mirror of
https://github.com/oauth2-proxy/oauth2-proxy.git
synced 2026-10-17 20:17:03 +02:00
Update documentation based on ef95957990
This commit is contained in:
github-actions[bot]
File diff suppressed because one or more lines are too long
@@ -4,7 +4,7 @@
|
||||
<meta charset="UTF-8">
|
||||
<meta name="generator" content="Docusaurus v2.4.1">
|
||||
<title data-rh="true">OAuth Provider Configuration | OAuth2 Proxy</title><meta data-rh="true" name="viewport" content="width=device-width,initial-scale=1"><meta data-rh="true" name="twitter:card" content="summary_large_image"><meta data-rh="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider"><meta data-rh="true" name="docusaurus_locale" content="en"><meta data-rh="true" name="docsearch:language" content="en"><meta data-rh="true" name="docusaurus_version" content="7.5.x"><meta data-rh="true" name="docusaurus_tag" content="docs-default-7.5.x"><meta data-rh="true" name="docsearch:version" content="7.5.x"><meta data-rh="true" name="docsearch:docusaurus_tag" content="docs-default-7.5.x"><meta data-rh="true" property="og:title" content="OAuth Provider Configuration | OAuth2 Proxy"><meta data-rh="true" name="description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><meta data-rh="true" property="og:description" content="You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on."><link data-rh="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-rh="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider"><link data-rh="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider" hreflang="en"><link data-rh="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.5c990d8a.css">
|
||||
<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.53cfe8ac.js" as="script">
|
||||
<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.3f651c82.js" as="script">
|
||||
<link rel="preload" href="/oauth2-proxy/assets/js/main.30b04635.js" as="script">
|
||||
</head>
|
||||
<body class="navigation-with-keyboard">
|
||||
@@ -72,7 +72,7 @@ to setup the client id and client secret. Your "Redirection URI" will
|
||||
<code>Provider</code> instance. Add a new <code>case</code> to
|
||||
<a href="https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go" target="_blank" rel="noopener noreferrer"><code>providers.New()</code></a> to allow <code>oauth2-proxy</code> to use the
|
||||
new <code>Provider</code>.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.5.x/configuration/auth.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_Z9Sw" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_vwxv"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages"><a class="pagination-nav__link pagination-nav__link--prev" href="/oauth2-proxy/docs/configuration/overview"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Overview</div></a><a class="pagination-nav__link pagination-nav__link--next" href="/oauth2-proxy/docs/configuration/session_storage"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Session Storage</div></a></nav></div></div><div class="col col--3"><div class="tableOfContents_bqdL thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#google-auth-provider" class="table-of-contents__link toc-highlight">Google Auth Provider</a></li><li><a href="#azure-auth-provider" class="table-of-contents__link toc-highlight">Azure Auth Provider</a></li><li><a href="#adfs-auth-provider" class="table-of-contents__link toc-highlight">ADFS Auth Provider</a></li><li><a href="#facebook-auth-provider" class="table-of-contents__link toc-highlight">Facebook Auth Provider</a></li><li><a href="#github-auth-provider" class="table-of-contents__link toc-highlight">GitHub Auth Provider</a></li><li><a href="#keycloak-auth-provider" class="table-of-contents__link toc-highlight">Keycloak Auth Provider</a></li><li><a href="#keycloak-oidc-auth-provider" class="table-of-contents__link toc-highlight">Keycloak OIDC Auth Provider</a></li><li><a href="#gitlab-auth-provider" class="table-of-contents__link toc-highlight">GitLab Auth Provider</a></li><li><a href="#linkedin-auth-provider" class="table-of-contents__link toc-highlight">LinkedIn Auth Provider</a></li><li><a href="#microsoft-azure-ad-provider" class="table-of-contents__link toc-highlight">Microsoft Azure AD Provider</a></li><li><a href="#openid-connect-provider" class="table-of-contents__link toc-highlight">OpenID Connect Provider</a></li><li><a href="#logingov-provider" class="table-of-contents__link toc-highlight">login.gov Provider</a></li><li><a href="#nextcloud-provider" class="table-of-contents__link toc-highlight">Nextcloud Provider</a></li><li><a href="#digitalocean-auth-provider" class="table-of-contents__link toc-highlight">DigitalOcean Auth Provider</a></li><li><a href="#bitbucket-auth-provider" class="table-of-contents__link toc-highlight">Bitbucket Auth Provider</a></li><li><a href="#gitea-auth-provider" class="table-of-contents__link toc-highlight">Gitea Auth Provider</a></li><li><a href="#email-authentication" class="table-of-contents__link toc-highlight">Email Authentication</a></li><li><a href="#adding-a-new-provider" class="table-of-contents__link toc-highlight">Adding a new Provider</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2023 OAuth2 Proxy.</div></div></div></footer></div>
|
||||
<script src="/oauth2-proxy/assets/js/runtime~main.53cfe8ac.js"></script>
|
||||
<script src="/oauth2-proxy/assets/js/runtime~main.3f651c82.js"></script>
|
||||
<script src="/oauth2-proxy/assets/js/main.30b04635.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
File diff suppressed because one or more lines are too long
@@ -4,7 +4,7 @@
|
||||
<meta charset="UTF-8">
|
||||
<meta name="generator" content="Docusaurus v2.4.1">
|
||||
<title data-rh="true">Session Storage | OAuth2 Proxy</title><meta data-rh="true" name="viewport" content="width=device-width,initial-scale=1"><meta data-rh="true" name="twitter:card" content="summary_large_image"><meta data-rh="true" property="og:url" content="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/session_storage"><meta data-rh="true" name="docusaurus_locale" content="en"><meta data-rh="true" name="docsearch:language" content="en"><meta data-rh="true" name="docusaurus_version" content="7.5.x"><meta data-rh="true" name="docusaurus_tag" content="docs-default-7.5.x"><meta data-rh="true" name="docsearch:version" content="7.5.x"><meta data-rh="true" name="docsearch:docusaurus_tag" content="docs-default-7.5.x"><meta data-rh="true" property="og:title" content="Session Storage | OAuth2 Proxy"><meta data-rh="true" name="description" content="Sessions allow a user's authentication to be tracked between multiple HTTP"><meta data-rh="true" property="og:description" content="Sessions allow a user's authentication to be tracked between multiple HTTP"><link data-rh="true" rel="icon" href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><link data-rh="true" rel="canonical" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/session_storage"><link data-rh="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/session_storage" hreflang="en"><link data-rh="true" rel="alternate" href="https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/session_storage" hreflang="x-default"><link rel="stylesheet" href="/oauth2-proxy/assets/css/styles.5c990d8a.css">
|
||||
<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.53cfe8ac.js" as="script">
|
||||
<link rel="preload" href="/oauth2-proxy/assets/js/runtime~main.3f651c82.js" as="script">
|
||||
<link rel="preload" href="/oauth2-proxy/assets/js/main.30b04635.js" as="script">
|
||||
</head>
|
||||
<body class="navigation-with-keyboard">
|
||||
@@ -20,14 +20,23 @@ back the client for storage, as in the <a href="#cookie-storage">Cookie storage<
|
||||
to the user as the cookie value instead.</p><p>A ticket is composed as the following:</p><p><code>{CookieName}-{ticketID}.{secret}</code></p><p>Where:</p><ul><li>The <code>CookieName</code> is the OAuth2 cookie name (_oauth2_proxy by default)</li><li>The <code>ticketID</code> is a 128 bit random number, hex-encoded</li><li>The <code>secret</code> is a 128 bit random number, base64url encoded (no padding). The secret is unique for every session.</li><li>The pair of <code>{CookieName}-{ticketID}</code> comprises a ticket handle, and thus, the redis key
|
||||
to which the session is stored. The encoded session is encrypted with the secret and stored
|
||||
in redis via the <code>SETEX</code> command.</li></ul><p>Encrypting every session uniquely protects the refresh/access/id tokens stored in the session from
|
||||
disclosure.</p><h4 class="anchor anchorWithStickyNavbar_LWe7" id="usage">Usage<a href="#usage" class="hash-link" aria-label="Direct link to Usage" title="Direct link to Usage"></a></h4><p>When using the redis store, specify <code>--session-store-type=redis</code> as well as the Redis connection URL, via
|
||||
disclosure.</p><p>Additionally the browser only has to send a short Cookie with every request and not the whole JWT, which can get quite big.</p><p>Two settings are used to configure the OAuth2 Proxy cookie lifetime:</p><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">--cookie-refresh duration refresh the cookie after this duration; 0 to disable</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">--cookie-expire duration expire timeframe for cookie 168h0m0s</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>The "cookie-expire" value should be equal to the lifetime of the Refresh-Token that is issued by the OAuth2 authorization server.
|
||||
If it expires earlier and is deleted by the browser, OAuth2 Proxy cannot find the stored Refresh-Tokens in Redis and thus cannot start
|
||||
the refresh flow to get new Access-Tokens. If it is longer, it might be that the old Refresh-Token will be found in Redis but has already
|
||||
expired.</p><p>The "cookie-refresh" value controls when OAuth2 Proxy tries to refresh an Access-Token. If it is set to "0", the
|
||||
Access-Token will never be refreshed, even it is already expired and there would be a valid Refresh-Token in the
|
||||
available. If set, OAuth2 Proxy will refresh the Access-Token after this many seconds even if it is still valid.
|
||||
Of course, it will also be refreshed after it has expired, as long as a Refresh Token is available.</p><p>Caveat: It can happen that the Access-Token is valid for e.g. "1m" and a request happens after exactly "59s".
|
||||
It would pass OAuth2 Proxy and be forwarded to the backend but is just expired when the backend tries to validate
|
||||
it. This is especially relevant if the backend uses the JWT to make requests to other backends.
|
||||
For this reason, it's advised to set the cookie-refresh a couple of seconds less than the Access-Token lifespan.</p><p>Recommended settings:</p><ul><li>cookie<!-- -->_<!-- -->refresh := Access-Token lifespan - 1m</li><li>cookie<!-- -->_<!-- -->expire := Refresh-Token lifespan (i.e. Keycloak's client<!-- -->_<!-- -->session<!-- -->_<!-- -->idle)</li></ul><h4 class="anchor anchorWithStickyNavbar_LWe7" id="usage">Usage<a href="#usage" class="hash-link" aria-label="Direct link to Usage" title="Direct link to Usage"></a></h4><p>When using the redis store, specify <code>--session-store-type=redis</code> as well as the Redis connection URL, via
|
||||
<code>--redis-connection-url=redis://host[:port][/db-number]</code>.</p><p>You may also configure the store for Redis Sentinel. In this case, you will want to use the
|
||||
<code>--redis-use-sentinel=true</code> flag, as well as configure the flags <code>--redis-sentinel-master-name</code>
|
||||
and <code>--redis-sentinel-connection-urls</code> appropriately.</p><p>Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the
|
||||
<code>--redis-use-cluster=true</code> flag, and configure the flags <code>--redis-cluster-connection-urls</code> appropriately.</p><p>Note that flags <code>--redis-use-sentinel=true</code> and <code>--redis-use-cluster=true</code> are mutually exclusive.</p><p>Note, if Redis timeout option is set to non-zero, the <code>--redis-connection-idle-timeout</code>
|
||||
must be less than <a href="https://redis.io/docs/reference/clients/#client-timeouts" target="_blank" rel="noopener noreferrer">Redis timeout option</a>. For example: if either redis.conf includes
|
||||
<code>timeout 15</code> or using <code>CONFIG SET timeout 15</code> the <code>--redis-connection-idle-timeout</code> must be at least <code>--redis-connection-idle-timeout=14</code></p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.5.x/configuration/sessions.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_Z9Sw" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_vwxv"></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages"><a class="pagination-nav__link pagination-nav__link--prev" href="/oauth2-proxy/docs/configuration/oauth_provider"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">OAuth Provider Configuration</div></a><a class="pagination-nav__link pagination-nav__link--next" href="/oauth2-proxy/docs/configuration/tls"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">TLS Configuration</div></a></nav></div></div><div class="col col--3"><div class="tableOfContents_bqdL thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#cookie-storage" class="table-of-contents__link toc-highlight">Cookie Storage</a></li><li><a href="#redis-storage" class="table-of-contents__link toc-highlight">Redis Storage</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2023 OAuth2 Proxy.</div></div></div></footer></div>
|
||||
<script src="/oauth2-proxy/assets/js/runtime~main.53cfe8ac.js"></script>
|
||||
<script src="/oauth2-proxy/assets/js/runtime~main.3f651c82.js"></script>
|
||||
<script src="/oauth2-proxy/assets/js/main.30b04635.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
File diff suppressed because one or more lines are too long
Reference in New Issue
Block a user