[{"_1":2,"_154":-5,"_155":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_133":134},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":17},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_84":-5,"_85":86,"_124":-5,"_125":11,"_126":17,"_127":11,"_128":-5,"_129":11,"_130":-5,"_131":132},"canonicalUrl","https://hub.docker.com/r/noonien/google-auth-proxy/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","noonien","reponame","google-auth-proxy","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_38":39,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":51,"_53":31,"_28":29,"_54":55,"_56":-5,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":58,"_65":66,"_67":11,"_68":29,"_69":70,"_75":17,"_76":77,"_81":29,"_82":83},"categories",[],"content_types",[40],"image","date_registered","2015-04-29T10:34:09.058897Z","description","","is_private","last_updated","2015-10-11T06:49:27.789991Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[52],"application/vnd.docker.distribution.manifest.v1+prettyjws","name","pull_count",1280,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","google_auth_proxy\n=================\n\n\nA reverse proxy that provides authentication using Google and other OAuth2\nproviders to validate individual accounts, or a whole google apps domain.\n\n[![Build Status](https://secure.travis-ci.org/bitly/google_auth_proxy.png?branch=master)](http://travis-ci.org/bitly/google_auth_proxy)\n\n\n![sign_in_page](https://cloud.githubusercontent.com/assets/45028/4970624/7feb7dd8-6886-11e4-93e0-c9904af44ea8.png)\n\n## Architecture\n\n```\n _______ ___________________ __________\n |Nginx| ----> |google_auth_proxy| ----> |upstream| \n ------- ------------------- ----------\n ||\n \\/\n [google oauth2 api]\n```\n\n\n## Installation\n\n1. Download [Prebuilt Binary](https://github.com/bitly/google_auth_proxy/releases) or build from `master` with `$ go get github.com/bitly/google_auth_proxy` which should put the binary in `$GOROOT/bin`\n2. Register an OAuth Application with Google\n3. Configure Google Auth Proxy using config file, command line options, or environment variables\n4. Deploy behind a SSL endpoint (example provided for Nginx)\n\n## OAuth Configuration\n\nYou will need to register an OAuth application with Google (or [another\nprovider](#providers)), and configure it with Redirect URI(s) for the domain\nyou intend to run `google_auth_proxy` on.\n\nFor Google, the registration steps are:\n\n1. Create a new project: https://console.developers.google.com/project\n2. Under \"APIs & Auth\", choose \"Credentials\"\n3. Now, choose \"Create new Client ID\"\n * The Application Type should be **Web application**\n * Enter your domain in the Authorized Javascript Origins `https://internal.yourcompany.com`\n * Enter the correct Authorized Redirect URL `https://internal.yourcompany.com/oauth2/callback`\n * NOTE: `google_auth_proxy` will _only_ callback on the path `/oauth2/callback`\n4. Under \"APIs & Auth\" choose \"Consent Screen\"\n * Fill in the necessary fields and Save (this is _required_)\n5. Take note of the **Client ID** and **Client Secret**\n\nFor LinkedIn, the registration steps are:\n\n1. Create a new project: https://www.linkedin.com/secure/developer\n2. In the OAuth User Agreement section:\n * In default scope, select r_basicprofile and r_emailaddress.\n * In \"OAuth 2.0 Redirect URLs\", enter `https://internal.yourcompany.com/oauth2/callback`\n3. Fill in the remaining required fields and Save.\n4. Take note of the **Consumer Key / API Key** and **Consumer Secret / Secret Key**\n\n## Configuration\n\n`google_auth_proxy` can be configured via [config file](#config-file), [command line options](#command-line-options) or [environment variables](#environment-variables).\n\n### Config File\n\nAn example [google_auth_proxy.cfg](contrib/google_auth_proxy.cfg.example) config file is in the contrib directory. It can be used by specifying `-config=/etc/google_auth_proxy.cfg`\n\n### Command Line Options\n\n```\nUsage of google_auth_proxy:\n -authenticated-emails-file=\"\": authenticate against emails via file (one per line)\n -client-id=\"\": the Google OAuth Client ID: ie: \"123456.apps.googleusercontent.com\"\n -client-secret=\"\": the OAuth Client Secret\n -config=\"\": path to config file\n -cookie-domain=\"\": an optional cookie domain to force cookies to (ie: .yourcompany.com)*\n -cookie-expire=168h0m0s: expire timeframe for cookie\n -cookie-httponly=true: set HttpOnly cookie flag\n -cookie-https-only=true: set secure (HTTPS) cookies (deprecated. use --cookie-secure setting)\n -cookie-secret=\"\": the seed string for secure cookies\n -cookie-secure=true: set secure (HTTPS) cookie flag\n -custom-templates-dir=\"\": path to custom html templates\n -display-htpasswd-form=true: display username / password login form if an htpasswd file is provided\n -google-apps-domain=: authenticate against the given Google apps domain (may be given multiple times)\n -htpasswd-file=\"\": additionally authenticate against a htpasswd file. Entries must be created with \"htpasswd -s\" for SHA encryption\n -http-address=\"127.0.0.1:4180\": [http://]: or unix:// to listen on for HTTP clients\n -login-url=\"\": Authentication endpoint\n -pass-access-token=false: pass OAuth access_token to upstream via X-Forwarded-Access-Token header\n -pass-basic-auth=true: pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream\n -pass-host-header=true: pass the request Host Header to upstream\n -profile-url=\"\": Profile access endpoint\n -provider=\"\": Oauth provider (defaults to Google)\n -redeem-url=\"\": Token redemption endpoint\n -redirect-url=\"\": the OAuth Redirect URL. ie: \"https://internalapp.yourcompany.com/oauth2/callback\"\n -request-logging=true: Log requests to stdout\n -scope=\"\": Oauth scope specification\n -skip-auth-regex=: bypass authentication for requests path's that match (may be given multiple times)\n -upstream=: the http url(s) of the upstream endpoint. If multiple, routing is based on path\n -version=false: print version string\n```\n\n### Environment variables\n\nThe environment variables `GOOGLE_AUTH_PROXY_CLIENT_ID`, `GOOGLE_AUTH_PROXY_CLIENT_SECRET`, `GOOGLE_AUTH_PROXY_COOKIE_SECRET`, `GOOGLE_AUTH_PROXY_COOKIE_DOMAIN` and `GOOGLE_AUTH_PROXY_COOKIE_EXPIRE` can be used in place of the corresponding command-line arguments.\n\n### Example Nginx Configuration\n\nThis example has a [Nginx](http://nginx.org/) SSL endpoint proxying to `google_auth_proxy` on port `4180`. \n`google_auth_proxy` then authenticates requests for an upstream application running on port `8080`. The external \nendpoint for this example would be `https://internal.yourcompany.com/`.\n\nAn example Nginx config follows. Note the use of `Strict-Transport-Security` header to pin requests to SSL \nvia [HSTS](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security):\n\n```\nserver {\n listen 443 default ssl;\n server_name internal.yourcompany.com;\n ssl_certificate /path/to/cert.pem;\n ssl_certificate_key /path/to/cert.key;\n add_header Strict-Transport-Security max-age=1209600;\n\n location / {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n proxy_connect_timeout 1;\n proxy_send_timeout 30;\n proxy_read_timeout 30;\n }\n}\n```\n\nThe command line to run `google_auth_proxy` would look like this:\n\n```bash\n./google_auth_proxy \\\n --google-apps-domain=\"yourcompany.com\" \\\n --upstream=http://127.0.0.1:8080/ \\\n --cookie-secret=... \\\n --cookie-secure=true \\\n --client-id=... \\\n --client-secret=...\n```\n\n\n## Endpoint Documentation\n\nGoogle Auth Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated.\n\n* /ping - returns an 200 OK response\n* /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)\n* /oauth2/start - a URL that will redirect to start the OAuth cycle\n* /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this ass the callback url.\n\n## Logging Format\n\nGoogle Auth Proxy logs requests to stdout in a format similar to Apache Combined Log.\n\n```\n - [19/Mar/2015:17:20:19 -0400] GET \"/path/\" HTTP/1.1 \"\" \n```\n\n## Providers other than Google\n\nOther providers besides Google can be specified by the `providers` flag/config\ndirective. Right now this includes:\n\n* `myusa` - The [MyUSA](https://alpha.my.usa.gov) authentication service\n ([GitHub](https://github.com/18F/myusa))\n* `linkedin` - The [LinkedIn](https://developer.linkedin.com/docs/signin-with-linkedin) Sign In service.\n\n## Adding a new Provider\n\nFollow the examples in the [`providers` package](providers/) to define a new\n`Provider` instance. Add a new `case` to\n[`providers.New()`](providers/providers.go) to allow the auth proxy to use the\nnew `Provider`.\n","has_starred","hub_user","immutable_tags_settings",{"_71":11,"_72":73},"enabled","rules",[74],".*","is_automated","permissions",{"_78":17,"_79":11,"_80":11},"read","write","admin","user","storage_size",182964598,"orgData","recentTags",[87],{"_88":40,"_89":90,"_91":92,"_93":94,"_95":96,"_97":98,"_46":113,"_114":90,"_115":29,"_116":52,"_53":117,"_118":119,"_120":104,"_121":113,"_122":62,"_123":17},"content_type","creator",2583,"digest","sha256:c19450a0c58f83ed20e19e4d29fef15050e582e85bc26e8edc9586fa680569f4","full_size",182917471,"id",162845,"images",[99],{"_100":101,"_91":92,"_102":44,"_103":104,"_105":106,"_107":44,"_108":44,"_109":-5,"_110":111,"_59":62,"_112":-5},"architecture","amd64","features","last_pulled","2026-09-21T22:13:42.69868038Z","last_pushed","2015-10-11T06:49:27Z","os","os_features","os_version","size",182917855,"variant","2015-10-11T06:49:28Z","last_updater","last_updater_username","media_type","latest","repository",190849,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":135,"_142":143,"_131":152,"_153":11},{"_36":136,"_38":137,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":138,"_53":31,"_28":29,"_54":55,"_56":-5,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":58,"_65":66,"_67":11,"_68":29,"_69":139,"_75":17,"_76":141,"_81":29,"_82":83},[],[40],[52],{"_71":11,"_72":140},[74],{"_78":17,"_79":11,"_80":11},"tags",{"_144":60,"_145":-5,"_146":-5,"_147":148},"count","next","previous","results",[149],{"_88":40,"_89":90,"_91":92,"_93":94,"_95":96,"_97":150,"_46":113,"_114":90,"_115":29,"_116":52,"_53":117,"_118":119,"_120":104,"_121":113,"_122":62,"_123":17},[151],{"_100":101,"_91":92,"_102":44,"_103":104,"_105":106,"_107":44,"_108":44,"_109":-5,"_110":111,"_59":62,"_112":-5},[],"canDeleteTags","actionData","errors"]

noonien/google-auth-proxy

Tags for noonien/google-auth-proxy