Support Traefik ForwardAuth without a 401 handler (#1023)
* GH-1015 Adds support for Traefik to OauthStart on '/oauth2/auth' endpoint * Fix incorrect reference to signout path and point to signin path - remove commented out alternative solutions and debug log statements * Remove skip provider button check as SignIn method already does this * Updated traefik example to match existing file configuration reference, updated tests * Update doc and refactor nested conditional statements * Revert code changes as static upstream provides the same functionality - Add doc on using static upstream with Traefik ForwardAuth middleware * update changelog * Move the doc changes to 7.0.x versioned docs * Re-add traefik docs update in the main docs overview.md * add missing oauth2-proxy routing Co-authored-by: Praveen Chinthala <PraveenChinthala@hollandandbarrett.com>
This commit is contained in:
Praveen Chinthala
GitHub
parent
845235185d
commit
76269a13b7
|
|
@ -13,6 +13,7 @@
|
|||
- [#1028](https://github.com/oauth2-proxy/oauth2-proxy/pull/1028) Refactor templates, update theme and provide styled error pages (@JoelSpeed)
|
||||
- [#1039](https://github.com/oauth2-proxy/oauth2-proxy/pull/1039) Ensure errors in tests are logged to the GinkgoWriter (@JoelSpeed)
|
||||
- [#980](https://github.com/oauth2-proxy/oauth2-proxy/pull/980) Add Prometheus metrics endpoint
|
||||
- [#1023](https://github.com/oauth2-proxy/oauth2-proxy/pull/1023) Update docs on Traefik ForwardAuth support without the use of Traefik 'errors' middleware
|
||||
|
||||
# V7.0.1
|
||||
|
||||
|
|
|
|||
|
|
@ -362,6 +362,8 @@ You have to substitute *name* with the actual cookie name you configured via --c
|
|||
|
||||
**This option requires `--reverse-proxy` option to be set.**
|
||||
|
||||
### ForwardAuth with 401 errors middleware
|
||||
|
||||
The [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/forwardauth/) allows Traefik to authenticate requests via the oauth2-proxy's `/oauth2/auth` endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:
|
||||
|
||||
```yaml
|
||||
|
|
@ -425,6 +427,104 @@ http:
|
|||
query: "/oauth2/sign_in"
|
||||
```
|
||||
|
||||
### ForwardAuth with static upstreams configuration
|
||||
|
||||
Redirect to sign_in functionality provided without the use of `errors` middleware with [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/forwardauth/) pointing to oauth2-proxy service's `/` endpoint
|
||||
|
||||
**Following options need to be set on `oauth2-proxy`:**
|
||||
- `--upstream=static://202`: Configures a static response for authenticated sessions
|
||||
- `--reverseproxy=true`: Enables the use of `X-Forwarded-*` headers to determine redirects correctly
|
||||
|
||||
```yaml
|
||||
http:
|
||||
routers:
|
||||
a-service-route-1:
|
||||
rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"
|
||||
service: a-service-backend
|
||||
middlewares:
|
||||
- oauth-auth-redirect # redirects all unauthenticated to oauth2 signin
|
||||
tls:
|
||||
certResolver: default
|
||||
domains:
|
||||
- main: "example.com"
|
||||
sans:
|
||||
- "*.example.com"
|
||||
a-service-route-2:
|
||||
rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"
|
||||
service: a-service-backend
|
||||
middlewares:
|
||||
- oauth-auth-wo-redirect # unauthenticated session will return a 401
|
||||
tls:
|
||||
certResolver: default
|
||||
domains:
|
||||
- main: "example.com"
|
||||
sans:
|
||||
- "*.example.com"
|
||||
services-oauth2-route:
|
||||
rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"
|
||||
middlewares:
|
||||
- auth-headers
|
||||
service: oauth-backend
|
||||
tls:
|
||||
certResolver: default
|
||||
domains:
|
||||
- main: "example.com"
|
||||
sans:
|
||||
- "*.example.com"
|
||||
oauth2-proxy-route:
|
||||
rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"
|
||||
middlewares:
|
||||
- auth-headers
|
||||
service: oauth-backend
|
||||
tls:
|
||||
certResolver: default
|
||||
domains:
|
||||
- main: "example.com"
|
||||
sans:
|
||||
- "*.example.com"
|
||||
|
||||
services:
|
||||
a-service-backend:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: http://172.16.0.2:7555
|
||||
b-service-backend:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: http://172.16.0.3:7555
|
||||
oauth-backend:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: http://172.16.0.1:4180
|
||||
|
||||
middlewares:
|
||||
auth-headers:
|
||||
headers:
|
||||
sslRedirect: true
|
||||
stsSeconds: 315360000
|
||||
browserXssFilter: true
|
||||
contentTypeNosniff: true
|
||||
forceSTSHeader: true
|
||||
sslHost: example.com
|
||||
stsIncludeSubdomains: true
|
||||
stsPreload: true
|
||||
frameDeny: true
|
||||
oauth-auth-redirect:
|
||||
forwardAuth:
|
||||
address: https://oauth.example.com/
|
||||
trustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- X-Auth-Request-Access-Token
|
||||
- Authorization
|
||||
oauth-auth-wo-redirect:
|
||||
forwardAuth:
|
||||
address: https://oauth.example.com/oauth2/auth
|
||||
trustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- X-Auth-Request-Access-Token
|
||||
- Authorization
|
||||
```
|
||||
|
||||
:::note
|
||||
If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.
|
||||
:::
|
||||
|
|
|
|||
|
|
@ -360,6 +360,8 @@ You have to substitute *name* with the actual cookie name you configured via --c
|
|||
|
||||
**This option requires `--reverse-proxy` option to be set.**
|
||||
|
||||
### ForwardAuth with 401 errors middleware
|
||||
|
||||
The [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/forwardauth/) allows Traefik to authenticate requests via the oauth2-proxy's `/oauth2/auth` endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:
|
||||
|
||||
```yaml
|
||||
|
|
@ -423,6 +425,104 @@ http:
|
|||
query: "/oauth2/sign_in"
|
||||
```
|
||||
|
||||
### ForwardAuth with static upstreams configuration
|
||||
|
||||
Redirect to sign_in functionality provided without the use of `errors` middleware with [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/forwardauth/) pointing to oauth2-proxy service's `/` endpoint
|
||||
|
||||
**Following options need to be set on `oauth2-proxy`:**
|
||||
- `--upstream=static://202`: Configures a static response for authenticated sessions
|
||||
- `--reverseproxy=true`: Enables the use of `X-Forwarded-*` headers to determine redirects correctly
|
||||
|
||||
```yaml
|
||||
http:
|
||||
routers:
|
||||
a-service-route-1:
|
||||
rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"
|
||||
service: a-service-backend
|
||||
middlewares:
|
||||
- oauth-auth-redirect # redirects all unauthenticated to oauth2 signin
|
||||
tls:
|
||||
certResolver: default
|
||||
domains:
|
||||
- main: "example.com"
|
||||
sans:
|
||||
- "*.example.com"
|
||||
a-service-route-2:
|
||||
rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"
|
||||
service: a-service-backend
|
||||
middlewares:
|
||||
- oauth-auth-wo-redirect # unauthenticated session will return a 401
|
||||
tls:
|
||||
certResolver: default
|
||||
domains:
|
||||
- main: "example.com"
|
||||
sans:
|
||||
- "*.example.com"
|
||||
services-oauth2-route:
|
||||
rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"
|
||||
middlewares:
|
||||
- auth-headers
|
||||
service: oauth-backend
|
||||
tls:
|
||||
certResolver: default
|
||||
domains:
|
||||
- main: "example.com"
|
||||
sans:
|
||||
- "*.example.com"
|
||||
oauth2-proxy-route:
|
||||
rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"
|
||||
middlewares:
|
||||
- auth-headers
|
||||
service: oauth-backend
|
||||
tls:
|
||||
certResolver: default
|
||||
domains:
|
||||
- main: "example.com"
|
||||
sans:
|
||||
- "*.example.com"
|
||||
|
||||
services:
|
||||
a-service-backend:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: http://172.16.0.2:7555
|
||||
b-service-backend:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: http://172.16.0.3:7555
|
||||
oauth-backend:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: http://172.16.0.1:4180
|
||||
|
||||
middlewares:
|
||||
auth-headers:
|
||||
headers:
|
||||
sslRedirect: true
|
||||
stsSeconds: 315360000
|
||||
browserXssFilter: true
|
||||
contentTypeNosniff: true
|
||||
forceSTSHeader: true
|
||||
sslHost: example.com
|
||||
stsIncludeSubdomains: true
|
||||
stsPreload: true
|
||||
frameDeny: true
|
||||
oauth-auth-redirect:
|
||||
forwardAuth:
|
||||
address: https://oauth.example.com/
|
||||
trustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- X-Auth-Request-Access-Token
|
||||
- Authorization
|
||||
oauth-auth-wo-redirect:
|
||||
forwardAuth:
|
||||
address: https://oauth.example.com/oauth2/auth
|
||||
trustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- X-Auth-Request-Access-Token
|
||||
- Authorization
|
||||
```
|
||||
|
||||
:::note
|
||||
If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.
|
||||
:::
|
||||
|
|
|
|||
Loading…
Reference in New Issue