[{"_1":2,"_153":-5,"_154":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_132":133},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_84":-5,"_85":86,"_125":-5,"_126":11,"_127":17,"_128":11,"_129":-5,"_130":131},"canonicalUrl","https://hub.docker.com/r/accountservices/oauth2_proxy/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","accountservices","reponame","oauth2_proxy","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_38":39,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":51,"_53":31,"_28":29,"_54":55,"_56":-5,"_57":58,"_59":58,"_60":61,"_62":-5,"_63":64,"_65":66,"_67":11,"_68":29,"_69":70,"_75":17,"_76":77,"_81":29,"_82":83},"categories",[],"content_types",[40],"image","date_registered","2015-08-25T11:39:54.305057Z","description","A oauth2_proxy","is_private","last_updated","2016-02-26T14:53:49.828559Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[52],"application/vnd.docker.distribution.manifest.v1+prettyjws","name","pull_count",27983,"repository_type","star_count",1,"status","status_description","active","source","collaborator_count",0,"full_description","oauth2_proxy\n=================\n\n(This project was renamed from Google Auth Proxy - May 2015)\n\nA reverse proxy that provides authentication using Providers (Google, Github, and others)\nto validate accounts by email, domain or group.\n\n[![Build Status](https://secure.travis-ci.org/bitly/oauth2_proxy.png?branch=master)](http://travis-ci.org/bitly/oauth2_proxy)\n\n\n![Sign In Page](https://cloud.githubusercontent.com/assets/45028/4970624/7feb7dd8-6886-11e4-93e0-c9904af44ea8.png)\n\n## Architecture\n\n![OAuth2 Proxy Architecture](https://cloud.githubusercontent.com/assets/45028/8027702/bd040b7a-0d6a-11e5-85b9-f8d953d04f39.png)\n\n## Installation\n\n1. Download [Prebuilt Binary](https://github.com/bitly/oauth2_proxy/releases) (current release is `v2.0.1`) or build with `$ go get github.com/bitly/oauth2_proxy` which will put the binary in `$GOROOT/bin`\n2. Select a Provider and Register an OAuth Application with a Provider\n3. Configure OAuth2 Proxy using config file, command line options, or environment variables\n4. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)\n\n## OAuth Provider Configuration\n\nYou will need to register an OAuth application with a Provider (Google, Github or another provider), and configure it with Redirect URI(s) for the domain you intend to run `oauth2_proxy` on.\n\nValid providers are :\n\n* [Google](#google-auth-provider) *default*\n* [GitHub](#github-auth-provider)\n* [LinkedIn](#linkedin-auth-provider)\n* [MyUSA](#myusa-auth-provider)\n\nThe provider can be selected using the `provider` configuration value.\n\n### Google Auth Provider\n\nFor Google, the registration steps are:\n\n1. Create a new project: https://console.developers.google.com/project\n2. Under \"APIs & Auth\", choose \"Credentials\"\n3. Now, choose \"Create new Client ID\"\n * The Application Type should be **Web application** and click **Configure Consent Screen**\n * Fill out the appropriate details on the Consent Screen page and hit **Save**\n * On the next screen, leaving **Web Application** checked, enter your domain in the Authorized Javascript Origins `https://internal.yourcompany.com`\n * Enter the correct Authorized Redirect URL `https://internal.yourcompany.com/oauth2/callback`\n * NOTE: `oauth2_proxy` will _only_ callback on the path `/oauth2/callback`\n4. Take note of the **Client ID** and **Client Secret**\n\nIt's recommended to refresh sessions on a short interval (1h) with `cookie-refresh` setting which validates that the account is still authorized.\n\n### GitHub Auth Provider\n\n1. Create a new project: https://github.com/settings/developers\n2. Under `Authorization callback URL` enter the correct url ie `https://internal.yourcompany.com/oauth2/callback`\n\nThe GitHub auth provider supports two additional parameters to restrict authentication to Organization or Team level access. Restricting by org and team is normally accompanied with `--email-domain=*`\n\n -github-org=\"\": restrict logins to members of this organisation\n -github-team=\"\": restrict logins to members of this team\n\n\n### LinkedIn Auth Provider\n\nFor LinkedIn, the registration steps are:\n\n1. Create a new project: https://www.linkedin.com/secure/developer\n2. In the OAuth User Agreement section:\n * In default scope, select r_basicprofile and r_emailaddress.\n * In \"OAuth 2.0 Redirect URLs\", enter `https://internal.yourcompany.com/oauth2/callback`\n3. Fill in the remaining required fields and Save.\n4. Take note of the **Consumer Key / API Key** and **Consumer Secret / Secret Key**\n\n### MyUSA Auth Provider\n\nThe [MyUSA](https://alpha.my.usa.gov) authentication service ([GitHub](https://github.com/18F/myusa))\n\n## Email Authentication\n\nTo authorize by email domain use `--email-domain=yourcompany.com`. To authorize individual email addresses use `--authenticated-emails-file=/path/to/file` with one email per line. To authorize all email addresse use `--email-domain=*`.\n\n## Configuration\n\n`oauth2_proxy` can be configured via [config file](#config-file), [command line options](#command-line-options) or [environment variables](#environment-variables).\n\n### Config File\n\nAn example [oauth2_proxy.cfg](contrib/oauth2_proxy.cfg.example) config file is in the contrib directory. It can be used by specifying `-config=/etc/oauth2_proxy.cfg`\n\n### Command Line Options\n\n```\nUsage of oauth2_proxy:\n -authenticated-emails-file=\"\": authenticate against emails via file (one per line)\n -client-id=\"\": the OAuth Client ID: ie: \"123456.apps.googleusercontent.com\"\n -client-secret=\"\": the OAuth Client Secret\n -config=\"\": path to config file\n -cookie-domain=\"\": an optional cookie domain to force cookies to (ie: .yourcompany.com)*\n -cookie-expire=168h0m0s: expire timeframe for cookie\n -cookie-httponly=true: set HttpOnly cookie flag\n -cookie-key=\"_oauth2_proxy\": the name of the cookie that the oauth_proxy creates\n -cookie-refresh=0: refresh the cookie after this duration; 0 to disable\n -cookie-secret=\"\": the seed string for secure cookies\n -cookie-secure=true: set secure (HTTPS) cookie flag\n -custom-templates-dir=\"\": path to custom html templates\n -display-htpasswd-form=true: display username / password login form if an htpasswd file is provided\n -email-domain=: authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email\n -github-org=\"\": restrict logins to members of this organisation\n -github-team=\"\": restrict logins to members of this team\n -htpasswd-file=\"\": additionally authenticate against a htpasswd file. Entries must be created with \"htpasswd -s\" for SHA encryption\n -http-address=\"127.0.0.1:4180\": [http://]: or unix:// to listen on for HTTP clients\n -https-address=\":443\": : to listen on for HTTPS clients\n -login-url=\"\": Authentication endpoint\n -pass-access-token=false: pass OAuth access_token to upstream via X-Forwarded-Access-Token header\n -pass-basic-auth=true: pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream\n -basic-auth-password=\"\": the password to set when passing the HTTP Basic Auth header\n -pass-host-header=true: pass the request Host Header to upstream\n -profile-url=\"\": Profile access endpoint\n -provider=\"google\": OAuth provider\n -proxy-prefix=\"/oauth2\": the url root path that this proxy should be nested under (e.g. //sign_in)\n -redeem-url=\"\": Token redemption endpoint\n -redirect-url=\"\": the OAuth Redirect URL. ie: \"https://internalapp.yourcompany.com/oauth2/callback\"\n -request-logging=true: Log requests to stdout\n -scope=\"\": Oauth scope specification\n -skip-auth-regex=: bypass authentication for requests path's that match (may be given multiple times)\n -tls-cert=\"\": path to certificate file\n -tls-key=\"\": path to private key file\n -upstream=: the http url(s) of the upstream endpoint. If multiple, routing is based on path\n -validate-url=\"\": Access token validation endpoint\n -version=false: print version string\n```\n\nSee below for provider specific options\n\n### Environment variables\n\nThe environment variables `OAUTH2_PROXY_CLIENT_ID`, `OAUTH2_PROXY_CLIENT_SECRET`, `OAUTH2_PROXY_COOKIE_SECRET`, `OAUTH2_PROXY_COOKIE_DOMAIN` and `OAUTH2_PROXY_COOKIE_EXPIRE` can be used in place of the corresponding command-line arguments.\n\n## SSL Configuration\n\nThere are two recommended configurations. \n\n1) Configure SSL Terminiation with OAuth2 Proxy by providing a `--tls-cert=/path/to/cert.pem` and `--tls-key=/path/to/cert.key`.\n\nThe command line to run `oauth2_proxy` in this configuration would look like this:\n\n```bash\n./oauth2_proxy \\\n --email-domain=\"yourcompany.com\" \\\n --upstream=http://127.0.0.1:8080/ \\\n --tls-cert=/path/to/cert.pem \\\n --tls-key=/path/to/cert.key \\\n --cookie-secret=... \\\n --cookie-secure=true \\\n --provider=... \\\n --client-id=... \\\n --client-secret=...\n```\n\n\n2) Configure SSL Termination with [Nginx](http://nginx.org/) (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ....\n\nBecause `oauth2_proxy` listens on `127.0.0.1:4180` by default, to listen on all interfaces (needed when using an\nexternal load balancer like Amazon ELB or Google Platform Load Balancing) use `--http-address=\"0.0.0.0:4180\"` or\n`--http-address=\"http://:4180\"`.\n\nNginx will listen on port `443` and handle SSL connections while proxying to `oauth2_proxy` on port `4180`.\n`oauth2_proxy` will then authenticate requests for an upstream application. The external endpoint for this example\nwould be `https://internal.yourcompany.com/`.\n\nAn example Nginx config follows. Note the use of `Strict-Transport-Security` header to pin requests to SSL \nvia [HSTS](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security):\n\n```\nserver {\n listen 443 default ssl;\n server_name internal.yourcompany.com;\n ssl_certificate /path/to/cert.pem;\n ssl_certificate_key /path/to/cert.key;\n add_header Strict-Transport-Security max-age=2592000;\n\n location / {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n proxy_connect_timeout 1;\n proxy_send_timeout 30;\n proxy_read_timeout 30;\n }\n}\n```\n\nThe command line to run `oauth2_proxy` in this configuration would look like this:\n\n```bash\n./oauth2_proxy \\\n --email-domain=\"yourcompany.com\" \\\n --upstream=http://127.0.0.1:8080/ \\\n --cookie-secret=... \\\n --cookie-secure=true \\\n --provider=... \\\n --client-id=... \\\n --client-secret=...\n```\n\n\n## Endpoint Documentation\n\nOAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The `/oauth2` prefix can be changed with the `--proxy-prefix` config variable.\n\n* /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see [robotstxt.org](http://www.robotstxt.org/) for more info\n* /ping - returns an 200 OK response\n* /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)\n* /oauth2/start - a URL that will redirect to start the OAuth cycle\n* /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.\n\n## Logging Format\n\nOAuth2 Proxy logs requests to stdout in a format similar to Apache Combined Log.\n\n```\n - [19/Mar/2015:17:20:19 -0400] GET \"/path/\" HTTP/1.1 \"\" \n```\n\n\n## Adding a new Provider\n\nFollow the examples in the [`providers` package](providers/) to define a new\n`Provider` instance. Add a new `case` to\n[`providers.New()`](providers/providers.go) to allow `oauth2_proxy` to use the\nnew `Provider`.\n\n","has_starred","hub_user","immutable_tags_settings",{"_71":11,"_72":73},"enabled","rules",[74],".*","is_automated","permissions",{"_78":17,"_79":11,"_80":11},"read","write","admin","user","storage_size",532976788,"orgData","recentTags",[87],{"_88":40,"_89":90,"_91":92,"_93":94,"_95":96,"_97":98,"_46":114,"_115":90,"_116":29,"_117":52,"_53":118,"_119":120,"_121":105,"_122":114,"_123":61,"_124":17},"content_type","creator",313952,"digest","sha256:157152b24cc628c26e4f336158f48e4c3c15307e34cf650f6bee6021e6f93819","full_size",226444468,"id",791992,"images",[99],{"_100":101,"_91":92,"_102":103,"_104":105,"_106":107,"_108":103,"_109":103,"_110":-5,"_111":112,"_59":61,"_113":-5},"architecture","amd64","features","","last_pulled","2026-09-15T15:30:55.940145308Z","last_pushed","2016-02-26T14:53:49Z","os","os_features","os_version","size",226444916,"variant","2016-02-26T14:53:49.196813Z","last_updater","last_updater_username","media_type","latest","repository",299158,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":134,"_141":142,"_130":151,"_152":11},{"_36":135,"_38":136,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":137,"_53":31,"_28":29,"_54":55,"_56":-5,"_57":58,"_59":58,"_60":61,"_62":-5,"_63":64,"_65":66,"_67":11,"_68":29,"_69":138,"_75":17,"_76":140,"_81":29,"_82":83},[],[40],[52],{"_71":11,"_72":139},[74],{"_78":17,"_79":11,"_80":11},"tags",{"_143":58,"_144":-5,"_145":-5,"_146":147},"count","next","previous","results",[148],{"_88":40,"_89":90,"_91":92,"_93":94,"_95":96,"_97":149,"_46":114,"_115":90,"_116":29,"_117":52,"_53":118,"_119":120,"_121":105,"_122":114,"_123":61,"_124":17},[150],{"_100":101,"_91":92,"_102":103,"_104":105,"_106":107,"_108":103,"_109":103,"_110":-5,"_111":112,"_59":61,"_113":-5},[],"canDeleteTags","actionData","errors"]

accountservices/oauth2_proxy

Tags for accountservices/oauth2_proxy