[{"_1":2,"_154":-5,"_155":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_133":134},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_85":-5,"_86":87,"_126":-5,"_127":11,"_128":17,"_129":11,"_130":-5,"_131":132},"canonicalUrl","https://hub.docker.com/r/liggitt/auth-proxy/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","liggitt","reponame","auth-proxy","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_38":39,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":51,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":65,"_66":67,"_68":11,"_69":29,"_70":71,"_76":17,"_77":78,"_82":29,"_83":84},"categories",[],"content_types",[40],"image","date_registered","2015-09-08T04:56:53.137855Z","description","Test proxy server, configured with Kerberos and Basic authentication","is_private","last_updated","2017-04-20T14:20:14.050606Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[52],"application/vnd.docker.container.image.v1+json","name","pull_count",5719,"repository_type","star_count",4,"status",1,"status_description","active","source","collaborator_count",0,"full_description","# Auth Proxy\n\n## Overview\n\nThis repo and Docker image provides a test proxy server, configured with Kerberos, Basic, Form and SAML authentication.\n\nTo start, run like this:\n```\ndocker run -p 80:80 -p 443:443 -p 88:88 -h auth.example.com -e BACKEND=https://api.example.com:8443 -ti liggitt/auth-proxy\n```\n\nInvocation details:\n* 80 is the http proxy port\n* 443 is the https proxy port\n* 88 is the Kerberos ticket server port\n* `auth.example.com` can be replaced with any hostname you like, just adjust the setup instructions appropriately\n* `$BACKEND` should be set to the base URL you want proxied (with no trailing slash). The host or IP must be accessible from within the container (so `localhost` probably won't work)\n\nOn startup, it sets up the following:\n* Kerberos ticket server for `$PROXY_HOST` (defaulting to the host `auth.example.com` and the realm `AUTH.EXAMPLE.COM`)\n* Apache proxy from `https://$PROXY_HOST/mod_auth_gssapi/*` to `$BACKEND`, secured by negotiate auth backed by Kerberos (mod_auth_gssapi)\n* Apache proxy from `https://$PROXY_HOST/mod_auth_gssapi_basic/*` to `$BACKEND`, secured by negotiate auth backed by Kerberos (mod_auth_gssapi) with basic auth fallback\n* Apache proxy from `https://$PROXY_HOST/mod_auth_kerb/*` to `$BACKEND`, secured by negotiate auth backed by Kerberos (mod_auth_kerb)\n* Apache proxy from `https://$PROXY_HOST/mod_auth_kerb_basic/*` to `$BACKEND`, secured by negotiate auth backed by Kerberos (mod_auth_kerb) with basic auth fallback\n* Apache proxy from `https://$PROXY_HOST/mod_auth_basic/*` to `$BACKEND`, secured by basic auth backed by Kerberos\n* Apache proxy from `https://$PROXY_HOST/mod_auth_form/*` to `$BACKEND`, secured by form auth backed by a htpasswd file\n* Apache proxy from `https://$PROXY_HOST/mod_auth_mellon/*` to `$BACKEND`, secured by SAML auth with the IDP metadata in /etc/httpd/conf.d/saml_idp.xml\n* Apache proxy from `https://$PROXY_HOST/mod_intercept_form_submit/*` to `$BACKEND`, secured by form interception auth backed by Kerberos\n* 5 test users, user1-user5@REALM, with password `password` (e.g. `user1@AUTH.EXAMPLE.COM`/`password`)\n\n# Docker image setup\n\n### Build the Docker image from source\n\n```\nmake build\n```\n\n### Run the Docker image from source\n\nSpecify the backend to proxy to with the `$BACKEND` envvar.\n\n```\nBACKEND=https://api.example.com:8443 PROXY_HOST=auth.example.com make run\n```\n\n## Desktop setup\n\n### Use the container as a Kerberos ticket server\n\nThe following examples assume `$PROXY_HOST` was set to `auth.example.com`, and the `krb5-workstation` package is installed.\n\n1. Alias `auth.example.com` to the Docker IP in `/etc/hosts/:\n\n ```\n 172.17.42.1 auth.example.com\n ```\n\n2. Configure Kerberos to use the container as the ticket server in `/etc/krb5.conf`:\n\n ```\n [realms]\n AUTH.EXAMPLE.COM = {\n kdc = auth.example.com\n admin_server = auth.example.com\n default_domain = auth.example.com\n }\n \n [domain_realm]\n .auth.example.com = AUTH.EXAMPLE.COM\n auth.example.com = AUTH.EXAMPLE.COM\n ```\n\n3. Configure Firefox to use negotiate auth with the domain:\n\n 1. Type `about:config`\n 2. Set `network.negotiate-auth.trusted-uris` to include `auth.example.com`\n \n## Example Use\n\n### Kerberos\n\nThe following examples assume `$PROXY_HOST` was set to `auth.example.com`, and the `krb5-workstation` package is installed.\n\n1. Log in:\n\n ```\n $ kinit user1@AUTH.EXAMPLE.COM\n Password for user1@AUTH.EXAMPLE.COM: password\n\n $ klist\n Ticket cache: KEYRING:persistent:1000:1000\n Default principal: user1@AUTH.EXAMPLE.COM\n\n Valid starting Expires Service principal\n 09/07/2015 20:43:32 09/08/2015 20:43:32 krbtgt/AUTH.EXAMPLE.COM@AUTH.EXAMPLE.COM\n ```\n\n2. Check negotiate auth:\n \n ```\n $ curl -v http://auth.example.com/mod_auth_gssapi/ --negotiate -u :\n\n * Connected to auth.example.com (172.17.42.1) port 80 (#0)\n > GET /mod_auth_gssapi/ HTTP/1.1\n > Host: auth.example.com\n > Accept: */*\n\n < HTTP/1.1 401 Unauthorized\n < WWW-Authenticate: Negotiate\n\n * Issue another request to this URL: 'http://auth.example.com/mod_auth_gssapi/'\n * Server auth using GSS-Negotiate with user ''\n\n > GET /mod_auth_gssapi/ HTTP/1.1\n > Authorization: Negotiate YIICmQYGKwYBBQUCoIICj...\n > Host: auth.example.com\n > Accept: */*\n\n < HTTP/1.1 200 OK\n < WWW-Authenticate: Negotiate oYG3MIG0oAMKAQChCwYJK...\n < Content-Type: text/html\n < Content-Length: 252\n ...\n ```\n\n3. Log out, verify no tickets are active\n\n ```\n $ kdestroy\n $ klist\n klist: Credentials cache keyring 'persistent:1000:1000' not found\n\n ```\n\n4. Verify negotiate auth fails:\n\n ```\n $ curl -v http://auth.example.com/mod_auth_gssapi/ --negotiate -u :\n\n > GET /mod_auth_gssapi/ HTTP/1.1\n > Host: auth.example.com\n > Accept: */*\n\n < HTTP/1.1 401 Unauthorized\n < WWW-Authenticate: Negotiate\n * gss_init_sec_context() failed: : SPNEGO cannot find mechanisms to negotiate\n ...\n ```\n\n### Basic auth\n\n1. Check basic auth fails:\n \n ```\n $ curl -v http://auth.example.com/mod_auth_basic/ -u test:user\n\n * Server auth using Basic with user 'test'\n > GET /mod_auth_basic/ HTTP/1.1\n > Authorization: Basic dGVzdDp1c2Vy\n > Host: auth.example.com\n > Accept: */*\n\n < HTTP/1.1 401 Unauthorized\n * Authentication problem. Ignoring this.\n < WWW-Authenticate: Basic realm=\"Basic Login\"\n ...\n\n ```\n\n2. Check basic auth succeeds:\n \n ```\n $ curl -v http://auth.example.com/mod_auth_basic/ -u user1@AUTH.EXAMPLE.COM:password\n\n * Server auth using Basic with user 'user1@AUTH.EXAMPLE.COM'\n > GET /mod_auth_basic/ HTTP/1.1\n > Authorization: Basic dXNlcjFATVlET01BSU4uQ09NOnBhc3N3b3Jk\n > Host: auth.example.com\n > Accept: */*\n\n < HTTP/1.1 200 OK\n < Content-Type: text/html\n < Content-Length: 252\n ...\n ```\n\n### SAML auth\n\n1. Copy your IDP's metadata XML to /etc/httpd/conf.d/saml_idp.xml and restart httpd (`httpd -k restart`)\n\n2. An example IDP can be created at https://auth0.com/. After creating an account, edit the default app's *Addons > SAML2 Web App* settings as follows:\n\n *Settings > Application Callback URL*: https://auth.example.com/mellon/postResponse\n\n *Settings > Settings*: \n ```\n {\n \"audience\": \"https://auth.example.com\",\n ...\n }\n ```\n\n *Usage > Identity Provider Metadata*: Copy to /etc/httpd/conf.d/saml_idp.xml in your proxy image and restart httpd (`httpd -k restart`) ","has_starred","hub_user","immutable_tags_settings",{"_72":11,"_73":74},"enabled","rules",[75],".*","is_automated","permissions",{"_79":17,"_80":11,"_81":11},"read","write","admin","user","storage_size",626789804,"orgData","recentTags",[88],{"_89":40,"_90":91,"_92":93,"_94":95,"_96":97,"_98":99,"_46":115,"_116":91,"_117":29,"_118":52,"_53":119,"_120":121,"_122":106,"_123":115,"_124":62,"_125":17},"content_type","creator",407293,"digest","sha256:8466c19fb75149c3819e21c2543c984ef30d4b17a240b5d5bc5d171d299dfdd0","full_size",106490771,"id",856711,"images",[100],{"_101":102,"_92":93,"_103":104,"_105":106,"_107":108,"_109":110,"_111":104,"_112":-5,"_113":95,"_59":62,"_114":-5},"architecture","amd64","features","","last_pulled","2026-09-15T00:41:33.289663097Z","last_pushed","2017-04-20T14:20:13Z","os","linux","os_features","os_version","size","variant","2017-04-20T14:20:12.574578Z","last_updater","last_updater_username","media_type","latest","repository",314624,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":135,"_142":143,"_131":152,"_153":11},{"_36":136,"_38":137,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":138,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":65,"_66":67,"_68":11,"_69":29,"_70":139,"_76":17,"_77":141,"_82":29,"_83":84},[],[40],[52],{"_72":11,"_73":140},[75],{"_79":17,"_80":11,"_81":11},"tags",{"_144":60,"_145":-5,"_146":-5,"_147":148},"count","next","previous","results",[149],{"_89":40,"_90":91,"_92":93,"_94":95,"_96":97,"_98":150,"_46":115,"_116":91,"_117":29,"_118":52,"_53":119,"_120":121,"_122":106,"_123":115,"_124":62,"_125":17},[151],{"_101":102,"_92":93,"_103":104,"_105":106,"_107":108,"_109":110,"_111":104,"_112":-5,"_113":95,"_59":62,"_114":-5},[],"canDeleteTags","actionData","errors"]

liggitt/auth-proxy

Tags for liggitt/auth-proxy