth2-proxy.cfg`
64+
65+## Config Options
66+
67+### Command Line Options
68+
69+| Flag | Description |
70+| ----------- | -------------------- |
71+| `--config` | path to config file |
72+| `--version` | print version string |
73+
74+### General Provider Options
75+
76+Provider specific options can be found on their respective subpages.
77+
78+| Flag / Config Field | Type | Description | Default |
79+| --------------------------------------------------------------------------------------------------- | -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
80+| flag: `--acr-values`<br/>toml: `acr_values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
81+| flag: `--allowed-group`<br/>toml: `allowed_groups` | string \| list | Restrict login to members of a group or list of groups. Furthermore, if you aren't setting the `scope` and use `allowed_groups` with the generic OIDC provider the scope `groups` gets added implicitly. | |
82+| flag: `--approval-prompt`<br/>toml: `approval_prompt` | string | OAuth approval_prompt | `"force"` |
83+| flag: `--backend-logout-url`<br/>toml: `backend_logout_url` | string | URL to perform backend logout, if you use `{id_token}` in the url it will be replaced by the actual `id_token` of the user session | |
84+| flag: `--client-id`<br/>toml: `client_id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
85+| flag: `--client-secret-file`<br/>toml: `client_secret_file` | string | the file with OAuth Client Secret | |
86+| flag: `--client-secret`<br/>toml: `client_secret` | string | the OAuth Client Secret | |
87+| flag: `--code-challenge-method`<br/>toml: `code_challenge_method` | string | use PKCE code challenges with the specified method. Either 'plain' or 'S256' (recommended) | |
88+| flag: `--insecure-oidc-allow-unverified-email`<br/>toml: `insecure_oidc_allow_unverified_email` | bool | don't fail if an email address in an id_token is not verified | false |
89+| flag: `--insecure-oidc-skip-issuer-verification`<br/>toml: `insecure_oidc_skip_issuer_verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
90+| flag: `--insecure-oidc-skip-nonce`<br/>toml: `insecure_oidc_skip_nonce` | bool | skip verifying the OIDC ID Token's nonce claim | true |
91+| flag: `--jwt-key-file`<br/>toml: `jwt_key_file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |
92+| flag: `--jwt-key`<br/>toml: `jwt_key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |
93+| flag: `--login-url`<br/>toml: `login_url` | string | Authentication endpoint | |
94+| flag: `--auth-request-response-mode`<br/>toml: `auth-request-response-mode` | string | Response mode to ask for during authentication request | |
95+| flag: `--oidc-audience-claim`<br/>toml: `oidc_audience_claims` | string | which OIDC claim contains the audience | `"aud"` |
96+| flag: `--oidc-email-claim`<br/>toml: `oidc_email_claim` | string | which OIDC claim contains the user's email | `"email"` |
97+| flag: `--oidc-extra-audience`<br/>toml: `oidc_extra_audiences` | string \| list | additional audiences which are allowed to pass verification | `"[]"` |
98+| flag: `--oidc-groups-claim`<br/>toml: `oidc_groups_claim` | string | which OIDC claim contains the user groups | `"groups"` |
99+| flag: `--oidc-issuer-url`<br/>toml: `oidc_issuer_url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
100+| flag: `--oidc-jwks-url`<br/>toml: `oidc_jwks_url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled and public key files are not provided | |
101+| flag: `--oidc-public-key-file`<br/>toml: `oidc_public_key_files` | string | Path to public key file in PEM format to use for verifying JWT tokens (may be given multiple times). Required if OIDC discovery is disabled na JWKS URL isn't provided | string \| list |
102+| flag: `--profile-url`<br/>toml: `profile_url` | string | Profile access endpoint | |
103+| flag: `--prompt`<br/>toml: `prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
104+| flag: `--provider-ca-file`<br/>toml: `provider_ca_files` | string \| list | Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead. |
105+| flag: `--provider-display-name`<br/>toml: `provider_display_name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
106+| flag: `--provider`<br/>toml: `provider` | string | OAuth provider | google |
107+| flag: `--pubjwk-url`<br/>toml: `pubjwk_url` | string | JWK pubkey access endpoint: required by login.gov | |
108+| flag: `--redeem-url`<br/>toml: `redeem_url` | string | Token redemption endpoint | |
109+| flag: `--scope`<br/>toml:`scope` | string | OAuth scope specification. Every provider has a default list of scopes which will be used in case no scope is configured. | |
110+| flag: `--skip-claims-from-profile-url`<br/>toml: `skip_claims_from_profile_url` | bool | skip request to Profile URL for resolving claims not present in id_token | false |
111+| flag: `--skip-oidc-discovery`<br/>toml: `skip_oidc_discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
112+| flag: `--use-system-trust-store`<br/>toml: `use_system_trust_store` | bool | Determines if `provider-ca-file` files and the system trust store are used. If set to true, your custom CA files and the system trust store are used otherwise only your custom CA files. | false |
113+| flag: `--validate-url`<br/>toml: `validate_url` | string | Access token validation endpoint | |
114+
115+### Cookie Options
116+
117+| Flag / Config Field | Type | Description | Default |
118+| -------------------------------------------------------------------- | -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- |
119+| flag: `--cookie-csrf-expire`<br/>toml: `cookie_csrf_expire` | duration | expire timeframe for CSRF cookie | 15m |
120+| flag: `--cookie-csrf-per-request`<br/>toml:`cookie_csrf_per_request` | bool | Enable having different CSRF cookies per request, making it possible to have parallel requests. | false |
121+| flag: `--cookie-domain`<br/>toml: `cookie_domains` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
122+| flag: `--cookie-expire`<br/>toml: `cookie_expire` | duration | expire timeframe for cookie. If set to 0, cookie becomes a session-cookie which will expire when the browser is closed. | 168h0m0s |
123+| flag: `--cookie-httponly`<br/>toml: `cookie_httponly` | bool | set HttpOnly cookie flag | true |
124+| flag: `--cookie-name`<br/>toml: `cookie_name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
125+| flag: `--cookie-path`<br/>toml: `cookie_path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
126+| flag: `--cookie-refresh`<br/>toml: `cookie_refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;[^1] | |
127+| flag: `--cookie-samesite`<br/>toml: `cookie_samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
128+| flag: `--cookie-secret`<br/>toml: `cookie_secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
129+| flag: `--cookie-secure`<br/>toml: `cookie_secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
130+
131+[^1]: The following providers support `--cookie-refresh`: ADFS, Azure, GitLab, Google, Keycloak and all other Identity Providers which support the full [OIDC specification](https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokens)
132+
133+### Header Options
134+
135+| Flag / Config Field | Type | Description | Default |
136+| ------------------------------------------------------------------------- | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
137+| flag: `--basic-auth-password`<br/>toml: `basic_auth_password` | string | the password to set when passing the HTTP Basic Auth header | |
138+| flag: `--set-xauthrequest`<br/>toml: `set_xauthrequest` | bool | set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with `--pass-access-token`, X-Auth-Request-Access-Token is added to response headers. | false |
139+| flag: `--set-authorization-header`<br/>toml: `set_authorization_header` | bool | set Authorization Bearer response header (useful in Nginx auth_request mode) | false |
140+| flag: `--set-basic-auth`<br/>toml: `set_basic_auth` | bool | set HTTP Basic Auth information in response (useful in Nginx auth_request mode) | false |
141+| flag: `--skip-auth-strip-headers`<br/>toml: `skip_auth_strip_headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy | true |
142+| flag: `--pass-access-token`<br/>toml: `pass_access_token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
143+| flag: `--pass-authorization-header`<br/>toml: `pass_authorization_header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
144+| flag: `--pass-basic-auth`<br/>toml: `pass_basic_auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
145+| flag: `--prefer-email-to-user`<br/>toml: `prefer_email_to_user` | bool | Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with `--pass-basic-auth` and `--pass-user-headers` | false |
146+| flag: `--pass-user-headers`<br/>toml: `pass_user_headers` | bool | pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
147+
148+### Logging Options
149+
150+| Flag / Config Field | Type | Description | Default |
151+| --------------------------------------------------------------------- | ------ | ---------------------------------------------------------------------------- | --------------------------------------------------- |
152+| flag: `--auth-logging-format`<br/>toml: `auth_logging_format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
153+| flag: `--auth-logging`<br/>toml: `auth_logging` | bool | Log authentication attempts | true |
154+| flag: `--errors-to-info-log`<br/>toml: `errors_to_info_log` | bool | redirects error-level logging to default log channel instead of stderr | false |
155+| flag: `--exclude-logging-path`<br/>toml: `exclude_logging_paths` | string | comma separated list of paths to exclude from logging, e.g. `"/ping,/path2"` | `""` (no paths excluded) |
156+| flag: `--logging-compress`<br/>toml: `logging_compress` | bool | Should rotated log files be compressed using gzip | false |
157+| flag: `--logging-filename`<br/>toml: `logging_filename` | string | File to log requests to, empty for `stdout` | `""` (stdout) |
158+| flag: `--logging-local-time`<br/>toml: `logging_local_time` | bool | Use local time in log files and backup filenames instead of UTC | true (local time) |
159+| flag: `--logging-max-age`<br/>toml: `logging_max_age` | int | Maximum number of days to retain old log files | 7 |
160+| flag: `--logging-max-backups`<br/>toml: `logging_max_backups` | int | Maximum number of old log files to retain; 0 to disable | 0 |
161+| flag: `--logging-max-size`<br/>toml: `logging_max_size` | int | Maximum size in megabytes of the log file before rotation | 100 |
162+| flag: `--request-id-header`<br/>toml: `request_id_header` | string | Request header to use as the request ID in logging | X-Request-Id |
163+| flag: `--request-logging-format`<br/>toml: `request_logging_format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
164+| flag: `--request-logging`<br/>toml: `request_logging` | bool | Log requests | true |
165+| flag: `--silence-ping-logging`<br/>toml: `silence_ping_logging` | bool | disable logging of requests to ping & ready endpoints | false |
166+| flag: `--standard-logging-format`<br/>toml: `standard_logging_format` | string | Template for standard log lines | see [Logging Configuration](#logging-configuration) |
167+| flag: `--standard-logging`<br/>toml: `standard_logging` | bool | Log standard runtime information | true |
168+
169+### Page Template Options
170+
171+| Flag / Config Field | Type | Description | Default |
172+| ----------------------------------------------------------------- | ------ | --------------------------------------------------------------------------------------------------------------------------- | ------- |
173+| flag: `--banner`<br/>toml: `banner` | string | custom (html) banner string. Use `"-"` to disable default banner. | |
174+| flag: `--custom-sign-in-logo`<br/>toml: `custom_sign_in_logo` | string | path or a URL to an custom image for the sign_in page logo. Use `"-"` to disable default logo. |
175+| flag: `--custom-templates-dir`<br/>toml: `custom_templates_dir` | string | path to custom html templates | |
176+| flag: `--display-htpasswd-form`<br/>toml: `display_htpasswd_form` | bool | display username / password login form if an htpasswd file is provided | true |
177+| flag: `--footer`<br/>toml: `footer` | string | custom (html) footer string. Use `"-"` to disable default footer. (Can be used to obfuscate the version) | |
178+| flag: `--show-debug-on-error`<br/>toml: `show_debug_on_error` | bool | show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production) | false |
179+
180+### Probe Options
181+
182+| Flag / Config Field | Type | Description | Default |
183+| ------------------------------------------------------- | ------ | ---------------------------------------------------------- | ----------------------------- |
184+| flag: `--ping-path`<br/>toml: `ping_path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
185+| flag: `--ping-user-agent`<br/>toml: `ping_user_agent` | string | a User-Agent that can be used for basic health checks | `""` (don't check user agent) |
186+| flag: `--ready-path`<br/>toml: `ready_path` | string | the ready endpoint that can be used for deep health checks | `"/ready"` |
187+| flag: `--gcp-healthchecks`<br/>toml: `gcp_healthchecks` | bool | Enable GCP/GKE healthcheck endpoints (deprecated) | false |
188+
189+### Proxy Options
190+
191+| Flag / Config Field | Type | Description | Default |
192+| ------------------------------------------------------------------------- | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
193+| flag: `--allow-query-semicolons`<br/>toml: `allow_query_semicolons` | bool | allow the use of semicolons in query args ([required for some legacy applications](https://github.com/golang/go/issues/25192)) | `false` |
194+| flag: `--api-route`<br/>toml: `api_routes` | string \| list | Requests to these paths must already be authenticated with a cookie, or a JWT if `--skip-jwt-bearer-tokens` is set. No redirect to login will be done. Return 401 if not. Format: path_regex | |
195+| flag: `--authenticated-emails-file`<br/>toml: `authenticated_emails_file` | string | authenticate against emails via file (one per line) | |
196+| flag: `--bearer-token-login-fallback`<br/>toml: `bearer_token_login_fallback` | bool | if `--skip-jwt-bearer-tokens` is set, if a request includes an invalid JWT (expired, malformed, missing required audiences, etc), fall back to normal login redirect as if the token were not sent at all. If false, respond 403 | true |
197+| flag: `--email-domain`<br/>toml: `email_domains` | string \| list | authenticate emails with the specified domain (may be given multiple times). Use `*` to authenticate any email | |
198+| flag: `--encode-state`<br/>toml: `encode_state` | bool | encode the state parameter as UrlEncodedBase64 | false |
199+| flag: `--extra-jwt-issuers`<br/>toml: `extra_jwt_issuers` | string | if `--skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` (see a token's `iss`, `aud` fields) pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
200+| flag: `--force-https`<br/>toml: `force_https` | bool | enforce https redirect | `false` |
201+| flag: `--force-json-errors`<br/>toml: `force_json_errors` | bool | force JSON errors instead of HTTP error pages or redirects | `false` |
202+| flag: `--htpasswd-file`<br/>toml: `htpasswd_file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
203+| flag: `--htpasswd-user-group`<br/>toml: `htpasswd_user_groups` | string \| list | the groups to be set on sessions for htpasswd users | |
204+| flag: `--proxy-prefix`<br/>toml: `proxy_prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
205+| flag: `--real-client-ip-header`<br/>toml: `real_client_ip_header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, X-ProxyUser-IP, X-Envoy-External-Address, or CF-Connecting-IP) | X-Real-IP |
206+| flag: `--redirect-url`<br/>toml: `redirect_url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
207+| flag: `--relative-redirect-url`<br/>toml: `relative_redirect_url` | bool | allow relative OAuth Redirect URL.` | false |
208+| flag: `--reverse-proxy`<br/>toml: `reverse_proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-\{Proto,Host,Uri\} headers to be used on redirect selection | false |
209+| flag: `--signature-key`<br/>toml: `signature_key` | string | GAP-Signature request signature key (algorithm:secretkey) | |
210+| flag: `--skip-auth-preflight`<br/>toml: `skip_auth_preflight` | bool | will skip authentication for OPTIONS requests | false |
211+| flag: `--skip-auth-regex`<br/>toml: `skip_auth_regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times) | |
212+| flag: `--skip-auth-route`<br/>toml: `skip_auth_routes` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR method!=path_regex. For all methods: path_regex OR !=path_regex | |
213+| flag: `--skip-jwt-bearer-tokens`<br/>toml: `skip_jwt_bearer_tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
214+| flag: `--skip-provider-button`<br/>toml: `skip_provider_button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
215+| flag: `--ssl-insecure-skip-verify`<br/>toml: `ssl_insecure_skip_verify` | bool | skip validation of certificates presented when using HTTPS providers | false |
216+| flag: `--trusted-ip`<br/>toml: `trusted_ips` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
217+| flag: `--whitelist-domain`<br/>toml: `whitelist_domains` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` or a `*.` to allow subdomains (e.g. `.example.com`, `*.example.com`)&nbsp;[^2] | |
218+
219+[^2]: When using the `whitelist-domain` option, any domain prefixed with a `.` or a `*.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
220+
221+### Server Options
222+
223+| Flag / Config Field | Type | Description | Default |
224+| ------------------------------------------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ |
225+| flag: `--http-address`<br/>toml: `http_address` | string | `[http://]<addr>:<port>` or `unix://<path>` or `fd:<int>` (case insensitive) to listen on for HTTP clients. Square brackets are required for ipv6 address, e.g. `http://[::1]:4180` | `"127.0.0.1:4180"` |
226+| flag: `--https-address`<br/>toml: `https_address` | string | `[https://]<addr>:<port>` to listen on for HTTPS clients. Square brackets are required for ipv6 address, e.g. `https://[::1]:443` | `":443"` |
227+| flag: `--metrics-address`<br/>toml: `metrics_address` | string | the address prometheus metrics will be scraped from | `""` |
228+| flag: `--metrics-secure-address`<br/>toml: `metrics_secure_address` | string | the address prometheus metrics will be scraped from if using HTTPS | `""` |
229+| flag: `--metrics-tls-cert-file`<br/>toml: `metrics_tls_cert_file` | string | path to certificate file for secure metrics server | `""` |
230+| flag: `--metrics-tls-key-file`<br/>toml: `metrics_tls_key_file` | string | path to private key file for secure metrics server | `""` |
231+| flag: `--tls-cert-file`<br/>toml: `tls_cert_file` | string | path to certificate file | |
232+| flag: `--tls-key-file`<br/>toml: `tls_key_file` | string | path to private key file | |
233+| flag: `--tls-cipher-suite`<br/>toml: `tls_cipher_suites` | string \| list | Restricts TLS cipher suites used by server to those listed (e.g. TLS_RSA_WITH_RC4_128_SHA) (may be given multiple times). If not specified, the default Go safe cipher list is used. List of valid cipher suites can be found in the [crypto/tls documentation](https://pkg.go.dev/crypto/tls#pkg-constants). | |
234+| flag: `--tls-min-version`<br/>toml: `tls_min_version` | string | minimum TLS version that is acceptable, either `"TLS1.2"` or `"TLS1.3"` | `"TLS1.2"` |
235+
236+### Session Options
237+
238+| Flag / Config Field | Type | Description | Default |
239+| ----------------------------------------------------------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
240+| flag: `--session-cookie-minimal`<br/>toml: `session_cookie_minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
241+| flag: `--session-store-type`<br/>toml: `session_store_type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
242+| flag: `--redis-cluster-connection-urls`<br/>toml: `redis_cluster_connection_urls` | string \| list | List of Redis cluster connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-cluster` | |
243+| flag: `--redis-connection-url`<br/>toml: `redis_connection_url` | string | URL of redis server for redis session storage (e.g. `redis://HOST[:PORT]`) | |
244+| flag: `--redis-ca-path`<br/>toml: `redis_ca_path` | string | Path to a CA certificates file that should be used when connecting to redis. If not specified, the system cert pool is used instead. |
245+| flag: `--redis-insecure-skip-tls-verify`<br/>toml: `redis_insecure_skip_tls_verify` | bool | skip TLS verification when connecting to Redis | false |
246+| flag: `--redis-password`<br/>toml: `redis_password` | string | Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url` | |
247+| flag: `--redis-sentinel-password`<br/>toml: `redis_sentinel_password` | string | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password` | |
248+| flag: `--redis-sentinel-master-name`<br/>toml: `redis_sentinel_master_name` | string | Redis sentinel master name. Used in conjunction with `--redis-use-sentinel` | |
249+| flag: `--redis-sentinel-connection-urls`<br/>toml: `redis_sentinel_connection_urls` | string \| list | List of Redis sentinel connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-sentinel` | |
250+| flag: `--redis-use-cluster`<br/>toml: `redis_use_cluster` | bool | Connect to redis cluster. Must set `--redis-cluster-connection-urls` to use this feature | false |
251+| flag: `--redis-use-sentinel`<br/>toml: `redis_use_sentinel` | bool | Connect to redis via sentinels. Must set `--redis-sentinel-master-name` and `--redis-sentinel-connection-urls` to use this feature | false |
252+| flag: `--redis-connection-idle-timeout`<br/>toml: `redis_connection_idle_timeout` | int | Redis connection idle timeout seconds. If Redis [timeout](https://redis.io/docs/reference/clients/#client-timeouts) option is set to non-zero, the `--redis-connection-idle-timeout` must be less than Redis timeout option. Example: if either redis.conf includes `timeout 15` or using `CONFIG SET timeout 15` the `--redis-connection-idle-timeout` must be at least `--redis-connection-idle-timeout=14` | 0 |
253+
254+### Upstream Options
255+
256+| Flag / Config Field | Type | Description | Default |
257+| ----------------------------------------------------------------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------- |
258+| flag: `--flush-interval`<br/>toml: `flush_interval` | duration | period between flushing response buffers when streaming responses | `"1s"` |
259+| flag: `--pass-host-header`<br/>toml: `pass_host_header` | bool | pass the request Host Header to upstream | true |
260+| flag: `--proxy-websockets`<br/>toml: `proxy_websockets` | bool | enables WebSocket proxying | true |
261+| flag: `--ssl-upstream-insecure-skip-verify`<br/>toml: `ssl_upstream_insecure_skip_verify` | bool | skip validation of certificates presented when using HTTPS upstreams | false |
262+| flag: `--upstream-timeout`<br/>toml: `upstream_timeout` | duration | maximum amount of time the server will wait for a response from the upstream | 30s |
263+| flag: `--upstream`<br/>toml: `upstreams` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
264+
265+## Upstreams Configuration
266+
267+`oauth2-proxy` supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers, unix socket or serve static files from the file system.
268+
269+To configure **HTTP and HTTPS upstreams**, provide such a URL in `--upstream=URL`. The scheme+host portion and the path portion are extracted to configure proxying behavior. When processing incoming requests, the path portion becomes a lookup key for selecting the destination server of the proxied request.
270+
271+* Upstream URLs *without a trailing slash,* like in `--upstream=http://service2.internal/foo`, will match an incoming request exactly to `/foo` in `https://this.o2p.example.com/foo`, and forward the request on to service2.internal, but not match a request to `https://this.o2p.example.com/foo/more` nor ...`.com/food`.
272+* Upstream URLs *with a trailing slash,* like in `--upstream=http://service1.internal/foo/`, will match any incoming request to any incoming requests's path *starting with* `/foo/`, like `/foo/` and `/foo/more` and `/foo/lots/more?etc`.
273+
274+If multiple `--upstream` URLs' paths match an incoming request, the one with the longest matching path (the most specific match) takes priority over shorter (less specific) ones.
275+
276+**Unix socket upstreams** are configured as `unix:///path/to/unix.sock`.
277+
278+**Static file paths** are configured as a file:// URL. `file:///var/www/static/` will serve the files from that directory at `http://[oauth2-proxy url]/var/www/static/`, which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. `file:///var/www/static/#/static/` will make `/var/www/static/` available at `http://[oauth2-proxy url]/static/`.
279+
280+Multiple upstreams can either be configured by supplying a comma separated list to the `--upstream` parameter, supplying the parameter multiple times or providing a list in the [config file](#config-file). When multiple upstreams are used routing to them will be based on the path they are set up with.
281+
282+## Environment variables
283+
284+Every command line argument can be specified as an environment variable by
285+prefixing it with `OAUTH2_PROXY_`, capitalising it, and replacing hyphens (`-`)
286+with underscores (`_`). If the argument can be specified multiple times, the
287+environment variable should be plural (trailing `S`).
288+
289+This is particularly useful for storing secrets outside a configuration file
290+or the command line.
291+
292+For example, the `--cookie-secret` flag becomes `OAUTH2_PROXY_COOKIE_SECRET`.
293+If a flag has the type `string | list` like the `--email-domain` flag it is
294+available as an environment variable in plural form e.g. `OAUTH2_PROXY_EMAIL_DOMAINS`
295+
296+Values for type `string | list` usually have a plural environment variable name
297+and need to be seperated by `,` e.g.
298+`OAUTH2_PROXY_SKIP_AUTH_ROUTES="GET=^/api/status,POST=^/api/saved_objects/_import"`
299+
300+Please check the type for each [config option](#config-options) first.
301+
302+## Logging Configuration
303+
304+By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the `--logging-filename` command.
305+
306+If logging to a file you can also configure the maximum file size (`--logging-max-size`), age (`--logging-max-age`), max backup logs (`--logging-max-backups`), and if backup logs should be compressed (`--logging-compress`).
307+
308+There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with `--standard-logging`, `--auth-logging`, and `--request-logging`.
309+
310+Each type of logging has its own configurable format and variables. By default, these formats are similar to the Apache Combined Log.
311+
312+Logging of requests to the `/ping` endpoint (or using `--ping-user-agent`) and the `/ready` endpoint can be disabled with `--silence-ping-logging` reducing log volume.
313+
314+## Auth Log Format
315+
316+Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:
317+
318+```
319+<REMOTE_ADDRESS> - <REQUEST ID> - <user@domain.com> [2015/03/19 17:20:19] [<STATUS>] <MESSAGE>
320+```
321+
322+The status block will contain one of the below strings:
323+
324+- `AuthSuccess` If a user has authenticated successfully by any method
325+- `AuthFailure` If the user failed to authenticate explicitly
326+- `AuthError` If there was an unexpected error during authentication
327+
328+If you require a different format than that, you can configure it with the `--auth-logging-format` flag.
329+The default format is configured as follows:
330+
331+```
332+{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}
333+```
334+
335+Available variables for auth logging:
336+
337+| Variable | Example | Description |
338+| ------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
339+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
340+| Host | domain.com | The value of the Host header. |
341+| Message | Authenticated via OAuth2 | The details of the auth attempt. |
342+| Protocol | HTTP/1.0 | The request protocol. |
343+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
344+| RequestMethod | GET | The request method. |
345+| Timestamp | 2015/03/19 17:20:19 | The date and time of the logging event. |
346+| UserAgent | - | The full user agent as reported by the requesting client. |
347+| Username | username@email.com | The email or username of the auth request. |
348+| Status | AuthSuccess | The status of the auth request. See above for details. |
349+
350+## Request Log Format
351+
352+HTTP request logs will output by default in the below format:
353+
354+```
355+<REMOTE_ADDRESS> - <REQUEST ID> - <user@domain.com> [2015/03/19 17:20:19] <HOST_HEADER> GET <UPSTREAM_HOST> "/path/" HTTP/1.1 "<USER_AGENT>" <RESPONSE_CODE> <RESPONSE_BYTES> <REQUEST_DURATION>
356+```
357+
358+If you require a different format than that, you can configure it with the `--request-logging-format` flag.
359+The default format is configured as follows:
360+
361+```
362+{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}
363+```
364+
365+Available variables for request logging:
366+
367+| Variable | Example | Description |
368+| --------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
369+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
370+| Host | domain.com | The value of the Host header. |
371+| Protocol | HTTP/1.0 | The request protocol. |
372+| RequestDuration | 0.001 | The time in seconds that a request took to process. |
373+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
374+| RequestMethod | GET | The request method. |
375+| RequestURI | "/oauth2/auth" | The URI path of the request. |
376+| ResponseSize | 12 | The size in bytes of the response. |
377+| StatusCode | 200 | The HTTP status code of the response. |
378+| Timestamp | 2015/03/19 17:20:19 | The date and time of the logging event. |
379+| Upstream | - | The upstream data of the HTTP request. |
380+| UserAgent | - | The full user agent as reported by the requesting client. |
381+| Username | username@email.com | The email or username of the auth request. |
382+
383+## Standard Log Format
384+
385+All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:
386+
387+```
388+[2015/03/19 17:20:19] [main.go:40] <MESSAGE>
389+```
390+
391+If you require a different format than that, you can configure it with the `--standard-logging-format` flag. The default format is configured as follows:
392+
393+```
394+[{{.Timestamp}}] [{{.File}}] {{.Message}}
395+```
396+
397+Available variables for standard logging:
398+
399+| Variable | Example | Description |
400+| --------- | --------------------------------- | -------------------------------------------------- |
401+| Timestamp | 2015/03/19 17:20:19 | The date and time of the logging event. |
402+| File | main.go:40 | The file and line number of the logging statement. |
403+| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
docs/versioned_docs/version-7.10.x/configuration/providers/adfs.mdnew file+19
@@ -0,0 +1,19 @@
1+---
2+id: adfs
3+title: ADFS
4+---
5+
6+1. Open the ADFS administration console on your Windows Server and add a new Application Group
7+2. Provide a name for the integration, select Server Application from the Standalone applications section and click Next
8+3. Follow the wizard to get the client-id, client-secret and configure the application credentials
9+4. Configure the proxy with
10+
11+```
12+ --provider=adfs
13+ --client-id=<application ID from step 3>
14+ --client-secret=<value from step 3>
15+```
16+
17+Note: When using the ADFS Auth provider with nginx and the cookie session store you may find the cookie is too large and
18+doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the
19+[redis session storage](../sessions.md#redis-storage) should resolve this.
docs/versioned_docs/version-7.10.x/configuration/providers/bitbucket.mdnew file+25
@@ -0,0 +1,25 @@
1+---
2+id: bitbucket
3+title: BitBucket
4+---
5+
6+1. [Add a new OAuth consumer](https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html)
7+ * In "Callback URL" use `https://<oauth2-proxy>/oauth2/callback`, substituting `<oauth2-proxy>` with the actual
8+ hostname that oauth2-proxy is running on.
9+ * In Permissions section select:
10+ * Account -> Email
11+ * Team membership -> Read
12+ * Repositories -> Read
13+2. Note the Client ID and Client Secret.
14+
15+To use the provider, pass the following options:
16+
17+```
18+ --provider=bitbucket
19+ --client-id=<Client ID>
20+ --client-secret=<Client Secret>
21+```
22+
23+The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team
24+members use additional configuration option: `--bitbucket-team=<Team name>`. To restrict the access to only these users
25+who have access to one selected repository use `--bitbucket-repository=<Repository name>`.
docs/versioned_docs/version-7.10.x/configuration/providers/digitalocean.mdnew file+21
@@ -0,0 +1,21 @@
1+---
2+id: digitalocean
3+title: DigitalOcean
4+---
5+
6+1. [Create a new OAuth application](https://cloud.digitalocean.com/account/api/applications)
7+ * You can fill in the name, homepage, and description however you wish.
8+ * In the "Application callback URL" field, enter: `https://oauth-proxy/oauth2/callback`, substituting `oauth2-proxy`
9+ with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL.
10+2. Note the Client ID and Client Secret.
11+
12+To use the provider, pass the following options:
13+
14+```
15+ --provider=digitalocean
16+ --client-id=<Client ID>
17+ --client-secret=<Client Secret>
18+```
19+
20+Alternatively, set the equivalent options in the config file. The redirect URL defaults to
21+`https://<requested host header>/oauth2/callback`. If you need to change it, you can use the `--redirect-url` command-line option.
docs/versioned_docs/version-7.10.x/configuration/providers/facebook.mdnew file+7
@@ -0,0 +1,7 @@
1+---
2+id: facebook
3+title: Facebook
4+---
5+
6+1. Create a new FB App from https://developers.facebook.com/
7+2. Under FB Login, set your Valid OAuth redirect URIs to `https://internal.yourcompany.com/oauth2/callback`
docs/versioned_docs/version-7.10.x/configuration/providers/gitea.mdnew file+24
@@ -0,0 +1,24 @@
1+---
2+id: gitea
3+title: Gitea
4+---
5+
6+:::note
7+This is not actually its own provider. For more details and options please refer to the [GitHub Provider Options](github.md)
8+:::
9+
10+1. Create a new application: `https://< your gitea host >/user/settings/applications`
11+2. Under `Redirect URI` enter the correct URL i.e. `https://<proxied host>/oauth2/callback`
12+3. Note the Client ID and Client Secret.
13+4. Pass the following options to the proxy:
14+
15+```
16+ --provider="github"
17+ --redirect-url="https://<proxied host>/oauth2/callback"
18+ --provider-display-name="Gitea"
19+ --client-id="< client_id as generated by Gitea >"
20+ --client-secret="< client_secret as generated by Gitea >"
21+ --login-url="https://< your gitea host >/login/oauth/authorize"
22+ --redeem-url="https://< your gitea host >/login/oauth/access_token"
23+ --validate-url="https://< your gitea host >/api/v1/user/emails"
24+```
docs/versioned_docs/version-7.10.x/configuration/providers/github.mdnew file+81
@@ -0,0 +1,81 @@
1+---
2+id: github
3+title: GitHub
4+---
5+
6+## Config Options
7+
8+| Flag | Toml Field | Type | Description | Default |
9+| ---------------- | -------------- | -------------- | ------------------------------------------------------------------------------------------------------------- | ------- |
10+| `--github-org` | `github_org` | string | restrict logins to members of this organisation | |
11+| `--github-team` | `github_team` | string | restrict logins to members of any of these teams (slug) or (org:team), comma separated | |
12+| `--github-repo` | `github_repo` | string | restrict logins to collaborators of this repository formatted as `orgname/repo` | |
13+| `--github-token` | `github_token` | string | the token to use when verifying repository collaborators (must have push access to the repository) | |
14+| `--github-user` | `github_users` | string \| list | To allow users to login by username even if they do not belong to the specified org and team or collaborators | |
15+
16+## Usage
17+
18+1. Create a new project: https://github.com/settings/developers
19+2. Under `Authorization callback URL` enter the correct url ie `https://internal.yourcompany.com/oauth2/callback`
20+
21+The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional
22+team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with `--email-domain=*`. Additionally, all the organizations and teams a user belongs to are set as part of the `X-Forwarded-Groups` header. e.g. `org1:team1,org1:team2,org2:team1`
23+
24+NOTE: When `--github-user` is set, the specified users are allowed to log in even if they do not belong to the specified
25+org and team or collaborators.
26+
27+To restrict access to your organization:
28+
29+```shell
30+ # restrict logins to members of this organisation
31+ --github-org="your-org"
32+```
33+
34+To restrict access to specific teams within an organization:
35+
36+```shell
37+ --github-org="your-org"
38+ # restrict logins to members of any of these teams (slug), comma separated
39+ --github-team="team1,team2,team3"
40+```
41+
42+To restrict to teams within different organizations, keep the organization flag empty and use `--github-team` like so:
43+
44+```shell
45+ # keep empty
46+ --github-org=""
47+ # restrict logins to members to any of the following teams (format <org>:<slug>, like octo:team1), comma separated
48+ --github-team="org1:team1,org2:team1,org3:team42,octo:cat"
49+```
50+
51+If you would rather restrict access to collaborators of a repository, those users must either have push access to a
52+public repository or any access to a private repository:
53+
54+```shell
55+ # restrict logins to collaborators of this repository formatted as orgname/repo
56+ --github-repo=""
57+```
58+
59+If you'd like to allow access to users with **read only** access to a **public** repository you will need to provide a
60+[token](https://github.com/settings/tokens) for a user that has write access to the repository. The token must be
61+created with at least the `public_repo` scope:
62+
63+```shell
64+ # the token to use when verifying repository collaborators
65+ --github-token=""
66+```
67+
68+To allow a user to log in with their username even if they do not belong to the specified org and team or collaborators:
69+
70+```shell
71+ # allow logins by username, comma separated
72+ --github-user=""
73+```
74+
75+If you are using GitHub enterprise, make sure you set the following to the appropriate url:
76+
77+```shell
78+ --login-url="http(s)://<enterprise github host>/login/oauth/authorize"
79+ --redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"
80+ --validate-url="http(s)://<enterprise github host>/api/v3"
81+```
docs/versioned_docs/version-7.10.x/configuration/providers/gitlab.mdnew file+49
@@ -0,0 +1,49 @@
1+---
2+id: gitlab
3+title: GitLab
4+---
5+
6+## Config Options
7+
8+| Flag | Toml Field | Type | Description | Default |
9+| ------------------- | ----------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
10+| `--gitlab-group` | `gitlab_groups` | string \| list | restrict logins to members of any of these groups (slug), separated by a comma | |
11+| `--gitlab-project` | `gitlab_projects` | string \| list | restrict logins to members of any of these projects (may be given multiple times) formatted as `orgname/repo=accesslevel`. Access level should be a value matching [Gitlab access levels](https://docs.gitlab.com/ee/api/members.html#valid-access-levels), defaulted to 20 if absent | |
12+
13+## Usage
14+
15+This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version
16+prior to 12.X (see [994](https://github.com/oauth2-proxy/oauth2-proxy/issues/994)).
17+
18+Whether you are using GitLab.com or self-hosting GitLab, follow
19+[these steps to add an application](https://docs.gitlab.com/integration/oauth_provider/). Make sure to enable at
20+least the `openid`, `profile` and `email` scopes, and set the redirect url to your application url e.g.
21+https://myapp.com/oauth2/callback.
22+
23+If you need projects filtering, add the extra `read_api` scope to your application.
24+
25+The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow
26+[these steps](../overview.md#generating-a-cookie-secret)
27+
28+```
29+ --provider="gitlab"
30+ --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab
31+ --client-id=GITLAB_CLIENT_ID
32+ --client-secret=GITLAB_CLIENT_SECRET
33+ --cookie-secret=COOKIE_SECRET
34+```
35+
36+Restricting by group membership is possible with the following option:
37+
38+```shell
39+ --gitlab-group="mygroup,myothergroup" # restrict logins to members of any of these groups (slug), separated by a comma
40+```
41+
42+If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:
43+
44+```shell
45+ --oidc-issuer-url="<your gitlab url>"
46+```
47+
48+If your self-hosted GitLab is on a subdirectory (e.g. domain.tld/gitlab), as opposed to its own subdomain
49+(e.g. gitlab.domain.tld), you may need to add a redirect from domain.tld/oauth pointing at e.g. domain.tld/gitlab/oauth.
docs/versioned_docs/version-7.10.x/configuration/providers/google.mdnew file+76
@@ -0,0 +1,76 @@
1+---
2+id: google
3+title: Google (default)
4+---
5+
6+## Config Options
7+
8+| Flag | Toml Field | Type | Description | Default |
9+| ---------------------------------------------- | -------------------------------------------- | ------ | ------------------------------------------------------------------------------------------------ | -------------------------------------------------- |
10+| `--google-admin-email` | `google_admin_email` | string | the google admin to impersonate for api calls | |
11+| `--google-group` | `google_groups` | string | restrict logins to members of this google group (may be given multiple times). | |
12+| `--google-service-account-json` | `google_service_account_json` | string | the path to the service account json credentials | |
13+| `--google-use-application-default-credentials` | `google_use_application_default_credentials` | bool | use application default credentials instead of service account json (i.e. GKE Workload Identity) | |
14+| `--google-target-principal` | `google_target_principal` | bool | the target principal to impersonate when using ADC | defaults to the service account configured for ADC |
15+
16+## Usage
17+
18+For Google, the registration steps are:
19+
20+1. Create a new project: https://console.developers.google.com/project
21+2. Choose the new project from the top right project dropdown (only if another project is selected)
22+3. In the project Dashboard center pane, choose **"APIs & Services"**
23+4. In the left Nav pane, choose **"Credentials"**
24+5. In the center pane, choose **"OAuth consent screen"** tab. Fill in **"Product name shown to users"** and hit save.
25+6. In the center pane, choose **"Credentials"** tab.
26+ - Open the **"New credentials"** drop down
27+ - Choose **"OAuth client ID"**
28+ - Choose **"Web application"**
29+ - Application name is freeform, choose something appropriate
30+ - Authorized JavaScript origins is your domain ex: `https://internal.yourcompany.com`
31+ - Authorized redirect URIs is the location of oauth2/callback ex: `https://internal.yourcompany.com/oauth2/callback`
32+ - Choose **"Create"**
33+7. Take note of the **Client ID** and **Client Secret**
34+
35+It's recommended to refresh sessions on a short interval (1h) with `cookie-refresh` setting which validates that the
36+account is still authorized.
37+
38+#### Restrict auth to specific Google groups on your domain. (optional)
39+
40+1. Create a [service account](https://developers.google.com/identity/protocols/OAuth2ServiceAccount) and configure it
41+ to use [Application Default Credentials / Workload Identity / Workload Identity Federation (recommended)](#using-application-default-credentials-adc--workload-identity--workload-identity-federation-recommended) or,
42+ alternatively download the JSON.
43+2. Make note of the Client ID for a future step.
44+3. Under "APIs & Auth", choose APIs.
45+4. Click on Admin SDK and then Enable API.
46+5. Follow the steps on https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account
47+ and give the client id from step 2 the following oauth scopes:
48+
49+ ```
50+ https://www.googleapis.com/auth/admin.directory.group.readonly
51+ https://www.googleapis.com/auth/admin.directory.user.readonly
52+ ```
53+
54+6. Follow the steps on https://support.google.com/a/answer/60757 to enable Admin API access.
55+7. Create or choose an existing administrative email address on the Gmail domain to assign to the `google-admin-email`
56+ flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from
57+ step 5 for the reason why.
58+8. Create or choose an existing email group and set that email to the `google-group` flag. You can pass multiple instances
59+ of this flag with different groups and the user will be checked against all the provided groups.
60+
61+(Only if using a JSON file (see step 1))
62+
63+9. Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and
64+ set the path to the file in the `google-service-account-json` flag.
65+10. Restart oauth2-proxy.
66+
67+Note: The user is checked against the group members list on initial authentication and every time the token is
68+refreshed ( about once an hour ).
69+
70+##### Using Application Default Credentials (ADC) / Workload Identity / Workload Identity Federation (recommended)
71+oauth2-proxy can make use of [Application Default Credentials](https://cloud.google.com/docs/authentication/application-default-credentials).
72+When deployed within GCP, this means that it can automatically use the service account attached to the resource. When deployed to GKE, ADC
73+can be leveraged through a feature called Workload Identity. Follow Google's [guide](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity)
74+to set up Workload Identity.
75+
76+When deployed outside of GCP, [Workload Identity Federation](https://cloud.google.com/docs/authentication/provide-credentials-adc#wlif) might be an option.
docs/versioned_docs/version-7.10.x/configuration/providers/index.mdnew file+43
@@ -0,0 +1,43 @@
1+---
2+id: index
3+title: OAuth Provider Configuration
4+---
5+
6+You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it
7+with Redirect URI(s) for the domain you intend to run `oauth2-proxy` on.
8+
9+Valid providers are :
10+
11+- [ADFS](adfs.md)
12+- [Bitbucket](bitbucket.md)
13+- [DigitalOcean](digitalocean.md)
14+- [Facebook](facebook.md)
15+- [Gitea](gitea.md)
16+- [GitHub](github.md)
17+- [GitLab](gitlab.md)
18+- [Google](google.md) _default_
19+- [Keycloak](keycloak.md) (Deprecated)
20+- [Keycloak OIDC](keycloak_oidc.md)
21+- [LinkedIn](linkedin.md)
22+- [login.gov](login_gov.md)
23+- [Microsoft Azure](ms_azure_ad.md) (Deprecated)
24+- [Microsoft Entra ID](ms_entra_id.md)
25+- [Nextcloud](nextcloud.md)
26+- [OpenID Connect](openid_connect.md)
27+
28+The provider can be selected using the `provider` configuration value, or set in the [`providers` array using AlphaConfig](https://oauth2-proxy.github.io/oauth2-proxy/configuration/alpha-config#providers). However, [**the feature to implement multiple providers is not complete**](https://github.com/oauth2-proxy/oauth2-proxy/issues/926).
29+
30+Please note that not all providers support all claims. The `preferred_username` claim is currently only supported by the
31+OpenID Connect provider.
32+
33+## Email Authentication
34+
35+To authorize a specific email-domain use `--email-domain=yourcompany.com`. To authorize individual email addresses use
36+`--authenticated-emails-file=/path/to/file` with one email per line. To authorize all email addresses use `--email-domain=*`.
37+
38+## Adding a new Provider
39+
40+Follow the examples in the [`providers` package](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/) to define a new
41+`Provider` instance. Add a new `case` to
42+[`providers.New()`](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go) to allow `oauth2-proxy` to use the
43+new `Provider`.
docs/versioned_docs/version-7.10.x/configuration/providers/keycloak.mdnew file+36
@@ -0,0 +1,36 @@
1+---
2+id: keycloak
3+title: Keycloak (Deprecated)
4+---
5+
6+:::note
7+This is the legacy and deprecated provider for Keycloak, use [Keycloak OIDC Auth Provider](keycloak_oidc.md) if possible.
8+:::
9+
10+1. Create new client in your Keycloak realm with **Access Type** 'confidential' and **Valid Redirect URIs** 'https://internal.yourcompany.com/oauth2/callback'
11+2. Take note of the Secret in the credential tab of the client
12+3. Create a mapper with **Mapper Type** 'Group Membership' and **Token Claim Name** 'groups'.
13+
14+Make sure you set the following to the appropriate url:
15+
16+```
17+ --provider=keycloak
18+ --client-id=<client you have created>
19+ --client-secret=<your client's secret>
20+ --login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"
21+ --redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"
22+ --profile-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
23+ --validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
24+ --keycloak-group=<first_allowed_user_group>
25+ --keycloak-group=<second_allowed_user_group>
26+```
27+
28+For group based authorization, the optional `--keycloak-group` (legacy) or `--allowed-group` (global standard)
29+flags can be used to specify which groups to limit access to.
30+
31+If these are unset but a `groups` mapper is set up above in step (3), the provider will still
32+populate the `X-Forwarded-Groups` header to your upstream server with the `groups` data in the
33+Keycloak userinfo endpoint response.
34+
35+The group management in keycloak is using a tree. If you create a group named admin in keycloak
36+you should define the 'keycloak-group' value to /admin.
docs/versioned_docs/version-7.10.x/configuration/providers/keycloak_oidc.mdnew file+151
@@ -0,0 +1,151 @@
1+---
2+id: keycloak_oidc
3+title: Keycloak OIDC
4+---
5+
6+## Config Options
7+
8+| Flag | Toml Field | Type | Description | Default |
9+| ---------------- | --------------- | -------------- | ------------------------------------------------------------------------------------------------------------------ | ------- |
10+| `--allowed-role` | `allowed_roles` | string \| list | restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider. | |
11+
12+## Usage
13+
14+```
15+ --provider=keycloak-oidc
16+ --client-id=<your client's id>
17+ --client-secret=<your client's secret>
18+ --redirect-url=https://internal.yourcompany.com/oauth2/callback
19+ --oidc-issuer-url=https://<keycloak host>/realms/<your realm> // For Keycloak versions <17: --oidc-issuer-url=https://<keycloak host>/auth/realms/<your realm>
20+ --email-domain=<yourcompany.com> // Validate email domain for users, see option documentation
21+ --allowed-role=<realm role name> // Optional, required realm role
22+ --allowed-role=<client id>:<client role name> // Optional, required client role
23+ --allowed-group=</group name> // Optional, requires group client scope
24+ --code-challenge-method=S256 // PKCE
25+```
26+
27+:::note
28+Keycloak has updated its admin console and as of version 19.0.0, the new admin console is enabled by default. The
29+legacy admin console has been announced for removal with the release of version 21.0.0.
30+:::
31+
32+**Keycloak legacy admin console**
33+
34+1. Create new client in your Keycloak realm with **Access Type** 'confidential', **Client protocol** 'openid-connect'
35+ and **Valid Redirect URIs** 'https://internal.yourcompany.com/oauth2/callback'
36+2. Take note of the Secret in the credential tab of the client
37+3. Create a mapper with **Mapper Type** 'Group Membership' and **Token Claim Name** 'groups'.
38+4. Create a mapper with **Mapper Type** 'Audience' and **Included Client Audience** and **Included Custom Audience** set
39+ to your client name.
40+
41+**Keycloak new admin console (default as of v19.0.0)**
42+
43+The following example shows how to create a simple OIDC client using the new Keycloak admin2 console. However, for best
44+practices, it is recommended to consult the Keycloak documentation.
45+
46+The OIDC client must be configured with an _audience mapper_ to include the client's name in the `aud` claim of the JWT token.
47+The `aud` claim specifies the intended recipient of the token, and OAuth2 Proxy expects a match against the values of
48+either `--client-id` or `--oidc-extra-audience`.
49+
50+_In Keycloak, claims are added to JWT tokens through the use of mappers at either the realm level using "client scopes" or
51+through "dedicated" client mappers._
52+
53+**Creating the client**
54+
55+1. Create a new OIDC client in your Keycloak realm by navigating to:
56+ **Clients** -> **Create client**
57+ * **Client Type** 'OpenID Connect'
58+ * **Client ID** `<your client's id>`, please complete the remaining fields as appropriate and click **Next**.
59+ * **Client authentication** 'On'
60+ * **Authentication flow**
61+ * **Standard flow** 'selected'
62+ * **Direct access grants** 'deselect'
63+ * _Save the configuration._
64+ * **Settings / Access settings**:
65+ * **Valid redirect URIs** `https://internal.yourcompany.com/oauth2/callback`
66+ * _Save the configuration._
67+ * Under the **Credentials** tab you will now be able to locate `<your client's secret>`.
68+2. Configure a dedicated *audience mapper* for your client by navigating to **Clients** -> **\<your client's id\>** -> **Client scopes**.
69+* Access the dedicated mappers pane by clicking **\<your client's id\>-dedicated**, located under *Assigned client scope*.
70+ _(It should have a description of "Dedicated scope and mappers for this client")_
71+ * Click **Configure a new mapper** and select **Audience**
72+ * **Name** 'aud-mapper-\<your client's id\>'
73+ * **Included Client Audience** select `<your client's id>` from the dropdown.
74+ * _OAuth2 proxy can be set up to pass both the access and ID JWT tokens to your upstream services.
75+ If you require additional audience entries, you can use the **Included Custom Audience** field in addition
76+ to the "Included Client Audience" dropdown. Note that the "aud" claim of a JWT token should be limited and
77+ only specify its intended recipients._
78+ * **Add to ID token** 'On'
79+ * **Add to access token** 'On' - [#1916](https://github.com/oauth2-proxy/oauth2-proxy/pull/1916)
80+ * _Save the configuration._
81+* Any subsequent dedicated client mappers can be defined by clicking **Dedicated scopes** -> **Add mapper** ->
82+ **By configuration** -> *Select mapper*
83+
84+You should now be able to create a test user in Keycloak and get access to the OAuth2 Proxy instance, make sure to set
85+an email address matching `<yourcompany.com>` and select _Email verified_.
86+
87+**Authorization**
88+
89+_OAuth2 Proxy will perform authorization by requiring a valid user, this authorization can be extended to take into
90+account a user's membership in Keycloak `groups`, `realm roles`, and `client roles` using the keycloak-oidc provider options
91+`--allowed-role` or `--allowed-group`_
92+
93+**Roles**
94+
95+_A standard Keycloak installation comes with the required mappers for **realm roles** and **client roles** through the
96+pre-defined client scope "roles". This ensures that any roles assigned to a user are included in the `JWT` tokens when
97+using an OIDC client that has the "Full scope allowed" feature activated, the feature is enabled by default._
98+
99+_Creating a realm role_
100+* Navigate to **Realm roles** -> **Create role**
101+ * **Role name**, *`<realm role name>`* -> **save**
102+
103+_Creating a client role_
104+* Navigate to **Clients** -> `<your client's id>` -> **Roles** -> **Create role**
105+ * **Role name**, *`<client role name>`* -> **save**
106+
107+
108+_Assign a role to a user_
109+
110+**Users** -> _Username_ -> **Role mapping** -> **Assign role** -> _filter by roles or clients and select_ -> **Assign**.
111+
112+Keycloak "realm roles" can be authorized using the `--allowed-role=<realm role name>` option, while "client roles" can be
113+evaluated using `--allowed-role=<your client's id>:<client role name>`.
114+
115+You may limit the _realm roles_ included in the JWT tokens for any given client by navigating to:
116+**Clients** -> `<your client's id>` -> **Client scopes** -> _\<your client's id\>-dedicated_ -> **Scope**
117+Disabling **Full scope allowed** activates the **Assign role** option, allowing you to select which roles, if assigned
118+to a user, will be included in the user's JWT tokens. This can be useful when a user has many associated roles, and you
119+want to reduce the size and impact of the JWT token.
120+
121+
122+**Groups**
123+
124+You may also do authorization on group memberships by using the OAuth2 Proxy option `--allowed-group`.
125+We will only do a brief description of creating the required _client scope_ **groups** and refer you to read the Keycloak
126+documentation.
127+
128+To summarize, the steps required to authorize Keycloak group membership with OAuth2 Proxy are as follows:
129+
130+* Create a new Client Scope with the name **groups** in Keycloak.
131+ * Include a mapper of type **Group Membership**.
132+ * Set the "Token Claim Name" to **groups** or customize by matching it to the `--oidc-groups-claim` option of OAuth2 Proxy.
133+ * If the "Full group path" option is selected, you need to include a "/" separator in the group names defined in the
134+ `--allowed-group` option of OAuth2 Proxy. Example: "/groupname" or "/groupname/child_group".
135+
136+After creating the _Client Scope_ named _groups_ you will need to attach it to your client.
137+**Clients** -> `<your client's id>` -> **Client scopes** -> **Add client scope** -> Select **groups** and choose Optional
138+and you should now have a client that maps group memberships into the JWT tokens so that Oauth2 Proxy may evaluate them.
139+
140+Create a group by navigating to **Groups** -> **Create group** and _add_ your test user as a member.
141+
142+The OAuth2 Proxy option `--allowed-group=/groupname` will now allow you to filter on group membership
143+
144+Keycloak also has the option of attaching roles to groups, please refer to the Keycloak documentation for more information.
145+
146+**Tip**
147+
148+To check if roles or groups are added to JWT tokens, you can preview a users token in the Keycloak console by following
149+these steps: **Clients** -> `<your client's id>` -> **Client scopes** -> **Evaluate**.
150+Select a _realm user_ and optional _scope parameters_ such as groups, and generate the JSON representation of an access
151+or id token to examine its contents.
docs/versioned_docs/version-7.10.x/configuration/providers/linkedin.mdnew file+13
@@ -0,0 +1,13 @@
1+---
2+id: linkedin
3+title: LinkedIn
4+---
5+
6+For LinkedIn, the registration steps are:
7+
8+1. Create a new project: https://www.linkedin.com/secure/developer
9+2. In the OAuth User Agreement section:
10+ - In default scope, select r_basicprofile and r_emailaddress.
11+ - In "OAuth 2.0 Redirect URLs", enter `https://internal.yourcompany.com/oauth2/callback`
12+3. Fill in the remaining required fields and Save.
13+4. Take note of the **Consumer Key / API Key** and **Consumer Secret / Secret Key**
docs/versioned_docs/version-7.10.x/configuration/providers/login_gov.mdnew file+79
@@ -0,0 +1,79 @@
1+---
2+id: login_gov
3+title: Login.gov
4+---
5+
6+login.gov is an OIDC provider for the US Government.
7+If you are a US Government agency, you can contact the login.gov team through the contact information
8+that you can find on https://login.gov/developers/ and work with them to understand how to get login.gov
9+accounts for integration/test and production access.
10+
11+A developer guide is available here: https://developers.login.gov/, though this proxy handles everything
12+but the data you need to create to register your application in the login.gov dashboard.
13+
14+As a demo, we will assume that you are running your application that you want to secure locally on
15+http://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that
16+you have an agency integration account for testing.
17+
18+First, register your application in the dashboard. The important bits are:
19+* Identity protocol: make this `Openid connect`
20+* Issuer: do what they say for OpenID Connect. We will refer to this string as `${LOGINGOV_ISSUER}`.
21+* Public key: This is a self-signed certificate in .pem format generated from a 2048-bit RSA private key.
22+ A quick way to do this is
23+ `openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'`.
24+ The contents of the `key.pem` shall be referred to as `${OAUTH2_PROXY_JWT_KEY}`.
25+* Return to App URL: Make this be `http://localhost:4180/`
26+* Redirect URIs: Make this be `http://localhost:4180/oauth2/callback`.
27+* Attribute Bundle: Make sure that email is selected.
28+
29+Now start the proxy up with the following options:
30+```
31+./oauth2-proxy -provider login.gov \
32+ -client-id=${LOGINGOV_ISSUER} \
33+ -redirect-url=http://localhost:4180/oauth2/callback \
34+ -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \
35+ -cookie-secure=false \
36+ -email-domain=gsa.gov \
37+ -upstream=http://localhost:3000/ \
38+ -cookie-secret=somerandomstring12341234567890AB \
39+ -cookie-domain=localhost \
40+ -skip-provider-button=true \
41+ -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \
42+ -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \
43+ -jwt-key="${OAUTH2_PROXY_JWT_KEY}"
44+```
45+You can also set all these options with environment variables, for use in cloud/docker environments.
46+One tricky thing that you may encounter is that some cloud environments will pass in environment
47+variables in a docker env-file, which does not allow multiline variables like a PEM file.
48+If you encounter this, then you can create a `jwt_signing_key.pem` file in the top level
49+directory of the repo which contains the key in PEM format and then do your docker build.
50+The docker build process will copy that file into your image which you can then access by
51+setting the `OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem`
52+environment variable, or by setting `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem` on the commandline.
53+
54+Once it is running, you should be able to go to `http://localhost:4180/` in your browser,
55+get authenticated by the login.gov integration server, and then get proxied on to your
56+application running on `http://localhost:3000/`. In a real deployment, you would secure
57+your application with a firewall or something so that it was only accessible from the
58+proxy, and you would use real hostnames everywhere.
59+
60+#### Skip OIDC discovery
61+
62+Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization,
63+token and jwks URI endpoints from the provider's metadata.
64+
65+In this case, you can set the `--skip-oidc-discovery` option, and supply those required endpoints manually:
66+
67+```
68+ -provider oidc
69+ -client-id oauth2-proxy
70+ -client-secret proxy
71+ -redirect-url http://127.0.0.1:4180/oauth2/callback
72+ -oidc-issuer-url http://127.0.0.1:5556
73+ -skip-oidc-discovery
74+ -login-url http://127.0.0.1:5556/authorize
75+ -redeem-url http://127.0.0.1:5556/token
76+ -oidc-jwks-url http://127.0.0.1:5556/keys
77+ -cookie-secure=false
78+ -email-domain example.com
79+```
docs/versioned_docs/version-7.10.x/configuration/providers/ms_azure_ad.mdnew file+59
@@ -0,0 +1,59 @@
1+---
2+id: azure
3+title: Azure (Deprecated)
4+---
5+
6+:::note
7+This is the legacy and deprecated provider for Azure, use [Microsoft Entra ID](ms_entra_id.md) if possible.
8+:::
9+
10+## Config Options
11+
12+| Flag | Toml Field | Type | Description | Default |
13+| ---------------- | -------------- | ------ | ---------------------------------------------------------------- | ---------- |
14+| `--azure-tenant` | `azure_tenant` | string | go to a tenant-specific or common (tenant-independent) endpoint. | `"common"` |
15+| `--resource` | `resource` | string | The resource that is protected (Azure AD only) | |
16+
17+## Usage
18+
19+1. Add an application: go to [https://portal.azure.com](https://portal.azure.com), choose **Azure Active Directory**, select
20+ **App registrations** and then click on **New registration**.
21+2. Pick a name, check the supported account type(single-tenant, multi-tenant, etc). In the **Redirect URI** section create a new
22+ **Web** platform entry for each app that you want to protect by the oauth2 proxy(e.g.
23+ https://internal.yourcompanycom/oauth2/callback). Click **Register**.
24+3. Next we need to add group read permissions for the app registration, on the **API Permissions** page of the app, click on
25+ **Add a permission**, select **Microsoft Graph**, then select **Application permissions**, then click on **Group** and select
26+ **Group.Read.All**. Hit **Add permissions** and then on **Grant admin consent** (you might need an admin to do this).
27+ <br/>**IMPORTANT**: Even if this permission is listed with **"Admin consent required=No"** the consent might actually
28+ be required, due to AAD policies you won't be able to see. If you get a **"Need admin approval"** during login,
29+ most likely this is what you're missing!
30+4. Next, if you are planning to use v2.0 Azure Auth endpoint, go to the **Manifest** page and set `"accessTokenAcceptedVersion": 2`
31+ in the App registration manifest file.
32+5. On the **Certificates & secrets** page of the app, add a new client secret and note down the value after hitting **Add**.
33+6. Configure the proxy with:
34+- for V1 Azure Auth endpoint (Azure Active Directory Endpoints - https://login.microsoftonline.com/common/oauth2/authorize)
35+
36+```
37+ --provider=azure
38+ --client-id=<application ID from step 3>
39+ --client-secret=<value from step 5>
40+ --azure-tenant={tenant-id}
41+ --oidc-issuer-url=https://sts.windows.net/{tenant-id}/
42+```
43+
44+- for V2 Azure Auth endpoint (Microsoft Identity Platform Endpoints - https://login.microsoftonline.com/common/oauth2/v2.0/authorize)
45+```
46+ --provider=azure
47+ --client-id=<application ID from step 3>
48+ --client-secret=<value from step 5>
49+ --azure-tenant={tenant-id}
50+ --oidc-issuer-url=https://login.microsoftonline.com/{tenant-id}/v2.0
51+```
52+
53+***Notes***:
54+- When using v2.0 Azure Auth endpoint (`https://login.microsoftonline.com/{tenant-id}/v2.0`) as `--oidc_issuer_url`, in conjunction
55+ with `--resource` flag, be sure to append `/.default` at the end of the resource name. See
56+ https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#the-default-scope for more details.
57+- When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't
58+ get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the
59+ [redis session storage](../sessions.md#redis-storage) should resolve this.
docs/versioned_docs/version-7.10.x/configuration/providers/ms_entra_id.mdnew file+197
@@ -0,0 +1,197 @@
1+---
2+id: ms_entra_id
3+title: Microsoft Entra ID
4+---
5+
6+Provider for Microsoft Entra ID. Fully compliant with OIDC, with support for group overage and multi-tenant apps.
7+
8+## Config Options
9+
10+The provider is OIDC-compliant, so all the OIDC parameters are honored. Additional provider-specific configuration parameters are:
11+
12+| Flag | Toml Field | Type | Description | Default |
13+| --------------------------- | -------------------------- | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
14+| `--entra-id-allowed-tenant` | `entra_id_allowed_tenants` | string \| list | List of allowed tenants. In case of multi-tenant apps, incoming tokens are issued by different issuers and OIDC issuer verification needs to be disabled. When not specified, all tenants are allowed. Redundant for single-tenant apps (regular ID token validation matches the issuer). | |
15+| `--entra-id-federated-token-auth` | `entra_id_federated_token_auth` | boolean | Enable oAuth2 client authentication with federated token projected by Entra Workload Identity plugin, instead of client secret. | false |
16+
17+## Configure App registration
18+To begin, create an App registration, set a redirect URI, and generate a secret. All account types are supported, including single-tenant, multi-tenant, multi-tenant with Microsoft accounts, and Microsoft accounts only.
19+
20+<details>
21+ <summary>See Azure Portal example</summary>
22+ <div class="videoBlock">
23+ <iframe src="https://www.youtube.com/embed/IUNfxhOzr4E"></iframe>
24+ </div>
25+</details>
26+
27+<details>
28+ <summary>See Terraform example</summary>
29+```
30+ resource "azuread_application" "auth" {
31+ display_name = "oauth2-proxy"
32+ sign_in_audience = "AzureADMyOrg" # Others are also supported
33+
34+ web {
35+ redirect_uris = [
36+ "https://podinfo.lakis.tech/oauth2/callback",
37+ ]
38+ }
39+ // We don't specify any required API permissions - we allow user consent only
40+ }
41+
42+ resource "azuread_service_principal" "sp" {
43+ client_id = azuread_application.auth.client_id
44+ app_role_assignment_required = false
45+ }
46+
47+ resource "azuread_service_principal_password" "pass" {
48+ service_principal_id = azuread_service_principal.sp.id
49+ }
50+
51+```
52+</details>
53+
54+### Configure groups
55+If you want to make use of groups, you can configure *groups claim* to be present in ID Tokens issued by the App registration.
56+<details>
57+ <summary>See Azure Portal example</summary>
58+ <div class="videoBlock">
59+ <div class="videoBlock">
60+ <iframe src="https://www.youtube.com/embed/QZmP5MKEJis"></iframe>
61+ </div>
62+ </div>
63+</details>
64+<details>
65+ <summary>See Terraform example</summary>
66+```
67+ resource "azuread_application" "auth" {
68+ display_name = "oauth2-proxy"
69+ sign_in_audience = "AzureADMyOrg"
70+
71+ group_membership_claims = [
72+ "SecurityGroup"
73+ ]
74+
75+ web {
76+ redirect_uris = [
77+ "https://podinfo.lakis.tech/oauth2/callback",
78+ ]
79+ }
80+ }
81+
82+ resource "azuread_service_principal" "sp" {
83+ client_id = azuread_application.auth.client_id
84+ app_role_assignment_required = false
85+ }
86+
87+ resource "azuread_service_principal_password" "pass" {
88+ service_principal_id = azuread_service_principal.sp.id
89+ }
90+
91+```
92+</details>
93+
94+### Scopes and claims
95+For single-tenant and multi-tenant apps without groups, the only required scope is `openid` (See: [Scopes and permissions](https://learn.microsoft.com/en-us/entra/identity-platform/scopes-oidc#the-openid-scope)).
96+
97+To make use of groups - for example use `allowed_groups` setting or authorize based on groups inside your service - you need to enable *groups claims* in the App Registration. When enabled, list of groups is present in the issued ID token. No additional scopes are required besides `openid`. This works up to 200 groups.
98+
99+When user has more than 200 group memberships, OAuth2-Proxy attempts to retrieve the complete list from Microsoft Graph API's [`transitiveMemberOf`](https://learn.microsoft.com/en-us/graph/api/user-list-transitivememberof). Endpoint requires `User.Read` scope (delegated permission). This permission can be by default consented by user during first login. Set scope to `openid User.Read` to request user consent. Without proper scope, user with 200+ groups will authenticate with 0 groups. See: [group overages](https://learn.microsoft.com/en-us/security/zero-trust/develop/configure-tokens-group-claims-app-roles#group-overages).
100+
101+Alternatively to user consent, both `openid` and `User.Read` permissions can be consented by admistrator. Then, user is not asked for consent on the first login, and group overage works with `openid` scope only. Admin consent can also be required for some tenants. It can be granted with [azuread_service_principal_delegated_permission_grant](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/service_principal_delegated_permission_grant) terraform resource.
102+
103+For personal microsoft accounts, required scope is `openid profile email`.
104+
105+See: [Overview of permissions and consent in the Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/permissions-consent-overview).
106+
107+### Multi-tenant apps
108+To authenticate apps from multiple tenants (including personal Microsoft accounts), set the common OIDC issuer url and disable verification:
109+```toml
110+oidc_issuer_url=https://login.microsoftonline.com/common/v2.0
111+insecure_oidc_skip_issuer_verification=true
112+```
113+`insecure_oidc_skip_issuer_verification` setting is required to disable following checks:
114+* Startup check for matching issuer URL returned from [discovery document](https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration) with `oidc_issuer_url` setting. Required, as document's `issuer` field doesn't equal to `https://login.microsoftonline.com/common/v2.0`. See [OIDC Discovery 4.3](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationValidation).
115+* Matching ID token's `issuer` claim with `oidc_issuer_url` setting during ID token validation. Required to support tokens issued by different tenants. See [OIDC Core 3.1.3.7](https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation).
116+
117+To provide additional security, Entra ID provider performs check on the ID token's `issuer` claim to match the `https://login.microsoftonline.com/{tenant-id}/v2.0` template.
118+
119+### Workload Identity
120+Provider supports authentication with federated token, without need of using client secret. Following conditions have to be met:
121+
122+* Cluster has public OIDC provider URL. For major cloud providers, it can be enabled with a single flag, for example for [Azure Kubernetes Service deployed with Terraform](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster), it's `oidc_issuer_enabled`.
123+* Workload Identity admission webhook is deployed on the cluster. For AKS, it can be enabled with a flag (`workload_identity_enabled` in Terraform resource), for clusters outside of Azure, it can be installed from [helm chart](https://github.com/Azure/azure-workload-identity).
124+* Appropriate federated credential is added to application registration.
125+<details>
126+ <summary>See federated credential terraform example</summary>
127+```
128+ resource "azuread_application_federated_identity_credential" "fedcred" {
129+ application_id = azuread_application.application.id # ID of your application
130+ display_name = "federation-cred"
131+ description = "Workload identity for oauth2-proxy"
132+ audiences = ["api://AzureADTokenExchange"] # Fixed value
133+ issuer = "https://cluster-oidc-issuer-url..."
134+ subject = "system:serviceaccount:oauth2-proxy-namespace-name:oauth2-proxy-sa-name" # set proper NS and SA name
135+ }
136+```
137+</details>
138+
139+* Kubernetes service account associated with oauth2-proxy deployment, is annotated with `azure.workload.identity/client-id: <app-registration-client-id>`
140+* oauth2-proxy pod is labeled with `azure.workload.identity/use: "true"`
141+* oauth2-proxy is configured with `entra_id_federated_token_auth` set to `true`.
142+
143+`client_secret` setting can be omitted when using federated token authentication.
144+
145+See: [Azure Workload Identity documentation](https://azure.github.io/azure-workload-identity/docs/).
146+
147+### Example configurations
148+Single-tenant app without groups (*groups claim* not enabled). Consider using generic OIDC provider:
149+```toml
150+provider="entra-id"
151+oidc_issuer_url="https://login.microsoftonline.com/<tenant-id>/v2.0"
152+client_id="<client-id>"
153+client_secret="<client-secret>"
154+scope="openid"
155+```
156+
157+Single-tenant app with up to 200 groups (*groups claim* enabled). Consider using generic OIDC provider:
158+```toml
159+provider="entra-id"
160+oidc_issuer_url="https://login.microsoftonline.com/<tenant-id>/v2.0"
161+client_id="<client-id>"
162+client_secret="<client-secret>"
163+scope="openid"
164+allowed_groups=["ac51800c-2679-4ecb-8130-636380a3b491"]
165+```
166+
167+Single-tenant app with more than 200 groups:
168+```toml
169+provider="entra-id"
170+oidc_issuer_url="https://login.microsoftonline.com/<tenant-id>/v2.0"
171+client_id="<client-id>"
172+client_secret="<client-secret>"
173+scope="openid User.Read"
174+allowed_groups=["968b4844-d5e7-4e18-a834-59927959369f"]
175+```
176+
177+Single-tenant app with more than 200 groups and workload identity enabled:
178+```toml
179+provider="entra-id"
180+oidc_issuer_url="https://login.microsoftonline.com/<tenant-id>/v2.0"
181+client_id="<client-id>"
182+scope="openid User.Read"
183+allowed_groups=["968b4844-d5e7-4e18-a834-59927959369f"]
184+entra_id_federated_token_auth=true
185+```
186+
187+Multi-tenant app with Microsoft personal accounts & one Entra tenant allowed, with group overage considered:
188+```toml
189+provider="entra-id"
190+oidc_issuer_url="https://login.microsoftonline.com/common/v2.0"
191+client_id="<client-id>"
192+client_secret="<client-secret>"
193+insecure_oidc_skip_issuer_verification=true
194+scope="openid profile email User.Read"
195+entra_id_allowed_tenants=["9188040d-6c67-4c5b-b112-36a304b66dad","<my-tenant-id>"] # Allow only <my-tenant-id> and Personal MS Accounts tenant
196+email_domains="*"
197+```
docs/versioned_docs/version-7.10.x/configuration/providers/nextcloud.mdnew file+28
@@ -0,0 +1,28 @@
1+---
2+id: nextcloud
3+title: NextCloud
4+---
5+
6+The Nextcloud provider allows you to authenticate against users in your
7+Nextcloud instance.
8+
9+When you are using the Nextcloud provider, you must specify the urls via
10+configuration, environment variable, or command line argument. Depending
11+on whether your Nextcloud instance is using pretty urls your urls may be of the
12+form `/index.php/apps/oauth2/*` or `/apps/oauth2/*`.
13+
14+Refer to the [OAuth2
15+documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html)
16+to set up the client id and client secret. Your "Redirection URI" will be
17+`https://internalapp.yourcompany.com/oauth2/callback`.
18+
19+```
20+ -provider nextcloud
21+ -client-id <from nextcloud admin>
22+ -client-secret <from nextcloud admin>
23+ -login-url="<your nextcloud url>/index.php/apps/oauth2/authorize"
24+ -redeem-url="<your nextcloud url>/index.php/apps/oauth2/api/v1/token"
25+ -validate-url="<your nextcloud url>/ocs/v2.php/cloud/user?format=json"
26+```
27+
28+Note: in *all* cases the validate-url will *not* have the `index.php`.
docs/versioned_docs/version-7.10.x/configuration/providers/openid_connect.mdnew file+146
@@ -0,0 +1,146 @@
1+---
2+id: openid_connect
3+title: OpenID Connect
4+---
5+
6+OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects.
7+
8+This provider was originally built against CoreOS Dex, and we will use it as an example.
9+The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below.
10+
11+#### Dex
12+
13+To configure the OIDC provider for Dex, perform the following steps:
14+
15+1. Download Dex:
16+
17+ ```
18+ go get github.com/dexidp/dex
19+ ```
20+
21+ See the [getting started guide](https://dexidp.io/docs/getting-started/) for more details.
22+
23+2. Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to
24+ the `staticClients` section of `examples/config-dev.yaml`:
25+
26+ ```
27+ - id: oauth2-proxy
28+ redirectURIs:
29+ - 'http://127.0.0.1:4180/oauth2/callback'
30+ name: 'oauth2-proxy'
31+ secret: proxy
32+ ```
33+
34+3. Launch Dex: from `$GOPATH/github.com/dexidp/dex`, run:
35+
36+ ```
37+ bin/dex serve examples/config-dev.yaml
38+ ```
39+
40+4. In a second terminal, run the oauth2-proxy with the following args:
41+
42+ ```shell
43+ --provider oidc
44+ --provider-display-name "My OIDC Provider"
45+ --client-id oauth2-proxy
46+ --client-secret proxy
47+ --redirect-url http://127.0.0.1:4180/oauth2/callback
48+ --oidc-issuer-url http://127.0.0.1:5556/dex
49+ --cookie-secure=false
50+ --cookie-secret=secret
51+ --email-domain kilgore.trout
52+ ```
53+
54+ To serve the current working directory as a website under the `/static` endpoint, add:
55+
56+ ```shell
57+ --upstream file://$PWD/#/static/
58+ ```
59+
60+5. Test the setup by visiting http://127.0.0.1:4180 or http://127.0.0.1:4180/static .
61+
62+See also [our local testing environment](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment) for a self-contained example using Docker and etcd as storage for Dex.
63+
64+#### Okta
65+
66+To configure the OIDC provider for Okta, perform the following steps:
67+
68+1. Log in to Okta using an administrative account. It is suggested you try this in preview first, `example.oktapreview.com`
69+2. (OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,
70+ you may wish to configure an authorization server for each application. Otherwise, the provided `default` will work.
71+ * Navigate to **Security** then select **API**
72+ * Click **Add Authorization Server**, if this option is not available you may require an additional license for a custom
73+ authorization server.
74+ * Fill out the **Name** with something to describe the application you are protecting. e.g. 'Example App'.
75+ * For **Audience**, pick the URL of the application you wish to protect: https://example.corp.com
76+ * Fill out a **Description**
77+ * Add any **Access Policies** you wish to configure to limit application access.
78+ * The default settings will work for other options.
79+ [See Okta documentation for more information on Authorization Servers](https://developer.okta.com/docs/guides/customize-authz-server/overview/)
80+3. Navigate to **Applications** then select **Add Application**.
81+ * Select **Web** for the **Platform** setting.
82+ * Select **OpenID Connect** and click **Create**
83+ * Pick an **Application Name** such as `Example App`.
84+ * Set the **Login redirect URI** to `https://example.corp.com`.
85+ * Under **General** set the **Allowed grant types** to `Authorization Code` and `Refresh Token`.
86+ * Leave the rest as default, taking note of the `Client ID` and `Client Secret`.
87+ * Under **Assignments** select the users or groups you wish to access your application.
88+4. Create a configuration file like the following:
89+
90+ ```
91+ provider = "oidc"
92+ redirect_url = "https://example.corp.com/oauth2/callback"
93+ oidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"
94+ upstreams = [
95+ "https://example.corp.com"
96+ ]
97+ email_domains = [
98+ "corp.com"
99+ ]
100+ client_id = "XXXXX"
101+ client_secret = "YYYYY"
102+ pass_access_token = true
103+ cookie_secret = "ZZZZZ"
104+ skip_provider_button = true
105+ ```
106+
107+The `oidc_issuer_url` is based on URL from your **Authorization Server**'s **Issuer** field in step 2, or simply
108+https://corp.okta.com. The `client_id` and `client_secret` are configured in the application settings.
109+Generate a unique `cookie_secret` to encrypt the cookie.
110+
111+Then you can start the oauth2-proxy with `./oauth2-proxy --config /etc/example.cfg`
112+
113+#### Okta - localhost
114+
115+1. Signup for developer account: https://developer.okta.com/signup/
116+2. Create New `Web` Application: https://$\{your-okta-domain\}/dev/console/apps/new
117+3. Example Application Settings for localhost:
118+ * **Name:** My Web App
119+ * **Base URIs:** http://localhost:4180/
120+ * **Login redirect URIs:** http://localhost:4180/oauth2/callback
121+ * **Logout redirect URIs:** http://localhost:4180/
122+ * **Group assignments:** `Everyone`
123+ * **Grant type allowed:** `Authorization Code` and `Refresh Token`
124+4. Make note of the `Client ID` and `Client secret`, they are needed in a future step
125+5. Make note of the **default** Authorization Server Issuer URI from: https://$\{your-okta-domain\}/admin/oauth2/as
126+6. Example config file `/etc/localhost.cfg`
127+ ```shell
128+ provider = "oidc"
129+ redirect_url = "http://localhost:4180/oauth2/callback"
130+ oidc_issuer_url = "https://$\{your-okta-domain\}/oauth2/default"
131+ upstreams = [
132+ "http://0.0.0.0:8080"
133+ ]
134+ email_domains = [
135+ "*"
136+ ]
137+ client_id = "XXX"
138+ client_secret = "YYY"
139+ pass_access_token = true
140+ cookie_secret = "ZZZ"
141+ cookie_secure = false
142+ skip_provider_button = true
143+ # Note: use the following for testing within a container
144+ # http_address = "0.0.0.0:4180"
145+ ```
146+7. Then you can start the oauth2-proxy with `./oauth2-proxy --config /etc/localhost.cfg`
docs/versioned_docs/version-7.10.x/configuration/sessions.mdnew file+99
@@ -0,0 +1,99 @@
1+---
2+id: session_storage
3+title: Session Storage
4+---
5+
6+Sessions allow a user's authentication to be tracked between multiple HTTP
7+requests to a service.
8+
9+The OAuth2 Proxy uses a Cookie to track user sessions and will store the session
10+data in one of the available session storage backends.
11+
12+At present the available backends are (as passed to `--session-store-type`):
13+- [cookie](#cookie-storage) (default)
14+- [redis](#redis-storage)
15+
16+### Cookie Storage
17+
18+The Cookie storage backend is the default backend implementation and has
19+been used in the OAuth2 Proxy historically.
20+
21+With the Cookie storage backend, all session information is stored in client
22+side cookies and transferred with each and every request.
23+
24+The following should be known when using this implementation:
25+- Since all state is stored client side, this storage backend means that the OAuth2 Proxy is completely stateless
26+- Cookies are signed server side to prevent modification client-side
27+- It is mandatory to set a `cookie-secret` which will ensure data is encrypted within the cookie data.
28+- Since multiple requests can be made concurrently to the OAuth2 Proxy, this session implementation
29+cannot lock sessions and while updating and refreshing sessions, there can be conflicts which force
30+users to re-authenticate
31+
32+
33+### Redis Storage
34+
35+The Redis Storage backend stores encrypted sessions in redis. Instead of sending all the information
36+back the client for storage, as in the [Cookie storage](#cookie-storage), a ticket is sent back
37+to the user as the cookie value instead.
38+
39+A ticket is composed as the following:
40+
41+`{CookieName}-{ticketID}.{secret}`
42+
43+Where:
44+
45+- The `CookieName` is the OAuth2 cookie name (_oauth2_proxy by default)
46+- The `ticketID` is a 128-bit random number, hex-encoded
47+- The `secret` is a 128-bit random number, base64url encoded (no padding). The secret is unique for every session.
48+- The pair of `{CookieName}-{ticketID}` comprises a ticket handle, and thus, the redis key
49+to which the session is stored. The encoded session is encrypted with the secret and stored
50+in redis via the `SETEX` command.
51+
52+Encrypting every session uniquely protects the refresh/access/id tokens stored in the session from
53+disclosure. Additionally, the browser only has to send a short Cookie with every request and not the whole JWT,
54+which can get quite big.
55+
56+Two settings are used to configure the OAuth2 Proxy cookie lifetime:
57+
58+ --cookie-refresh duration refresh the cookie after this duration; 0 to disable
59+ --cookie-expire duration expire timeframe for cookie 168h0m0s
60+
61+The "cookie-expire" value should be equal to the lifetime of the Refresh-Token that is issued by the OAuth2 authorization server.
62+If it expires earlier and is deleted by the browser, OAuth2 Proxy cannot find the stored Refresh-Tokens in Redis and thus cannot start
63+the refresh flow to get a new Access-Token. If it is longer, it might be that the old Refresh-Token will be found in Redis but has already
64+expired.
65+
66+The "cookie-refresh" value controls when OAuth2 Proxy tries to refresh an Access-Token. If it is set to "0", the
67+Access-Token will never be refreshed, even if it is already expired and a valid Refresh-Token is available. If set, OAuth2-Proxy will
68+refresh the Access-Token after this many seconds whether it is still valid or not. According to the official OAuth2.0 specification
69+Access-Tokens are not required to follow a specific format. Therefore OAuth2-Proxy cannot check for any expiry date without an
70+introspection endpoint. If an Access-Token expires and you have not set a corresponding "cookie-refresh" value, you will likely
71+encounter expiry issues.
72+
73+Caveat: It can happen that the Access-Token is valid for e.g. "1m" and a request happens after exactly "59s".
74+It would pass OAuth2 Proxy and be forwarded to the backend but is just expired when the backend tries to validate
75+it. This is especially relevant if the backend uses the JWT to make requests to other backends.
76+For this reason, it's advised to set the cookie-refresh a couple of seconds less than the Access-Token lifespan.
77+
78+Recommended settings:
79+
80+* cookie_refresh := Access-Token lifespan - 1m
81+* cookie_expire := Refresh-Token lifespan (i.e. Keycloak client_session_idle)
82+
83+#### Usage
84+
85+When using the redis store, specify `--session-store-type=redis` as well as the Redis connection URL, via
86+`--redis-connection-url=redis://host[:port][/db-number]`.
87+
88+You may also configure the store for Redis Sentinel. In this case, you will want to use the
89+`--redis-use-sentinel=true` flag, as well as configure the flags `--redis-sentinel-master-name`
90+and `--redis-sentinel-connection-urls` appropriately.
91+
92+Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the
93+`--redis-use-cluster=true` flag, and configure the flags `--redis-cluster-connection-urls` appropriately.
94+
95+Note that flags `--redis-use-sentinel=true` and `--redis-use-cluster=true` are mutually exclusive.
96+
97+Note, if Redis timeout option is set to non-zero, the `--redis-connection-idle-timeout`
98+must be less than [Redis timeout option](https://redis.io/docs/reference/clients/#client-timeouts). For example: if either redis.conf includes
99+`timeout 15` or using `CONFIG SET timeout 15` the `--redis-connection-idle-timeout` must be at least `--redis-connection-idle-timeout=14`
docs/versioned_docs/version-7.10.x/configuration/systemd_socket.mdnew file+43
@@ -0,0 +1,43 @@
1+---
2+id: systemd_socket
3+title: Systemd Socket Activation
4+---
5+
6+Pass an existing listener created by systemd.socket to oauth2-proxy.
7+
8+To do this create a socket:
9+
10+oauth2-proxy.socket
11+```
12+[Socket]
13+ListenStream=%t/oauth2.sock
14+SocketGroup=www-data
15+SocketMode=0660
16+```
17+
18+Now it's possible to call this socket from e.g. nginx:
19+```
20+server {
21+ location /oauth2/ {
22+ proxy_pass http://unix:/run/oauth2-proxy/oauth2.sock;
23+}
24+```
25+
26+The oauth2-proxy should have `--http-address=fd:3` as a parameter.
27+Here fd is case insensitive and means file descriptor. The number 3 refers to the first non-stdin/stdout/stderr file descriptor,
28+systemd-socket-activate (which is what systemd.socket uses), listens to what it is told and passes
29+the listener it created onto the process, starting with file descriptor 3.
30+
31+```
32+./oauth2-proxy \
33+ --http-address="fd:3" \
34+ --email-domain="yourcompany.com" \
35+ --upstream=http://127.0.0.1:8080/ \
36+ --cookie-secret=... \
37+ --cookie-secure=true \
38+ --provider=... \
39+ --client-id=... \
40+ --client-secret=...
41+```
42+
43+Currently TLS is not supported (but it's doable).
docs/versioned_docs/version-7.10.x/configuration/tls.mdnew file+85
@@ -0,0 +1,85 @@
1+---
2+id: tls
3+title: TLS Configuration
4+---
5+
6+There are two recommended configurations:
7+- [At OAuth2 Proxy](#terminate-tls-at-oauth2-proxy)
8+- [At Reverse Proxy](#terminate-tls-at-reverse-proxy-eg-nginx)
9+
10+### Terminate TLS at OAuth2 Proxy
11+
12+1. Configure SSL Termination with OAuth2 Proxy by providing a `--tls-cert-file=/path/to/cert.pem` and `--tls-key-file=/path/to/cert.key`.
13+
14+ The command line to run `oauth2-proxy` in this configuration would look like this:
15+
16+ ```bash
17+ ./oauth2-proxy \
18+ --email-domain="yourcompany.com" \
19+ --upstream=http://127.0.0.1:8080/ \
20+ --tls-cert-file=/path/to/cert.pem \
21+ --tls-key-file=/path/to/cert.key \
22+ --cookie-secret=... \
23+ --cookie-secure=true \
24+ --provider=... \
25+ --client-id=... \
26+ --client-secret=...
27+ ```
28+
29+2. With this configuration approach the customization of the TLS settings is limited.
30+
31+ The minimal acceptable TLS version can be set with `--tls-min-version=TLS1.3`.
32+ The defaults set `TLS1.2` as the minimal version.
33+ Regardless of the minimum version configured, `TLS1.3` is currently always used as the maximal version.
34+
35+ TLS server side cipher suites can be specified with `--tls-cipher-suite=TLS_RSA_WITH_RC4_128_SHA`.
36+ If not specified, the defaults from [`crypto/tls`](https://pkg.go.dev/crypto/tls#CipherSuites) of the currently used `go` version for building `oauth2-proxy` will be used.
37+ A complete list of valid TLS cipher suite names can be found in [`crypto/tls`](https://pkg.go.dev/crypto/tls#pkg-constants).
38+
39+### Terminate TLS at Reverse Proxy, e.g. Nginx
40+
41+1. Configure SSL Termination with [Nginx](http://nginx.org/) (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ...
42+
43+ Because `oauth2-proxy` listens on `127.0.0.1:4180` by default, to listen on all interfaces (needed when using an
44+ external load balancer like Amazon ELB or Google Platform Load Balancing) use `--http-address="0.0.0.0:4180"` or
45+ `--http-address="http://:4180"`.
46+
47+ Nginx will listen on port `443` and handle SSL connections while proxying to `oauth2-proxy` on port `4180`.
48+ `oauth2-proxy` will then authenticate requests for an upstream application. The external endpoint for this example
49+ would be `https://internal.yourcompany.com/`.
50+
51+ An example Nginx config follows. Note the use of `Strict-Transport-Security` header to pin requests to SSL
52+ via [HSTS](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security):
53+
54+ ```
55+ server {
56+ listen 443 default ssl;
57+ server_name internal.yourcompany.com;
58+ ssl_certificate /path/to/cert.pem;
59+ ssl_certificate_key /path/to/cert.key;
60+ add_header Strict-Transport-Security max-age=2592000;
61+
62+ location / {
63+ proxy_pass http://127.0.0.1:4180;
64+ proxy_set_header Host $host;
65+ proxy_set_header X-Real-IP $remote_addr;
66+ proxy_connect_timeout 1;
67+ proxy_send_timeout 30;
68+ proxy_read_timeout 30;
69+ }
70+ }
71+ ```
72+
73+2. The command line to run `oauth2-proxy` in this configuration would look like this:
74+
75+ ```bash
76+ ./oauth2-proxy \
77+ --email-domain="yourcompany.com" \
78+ --upstream=http://127.0.0.1:8080/ \
79+ --cookie-secret=... \
80+ --cookie-secure=true \
81+ --provider=... \
82+ --reverse-proxy=true \
83+ --client-id=... \
84+ --client-secret=...
85+ ```
docs/versioned_docs/version-7.10.x/features/endpoints.mdnew file+47
@@ -0,0 +1,47 @@
1+---
2+id: endpoints
3+title: Endpoints
4+---
5+
6+OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The `/oauth2` prefix can be changed with the `--proxy-prefix` config variable.
7+
8+- /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see [robotstxt.org](http://www.robotstxt.org/) for more info
9+- /ping - returns a 200 OK response, which is intended for use with health checks
10+- /ready - returns a 200 OK response if all the underlying connections (e.g., Redis store) are connected
11+- /metrics - Metrics endpoint for Prometheus to scrape, serve on the address specified by `--metrics-address`, disabled by default
12+- /oauth2/sign_in - the login page, which also doubles as a sign-out page (it clears cookies)
13+- /oauth2/sign_out - this URL is used to clear the session cookie
14+- /oauth2/start - a URL that will redirect to start the OAuth cycle
15+- /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
16+- /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
17+- /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the [Nginx `auth_request` directive](../configuration/integration#configuring-for-use-with-the-nginx-auth_request-directive)
18+- /oauth2/static/\* - stylesheets and other dependencies used in the sign_in and error pages
19+
20+### Sign out
21+
22+To sign the user out, redirect them to `/oauth2/sign_out`. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign-out page afterward using the `rd` query parameter, i.e. redirect the user to something like (notice the url-encoding!):
23+
24+```
25+/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page
26+```
27+
28+Alternatively, include the redirect URL in the `X-Auth-Request-Redirect` header:
29+
30+```
31+GET /oauth2/sign_out HTTP/1.1
32+X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
33+...
34+```
35+
36+(The "sign_out_page" should be the [`end_session_endpoint`](https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1) from [the metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig) if your OIDC provider supports Session Management and Discovery.)
37+
38+BEWARE that the domain you want to redirect to (`my-oidc-provider.example.com` in the example) must be added to the [`--whitelist-domain`](../configuration/overview) configuration option otherwise the redirect will be ignored. Make sure to include the actual domain and port (if needed) and not the URL (e.g "localhost:8081" instead of "http://localhost:8081").
39+
40+### Auth
41+
42+This endpoint returns 202 Accepted response or a 401 Unauthorized response.
43+
44+It can be configured using the following query parameters:
45+- `allowed_groups`: comma separated list of allowed groups
46+- `allowed_email_domains`: comma separated list of allowed email domains
47+- `allowed_emails`: comma separated list of allowed emails
docs/versioned_docs/version-7.10.x/installation.mdnew file+32
@@ -0,0 +1,32 @@
1+---
2+id: installation
3+title: Installation
4+---
5+
6+1. Choose how to deploy:
7+
8+ a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.10.0`)
9+
10+ b. Using Go to install the latest release
11+ ```bash
12+ $ go install github.com/oauth2-proxy/oauth2-proxy/v7@latest
13+ ```
14+ This will install the binary into `$GOPATH/bin`. Make sure you include `$GOPATH` in your `$PATH`. Otherwise your system won't find binaries installed via `go install`
15+
16+ c. Using a [Prebuilt Docker Image](https://quay.io/oauth2-proxy/oauth2-proxy) (AMD64, PPC64LE, S390x, ARMv6, ARMv7, and ARM64 available)
17+
18+ d. Using a [Pre-Release Nightly Docker Image](https://quay.io/oauth2-proxy/oauth2-proxy-nightly) (AMD64, PPC64LE, ARMv6, ARMv7, and ARM64 available)
19+
20+ e. Using the official [Kubernetes manifest](https://github.com/oauth2-proxy/manifests) (Helm)
21+
22+ Prebuilt binaries can be validated by extracting the file and verifying it against the `sha256sum.txt` checksum file provided for each release starting with version `v3.0.0`.
23+
24+ ```
25+ $ sha256sum -c sha256sum.txt
26+ oauth2-proxy-x.y.z.linux-amd64: OK
27+ ```
28+
29+2. [Select a Provider and Register an OAuth Application with a Provider](configuration/providers/index.md)
30+3. [Configure OAuth2 Proxy using config file, command line options, or environment variables](configuration/overview.md)
31+4. [Configure SSL or Deploy behind an SSL endpoint](configuration/tls.md) (example provided for Nginx)
32+5. [Configure OAuth2 Proxy using systemd.socket](configuration/systemd_socket.md) (example provided for Nginx/Systemd)
docs/versioned_docs/version-7.10.x/welcome.mdnew file+23
@@ -0,0 +1,23 @@
1+---
2+id: welcome
3+title: Welcome
4+hide_table_of_contents: true
5+slug: /
6+---
7+
8+![OAuth2 Proxy](/img/logos/OAuth2_Proxy_horizontal.svg)
9+
10+A reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others)
11+to validate accounts by email, domain or group.
12+
13+:::note
14+This repository was forked from [bitly/OAuth2_Proxy](https://github.com/bitly/oauth2_proxy) on 27/11/2018.
15+Versions v3.0.0 and up are from this fork and will have diverged from any changes in the original fork.
16+A list of changes can be seen in the [CHANGELOG](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/CHANGELOG.md).
17+:::
18+
19+![Sign In Page](/img/sign-in-page.png)
20+
21+## Architecture
22+
23+![OAuth2 Proxy Architecture](/img/simplified-architecture.svg)
docs/versioned_docs/version-7.11.x/behaviour.mdnew file+26
@@ -0,0 +1,26 @@
1+---
2+id: behaviour
3+title: Behaviour
4+---
5+
6+1. Authentication Requirement: All requests passing through the proxy to upstream applications require authentication, excluding default proxy endpoints.
7+ - Exception: If the request matches a skipped route (configured via `--skip-auth-route`):
8+ - Authentication is not enforced, but the proxy will opportunistically attempt to validate a session cookie (`--cookie-name`) or JWT (`--skip-jwt-bearer-tokens`) if present in the request.
9+ - Configured user info and authentication headers (e.g., `--pass-access-token`) are injected to upstream routes when validation succeeds.
10+
11+2. Unauthenticated Requests: When authentication is missing but required, the user is redirected to the configured Identity Provider (IdP) login page by default.
12+ - Ajax Requests: If the request has `Accept: application/json` header:
13+ - Returns `401 Unauthorized`.
14+ - Invalid JWT Tokens: If `--skip-jwt-bearer-tokens` is set and the request includes an invalid JWT:
15+ - Redirects to the login page by default.
16+ - Returns `403 Forbidden` if `--bearer-token-login-fallback` is set to `false`.
17+
18+3. Post-Authentication: After successful authentication with the IdP, OAuth tokens are stored in the configured session store (cookie or Redis), and a cookie is set.
19+
20+4. Request Forwarding: The authenticated request is processed based on configuration:
21+ - Forwarded to the configured upstream application with added user info and authentication headers, or
22+ - Returns a valid status code for downstream processing by another proxy or load balancer (e.g., Nginx or Traefik).
23+
24+---
25+
26+Note: The proxy also provides a number of useful [endpoints](features/endpoints.md) for monitoring and management.
docs/versioned_docs/version-7.11.x/community/contribution.mdnew file+89
@@ -0,0 +1,89 @@
1+---
2+id: contribution
3+title: Contribution Guide
4+---
5+
6+We track bugs and issues using Github.
7+
8+If you find a bug, please open an Issue. When opening an Issue or Pull Request please follow the preconfigured template and take special note of the checkboxes.
9+
10+If you want to fix a bug, add a new feature or extend existing functionality, please create a fork, create a feature branch and open a PR back to this repo.
11+Please mention open bug issue number(s) within your PR if applicable.
12+
13+We suggest using [Visual Studio Code](https://code.visualstudio.com/docs/languages/go) with the official [Go for Visual Studio Code](https://marketplace.visualstudio.com/items?itemName=golang.go) extension.
14+
15+
16+# Go version
17+
18+This project is currently still using go 1.22. You can follow the installation guide for go [here.](https://go.dev/doc/install) And you can find go version 1.22 in the archived section [here.](https://go.dev/dl/)
19+
20+# Preparing your fork
21+Clone your fork, create a feature branch and update the depedencies to get started.
22+```bash
23+git clone git@github.com:<YOUR_FORK>/oauth2-proxy
24+cd oauth2-proxy
25+git branch feature/<BRANCH_NAME>
26+git push --set-upstream origin feature/<BRANCH_NAME>
27+go mod download
28+```
29+
30+
31+# Testing / Debugging
32+For starting oauth2-proxy locally open the debugging tab and create the `launch.json` and select `Go: Launch Package`.
33+
34+![Debugging Tab](/img/debug-tab.png)
35+```json
36+{
37+ "version": "0.2.0",
38+ "configurations": [
39+ {
40+ "name": "Launch OAuth2-Proxy with Dex",
41+ "type": "go",
42+ "request": "launch",
43+ "mode": "auto",
44+ "program": "${workspaceFolder}",
45+ "args": [
46+ "--config",
47+ // The following configuration contains settings for a locally deployed
48+ // upstream and dex as an idetity provider
49+ "contrib/local-environment/oauth2-proxy.cfg"
50+ ]
51+ },
52+ {
53+ "name": "Launch OAuth2-Proxy with Keycloak",
54+ "type": "go",
55+ "request": "launch",
56+ "mode": "auto",
57+ "program": "${workspaceFolder}",
58+ "args": [
59+ "--config",
60+ // The following configuration contains settings for a locally deployed
61+ // upstream and keycloak as an idetity provider
62+ "contrib/local-environment/oauth2-proxy-keycloak.cfg"
63+ ]
64+ }
65+ ]
66+}
67+```
68+
69+Before you can start your local version of oauth2-proxy, you will have to use the provided docker compose files to start a local upstream service and identity provider. We suggest using [httpbin](https://hub.docker.com/r/kennethreitz/httpbin) as your upstream for testing as it allows for request and response introspection of all things HTTP.
70+
71+Inside the `contrib/local-environment` directory you can use the `Makefile` for
72+starting different example setups:
73+
74+- Dex as your IdP: `make up` or `make down`
75+- Dex as your IdP using the alpha-config: `make alpha-config-up`
76+- Keycloak as your IdP: `make keycloak-up`
77+- Dex as your IdP & nginx reverse proxy: `make nginx-up`
78+- and many more...
79+
80+Check out the `Makefile` to see what is available.
81+
82+The username and password for all setups is usually `admin@example.com` and `password`.
83+
84+The docker compose setups expose the services with a dynamic reverse DNS resolver: localtest.me
85+
86+- OAuth2-Proxy: http://oauth2-proxy.localtest.me:4180
87+- Upstream: http://httpbin.localtest.me:8080
88+- Dex: http://dex.localtest.me:5556
89+
docs/versioned_docs/version-7.11.x/community/security.mdnew file+49
@@ -0,0 +1,49 @@
1+---
2+id: security
3+title: Security
4+---
5+
6+:::note
7+OAuth2 Proxy is a community project.
8+Maintainers do not work on this project full time, and as such,
9+while we endeavour to respond to disclosures as quickly as possible,
10+this may take longer than in projects with corporate sponsorship.
11+:::
12+
13+## Security Disclosures
14+
15+:::important
16+If you believe you have found a vulnerability within OAuth2 Proxy or any of its
17+dependencies, please do NOT open an issue or PR on GitHub, please do NOT post
18+any details publicly.
19+:::
20+
21+Security disclosures MUST be done in private.
22+If you have found an issue that you would like to bring to the attention of the
23+maintenance team for OAuth2 Proxy, please compose an email and send it to the
24+list of maintainers in our [MAINTAINERS](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/MAINTAINERS) file.
25+
26+Please include as much detail as possible.
27+Ideally, your disclosure should include:
28+- A reproducible case that can be used to demonstrate the exploit
29+- How you discovered this vulnerability
30+- A potential fix for the issue (if you have thought of one)
31+- Versions affected (if not present in master)
32+- Your GitHub ID
33+
34+### How will we respond to disclosures?
35+
36+We use [GitHub Security Advisories](https://docs.github.com/en/github/managing-security-vulnerabilities/about-github-security-advisories)
37+to privately discuss fixes for disclosed vulnerabilities.
38+If you include a GitHub ID with your disclosure we will add you as a collaborator
39+for the advisory so that you can join the discussion and validate any fixes
40+we may propose.
41+
42+For minor issues and previously disclosed vulnerabilities (typically for
43+dependencies), we may use regular PRs for fixes and forego the security advisory.
44+
45+Once a fix has been agreed upon, we will merge the fix and create a new release.
46+If we have multiple security issues in flight simultaneously, we may delay
47+merging fixes until all patches are ready.
48+We may also backport the fix to previous releases,
49+but this will be at the discretion of the maintainers.
docs/versioned_docs/version-7.11.x/configuration/alpha_config.mdnew file+564
@@ -0,0 +1,564 @@
1+---
2+id: alpha-config
3+title: Alpha Configuration
4+---
5+
6+:::warning
7+This page contains documentation for alpha features.
8+We reserve the right to make breaking changes to the features detailed within this page with no notice.
9+
10+Options described in this page may be changed, removed, renamed or moved without prior warning.
11+Please beware of this before you use alpha configuration options.
12+:::
13+
14+This page details a set of **alpha** configuration options in a new format.
15+Going forward we are intending to add structured configuration in YAML format to
16+replace the existing TOML based configuration file and flags.
17+
18+Below is a reference for the structure of the configuration, with
19+[AlphaOptions](#alphaoptions) as the root of the configuration.
20+
21+When using alpha configuration, your config file will look something like below:
22+
23+```yaml
24+upstreams:
25+ - id: ...
26+ ...: ...
27+injectRequestHeaders:
28+ - name: ...
29+ ...: ...
30+injectResponseHeaders:
31+ - name: ...
32+ ...: ...
33+```
34+
35+Please browse the [reference](#configuration-reference) below for the structure
36+of the new configuration format.
37+
38+## Using Alpha Configuration
39+
40+To use the new **alpha** configuration, generate a YAML file based on the format
41+described in the [reference](#configuration-reference) below.
42+
43+Provide the path to this file using the `--alpha-config` flag.
44+
45+:::note
46+When using the `--alpha-config` flag, some options are no longer available.
47+See [removed options](#removed-options) below for more information.
48+:::
49+
50+### Converting configuration to the new structure
51+
52+Before adding the new `--alpha-config` option, start OAuth2 Proxy using the
53+`convert-config-to-alpha` flag to convert existing configuration to the new format.
54+
55+```bash
56+oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg
57+```
58+
59+This will convert any options supported by the new format to YAML and print the
60+new configuration to `STDOUT`.
61+
62+Copy this to a new file, remove any options from your existing configuration
63+noted in [removed options](#removed-options) and then start OAuth2 Proxy using
64+the new config.
65+
66+```bash
67+oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg
68+```
69+
70+## Using ENV variables in the alpha configuration
71+
72+The alpha package supports the use of environment variables in place of yaml keys, allowing sensitive values to be pulled from somewhere other than the yaml file.
73+When using environment variables, your yaml will look like this:
74+
75+```yaml
76+ providers:
77+ - provider: azure
78+ clientSecret: ${CLIENT_SECRET}
79+ ...
80+```
81+Where CLIENT_SECRET is an environment variable.
82+More information and available patterns can be found [here](https://github.com/a8m/envsubst#docs)
83+
84+## Removed options
85+
86+The following flags/options and their respective environment variables are no
87+longer available when using alpha configuration:
88+
89+<!-- Legacy Upstream FlagSet -->
90+- `flush-interval`/`flush_interval`
91+- `pass-host-header`/`pass_host_header`
92+- `proxy-websockets`/`proxy_websockets`
93+- `ssl-upstream-insecure-skip-verify`/`ssl_upstream_insecure_skip_verify`
94+- `upstream`/`upstreams`
95+
96+<!-- Legacy Headers FlagSet -->
97+- `pass-basic-auth`/`pass_basic_auth`
98+- `pass-access-token`/`pass_access_token`
99+- `pass-user-headers`/`pass_user_headers`
100+- `pass-authorization-header`/`pass_authorization_header`
101+- `set-basic-auth`/`set_basic_auth`
102+- `set-xauthrequest`/`set_xauthrequest`
103+- `set-authorization-header`/`set_authorization_header`
104+- `prefer-email-to-user`/`prefer_email_to_user`
105+- `basic-auth-password`/`basic_auth_password`
106+- `skip-auth-strip-headers`/`skip_auth_strip_headers`
107+
108+<!-- Legacy provider FlagSet -->
109+- `client-id`/`client_id`
110+- `client-secret`/`client_secret`, and `client-secret-file`/`client_secret_file`
111+- `provider`
112+- `provider-display-name`/`provider_display_name`
113+- `provider-ca-file`/`provider_ca_files`
114+- `login-url`/`login_url`
115+- `redeem-url`/`redeem_url`
116+- `profile-url`/`profile_url`
117+- `resource`
118+- `validate-url`/`validate_url`
119+- `scope`
120+- `prompt`
121+- `approval-prompt`/`approval_prompt`
122+- `acr-values`/`acr_values`
123+- `user-id-claim`/`user_id_claim`
124+- `allowed-group`/`allowed_groups`
125+- `allowed-role`/`allowed_roles`
126+- `jwt-key`/`jwt_key`
127+- `jwt-key-file`/`jwt_key_file`
128+- `pubjwk-url`/`pubjwk_url`
129+
130+and all provider-specific options, i.e. any option whose name includes `oidc`,
131+`azure`, `bitbucket`, `github`, `gitlab`, `google` or `keycloak`. Attempting to
132+use any of these options via flags or via config when `--alpha-config` is
133+set will result in an error.
134+
135+:::important
136+You must remove these options before starting OAuth2 Proxy with `--alpha-config`
137+:::
138+
139+## Configuration Reference
140+
141+<!--- THIS FILE IS AUTOGENERATED!!! DO NOT EDIT!!! -->
142+
143+### ADFSOptions
144+
145+(**Appears on:** [Provider](#provider))
146+
147+
148+
149+| Field | Type | Description |
150+| ----- | ---- | ----------- |
151+| `skipScope` | _bool_ | Skip adding the scope parameter in login request<br/>Default value is 'false' |
152+
153+### AlphaOptions
154+
155+AlphaOptions contains alpha structured configuration options.
156+Usage of these options allows users to access alpha features that are not
157+available as part of the primary configuration structure for OAuth2 Proxy.
158+
159+:::warning
160+The options within this structure are considered alpha.
161+They may change between releases without notice.
162+:::
163+
164+| Field | Type | Description |
165+| ----- | ---- | ----------- |
166+| `upstreamConfig` | _[UpstreamConfig](#upstreamconfig)_ | UpstreamConfig is used to configure upstream servers.<br/>Once a user is authenticated, requests to the server will be proxied to<br/>these upstream servers based on the path mappings defined in this list. |
167+| `injectRequestHeaders` | _[[]Header](#header)_ | InjectRequestHeaders is used to configure headers that should be added<br/>to requests to upstream servers.<br/>Headers may source values from either the authenticated user's session<br/>or from a static secret value. |
168+| `injectResponseHeaders` | _[[]Header](#header)_ | InjectResponseHeaders is used to configure headers that should be added<br/>to responses from the proxy.<br/>This is typically used when using the proxy as an external authentication<br/>provider in conjunction with another proxy such as NGINX and its<br/>auth_request module.<br/>Headers may source values from either the authenticated user's session<br/>or from a static secret value. |
169+| `server` | _[Server](#server)_ | Server is used to configure the HTTP(S) server for the proxy application.<br/>You may choose to run both HTTP and HTTPS servers simultaneously.<br/>This can be done by setting the BindAddress and the SecureBindAddress simultaneously.<br/>To use the secure server you must configure a TLS certificate and key. |
170+| `metricsServer` | _[Server](#server)_ | MetricsServer is used to configure the HTTP(S) server for metrics.<br/>You may choose to run both HTTP and HTTPS servers simultaneously.<br/>This can be done by setting the BindAddress and the SecureBindAddress simultaneously.<br/>To use the secure server you must configure a TLS certificate and key. |
171+| `providers` | _[Providers](#providers)_ | Providers is used to configure your provider. **Multiple-providers is not<br/>yet working.** [This feature is tracked in<br/>#925](https://github.com/oauth2-proxy/oauth2-proxy/issues/926) |
172+
173+### AzureOptions
174+
175+(**Appears on:** [Provider](#provider))
176+
177+
178+
179+| Field | Type | Description |
180+| ----- | ---- | ----------- |
181+| `tenant` | _string_ | Tenant directs to a tenant-specific or common (tenant-independent) endpoint<br/>Default value is 'common' |
182+| `graphGroupField` | _string_ | GraphGroupField configures the group field to be used when building the groups list from Microsoft Graph<br/>Default value is 'id' |
183+
184+### BitbucketOptions
185+
186+(**Appears on:** [Provider](#provider))
187+
188+
189+
190+| Field | Type | Description |
191+| ----- | ---- | ----------- |
192+| `team` | _string_ | Team sets restrict logins to members of this team |
193+| `repository` | _string_ | Repository sets restrict logins to user with access to this repository |
194+
195+### ClaimSource
196+
197+(**Appears on:** [HeaderValue](#headervalue))
198+
199+ClaimSource allows loading a header value from a claim within the session
200+
201+| Field | Type | Description |
202+| ----- | ---- | ----------- |
203+| `claim` | _string_ | Claim is the name of the claim in the session that the value should be<br/>loaded from. Available claims: `access_token` `id_token` `created_at`<br/>`expires_on` `refresh_token` `email` `user` `groups` `preferred_username`. |
204+| `prefix` | _string_ | Prefix is an optional prefix that will be prepended to the value of the<br/>claim if it is non-empty. |
205+| `basicAuthPassword` | _[SecretSource](#secretsource)_ | BasicAuthPassword converts this claim into a basic auth header.<br/>Note the value of claim will become the basic auth username and the<br/>basicAuthPassword will be used as the password value. |
206+
207+### Duration
208+#### (`string` alias)
209+
210+(**Appears on:** [Upstream](#upstream))
211+
212+Duration is as string representation of a period of time.
213+A duration string is a is a possibly signed sequence of decimal numbers,
214+each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".
215+Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
216+
217+### GitHubOptions
218+
219+(**Appears on:** [Provider](#provider))
220+
221+
222+
223+| Field | Type | Description |
224+| ----- | ---- | ----------- |
225+| `org` | _string_ | Org sets restrict logins to members of this organisation |
226+| `team` | _string_ | Team sets restrict logins to members of this team |
227+| `repo` | _string_ | Repo sets restrict logins to collaborators of this repository |
228+| `token` | _string_ | Token is the token to use when verifying repository collaborators<br/>it must have push access to the repository |
229+| `users` | _[]string_ | Users allows users with these usernames to login<br/>even if they do not belong to the specified org and team or collaborators |
230+
231+### GitLabOptions
232+
233+(**Appears on:** [Provider](#provider))
234+
235+
236+
237+| Field | Type | Description |
238+| ----- | ---- | ----------- |
239+| `group` | _[]string_ | Group sets restrict logins to members of this group |
240+| `projects` | _[]string_ | Projects restricts logins to members of these projects |
241+
242+### GoogleOptions
243+
244+(**Appears on:** [Provider](#provider))
245+
246+
247+
248+| Field | Type | Description |
249+| ----- | ---- | ----------- |
250+| `group` | _[]string_ | Groups sets restrict logins to members of this Google group |
251+| `adminEmail` | _string_ | AdminEmail is the Google admin to impersonate for api calls |
252+| `serviceAccountJson` | _string_ | ServiceAccountJSON is the path to the service account json credentials |
253+| `useApplicationDefaultCredentials` | _bool_ | UseApplicationDefaultCredentials is a boolean whether to use Application Default Credentials instead of a ServiceAccountJSON |
254+| `targetPrincipal` | _string_ | TargetPrincipal is the Google Service Account used for Application Default Credentials |
255+
256+### Header
257+
258+(**Appears on:** [AlphaOptions](#alphaoptions))
259+
260+Header represents an individual header that will be added to a request or
261+response header.
262+
263+| Field | Type | Description |
264+| ----- | ---- | ----------- |
265+| `name` | _string_ | Name is the header name to be used for this set of values.<br/>Names should be unique within a list of Headers. |
266+| `preserveRequestValue` | _bool_ | PreserveRequestValue determines whether any values for this header<br/>should be preserved for the request to the upstream server.<br/>This option only applies to injected request headers.<br/>Defaults to false (headers that match this header will be stripped). |
267+| `values` | _[[]HeaderValue](#headervalue)_ | Values contains the desired values for this header |
268+
269+### HeaderValue
270+
271+(**Appears on:** [Header](#header))
272+
273+HeaderValue represents a single header value and the sources that can
274+make up the header value
275+
276+| Field | Type | Description |
277+| ----- | ---- | ----------- |
278+| `value` | _[]byte_ | Value expects a base64 encoded string value. |
279+| `fromEnv` | _string_ | FromEnv expects the name of an environment variable. |
280+| `fromFile` | _string_ | FromFile expects a path to a file containing the secret value. |
281+| `claim` | _string_ | Claim is the name of the claim in the session that the value should be<br/>loaded from. Available claims: `access_token` `id_token` `created_at`<br/>`expires_on` `refresh_token` `email` `user` `groups` `preferred_username`. |
282+| `prefix` | _string_ | Prefix is an optional prefix that will be prepended to the value of the<br/>claim if it is non-empty. |
283+| `basicAuthPassword` | _[SecretSource](#secretsource)_ | BasicAuthPassword converts this claim into a basic auth header.<br/>Note the value of claim will become the basic auth username and the<br/>basicAuthPassword will be used as the password value. |
284+
285+### KeycloakOptions
286+
287+(**Appears on:** [Provider](#provider))
288+
289+
290+
291+| Field | Type | Description |
292+| ----- | ---- | ----------- |
293+| `groups` | _[]string_ | Group enables to restrict login to members of indicated group |
294+| `roles` | _[]string_ | Role enables to restrict login to users with role (only available when using the keycloak-oidc provider) |
295+
296+### LoginGovOptions
297+
298+(**Appears on:** [Provider](#provider))
299+
300+
301+
302+| Field | Type | Description |
303+| ----- | ---- | ----------- |
304+| `jwtKey` | _string_ | JWTKey is a private key in PEM format used to sign JWT, |
305+| `jwtKeyFile` | _string_ | JWTKeyFile is a path to the private key file in PEM format used to sign the JWT |
306+| `pubjwkURL` | _string_ | PubJWKURL is the JWK pubkey access endpoint |
307+
308+### LoginURLParameter
309+
310+(**Appears on:** [Provider](#provider))
311+
312+LoginURLParameter is the configuration for a single query parameter that
313+can be passed through from the `/oauth2/start` endpoint to the IdP login
314+URL. The "default" option specifies the default value or values (if any)
315+that will be passed to the IdP for this parameter, and "allow" is a list
316+of options for ways in which this parameter can be set or overridden via
317+the query string to `/oauth2/start`.
318+If _only_ a default is specified and no "allow" then the parameter is
319+effectively fixed - the default value will always be used and anything
320+passed to the start URL will be ignored. If _only_ "allow" is specified
321+but no default then the parameter will only be passed on to the IdP if
322+the caller provides it, and no value will be sent otherwise.
323+
324+Examples:
325+
326+# A parameter whose value is fixed
327+
328+```
329+name: organization
330+default:
331+- myorg
332+```
333+
334+A parameter that is not passed by default, but may be set to one of a
335+fixed set of values
336+
337+```
338+name: prompt
339+allow:
340+- value: login
341+- value: consent
342+- value: select_account
343+```
344+
345+A parameter that is passed by default but may be overridden by one of
346+a fixed set of values
347+
348+```
349+name: prompt
350+default: ["login"]
351+allow:
352+- value: consent
353+- value: select_account
354+```
355+
356+A parameter that may be overridden, but only by values that match a
357+regular expression. For example to restrict `login_hint` to email
358+addresses in your organization's domain:
359+
360+```
361+name: login_hint
362+allow:
363+- pattern: '^[^@]*@example\.com$'
364+# this allows at most one "@" sign, and requires "example.com" domain.
365+```
366+
367+Note that the YAML rules around exactly which characters are allowed
368+and/or require escaping in different types of string literals are
369+convoluted. For regular expressions the single quoted form is simplest
370+as backslash is not considered to be an escape character. Alternatively
371+use the "chomped block" format `|-`:
372+
373+```
374+ - pattern: |-
375+ ^[^@]*@example\.com$
376+
377+```
378+
379+The hyphen is important, a `|` block would have a trailing newline
380+character.
381+
382+| Field | Type | Description |
383+| ----- | ---- | ----------- |
384+| `name` | _string_ | Name specifies the name of the query parameter. |
385+| `default` | _[]string_ | _(Optional)_ Default specifies a default value or values that will be<br/>passed to the IdP if not overridden. |
386+| `allow` | _[[]URLParameterRule](#urlparameterrule)_ | _(Optional)_ Allow specifies rules about how the default (if any) may be<br/>overridden via the query string to `/oauth2/start`. Only<br/>values that match one or more of the allow rules will be<br/>forwarded to the IdP. |
387+
388+### MicrosoftEntraIDOptions
389+
390+(**Appears on:** [Provider](#provider))
391+
392+
393+
394+| Field | Type | Description |
395+| ----- | ---- | ----------- |
396+| `allowedTenants` | _[]string_ | AllowedTenants is a list of allowed tenants. In case of multi-tenant apps, incoming tokens are<br/>issued by different issuers and OIDC issuer verification needs to be disabled.<br/>When not specified, all tenants are allowed. Redundant for single-tenant apps<br/>(regular ID token validation matches the issuer). |
397+| `federatedTokenAuth` | _bool_ | FederatedTokenAuth enable oAuth2 client authentication with federated token projected<br/>by Entra Workload Identity plugin, instead of client secret. |
398+
399+### OIDCOptions
400+
401+(**Appears on:** [Provider](#provider))
402+
403+
404+
405+| Field | Type | Description |
406+| ----- | ---- | ----------- |
407+| `issuerURL` | _string_ | IssuerURL is the OpenID Connect issuer URL<br/>eg: https://accounts.google.com |
408+| `insecureAllowUnverifiedEmail` | _bool_ | InsecureAllowUnverifiedEmail prevents failures if an email address in an id_token is not verified<br/>default set to 'false' |
409+| `insecureSkipIssuerVerification` | _bool_ | InsecureSkipIssuerVerification skips verification of ID token issuers. When false, ID Token Issuers must match the OIDC discovery URL<br/>default set to 'false' |
410+| `insecureSkipNonce` | _bool_ | InsecureSkipNonce skips verifying the ID Token's nonce claim that must match<br/>the random nonce sent in the initial OAuth flow. Otherwise, the nonce is checked<br/>after the initial OAuth redeem & subsequent token refreshes.<br/>default set to 'true'<br/>Warning: In a future release, this will change to 'false' by default for enhanced security. |
411+| `skipDiscovery` | _bool_ | SkipDiscovery allows to skip OIDC discovery and use manually supplied Endpoints<br/>default set to 'false' |
412+| `jwksURL` | _string_ | JwksURL is the OpenID Connect JWKS URL<br/>eg: https://www.googleapis.com/oauth2/v3/certs |
413+| `publicKeyFiles` | _[]string_ | PublicKeyFiles is a list of paths pointing to public key files in PEM format to use<br/>for verifying JWT tokens |
414+| `emailClaim` | _string_ | EmailClaim indicates which claim contains the user email,<br/>default set to 'email' |
415+| `groupsClaim` | _string_ | GroupsClaim indicates which claim contains the user groups<br/>default set to 'groups' |
416+| `userIDClaim` | _string_ | UserIDClaim indicates which claim contains the user ID<br/>default set to 'email' |
417+| `audienceClaims` | _[]string_ | AudienceClaim allows to define any claim that is verified against the client id<br/>By default `aud` claim is used for verification. |
418+| `extraAudiences` | _[]string_ | ExtraAudiences is a list of additional audiences that are allowed<br/>to pass verification in addition to the client id. |
419+
420+### Provider
421+
422+(**Appears on:** [Providers](#providers))
423+
424+Provider holds all configuration for a single provider
425+
426+| Field | Type | Description |
427+| ----- | ---- | ----------- |
428+| `clientID` | _string_ | ClientID is the OAuth Client ID that is defined in the provider<br/>This value is required for all providers. |
429+| `clientSecret` | _string_ | ClientSecret is the OAuth Client Secret that is defined in the provider<br/>This value is required for all providers. |
430+| `clientSecretFile` | _string_ | ClientSecretFile is the name of the file<br/>containing the OAuth Client Secret, it will be used if ClientSecret is not set. |
431+| `keycloakConfig` | _[KeycloakOptions](#keycloakoptions)_ | KeycloakConfig holds all configurations for Keycloak provider. |
432+| `azureConfig` | _[AzureOptions](#azureoptions)_ | AzureConfig holds all configurations for Azure provider. |
433+| `microsoftEntraIDConfig` | _[MicrosoftEntraIDOptions](#microsoftentraidoptions)_ | MicrosoftEntraIDConfig holds all configurations for Entra ID provider. |
434+| `ADFSConfig` | _[ADFSOptions](#adfsoptions)_ | ADFSConfig holds all configurations for ADFS provider. |
435+| `bitbucketConfig` | _[BitbucketOptions](#bitbucketoptions)_ | BitbucketConfig holds all configurations for Bitbucket provider. |
436+| `githubConfig` | _[GitHubOptions](#githuboptions)_ | GitHubConfig holds all configurations for GitHubC provider. |
437+| `gitlabConfig` | _[GitLabOptions](#gitlaboptions)_ | GitLabConfig holds all configurations for GitLab provider. |
438+| `googleConfig` | _[GoogleOptions](#googleoptions)_ | GoogleConfig holds all configurations for Google provider. |
439+| `oidcConfig` | _[OIDCOptions](#oidcoptions)_ | OIDCConfig holds all configurations for OIDC provider<br/>or providers utilize OIDC configurations. |
440+| `loginGovConfig` | _[LoginGovOptions](#logingovoptions)_ | LoginGovConfig holds all configurations for LoginGov provider. |
441+| `id` | _string_ | ID should be a unique identifier for the provider.<br/>This value is required for all providers. |
442+| `provider` | _[ProviderType](#providertype)_ | Type is the OAuth provider<br/>must be set from the supported providers group,<br/>otherwise 'Google' is set as default |
443+| `name` | _string_ | Name is the providers display name<br/>if set, it will be shown to the users in the login page. |
444+| `caFiles` | _[]string_ | CAFiles is a list of paths to CA certificates that should be used when connecting to the provider.<br/>If not specified, the default Go trust sources are used instead |
445+| `useSystemTrustStore` | _bool_ | UseSystemTrustStore determines if your custom CA files and the system trust store are used<br/>If set to true, your custom CA files and the system trust store are used otherwise only your custom CA files. |
446+| `loginURL` | _string_ | LoginURL is the authentication endpoint |
447+| `loginURLParameters` | _[[]LoginURLParameter](#loginurlparameter)_ | LoginURLParameters defines the parameters that can be passed from the start URL to the IdP login URL |
448+| `authRequestResponseMode` | _string_ | AuthRequestResponseMode defines the response mode to request during authorization request |
449+| `redeemURL` | _string_ | RedeemURL is the token redemption endpoint |
450+| `profileURL` | _string_ | ProfileURL is the profile access endpoint |
451+| `skipClaimsFromProfileURL` | _bool_ | SkipClaimsFromProfileURL allows to skip request to Profile URL for resolving claims not present in id_token<br/>default set to 'false' |
452+| `resource` | _string_ | ProtectedResource is the resource that is protected (Azure AD and ADFS only) |
453+| `validateURL` | _string_ | ValidateURL is the access token validation endpoint |
454+| `scope` | _string_ | Scope is the OAuth scope specification |
455+| `allowedGroups` | _[]string_ | AllowedGroups is a list of restrict logins to members of this group |
456+| `code_challenge_method` | _string_ | The code challenge method |
457+| `backendLogoutURL` | _string_ | URL to call to perform backend logout, `{id_token}` would be replaced by the actual `id_token` if available in the session |
458+
459+### ProviderType
460+#### (`string` alias)
461+
462+(**Appears on:** [Provider](#provider))
463+
464+ProviderType is used to enumerate the different provider type options
465+Valid options are: adfs, azure, bitbucket, digitalocean facebook, github,
466+gitlab, google, keycloak, keycloak-oidc, linkedin, login.gov, nextcloud
467+and oidc.
468+
469+### Providers
470+
471+#### ([[]Provider](#provider) alias)
472+
473+(**Appears on:** [AlphaOptions](#alphaoptions))
474+
475+The provider can be selected using the `provider` configuration value, or
476+set in the [`providers` array using
477+AlphaConfig](https://oauth2-proxy.github.io/oauth2-proxy/configuration/alpha-config#providers).
478+However, [**the feature to implement multiple providers is not
479+complete**](https://github.com/oauth2-proxy/oauth2-proxy/issues/926).
480+
481+### SecretSource
482+
483+(**Appears on:** [ClaimSource](#claimsource), [HeaderValue](#headervalue), [TLS](#tls))
484+
485+SecretSource references an individual secret value.
486+Only one source within the struct should be defined at any time.
487+
488+| Field | Type | Description |
489+| ----- | ---- | ----------- |
490+| `value` | _[]byte_ | Value expects a base64 encoded string value. |
491+| `fromEnv` | _string_ | FromEnv expects the name of an environment variable. |
492+| `fromFile` | _string_ | FromFile expects a path to a file containing the secret value. |
493+
494+### Server
495+
496+(**Appears on:** [AlphaOptions](#alphaoptions))
497+
498+Server represents the configuration for an HTTP(S) server
499+
500+| Field | Type | Description |
501+| ----- | ---- | ----------- |
502+| `BindAddress` | _string_ | BindAddress is the address on which to serve traffic.<br/>Leave blank or set to "-" to disable. |
503+| `SecureBindAddress` | _string_ | SecureBindAddress is the address on which to serve secure traffic.<br/>Leave blank or set to "-" to disable. |
504+| `TLS` | _[TLS](#tls)_ | TLS contains the information for loading the certificate and key for the<br/>secure traffic and further configuration for the TLS server. |
505+
506+### TLS
507+
508+(**Appears on:** [Server](#server))
509+
510+TLS contains the information for loading a TLS certificate and key
511+as well as an optional minimal TLS version that is acceptable.
512+
513+| Field | Type | Description |
514+| ----- | ---- | ----------- |
515+| `Key` | _[SecretSource](#secretsource)_ | Key is the TLS key data to use.<br/>Typically this will come from a file. |
516+| `Cert` | _[SecretSource](#secretsource)_ | Cert is the TLS certificate data to use.<br/>Typically this will come from a file. |
517+| `MinVersion` | _string_ | MinVersion is the minimal TLS version that is acceptable.<br/>E.g. Set to "TLS1.3" to select TLS version 1.3 |
518+| `CipherSuites` | _[]string_ | CipherSuites is a list of TLS cipher suites that are allowed.<br/>E.g.:<br/>- TLS_RSA_WITH_RC4_128_SHA<br/>- TLS_RSA_WITH_AES_256_GCM_SHA384<br/>If not specified, the default Go safe cipher list is used.<br/>List of valid cipher suites can be found in the [crypto/tls documentation](https://pkg.go.dev/crypto/tls#pkg-constants). |
519+
520+### URLParameterRule
521+
522+(**Appears on:** [LoginURLParameter](#loginurlparameter))
523+
524+URLParameterRule represents a rule by which query parameters
525+passed to the `/oauth2/start` endpoint are checked to determine whether
526+they are valid overrides for the given parameter passed to the IdP's
527+login URL. Either Value or Pattern should be supplied, not both.
528+
529+| Field | Type | Description |
530+| ----- | ---- | ----------- |
531+| `value` | _string_ | A Value rule matches just this specific value |
532+| `pattern` | _string_ | A Pattern rule gives a regular expression that must be matched by<br/>some substring of the value. The expression is _not_ automatically<br/>anchored to the start and end of the value, if you _want_ to restrict<br/>the whole parameter value you must anchor it yourself with `^` and `$`. |
533+
534+### Upstream
535+
536+(**Appears on:** [UpstreamConfig](#upstreamconfig))
537+
538+Upstream represents the configuration for an upstream server.
539+Requests will be proxied to this upstream if the path matches the request path.
540+
541+| Field | Type | Description |
542+| ----- | ---- | ----------- |
543+| `id` | _string_ | ID should be a unique identifier for the upstream.<br/>This value is required for all upstreams. |
544+| `path` | _string_ | Path is used to map requests to the upstream server.<br/>The closest match will take precedence and all Paths must be unique.<br/>Path can also take a pattern when used with RewriteTarget.<br/>Path segments can be captured and matched using regular experessions.<br/>Eg:<br/>- `^/foo$`: Match only the explicit path `/foo`<br/>- `^/bar/$`: Match any path prefixed with `/bar/`<br/>- `^/baz/(.*)$`: Match any path prefixed with `/baz` and capture the remaining path for use with RewriteTarget |
545+| `rewriteTarget` | _string_ | RewriteTarget allows users to rewrite the request path before it is sent to<br/>the upstream server (for an HTTP/HTTPS upstream) or mapped to the filesystem<br/>(for a `file:` upstream).<br/>Use the Path to capture segments for reuse within the rewrite target.<br/>Eg: With a Path of `^/baz/(.*)`, a RewriteTarget of `/foo/$1` would rewrite<br/>the request `/baz/abc/123` to `/foo/abc/123` before proxying to the<br/>upstream server. Or if the upstream were `file:///app`, a request for<br/>`/baz/info.html` would return the contents of the file `/app/foo/info.html`. |
546+| `uri` | _string_ | The URI of the upstream server. This may be an HTTP(S) server of a File<br/>based URL. It may include a path, in which case all requests will be served<br/>under that path.<br/>Eg:<br/>- http://localhost:8080<br/>- https://service.localhost<br/>- https://service.localhost/path<br/>- file://host/path<br/>If the URI's path is "/base" and the incoming request was for "/dir",<br/>the upstream request will be for "/base/dir". |
547+| `insecureSkipTLSVerify` | _bool_ | InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.<br/>This option is insecure and will allow potential Man-In-The-Middle attacks<br/>between OAuth2 Proxy and the upstream server.<br/>Defaults to false. |
548+| `static` | _bool_ | Static will make all requests to this upstream have a static response.<br/>The response will have a body of "Authenticated" and a response code<br/>matching StaticCode.<br/>If StaticCode is not set, the response will return a 200 response. |
549+| `staticCode` | _int_ | StaticCode determines the response code for the Static response.<br/>This option can only be used with Static enabled. |
550+| `flushInterval` | _[Duration](#duration)_ | FlushInterval is the period between flushing the response buffer when<br/>streaming response from the upstream.<br/>Defaults to 1 second. |
551+| `passHostHeader` | _bool_ | PassHostHeader determines whether the request host header should be proxied<br/>to the upstream server.<br/>Defaults to true. |
552+| `proxyWebSockets` | _bool_ | ProxyWebSockets enables proxying of websockets to upstream servers<br/>Defaults to true. |
553+| `timeout` | _[Duration](#duration)_ | Timeout is the maximum duration the server will wait for a response from the upstream server.<br/>Defaults to 30 seconds. |
554+
555+### UpstreamConfig
556+
557+(**Appears on:** [AlphaOptions](#alphaoptions))
558+
559+UpstreamConfig is a collection of definitions for upstream servers.
560+
561+| Field | Type | Description |
562+| ----- | ---- | ----------- |
563+| `proxyRawPath` | _bool_ | ProxyRawPath will pass the raw url path to upstream allowing for urls<br/>like: "/%2F/" which would otherwise be redirected to "/" |
564+| `upstreams` | _[[]Upstream](#upstream)_ | Upstreams represents the configuration for the upstream servers.<br/>Requests will be proxied to this upstream if the path matches the request path. |
docs/versioned_docs/version-7.11.x/configuration/alpha_config.md.tmplnew file+139
@@ -0,0 +1,139 @@
1+---
2+id: alpha-config
3+title: Alpha Configuration
4+---
5+
6+:::warning
7+This page contains documentation for alpha features.
8+We reserve the right to make breaking changes to the features detailed within this page with no notice.
9+
10+Options described in this page may be changed, removed, renamed or moved without prior warning.
11+Please beware of this before you use alpha configuration options.
12+:::
13+
14+This page details a set of **alpha** configuration options in a new format.
15+Going forward we are intending to add structured configuration in YAML format to
16+replace the existing TOML based configuration file and flags.
17+
18+Below is a reference for the structure of the configuration, with
19+[AlphaOptions](#alphaoptions) as the root of the configuration.
20+
21+When using alpha configuration, your config file will look something like below:
22+
23+```yaml
24+upstreams:
25+ - id: ...
26+ ...: ...
27+injectRequestHeaders:
28+ - name: ...
29+ ...: ...
30+injectResponseHeaders:
31+ - name: ...
32+ ...: ...
33+```
34+
35+Please browse the [reference](#configuration-reference) below for the structure
36+of the new configuration format.
37+
38+## Using Alpha Configuration
39+
40+To use the new **alpha** configuration, generate a YAML file based on the format
41+described in the [reference](#configuration-reference) below.
42+
43+Provide the path to this file using the `--alpha-config` flag.
44+
45+:::note
46+When using the `--alpha-config` flag, some options are no longer available.
47+See [removed options](#removed-options) below for more information.
48+:::
49+
50+### Converting configuration to the new structure
51+
52+Before adding the new `--alpha-config` option, start OAuth2 Proxy using the
53+`convert-config-to-alpha` flag to convert existing configuration to the new format.
54+
55+```bash
56+oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg
57+```
58+
59+This will convert any options supported by the new format to YAML and print the
60+new configuration to `STDOUT`.
61+
62+Copy this to a new file, remove any options from your existing configuration
63+noted in [removed options](#removed-options) and then start OAuth2 Proxy using
64+the new config.
65+
66+```bash
67+oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg
68+```
69+
70+## Using ENV variables in the alpha configuration
71+
72+The alpha package supports the use of environment variables in place of yaml keys, allowing sensitive values to be pulled from somewhere other than the yaml file.
73+When using environment variables, your yaml will look like this:
74+
75+```yaml
76+ providers:
77+ - provider: azure
78+ clientSecret: ${CLIENT_SECRET}
79+ ...
80+```
81+Where CLIENT_SECRET is an environment variable.
82+More information and available patterns can be found [here](https://github.com/a8m/envsubst#docs)
83+
84+## Removed options
85+
86+The following flags/options and their respective environment variables are no
87+longer available when using alpha configuration:
88+
89+<!-- Legacy Upstream FlagSet -->
90+- `flush-interval`/`flush_interval`
91+- `pass-host-header`/`pass_host_header`
92+- `proxy-websockets`/`proxy_websockets`
93+- `ssl-upstream-insecure-skip-verify`/`ssl_upstream_insecure_skip_verify`
94+- `upstream`/`upstreams`
95+
96+<!-- Legacy Headers FlagSet -->
97+- `pass-basic-auth`/`pass_basic_auth`
98+- `pass-access-token`/`pass_access_token`
99+- `pass-user-headers`/`pass_user_headers`
100+- `pass-authorization-header`/`pass_authorization_header`
101+- `set-basic-auth`/`set_basic_auth`
102+- `set-xauthrequest`/`set_xauthrequest`
103+- `set-authorization-header`/`set_authorization_header`
104+- `prefer-email-to-user`/`prefer_email_to_user`
105+- `basic-auth-password`/`basic_auth_password`
106+- `skip-auth-strip-headers`/`skip_auth_strip_headers`
107+
108+<!-- Legacy provider FlagSet -->
109+- `client-id`/`client_id`
110+- `client-secret`/`client_secret`, and `client-secret-file`/`client_secret_file`
111+- `provider`
112+- `provider-display-name`/`provider_display_name`
113+- `provider-ca-file`/`provider_ca_files`
114+- `login-url`/`login_url`
115+- `redeem-url`/`redeem_url`
116+- `profile-url`/`profile_url`
117+- `resource`
118+- `validate-url`/`validate_url`
119+- `scope`
120+- `prompt`
121+- `approval-prompt`/`approval_prompt`
122+- `acr-values`/`acr_values`
123+- `user-id-claim`/`user_id_claim`
124+- `allowed-group`/`allowed_groups`
125+- `allowed-role`/`allowed_roles`
126+- `jwt-key`/`jwt_key`
127+- `jwt-key-file`/`jwt_key_file`
128+- `pubjwk-url`/`pubjwk_url`
129+
130+and all provider-specific options, i.e. any option whose name includes `oidc`,
131+`azure`, `bitbucket`, `github`, `gitlab`, `google` or `keycloak`. Attempting to
132+use any of these options via flags or via config when `--alpha-config` is
133+set will result in an error.
134+
135+:::important
136+You must remove these options before starting OAuth2 Proxy with `--alpha-config`
137+:::
138+
139+## Configuration Reference
docs/versioned_docs/version-7.11.x/configuration/integration.mdnew file+386
@@ -0,0 +1,386 @@
1+---
2+id: integration
3+title: Integration
4+---
5+
6+## Configuring for use with the Nginx `auth_request` directive
7+
8+**This option requires `--reverse-proxy` option to be set.**
9+
10+The [Nginx `auth_request` directive](http://nginx.org/en/docs/http/ngx_http_auth_request_module.html) allows Nginx to authenticate requests via the oauth2-proxy's `/auth` endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:
11+
12+```nginx
13+server {
14+ listen 443 ssl;
15+ server_name ...;
16+ include ssl/ssl.conf;
17+
18+ location /oauth2/ {
19+ proxy_pass http://127.0.0.1:4180;
20+ proxy_set_header Host $host;
21+ proxy_set_header X-Real-IP $remote_addr;
22+ proxy_set_header X-Auth-Request-Redirect $request_uri;
23+ # or, if you are handling multiple domains:
24+ # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
25+ }
26+ location = /oauth2/auth {
27+ proxy_pass http://127.0.0.1:4180;
28+ proxy_set_header Host $host;
29+ proxy_set_header X-Real-IP $remote_addr;
30+ proxy_set_header X-Forwarded-Uri $request_uri;
31+ # nginx auth_request includes headers but not body
32+ proxy_set_header Content-Length "";
33+ proxy_pass_request_body off;
34+ }
35+
36+ # Named location for handling OAuth2 sign-in redirects
37+ # This ensures the browser receives a proper 302 redirect that it will follow
38+ location @oauth2_signin {
39+ return 302 /oauth2/sign_in?rd=$scheme://$host$request_uri;
40+ }
41+
42+ location / {
43+ auth_request /oauth2/auth;
44+ error_page 401 = @oauth2_signin;
45+
46+ # pass information via X-User and X-Email headers to backend,
47+ # requires running with --set-xauthrequest flag
48+ auth_request_set $user $upstream_http_x_auth_request_user;
49+ auth_request_set $email $upstream_http_x_auth_request_email;
50+ proxy_set_header X-User $user;
51+ proxy_set_header X-Email $email;
52+
53+ # if you enabled --pass-access-token, this will pass the token to the backend
54+ auth_request_set $token $upstream_http_x_auth_request_access_token;
55+ proxy_set_header X-Access-Token $token;
56+
57+ # if you enabled --cookie-refresh, this is needed for it to work with auth_request
58+ auth_request_set $auth_cookie $upstream_http_set_cookie;
59+ add_header Set-Cookie $auth_cookie;
60+
61+ # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
62+ # limit and so the OAuth2 Proxy splits these into multiple parts.
63+ # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
64+ # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
65+ auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;
66+
67+ # Extract the Cookie attributes from the first Set-Cookie header and append them
68+ # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
69+ if ($auth_cookie ~* "(; .*)") {
70+ set $auth_cookie_name_0 $auth_cookie;
71+ set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
72+ }
73+
74+ # Send both Set-Cookie headers now if there was a second part
75+ if ($auth_cookie_name_upstream_1) {
76+ add_header Set-Cookie $auth_cookie_name_0;
77+ add_header Set-Cookie $auth_cookie_name_1;
78+ }
79+
80+ proxy_pass http://backend/;
81+ # or "root /path/to/site;" or "fastcgi_pass ..." etc
82+ }
83+}
84+```
85+
86+### Understanding the `error_page` redirect pattern
87+
88+The `auth_request` directive expects the authentication endpoint (`/oauth2/auth`) to return:
89+- **2xx**: Request is authenticated, allow access
90+- **401 or 403**: Request is not authenticated, deny access
91+
92+When a 401 is returned, nginx triggers the `error_page` directive. The recommended pattern uses a **named location** (`@oauth2_signin`) that returns a proper **302 redirect**:
93+
94+
95+```nginx
96+error_page 401 = @oauth2_signin;
97+
98+location @oauth2_signin {
99+ return 302 /oauth2/sign_in?rd=$scheme://$host$request_uri;
100+}
101+```
102+
103+:::warning Avoid `error_page 401 =403` with sign_in
104+Some older configurations use `error_page 401 =403 /oauth2/sign_in`. While this works for displaying the sign-in page, it returns a **403 status code** with a `Location` header. Browsers do not automatically follow redirects on 403 responses, which can cause issues when using `--skip-provider-button=true` (users see a "Found." link instead of being automatically redirected).
105+
106+The named location pattern above ensures the browser receives a standard **302 redirect** that works correctly with all oauth2-proxy configurations.
107+:::
108+
109+### Browser vs API Routes
110+
111+:::important When to use redirects
112+Redirecting authentication failures (302 to `/oauth2/sign_in`) should **only be used for browser-facing routes**. API or machine clients should receive a plain 401/403 response without redirect.
113+:::
114+
115+#### Browser-facing routes (HTML, UI)
116+
117+For interactive browser routes where users should be redirected to sign in:
118+
119+```nginx
120+location / {
121+ auth_request /oauth2/auth;
122+ error_page 401 = @oauth2_signin;
123+ proxy_pass http://backend/;
124+}
125+
126+location @oauth2_signin {
127+ return 302 /oauth2/sign_in?rd=$scheme://$host$request_uri;
128+}
129+```
130+
131+#### API / Machine routes (no redirect)
132+
133+For API endpoints where clients expect a 401/403 status code (not a redirect):
134+
135+```nginx
136+location /api/ {
137+ auth_request /oauth2/auth;
138+ error_page 401 =401; # Pass through the 401 status
139+ proxy_pass http://backend/;
140+}
141+```
142+
143+This ensures:
144+- ✅ Browsers get a redirect and smooth login flow
145+- ✅ API clients fail fast with appropriate HTTP status codes
146+- ✅ `/oauth2/auth` remains a pure boolean oracle (2xx/401)
147+
148+When you use ingress-nginx in Kubernetes, you can configure the same behavior with the following annotations on your Ingress resource:
149+
150+```yaml
151+nginx.ingress.kubernetes.io/auth-url: "https://<oauth2-proxy-fqdn>/oauth2/auth"
152+nginx.ingress.kubernetes.io/auth-signin: "https://<oauth2-proxy-fqdn>/oauth2/start?rd=$escaped_request_uri"
153+```
154+
155+This minimal configuration works for standard authentication flows. Lua/cookie handling is only needed for advanced scenarios (e.g., multi-part cookies, custom session logic). See the official ingress-nginx example: https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth/.
156+
157+It is recommended to use `--session-store-type=redis` when expecting large sessions/OIDC tokens (_e.g._ with MS Azure).
158+
159+You have to substitute *name* with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".
160+
161+## Configuring for use with the Traefik (v2) `ForwardAuth` middleware
162+
163+**This option requires `--reverse-proxy` option to be set.**
164+
165+### ForwardAuth with 401 errors middleware
166+
167+The [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/http/forwardauth/) allows Traefik to authenticate requests via the oauth2-proxy's `/oauth2/auth` endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:
168+
169+```yaml
170+http:
171+ routers:
172+ a-service:
173+ rule: "Host(`a-service.example.com`)"
174+ service: a-service-backend
175+ middlewares:
176+ - oauth-errors
177+ - oauth-auth
178+ tls:
179+ certResolver: default
180+ domains:
181+ - main: "example.com"
182+ sans:
183+ - "*.example.com"
184+ oauth:
185+ rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"
186+ middlewares:
187+ - auth-headers
188+ service: oauth-backend
189+ tls:
190+ certResolver: default
191+ domains:
192+ - main: "example.com"
193+ sans:
194+ - "*.example.com"
195+
196+ services:
197+ a-service-backend:
198+ loadBalancer:
199+ servers:
200+ - url: http://172.16.0.2:7555
201+ oauth-backend:
202+ loadBalancer:
203+ servers:
204+ - url: http://172.16.0.1:4180
205+
206+ middlewares:
207+ auth-headers:
208+ headers:
209+ sslRedirect: true
210+ stsSeconds: 315360000
211+ browserXssFilter: true
212+ contentTypeNosniff: true
213+ forceSTSHeader: true
214+ sslHost: example.com
215+ stsIncludeSubdomains: true
216+ stsPreload: true
217+ frameDeny: true
218+ oauth-auth:
219+ forwardAuth:
220+ address: https://oauth.example.com/oauth2/auth
221+ trustForwardHeader: true
222+ oauth-errors:
223+ errors:
224+ status:
225+ - "401-403"
226+ service: oauth-backend
227+ query: "/oauth2/sign_in?rd={url}"
228+ statusRewrites:
229+ "401": 302
230+```
231+
232+:::info Troubleshooting: Browser shows "Found." instead of redirecting
233+When using the Errors middleware without `statusRewrites`, the redirect response from oauth2-proxy can be served within the original 401/403 status context. This causes some browsers to display a "Found." link instead of automatically following the redirect to the identity provider.
234+
235+Adding `statusRewrites` to rewrite `401 -> 302` ensures the browser treats the response as a proper redirect and follows it automatically.
236+:::
237+
238+### ForwardAuth with static upstreams configuration
239+
240+Redirect to sign_in functionality provided without the use of `errors` middleware with [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/http/forwardauth/) pointing to oauth2-proxy service's `/` endpoint
241+
242+**Following options need to be set on `oauth2-proxy`:**
243+- `--upstream=static://202`: Configures a static response for authenticated sessions
244+- `--reverse-proxy=true`: Enables the use of `X-Forwarded-*` headers to determine redirects correctly
245+
246+```yaml
247+http:
248+ routers:
249+ a-service-route-1:
250+ rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"
251+ service: a-service-backend
252+ middlewares:
253+ - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin
254+ tls:
255+ certResolver: default
256+ domains:
257+ - main: "example.com"
258+ sans:
259+ - "*.example.com"
260+ a-service-route-2:
261+ rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"
262+ service: a-service-backend
263+ middlewares:
264+ - oauth-auth-wo-redirect # unauthenticated session will return a 401
265+ tls:
266+ certResolver: default
267+ domains:
268+ - main: "example.com"
269+ sans:
270+ - "*.example.com"
271+ services-oauth2-route:
272+ rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"
273+ middlewares:
274+ - auth-headers
275+ service: oauth-backend
276+ tls:
277+ certResolver: default
278+ domains:
279+ - main: "example.com"
280+ sans:
281+ - "*.example.com"
282+ oauth2-proxy-route:
283+ rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"
284+ middlewares:
285+ - auth-headers
286+ service: oauth-backend
287+ tls:
288+ certResolver: default
289+ domains:
290+ - main: "example.com"
291+ sans:
292+ - "*.example.com"
293+
294+ services:
295+ a-service-backend:
296+ loadBalancer:
297+ servers:
298+ - url: http://172.16.0.2:7555
299+ b-service-backend:
300+ loadBalancer:
301+ servers:
302+ - url: http://172.16.0.3:7555
303+ oauth-backend:
304+ loadBalancer:
305+ servers:
306+ - url: http://172.16.0.1:4180
307+
308+ middlewares:
309+ auth-headers:
310+ headers:
311+ sslRedirect: true
312+ stsSeconds: 315360000
313+ browserXssFilter: true
314+ contentTypeNosniff: true
315+ forceSTSHeader: true
316+ sslHost: example.com
317+ stsIncludeSubdomains: true
318+ stsPreload: true
319+ frameDeny: true
320+ oauth-auth-redirect:
321+ forwardAuth:
322+ address: https://oauth.example.com/
323+ trustForwardHeader: true
324+ authResponseHeaders:
325+ - X-Auth-Request-Access-Token
326+ - Authorization
327+ oauth-auth-wo-redirect:
328+ forwardAuth:
329+ address: https://oauth.example.com/oauth2/auth
330+ trustForwardHeader: true
331+ authResponseHeaders:
332+ - X-Auth-Request-Access-Token
333+ - Authorization
334+```
335+
336+## Configuring for use with the Caddy (v2) `forward_auth` directive
337+
338+The [Caddy `forward_auth` directive](https://caddyserver.com/docs/caddyfile/directives/forward_auth) allows Caddy to authenticate requests via the `oauth2-proxy`'s `/auth`.
339+
340+This example is for a simple reverse proxy setup where the `/oauth2/` path is kept under the same domain and failed auth requests (401 status returned) will be caught and redirected to the `sign_in` endpoint.
341+
342+**Following options need to be set on `oauth2-proxy`:**
343+- `--reverse-proxy=true`: Enables the use of `X-Forwarded-*` headers to determine redirects correctly
344+
345+```nginx title="Caddyfile"
346+example.com {
347+ # Requests to /oauth2/* are proxied to oauth2-proxy without authentication.
348+ # You can't use `reverse_proxy /oauth2/* oauth2-proxy.internal:4180` here because the reverse_proxy directive has lower precedence than the handle directive.
349+ handle /oauth2/* {
350+ reverse_proxy oauth2-proxy.internal:4180 {
351+ # oauth2-proxy requires the X-Real-IP and X-Forwarded-{Proto,Host,Uri} headers.
352+ # The reverse_proxy directive automatically sets X-Forwarded-{For,Proto,Host} headers.
353+ header_up X-Real-IP {remote_host}
354+ header_up X-Forwarded-Uri {uri}
355+ }
356+ }
357+
358+ # Requests to other paths are first processed by oauth2-proxy for authentication.
359+ handle {
360+ forward_auth oauth2-proxy.internal:4180 {
361+ uri /oauth2/auth
362+
363+ # oauth2-proxy requires the X-Real-IP and X-Forwarded-{Proto,Host,Uri} headers.
364+ # The forward_auth directive automatically sets the X-Forwarded-{For,Proto,Host,Method,Uri} headers.
365+ header_up X-Real-IP {remote_host}
366+
367+ # If needed, you can copy headers from the oauth2-proxy response to the request sent to the upstream.
368+ # Make sure to configure the --set-xauthrequest flag to enable this feature.
369+ #copy_headers X-Auth-Request-User X-Auth-Request-Email
370+
371+ # If oauth2-proxy returns a 401 status, redirect the client to the sign-in page.
372+ @error status 401
373+ handle_response @error {
374+ redir * /oauth2/sign_in?rd={scheme}://{host}{uri}
375+ }
376+ }
377+
378+ # If oauth2-proxy returns a 2xx status, the request is then proxied to the upstream.
379+ reverse_proxy upstream.internal:3000
380+ }
381+}
382+```
383+
384+:::note
385+If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.
386+:::
docs/versioned_docs/version-7.11.x/configuration/overview.mdnew file+406
@@ -0,0 +1,406 @@
1+---
2+id: overview
3+title: Overview
4+---
5+
6+`oauth2-proxy` can be configured via [command line options](#command-line-options), [environment variables](#environment-variables) or [config file](#config-file) (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings).
7+
8+## Generating a Cookie Secret
9+
10+To generate a strong cookie secret use one of the below commands:
11+
12+import Tabs from '@theme/Tabs';
13+import TabItem from '@theme/TabItem';
14+
15+<Tabs defaultValue="python">
16+ <TabItem value="python" label="Python">
17+
18+```shell
19+python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'
20+```
21+
22+ </TabItem>
23+ <TabItem value="bash" label="Bash">
24+
25+```shell
26+dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\n' | tr -- '+/' '-_' ; echo
27+```
28+
29+ </TabItem>
30+ <TabItem value="openssl" label="OpenSSL">
31+
32+```shell
33+openssl rand -base64 32 | tr -- '+/' '-_'
34+```
35+
36+ </TabItem>
37+ <TabItem value="powershell" label="PowerShell">
38+
39+```powershell
40+# Add System.Web assembly to session, just in case
41+Add-Type -AssemblyName System.Web
42+[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")
43+```
44+
45+ </TabItem>
46+ <TabItem value="terraform" label="Terraform">
47+
48+```hcl
49+# Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret
50+resource "random_password" "cookie_secret" {
51+ length = 32
52+ override_special = "-_"
53+}
54+```
55+
56+ </TabItem>
57+</Tabs>
58+
59+## Config File
60+
61+Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (\_). If the argument can be specified multiple times, the config option should be plural (trailing s).
62+
63+An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example) config file is in the contrib directory. It can be used by specifying `--config=/etc/oauth2-proxy.cfg`
64+
65+## Config Options
66+
67+### Command Line Options
68+
69+| Flag | Description |
70+| ----------- | -------------------- |
71+| `--config` | path to config file |
72+| `--version` | print version string |
73+
74+
75+### General Provider Options
76+
77+Provider specific options can be found on their respective subpages.
78+
79+| Flag / Config Field | Type | Description | Default |
80+| --------------------------------------------------------------------------------------------------- | -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
81+| flag: `--acr-values`<br/>toml: `acr_values` | string | optional, see [docs](https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues) | `""` |
82+| flag: `--allowed-group`<br/>toml: `allowed_groups` | string \| list | Restrict login to members of a group or list of groups. Furthermore, if you aren't setting the `scope` and use `allowed_groups` with the generic OIDC provider the scope `groups` gets added implicitly. | |
83+| flag: `--approval-prompt`<br/>toml: `approval_prompt` | string | OAuth approval_prompt | `"force"` |
84+| flag: `--backend-logout-url`<br/>toml: `backend_logout_url` | string | URL to perform backend logout, if you use `{id_token}` in the url it will be replaced by the actual `id_token` of the user session | |
85+| flag: `--client-id`<br/>toml: `client_id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
86+| flag: `--client-secret-file`<br/>toml: `client_secret_file` | string | the file with OAuth Client Secret | |
87+| flag: `--client-secret`<br/>toml: `client_secret` | string | the OAuth Client Secret | |
88+| flag: `--code-challenge-method`<br/>toml: `code_challenge_method` | string | use PKCE code challenges with the specified method. Either 'plain' or 'S256' (recommended) | |
89+| flag: `--insecure-oidc-allow-unverified-email`<br/>toml: `insecure_oidc_allow_unverified_email` | bool | don't fail if an email address in an id_token is not verified | false |
90+| flag: `--insecure-oidc-skip-issuer-verification`<br/>toml: `insecure_oidc_skip_issuer_verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
91+| flag: `--insecure-oidc-skip-nonce`<br/>toml: `insecure_oidc_skip_nonce` | bool | skip verifying the OIDC ID Token's nonce claim | true |
92+| flag: `--jwt-key-file`<br/>toml: `jwt_key_file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |
93+| flag: `--jwt-key`<br/>toml: `jwt_key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |
94+| flag: `--login-url`<br/>toml: `login_url` | string | Authentication endpoint | |
95+| flag: `--auth-request-response-mode`<br/>toml: `auth-request-response-mode` | string | Response mode to ask for during authentication request | |
96+| flag: `--oidc-audience-claim`<br/>toml: `oidc_audience_claims` | string | which OIDC claim contains the audience | `"aud"` |
97+| flag: `--oidc-email-claim`<br/>toml: `oidc_email_claim` | string | which OIDC claim contains the user's email | `"email"` |
98+| flag: `--oidc-extra-audience`<br/>toml: `oidc_extra_audiences` | string \| list | additional audiences which are allowed to pass verification | `"[]"` |
99+| flag: `--oidc-groups-claim`<br/>toml: `oidc_groups_claim` | string | which OIDC claim contains the user groups | `"groups"` |
100+| flag: `--oidc-issuer-url`<br/>toml: `oidc_issuer_url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
101+| flag: `--oidc-jwks-url`<br/>toml: `oidc_jwks_url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled and public key files are not provided | |
102+| flag: `--oidc-public-key-file`<br/>toml: `oidc_public_key_files` | string | Path to public key file in PEM format to use for verifying JWT tokens (may be given multiple times). Required if OIDC discovery is disabled na JWKS URL isn't provided | string \| list |
103+| flag: `--profile-url`<br/>toml: `profile_url` | string | Profile access endpoint | |
104+| flag: `--prompt`<br/>toml: `prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
105+| flag: `--provider-ca-file`<br/>toml: `provider_ca_files` | string \| list | Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead. |
106+| flag: `--provider-display-name`<br/>toml: `provider_display_name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
107+| flag: `--provider`<br/>toml: `provider` | string | OAuth provider | google |
108+| flag: `--pubjwk-url`<br/>toml: `pubjwk_url` | string | JWK pubkey access endpoint: required by login.gov | |
109+| flag: `--redeem-url`<br/>toml: `redeem_url` | string | Token redemption endpoint | |
110+| flag: `--scope`<br/>toml:`scope` | string | OAuth scope specification. Every provider has a default list of scopes which will be used in case no scope is configured. | |
111+| flag: `--skip-claims-from-profile-url`<br/>toml: `skip_claims_from_profile_url` | bool | skip request to Profile URL for resolving claims not present in id_token | false |
112+| flag: `--skip-oidc-discovery`<br/>toml: `skip_oidc_discovery` | bool | bypass OIDC endpoint discovery. `--login-url`, `--redeem-url` and `--oidc-jwks-url` must be configured in this case | false |
113+| flag: `--use-system-trust-store`<br/>toml: `use_system_trust_store` | bool | Determines if `provider-ca-file` files and the system trust store are used. If set to true, your custom CA files and the system trust store are used otherwise only your custom CA files. | false |
114+| flag: `--validate-url`<br/>toml: `validate_url` | string | Access token validation endpoint | |
115+
116+### Cookie Options
117+
118+| Flag / Config Field | Type | Description | Default |
119+| --------------------------------------------------------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- |
120+| flag: `--cookie-csrf-expire`<br/>toml: `cookie_csrf_expire` | duration | expire timeframe for CSRF cookie | 15m |
121+| flag: `--cookie-csrf-per-request`<br/>toml:`cookie_csrf_per_request` | bool | Enable having different CSRF cookies per request, making it possible to have parallel requests. | false |
122+| flag: `--cookie-csrf-per-request-limit`<br/>toml: `cookie_csrf_per_request_limit` | int | Sets a limit on the number of CSRF requests cookies that oauth2-proxy will create. The oldest cookie will be removed. Useful if users end up with 431 Request headers too large status codes. Only effective if --cookie-csrf-per-request is true | "infinite" |
123+| flag: `--cookie-domain`<br/>toml: `cookie_domains` | string \| list | Optional cookie domains to force cookies to (e.g. `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match). | |
124+| flag: `--cookie-expire`<br/>toml: `cookie_expire` | duration | expire timeframe for cookie. If set to 0, cookie becomes a session-cookie which will expire when the browser is closed. | 168h0m0s |
125+| flag: `--cookie-httponly`<br/>toml: `cookie_httponly` | bool | set HttpOnly cookie flag | true |
126+| flag: `--cookie-name`<br/>toml: `cookie_name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
127+| flag: `--cookie-path`<br/>toml: `cookie_path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
128+| flag: `--cookie-refresh`<br/>toml: `cookie_refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers&nbsp;[^1] | |
129+| flag: `--cookie-samesite`<br/>toml: `cookie_samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
130+| flag: `--cookie-secret`<br/>toml: `cookie_secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
131+| flag: `--cookie-secret-file`<br/>toml: `cookie_secret_file` | string | For defining a separate cookie secret file to read the encryption key from | |
132+| flag: `--cookie-secure`<br/>toml: `cookie_secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
133+
134+[^1]: The following providers support `--cookie-refresh`: ADFS, Azure, GitLab, Google, Keycloak and all other Identity Providers which support the full [OIDC specification](https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokens)
135+
136+### Header Options
137+
138+| Flag / Config Field | Type | Description | Default |
139+| ------------------------------------------------------------------------- | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
140+| flag: `--basic-auth-password`<br/>toml: `basic_auth_password` | string | the password to set when passing the HTTP Basic Auth header | |
141+| flag: `--set-xauthrequest`<br/>toml: `set_xauthrequest` | bool | set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with `--pass-access-token`, X-Auth-Request-Access-Token is added to response headers. | false |
142+| flag: `--set-authorization-header`<br/>toml: `set_authorization_header` | bool | set Authorization Bearer response header (useful in Nginx auth_request mode) | false |
143+| flag: `--set-basic-auth`<br/>toml: `set_basic_auth` | bool | set HTTP Basic Auth information in response (useful in Nginx auth_request mode) | false |
144+| flag: `--skip-auth-strip-headers`<br/>toml: `skip_auth_strip_headers` | bool | strips `X-Forwarded-*` style authentication headers & `Authorization` header if they would be set by oauth2-proxy | true |
145+| flag: `--pass-access-token`<br/>toml: `pass_access_token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
146+| flag: `--pass-authorization-header`<br/>toml: `pass_authorization_header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
147+| flag: `--pass-basic-auth`<br/>toml: `pass_basic_auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
148+| flag: `--prefer-email-to-user`<br/>toml: `prefer_email_to_user` | bool | Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with `--pass-basic-auth` and `--pass-user-headers` | false |
149+| flag: `--pass-user-headers`<br/>toml: `pass_user_headers` | bool | pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
150+
151+### Logging Options
152+
153+| Flag / Config Field | Type | Description | Default |
154+| --------------------------------------------------------------------- | ------ | ---------------------------------------------------------------------------- | --------------------------------------------------- |
155+| flag: `--auth-logging-format`<br/>toml: `auth_logging_format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
156+| flag: `--auth-logging`<br/>toml: `auth_logging` | bool | Log authentication attempts | true |
157+| flag: `--errors-to-info-log`<br/>toml: `errors_to_info_log` | bool | redirects error-level logging to default log channel instead of stderr | false |
158+| flag: `--exclude-logging-path`<br/>toml: `exclude_logging_paths` | string | comma separated list of paths to exclude from logging, e.g. `"/ping,/path2"` | `""` (no paths excluded) |
159+| flag: `--logging-compress`<br/>toml: `logging_compress` | bool | Should rotated log files be compressed using gzip | false |
160+| flag: `--logging-filename`<br/>toml: `logging_filename` | string | File to log requests to, empty for `stdout` | `""` (stdout) |
161+| flag: `--logging-local-time`<br/>toml: `logging_local_time` | bool | Use local time in log files and backup filenames instead of UTC | true (local time) |
162+| flag: `--logging-max-age`<br/>toml: `logging_max_age` | int | Maximum number of days to retain old log files | 7 |
163+| flag: `--logging-max-backups`<br/>toml: `logging_max_backups` | int | Maximum number of old log files to retain; 0 to disable | 0 |
164+| flag: `--logging-max-size`<br/>toml: `logging_max_size` | int | Maximum size in megabytes of the log file before rotation | 100 |
165+| flag: `--request-id-header`<br/>toml: `request_id_header` | string | Request header to use as the request ID in logging | X-Request-Id |
166+| flag: `--request-logging-format`<br/>toml: `request_logging_format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
167+| flag: `--request-logging`<br/>toml: `request_logging` | bool | Log requests | true |
168+| flag: `--silence-ping-logging`<br/>toml: `silence_ping_logging` | bool | disable logging of requests to ping & ready endpoints | false |
169+| flag: `--standard-logging-format`<br/>toml: `standard_logging_format` | string | Template for standard log lines | see [Logging Configuration](#logging-configuration) |
170+| flag: `--standard-logging`<br/>toml: `standard_logging` | bool | Log standard runtime information | true |
171+
172+### Page Template Options
173+
174+| Flag / Config Field | Type | Description | Default |
175+| ----------------------------------------------------------------- | ------ | --------------------------------------------------------------------------------------------------------------------------- | ------- |
176+| flag: `--banner`<br/>toml: `banner` | string | custom (html) banner string. Use `"-"` to disable default banner. | |
177+| flag: `--custom-sign-in-logo`<br/>toml: `custom_sign_in_logo` | string | path or a URL to an custom image for the sign_in page logo. Use `"-"` to disable default logo. |
178+| flag: `--custom-templates-dir`<br/>toml: `custom_templates_dir` | string | path to custom html templates | |
179+| flag: `--display-htpasswd-form`<br/>toml: `display_htpasswd_form` | bool | display username / password login form if an htpasswd file is provided | true |
180+| flag: `--footer`<br/>toml: `footer` | string | custom (html) footer string. Use `"-"` to disable default footer. (Can be used to obfuscate the version) | |
181+| flag: `--show-debug-on-error`<br/>toml: `show_debug_on_error` | bool | show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production) | false |
182+
183+### Probe Options
184+
185+| Flag / Config Field | Type | Description | Default |
186+| ------------------------------------------------------- | ------ | ---------------------------------------------------------- | ----------------------------- |
187+| flag: `--ping-path`<br/>toml: `ping_path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
188+| flag: `--ping-user-agent`<br/>toml: `ping_user_agent` | string | a User-Agent that can be used for basic health checks | `""` (don't check user agent) |
189+| flag: `--ready-path`<br/>toml: `ready_path` | string | the ready endpoint that can be used for deep health checks | `"/ready"` |
190+| flag: `--gcp-healthchecks`<br/>toml: `gcp_healthchecks` | bool | Enable GCP/GKE healthcheck endpoints (deprecated) | false |
191+
192+### Proxy Options
193+
194+| Flag / Config Field | Type | Description | Default |
195+| ----------------------------------------------------------------------------- | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
196+| flag: `--allow-query-semicolons`<br/>toml: `allow_query_semicolons` | bool | allow the use of semicolons in query args ([required for some legacy applications](https://github.com/golang/go/issues/25192)) | `false` |
197+| flag: `--api-route`<br/>toml: `api_routes` | string \| list | Requests to these paths must already be authenticated with a cookie, or a JWT if `--skip-jwt-bearer-tokens` is set. No redirect to login will be done. Return 401 if not. Format: path_regex | |
198+| flag: `--authenticated-emails-file`<br/>toml: `authenticated_emails_file` | string | authenticate against emails via file (one per line) | |
199+| flag: `--bearer-token-login-fallback`<br/>toml: `bearer_token_login_fallback` | bool | if `--skip-jwt-bearer-tokens` is set, if a request includes an invalid JWT (expired, malformed, missing required audiences, etc), fall back to normal login redirect as if the token were not sent at all. If false, respond 403 | true |
200+| flag: `--email-domain`<br/>toml: `email_domains` | string \| list | authenticate emails with the specified domain (may be given multiple times). Use `*` to authenticate any email | |
201+| flag: `--encode-state`<br/>toml: `encode_state` | bool | encode the state parameter as UrlEncodedBase64 | false |
202+| flag: `--extra-jwt-issuers`<br/>toml: `extra_jwt_issuers` | string | if `--skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` (see a token's `iss`, `aud` fields) pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
203+| flag: `--force-https`<br/>toml: `force_https` | bool | enforce https redirect | `false` |
204+| flag: `--force-json-errors`<br/>toml: `force_json_errors` | bool | force JSON errors instead of HTTP error pages or redirects | `false` |
205+| flag: `--htpasswd-file`<br/>toml: `htpasswd_file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |
206+| flag: `--htpasswd-user-group`<br/>toml: `htpasswd_user_groups` | string \| list | the groups to be set on sessions for htpasswd users | |
207+| flag: `--proxy-prefix`<br/>toml: `proxy_prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
208+| flag: `--real-client-ip-header`<br/>toml: `real_client_ip_header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, X-ProxyUser-IP, X-Envoy-External-Address, or CF-Connecting-IP) | X-Real-IP |
209+| flag: `--redirect-url`<br/>toml: `redirect_url` | string | the OAuth Redirect URL, e.g. `"https://internalapp.yourcompany.com/oauth2/callback"` | |
210+| flag: `--relative-redirect-url`<br/>toml: `relative_redirect_url` | bool | allow relative OAuth Redirect URL.` | false |
211+| flag: `--reverse-proxy`<br/>toml: `reverse_proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-\{Proto,Host,Uri\} headers to be used on redirect selection | false |
212+| flag: `--signature-key`<br/>toml: `signature_key` | string | GAP-Signature request signature key (algorithm:secretkey) | |
213+| flag: `--skip-auth-preflight`<br/>toml: `skip_auth_preflight` | bool | will skip authentication for OPTIONS requests | false |
214+| flag: `--skip-auth-regex`<br/>toml: `skip_auth_regex` | string \| list | (DEPRECATED for `--skip-auth-route`) bypass authentication for requests paths that match (may be given multiple times) | |
215+| flag: `--skip-auth-route`<br/>toml: `skip_auth_routes` | string \| list | bypass authentication for requests that match the method & path. Format: method=path_regex OR method!=path_regex. For all methods: path_regex OR !=path_regex | |
216+| flag: `--skip-jwt-bearer-tokens`<br/>toml: `skip_jwt_bearer_tokens` | bool | will skip requests that have verified JWT bearer tokens (the token must have [`aud`](https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields) that matches this client id or one of the extras from `extra-jwt-issuers`) | false |
217+| flag: `--skip-provider-button`<br/>toml: `skip_provider_button` | bool | will skip sign-in-page to directly reach the next step: oauth/start | false |
218+| flag: `--ssl-insecure-skip-verify`<br/>toml: `ssl_insecure_skip_verify` | bool | skip validation of certificates presented when using HTTPS providers | false |
219+| flag: `--trusted-ip`<br/>toml: `trusted_ips` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
220+| flag: `--whitelist-domain`<br/>toml: `whitelist_domains` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` or a `*.` to allow subdomains (e.g. `.example.com`, `*.example.com`)&nbsp;[^2] | |
221+
222+[^2]: When using the `whitelist-domain` option, any domain prefixed with a `.` or a `*.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
223+
224+### Server Options
225+
226+| Flag / Config Field | Type | Description | Default |
227+| ------------------------------------------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ |
228+| flag: `--http-address`<br/>toml: `http_address` | string | `[http://]<addr>:<port>` or `unix://<path>` or `fd:<int>` (case insensitive) to listen on for HTTP clients. Square brackets are required for ipv6 address, e.g. `http://[::1]:4180` | `"127.0.0.1:4180"` |
229+| flag: `--https-address`<br/>toml: `https_address` | string | `[https://]<addr>:<port>` to listen on for HTTPS clients. Square brackets are required for ipv6 address, e.g. `https://[::1]:443` | `":443"` |
230+| flag: `--metrics-address`<br/>toml: `metrics_address` | string | the address prometheus metrics will be scraped from | `""` |
231+| flag: `--metrics-secure-address`<br/>toml: `metrics_secure_address` | string | the address prometheus metrics will be scraped from if using HTTPS | `""` |
232+| flag: `--metrics-tls-cert-file`<br/>toml: `metrics_tls_cert_file` | string | path to certificate file for secure metrics server | `""` |
233+| flag: `--metrics-tls-key-file`<br/>toml: `metrics_tls_key_file` | string | path to private key file for secure metrics server | `""` |
234+| flag: `--tls-cert-file`<br/>toml: `tls_cert_file` | string | path to certificate file | |
235+| flag: `--tls-key-file`<br/>toml: `tls_key_file` | string | path to private key file | |
236+| flag: `--tls-cipher-suite`<br/>toml: `tls_cipher_suites` | string \| list | Restricts TLS cipher suites used by server to those listed (e.g. TLS_RSA_WITH_RC4_128_SHA) (may be given multiple times). If not specified, the default Go safe cipher list is used. List of valid cipher suites can be found in the [crypto/tls documentation](https://pkg.go.dev/crypto/tls#pkg-constants). | |
237+| flag: `--tls-min-version`<br/>toml: `tls_min_version` | string | minimum TLS version that is acceptable, either `"TLS1.2"` or `"TLS1.3"` | `"TLS1.2"` |
238+
239+### Session Options
240+
241+| Flag / Config Field | Type | Description | Default |
242+| ----------------------------------------------------------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
243+| flag: `--session-cookie-minimal`<br/>toml: `session_cookie_minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
244+| flag: `--session-store-type`<br/>toml: `session_store_type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
245+| flag: `--redis-cluster-connection-urls`<br/>toml: `redis_cluster_connection_urls` | string \| list | List of Redis cluster connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-cluster` | |
246+| flag: `--redis-connection-url`<br/>toml: `redis_connection_url` | string | URL of redis server for redis session storage (e.g. `redis://HOST[:PORT]`) | |
247+| flag: `--redis-ca-path`<br/>toml: `redis_ca_path` | string | Path to a CA certificates file that should be used when connecting to redis. If not specified, the system cert pool is used instead. |
248+| flag: `--redis-insecure-skip-tls-verify`<br/>toml: `redis_insecure_skip_tls_verify` | bool | skip TLS verification when connecting to Redis | false |
249+| flag: `--redis-password`<br/>toml: `redis_password` | string | Redis password. Applicable for all Redis configurations. Will override any password set in `--redis-connection-url` | |
250+| flag: `--redis-sentinel-password`<br/>toml: `redis_sentinel_password` | string | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `--redis-password` | |
251+| flag: `--redis-sentinel-master-name`<br/>toml: `redis_sentinel_master_name` | string | Redis sentinel master name. Used in conjunction with `--redis-use-sentinel` | |
252+| flag: `--redis-sentinel-connection-urls`<br/>toml: `redis_sentinel_connection_urls` | string \| list | List of Redis sentinel connection URLs (e.g. `redis://HOST[:PORT]`). Used in conjunction with `--redis-use-sentinel` | |
253+| flag: `--redis-use-cluster`<br/>toml: `redis_use_cluster` | bool | Connect to redis cluster. Must set `--redis-cluster-connection-urls` to use this feature | false |
254+| flag: `--redis-use-sentinel`<br/>toml: `redis_use_sentinel` | bool | Connect to redis via sentinels. Must set `--redis-sentinel-master-name` and `--redis-sentinel-connection-urls` to use this feature | false |
255+| flag: `--redis-connection-idle-timeout`<br/>toml: `redis_connection_idle_timeout` | int | Redis connection idle timeout seconds. If Redis [timeout](https://redis.io/docs/reference/clients/#client-timeouts) option is set to non-zero, the `--redis-connection-idle-timeout` must be less than Redis timeout option. Example: if either redis.conf includes `timeout 15` or using `CONFIG SET timeout 15` the `--redis-connection-idle-timeout` must be at least `--redis-connection-idle-timeout=14` | 0 |
256+
257+### Upstream Options
258+
259+| Flag / Config Field | Type | Description | Default |
260+| ----------------------------------------------------------------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------- |
261+| flag: `--flush-interval`<br/>toml: `flush_interval` | duration | period between flushing response buffers when streaming responses | `"1s"` |
262+| flag: `--pass-host-header`<br/>toml: `pass_host_header` | bool | pass the request Host Header to upstream | true |
263+| flag: `--proxy-websockets`<br/>toml: `proxy_websockets` | bool | enables WebSocket proxying | true |
264+| flag: `--ssl-upstream-insecure-skip-verify`<br/>toml: `ssl_upstream_insecure_skip_verify` | bool | skip validation of certificates presented when using HTTPS upstreams | false |
265+| flag: `--upstream-timeout`<br/>toml: `upstream_timeout` | duration | maximum amount of time the server will wait for a response from the upstream | 30s |
266+| flag: `--upstream`<br/>toml: `upstreams` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
267+
268+## Upstreams Configuration
269+
270+`oauth2-proxy` supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers, unix socket or serve static files from the file system.
271+
272+To configure **HTTP and HTTPS upstreams**, provide such a URL in `--upstream=URL`. The scheme+host portion and the path portion are extracted to configure proxying behavior. When processing incoming requests, the path portion becomes a lookup key for selecting the destination server of the proxied request.
273+
274+* Upstream URLs *without a trailing slash,* like in `--upstream=http://service2.internal/foo`, will match an incoming request exactly to `/foo` in `https://this.o2p.example.com/foo`, and forward the request on to service2.internal, but not match a request to `https://this.o2p.example.com/foo/more` nor ...`.com/food`.
275+* Upstream URLs *with a trailing slash,* like in `--upstream=http://service1.internal/foo/`, will match any incoming request to any incoming requests's path *starting with* `/foo/`, like `/foo/` and `/foo/more` and `/foo/lots/more?etc`.
276+
277+If multiple `--upstream` URLs' paths match an incoming request, the one with the longest matching path (the most specific match) takes priority over shorter (less specific) ones.
278+
279+**Unix socket upstreams** are configured as `unix:///path/to/unix.sock`.
280+
281+**Static file paths** are configured as a file:// URL. `file:///var/www/static/` will serve the files from that directory at `http://[oauth2-proxy url]/var/www/static/`, which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. `file:///var/www/static/#/static/` will make `/var/www/static/` available at `http://[oauth2-proxy url]/static/`.
282+
283+Multiple upstreams can either be configured by supplying a comma separated list to the `--upstream` parameter, supplying the parameter multiple times or providing a list in the [config file](#config-file). When multiple upstreams are used routing to them will be based on the path they are set up with.
284+
285+## Environment variables
286+
287+Every command line argument can be specified as an environment variable by
288+prefixing it with `OAUTH2_PROXY_`, capitalising it, and replacing hyphens (`-`)
289+with underscores (`_`). If the argument can be specified multiple times, the
290+environment variable should be plural (trailing `S`).
291+
292+This is particularly useful for storing secrets outside a configuration file
293+or the command line.
294+
295+For example, the `--cookie-secret` flag becomes `OAUTH2_PROXY_COOKIE_SECRET`.
296+If a flag has the type `string | list` like the `--email-domain` flag it is
297+available as an environment variable in plural form e.g. `OAUTH2_PROXY_EMAIL_DOMAINS`
298+
299+Values for type `string | list` usually have a plural environment variable name
300+and need to be seperated by `,` e.g.
301+`OAUTH2_PROXY_SKIP_AUTH_ROUTES="GET=^/api/status,POST=^/api/saved_objects/_import"`
302+
303+Please check the type for each [config option](#config-options) first.
304+
305+## Logging Configuration
306+
307+By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the `--logging-filename` command.
308+
309+If logging to a file you can also configure the maximum file size (`--logging-max-size`), age (`--logging-max-age`), max backup logs (`--logging-max-backups`), and if backup logs should be compressed (`--logging-compress`).
310+
311+There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with `--standard-logging`, `--auth-logging`, and `--request-logging`.
312+
313+Each type of logging has its own configurable format and variables. By default, these formats are similar to the Apache Combined Log.
314+
315+Logging of requests to the `/ping` endpoint (or using `--ping-user-agent`) and the `/ready` endpoint can be disabled with `--silence-ping-logging` reducing log volume.
316+
317+## Auth Log Format
318+
319+Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:
320+
321+```
322+<REMOTE_ADDRESS> - <REQUEST ID> - <user@domain.com> [2015/03/19 17:20:19] [<STATUS>] <MESSAGE>
323+```
324+
325+The status block will contain one of the below strings:
326+
327+- `AuthSuccess` If a user has authenticated successfully by any method
328+- `AuthFailure` If the user failed to authenticate explicitly
329+- `AuthError` If there was an unexpected error during authentication
330+
331+If you require a different format than that, you can configure it with the `--auth-logging-format` flag.
332+The default format is configured as follows:
333+
334+```
335+{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}
336+```
337+
338+Available variables for auth logging:
339+
340+| Variable | Example | Description |
341+| ------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
342+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
343+| Host | domain.com | The value of the Host header. |
344+| Message | Authenticated via OAuth2 | The details of the auth attempt. |
345+| Protocol | HTTP/1.0 | The request protocol. |
346+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
347+| RequestMethod | GET | The request method. |
348+| Timestamp | 2015/03/19 17:20:19 | The date and time of the logging event. |
349+| UserAgent | - | The full user agent as reported by the requesting client. |
350+| Username | username@email.com | The email or username of the auth request. |
351+| Status | AuthSuccess | The status of the auth request. See above for details. |
352+
353+## Request Log Format
354+
355+HTTP request logs will output by default in the below format:
356+
357+```
358+<REMOTE_ADDRESS> - <REQUEST ID> - <user@domain.com> [2015/03/19 17:20:19] <HOST_HEADER> GET <UPSTREAM_HOST> "/path/" HTTP/1.1 "<USER_AGENT>" <RESPONSE_CODE> <RESPONSE_BYTES> <REQUEST_DURATION>
359+```
360+
361+If you require a different format than that, you can configure it with the `--request-logging-format` flag.
362+The default format is configured as follows:
363+
364+```
365+{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}
366+```
367+
368+Available variables for request logging:
369+
370+| Variable | Example | Description |
371+| --------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
372+| Client | 74.125.224.72 | The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true. |
373+| Host | domain.com | The value of the Host header. |
374+| Protocol | HTTP/1.0 | The request protocol. |
375+| RequestDuration | 0.001 | The time in seconds that a request took to process. |
376+| RequestID | 00010203-0405-4607-8809-0a0b0c0d0e0f | The request ID pulled from the `--request-id-header`. Random UUID if empty |
377+| RequestMethod | GET | The request method. |
378+| RequestURI | "/oauth2/auth" | The URI path of the request. |
379+| ResponseSize | 12 | The size in bytes of the response. |
380+| StatusCode | 200 | The HTTP status code of the response. |
381+| Timestamp | 2015/03/19 17:20:19 | The date and time of the logging event. |
382+| Upstream | - | The upstream data of the HTTP request. |
383+| UserAgent | - | The full user agent as reported by the requesting client. |
384+| Username | username@email.com | The email or username of the auth request. |
385+
386+## Standard Log Format
387+
388+All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:
389+
390+```
391+[2015/03/19 17:20:19] [main.go:40] <MESSAGE>
392+```
393+
394+If you require a different format than that, you can configure it with the `--standard-logging-format` flag. The default format is configured as follows:
395+
396+```
397+[{{.Timestamp}}] [{{.File}}] {{.Message}}
398+```
399+
400+Available variables for standard logging:
401+
402+| Variable | Example | Description |
403+| --------- | --------------------------------- | -------------------------------------------------- |
404+| Timestamp | 2015/03/19 17:20:19 | The date and time of the logging event. |
405+| File | main.go:40 | The file and line number of the logging statement. |
406+| Message | HTTP: listening on 127.0.0.1:4180 | The details of the log statement. |
docs/versioned_docs/version-7.11.x/configuration/providers/adfs.mdnew file+19
@@ -0,0 +1,19 @@
1+---
2+id: adfs
3+title: ADFS
4+---
5+
6+1. Open the ADFS administration console on your Windows Server and add a new Application Group
7+2. Provide a name for the integration, select Server Application from the Standalone applications section and click Next
8+3. Follow the wizard to get the client-id, client-secret and configure the application credentials
9+4. Configure the proxy with
10+
11+```
12+ --provider=adfs
13+ --client-id=<application ID from step 3>
14+ --client-secret=<value from step 3>
15+```
16+
17+Note: When using the ADFS Auth provider with nginx and the cookie session store you may find the cookie is too large and
18+doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the
19+[redis session storage](../sessions.md#redis-storage) should resolve this.
docs/versioned_docs/version-7.11.x/configuration/providers/bitbucket.mdnew file+25
@@ -0,0 +1,25 @@
1+---
2+id: bitbucket
3+title: BitBucket
4+---
5+
6+1. [Add a new OAuth consumer](https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html)
7+ * In "Callback URL" use `https://<oauth2-proxy>/oauth2/callback`, substituting `<oauth2-proxy>` with the actual
8+ hostname that oauth2-proxy is running on.
9+ * In Permissions section select:
10+ * Account -> Email
11+ * Team membership -> Read
12+ * Repositories -> Read
13+2. Note the Client ID and Client Secret.
14+
15+To use the provider, pass the following options:
16+
17+```
18+ --provider=bitbucket
19+ --client-id=<Client ID>
20+ --client-secret=<Client Secret>
21+```
22+
23+The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team
24+members use additional configuration option: `--bitbucket-team=<Team name>`. To restrict the access to only these users
25+who have access to one selected repository use `--bitbucket-repository=<Repository name>`.
docs/versioned_docs/version-7.11.x/configuration/providers/digitalocean.mdnew file+21
@@ -0,0 +1,21 @@
1+---
2+id: digitalocean
3+title: DigitalOcean
4+---
5+
6+1. [Create a new OAuth application](https://cloud.digitalocean.com/account/api/applications)
7+ * You can fill in the name, homepage, and description however you wish.
8+ * In the "Application callback URL" field, enter: `https://oauth-proxy/oauth2/callback`, substituting `oauth2-proxy`
9+ with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL.
10+2. Note the Client ID and Client Secret.
11+
12+To use the provider, pass the following options:
13+
14+```
15+ --provider=digitalocean
16+ --client-id=<Client ID>
17+ --client-secret=<Client Secret>
18+```
19+
20+Alternatively, set the equivalent options in the config file. The redirect URL defaults to
21+`https://<requested host header>/oauth2/callback`. If you need to change it, you can use the `--redirect-url` command-line option.
docs/versioned_docs/version-7.11.x/configuration/providers/facebook.mdnew file+7
@@ -0,0 +1,7 @@
1+---
2+id: facebook
3+title: Facebook
4+---
5+
6+1. Create a new FB App from https://developers.facebook.com/
7+2. Under FB Login, set your Valid OAuth redirect URIs to `https://internal.yourcompany.com/oauth2/callback`
docs/versioned_docs/version-7.11.x/configuration/providers/gitea.mdnew file+24
@@ -0,0 +1,24 @@
1+---
2+id: gitea
3+title: Gitea
4+---
5+
6+:::note
7+This is not actually its own provider. For more details and options please refer to the [GitHub Provider Options](github.md)
8+:::
9+
10+1. Create a new application: `https://< your gitea host >/user/settings/applications`
11+2. Under `Redirect URI` enter the correct URL i.e. `https://<proxied host>/oauth2/callback`
12+3. Note the Client ID and Client Secret.
13+4. Pass the following options to the proxy:
14+
15+```
16+ --provider="github"
17+ --redirect-url="https://<proxied host>/oauth2/callback"
18+ --provider-display-name="Gitea"
19+ --client-id="< client_id as generated by Gitea >"
20+ --client-secret="< client_secret as generated by Gitea >"
21+ --login-url="https://< your gitea host >/login/oauth/authorize"
22+ --redeem-url="https://< your gitea host >/login/oauth/access_token"
23+ --validate-url="https://< your gitea host >/api/v1/user/emails"
24+```
docs/versioned_docs/version-7.11.x/configuration/providers/github.mdnew file+81
@@ -0,0 +1,81 @@
1+---
2+id: github
3+title: GitHub
4+---
5+
6+## Config Options
7+
8+| Flag | Toml Field | Type | Description | Default |
9+| ---------------- | -------------- | -------------- | ------------------------------------------------------------------------------------------------------------- | ------- |
10+| `--github-org` | `github_org` | string | restrict logins to members of this organisation | |
11+| `--github-team` | `github_team` | string | restrict logins to members of any of these teams (slug) or (org:team), comma separated | |
12+| `--github-repo` | `github_repo` | string | restrict logins to collaborators of this repository formatted as `orgname/repo` | |
13+| `--github-token` | `github_token` | string | the token to use when verifying repository collaborators (must have push access to the repository) | |
14+| `--github-user` | `github_users` | string \| list | To allow users to login by username even if they do not belong to the specified org and team or collaborators | |
15+
16+## Usage
17+
18+1. Create a new project: https://github.com/settings/developers
19+2. Under `Authorization callback URL` enter the correct url ie `https://internal.yourcompany.com/oauth2/callback`
20+
21+The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional
22+team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with `--email-domain=*`. Additionally, all the organizations and teams a user belongs to are set as part of the `X-Forwarded-Groups` header. e.g. `org1:team1,org1:team2,org2:team1`
23+
24+NOTE: When `--github-user` is set, the specified users are allowed to log in even if they do not belong to the specified
25+org and team or collaborators.
26+
27+To restrict access to your organization:
28+
29+```shell
30+ # restrict logins to members of this organisation
31+ --github-org="your-org"
32+```
33+
34+To restrict access to specific teams within an organization:
35+
36+```shell
37+ --github-org="your-org"
38+ # restrict logins to members of any of these teams (slug), comma separated
39+ --github-team="team1,team2,team3"
40+```
41+
42+To restrict to teams within different organizations, keep the organization flag empty and use `--github-team` like so:
43+
44+```shell
45+ # keep empty
46+ --github-org=""
47+ # restrict logins to members to any of the following teams (format <org>:<slug>, like octo:team1), comma separated
48+ --github-team="org1:team1,org2:team1,org3:team42,octo:cat"
49+```
50+
51+If you would rather restrict access to collaborators of a repository, those users must either have push access to a
52+public repository or any access to a private repository:
53+
54+```shell
55+ # restrict logins to collaborators of this repository formatted as orgname/repo
56+ --github-repo=""
57+```
58+
59+If you'd like to allow access to users with **read only** access to a **public** repository you will need to provide a
60+[token](https://github.com/settings/tokens) for a user that has write access to the repository. The token must be
61+created with at least the `public_repo` scope:
62+
63+```shell
64+ # the token to use when verifying repository collaborators
65+ --github-token=""
66+```
67+
68+To allow a user to log in with their username even if they do not belong to the specified org and team or collaborators:
69+
70+```shell
71+ # allow logins by username, comma separated
72+ --github-user=""
73+```
74+
75+If you are using GitHub enterprise, make sure you set the following to the appropriate url:
76+
77+```shell
78+ --login-url="http(s)://<enterprise github host>/login/oauth/authorize"
79+ --redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"
80+ --validate-url="http(s)://<enterprise github host>/api/v3"
81+```
docs/versioned_docs/version-7.11.x/configuration/providers/gitlab.mdnew file+49
@@ -0,0 +1,49 @@
1+---
2+id: gitlab
3+title: GitLab
4+---
5+
6+## Config Options
7+
8+| Flag | Toml Field | Type | Description | Default |
9+| ------------------- | ----------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
10+| `--gitlab-group` | `gitlab_groups` | string \| list | restrict logins to members of any of these groups (slug), separated by a comma | |
11+| `--gitlab-project` | `gitlab_projects` | string \| list | restrict logins to members of any of these projects (may be given multiple times) formatted as `orgname/repo=accesslevel`. Access level should be a value matching [Gitlab access levels](https://docs.gitlab.com/ee/api/members.html#valid-access-levels), defaulted to 20 if absent | |
12+
13+## Usage
14+
15+This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version
16+prior to 12.X (see [994](https://github.com/oauth2-proxy/oauth2-proxy/issues/994)).
17+
18+Whether you are using GitLab.com or self-hosting GitLab, follow
19+[these steps to add an application](https://docs.gitlab.com/integration/oauth_provider/). Make sure to enable at
20+least the `openid`, `profile` and `email` scopes, and set the redirect url to your application url e.g.
21+https://myapp.com/oauth2/callback.
22+
23+If you need projects filtering, add the extra `read_api` scope to your application.
24+
25+The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow
26+[these steps](../overview.md#generating-a-cookie-secret)
27+
28+```
29+ --provider="gitlab"
30+ --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab
31+ --client-id=GITLAB_CLIENT_ID
32+ --client-secret=GITLAB_CLIENT_SECRET
33+ --cookie-secret=COOKIE_SECRET
34+```
35+
36+Restricting by group membership is possible with the following option:
37+
38+```shell
39+ --gitlab-group="mygroup,myothergroup" # restrict logins to members of any of these groups (slug), separated by a comma
40+```
41+
42+If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:
43+
44+```shell
45+ --oidc-issuer-url="<your gitlab url>"
46+```
47+
48+If your self-hosted GitLab is on a subdirectory (e.g. domain.tld/gitlab), as opposed to its own subdomain
49+(e.g. gitlab.domain.tld), you may need to add a redirect from domain.tld/oauth pointing at e.g. domain.tld/gitlab/oauth.
docs/versioned_docs/version-7.11.x/configuration/providers/google.mdnew file+75
@@ -0,0 +1,75 @@
1+---
2+id: google
3+title: Google (default)
4+---
5+
6+## Config Options
7+
8+| Flag | Toml Field | Type | Description | Default |
9+| ---------------------------------------------- | -------------------------------------------- | ------ | ------------------------------------------------------------------------------------------------ | -------------------------------------------------- |
10+| `--google-admin-email` | `google_admin_email` | string | the google admin to impersonate for api calls | |
11+| `--google-group` | `google_groups` | string | restrict logins to members of this google group (may be given multiple times). If not specified and service account or default credentials are configured, all user groups will be allowed. | |
12+| `--google-service-account-json` | `google_service_account_json` | string | the path to the service account json credentials | |
13+| `--google-use-application-default-credentials` | `google_use_application_default_credentials` | bool | use application default credentials instead of service account json (i.e. GKE Workload Identity) | |
14+| `--google-target-principal` | `google_target_principal` | bool | the target principal to impersonate when using ADC | defaults to the service account configured for ADC |
15+
16+## Usage
17+
18+For Google, the registration steps are:
19+
20+1. Create a new project: https://console.developers.google.com/project
21+2. Choose the new project from the top right project dropdown (only if another project is selected)
22+3. In the project Dashboard center pane, choose **"APIs & Services"**
23+4. In the left Nav pane, choose **"Credentials"**
24+5. In the center pane, choose **"OAuth consent screen"** tab. Fill in **"Product name shown to users"** and hit save.
25+6. In the center pane, choose **"Credentials"** tab.
26+ - Open the **"New credentials"** drop down
27+ - Choose **"OAuth client ID"**
28+ - Choose **"Web application"**
29+ - Application name is freeform, choose something appropriate
30+ - Authorized JavaScript origins is your domain ex: `https://internal.yourcompany.com`
31+ - Authorized redirect URIs is the location of oauth2/callback ex: `https://internal.yourcompany.com/oauth2/callback`
32+ - Choose **"Create"**
33+7. Take note of the **Client ID** and **Client Secret**
34+
35+It's recommended to refresh sessions on a short interval (1h) with `cookie-refresh` setting which validates that the
36+account is still authorized.
37+
38+#### Restrict auth to specific Google groups on your domain. (optional)
39+
40+1. Create a [service account](https://developers.google.com/identity/protocols/oauth2/service-account) and configure it
41+ to use [Application Default Credentials / Workload Identity / Workload Identity Federation (recommended)](#using-application-default-credentials-adc--workload-identity--workload-identity-federation-recommended) or,
42+ alternatively download the JSON.
43+2. Make note of the Client ID for a future step.
44+3. Under "APIs & Auth", choose APIs.
45+4. Click on Admin SDK and then Enable API.
46+5. Follow the steps on [Set up domain-wide delegation for a service account](https://developers.google.com/workspace/guides/create-credentials#optional_set_up_domain-wide_delegation_for_a_service_account)
47+ and give the client id from step 2 the following oauth scopes:
48+
49+ ```
50+ https://www.googleapis.com/auth/admin.directory.group.member.readonly
51+ ```
52+
53+6. Follow the steps on https://support.google.com/a/answer/60757 to enable Admin API access.
54+7. Create or choose an existing administrative email address on the Gmail domain to assign to the `google-admin-email`
55+ flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from
56+ step 5 for the reason why.
57+8. Create or choose an existing email group and set that email to the `google-group` flag. You can pass multiple instances
58+ of this flag with different groups and the user will be checked against all the provided groups.
59+
60+(Only if using a JSON file (see step 1))
61+
62+9. Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and
63+ set the path to the file in the `google-service-account-json` flag.
64+10. Restart oauth2-proxy.
65+
66+Note: The user is checked against the group members list on initial authentication and every time the token is
67+refreshed ( about once an hour ).
68+
69+##### Using Application Default Credentials (ADC) / Workload Identity / Workload Identity Federation (recommended)
70+oauth2-proxy can make use of [Application Default Credentials](https://cloud.google.com/docs/authentication/application-default-credentials).
71+When deployed within GCP, this means that it can automatically use the service account attached to the resource. When deployed to GKE, ADC
72+can be leveraged through a feature called Workload Identity. Follow Google's [guide](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity)
73+to set up Workload Identity.
74+
75+When deployed outside of GCP, [Workload Identity Federation](https://cloud.google.com/docs/authentication/provide-credentials-adc#wlif) might be an option.
docs/versioned_docs/version-7.11.x/configuration/providers/index.mdnew file+44
@@ -0,0 +1,44 @@
1+---
2+id: index
3+title: OAuth Provider Configuration
4+---
5+
6+You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it
7+with Redirect URI(s) for the domain you intend to run `oauth2-proxy` on.
8+
9+Valid providers are :
10+
11+- [ADFS](adfs.md)
12+- [Bitbucket](bitbucket.md)
13+- [DigitalOcean](digitalocean.md)
14+- [Facebook](facebook.md)
15+- [Gitea](gitea.md)
16+- [GitHub](github.md)
17+- [GitLab](gitlab.md)
18+- [Google](google.md) _default_
19+- [Keycloak](keycloak.md) (Deprecated)
20+- [Keycloak OIDC](keycloak_oidc.md)
21+- [LinkedIn](linkedin.md)
22+- [login.gov](login_gov.md)
23+- [Microsoft Azure](ms_azure_ad.md) (Deprecated)
24+- [Microsoft Entra ID](ms_entra_id.md)
25+- [Nextcloud](nextcloud.md)
26+- [OpenID Connect](openid_connect.md)
27+- [SourceHut](sourcehut.md)
28+
29+The provider can be selected using the `provider` configuration value, or set in the [`providers` array using AlphaConfig](https://oauth2-proxy.github.io/oauth2-proxy/configuration/alpha-config#providers). However, [**the feature to implement multiple providers is not complete**](https://github.com/oauth2-proxy/oauth2-proxy/issues/926).
30+
31+Please note that not all providers support all claims. The `preferred_username` claim is currently only supported by the
32+OpenID Connect provider.
33+
34+## Email Authentication
35+
36+To authorize a specific email-domain use `--email-domain=yourcompany.com`. To authorize individual email addresses use
37+`--authenticated-emails-file=/path/to/file` with one email per line. To authorize all email addresses use `--email-domain=*`.
38+
39+## Adding a new Provider
40+
41+Follow the examples in the [`providers` package](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/) to define a new
42+`Provider` instance. Add a new `case` to
43+[`providers.New()`](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go) to allow `oauth2-proxy` to use the
44+new `Provider`.
docs/versioned_docs/version-7.11.x/configuration/providers/keycloak.mdnew file+36
@@ -0,0 +1,36 @@
1+---
2+id: keycloak
3+title: Keycloak (Deprecated)
4+---
5+
6+:::note
7+This is the legacy and deprecated provider for Keycloak, use [Keycloak OIDC Auth Provider](keycloak_oidc.md) if possible.
8+:::
9+
10+1. Create new client in your Keycloak realm with **Access Type** 'confidential' and **Valid Redirect URIs** 'https://internal.yourcompany.com/oauth2/callback'
11+2. Take note of the Secret in the credential tab of the client
12+3. Create a mapper with **Mapper Type** 'Group Membership' and **Token Claim Name** 'groups'.
13+
14+Make sure you set the following to the appropriate url:
15+
16+```
17+ --provider=keycloak
18+ --client-id=<client you have created>
19+ --client-secret=<your client's secret>
20+ --login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"
21+ --redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"
22+ --profile-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
23+ --validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
24+ --keycloak-group=<first_allowed_user_group>
25+ --keycloak-group=<second_allowed_user_group>
26+```
27+
28+For group based authorization, the optional `--keycloak-group` (legacy) or `--allowed-group` (global standard)
29+flags can be used to specify which groups to limit access to.
30+
31+If these are unset but a `groups` mapper is set up above in step (3), the provider will still
32+populate the `X-Forwarded-Groups` header to your upstream server with the `groups` data in the
33+Keycloak userinfo endpoint response.
34+
35+The group management in keycloak is using a tree. If you create a group named admin in keycloak
36+you should define the 'keycloak-group' value to /admin.
docs/versioned_docs/version-7.11.x/configuration/providers/keycloak_oidc.mdnew file+151

This diff is too big to show here.

docs/versioned_docs/version-7.11.x/configuration/providers/linkedin.mdnew file+13

This diff is too big to show here.

docs/versioned_docs/version-7.11.x/configuration/providers/login_gov.mdnew file+79

This diff is too big to show here.

docs/versioned_docs/version-7.11.x/configuration/providers/ms_azure_ad.mdnew file+59

This diff is too big to show here.

docs/versioned_docs/version-7.11.x/configuration/providers/ms_entra_id.mdnew file+197

This diff is too big to show here.

docs/versioned_docs/version-7.11.x/configuration/providers/nextcloud.mdnew file+28

This diff is too big to show here.

docs/versioned_docs/version-7.11.x/configuration/providers/openid_connect.mdnew file+146

This diff is too big to show here.

docs/versioned_docs/version-7.11.x/configuration/providers/sourcehut.mdnew file+25

This diff is too big to show here.

docs/versioned_docs/version-7.11.x/configuration/sessions.mdnew file+99

This diff is too big to show here.

docs/versioned_docs/version-7.11.x/configuration/systemd_socket.mdnew file+43

This diff is too big to show here.

docs/versioned_docs/version-7.11.x/configuration/tls.mdnew file+85

This diff is too big to show here.

docs/versioned_docs/version-7.11.x/features/endpoints.mdnew file+47

This diff is too big to show here.

docs/versioned_docs/version-7.11.x/installation.mdnew file+32

This diff is too big to show here.

docs/versioned_docs/version-7.11.x/welcome.mdnew file+23

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/behaviour.mdnew file+26

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/community/contribution.mdnew file+89

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/community/security.mdnew file+49

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/alpha_config.mdnew file+565

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/alpha_config.md.tmplnew file+139

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/integration.mdnew file+386

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/overview.mdnew file+407

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/providers/adfs.mdnew file+19

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/providers/bitbucket.mdnew file+25

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/providers/cidaas.mdnew file+37

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/providers/digitalocean.mdnew file+21

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/providers/facebook.mdnew file+7

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/providers/gitea.mdnew file+24

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/providers/github.mdnew file+81

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/providers/gitlab.mdnew file+49

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/providers/google.mdnew file+75

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/providers/index.mdnew file+45

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/providers/keycloak.mdnew file+36

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/providers/keycloak_oidc.mdnew file+151

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/providers/linkedin.mdnew file+13

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/providers/login_gov.mdnew file+79

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/providers/ms_azure_ad.mdnew file+59

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/providers/ms_entra_id.mdnew file+197

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/providers/nextcloud.mdnew file+28

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/providers/openid_connect.mdnew file+146

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/providers/sourcehut.mdnew file+25

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/sessions.mdnew file+99

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/systemd_socket.mdnew file+43

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/configuration/tls.mdnew file+85

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/features/endpoints.mdnew file+47

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/installation.mdnew file+32

This diff is too big to show here.

docs/versioned_docs/version-7.12.x/welcome.mdnew file+23

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/behaviour.mdnew file+26

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/community/contribution.mdnew file+91

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/community/security.mdnew file+49

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/alpha_config.mdnew file+568

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/alpha_config.md.tmplnew file+139

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/integrations/caddy.mdnew file+63

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/integrations/headlamp.mdnew file+105

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/integrations/index.mdnew file+41

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/integrations/kubernetes-dashboard.mdnew file+289

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/integrations/nginx.mdnew file+174

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/integrations/traefik.mdnew file+192

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/overview.mdnew file+407

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/providers/adfs.mdnew file+19

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/providers/bitbucket.mdnew file+25

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/providers/cidaas.mdnew file+37

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/providers/cisco_duo.mdnew file+44

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/providers/digitalocean.mdnew file+21

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/providers/facebook.mdnew file+7

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/providers/gitea.mdnew file+24

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/providers/github.mdnew file+81

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/providers/gitlab.mdnew file+49

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/providers/google.mdnew file+84

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/providers/index.mdnew file+46

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/providers/keycloak.mdnew file+36

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/providers/keycloak_oidc.mdnew file+151

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/providers/linkedin.mdnew file+13

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/providers/login_gov.mdnew file+79

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/providers/ms_azure_ad.mdnew file+59

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/providers/ms_entra_id.mdnew file+197

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/providers/nextcloud.mdnew file+28

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/providers/openid_connect.mdnew file+146

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/providers/sourcehut.mdnew file+25

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/sessions.mdnew file+99

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/systemd_socket.mdnew file+43

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/configuration/tls.mdnew file+85

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/features/endpoints.mdnew file+47

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/installation.mdnew file+32

This diff is too big to show here.

docs/versioned_docs/version-7.13.x/welcome.mdnew file+23

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/behaviour.mdnew file+26

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/community/contribution.mdnew file+91

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/community/security.mdnew file+49

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/alpha_config.mdnew file+637

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/alpha_config.md.tmplnew file+218

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/integrations/caddy.mdnew file+63

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/integrations/headlamp.mdnew file+105

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/integrations/index.mdnew file+41

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/integrations/kubernetes-dashboard.mdnew file+289

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/integrations/nginx.mdnew file+174

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/integrations/traefik.mdnew file+192

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/overview.mdnew file+407

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/providers/adfs.mdnew file+19

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/providers/bitbucket.mdnew file+25

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/providers/cidaas.mdnew file+37

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/providers/cisco_duo.mdnew file+44

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/providers/digitalocean.mdnew file+21

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/providers/facebook.mdnew file+7

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/providers/gitea.mdnew file+24

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/providers/github.mdnew file+81

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/providers/gitlab.mdnew file+49

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/providers/google.mdnew file+84

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/providers/index.mdnew file+46

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/providers/keycloak.mdnew file+36

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/providers/keycloak_oidc.mdnew file+151

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/providers/linkedin.mdnew file+13

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/providers/login_gov.mdnew file+79

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/providers/ms_azure_ad.mdnew file+59

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/providers/ms_entra_id.mdnew file+197

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/providers/nextcloud.mdnew file+28

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/providers/openid_connect.mdnew file+146

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/providers/sourcehut.mdnew file+25

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/sessions.mdnew file+99

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/systemd_socket.mdnew file+43

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/configuration/tls.mdnew file+85

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/features/endpoints.mdnew file+59

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/installation.mdnew file+32

This diff is too big to show here.

docs/versioned_docs/version-7.14.x/welcome.mdnew file+32

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/behaviour.mdnew file+26

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/community/contribution.mdnew file+91

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/community/security.mdnew file+49

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/alpha_config.mdnew file+702

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/alpha_config.md.tmplnew file+281

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/integrations/caddy.mdnew file+63

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/integrations/headlamp.mdnew file+105

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/integrations/index.mdnew file+41

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/integrations/kubernetes-dashboard.mdnew file+289

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/integrations/nginx.mdnew file+174

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/integrations/traefik.mdnew file+192

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/overview.mdnew file+451

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/providers/adfs.mdnew file+19

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/providers/bitbucket.mdnew file+25

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/providers/cidaas.mdnew file+37

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/providers/cisco_duo.mdnew file+44

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/providers/digitalocean.mdnew file+21

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/providers/facebook.mdnew file+7

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/providers/gitea.mdnew file+24

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/providers/github.mdnew file+81

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/providers/gitlab.mdnew file+49

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/providers/google.mdnew file+84

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/providers/index.mdnew file+46

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/providers/keycloak.mdnew file+36

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/providers/keycloak_oidc.mdnew file+151

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/providers/linkedin.mdnew file+13

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/providers/login_gov.mdnew file+79

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/providers/ms_azure_ad.mdnew file+59

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/providers/ms_entra_id.mdnew file+201

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/providers/nextcloud.mdnew file+28

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/providers/openid_connect.mdnew file+146

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/providers/sourcehut.mdnew file+25

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/sessions.mdnew file+99

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/systemd_socket.mdnew file+51

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/configuration/tls.mdnew file+85

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/features/endpoints.mdnew file+73

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/installation.mdnew file+32

This diff is too big to show here.

docs/versioned_docs/version-7.15.x/welcome.mdnew file+33

This diff is too big to show here.

docs/versioned_docs/version-7.2.x/behaviour.mdnew file+26

This diff is too big to show here.

docs/versioned_docs/version-7.2.x/community/security.mdnew file+49

This diff is too big to show here.

docs/versioned_docs/version-7.2.x/configuration/alpha_config.mdnew file+394

This diff is too big to show here.

docs/versioned_docs/version-7.2.x/configuration/alpha_config.md.tmplnew file+101

This diff is too big to show here.

docs/versioned_docs/version-7.2.x/configuration/auth.mdnew file+563

This diff is too big to show here.

docs/versioned_docs/version-7.2.x/configuration/overview.mdnew file+592

This diff is too big to show here.

docs/versioned_docs/version-7.2.x/configuration/sessions.mdnew file+67

This diff is too big to show here.

docs/versioned_docs/version-7.2.x/configuration/tls.mdnew file+70

This diff is too big to show here.

docs/versioned_docs/version-7.2.x/features/endpoints.mdnew file+36

This diff is too big to show here.

docs/versioned_docs/version-7.2.x/installation.mdnew file+26

This diff is too big to show here.

docs/versioned_docs/version-7.3.x/behaviour.mdnew file+26

This diff is too big to show here.

docs/versioned_docs/version-7.3.x/community/security.mdnew file+49

This diff is too big to show here.

docs/versioned_docs/version-7.3.x/configuration/alpha_config.mdnew file+526

This diff is too big to show here.

docs/versioned_docs/version-7.3.x/configuration/alpha_config.md.tmplnew file+125

This diff is too big to show here.

docs/versioned_docs/version-7.3.x/configuration/auth.mdnew file+570

This diff is too big to show here.

docs/versioned_docs/version-7.3.x/configuration/overview.mdnew file+597

This diff is too big to show here.

docs/versioned_docs/version-7.3.x/configuration/sessions.mdnew file+67

This diff is too big to show here.

docs/versioned_docs/version-7.3.x/configuration/tls.mdnew file+85

This diff is too big to show here.

docs/versioned_docs/version-7.3.x/features/endpoints.mdnew file+45

This diff is too big to show here.

docs/versioned_docs/version-7.3.x/installation.mdnew file+26

This diff is too big to show here.

docs/versioned_docs/version-7.4.x/behaviour.mdnew file+26

This diff is too big to show here.

docs/versioned_docs/version-7.4.x/community/security.mdnew file+49

This diff is too big to show here.

docs/versioned_docs/version-7.4.x/configuration/alpha_config.mdnew file+529

This diff is too big to show here.

docs/versioned_docs/version-7.4.x/configuration/alpha_config.md.tmplnew file+125

This diff is too big to show here.

docs/versioned_docs/version-7.4.x/configuration/auth.mdnew file+593

This diff is too big to show here.

docs/versioned_docs/version-7.4.x/configuration/overview.mdnew file+602

This diff is too big to show here.

docs/versioned_docs/version-7.4.x/configuration/sessions.mdnew file+71

This diff is too big to show here.

docs/versioned_docs/version-7.4.x/configuration/tls.mdnew file+86

This diff is too big to show here.

docs/versioned_docs/version-7.4.x/features/endpoints.mdnew file+45

This diff is too big to show here.

docs/versioned_docs/version-7.4.x/installation.mdnew file+26

This diff is too big to show here.

docs/versioned_docs/version-7.5.x/behaviour.mdnew file+26

This diff is too big to show here.

docs/versioned_docs/version-7.5.x/community/contribution.mdnew file+78

This diff is too big to show here.

docs/versioned_docs/version-7.5.x/community/security.mdnew file+49

This diff is too big to show here.

docs/versioned_docs/version-7.5.x/configuration/alpha_config.mdnew file+530

This diff is too big to show here.

docs/versioned_docs/version-7.5.x/configuration/alpha_config.md.tmplnew file+125

This diff is too big to show here.

docs/versioned_docs/version-7.5.x/configuration/auth.mdnew file+707

This diff is too big to show here.

docs/versioned_docs/version-7.5.x/configuration/overview.mdnew file+605

This diff is too big to show here.

docs/versioned_docs/version-7.5.x/configuration/sessions.mdnew file+98

This diff is too big to show here.

docs/versioned_docs/version-7.5.x/configuration/tls.mdnew file+86

This diff is too big to show here.

docs/versioned_docs/version-7.5.x/features/endpoints.mdnew file+47

This diff is too big to show here.

docs/versioned_docs/version-7.5.x/installation.mdnew file+32

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/behaviour.mdnew file+26

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/community/contribution.mdnew file+78

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/community/security.mdnew file+49

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/alpha_config.mdnew file+548

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/alpha_config.md.tmplnew file+139

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/integration.mdnew file+318

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/overview.mdnew file+391

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/providers/adfs.mdnew file+19

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/providers/azure.mdnew file+46

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/providers/azure_ad.mdnew file+9

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/providers/bitbucket.mdnew file+25

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/providers/digitalocean.mdnew file+21

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/providers/facebook.mdnew file+7

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/providers/gitea.mdnew file+20

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/providers/github.mdnew file+67

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/providers/gitlab.mdnew file+49

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/providers/google.mdnew file+76

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/providers/index.mdnew file+42

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/providers/keycloak.mdnew file+36

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/providers/keycloak_oidc.mdnew file+151

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/providers/linkedin.mdnew file+13

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/providers/login_gov.mdnew file+79

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/providers/nextcloud.mdnew file+28

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/providers/openid_connect.mdnew file+146

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/sessions.mdnew file+97

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/configuration/tls.mdnew file+85

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/features/endpoints.mdnew file+47

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/installation.mdnew file+31

This diff is too big to show here.

docs/versioned_docs/version-7.6.x/welcome.mdnew file+23

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/behaviour.mdnew file+26

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/community/contribution.mdnew file+78

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/community/security.mdnew file+49

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/alpha_config.mdnew file+546

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/alpha_config.md.tmplnew file+139

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/integration.mdnew file+318

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/overview.mdnew file+396

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/providers/adfs.mdnew file+19

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/providers/azure.mdnew file+55

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/providers/azure_ad.mdnew file+18

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/providers/bitbucket.mdnew file+25

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/providers/digitalocean.mdnew file+21

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/providers/facebook.mdnew file+7

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/providers/gitea.mdnew file+20

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/providers/github.mdnew file+67

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/providers/gitlab.mdnew file+49

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/providers/google.mdnew file+76

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/providers/index.mdnew file+42

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/providers/keycloak.mdnew file+36

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/providers/keycloak_oidc.mdnew file+151

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/providers/linkedin.mdnew file+13

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/providers/login_gov.mdnew file+79

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/providers/nextcloud.mdnew file+28

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/providers/openid_connect.mdnew file+146

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/sessions.mdnew file+99

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/configuration/tls.mdnew file+85

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/features/endpoints.mdnew file+47

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/installation.mdnew file+31

This diff is too big to show here.

docs/versioned_docs/version-7.7.x/welcome.mdnew file+23

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/behaviour.mdnew file+26

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/community/contribution.mdnew file+89

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/community/security.mdnew file+49

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/alpha_config.mdnew file+563

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/alpha_config.md.tmplnew file+139

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/integration.mdnew file+318

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/overview.mdnew file+401

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/providers/adfs.mdnew file+19

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/providers/bitbucket.mdnew file+25

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/providers/digitalocean.mdnew file+21

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/providers/facebook.mdnew file+7

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/providers/gitea.mdnew file+24

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/providers/github.mdnew file+67

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/providers/gitlab.mdnew file+49

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/providers/google.mdnew file+76

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/providers/index.mdnew file+43

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/providers/keycloak.mdnew file+36

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/providers/keycloak_oidc.mdnew file+151

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/providers/linkedin.mdnew file+13

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/providers/login_gov.mdnew file+79

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/providers/ms_azure_ad.mdnew file+59

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/providers/ms_entra_id.mdnew file+197

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/providers/nextcloud.mdnew file+28

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/providers/openid_connect.mdnew file+146

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/sessions.mdnew file+99

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/systemd_socket.mdnew file+43

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/configuration/tls.mdnew file+85

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/features/endpoints.mdnew file+47

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/installation.mdnew file+32

This diff is too big to show here.

docs/versioned_docs/version-7.8.x/welcome.mdnew file+23

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/behaviour.mdnew file+26

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/community/contribution.mdnew file+89

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/community/security.mdnew file+49

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/alpha_config.mdnew file+564

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/alpha_config.md.tmplnew file+139

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/integration.mdnew file+318

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/overview.mdnew file+403

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/providers/adfs.mdnew file+19

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/providers/bitbucket.mdnew file+25

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/providers/digitalocean.mdnew file+21

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/providers/facebook.mdnew file+7

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/providers/gitea.mdnew file+24

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/providers/github.mdnew file+67

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/providers/gitlab.mdnew file+49

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/providers/google.mdnew file+76

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/providers/index.mdnew file+43

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/providers/keycloak.mdnew file+36

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/providers/keycloak_oidc.mdnew file+151

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/providers/linkedin.mdnew file+13

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/providers/login_gov.mdnew file+79

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/providers/ms_azure_ad.mdnew file+59

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/providers/ms_entra_id.mdnew file+197

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/providers/nextcloud.mdnew file+28

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/providers/openid_connect.mdnew file+146

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/sessions.mdnew file+99

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/systemd_socket.mdnew file+43

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/configuration/tls.mdnew file+85

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/features/endpoints.mdnew file+47

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/installation.mdnew file+32

This diff is too big to show here.

docs/versioned_docs/version-7.9.x/welcome.mdnew file+23

This diff is too big to show here.

docs/versioned_sidebars/version-6.1.x-sidebars.jsonnew file+61

This diff is too big to show here.

docs/versioned_sidebars/version-7.0.x-sidebars.jsonnew file+65

This diff is too big to show here.

docs/versioned_sidebars/version-7.1.x-sidebars.jsonnew file+61

This diff is too big to show here.

docs/versioned_sidebars/version-7.10.x-sidebars.jsonnew file+83

This diff is too big to show here.

docs/versioned_sidebars/version-7.11.x-sidebars.jsonnew file+84

This diff is too big to show here.

docs/versioned_sidebars/version-7.12.x-sidebars.jsonnew file+84

This diff is too big to show here.

docs/versioned_sidebars/version-7.13.x-sidebars.jsonnew file+100

This diff is too big to show here.

docs/versioned_sidebars/version-7.14.x-sidebars.jsonnew file+100

This diff is too big to show here.

docs/versioned_sidebars/version-7.15.x-sidebars.jsonnew file+100

This diff is too big to show here.

docs/versioned_sidebars/version-7.2.x-sidebars.jsonnew file+61

This diff is too big to show here.

docs/versioned_sidebars/version-7.3.x-sidebars.jsonnew file+40

This diff is too big to show here.

docs/versioned_sidebars/version-7.4.x-sidebars.jsonnew file+40

This diff is too big to show here.

docs/versioned_sidebars/version-7.5.x-sidebars.jsonnew file+41

This diff is too big to show here.

docs/versioned_sidebars/version-7.6.x-sidebars.jsonnew file+83

This diff is too big to show here.

docs/versioned_sidebars/version-7.7.x-sidebars.jsonnew file+83

This diff is too big to show here.

docs/versioned_sidebars/version-7.8.x-sidebars.jsonnew file+83

This diff is too big to show here.

docs/versioned_sidebars/version-7.9.x-sidebars.jsonnew file+83

This diff is too big to show here.

docs/versions.jsonnew file+18

This diff is too big to show here.

go.modnew file+83

This diff is too big to show here.

go.sumnew file+271

This diff is too big to show here.

main.gonew file+184

This diff is too big to show here.

main_suite_test.gonew file+17

This diff is too big to show here.

main_test.gonew file+370

This diff is too big to show here.

oauthproxy.gonew file+1369

This diff is too big to show here.

oauthproxy_test.gonew file+3810

This diff is too big to show here.

pkg/apis/ip/interfaces.gonew file+11

This diff is too big to show here.

pkg/apis/middleware/middleware_suite_test.gonew file+20

This diff is too big to show here.

pkg/apis/middleware/scope.gonew file+107

This diff is too big to show here.

pkg/apis/middleware/scope_test.gonew file+90

This diff is too big to show here.

pkg/apis/middleware/session.gonew file+64

This diff is too big to show here.

pkg/apis/options/alpha_options.gonew file+77

This diff is too big to show here.

pkg/apis/options/app.gonew file+58

This diff is too big to show here.

pkg/apis/options/cookie.gonew file+83

This diff is too big to show here.

pkg/apis/options/cookie_test.gonew file+70

This diff is too big to show here.

pkg/apis/options/doc.gonew file+3

This diff is too big to show here.

pkg/apis/options/header.gonew file+89

This diff is too big to show here.

pkg/apis/options/hooks.gonew file+57

This diff is too big to show here.

pkg/apis/options/hooks_test.gonew file+96

This diff is too big to show here.

pkg/apis/options/legacy_options.gonew file+834

This diff is too big to show here.

pkg/apis/options/legacy_options_test.gonew file+1089

This diff is too big to show here.

pkg/apis/options/load.gonew file+233

This diff is too big to show here.

pkg/apis/options/load_test.gonew file+592

This diff is too big to show here.

pkg/apis/options/logging.gonew file+80

This diff is too big to show here.

pkg/apis/options/login_url_parameters.gonew file+102

This diff is too big to show here.

pkg/apis/options/options.gonew file+192

This diff is too big to show here.

pkg/apis/options/options_suite_test.gonew file+17

This diff is too big to show here.

pkg/apis/options/providers.gonew file+440

This diff is too big to show here.

pkg/apis/options/secret_source.gonew file+19

This diff is too big to show here.

pkg/apis/options/server.gonew file+49

This diff is too big to show here.

pkg/apis/options/sessions.gonew file+46

This diff is too big to show here.

pkg/apis/options/testutil/options_matcher.gonew file+62

This diff is too big to show here.

pkg/apis/options/testutil/options_matcher_test.gonew file+70

This diff is too big to show here.

pkg/apis/options/upstreams.gonew file+181

This diff is too big to show here.

pkg/apis/options/util/util.gonew file+22

This diff is too big to show here.

pkg/apis/options/util/util_suite_test.gonew file+17

This diff is too big to show here.

pkg/apis/options/util/util_test.gonew file+78

This diff is too big to show here.

pkg/apis/sessions/interfaces.gonew file+37

This diff is too big to show here.

pkg/apis/sessions/lock.gonew file+24

This diff is too big to show here.

pkg/apis/sessions/session_state.gonew file+275

This diff is too big to show here.

pkg/apis/sessions/session_state_test.gonew file+384

This diff is too big to show here.

pkg/app/pagewriter/default_logo.svgnew file+1

This diff is too big to show here.

pkg/app/pagewriter/error.htmlnew file+107

This diff is too big to show here.

pkg/app/pagewriter/error_page.gonew file+119

This diff is too big to show here.

pkg/app/pagewriter/error_page_test.gonew file+145

This diff is too big to show here.

pkg/app/pagewriter/pagewriter.gonew file+174

This diff is too big to show here.

pkg/app/pagewriter/pagewriter_suite_test.gonew file+19

This diff is too big to show here.

pkg/app/pagewriter/pagewriter_test.gonew file+280

This diff is too big to show here.

pkg/app/pagewriter/robots.txtnew file+2

This diff is too big to show here.

pkg/app/pagewriter/sign_in.htmlnew file+132

This diff is too big to show here.

pkg/app/pagewriter/sign_in_page.gonew file+136

This diff is too big to show here.

pkg/app/pagewriter/sign_in_page_test.gonew file+166

This diff is too big to show here.

pkg/app/pagewriter/static_pages.gonew file+118

This diff is too big to show here.

pkg/app/pagewriter/static_pages_test.gonew file+153

This diff is too big to show here.

pkg/app/pagewriter/templates.gonew file+77

This diff is too big to show here.

pkg/app/pagewriter/templates_test.gonew file+202

This diff is too big to show here.

pkg/app/redirect/director.gonew file+96

This diff is too big to show here.

pkg/app/redirect/director_test.gonew file+208

This diff is too big to show here.

pkg/app/redirect/getters.gonew file+73

This diff is too big to show here.

pkg/app/redirect/pagewriter_suite_test.gonew file+39

This diff is too big to show here.

pkg/app/redirect/validator.gonew file+66

This diff is too big to show here.

pkg/app/redirect/validator_test.gonew file+160

This diff is too big to show here.

pkg/authentication/basic/basic_suite_test.gonew file+17

This diff is too big to show here.

pkg/authentication/basic/htpasswd.gonew file+174

This diff is too big to show here.

pkg/authentication/basic/htpasswd_test.gonew file+177

This diff is too big to show here.

pkg/authentication/basic/test/htpasswd-bcrypt.txtnew file+8

This diff is too big to show here.

pkg/authentication/basic/test/htpasswd-mixed.txtnew file+8

This diff is too big to show here.

pkg/authentication/basic/test/htpasswd-sha1.txtnew file+8

This diff is too big to show here.

pkg/authentication/basic/validator.gonew file+7

This diff is too big to show here.

pkg/authentication/hmacauth/LICENSE.mdnew file+5

This diff is too big to show here.

pkg/authentication/hmacauth/hmacauth.gonew file+237

This diff is too big to show here.

pkg/authentication/hmacauth/hmacauth_test.gonew file+302

This diff is too big to show here.

pkg/cookies/cookies.gonew file+101

This diff is too big to show here.

pkg/cookies/cookies_suite_test.gonew file+32

This diff is too big to show here.

pkg/cookies/cookies_test.gonew file+158

This diff is too big to show here.

pkg/cookies/csrf.gonew file+329

This diff is too big to show here.

pkg/cookies/csrf_per_request_test.gonew file+278

This diff is too big to show here.

pkg/cookies/csrf_test.gonew file+540

This diff is too big to show here.

pkg/encryption/cipher.gonew file+132

This diff is too big to show here.

pkg/encryption/cipher_test.gonew file+231

This diff is too big to show here.

pkg/encryption/nonce.gonew file+36

This diff is too big to show here.

pkg/encryption/utils.gonew file+137

This diff is too big to show here.

pkg/encryption/utils_test.gonew file+148

This diff is too big to show here.

pkg/header/header_suite_test.gonew file+37

This diff is too big to show here.

pkg/header/injector.gonew file+118

This diff is too big to show here.

pkg/header/injector_test.gonew file+416

This diff is too big to show here.

pkg/ip/net_set.gonew file+112

This diff is too big to show here.

pkg/ip/net_set_test.gonew file+117

This diff is too big to show here.

pkg/ip/parse_ip_net.gonew file+55

This diff is too big to show here.

pkg/ip/parse_ip_net_test.gonew file+118

This diff is too big to show here.

pkg/ip/realclientip.gonew file+114

This diff is too big to show here.

pkg/ip/realclientip_test.gonew file+183

This diff is too big to show here.

pkg/logger/logger.gonew file+572

This diff is too big to show here.

pkg/middleware/basic_session.gonew file+105

This diff is too big to show here.

pkg/middleware/basic_session_test.gonew file+143

This diff is too big to show here.

pkg/middleware/headers.gonew file+150

This diff is too big to show here.

pkg/middleware/headers_test.gonew file+482

This diff is too big to show here.

pkg/middleware/healthcheck.gonew file+55

This diff is too big to show here.

pkg/middleware/healthcheck_test.gonew file+167

This diff is too big to show here.

pkg/middleware/jwt_session.gonew file+134

This diff is too big to show here.

pkg/middleware/jwt_session_test.gonew file+587

This diff is too big to show here.

pkg/middleware/metrics.gonew file+122

This diff is too big to show here.

pkg/middleware/metrics_test.gonew file+66

This diff is too big to show here.

pkg/middleware/middleware_suite_test.gonew file+36

This diff is too big to show here.

pkg/middleware/readynesscheck.gonew file+40

This diff is too big to show here.

pkg/middleware/readynesscheck_test.gonew file+83

This diff is too big to show here.

pkg/middleware/redirect_to_https.gonew file+56

This diff is too big to show here.

pkg/middleware/redirect_to_https_test.gonew file+224

This diff is too big to show here.

pkg/middleware/request_logger.gonew file+110

This diff is too big to show here.

pkg/middleware/request_logger_test.gonew file+123

This diff is too big to show here.

pkg/middleware/scope.gonew file+35

This diff is too big to show here.

pkg/middleware/scope_test.gonew file+141

This diff is too big to show here.

pkg/middleware/session_utils.gonew file+33

This diff is too big to show here.

pkg/middleware/session_utils_test.gonew file+102

This diff is too big to show here.

pkg/middleware/stored_session.gonew file+298

This diff is too big to show here.

pkg/middleware/stored_session_test.gonew file+854

This diff is too big to show here.

pkg/middleware/testdata/metrics/notfoundrequest.txtnew file+3

This diff is too big to show here.

pkg/middleware/testdata/metrics/successfulrequest.txtnew file+3

This diff is too big to show here.

pkg/providers/oidc/oidc_suite_test.gonew file+16

This diff is too big to show here.

pkg/providers/oidc/provider.gonew file+107

This diff is too big to show here.

pkg/providers/oidc/provider_test.gonew file+191

This diff is too big to show here.

pkg/providers/oidc/provider_verifier.gonew file+271

This diff is too big to show here.

pkg/providers/oidc/provider_verifier_test.gonew file+325

This diff is too big to show here.

pkg/providers/oidc/verifier.gonew file+109

This diff is too big to show here.

pkg/providers/oidc/verifier_test.gonew file+249

This diff is too big to show here.

pkg/providers/util/claim_extractor.gonew file+164

This diff is too big to show here.

pkg/providers/util/claim_extractor_test.gonew file+578

This diff is too big to show here.

pkg/providers/util/util_suite_test.gonew file+17

This diff is too big to show here.

pkg/proxyhttp/http_suite_test.gonew file+88

This diff is too big to show here.

pkg/proxyhttp/server.gonew file+356

This diff is too big to show here.

pkg/proxyhttp/server_group.gonew file+35

This diff is too big to show here.

pkg/proxyhttp/server_group_test.gonew file+102

This diff is too big to show here.

pkg/proxyhttp/server_test.gonew file+1371

This diff is too big to show here.

pkg/proxyhttp/systemd_socket.gonew file+55

This diff is too big to show here.

pkg/proxyhttp/systemd_unsupported.gonew file+17

This diff is too big to show here.

pkg/requests/builder.gonew file+117

This diff is too big to show here.

pkg/requests/builder_test.gonew file+378

This diff is too big to show here.

pkg/requests/http.gonew file+31

This diff is too big to show here.

pkg/requests/requests_suite_test.gonew file+97

This diff is too big to show here.

pkg/requests/result.gonew file+98

This diff is too big to show here.

pkg/requests/result_test.gonew file+325

This diff is too big to show here.

pkg/requests/util/util.gonew file+93

This diff is too big to show here.

pkg/requests/util/util_suite_test.gonew file+20

This diff is too big to show here.

pkg/requests/util/util_test.gonew file+228

This diff is too big to show here.

pkg/sessions/cookie/session_store.gonew file+282

This diff is too big to show here.

pkg/sessions/cookie/session_store_test.gonew file+213

This diff is too big to show here.

pkg/sessions/persistence/interfaces.gonew file+19

This diff is too big to show here.

pkg/sessions/persistence/manager.gonew file+98

This diff is too big to show here.

pkg/sessions/persistence/manager_test.gonew file+25

This diff is too big to show here.

pkg/sessions/persistence/persistence_suite_test.gonew file+17

This diff is too big to show here.

pkg/sessions/persistence/ticket.gonew file+272

This diff is too big to show here.

pkg/sessions/persistence/ticket_test.gonew file+160

This diff is too big to show here.

pkg/sessions/redis/client.gonew file+82

This diff is too big to show here.

pkg/sessions/redis/client_test.gonew file+159

This diff is too big to show here.

pkg/sessions/redis/lock.gonew file+84

This diff is too big to show here.

pkg/sessions/redis/redis_store.gonew file+248

This diff is too big to show here.

pkg/sessions/redis/redis_store_test.gonew file+324

This diff is too big to show here.

pkg/sessions/redis/redis_store_tls_test.gonew file+169

This diff is too big to show here.

pkg/sessions/redis/redis_test.gonew file+68

This diff is too big to show here.

pkg/sessions/session_store.gonew file+22

This diff is too big to show here.

pkg/sessions/session_store_test.gonew file+91

This diff is too big to show here.

pkg/sessions/tests/mock_lock.gonew file+48

This diff is too big to show here.

pkg/sessions/tests/mock_store.gonew file+78

This diff is too big to show here.

pkg/sessions/tests/session_store_tests.gonew file+568

This diff is too big to show here.

pkg/upstream/file.gonew file+82

This diff is too big to show here.

pkg/upstream/file_test.gonew file+68

This diff is too big to show here.

pkg/upstream/http.gonew file+267

This diff is too big to show here.

pkg/upstream/http_test.gonew file+629

This diff is too big to show here.

pkg/upstream/proxy.gonew file+183

This diff is too big to show here.

pkg/upstream/proxy_test.gonew file+488

This diff is too big to show here.

pkg/upstream/rewrite.gonew file+81

This diff is too big to show here.

pkg/upstream/rewrite_test.gonew file+67

This diff is too big to show here.

pkg/upstream/static.gonew file+40

This diff is too big to show here.

pkg/upstream/static_test.gonew file+85

This diff is too big to show here.

pkg/upstream/upstream_suite_test.gonew file+193

This diff is too big to show here.

pkg/util/ptr/ptr.gonew file+14

This diff is too big to show here.

pkg/util/ptr/ptr_test.gonew file+38

This diff is too big to show here.

pkg/util/util.gonew file+257

This diff is too big to show here.

pkg/util/util_test.gonew file+325

This diff is too big to show here.

pkg/validation/allowlist.gonew file+93

This diff is too big to show here.

pkg/validation/allowlist_test.gonew file+154

This diff is too big to show here.

pkg/validation/common.gonew file+37

This diff is too big to show here.

pkg/validation/common_test.gonew file+127

This diff is too big to show here.

pkg/validation/cookie.gonew file+88

This diff is too big to show here.

pkg/validation/cookie_test.gonew file+335

This diff is too big to show here.

pkg/validation/header.gonew file+64

This diff is too big to show here.

pkg/validation/header_test.gonew file+163

This diff is too big to show here.

pkg/validation/logging.gonew file+62

This diff is too big to show here.

pkg/validation/options.gonew file+182

This diff is too big to show here.

pkg/validation/options_test.gonew file+238

This diff is too big to show here.

pkg/validation/providers.gonew file+176

This diff is too big to show here.

pkg/validation/providers_test.gonew file+136

This diff is too big to show here.

pkg/validation/sessions.gonew file+88

This diff is too big to show here.

pkg/validation/sessions_test.gonew file+409

This diff is too big to show here.

pkg/validation/upstreams.gonew file+114

This diff is too big to show here.

pkg/validation/upstreams_test.gonew file+229

This diff is too big to show here.

pkg/validation/utils.gonew file+11

This diff is too big to show here.

pkg/validation/validation_suite_test.gonew file+17

This diff is too big to show here.

pkg/version/version.gonew file+4

This diff is too big to show here.

pkg/watcher/watcher.gonew file+81

This diff is too big to show here.

providers/adfs.gonew file+112

This diff is too big to show here.

providers/adfs_test.gonew file+304

This diff is too big to show here.

providers/atlassian-cloud.gonew file+99

This diff is too big to show here.

providers/atlassian-cloud_test.gonew file+93

This diff is too big to show here.

providers/auth_test.gonew file+34

This diff is too big to show here.

providers/azure.gonew file+459

This diff is too big to show here.

providers/azure_test.gonew file+432

This diff is too big to show here.

providers/bitbucket.gonew file+190

This diff is too big to show here.

providers/bitbucket_test.gonew file+170

This diff is too big to show here.

providers/cidaas.gonew file+144

This diff is too big to show here.

providers/cidaas_test.gonew file+493

This diff is too big to show here.

providers/digitalocean.gonew file+90

This diff is too big to show here.

providers/digitalocean_test.gonew file+134

This diff is too big to show here.

providers/dtt_sso.gonew file+202

This diff is too big to show here.

providers/dtt_sso_test.gonew file+237

This diff is too big to show here.

providers/facebook.gonew file+95

This diff is too big to show here.

providers/facebook_test.gonew file+20

This diff is too big to show here.

providers/gitea_test.gonew file+98

This diff is too big to show here.

providers/github.gonew file+568

This diff is too big to show here.

providers/github_test.gonew file+622

This diff is too big to show here.

providers/gitlab.gonew file+300

This diff is too big to show here.

providers/gitlab_test.gonew file+390

This diff is too big to show here.

providers/google.gonew file+562

This diff is too big to show here.

providers/google_test.gonew file+407

This diff is too big to show here.

providers/internal_util.gonew file+91

This diff is too big to show here.

providers/internal_util_test.gonew file+157

This diff is too big to show here.

providers/keycloak.gonew file+121

This diff is too big to show here.

providers/keycloak_oidc.gonew file+171

This diff is too big to show here.

providers/keycloak_oidc_test.gonew file+243

This diff is too big to show here.

providers/keycloak_test.gonew file+212

This diff is too big to show here.

providers/linkedin.gonew file+107

This diff is too big to show here.

providers/linkedin_test.gonew file+134

This diff is too big to show here.

providers/logingov.gonew file+289

This diff is too big to show here.

providers/logingov_test.gonew file+341

This diff is too big to show here.

providers/ms_entra_id.gonew file+326

This diff is too big to show here.

providers/ms_entra_id_test.gonew file+186

This diff is too big to show here.

providers/nextcloud.gonew file+83

This diff is too big to show here.

providers/nextcloud_test.gonew file+67

This diff is too big to show here.

providers/oidc.gonew file+269

This diff is too big to show here.

providers/oidc_test.gonew file+306

This diff is too big to show here.

providers/provider_data.gonew file+365

This diff is too big to show here.

providers/provider_data_test.gonew file+663

This diff is too big to show here.

providers/provider_default.gonew file+155

This diff is too big to show here.

providers/provider_default_test.gonew file+161

This diff is too big to show here.

providers/providers.gonew file+206

This diff is too big to show here.

providers/providers_suite_test.gonew file+17

This diff is too big to show here.

providers/providers_test.gonew file+404

This diff is too big to show here.

providers/srht.gonew file+109

This diff is too big to show here.

providers/srht_test.gonew file+77

This diff is too big to show here.

providers/util.gonew file+76

This diff is too big to show here.

providers/util_test.gonew file+146

This diff is too big to show here.

static/css/all.min.cssnew file+9

This diff is too big to show here.

static/css/bulma.min.cssnew file+1

This diff is too big to show here.

static/webfonts/fa-solid-900.woff2new file

Binary file not shown.

testdata/openredirects.txtnew file+559

This diff is too big to show here.

validator.gonew file+133

This diff is too big to show here.

validator_test.gonew file+442

This diff is too big to show here.