[{"_1":2,"_154":-5,"_155":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_133":134},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_84":-5,"_85":86,"_124":-5,"_125":11,"_126":17,"_127":11,"_128":-5,"_129":11,"_130":-5,"_131":132},"canonicalUrl","https://hub.docker.com/r/thoughtgang/apache-oidc/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","thoughtgang","reponame","apache-oidc","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_38":39,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":51,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":60,"_65":66,"_67":11,"_68":29,"_69":70,"_75":11,"_76":77,"_81":29,"_82":83},"categories",[],"content_types",[40],"image","date_registered","2021-02-21T01:23:00.753152Z","description","","is_private","last_updated","2021-03-12T23:58:16.683836Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[52],"application/vnd.docker.container.image.v1+json","name","pull_count",1818,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# apache-oidc\n\nA Docker Image with an Apache HTTP Server with the OIDC module preinstalled\n\n## Getting Started\n\nIn order to get some benefit out this container you will need to things:\n\n* Content which you want to protect though OpenID Connect Authentcation\n* A registration with an OpenID Connect Provider (Google, Azure, etc.).\n The OIDC provider will with three things:\n\n * A meta url with the confiuration details and keystore of the OIDC Provider\n * A ClientID to identify your application\n * A ClientSecret to authenticate your server against the OpenID Connect Provider\n\nAdditionally you will need a redirect url which serves to which the user is redirected after he\nhas successfully identified himslef at the OIDC Provider. There is now meaning to this \naddreess except that it must be on this server and it does not interfere with the content\nyou have wnat to share.\n\nLastly, you should seet an encryption password to secure the cookies to reidentify users during future \nrequest.\n\n*Note:* The five settings mentioned above are the bare minimum got get started for any realistic use cases - especially limiting access to members of a certain domain - you should refer to the excellent documentation of the [mod_auth_openidc module at GitHub](https://github.com/zmartzone/mod_auth_openidc)\n\n\n### Usage\n\n#### Running your container\n\nFor simple use cases you may want\n\n```shell\ndocker run -e OIDC_REDIRECT_URL=http://localhost/login/redirect_uri \\\n -e OIDC_CRYPTO_PASSPHRASE= \\\n -e OIDC_PROVIDER_METADATA_URL=https://accounts.google.com/.well-known/openid-configuration \\\n -e OIDC_CLIENT_ID= \\\n -e OIDC_CRYPTO_PASSPHRASE= \\\n -v /var/www/html: \\\n -p 80:80 \\\n thoughtgang/apache-oid:latest \\\n```\n\nIf you need a more fine grained control over hte configuration settings you may want to edit the [auth_openidc.conf](auth_openidc.conf) and mount that in to the container:\n\n```shell\ndocker run -v /etc/apache2/mods-available/auth_openidc.conf: \\\n -v /var/www/html: \\\n -p 80:80 \\\n thoughtgang/apache-oid:latest \\\n```\n\nFinally you may want to use this image as the basis for your own images with the following Dockerfile:\n\n```\nFROM thoughtgang/apache-oidc:latest\n\nCOPY /var/www/html\n\nENV OIDC_REDIRECT_URL=http:///login/redirect_uri\nENV OIDC_CRYPTO_PASSPHRASE=\nENV OIDC_PROVIDER_METADATA_URL=https://accounts.google.com/.well-known/openid-configuration\nENV OIDC_CLIENT_ID=\nENV OIDC_CLIENT_SECRET=\n```\n\n\n### Environment Variables\n\n#### Basic configuration\n\n* `OIDC_REDIRECT_URL` - The redirect_uri for this OpenID Connect client; this is a vanity URL\nthat must ONLY point to a path on your server protected by this module\nbut it must NOT point to any actual content that needs to be served.\nYou can use a relative URL like /protected/redirect_uri if you want to\nsupport multiple vhosts that belong to the same security domain in a dynamic way\n* `OIDC_CRYPTO_PASSPHRASE` - Set a password for crypto purposes, this is used for:\n - encryption of the (temporary) state cookie\n - encryption of cache entries, that may include the session cookie, see: OIDCCacheEncrypt and OIDCSessionType\n\n Note that an encrypted cache mechanism can be shared between servers if they use the same OIDCCryptoPassphrase\nIf the value begins with exec: the resulting command will be executed and the\nfirst line returned to standard output by the program will be used as the password.\nThe command may be absolute or relative to the web server root.\n\n* `OIDC_PROVIDER_METADATA_URL` - URL where OpenID Connect Provider metadata can be found (e.g. https://accounts.google.com/.well-known/openid-configuration)\nThe obtained metadata will be cached and refreshed every 24 hours.\nIf set, individual entries below will not have to be configured but can be used to add\nextra entries/endpoints to settings obtained from the metadata.\nIf OIDCProviderMetadataURL is not set, the entries below it will have to be configured for a single\nstatic OP configuration or OIDCMetadataDir will have to be set for configuration of multiple OPs.\n\n* `OIDC_CLIENT_ID` - Client identifier used in calls to the OpenID Connect Provider.\n\n* `OIDC_CLIENT_SECRET` - Client secret used in calls to the OpenID Connect Provider.\n\n#### Advanged configuration\n\n* `OIDC_SCOPE` - A space separated list of OIDC to request (e.g. ENV OIDC_SCOPE=\"openid profile email\" would get you name and email associated with the login). Defaults to *openid*\n\n* `OIDC_SESSION_TYPE` - The OIDC session type (aka OIDCSessionType config value). \n> :warning: The default value is changed from `server-cache` to `client-cookie` by default to facilitate the use in a cluster environment.\n\n* `OIDC_SESSION_INACTIVITY_TIMEOUT` The value for the config parameter OIDCSessionInactivityTimeout. The default value is 300s aka 5 min.)\n\n* `OIDC_SESSION_MAX_DURATION` The value for the config parameter OIDCSessionMaxDuration. The default value is 28800s aka 8 h.\n\n### Volumes\n\n* `/var/www/html` - Root directory for the web server\n\n### Useful File Locations\n\n* `/etc/apache2/mods-available/mode_openidc.conf` - Confiuration file for the OIDC module\n\n## Find Us\n\n* [GitHub](https://github.com/thought-gang/apache-oidc)\n* [Docker.io](https://hub.docker.com/repository/docker/thoughtgang/apache-oidc)\n\n\n## Authors\n\n* **Felix Hoßfeld** - *Initial work* - [Thought Gang GmbH](https://www.thoughtgang.de/)\n\nSee also the list of [contributors](https://github.com/your/repository/contributors) who \nparticipated in this project.\n\n## License\n\nThis project is licensed under the MIT License - see the [LICENSE.md](LICENSE.md) file for details.\n","has_starred","hub_user","immutable_tags_settings",{"_71":11,"_72":73},"enabled","rules",[74],".*","is_automated","permissions",{"_78":17,"_79":11,"_80":11},"read","write","admin","user","storage_size",122122050,"orgData","recentTags",[87],{"_88":40,"_89":90,"_91":92,"_93":94,"_95":96,"_46":113,"_114":90,"_115":29,"_116":52,"_53":117,"_118":119,"_120":104,"_121":113,"_122":62,"_123":17},"content_type","creator",6900458,"full_size",61014236,"id",138397675,"images",[97],{"_98":99,"_100":101,"_102":44,"_103":104,"_105":106,"_107":108,"_109":44,"_110":-5,"_111":92,"_59":62,"_112":-5},"architecture","amd64","digest","sha256:c2bd7ba03d90b91b53b0b08e4d586a7c7c01968323024c4b8b472b1ba814f9be","features","last_pulled","2026-09-24T10:09:46.097259863Z","last_pushed","2021-03-12T23:58:17Z","os","linux","os_features","os_version","size","variant","2021-03-12T23:58:16.377995Z","last_updater","last_updater_username","media_type","latest","repository",11492183,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":135,"_142":143,"_131":152,"_153":11},{"_36":136,"_38":137,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":138,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":60,"_65":66,"_67":11,"_68":29,"_69":139,"_75":11,"_76":141,"_81":29,"_82":83},[],[40],[52],{"_71":11,"_72":140},[74],{"_78":17,"_79":11,"_80":11},"tags",{"_144":60,"_145":-5,"_146":-5,"_147":148},"count","next","previous","results",[149],{"_88":40,"_89":90,"_91":92,"_93":94,"_95":150,"_46":113,"_114":90,"_115":29,"_116":52,"_53":117,"_118":119,"_120":104,"_121":113,"_122":62,"_123":17},[151],{"_98":99,"_100":101,"_102":44,"_103":104,"_105":106,"_107":108,"_109":44,"_110":-5,"_111":92,"_59":62,"_112":-5},[],"canDeleteTags","actionData","errors"]

thoughtgang/apache-oidc

Tags for thoughtgang/apache-oidc