[{"_1":2,"_161":-5,"_162":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_140":141},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_88":-5,"_89":90,"_129":-5,"_130":11,"_131":21,"_132":11,"_133":-5,"_134":11,"_135":-5,"_136":137,"_138":91,"_139":-7},"canonicalUrl","https://hub.docker.com/r/jensendw/saml-proxy/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","jensendw","reponame","saml-proxy","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":74,"_79":11,"_80":81,"_85":33,"_86":87},"categories",[],"content_types",[44],"image","date_registered","2019-02-27T22:31:33.117583Z","description","A saml-proxy to provide SAML authentication","is_private","last_updated","2019-03-02T02:03:29.913581Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[56],"application/vnd.docker.container.image.v1+json","name","pull_count",456,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# SAML Proxy\n\n## Overview\n\nThis repo and Docker image provides a proxy server, configured with SAML authentication.\n\nTo start, run like this:\n```\ndocker run -ti -p 80:80 -h auth.example.com -v -e BACKEND=https://api.example.com:8443 -e SCHEMA=http barnabassudy/saml-proxy\n```\n\nPorts:\n* 80 for http proxying\n\nEnvironment variables:\n* `BACKEND` - to requests are proxied to (_mandatory_)\n* `PROXY_HOST` - the hostname the proxy is available - falls back to the host name of the container.\n* `SCHEMA` - the schema via the proxy is available (defaults to `https`) - _Note:_ This is not the protocol how the proxy accepts. SSL termination is not a responsibility of this image.\n* `DISABLE_SSL_VERIFY` - disabled ssl verification, use if the backend SSL certificate is invalid (defaults to false).\n* `REMOTE_USER_EMAIL_SAML_ATTRIBUTE` - the SAML attribute to be sent as `Remote-User-Name header`\n* `REMOTE_USER_NAME_SAML_ATTRIBUTE` - the SAML attribute to be sent as `Remote-User-Email`\n* `REMOTE_USER_PREFERRED_USERNAME_SAML_ATTRIBUTE` - the SAML attribute to be sent as `Remote-User-Preferred-Username`\n* `SAML_MAP_<>` - this will map the `saml_field` to a request header specified by the property. Eg: `SAML_MAP_EmailAddress=X-WEBAUTH-USER` will map `EmailAddress` SAML field to `X-WEBAUTH-USER` request header.\n\nVolumes:\n* `/etc/httpd/conf.d/saml_idp.xml` - SAML IPD metadata (_mandatory_)\n* `/etc/httpd/conf.d/saml_sp.key` - SAML SP key (generated if not provided)\n* `/etc/httpd/conf.d/saml_sp.cert` - SAML SP certificate (generated if not provided)\n* `/etc/httpd/conf.d/saml_sp.xml` - SAML SP metadata (generated if not provided)\n\n# Example Use\n\n## Getting SAML metadata\n### Auth0\n\nAn example IDP can be created at https://auth0.com/. After creating an account, edit the default app's *Addons > SAML2 Web App* settings as follows:\n\n * Settings > Application Callback URL*: https://auth.example.com/mellon/postResponse\n\n * Settings > Settings*:\n ```\n {\n \"audience\": \"https://auth.example.com\",\n ...\n }\n ```\n\n * Usage > Identity Provider Metadata*: Download the metadata xml and make it available as volume.\n\n## Bitium\n\nTODO\n\n## Configuration\n\n### Docker\n\n```\ndocker run \\\n -p 80:80 \\\n -h auth.example.com \\\n -v /saml_idp.xml:/etc/httpd/conf.d/saml_idp.xml \\\n -e BACKEND=https://api.example.com:8443 \\\n -e SCHEMA=http \\\n -ti\n barnabassudy/saml-proxy\n```\n\n* `-p 80:80` - port is mapped to localhost:80\n* `-h auth.example.com` is equivalent with `-e PROXY_HOST=auth.example.com` - waits for requests for this host and will redirect to this host\n* `-v /saml_idp.xml:/etc/httpd/conf.d/saml_idp.xml` - provides the SAML metadata as volume\n* `-e BACKEND=https://api.example.com:8443` - the url the requests should be proxied to\n* `-e SCHEMA=http`\n* `-ti` - make it interactive (eg. being able to stop it with Ctrl+C)\n* `barnabassudy/saml-proxy` - the name of the Docker image\n\n### Docker Compose\n\n```\nversion: \"2\"\nservices:\n yourservice:\n ...\n saml-proxy:\n image: \"barnabassudy/saml-proxy\"\n environment:\n BACKEND: \"http://yourservice:port\"\n ports:\n - \"80:80\"\n volumes:\n - \"/saml_idp.xml:/etc/httpd/conf.d/saml_idp.xml\"\n```\n\n### Kubernetes\n\n#### ConfigMap\n\nThe configmap stores the SAML configuration. You should download the SAML configuration from you Identity Provider\nand put into the config map. You can also use `--from-file` switch on `kubectl create configmap` ([Ref](https://kubernetes.io/docs/tasks/configure-pod-container/configmap/))\n\n```\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: saml-proxy-config\n namespace: <>\ndata:\n saml_idp.xml: ...\n\n```\n\n#### Deployment\n\n* I mount `saml_idp.xml` from the config as a volume.\n* `EmailAddress` SAML field is mapped to `X-Webauth-User` header. In my config the Grafana usernames will be the email addresses from SAML IDP. You can change it to a field you want to use.\n\n```\napiVersion: extensions/v1beta1\nkind: Deployment\nmetadata:\n name: saml-proxy\n namespace: <>\n labels:\n version: \"latest\"\nspec:\n strategy:\n rollingUpdate:\n maxSurge: 30%\n maxUnavailable: 30%\n progressDeadlineSeconds: 120\n revisionHistoryLimit: 5\n replicas: 1\n selector:\n matchLabels:\n app: saml-proxy\n template:\n metadata:\n labels:\n app: saml-proxy\n version: \"latest\"\n spec:\n containers:\n - name: saml-proxy\n image: \"barnabassudy/saml-proxy:latest\"\n ports:\n - name: http-service\n containerPort: 80\n livenessProbe:\n tcpSocket:\n port: http-service\n initialDelaySeconds: 10\n # Mounting saml_idp.xml from configMap\n volumeMounts:\n - name: saml-volume\n mountPath: /etc/httpd/conf.d/saml_idp.xml\n subPath: saml_idp.xml\n env:\n - name: BACKEND\n value: \"http://<>\"\n - name: REMOTE_USER_SAML_ATTRIBUTE\n value: login\n # You can specify multiple mappings\n - name: SAML_MAP_EmailAddress\n value: X-WEBAUTH-USER\n volumes:\n - name: saml-volume\n configMap:\n name: saml-proxy-config\n```\n\n#### Service\n\nTo expose saml-proxy as a service\n\n```\napiVersion: v1\nkind: Service\nmetadata:\n name: saml-proxy\n namespace: <>\nspec:\n ports:\n - name: http\n port: 80\n targetPort: http-service\n selector:\n app: saml-proxy\n```\n\n#### Ingress\n\nTo make it available in the Ingress controller.\n\n```\napiVersion: extensions/v1beta1\nkind: Ingress\nmetadata:\n name: monitor\n namespace: <>\n annotations:\n # USE YOUR ANNOTATIONS\n # To enable let's encrypt with kube-logo: kubernetes.io/tls-acme: \"true\"\nspec:\n # Use some SSL\n # tls:\n # - hosts:\n # # The host where the service will be available\n # - \"grafana.example.com\"\n # secretName: grafana-tls\n rules:\n # The host where the service will be available\n - host: \"grafana.example.com\"\n http:\n paths:\n - path: /\n backend:\n serviceName: saml-proxy\n servicePort: http\n```\n","has_starred","hub_user","immutable_tags_settings",{"_75":11,"_76":77},"enabled","rules",[78],".*","is_automated","permissions",{"_82":21,"_83":11,"_84":11},"read","write","admin","user","storage_size",107194544,"orgData","recentTags",[91],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":100,"_50":118,"_119":94,"_120":33,"_121":56,"_57":122,"_123":124,"_125":109,"_126":118,"_127":66,"_128":21},"content_type","creator",14094,"full_size",91919403,"id",48200215,"images",[101],{"_102":103,"_104":105,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":96,"_63":66,"_117":-5},"architecture","amd64","digest","sha256:45fe258fad3790755dce09aa488de5a9a2976dd61142de751c9ae555041b7341","features","","last_pulled","2026-09-25T04:53:23.800400964Z","last_pushed","2019-03-02T01:57:49Z","os","linux","os_features","os_version","size","variant","2019-03-02T02:03:29.68284Z","last_updater","last_updater_username","media_type","latest","repository",6753645,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":142,"_149":150,"_136":159,"_160":11},{"_40":143,"_42":144,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":145,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":146,"_79":11,"_80":148,"_85":33,"_86":87},[],[44],[56],{"_75":11,"_76":147},[78],{"_82":21,"_83":11,"_84":11},"tags",{"_151":64,"_152":-5,"_153":-5,"_154":155},"count","next","previous","results",[156],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":157,"_50":118,"_119":94,"_120":33,"_121":56,"_57":122,"_123":124,"_125":109,"_126":118,"_127":66,"_128":21},[158],{"_102":103,"_104":105,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":96,"_63":66,"_117":-5},[],"canDeleteTags","actionData","errors"]

jensendw/saml-proxy

Tags for jensendw/saml-proxy