jobteaser/s3-oidc-proxy repository overview

⁠s3-oidc-proxy

NGINX as an OIDC proxy over S3 private bucket.

⁠Usage

It is recommended to use the docker image named jobteaser/s3-oidc-proxy that you can run with the following command:

docker run -it --rm \
  -e OIDC_DISCOVERY=<your IDP discovery URL (default "/redirect_uri")> \
  -e OIDC_CLIENT_ID=<your openidc client id> \
  -e OIDC_CLIENT_SECRET=<your openidc client secret> \
  -e OIDC_AUTH_SCOPE=<the openidc scope you're interested in (default "openid email")> \
  -e OIDC_AUTH_METHOD=<"client_secret_basic or client_secret_post" (default "client_secret_basic")> \
  -e AWS_S3_BUCKET=<bucket you want to give access to> \
  -e AWS_S3_REGION=<s3 region your bucket is in> \
  -e AWS_ACCESS_KEY_ID=<your AWS credentials> \
  -e AWS_SECRET_ACCESS_KEY=<your AWS credentials> \
  -e ACL_EMAIL_DOMAINS=<email domains you want to filter on> \
  jobteaser/s3-oidc-proxy

Note: if you want to filter on email with ACL_EMAIL_DOMAINS, you need to include email in OIDC_AUTH_SCOPE variable. You'll get a warning if you ask for filtering without asking for email in the scope.

⁠TODO

• Find a way to limit access to a prefix by configuration.
• Improve email filtering and auth scope definition.
• Give more adaptability to filtering rules.

⁠LICENSE

Copyright 2018 JobTeaser

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0⁠

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.