finodigital/nexus-proxy repository overview

⁠nexus-proxy

This project is a fork of the original nexus-proxy (by travelaudience)⁠ which allowed optional authentication against the Google Cloud IAM. It is not hard-wired to Google Cloud IAM anymore. You can use it with any IDP which supports the OAuth2 Code Authorization Flow. Furthermore the docker proxy was removed since we only needed authentication for npm and gradle/maven.

A proxy for Nexus Repository Manager that allows for optional authentication against an external identity provider (which implements OAuth2/OpenID).

⁠Pre-requisites

For building the project:

• JDK 8.

For basic proxying:

• A domain name configured with an A and a CNAME records pointing to the proxy.
  • For local testing one may create two entries on /etc/hosts pointing to 127.0.0.1.
• A running and properly configured instance of Nexus.
  • One may use the default 8081 port for the HTTP connector.

For opt-in authentication against an IDP:

• All of the above.
• A properly configured IDP, e.g. Keycloak
• A set of credentials (CLIENT_ID & CLIENT_SECRET)
• OAuth2 Endpoint URLs (AUTHORIZE_ENDPOINT, TOKEN_ENDPOINT, JWK_URL)
• Proper configuration of the resulting client's REDIRECT_URL.

⁠Running the proxy

⁠Running the proxy with OpenID Authentication

The following command will run the proxy on port 8080 with authentication against an OpenID IDP enabled and pointing to a local Nexus instance:

$ BIND_PORT="8080" \
  CLOUD_IAM_AUTH_ENABLED="true" \
  CLIENT_ID="my-client-id" \
  CLIENT_SECRET="my-client-secret" \
  NEXUS_HTTP_HOST="nexus.example.com" \
  REDIRECT_URL="https://nexus.example.com/oauth/callback" \
  SESSION_TTL="1440000" \
  UPSTREAM_HTTP_PORT="8081" \
  UPSTREAM_HOST="localhost" \
  TOKEN_ENDPOINT="https://<sso-base-url>/openid-connect/token" \
  JWK_URL="https://<sso-base-url>/openid-connect/certs" \
  TOKEN_ENDPOINT="https://<sso-base-url>/openid-connect/auth" \
  java -jar ./build/libs/nexus-proxy-2.3.0.jar

⁠Environment Variables