Reverse Proxy for RBAC with SSO using OAuth2.
2.9K
It's a reverse proxy that performs RBAC (Role Based Access Control) with SSO using OAuth2.
It provides access control with email addresses tied to Gmail and GitHub accounts.
Please refer Kubernetes Deployment - github.com/tingtt/oauth2rbac.
Docker Compose - github.com/tingtt/oauth2rbac
First, set up at least one OAuth2 provider.
Google Cloud
GitHub
Encode the OAuth2 client credentials with base64 and store them in a .env file.
echo -n '<Your client ID>;<Your client secret>' | base64
Create a .env file with the following contents:
JWT_SECRET=<base64-encoded JWT secret>
OAUTH2_GOOGLE=<base64-encoded OAuth2 client credential set>
OAUTH2_GITHUB=<base64-encoded OAuth2 client credential set>
config.yamlCreate a config.yaml file for configuring reverse proxies and access control lists (ACL).
proxies:
- external_url: "http://www.example.com/"
target: "http://www:80/"
- external_url: "http://www.example.com/blog/"
target: "http://blog:80/" # cut the base url from request path with trailing slash "target"
# e.g. "http://www.example.com/blog/1" proxy to "http:/blog:80/1"
# (if "target" does not have trailing slash, base url not cut.)
- external_url: "http://docs.example.com/"
target: "http://docs:80/"
- external_url: "http://admin.example.com/"
target: "http://admin:80/"
set_headers:
Remote-User: ["tingtt"] # MIME header key will be normalized
# e.g. "CUSTOM-HEADER" canonicalize to "Custom-Header"
acl:
"http://www.example.com": # External Origin
paths:
"/":
- methods: ["GET"] # allow GET
emails: ["-"] # allow for anonymous use
"http://docs.example.com":
jwt_expiry_in: 10800 # JWT expires in 3 hour (default)
paths:
"/":
- methods: ["GET"]
emails: ["*"] # allow all signed-in user
- methods: ["*"]
emails: ["*@example.com"] # allow users with a specific domain
roles:
"*@example.com": ["editor"] # roles
# It will be included in JWT claim.
"http://admin.example.com":
paths:
"/":
- methods: ["*"]
emails: ["[email protected]"] # allow specified email user
roles:
"[email protected]": ["admin"]
compose.yamlCreate a compose.yaml file to define the services.
services:
oauth2rbac:
image: tingtt/oauth2rbac:v0.8.8
command: [
"--port", "80",
"--jwt-secret", "$(JWT_SECRET)",
"-f", "/etc/oauth2rbac/config.yaml",
"--oauth2-client", "github;$(OAUTH2_GITHUB)",
"--oauth2-client", "google;$(OAUTH2_GOOGLE)",
]
ports:
- "80:80"
environment:
- JWT_SECRET=${JWT_SECRET}
- OAUTH2_GOOGLE=${OAUTH2_GOOGLE}
- OAUTH2_GITHUB=${OAUTH2_GITHUB}
volumes:
- ./config.yaml:/etc/oauth2rbac/config.yaml
restart: always
app:
image: example.com/app:latest
ports:
- "3000":"3000"
web:
image: nginx:latest
ports:
- "80":"80"
prometheus:
image: prom/prometheus:latest
ports:
- "9090":"9090"
grafana:
image: grafana/grafana:latest
ports:
- "3000":"3000"
Provision certificates
$ mkdir -p tls/example.com/
# Get certificates...
# (e.g. certbot, ca-certificate, etc.)
$ ls
tls.crt tls.key
Ensure the TLS certificate and key are stored in the ./tls directory.
Modify the compose.yaml to enable built-in TLS termination:
services:
oauth2rbac:
image: tingtt/oauth2rbac:v0.8.8
command: [
- "--port", "80",
+ "--port", "443",
"--jwt-secret", "$(JWT_SECRET)",
"-f", "/etc/oauth2rbac/config.yaml",
"--oauth2-client", "github;$(OAUTH2_GITHUB)",
"--oauth2-client", "google;$(OAUTH2_GOOGLE)",
+ "--tls-cert", "/etc/oauth2rbac/tls/example.com/tls.crt;/etc/oauth2rbac/tls/example.com/tls.key",
]
ports:
- - "80:80"
+ - "443:443"
environment:
- JWT_SECRET=${JWT_SECRET}
- OAUTH2_GOOGLE=${OAUTH2_GOOGLE}
- OAUTH2_GITHUB=${OAUTH2_GITHUB}
volumes:
- ./config.yaml:/etc/oauth2rbac/config.yaml
+ - ./tls:/etc/oauth2rbac/tls/example.com
restart: always
Content type
Image
Digest
sha256:923057c7b…
Size
13.2 MB
Last updated
about 1 year ago
docker pull tingtt/oauth2rbac