From 7ffcc419b0a70ffe32e7bfe046ee79fc8443b561 Mon Sep 17 00:00:00 2001 From: gh-actions Date: Mon, 21 Feb 2022 21:45:42 +0000 Subject: [PATCH] Deploy website - based on b2f780c394f1f926983eb79343193c40f3c467aa --- 001ca130.446eb9c9.js | 1 - 00691219.b2dfc659.js | 1 - 0721a2c0.a90d8322.js | 1 - 0f425520.6799b1da.js | 1 - 1.b73729bd.js | 1 - 17896441.3f09010b.js | 1 - 1999cd7b.46972a4d.js | 1 - 2.0f84ec0c.js | 2 - 2.0f84ec0c.js.LICENSE.txt | 5 -- 230aeb34.d5b08ee8.js | 1 - 243cbd97.a8d0e9a3.js | 1 - 300a9996.b7a71b7e.js | 1 - 35234f08.1da5596a.js | 1 - 357fe94d.4d208af0.js | 1 - 3b8c55ea.3a181e89.js | 1 - 3b8e2d60.0b9656a2.js | 1 - 3def9002.60ccd596.js | 1 - 3fa022c7.05712c0a.js | 1 - 404.html | 18 ++--- 41de83de.9aa82ee1.js | 1 - 42326c77.8f4766a3.js | 1 - 58.c351a43a.js | 1 - 585bdad0.5bd991bb.js | 1 - 59.d377417b.js | 1 - 5a047177.7631f436.js | 1 - 60.0c644c35.js | 1 - 63d69a63.0230d4fd.js | 1 - 6f497b56.9a644fc6.js | 1 - 76aee1e9.8aaa381a.js | 1 - 7874e99f.6f7ac14d.js | 1 - 7b04b1d5.1a4858e7.js | 1 - 7dcecc8d.cbd1bb5d.js | 1 - 8c826f25.f531f433.js | 1 - 92147208.114088bc.js | 1 - 935f2afb.1429e449.js | 1 - 94285305.cff6b03f.js | 1 - 9ac82b89.4743b5b3.js | 1 - 9b9cfcc1.2f147917.js | 1 - 9f61b932.8b6b8c4c.js | 1 - a1bbfb14.866a6184.js | 1 - a37c03cb.fe04e9e0.js | 1 - a991188b.f43c20c7.js | 1 - adcdd4d2.86e71566.js | 1 - ade45c9a.82f3357c.js | 1 - assets/css/styles.19258e03.css | 1 + assets/js/001ca130.df12b21c.js | 1 + assets/js/00691219.1534c076.js | 1 + assets/js/0721a2c0.ffdc7189.js | 1 + assets/js/0f425520.1fb0ef81.js | 1 + assets/js/17896441.b571fd1c.js | 1 + assets/js/1999cd7b.67af2e9d.js | 1 + assets/js/1be78505.7b2cd06e.js | 1 + assets/js/1f391b9e.e29f8c90.js | 1 + assets/js/230aeb34.9e93a797.js | 1 + assets/js/243cbd97.547fc342.js | 1 + assets/js/300a9996.f753e41d.js | 1 + assets/js/35234f08.75b00d70.js | 1 + assets/js/357fe94d.9943f239.js | 1 + assets/js/3b8c55ea.cd62c80a.js | 1 + assets/js/3b8e2d60.fe4a92a4.js | 1 + assets/js/3def9002.0566d6b8.js | 1 + assets/js/3fa022c7.d245265c.js | 1 + assets/js/41de83de.41ba64ac.js | 1 + assets/js/42326c77.8e971b20.js | 1 + assets/js/4608.2c7b7ade.js | 1 + assets/js/585bdad0.91728ed2.js | 1 + assets/js/5897.ca6e53fd.js | 1 + assets/js/5a047177.1f48e99a.js | 1 + assets/js/63d69a63.bbcebc27.js | 1 + assets/js/6f497b56.d1fafb1d.js | 1 + assets/js/76aee1e9.bdaa7582.js | 1 + assets/js/7874e99f.97b5d23c.js | 1 + assets/js/7b04b1d5.d117d167.js | 1 + assets/js/7dcecc8d.02aac3e1.js | 1 + assets/js/8c826f25.83c9869e.js | 1 + assets/js/92147208.dd46efff.js | 1 + assets/js/935f2afb.4a3f1d92.js | 1 + assets/js/94285305.1f5fc964.js | 1 + assets/js/9ac82b89.8b0bb8b5.js | 1 + assets/js/9b9cfcc1.b7867f12.js | 1 + assets/js/9e4087bc.fcc33365.js | 1 + assets/js/9f61b932.2752973c.js | 1 + assets/js/a1bbfb14.97805ab6.js | 1 + assets/js/a37c03cb.4fbaf920.js | 1 + assets/js/a991188b.d0024de2.js | 1 + assets/js/adcdd4d2.6f85c9fc.js | 1 + assets/js/ade45c9a.a4c9db10.js | 1 + assets/js/b89e1cb0.d176f819.js | 1 + assets/js/be200c4b.0994fc5b.js | 1 + assets/js/cbc8963c.4522119e.js | 1 + assets/js/cd4a49c1.9bfe0b83.js | 1 + assets/js/cecf159a.90b73e88.js | 1 + assets/js/d8b74189.4b70dd77.js | 1 + assets/js/de718920.cd0c4637.js | 1 + assets/js/e8c74efb.b44be80f.js | 1 + assets/js/ea7cbf6d.7aaa7faa.js | 1 + assets/js/ecc333f0.bd6ec7e9.js | 1 + assets/js/edfc6e1b.25fb710b.js | 1 + assets/js/efc9be4b.e7b86efc.js | 1 + assets/js/f3976560.2cb9bfe2.js | 1 + assets/js/f4c9d322.114701fa.js | 1 + assets/js/f5839aac.b034b05a.js | 1 + assets/js/f98fc388.3b0c1664.js | 1 + assets/js/fb908f49.ebaf85d6.js | 1 + assets/js/main.7b57a222.js | 2 + .../js/main.7b57a222.js.LICENSE.txt | 24 ++++++ assets/js/runtime~main.5a1afe5b.js | 1 + b89e1cb0.52daa6be.js | 1 - be200c4b.810bef87.js | 1 - blog/archive/index.html | 17 +++++ cbc8963c.7f614d2e.js | 1 - cd4a49c1.2aa6e525.js | 1 - cecf159a.4dd0cced.js | 1 - de718920.748e7f46.js | 1 - docs/6.1.x/behaviour/index.html | 32 ++------ docs/6.1.x/community/security/index.html | 38 +++------- .../configuration/oauth_provider/index.html | 48 ++++-------- docs/6.1.x/configuration/overview/index.html | 50 +++---------- .../configuration/session_storage/index.html | 40 +++------- docs/6.1.x/configuration/tls/index.html | 35 +++------ docs/6.1.x/features/endpoints/index.html | 32 ++------ .../features/request_signatures/index.html | 34 +++------ docs/6.1.x/index.html | 32 ++------ docs/7.0.x/behaviour/index.html | 32 ++------ docs/7.0.x/community/security/index.html | 38 +++------- .../configuration/alpha-config/index.html | 56 +++++--------- .../configuration/oauth_provider/index.html | 50 +++++-------- docs/7.0.x/configuration/overview/index.html | 54 +++----------- .../configuration/session_storage/index.html | 40 +++------- docs/7.0.x/configuration/tls/index.html | 35 +++------ docs/7.0.x/features/endpoints/index.html | 32 ++------ .../features/request_signatures/index.html | 34 +++------ docs/7.0.x/index.html | 32 ++------ docs/7.1.x/behaviour/index.html | 32 ++------ docs/7.1.x/community/security/index.html | 38 +++------- .../configuration/alpha-config/index.html | 56 +++++--------- .../configuration/oauth_provider/index.html | 50 +++++-------- docs/7.1.x/configuration/overview/index.html | 54 +++----------- .../configuration/session_storage/index.html | 40 +++------- docs/7.1.x/configuration/tls/index.html | 35 +++------ docs/7.1.x/features/endpoints/index.html | 32 ++------ docs/7.1.x/index.html | 32 ++------ docs/behaviour/index.html | 32 ++------ docs/community/security/index.html | 38 +++------- docs/configuration/alpha-config/index.html | 56 +++++--------- docs/configuration/oauth_provider/index.html | 50 +++++-------- docs/configuration/overview/index.html | 54 +++----------- docs/configuration/session_storage/index.html | 40 +++------- docs/configuration/tls/index.html | 35 +++------ docs/features/endpoints/index.html | 32 ++------ docs/index.html | 32 ++------ docs/next/behaviour/index.html | 32 ++------ docs/next/community/security/index.html | 38 +++------- .../configuration/alpha-config/index.html | 74 ++++++++----------- .../configuration/oauth_provider/index.html | 50 +++++-------- docs/next/configuration/overview/index.html | 54 +++----------- .../configuration/session_storage/index.html | 40 +++------- docs/next/configuration/tls/index.html | 37 +++------- docs/next/features/endpoints/index.html | 32 ++------ docs/next/index.html | 32 ++------ e8c74efb.b5ed146a.js | 1 - ea7cbf6d.22bf10e4.js | 1 - ecc333f0.d4801f2e.js | 1 - edfc6e1b.d363ab28.js | 1 - efc9be4b.54e8580a.js | 1 - f3976560.44bda334.js | 1 - f4c9d322.d8a15a21.js | 1 - f5839aac.17917aea.js | 1 - f98fc388.dff58a75.js | 1 - fb908f49.70b8b3c4.js | 1 - index.html | 28 +++---- main.089aca77.js | 2 - runtime~main.ae845585.js | 1 - sitemap.xml | 2 +- styles.b2862157.css | 1 - styles.f494e809.js | 1 - 176 files changed, 654 insertions(+), 1438 deletions(-) delete mode 100644 001ca130.446eb9c9.js delete mode 100644 00691219.b2dfc659.js delete mode 100644 0721a2c0.a90d8322.js delete mode 100644 0f425520.6799b1da.js delete mode 100644 1.b73729bd.js delete mode 100644 17896441.3f09010b.js delete mode 100644 1999cd7b.46972a4d.js delete mode 100644 2.0f84ec0c.js delete mode 100644 2.0f84ec0c.js.LICENSE.txt delete mode 100644 230aeb34.d5b08ee8.js delete mode 100644 243cbd97.a8d0e9a3.js delete mode 100644 300a9996.b7a71b7e.js delete mode 100644 35234f08.1da5596a.js delete mode 100644 357fe94d.4d208af0.js delete mode 100644 3b8c55ea.3a181e89.js delete mode 100644 3b8e2d60.0b9656a2.js delete mode 100644 3def9002.60ccd596.js delete mode 100644 3fa022c7.05712c0a.js delete mode 100644 41de83de.9aa82ee1.js delete mode 100644 42326c77.8f4766a3.js delete mode 100644 58.c351a43a.js delete mode 100644 585bdad0.5bd991bb.js delete mode 100644 59.d377417b.js delete mode 100644 5a047177.7631f436.js delete mode 100644 60.0c644c35.js delete mode 100644 63d69a63.0230d4fd.js delete mode 100644 6f497b56.9a644fc6.js delete mode 100644 76aee1e9.8aaa381a.js delete mode 100644 7874e99f.6f7ac14d.js delete mode 100644 7b04b1d5.1a4858e7.js delete mode 100644 7dcecc8d.cbd1bb5d.js delete mode 100644 8c826f25.f531f433.js delete mode 100644 92147208.114088bc.js delete mode 100644 935f2afb.1429e449.js delete mode 100644 94285305.cff6b03f.js delete mode 100644 9ac82b89.4743b5b3.js delete mode 100644 9b9cfcc1.2f147917.js delete mode 100644 9f61b932.8b6b8c4c.js delete mode 100644 a1bbfb14.866a6184.js delete mode 100644 a37c03cb.fe04e9e0.js delete mode 100644 a991188b.f43c20c7.js delete mode 100644 adcdd4d2.86e71566.js delete mode 100644 ade45c9a.82f3357c.js create mode 100644 assets/css/styles.19258e03.css create mode 100644 assets/js/001ca130.df12b21c.js create mode 100644 assets/js/00691219.1534c076.js create mode 100644 assets/js/0721a2c0.ffdc7189.js create mode 100644 assets/js/0f425520.1fb0ef81.js create mode 100644 assets/js/17896441.b571fd1c.js create mode 100644 assets/js/1999cd7b.67af2e9d.js create mode 100644 assets/js/1be78505.7b2cd06e.js create mode 100644 assets/js/1f391b9e.e29f8c90.js create mode 100644 assets/js/230aeb34.9e93a797.js create mode 100644 assets/js/243cbd97.547fc342.js create mode 100644 assets/js/300a9996.f753e41d.js create mode 100644 assets/js/35234f08.75b00d70.js create mode 100644 assets/js/357fe94d.9943f239.js create mode 100644 assets/js/3b8c55ea.cd62c80a.js create mode 100644 assets/js/3b8e2d60.fe4a92a4.js create mode 100644 assets/js/3def9002.0566d6b8.js create mode 100644 assets/js/3fa022c7.d245265c.js create mode 100644 assets/js/41de83de.41ba64ac.js create mode 100644 assets/js/42326c77.8e971b20.js create mode 100644 assets/js/4608.2c7b7ade.js create mode 100644 assets/js/585bdad0.91728ed2.js create mode 100644 assets/js/5897.ca6e53fd.js create mode 100644 assets/js/5a047177.1f48e99a.js create mode 100644 assets/js/63d69a63.bbcebc27.js create mode 100644 assets/js/6f497b56.d1fafb1d.js create mode 100644 assets/js/76aee1e9.bdaa7582.js create mode 100644 assets/js/7874e99f.97b5d23c.js create mode 100644 assets/js/7b04b1d5.d117d167.js create mode 100644 assets/js/7dcecc8d.02aac3e1.js create mode 100644 assets/js/8c826f25.83c9869e.js create mode 100644 assets/js/92147208.dd46efff.js create mode 100644 assets/js/935f2afb.4a3f1d92.js create mode 100644 assets/js/94285305.1f5fc964.js create mode 100644 assets/js/9ac82b89.8b0bb8b5.js create mode 100644 assets/js/9b9cfcc1.b7867f12.js create mode 100644 assets/js/9e4087bc.fcc33365.js create mode 100644 assets/js/9f61b932.2752973c.js create mode 100644 assets/js/a1bbfb14.97805ab6.js create mode 100644 assets/js/a37c03cb.4fbaf920.js create mode 100644 assets/js/a991188b.d0024de2.js create mode 100644 assets/js/adcdd4d2.6f85c9fc.js create mode 100644 assets/js/ade45c9a.a4c9db10.js create mode 100644 assets/js/b89e1cb0.d176f819.js create mode 100644 assets/js/be200c4b.0994fc5b.js create mode 100644 assets/js/cbc8963c.4522119e.js create mode 100644 assets/js/cd4a49c1.9bfe0b83.js create mode 100644 assets/js/cecf159a.90b73e88.js create mode 100644 assets/js/d8b74189.4b70dd77.js create mode 100644 assets/js/de718920.cd0c4637.js create mode 100644 assets/js/e8c74efb.b44be80f.js create mode 100644 assets/js/ea7cbf6d.7aaa7faa.js create mode 100644 assets/js/ecc333f0.bd6ec7e9.js create mode 100644 assets/js/edfc6e1b.25fb710b.js create mode 100644 assets/js/efc9be4b.e7b86efc.js create mode 100644 assets/js/f3976560.2cb9bfe2.js create mode 100644 assets/js/f4c9d322.114701fa.js create mode 100644 assets/js/f5839aac.b034b05a.js create mode 100644 assets/js/f98fc388.3b0c1664.js create mode 100644 assets/js/fb908f49.ebaf85d6.js create mode 100644 assets/js/main.7b57a222.js rename main.089aca77.js.LICENSE.txt => assets/js/main.7b57a222.js.LICENSE.txt (53%) create mode 100644 assets/js/runtime~main.5a1afe5b.js delete mode 100644 b89e1cb0.52daa6be.js delete mode 100644 be200c4b.810bef87.js create mode 100644 blog/archive/index.html delete mode 100644 cbc8963c.7f614d2e.js delete mode 100644 cd4a49c1.2aa6e525.js delete mode 100644 cecf159a.4dd0cced.js delete mode 100644 de718920.748e7f46.js delete mode 100644 e8c74efb.b5ed146a.js delete mode 100644 ea7cbf6d.22bf10e4.js delete mode 100644 ecc333f0.d4801f2e.js delete mode 100644 edfc6e1b.d363ab28.js delete mode 100644 efc9be4b.54e8580a.js delete mode 100644 f3976560.44bda334.js delete mode 100644 f4c9d322.d8a15a21.js delete mode 100644 f5839aac.17917aea.js delete mode 100644 f98fc388.dff58a75.js delete mode 100644 fb908f49.70b8b3c4.js delete mode 100644 main.089aca77.js delete mode 100644 runtime~main.ae845585.js delete mode 100644 styles.b2862157.css delete mode 100644 styles.f494e809.js diff --git a/001ca130.446eb9c9.js b/001ca130.446eb9c9.js deleted file mode 100644 index 41750bdd..00000000 --- a/001ca130.446eb9c9.js +++ /dev/null @@ -1 +0,0 @@ -(window.webpackJsonp=window.webpackJsonp||[]).push([[3],{116:function(e,t,n){"use strict";n.d(t,"a",(function(){return l})),n.d(t,"b",(function(){return b}));var r=n(0),o=n.n(r);function i(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function c(e){for(var t=1;t=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var u=o.a.createContext({}),p=function(e){var t=o.a.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},l=function(e){var t=p(e.components);return o.a.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},h=o.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,i=e.originalType,a=e.parentName,u=s(e,["components","mdxType","originalType","parentName"]),l=p(n),h=r,b=l["".concat(a,".").concat(h)]||l[h]||d[h]||i;return n?o.a.createElement(b,c(c({ref:t},u),{},{components:n})):o.a.createElement(b,c({ref:t},u))}));function b(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var i=n.length,a=new Array(i);a[0]=h;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:r,a[1]=c;for(var u=2;u=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var l=o.a.createContext({}),s=function(e){var t=o.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},u=function(e){var t=s(e.components);return o.a.createElement(l.Provider,{value:t},e.children)},m={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,a=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),u=s(n),b=r,d=u["".concat(i,".").concat(b)]||u[b]||m[b]||a;return n?o.a.createElement(d,c(c({ref:t},l),{},{components:n})):o.a.createElement(d,c({ref:t},l))}));function d(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var a=n.length,i=new Array(a);i[0]=b;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:r,i[1]=c;for(var l=2;l=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var l=o.a.createContext({}),u=function(e){var t=o.a.useContext(l),r=t;return e&&(r="function"==typeof e?e(t):c(c({},t),e)),r},b=function(e){var t=u(e.components);return o.a.createElement(l.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},d=o.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,a=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),b=u(r),d=n,m=b["".concat(i,".").concat(d)]||b[d]||s[d]||a;return r?o.a.createElement(m,c(c({ref:t},l),{},{components:r})):o.a.createElement(m,c({ref:t},l))}));function m(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var a=r.length,i=new Array(a);i[0]=d;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:n,i[1]=c;for(var l=2;l&1 | grep OK\noauth2-proxy-x.y.z.linux-amd64: OK\n")),Object(a.b)("ol",{start:2},Object(a.b)("li",{parentName:"ol"},Object(a.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/7.0.x/configuration/oauth_provider"}),"Select a Provider and Register an OAuth Application with a Provider")),Object(a.b)("li",{parentName:"ol"},Object(a.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/7.0.x/configuration/overview"}),"Configure OAuth2 Proxy using config file, command line options, or environment variables")),Object(a.b)("li",{parentName:"ol"},Object(a.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/7.0.x/configuration/tls"}),"Configure SSL or Deploy behind a SSL endpoint")," (example provided for Nginx)")))}u.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/0f425520.6799b1da.js b/0f425520.6799b1da.js deleted file mode 100644 index 267492ab..00000000 --- a/0f425520.6799b1da.js +++ /dev/null @@ -1 +0,0 @@ -(window.webpackJsonp=window.webpackJsonp||[]).push([[6],{116:function(e,t,a){"use strict";a.d(t,"a",(function(){return p})),a.d(t,"b",(function(){return j}));var n=a(0),r=a.n(n);function b(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function l(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function i(e){for(var t=1;t=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var b=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var o=r.a.createContext({}),d=function(e){var t=r.a.useContext(o),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},p=function(e){var t=d(e.components);return r.a.createElement(o.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},O=r.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,b=e.originalType,l=e.parentName,o=c(e,["components","mdxType","originalType","parentName"]),p=d(a),O=n,j=p["".concat(l,".").concat(O)]||p[O]||s[O]||b;return a?r.a.createElement(j,i(i({ref:t},o),{},{components:a})):r.a.createElement(j,i({ref:t},o))}));function j(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var b=a.length,l=new Array(b);l[0]=O;var i={};for(var c in t)hasOwnProperty.call(t,c)&&(i[c]=t[c]);i.originalType=e,i.mdxType="string"==typeof e?e:n,l[1]=i;for(var o=2;oauth_request directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",children:[]},{value:"Configuring for use with the Traefik (v2) ForwardAuth middleware",id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware",children:[{value:"ForwardAuth with 401 errors middleware",id:"forwardauth-with-401-errors-middleware",children:[]},{value:"ForwardAuth with static upstreams configuration",id:"forwardauth-with-static-upstreams-configuration",children:[]}]}],p={rightToc:d};function s(e){var t=e.components,a=Object(r.a)(e,["components"]);return Object(b.b)("wrapper",Object(n.a)({},p,a,{components:t,mdxType:"MDXLayout"}),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#command-line-options"}),"command line options"),", ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#environment-variables"}),"environment variables")," or ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file")," (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."),Object(b.b)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),Object(b.b)("p",null,"To generate a strong cookie secret use one of the below commands:"),Object(b.b)(l.a,{defaultValue:"python",values:[{label:"Python",value:"python"},{label:"Bash",value:"bash"},{label:"OpenSSL",value:"openssl"},{label:"PowerShell",value:"powershell"},{label:"Terraform",value:"terraform"}],mdxType:"Tabs"},Object(b.b)(i.a,{value:"python",mdxType:"TabItem"},Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-shell"}),"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'\n"))),Object(b.b)(i.a,{value:"bash",mdxType:"TabItem"},Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-shell"}),"cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1 | base64\n"))),Object(b.b)(i.a,{value:"openssl",mdxType:"TabItem"},Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-shell"}),"openssl rand -base64 32 | tr -- '+/' '-_'\n"))),Object(b.b)(i.a,{value:"powershell",mdxType:"TabItem"},Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-shell"}),'# Add System.Web assembly to session, just in case\nAdd-Type -AssemblyName System.Web\n[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")\n'))),Object(b.b)(i.a,{value:"terraform",mdxType:"TabItem"},Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-shell"}),'# Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret\nresource "random_password" "cookie_secret" {\n length = 32\n override_special = "-_"\n}\n')))),Object(b.b)("h3",{id:"config-file"},"Config File"),Object(b.b)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),Object(b.b)("p",null,"An example ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"}),"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",Object(b.b)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),Object(b.b)("h3",{id:"command-line-options"},"Command Line Options"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Option"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Default"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--acr-values")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"optional, see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"}),"docs")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--approval-prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth approval_prompt"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"force"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log authentication attempts"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for authentication log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate against emails via file (one per line)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--azure-tenant")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"go to a tenant-specific or common (tenant-independent) endpoint."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"common"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--basic-auth-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the password to set when passing the HTTP Basic Auth header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-id")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client ID, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the file with OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--config")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to config file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Optional cookie domains to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-expire")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"expire timeframe for cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"168h0m0s")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-httponly")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HttpOnly cookie flag"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the name of the cookie that the oauth_proxy creates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"an optional cookie path to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"/poc/"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-refresh")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"refresh the cookie after this duration; ",Object(b.b)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote1"}),"1"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the seed string for secure cookies (optionally base64 encoded)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secure")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://owasp.org/www-community/controls/SecureFlag"}),"secure (HTTPS only) cookie flag")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-samesite")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set SameSite cookie attribute (",Object(b.b)("inlineCode",{parentName:"td"},'"lax"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"strict"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"none"'),", or ",Object(b.b)("inlineCode",{parentName:"td"},'""'),")."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--custom-templates-dir")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to custom html templates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--custom-sign-in-logo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),'path or a URL to an custom image for the sign_in page logo. Use \\"-\\" to disable default logo.'),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"display username / password login form if an htpasswd file is provided"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--email-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate emails with the specified domain (may be given multiple times). Use ",Object(b.b)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--errors-to-info-log")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"redirects error-level logging to default log channel instead of stderr"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"if ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",Object(b.b)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",Object(b.b)("inlineCode",{parentName:"td"},"iss"),", ",Object(b.b)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--exclude-logging-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"comma separated list of paths to exclude from logging, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"/ping,/path2"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--flush-interval")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"period between flushing response buffers when streaming responses"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"1s"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--force-https")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enforce https redirect"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"false"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--force-json-errors")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"force JSON errors instead of HTTP error pages or redirects"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"false"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--banner")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) banner string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--footer")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) footer string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-org")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this organisation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-team")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these teams (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to collaborators of this repository formatted as ",Object(b.b)("inlineCode",{parentName:"td"},"orgname/repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the token to use when verifying repository collaborators (must have push access to the repository)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gitlab-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these groups (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gitlab-projects")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these projects (may be given multiple times) formatted as ",Object(b.b)("inlineCode",{parentName:"td"},"orgname/repo=accesslevel"),". Access level should be a value matching ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://docs.gitlab.com/ee/api/members.html#valid-access-levels"}),"Gitlab access levels"),", defaulted to 20 if absent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-admin-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the google admin to impersonate for api calls"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this google group (may be given multiple times)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-service-account-json")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the path to the service account json credentials"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--htpasswd-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"additionally authenticate against a htpasswd file. Entries must be created with ",Object(b.b)("inlineCode",{parentName:"td"},"htpasswd -B")," for bcrypt encryption"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--htpasswd-user-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the groups to be set on sessions for htpasswd users"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--http-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"[http://]:")," or ",Object(b.b)("inlineCode",{parentName:"td"},"unix://")," to listen on for HTTP clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"127.0.0.1:4180"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--https-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},":")," to listen on for HTTPS clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'":443"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-compress")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Should rotated log files be compressed using gzip"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-filename")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File to log requests to, empty for ",Object(b.b)("inlineCode",{parentName:"td"},"stdout")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (stdout)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-local-time")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Use local time in log files and backup filenames instead of UTC"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true (local time)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-age")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of days to retain old log files"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"7")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-backups")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of old log files to retain; 0 to disable"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-size")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum size in megabytes of the log file before rotation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"100")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"private key in PEM format used to sign JWT, so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},'--jwt-key="${OAUTH2_PROXY_JWT_KEY}"'),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to the private key file in PEM format used to sign the JWT so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem"),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--login-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authentication endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-allow-unverified-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"don't fail if an email address in an id_token is not verified"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-issuer-verification")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-nonce")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip verifying the OIDC ID Token's nonce claim"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-issuer-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OpenID Connect issuer URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://accounts.google.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OIDC JWKS URI for token verification; required if OIDC discovery is disabled"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-email-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which OIDC claim contains the user's email"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"email"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-groups-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which OIDC claim contains the user groups"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"groups"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-audience-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which OIDC claim contains the audience"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"aud"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-extra-audience")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"additional audiences which are allowed to pass verification"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"[]"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")," this adds the X-Auth-Request-Access-Token header to the response"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OIDC IDToken to upstream via Authorization Bearer header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prefer-email-to-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-host-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass the request Host Header to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--profile-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Profile access endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"}),"OIDC prompt"),"; if present, ",Object(b.b)("inlineCode",{parentName:"td"},"approval-prompt")," is ignored"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth provider"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"google")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-ca-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-display-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Override the provider's name with the given string; used for the sign-in page"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"(depends on provider)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the ping endpoint that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/ping"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-user-agent")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"a User-Agent that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (don't check user agent)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--metrics-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the address prometheus metrics will be scraped from"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-prefix")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the url root path that this proxy should be nested under (e.g. /",Object(b.b)("inlineCode",{parentName:"td"},"/sign_in"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/oauth2"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-websockets")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enables WebSocket proxying"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pubjwk-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"JWK pubkey access endpoint: required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Header used to determine the real IP of the client, requires ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"X-Real-IP")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Token redemption endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redirect-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Redirect URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://internalapp.yourcompany.com/oauth2/callback"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis cluster connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"URL of redis server for redis session storage (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis password. Applicable for all Redis configurations. Will override any password set in ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel master name. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis sentinel connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis cluster. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis via sentinels. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-id-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Request header to use as the request ID in logging"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"X-Request-Id")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for request log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--resource")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The resource that is protected (Azure AD only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--scope")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth scope specification"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-cookie-minimal")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-store-type")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"/oauth2-proxy/docs/next/configuration/session_storage"}),"Session data storage backend"),"; redis or cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"cookie")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token"),", X-Auth-Request-Access-Token is added to response headers."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set Authorization Bearer response header (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HTTP Basic Auth information in response (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--show-debug-on-error")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--signature-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GAP-Signature request signature key (algorithm:secretkey)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--silence-ping-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"disable logging of requests to ping endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-preflight")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip authentication for OPTIONS requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-regex")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"(DEPRECATED for ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-route"),") bypass authentication for requests paths that match (may be given multiple times)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-route")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-strip-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strips ",Object(b.b)("inlineCode",{parentName:"td"},"X-Forwarded-*")," style authentication headers & ",Object(b.b)("inlineCode",{parentName:"td"},"Authorization")," header if they would be set by oauth2-proxy"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip requests that have verified JWT bearer tokens (the token must have ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields"}),Object(b.b)("inlineCode",{parentName:"a"},"aud"))," that matches this client id or one of the extras from ",Object(b.b)("inlineCode",{parentName:"td"},"extra-jwt-issuers"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-oidc-discovery")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass OIDC endpoint discovery. ",Object(b.b)("inlineCode",{parentName:"td"},"--login-url"),", ",Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")," must be configured in this case"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-provider-button")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip sign-in-page to directly reach the next step: oauth/start"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS providers"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-upstream-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS upstreams"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log standard runtime information"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for standard log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-cert-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to certificate file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to private key file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-min-version")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"minimum TLS version that is acceptable, either ",Object(b.b)("inlineCode",{parentName:"td"},'"TLS1.2"')," or ",Object(b.b)("inlineCode",{parentName:"td"},'"TLS1.3"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"TLS1.2"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--upstream")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the http url(s) of the upstream endpoint, file:// paths for static files or ",Object(b.b)("inlineCode",{parentName:"td"},"static://")," for static response. Routing is based on the path"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--allowed-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this group (may be given multiple times)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--allowed-role")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--validate-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Access token validation endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--version")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"n/a"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"print version string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--whitelist-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allowed domains for redirection after authentication. Prefix domain with a ",Object(b.b)("inlineCode",{parentName:"td"},".")," or a ",Object(b.b)("inlineCode",{parentName:"td"},"*.")," to allow subdomains (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".example.com"),", ",Object(b.b)("inlineCode",{parentName:"td"},"*.example.com"),")","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote2"}),"2"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--trusted-ip")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," and optionally ",Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")," this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))))),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote1"},"1"),"]",": Only these providers support ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-refresh"),": GitLab, Google and OIDC"),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote2"},"2"),"]",": When using the ",Object(b.b)("inlineCode",{parentName:"p"},"whitelist-domain")," option, any domain prefixed with a ",Object(b.b)("inlineCode",{parentName:"p"},".")," or a ",Object(b.b)("inlineCode",{parentName:"p"},"*.")," will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:8080"),". To allow any port, use ",Object(b.b)("inlineCode",{parentName:"p"},"*"),": ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:*"),"."),Object(b.b)("p",null,"See below for provider specific options"),Object(b.b)("h3",{id:"upstreams-configuration"},"Upstreams Configuration"),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/")," for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/some/path/")," then it will only be requests that start with ",Object(b.b)("inlineCode",{parentName:"p"},"/some/path/")," which are forwarded to the upstream."),Object(b.b)("p",null,"Static file paths are configured as a file:// URL. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/")," will serve the files from that directory at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/var/www/static/"),", which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/#/static/")," will make ",Object(b.b)("inlineCode",{parentName:"p"},"/var/www/static/")," available at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/static/"),"."),Object(b.b)("p",null,"Multiple upstreams can either be configured by supplying a comma separated list to the ",Object(b.b)("inlineCode",{parentName:"p"},"--upstream")," parameter, supplying the parameter multiple times or providing a list in the ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file"),". When multiple upstreams are used routing to them will be based on the path they are set up with."),Object(b.b)("h3",{id:"environment-variables"},"Environment variables"),Object(b.b)("p",null,"Every command line argument can be specified as an environment variable by\nprefixing it with ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_"),", capitalising it, and replacing hyphens (",Object(b.b)("inlineCode",{parentName:"p"},"-"),")\nwith underscores (",Object(b.b)("inlineCode",{parentName:"p"},"_"),"). If the argument can be specified multiple times, the\nenvironment variable should be plural (trailing ",Object(b.b)("inlineCode",{parentName:"p"},"S"),")."),Object(b.b)("p",null,"This is particularly useful for storing secrets outside of a configuration file\nor the command line."),Object(b.b)("p",null,"For example, the ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-secret")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_COOKIE_SECRET"),",\nand the ",Object(b.b)("inlineCode",{parentName:"p"},"--email-domain")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_EMAIL_DOMAINS"),"."),Object(b.b)("h2",{id:"logging-configuration"},"Logging Configuration"),Object(b.b)("p",null,"By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the ",Object(b.b)("inlineCode",{parentName:"p"},"--logging-filename")," command."),Object(b.b)("p",null,"If logging to a file you can also configure the maximum file size (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-size"),"), age (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-age"),"), max backup logs (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-backups"),"), and if backup logs should be compressed (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-compress"),")."),Object(b.b)("p",null,"There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging"),", ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging"),", and ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging"),"."),Object(b.b)("p",null,"Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log."),Object(b.b)("p",null,"Logging of requests to the ",Object(b.b)("inlineCode",{parentName:"p"},"/ping")," endpoint (or using ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-user-agent"),") can be disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--silence-ping-logging")," reducing log volume. This flag appends the ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-path")," to ",Object(b.b)("inlineCode",{parentName:"p"},"--exclude-logging-paths"),"."),Object(b.b)("h3",{id:"auth-log-format"},"Auth Log Format"),Object(b.b)("p",null,"Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{})," - - [19/Mar/2015:17:20:19 -0400] [] \n")),Object(b.b)("p",null,"The status block will contain one of the below strings:"),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthSuccess")," If a user has authenticated successfully by any method"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthFailure")," If the user failed to authenticate explicitly"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthError")," If there was an unexpected error during authentication")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for auth logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authenticated via OAuth2"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the auth attempt.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestID"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"00010203-0405-4607-8809-0a0b0c0d0e0f"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request ID pulled from the ",Object(b.b)("inlineCode",{parentName:"td"},"--request-id-header"),". Random UUID if empty")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Status"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"AuthSuccess"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The status of the auth request. See above for details.")))),Object(b.b)("h3",{id:"request-log-format"},"Request Log Format"),Object(b.b)("p",null,"HTTP request logs will output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),' - - [19/Mar/2015:17:20:19 -0400] GET "/path/" HTTP/1.1 "" \n')),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}\n")),Object(b.b)("p",null,"Available variables for request logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestDuration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0.001"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The time in seconds that a request took to process.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestID"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"00010203-0405-4607-8809-0a0b0c0d0e0f"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request ID pulled from the ",Object(b.b)("inlineCode",{parentName:"td"},"--request-id-header"),". Random UUID if empty")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestURI"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),'"/oauth2/auth"'),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The URI path of the request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ResponseSize"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"12"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The size in bytes of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"StatusCode"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"200"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The HTTP status code of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The upstream data of the HTTP request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")))),Object(b.b)("h3",{id:"standard-log-format"},"Standard Log Format"),Object(b.b)("p",null,"All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[19/Mar/2015:17:20:19 -0400] [main.go:40] \n")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging-format")," flag. The default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[{{.Timestamp}}] [{{.File}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for standard logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"main.go:40"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The file and line number of the logging statement.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP: listening on 127.0.0.1:4180"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the log statement.")))),Object(b.b)("h2",{id:"configuring-for-use-with-the-nginx-auth_request-directive"},"Configuring for use with the Nginx ",Object(b.b)("inlineCode",{parentName:"h2"},"auth_request")," directive"),Object(b.b)("p",null,"The ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"http://nginx.org/en/docs/http/ngx_http_auth_request_module.html"}),"Nginx ",Object(b.b)("inlineCode",{parentName:"a"},"auth_request")," directive")," allows Nginx to authenticate requests via the oauth2-proxy's ",Object(b.b)("inlineCode",{parentName:"p"},"/auth")," endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-nginx"}),'server {\n listen 443 ssl;\n server_name ...;\n include ssl/ssl.conf;\n\n location /oauth2/ {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n proxy_set_header X-Auth-Request-Redirect $request_uri;\n # or, if you are handling multiple domains:\n # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;\n }\n location = /oauth2/auth {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n # nginx auth_request includes headers but not body\n proxy_set_header Content-Length "";\n proxy_pass_request_body off;\n }\n\n location / {\n auth_request /oauth2/auth;\n error_page 401 = /oauth2/sign_in;\n\n # pass information via X-User and X-Email headers to backend,\n # requires running with --set-xauthrequest flag\n auth_request_set $user $upstream_http_x_auth_request_user;\n auth_request_set $email $upstream_http_x_auth_request_email;\n proxy_set_header X-User $user;\n proxy_set_header X-Email $email;\n\n # if you enabled --pass-access-token, this will pass the token to the backend\n auth_request_set $token $upstream_http_x_auth_request_access_token;\n proxy_set_header X-Access-Token $token;\n\n # if you enabled --cookie-refresh, this is needed for it to work with auth_request\n auth_request_set $auth_cookie $upstream_http_set_cookie;\n add_header Set-Cookie $auth_cookie;\n\n # When using the --set-authorization-header flag, some provider\'s cookies can exceed the 4kb\n # limit and so the OAuth2 Proxy splits these into multiple parts.\n # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\n # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\n auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;\n\n # Extract the Cookie attributes from the first Set-Cookie header and append them\n # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\n if ($auth_cookie ~* "(; .*)") {\n set $auth_cookie_name_0 $auth_cookie;\n set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";\n }\n\n # Send both Set-Cookie headers now if there was a second part\n if ($auth_cookie_name_upstream_1) {\n add_header Set-Cookie $auth_cookie_name_0;\n add_header Set-Cookie $auth_cookie_name_1;\n }\n\n proxy_pass http://backend/;\n # or "root /path/to/site;" or "fastcgi_pass ..." etc\n }\n}\n')),Object(b.b)("p",null,"When you use ingress-nginx in Kubernetes, you MUST use ",Object(b.b)("inlineCode",{parentName:"p"},"kubernetes/ingress-nginx")," (which includes the Lua module) and the following configuration snippet for your ",Object(b.b)("inlineCode",{parentName:"p"},"Ingress"),".\nVariables set with ",Object(b.b)("inlineCode",{parentName:"p"},"auth_request_set")," are not ",Object(b.b)("inlineCode",{parentName:"p"},"set"),"-able in plain nginx config when the location is processed via ",Object(b.b)("inlineCode",{parentName:"p"},"proxy_pass")," and then may only be processed by Lua.\nNote that ",Object(b.b)("inlineCode",{parentName:"p"},"nginxinc/kubernetes-ingress")," does not include the Lua module."),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'nginx.ingress.kubernetes.io/auth-response-headers: Authorization\nnginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri\nnginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth\nnginx.ingress.kubernetes.io/configuration-snippet: |\n auth_request_set $name_upstream_1 $upstream_cookie_name_1;\n\n access_by_lua_block {\n if ngx.var.name_upstream_1 ~= "" then\n ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")\n end\n }\n')),Object(b.b)("p",null,"It is recommended to use ",Object(b.b)("inlineCode",{parentName:"p"},"--session-store-type=redis")," when expecting large sessions/OIDC tokens (",Object(b.b)("em",{parentName:"p"},"e.g.")," with MS Azure)."),Object(b.b)("p",null,"You have to substitute ",Object(b.b)("em",{parentName:"p"},"name"),' with the actual cookie name you configured via --cookie-name parameter. If you don\'t set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".'),Object(b.b)("h2",{id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware"},"Configuring for use with the Traefik (v2) ",Object(b.b)("inlineCode",{parentName:"h2"},"ForwardAuth")," middleware"),Object(b.b)("p",null,Object(b.b)("strong",{parentName:"p"},"This option requires ",Object(b.b)("inlineCode",{parentName:"strong"},"--reverse-proxy")," option to be set.")),Object(b.b)("h3",{id:"forwardauth-with-401-errors-middleware"},"ForwardAuth with 401 errors middleware"),Object(b.b)("p",null,"The ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"}),"Traefik v2 ",Object(b.b)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," allows Traefik to authenticate requests via the oauth2-proxy's ",Object(b.b)("inlineCode",{parentName:"p"},"/oauth2/auth")," endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'http:\n routers:\n a-service:\n rule: "Host(`a-service.example.com`)"\n service: a-service-backend\n middlewares:\n - oauth-errors\n - oauth-auth\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth:\n rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n oauth-errors:\n errors:\n status:\n - "401-403"\n service: oauth-backend\n query: "/oauth2/sign_in"\n')),Object(b.b)("h3",{id:"forwardauth-with-static-upstreams-configuration"},"ForwardAuth with static upstreams configuration"),Object(b.b)("p",null,"Redirect to sign_in functionality provided without the use of ",Object(b.b)("inlineCode",{parentName:"p"},"errors")," middleware with ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"}),"Traefik v2 ",Object(b.b)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," pointing to oauth2-proxy service's ",Object(b.b)("inlineCode",{parentName:"p"},"/")," endpoint"),Object(b.b)("p",null,Object(b.b)("strong",{parentName:"p"},"Following options need to be set on ",Object(b.b)("inlineCode",{parentName:"strong"},"oauth2-proxy"),":")),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"--upstream=static://202"),": Configures a static response for authenticated sessions"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"--reverse-proxy=true"),": Enables the use of ",Object(b.b)("inlineCode",{parentName:"li"},"X-Forwarded-*")," headers to determine redirects correctly")),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'http:\n routers:\n a-service-route-1:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n a-service-route-2:\n rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-wo-redirect # unauthenticated session will return a 401\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n services-oauth2-route:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth2-proxy-route:\n rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n b-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.3:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth-redirect:\n forwardAuth:\n address: https://oauth.example.com/\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n oauth-auth-wo-redirect:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n')),Object(b.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"If you set up your OAuth2 provider to rotate your client secret, you can use the ",Object(b.b)("inlineCode",{parentName:"p"},"client-secret-file")," option to reload the secret when it is updated."))))}s.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/1.b73729bd.js b/1.b73729bd.js deleted file mode 100644 index 49eeb7b1..00000000 --- a/1.b73729bd.js +++ /dev/null @@ -1 +0,0 @@ -(window.webpackJsonp=window.webpackJsonp||[]).push([[1],{117:function(e,t,n){"use strict";function r(e){var t,n,o="";if("string"==typeof e||"number"==typeof e)o+=e;else if("object"==typeof e)if(Array.isArray(e))for(t=0;t0)&&(l.unobserve(t),l.disconnect(),n())}))}))).observe(t))},to:C||""},d&&{isActive:b,activeClassName:h}))}},126:function(e,t,n){"use strict";n.d(t,"b",(function(){return i})),n.d(t,"a",(function(){return a}));var r=n(119),o=n(128);function i(){var e=Object(r.a)().siteConfig,t=(e=void 0===e?{}:e).baseUrl,n=void 0===t?"/":t,i=e.url;return{withBaseUrl:function(e,t){return function(e,t,n,r){var i=void 0===r?{}:r,a=i.forcePrependBaseUrl,u=void 0!==a&&a,c=i.absolute,s=void 0!==c&&c;if(!n)return n;if(n.startsWith("#"))return n;if(Object(o.b)(n))return n;if(u)return t+n;var f=n.startsWith(t)?n:t+n.replace(/^\//,"");return s?e+f:f}(i,n,e,t)}}}function a(e,t){return void 0===t&&(t={}),(0,i().withBaseUrl)(e,t)}},127:function(e,t,n){"use strict";n.r(t);var r=n(13);n.d(t,"MemoryRouter",(function(){return r.d})),n.d(t,"Prompt",(function(){return r.f})),n.d(t,"Redirect",(function(){return r.g})),n.d(t,"Route",(function(){return r.h})),n.d(t,"Router",(function(){return r.i})),n.d(t,"StaticRouter",(function(){return r.j})),n.d(t,"Switch",(function(){return r.k})),n.d(t,"generatePath",(function(){return r.l})),n.d(t,"matchPath",(function(){return r.m})),n.d(t,"useHistory",(function(){return r.n})),n.d(t,"useLocation",(function(){return r.o})),n.d(t,"useParams",(function(){return r.p})),n.d(t,"useRouteMatch",(function(){return r.q})),n.d(t,"withRouter",(function(){return r.r})),n.d(t,"BrowserRouter",(function(){return r.a})),n.d(t,"HashRouter",(function(){return r.b})),n.d(t,"Link",(function(){return r.c})),n.d(t,"NavLink",(function(){return r.e}))},128:function(e,t,n){"use strict";function r(e){return!0===/^(\w*:|\/\/)/.test(e)}function o(e){return void 0!==e&&!r(e)}n.d(t,"b",(function(){return r})),n.d(t,"a",(function(){return o}))},132:function(e,t,n){"use strict";n.d(t,"a",(function(){return a}));var r=n(0),o=n(146),i=n(122);function a(e){void 0===e&&(e="default");var t=Object(i.useDocsData)(e),n=Object(o.b)(),a=n[0],u=n[1],c=a[e].preferredVersionName;return{preferredVersion:c?t.versions.find((function(e){return e.name===c})):null,savePreferredVersionName:Object(r.useCallback)((function(t){u.savePreferredVersion(e,t)}),[u])}}},133:function(e,t,n){"use strict";var r=n(0),o=n.n(r),i=n(158);t.a=function(e){return o.a.createElement(i.a,Object.assign({},e))}},146:function(e,t,n){"use strict";n.d(t,"a",(function(){return p})),n.d(t,"b",(function(){return h}));var r=n(0),o=n.n(r),i=n(118),a=n(122),u=!!a.useAllDocsData,c=function(e){return"docs-preferred-version-"+e},s={save:function(e,t,n){"none"===t||window.localStorage.setItem(c(e),n)},read:function(e,t){return"none"===t?null:window.localStorage.getItem(c(e))},clear:function(e,t){"none"===t||window.localStorage.removeItem(c(e))}};function f(e){var t=e.pluginIds,n=e.versionPersistence,r=e.allDocsData;var o={};return t.forEach((function(e){o[e]=function(e){var t=s.read(e,n);return r[e].versions.some((function(e){return e.name===t}))?{preferredVersionName:t}:(s.clear(e,n),{preferredVersionName:null})}(e)})),o}function l(){var e=Object(a.useAllDocsData)(),t=Object(i.a)().docs.versionPersistence,n=Object(r.useMemo)((function(){return Object.keys(e)}),[e]),o=Object(r.useState)((function(){return function(e){var t={};return e.forEach((function(e){t[e]={preferredVersionName:null}})),t}(n)})),u=o[0],c=o[1];return Object(r.useEffect)((function(){c(f({allDocsData:e,versionPersistence:t,pluginIds:n}))}),[e,t,n]),[u,Object(r.useMemo)((function(){return{savePreferredVersion:function(e,n){s.save(e,t,n),c((function(t){var r;return Object.assign({},t,((r={})[e]={preferredVersionName:n},r))}))}}}),[c])]}var d=Object(r.createContext)(null);function p(e){var t=e.children;return u?o.a.createElement(v,null,t):o.a.createElement(o.a.Fragment,null,t)}function v(e){var t=e.children,n=l();return o.a.createElement(d.Provider,{value:n},t)}function h(){var e=Object(r.useContext)(d);if(!e)throw new Error("Can't find docs preferred context, maybe you forgot to use the DocsPreferredVersionContextProvider ?");return e}},153:function(e,t,n){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.useDocVersionSuggestions=t.useActiveDocContext=t.useActiveVersion=t.useLatestVersion=t.useVersions=t.useActivePluginAndVersion=t.useActivePlugin=t.useDocsData=t.useAllDocsData=void 0;var r=n(127),o=n(154),i=n(155);t.useAllDocsData=function(){return o.useAllPluginInstancesData("docusaurus-plugin-content-docs")},t.useDocsData=function(e){return o.usePluginData("docusaurus-plugin-content-docs",e)},t.useActivePlugin=function(e){void 0===e&&(e={});var n=t.useAllDocsData(),o=r.useLocation().pathname;return i.getActivePlugin(n,o,e)},t.useActivePluginAndVersion=function(e){void 0===e&&(e={});var n=t.useActivePlugin(e),o=r.useLocation().pathname;if(n)return{activePlugin:n,activeVersion:i.getActiveVersion(n.pluginData,o)}},t.useVersions=function(e){return t.useDocsData(e).versions},t.useLatestVersion=function(e){var n=t.useDocsData(e);return i.getLatestVersion(n)},t.useActiveVersion=function(e){var n=t.useDocsData(e),o=r.useLocation().pathname;return i.getActiveVersion(n,o)},t.useActiveDocContext=function(e){var n=t.useDocsData(e),o=r.useLocation().pathname;return i.getActiveDocContext(n,o)},t.useDocVersionSuggestions=function(e){var n=t.useDocsData(e),o=r.useLocation().pathname;return i.getDocVersionSuggestions(n,o)}},154:function(e,t,n){"use strict";n.r(t),n.d(t,"default",(function(){return o})),n.d(t,"useAllPluginInstancesData",(function(){return i})),n.d(t,"usePluginData",(function(){return a}));var r=n(119);function o(){var e=Object(r.a)().globalData;if(!e)throw new Error("Docusaurus global data not found");return e}function i(e){var t=o()[e];if(!t)throw new Error("Docusaurus plugin global data not found for pluginName="+e);return t}function a(e,t){void 0===t&&(t="default");var n=i(e)[t];if(!n)throw new Error("Docusaurus plugin global data not found for pluginName="+e+" and pluginId="+t);return n}},155:function(e,t,n){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.getDocVersionSuggestions=t.getActiveDocContext=t.getActiveVersion=t.getLatestVersion=t.getActivePlugin=void 0;var r=n(127);t.getActivePlugin=function(e,t,n){void 0===n&&(n={});var o=Object.entries(e).find((function(e){e[0];var n=e[1];return!!r.matchPath(t,{path:n.path,exact:!1,strict:!1})})),i=o?{pluginId:o[0],pluginData:o[1]}:void 0;if(!i&&n.failfast)throw new Error("Can't find active docs plugin for pathname="+t+", while it was expected to be found. Maybe you tried to use a docs feature that can only be used on a docs-related page? Existing docs plugin paths are: "+Object.values(e).map((function(e){return e.path})).join(", "));return i},t.getLatestVersion=function(e){return e.versions.find((function(e){return e.isLast}))},t.getActiveVersion=function(e,n){var o=t.getLatestVersion(e);return[].concat(e.versions.filter((function(e){return e!==o})),[o]).find((function(e){return!!r.matchPath(n,{path:e.path,exact:!1,strict:!1})}))},t.getActiveDocContext=function(e,n){var o,i,a=t.getActiveVersion(e,n),u=null==a?void 0:a.docs.find((function(e){return!!r.matchPath(n,{path:e.path,exact:!0,strict:!1})}));return{activeVersion:a,activeDoc:u,alternateDocVersions:u?(o=u.id,i={},e.versions.forEach((function(e){e.docs.forEach((function(t){t.id===o&&(i[e.name]=t)}))})),i):{}}},t.getDocVersionSuggestions=function(e,n){var r=t.getLatestVersion(e),o=t.getActiveDocContext(e,n),i=o.activeVersion!==r;return{latestDocSuggestion:i?null==o?void 0:o.alternateDocVersions[r.name]:void 0,latestVersionSuggestion:i?r:void 0}}},158:function(e,t,n){"use strict";(function(e){n.d(t,"a",(function(){return be}));var r,o,i,a,u=n(7),c=n.n(u),s=n(159),f=n.n(s),l=n(160),d=n.n(l),p=n(0),v=n.n(p),h=n(21),b=n.n(h),g="bodyAttributes",y="htmlAttributes",m="titleAttributes",w={BASE:"base",BODY:"body",HEAD:"head",HTML:"html",LINK:"link",META:"meta",NOSCRIPT:"noscript",SCRIPT:"script",STYLE:"style",TITLE:"title"},T=(Object.keys(w).map((function(e){return w[e]})),"charset"),O="cssText",A="href",C="http-equiv",j="innerHTML",E="itemprop",S="name",P="property",D="rel",L="src",x="target",k={accesskey:"accessKey",charset:"charSet",class:"className",contenteditable:"contentEditable",contextmenu:"contextMenu","http-equiv":"httpEquiv",itemprop:"itemProp",tabindex:"tabIndex"},I="defaultTitle",V="defer",N="encodeSpecialCharacters",M="onChangeClientState",R="titleTemplate",_=Object.keys(k).reduce((function(e,t){return e[k[t]]=t,e}),{}),B=[w.NOSCRIPT,w.SCRIPT,w.STYLE],H="data-react-helmet",U="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},q=function(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")},F=function(){function e(e,t){for(var n=0;n=0||Object.prototype.hasOwnProperty.call(e,r)&&(n[r]=e[r]);return n},z=function(e,t){if(!e)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return!t||"object"!=typeof t&&"function"!=typeof t?e:t},K=function(e){var t=!(arguments.length>1&&void 0!==arguments[1])||arguments[1];return!1===t?String(e):String(e).replace(/&/g,"&").replace(//g,">").replace(/"/g,""").replace(/'/g,"'")},J=function(e){var t=Z(e,w.TITLE),n=Z(e,R);if(n&&t)return n.replace(/%s/g,(function(){return Array.isArray(t)?t.join(""):t}));var r=Z(e,I);return t||r||void 0},$=function(e){return Z(e,M)||function(){}},G=function(e,t){return t.filter((function(t){return void 0!==t[e]})).map((function(t){return t[e]})).reduce((function(e,t){return Y({},e,t)}),{})},Q=function(e,t){return t.filter((function(e){return void 0!==e[w.BASE]})).map((function(e){return e[w.BASE]})).reverse().reduce((function(t,n){if(!t.length)for(var r=Object.keys(n),o=0;o=0;n--){var r=e[n];if(r.hasOwnProperty(t))return r[t]}return null},ee=(r=Date.now(),function(e){var t=Date.now();t-r>16?(r=t,e(t)):setTimeout((function(){ee(e)}),0)}),te=function(e){return clearTimeout(e)},ne="undefined"!=typeof window?window.requestAnimationFrame&&window.requestAnimationFrame.bind(window)||window.webkitRequestAnimationFrame||window.mozRequestAnimationFrame||ee:e.requestAnimationFrame||ee,re="undefined"!=typeof window?window.cancelAnimationFrame||window.webkitCancelAnimationFrame||window.mozCancelAnimationFrame||te:e.cancelAnimationFrame||te,oe=function(e){return console&&"function"==typeof console.warn&&console.warn(e)},ie=null,ae=function(e,t){var n=e.baseTag,r=e.bodyAttributes,o=e.htmlAttributes,i=e.linkTags,a=e.metaTags,u=e.noscriptTags,c=e.onChangeClientState,s=e.scriptTags,f=e.styleTags,l=e.title,d=e.titleAttributes;se(w.BODY,r),se(w.HTML,o),ce(l,d);var p={baseTag:fe(w.BASE,n),linkTags:fe(w.LINK,i),metaTags:fe(w.META,a),noscriptTags:fe(w.NOSCRIPT,u),scriptTags:fe(w.SCRIPT,s),styleTags:fe(w.STYLE,f)},v={},h={};Object.keys(p).forEach((function(e){var t=p[e],n=t.newTags,r=t.oldTags;n.length&&(v[e]=n),r.length&&(h[e]=p[e].oldTags)})),t&&t(),c(e,v,h)},ue=function(e){return Array.isArray(e)?e.join(""):e},ce=function(e,t){void 0!==e&&document.title!==e&&(document.title=ue(e)),se(w.TITLE,t)},se=function(e,t){var n=document.getElementsByTagName(e)[0];if(n){for(var r=n.getAttribute(H),o=r?r.split(","):[],i=[].concat(o),a=Object.keys(t),u=0;u=0;l--)n.removeAttribute(i[l]);o.length===i.length?n.removeAttribute(H):n.getAttribute(H)!==a.join(",")&&n.setAttribute(H,a.join(","))}},fe=function(e,t){var n=document.head||document.querySelector(w.HEAD),r=n.querySelectorAll(e+"["+"data-react-helmet]"),o=Array.prototype.slice.call(r),i=[],a=void 0;return t&&t.length&&t.forEach((function(t){var n=document.createElement(e);for(var r in t)if(t.hasOwnProperty(r))if(r===j)n.innerHTML=t.innerHTML;else if(r===O)n.styleSheet?n.styleSheet.cssText=t.cssText:n.appendChild(document.createTextNode(t.cssText));else{var u=void 0===t[r]?"":t[r];n.setAttribute(r,u)}n.setAttribute(H,"true"),o.some((function(e,t){return a=t,n.isEqualNode(e)}))?o.splice(a,1):i.push(n)})),o.forEach((function(e){return e.parentNode.removeChild(e)})),i.forEach((function(e){return n.appendChild(e)})),{oldTags:o,newTags:i}},le=function(e){return Object.keys(e).reduce((function(t,n){var r=void 0!==e[n]?n+'="'+e[n]+'"':""+n;return t?t+" "+r:r}),"")},de=function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};return Object.keys(e).reduce((function(t,n){return t[k[n]||n]=e[n],t}),t)},pe=function(e,t,n){switch(e){case w.TITLE:return{toComponent:function(){return e=t.title,n=t.titleAttributes,(r={key:e})[H]=!0,o=de(n,r),[v.a.createElement(w.TITLE,o,e)];var e,n,r,o},toString:function(){return function(e,t,n,r){var o=le(n),i=ue(t);return o?"<"+e+' data-react-helmet="true" '+o+">"+K(i,r)+"":"<"+e+' data-react-helmet="true">'+K(i,r)+""}(e,t.title,t.titleAttributes,n)}};case g:case y:return{toComponent:function(){return de(t)},toString:function(){return le(t)}};default:return{toComponent:function(){return function(e,t){return t.map((function(t,n){var r,o=((r={key:n})[H]=!0,r);return Object.keys(t).forEach((function(e){var n=k[e]||e;if(n===j||n===O){var r=t.innerHTML||t.cssText;o.dangerouslySetInnerHTML={__html:r}}else o[n]=t[e]})),v.a.createElement(e,o)}))}(e,t)},toString:function(){return function(e,t,n){return t.reduce((function(t,r){var o=Object.keys(r).filter((function(e){return!(e===j||e===O)})).reduce((function(e,t){var o=void 0===r[t]?t:t+'="'+K(r[t],n)+'"';return e?e+" "+o:o}),""),i=r.innerHTML||r.cssText||"",a=-1===B.indexOf(e);return t+"<"+e+' data-react-helmet="true" '+o+(a?"/>":">"+i+"")}),"")}(e,t,n)}}}},ve=function(e){var t=e.baseTag,n=e.bodyAttributes,r=e.encode,o=e.htmlAttributes,i=e.linkTags,a=e.metaTags,u=e.noscriptTags,c=e.scriptTags,s=e.styleTags,f=e.title,l=void 0===f?"":f,d=e.titleAttributes;return{base:pe(w.BASE,t,r),bodyAttributes:pe(g,n,r),htmlAttributes:pe(y,o,r),link:pe(w.LINK,i,r),meta:pe(w.META,a,r),noscript:pe(w.NOSCRIPT,u,r),script:pe(w.SCRIPT,c,r),style:pe(w.STYLE,s,r),title:pe(w.TITLE,{title:l,titleAttributes:d},r)}},he=f()((function(e){return{baseTag:Q([A,x],e),bodyAttributes:G(g,e),defer:Z(e,V),encode:Z(e,N),htmlAttributes:G(y,e),linkTags:X(w.LINK,[D,A],e),metaTags:X(w.META,[S,T,C,P,E],e),noscriptTags:X(w.NOSCRIPT,[j],e),onChangeClientState:$(e),scriptTags:X(w.SCRIPT,[L,j],e),styleTags:X(w.STYLE,[O],e),title:J(e),titleAttributes:G(m,e)}}),(function(e){ie&&re(ie),e.defer?ie=ne((function(){ae(e,(function(){ie=null}))})):(ae(e),ie=null)}),ve)((function(){return null})),be=(o=he,a=i=function(e){function t(){return q(this,t),z(this,e.apply(this,arguments))}return function(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Super expression must either be null or a function, not "+typeof t);e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,enumerable:!1,writable:!0,configurable:!0}}),t&&(Object.setPrototypeOf?Object.setPrototypeOf(e,t):e.__proto__=t)}(t,e),t.prototype.shouldComponentUpdate=function(e){return!d()(this.props,e)},t.prototype.mapNestedChildrenToProps=function(e,t){if(!t)return null;switch(e.type){case w.SCRIPT:case w.NOSCRIPT:return{innerHTML:t};case w.STYLE:return{cssText:t}}throw new Error("<"+e.type+" /> elements are self-closing and can not contain children. Refer to our API for more information.")},t.prototype.flattenArrayTypeChildren=function(e){var t,n=e.child,r=e.arrayTypeChildren,o=e.newChildProps,i=e.nestedChildren;return Y({},r,((t={})[n.type]=[].concat(r[n.type]||[],[Y({},o,this.mapNestedChildrenToProps(n,i))]),t))},t.prototype.mapObjectTypeChildren=function(e){var t,n,r=e.child,o=e.newProps,i=e.newChildProps,a=e.nestedChildren;switch(r.type){case w.TITLE:return Y({},o,((t={})[r.type]=a,t.titleAttributes=Y({},i),t));case w.BODY:return Y({},o,{bodyAttributes:Y({},i)});case w.HTML:return Y({},o,{htmlAttributes:Y({},i)})}return Y({},o,((n={})[r.type]=Y({},i),n))},t.prototype.mapArrayTypeChildrenToProps=function(e,t){var n=Y({},t);return Object.keys(e).forEach((function(t){var r;n=Y({},n,((r={})[t]=e[t],r))})),n},t.prototype.warnOnInvalidChildren=function(e,t){return!0},t.prototype.mapChildrenToProps=function(e,t){var n=this,r={};return v.a.Children.forEach(e,(function(e){if(e&&e.props){var o=e.props,i=o.children,a=function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};return Object.keys(e).reduce((function(t,n){return t[_[n]||n]=e[n],t}),t)}(W(o,["children"]));switch(n.warnOnInvalidChildren(e,i),e.type){case w.LINK:case w.META:case w.NOSCRIPT:case w.SCRIPT:case w.STYLE:r=n.flattenArrayTypeChildren({child:e,arrayTypeChildren:r,newChildProps:a,nestedChildren:i});break;default:t=n.mapObjectTypeChildren({child:e,newProps:t,newChildProps:a,nestedChildren:i})}}})),t=this.mapArrayTypeChildrenToProps(r,t)},t.prototype.render=function(){var e=this.props,t=e.children,n=W(e,["children"]),r=Y({},n);return t&&(r=this.mapChildrenToProps(t,r)),v.a.createElement(o,r)},F(t,null,[{key:"canUseDOM",set:function(e){o.canUseDOM=e}}]),t}(v.a.Component),i.propTypes={base:c.a.object,bodyAttributes:c.a.object,children:c.a.oneOfType([c.a.arrayOf(c.a.node),c.a.node]),defaultTitle:c.a.string,defer:c.a.bool,encodeSpecialCharacters:c.a.bool,htmlAttributes:c.a.object,link:c.a.arrayOf(c.a.object),meta:c.a.arrayOf(c.a.object),noscript:c.a.arrayOf(c.a.object),onChangeClientState:c.a.func,script:c.a.arrayOf(c.a.object),style:c.a.arrayOf(c.a.object),title:c.a.string,titleAttributes:c.a.object,titleTemplate:c.a.string},i.defaultProps={defer:!0,encodeSpecialCharacters:!0},i.peek=o.peek,i.rewind=function(){var e=o.rewind();return e||(e=ve({baseTag:[],bodyAttributes:{},encodeSpecialCharacters:!0,htmlAttributes:{},linkTags:[],metaTags:[],noscriptTags:[],scriptTags:[],styleTags:[],title:"",titleAttributes:{}})),e},a);be.renderStatic=be.rewind}).call(this,n(29))},159:function(e,t,n){"use strict";var r,o=n(0),i=(r=o)&&"object"==typeof r&&"default"in r?r.default:r;function a(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}var u=!("undefined"==typeof window||!window.document||!window.document.createElement);e.exports=function(e,t,n){if("function"!=typeof e)throw new Error("Expected reducePropsToState to be a function.");if("function"!=typeof t)throw new Error("Expected handleStateChangeOnClient to be a function.");if(void 0!==n&&"function"!=typeof n)throw new Error("Expected mapStateOnServer to either be undefined or a function.");return function(r){if("function"!=typeof r)throw new Error("Expected WrappedComponent to be a React component.");var c,s=[];function f(){c=e(s.map((function(e){return e.props}))),l.canUseDOM?t(c):n&&(c=n(c))}var l=function(e){var t,n;function o(){return e.apply(this,arguments)||this}n=e,(t=o).prototype=Object.create(n.prototype),t.prototype.constructor=t,t.__proto__=n,o.peek=function(){return c},o.rewind=function(){if(o.canUseDOM)throw new Error("You may only call rewind() on the server. Call peek() to read the current state.");var e=c;return c=void 0,s=[],e};var a=o.prototype;return a.UNSAFE_componentWillMount=function(){s.push(this),f()},a.componentDidUpdate=function(){f()},a.componentWillUnmount=function(){var e=s.indexOf(this);s.splice(e,1),f()},a.render=function(){return i.createElement(r,this.props)},o}(o.PureComponent);return a(l,"displayName","SideEffect("+function(e){return e.displayName||e.name||"Component"}(r)+")"),a(l,"canUseDOM",u),l}}},160:function(e,t){var n="undefined"!=typeof Element,r="function"==typeof Map,o="function"==typeof Set,i="function"==typeof ArrayBuffer&&!!ArrayBuffer.isView;function a(e,t){if(e===t)return!0;if(e&&t&&"object"==typeof e&&"object"==typeof t){if(e.constructor!==t.constructor)return!1;var u,c,s,f;if(Array.isArray(e)){if((u=e.length)!=t.length)return!1;for(c=u;0!=c--;)if(!a(e[c],t[c]))return!1;return!0}if(r&&e instanceof Map&&t instanceof Map){if(e.size!==t.size)return!1;for(f=e.entries();!(c=f.next()).done;)if(!t.has(c.value[0]))return!1;for(f=e.entries();!(c=f.next()).done;)if(!a(c.value[1],t.get(c.value[0])))return!1;return!0}if(o&&e instanceof Set&&t instanceof Set){if(e.size!==t.size)return!1;for(f=e.entries();!(c=f.next()).done;)if(!t.has(c.value[0]))return!1;return!0}if(i&&ArrayBuffer.isView(e)&&ArrayBuffer.isView(t)){if((u=e.length)!=t.length)return!1;for(c=u;0!=c--;)if(e[c]!==t[c])return!1;return!0}if(e.constructor===RegExp)return e.source===t.source&&e.flags===t.flags;if(e.valueOf!==Object.prototype.valueOf)return e.valueOf()===t.valueOf();if(e.toString!==Object.prototype.toString)return e.toString()===t.toString();if((u=(s=Object.keys(e)).length)!==Object.keys(t).length)return!1;for(c=u;0!=c--;)if(!Object.prototype.hasOwnProperty.call(t,s[c]))return!1;if(n&&e instanceof Element)return!1;for(c=u;0!=c--;)if(("_owner"!==s[c]&&"__v"!==s[c]&&"__o"!==s[c]||!e.$$typeof)&&!a(e[s[c]],t[s[c]]))return!1;return!0}return e!=e&&t!=t}e.exports=function(e,t){try{return a(e,t)}catch(n){if((n.message||"").match(/stack|recursion/i))return console.warn("react-fast-compare cannot handle circular refs"),!1;throw n}}}}]); \ No newline at end of file diff --git a/17896441.3f09010b.js b/17896441.3f09010b.js deleted file mode 100644 index b4a1edcf..00000000 --- a/17896441.3f09010b.js +++ /dev/null @@ -1 +0,0 @@ -(window.webpackJsonp=window.webpackJsonp||[]).push([[7],{114:function(e,t,a){"use strict";a.r(t);var n=a(0),l=a.n(n),r=a(133),i=a(119),c=a(126),m=a(123);var o=function(e){var t=e.metadata;return l.a.createElement("nav",{className:"pagination-nav","aria-label":"Blog list page navigation"},l.a.createElement("div",{className:"pagination-nav__item"},t.previous&&l.a.createElement(m.a,{className:"pagination-nav__link",to:t.previous.permalink},l.a.createElement("div",{className:"pagination-nav__sublabel"},"Previous"),l.a.createElement("div",{className:"pagination-nav__label"},"\xab ",t.previous.title))),l.a.createElement("div",{className:"pagination-nav__item pagination-nav__item--next"},t.next&&l.a.createElement(m.a,{className:"pagination-nav__link",to:t.next.permalink},l.a.createElement("div",{className:"pagination-nav__sublabel"},"Next"),l.a.createElement("div",{className:"pagination-nav__label"},t.next.title," \xbb"))))},s=a(122),d=a(132);var u=function(){var e=Object(i.a)().siteConfig.title,t=Object(s.useActivePlugin)({failfast:!0}).pluginId,a=Object(d.a)(t).savePreferredVersionName,n=Object(s.useActiveVersion)(t),r=Object(s.useDocVersionSuggestions)(t),c=r.latestDocSuggestion,o=r.latestVersionSuggestion;if(!o)return l.a.createElement(l.a.Fragment,null);var u,g=null!=c?c:(u=o).docs.find((function(e){return e.id===u.mainDocId}));return l.a.createElement("div",{className:"alert alert--warning margin-bottom--md",role:"alert"},"current"===n.name?l.a.createElement("div",null,"This is unreleased documentation for ",e," ",l.a.createElement("strong",null,n.label)," version."):l.a.createElement("div",null,"This is documentation for ",e," ",l.a.createElement("strong",null,n.label),", which is no longer actively maintained."),l.a.createElement("div",{className:"margin-top--md"},"For up-to-date documentation, see the"," ",l.a.createElement("strong",null,l.a.createElement(m.a,{to:g.path,onClick:function(){return a(o.name)}},"latest version"))," ","(",o.label,")."))},g=a(137),v=a(117),E=a(62),p=a.n(E);t.default=function(e){var t,a=Object(i.a)().siteConfig,n=a.url,m=a.title,d=a.titleDelimiter,E=e.content,f=E.metadata,b=f.description,h=f.title,N=f.permalink,_=f.editUrl,w=f.lastUpdatedAt,O=f.lastUpdatedBy,y=E.frontMatter,k=y.image,j=y.keywords,C=y.hide_title,x=y.hide_table_of_contents,I=Object(s.useActivePlugin)({failfast:!0}).pluginId,L=Object(s.useVersions)(I),A=Object(s.useActiveVersion)(I),S=L.length>1,B=h?h+" "+d+" "+m:m,D=Object(c.a)(k,{absolute:!0});return l.a.createElement(l.a.Fragment,null,l.a.createElement(r.a,null,l.a.createElement("title",null,B),l.a.createElement("meta",{property:"og:title",content:B}),b&&l.a.createElement("meta",{name:"description",content:b}),b&&l.a.createElement("meta",{property:"og:description",content:b}),j&&j.length&&l.a.createElement("meta",{name:"keywords",content:j.join(",")}),k&&l.a.createElement("meta",{property:"og:image",content:D}),k&&l.a.createElement("meta",{property:"twitter:image",content:D}),k&&l.a.createElement("meta",{name:"twitter:image:alt",content:"Image for "+h}),N&&l.a.createElement("meta",{property:"og:url",content:n+N}),N&&l.a.createElement("link",{rel:"canonical",href:n+N})),l.a.createElement("div",{className:Object(v.a)("container padding-vert--lg",p.a.docItemWrapper)},l.a.createElement("div",{className:"row"},l.a.createElement("div",{className:Object(v.a)("col",(t={},t[p.a.docItemCol]=!x,t))},l.a.createElement(u,null),l.a.createElement("div",{className:p.a.docItemContainer},l.a.createElement("article",null,S&&l.a.createElement("div",null,l.a.createElement("span",{className:"badge badge--secondary"},"Version: ",A.label)),!C&&l.a.createElement("header",null,l.a.createElement("h1",{className:p.a.docTitle},h)),l.a.createElement("div",{className:"markdown"},l.a.createElement(E,null))),(_||w||O)&&l.a.createElement("div",{className:"margin-vert--xl"},l.a.createElement("div",{className:"row"},l.a.createElement("div",{className:"col"},_&&l.a.createElement("a",{href:_,target:"_blank",rel:"noreferrer noopener"},l.a.createElement("svg",{fill:"currentColor",height:"1.2em",width:"1.2em",preserveAspectRatio:"xMidYMid meet",viewBox:"0 0 40 40",style:{marginRight:"0.3em",verticalAlign:"sub"}},l.a.createElement("g",null,l.a.createElement("path",{d:"m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"}))),"Edit this page")),(w||O)&&l.a.createElement("div",{className:"col text--right"},l.a.createElement("em",null,l.a.createElement("small",null,"Last updated"," ",w&&l.a.createElement(l.a.Fragment,null,"on"," ",l.a.createElement("time",{dateTime:new Date(1e3*w).toISOString(),className:p.a.docLastUpdatedAt},new Date(1e3*w).toLocaleDateString()),O&&" "),O&&l.a.createElement(l.a.Fragment,null,"by ",l.a.createElement("strong",null,O)),!1))))),l.a.createElement("div",{className:"margin-vert--lg"},l.a.createElement(o,{metadata:f})))),!x&&E.rightToc&&l.a.createElement("div",{className:"col col--3"},l.a.createElement(g.a,{headings:E.rightToc})))))}},137:function(e,t,a){"use strict";var n=a(0),l=a.n(n);var r=function(e,t,a){var l=Object(n.useState)(void 0),r=l[0],i=l[1];Object(n.useEffect)((function(){function n(){var n=function(){var e=Array.from(document.getElementsByClassName("anchor")),t=e.find((function(e){return e.getBoundingClientRect().top>=a}));if(t){if(t.getBoundingClientRect().top>=a){var n=e[e.indexOf(t)-1];return null!=n?n:t}return t}return e[e.length-1]}();if(n)for(var l=0,c=!1,m=document.getElementsByClassName(e);l=0||(r[n]=e[n]);return r}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(i=0;i=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}var l=r.a.createContext({}),u=function(e){var t=r.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},b=function(e){var t=u(e.components);return r.a.createElement(l.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},p=r.a.forwardRef((function(e,t){var n=e.components,i=e.mdxType,o=e.originalType,a=e.parentName,l=c(e,["components","mdxType","originalType","parentName"]),b=u(n),p=i,h=b["".concat(a,".").concat(p)]||b[p]||d[p]||o;return n?r.a.createElement(h,s(s({ref:t},l),{},{components:n})):r.a.createElement(h,s({ref:t},l))}));function h(e,t){var n=arguments,i=t&&t.mdxType;if("string"==typeof e||i){var o=n.length,a=new Array(o);a[0]=p;var s={};for(var c in t)hasOwnProperty.call(t,c)&&(s[c]=t[c]);s.originalType=e,s.mdxType="string"==typeof e?e:i,a[1]=s;for(var l=2;l=s?r(!1):a+c0&&r.a.createElement("div",{className:"row footer__links"},l.map((function(e,t){return r.a.createElement("div",{key:t,className:"col footer__col"},null!=e.title?r.a.createElement("h4",{className:"footer__title"},e.title):null,null!=e.items&&Array.isArray(e.items)&&e.items.length>0?r.a.createElement("ul",{className:"footer__items"},e.items.map((function(e,t){return e.html?r.a.createElement("li",{key:t,className:"footer__item",dangerouslySetInnerHTML:{__html:e.html}}):r.a.createElement("li",{key:e.href||e.to,className:"footer__item"},r.a.createElement(U,e))}))):null)}))),(s||a)&&r.a.createElement("div",{className:"text--center"},s&&s.src&&r.a.createElement("div",{className:"margin-bottom--sm"},s.href?r.a.createElement("a",{href:s.href,target:"_blank",rel:"noopener noreferrer",className:F.a.footerLogoLink},r.a.createElement(H,{alt:s.alt,url:u})):r.a.createElement(H,{alt:s.alt,url:u})),r.a.createElement("div",{dangerouslySetInnerHTML:{__html:a}})))):null},G=a(9),W="light",Y="dark",K=function(e){return e===Y?Y:W},z=function(){return G.a.canUseDOM?K(document.documentElement.getAttribute("data-theme")):W},J=function(e){try{localStorage.setItem("theme",K(e))}catch(t){console.error(t)}},q=function(){var e=Object(o.a)().colorMode.disableSwitch,t=void 0!==e&&e,a=Object(n.useState)(z),r=a[0],c=a[1],l=Object(n.useCallback)((function(){c(W),J(W)}),[]),i=Object(n.useCallback)((function(){c(Y),J(Y)}),[]);return Object(n.useEffect)((function(){document.documentElement.setAttribute("data-theme",K(r))}),[r]),Object(n.useEffect)((function(){if(!t)try{var e=localStorage.getItem("theme");null!==e&&c(K(e))}catch(a){console.error(a)}}),[c]),Object(n.useEffect)((function(){t||window.matchMedia("(prefers-color-scheme: dark)").addListener((function(e){var t=e.matches;c(t?Y:W)}))}),[]),{isDarkTheme:r===Y,setLightTheme:l,setDarkTheme:i}},Q=a(139);var Z=function(e){var t=q(),a=t.isDarkTheme,n=t.setLightTheme,c=t.setDarkTheme;return r.a.createElement(Q.a.Provider,{value:{isDarkTheme:a,setLightTheme:n,setDarkTheme:c}},e.children)},$="docusaurus.tab.",ee=function(){var e=Object(n.useState)({}),t=e[0],a=e[1],r=Object(n.useCallback)((function(e,t){try{localStorage.setItem("docusaurus.tab."+e,t)}catch(a){console.error(a)}}),[]);return Object(n.useEffect)((function(){try{for(var e={},t=0;t996?r.desktop:r.mobile}var a=Object(n.useState)(t),c=a[0],o=a[1];return Object(n.useEffect)((function(){if(e)return window.addEventListener("resize",a),function(){return window.removeEventListener("resize",a)};function a(){o(t())}}),[]),c}},143:function(e,t,a){"use strict";var n=a(129),r=a(126),c=a(128),o=a(118);t.a=function(){var e=Object(o.a)().navbar.logo,t=Object(n.a)().isDarkTheme,a=Object(r.a)(e.href||"/"),l={};e.target?l={target:e.target}:Object(c.a)(a)||(l={rel:"noopener noreferrer",target:"_blank"});var i=e.srcDark&&t?e.srcDark:e.src;return{logoLink:a,logoLinkProps:l,logoImageUrl:Object(r.a)(i),logoAlt:e.alt}}},144:function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));var n=function(e,t){var a=function(e){return e.endsWith("/")?e:e+"/"};return a(e)===a(t)}},145:function(e,t,a){"use strict";a.d(t,"a",(function(){return n})),a.d(t,"b",(function(){return r}));var n="default";function r(e,t){return"docs-"+e+"-"+t}},147:function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=Object.assign||function(e){for(var t=1;tthis.startX&&(this.setState({checked:!0}),this.startX=t,this.activated=ta?this.previouslyChecked!==this.state.checked&&(this.setState({checked:!1}),this.previouslyChecked=this.state.checked,t.click()):this.startX-4=0||Object.prototype.hasOwnProperty.call(e,n)&&(a[n]=e[n]);return a}(t,["className","icons"])),c=(0,l.default)("react-toggle",{"react-toggle--checked":this.state.checked,"react-toggle--focus":this.state.hasFocus,"react-toggle--disabled":this.props.disabled},a);return o.default.createElement("div",{className:c,onClick:this.handleClick,onTouchStart:this.handleTouchStart,onTouchMove:this.handleTouchMove,onTouchEnd:this.handleTouchEnd},o.default.createElement("div",{className:"react-toggle-track"},o.default.createElement("div",{className:"react-toggle-track-check"},this.getIcon("checked")),o.default.createElement("div",{className:"react-toggle-track-x"},this.getIcon("unchecked"))),o.default.createElement("div",{className:"react-toggle-thumb"}),o.default.createElement("input",n({},r,{ref:function(t){e.input=t},onFocus:this.handleFocus,onBlur:this.handleBlur,className:"react-toggle-screenreader-only",type:"checkbox"})))}}]),t}(c.PureComponent);t.default=f,f.displayName="Toggle",f.defaultProps={icons:{checked:o.default.createElement(s.default,null),unchecked:o.default.createElement(u.default,null)}},f.propTypes={checked:i.default.bool,disabled:i.default.bool,defaultChecked:i.default.bool,onChange:i.default.func,onFocus:i.default.func,onBlur:i.default.func,className:i.default.string,name:i.default.string,value:i.default.string,id:i.default.string,"aria-labelledby":i.default.string,"aria-label":i.default.string,icons:i.default.oneOfType([i.default.bool,i.default.shape({checked:i.default.node,unchecked:i.default.node})])}},148:function(e,t,a){var n;!function(){"use strict";var a={}.hasOwnProperty;function r(){for(var e=[],t=0;t0){var a=t[0];return{x:a.clientX,y:a.clientY}}var n=e.pageX;if(void 0!==n)return{x:n,y:e.pageY}}return{x:0,y:0}}},152:function(e,t,a){"use strict";a.r(t),a.d(t,"default",(function(){return u}));var n=a(2),r=a(6),c=a(0),o=a.n(c),l=a(130),i=a(122),s=a(132);function u(e){var t,a=e.label,c=e.to,u=e.docsPluginId,d=Object(r.a)(e,["label","to","docsPluginId"]),m=Object(i.useActiveVersion)(u),f=Object(s.a)(u).preferredVersion,h=Object(i.useLatestVersion)(u),v=null!==(t=null!=m?m:f)&&void 0!==t?t:h,b=null!=a?a:v.label,p=null!=c?c:function(e){return e.docs.find((function(t){return t.id===e.mainDocId}))}(v).path;return o.a.createElement(l.a,Object(n.a)({},d,{label:b,to:p}))}},156:function(e,t,a){"use strict";a.r(t),a.d(t,"default",(function(){return d}));var n=a(2),r=a(6),c=a(0),o=a.n(c),l=a(130),i=a(122),s=a(132),u=function(e){return e.docs.find((function(t){return t.id===e.mainDocId}))};function d(e){var t,a,c=e.mobile,d=e.docsPluginId,m=e.dropdownActiveClassDisabled,f=e.dropdownItemsBefore,h=e.dropdownItemsAfter,v=Object(r.a)(e,["mobile","docsPluginId","dropdownActiveClassDisabled","dropdownItemsBefore","dropdownItemsAfter"]),b=Object(i.useActiveDocContext)(d),p=Object(i.useVersions)(d),g=Object(i.useLatestVersion)(d),k=Object(s.a)(d),E=k.preferredVersion,O=k.savePreferredVersionName;var j=null!==(t=null!==(a=b.activeVersion)&&void 0!==a?a:E)&&void 0!==t?t:g,y=c?"Versions":j.label,_=c?void 0:u(j).path;return o.a.createElement(l.a,Object(n.a)({},v,{mobile:c,label:y,to:_,items:function(){var e=p.map((function(e){var t=(null==b?void 0:b.alternateDocVersions[e.name])||u(e);return{isNavLink:!0,label:e.label,to:t.path,isActive:function(){return e===(null==b?void 0:b.activeVersion)},onClick:function(){O(e.name)}}})),t=[].concat(f,e,h);if(!(t.length<=1))return t}(),isActive:m?function(){return!1}:void 0}))}},157:function(e,t,a){"use strict";a.r(t),a.d(t,"default",(function(){return d}));var n=a(2),r=a(6),c=a(0),o=a.n(c),l=a(130),i=a(122),s=a(117),u=a(132);function d(e){var t,a,c=e.docId,d=e.activeSidebarClassName,m=e.label,f=e.docsPluginId,h=Object(r.a)(e,["docId","activeSidebarClassName","label","docsPluginId"]),v=Object(i.useActiveDocContext)(f),b=v.activeVersion,p=v.activeDoc,g=Object(u.a)(f).preferredVersion,k=Object(i.useLatestVersion)(f),E=null!==(t=null!=b?b:g)&&void 0!==t?t:k,O=E.docs.find((function(e){return e.id===c}));if(!O)throw new Error("DocNavbarItem: couldn't find any doc with id="+c+" in version "+E.name+".\nAvailable docIds=\n- "+E.docs.join("\n- "));return o.a.createElement(l.a,Object(n.a)({exact:!0},h,{className:Object(s.a)(h.className,(a={},a[d]=p&&p.sidebar===O.sidebar,a)),label:null!=m?m:O.id,to:O.path}))}}}]); \ No newline at end of file diff --git a/2.0f84ec0c.js.LICENSE.txt b/2.0f84ec0c.js.LICENSE.txt deleted file mode 100644 index bae6dd8e..00000000 --- a/2.0f84ec0c.js.LICENSE.txt +++ /dev/null @@ -1,5 +0,0 @@ -/*! - Copyright (c) 2017 Jed Watson. - Licensed under the MIT License (MIT), see - http://jedwatson.github.io/classnames -*/ diff --git a/230aeb34.d5b08ee8.js b/230aeb34.d5b08ee8.js deleted file mode 100644 index f479295d..00000000 --- a/230aeb34.d5b08ee8.js +++ /dev/null @@ -1 +0,0 @@ -(window.webpackJsonp=window.webpackJsonp||[]).push([[9],{67:function(o){o.exports=JSON.parse('{"pluginId":"default","version":"7.0.x","label":"7.0.x","isLast":false,"docsSidebars":{"version-7.0.x/docs":[{"type":"link","label":"Installation","href":"/oauth2-proxy/docs/7.0.x/"},{"type":"link","label":"Behaviour","href":"/oauth2-proxy/docs/7.0.x/behaviour"},{"collapsed":false,"type":"category","label":"Configuration","items":[{"type":"link","label":"Overview","href":"/oauth2-proxy/docs/7.0.x/configuration/overview"},{"type":"link","label":"OAuth Provider Configuration","href":"/oauth2-proxy/docs/7.0.x/configuration/oauth_provider"},{"type":"link","label":"Session Storage","href":"/oauth2-proxy/docs/7.0.x/configuration/session_storage"},{"type":"link","label":"TLS Configuration","href":"/oauth2-proxy/docs/7.0.x/configuration/tls"},{"type":"link","label":"Alpha Configuration","href":"/oauth2-proxy/docs/7.0.x/configuration/alpha-config"}]},{"collapsed":false,"type":"category","label":"Features","items":[{"type":"link","label":"Endpoints","href":"/oauth2-proxy/docs/7.0.x/features/endpoints"},{"type":"link","label":"Request Signatures","href":"/oauth2-proxy/docs/7.0.x/features/request_signatures"}]},{"collapsed":false,"type":"category","label":"Community","items":[{"type":"link","label":"Security","href":"/oauth2-proxy/docs/7.0.x/community/security"}]}]},"permalinkToSidebar":{"/oauth2-proxy/docs/7.0.x/behaviour":"version-7.0.x/docs","/oauth2-proxy/docs/7.0.x/community/security":"version-7.0.x/docs","/oauth2-proxy/docs/7.0.x/configuration/alpha-config":"version-7.0.x/docs","/oauth2-proxy/docs/7.0.x/configuration/oauth_provider":"version-7.0.x/docs","/oauth2-proxy/docs/7.0.x/configuration/overview":"version-7.0.x/docs","/oauth2-proxy/docs/7.0.x/configuration/session_storage":"version-7.0.x/docs","/oauth2-proxy/docs/7.0.x/configuration/tls":"version-7.0.x/docs","/oauth2-proxy/docs/7.0.x/features/endpoints":"version-7.0.x/docs","/oauth2-proxy/docs/7.0.x/features/request_signatures":"version-7.0.x/docs","/oauth2-proxy/docs/7.0.x/":"version-7.0.x/docs"}}')}}]); \ No newline at end of file diff --git a/243cbd97.a8d0e9a3.js b/243cbd97.a8d0e9a3.js deleted file mode 100644 index be9b6b53..00000000 --- a/243cbd97.a8d0e9a3.js +++ /dev/null @@ -1 +0,0 @@ -(window.webpackJsonp=window.webpackJsonp||[]).push([[10],{116:function(e,t,a){"use strict";a.d(t,"a",(function(){return p})),a.d(t,"b",(function(){return j}));var n=a(0),r=a.n(n);function b(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function l(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function i(e){for(var t=1;t=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var b=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var o=r.a.createContext({}),s=function(e){var t=r.a.useContext(o),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},p=function(e){var t=s(e.components);return r.a.createElement(o.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},O=r.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,b=e.originalType,l=e.parentName,o=c(e,["components","mdxType","originalType","parentName"]),p=s(a),O=n,j=p["".concat(l,".").concat(O)]||p[O]||d[O]||b;return a?r.a.createElement(j,i(i({ref:t},o),{},{components:a})):r.a.createElement(j,i({ref:t},o))}));function j(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var b=a.length,l=new Array(b);l[0]=O;var i={};for(var c in t)hasOwnProperty.call(t,c)&&(i[c]=t[c]);i.originalType=e,i.mdxType="string"==typeof e?e:n,l[1]=i;for(var o=2;o=0||(r[n]=e[n]);return r}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(i=0;i=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}var u=r.a.createContext({}),l=function(e){var t=r.a.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},d=function(e){var t=l(e.components);return r.a.createElement(u.Provider,{value:t},e.children)},p={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},b=r.a.forwardRef((function(e,t){var n=e.components,i=e.mdxType,o=e.originalType,a=e.parentName,u=c(e,["components","mdxType","originalType","parentName"]),d=l(n),b=i,m=d["".concat(a,".").concat(b)]||d[b]||p[b]||o;return n?r.a.createElement(m,s(s({ref:t},u),{},{components:n})):r.a.createElement(m,s({ref:t},u))}));function m(e,t){var n=arguments,i=t&&t.mdxType;if("string"==typeof e||i){var o=n.length,a=new Array(o);a[0]=b;var s={};for(var c in t)hasOwnProperty.call(t,c)&&(s[c]=t[c]);s.originalType=e,s.mdxType="string"==typeof e?e:i,a[1]=s;for(var u=2;u=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var u=i.a.createContext({}),l=function(e){var t=i.a.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},d=function(e){var t=l(e.components);return i.a.createElement(u.Provider,{value:t},e.children)},p={inlineCode:"code",wrapper:function(e){var t=e.children;return i.a.createElement(i.a.Fragment,{},t)}},b=i.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,o=e.originalType,a=e.parentName,u=c(e,["components","mdxType","originalType","parentName"]),d=l(n),b=r,m=d["".concat(a,".").concat(b)]||d[b]||p[b]||o;return n?i.a.createElement(m,s(s({ref:t},u),{},{components:n})):i.a.createElement(m,s({ref:t},u))}));function m(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var o=n.length,a=new Array(o);a[0]=b;var s={};for(var c in t)hasOwnProperty.call(t,c)&&(s[c]=t[c]);s.originalType=e,s.mdxType="string"==typeof e?e:r,a[1]=s;for(var u=2;u=0||(n[a]=e[a]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(o=0;o=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(n[a]=e[a])}return n}var p=n.a.createContext({}),b=function(e){var t=n.a.useContext(p),a=t;return e&&(a="function"==typeof e?e(t):l(l({},t),e)),a},s=function(e){var t=b(e.components);return n.a.createElement(p.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return n.a.createElement(n.a.Fragment,{},t)}},d=n.a.forwardRef((function(e,t){var a=e.components,o=e.mdxType,r=e.originalType,i=e.parentName,p=c(e,["components","mdxType","originalType","parentName"]),s=b(a),d=o,h=s["".concat(i,".").concat(d)]||s[d]||u[d]||r;return a?n.a.createElement(h,l(l({ref:t},p),{},{components:a})):n.a.createElement(h,l({ref:t},p))}));function h(e,t){var a=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var r=a.length,i=new Array(r);i[0]=d;var l={};for(var c in t)hasOwnProperty.call(t,c)&&(l[c]=t[c]);l.originalType=e,l.mdxType="string"==typeof e?e:o,i[1]=l;for(var p=2;p\n --client-secret=\n --oidc-issuer-url=https://sts.windows.net/{tenant-id}/\n")),Object(r.b)("p",null,"Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/next/configuration/session_storage#redis-storage"}),"redis session storage")," should resolve this."),Object(r.b)("h3",{id:"adfs-auth-provider"},"ADFS Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Open the ADFS administration console on your Windows Server and add a new Application Group"),Object(r.b)("li",{parentName:"ol"},"Provide a name for the integration, select Server Application from the Standalone applications section and click Next"),Object(r.b)("li",{parentName:"ol"},"Follow the wizard to get the client-id, client-secret and configure the application credentials"),Object(r.b)("li",{parentName:"ol"},"Configure the proxy with")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=adfs\n --client-id=\n --client-secret=\n")),Object(r.b)("p",null,"Note: When using the ADFS Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/next/configuration/session_storage#redis-storage"}),"redis session storage")," should resolve this."),Object(r.b)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new FB App from ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.facebook.com/"}),"https://developers.facebook.com/")),Object(r.b)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://github.com/settings/developers"}),"https://github.com/settings/developers")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*")),Object(r.b)("p",null,"NOTE: When ",Object(r.b)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),Object(r.b)("p",null,"To restrict by organization only, include the following flag:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-org="": restrict logins to members of this organisation\n')),Object(r.b)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",Object(r.b)("inlineCode",{parentName:"p"},"-github-org"),":"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),Object(r.b)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),Object(r.b)("p",null,"If you'd like to allow access to users with ",Object(r.b)("strong",{parentName:"p"},"read only")," access to a ",Object(r.b)("strong",{parentName:"p"},"public")," repository you will need to provide a ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/settings/tokens"}),"token")," for a user that has write access to the repository. The token must be created with at least the ",Object(r.b)("inlineCode",{parentName:"p"},"public_repo")," scope:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-token="": the token to use when verifying repository collaborators\n')),Object(r.b)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-user="": allow logins by username, separated by a comma\n')),Object(r.b)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-login-url="http(s):///login/oauth/authorize"\n-redeem-url="http(s):///login/oauth/access_token"\n-validate-url="http(s):///api/v3"\n')),Object(r.b)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),Object(r.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(r.b)("div",Object(o.a)({parentName:"div"},{className:"admonition-heading"}),Object(r.b)("h5",{parentName:"div"},Object(r.b)("span",Object(o.a)({parentName:"h5"},{className:"admonition-icon"}),Object(r.b)("svg",Object(o.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(r.b)("path",Object(o.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(r.b)("div",Object(o.a)({parentName:"div"},{className:"admonition-content"}),Object(r.b)("p",{parentName:"div"},"This is the legacy provider for Keycloak, use ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"#keycloak-oidc-auth-provider"}),"Keycloak OIDC Auth Provider")," if possible."))),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",Object(r.b)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",Object(r.b)("strong",{parentName:"li"},"Valid Redirect URIs")," '",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://internal.yourcompany.com/oauth2/callback'"}),"https://internal.yourcompany.com/oauth2/callback'")),Object(r.b)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),Object(r.b)("li",{parentName:"ol"},"Create a mapper with ",Object(r.b)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",Object(r.b)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),Object(r.b)("p",null,"Make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' --provider=keycloak\n --client-id=\n --client-secret=\n --login-url="http(s):///auth/realms//protocol/openid-connect/auth"\n --redeem-url="http(s):///auth/realms//protocol/openid-connect/token"\n --profile-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n --validate-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n --keycloak-group=\n --keycloak-group=\n')),Object(r.b)("p",null,"For group based authorization, the optional ",Object(r.b)("inlineCode",{parentName:"p"},"--keycloak-group")," (legacy) or ",Object(r.b)("inlineCode",{parentName:"p"},"--allowed-group")," (global standard)\nflags can be used to specify which groups to limit access to."),Object(r.b)("p",null,"If these are unset but a ",Object(r.b)("inlineCode",{parentName:"p"},"groups")," mapper is set up above in step (3), the provider will still\npopulate the ",Object(r.b)("inlineCode",{parentName:"p"},"X-Forwarded-Groups")," header to your upstream server with the ",Object(r.b)("inlineCode",{parentName:"p"},"groups")," data in the\nKeycloak userinfo endpoint response."),Object(r.b)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak\nyou should define the 'keycloak-group' value to /admin."),Object(r.b)("h3",{id:"keycloak-oidc-auth-provider"},"Keycloak OIDC Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",Object(r.b)("strong",{parentName:"li"},"Access Type")," 'confidental', ",Object(r.b)("strong",{parentName:"li"},"Client protocol")," 'openid-connect' and ",Object(r.b)("strong",{parentName:"li"},"Valid Redirect URIs")," '",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://internal.yourcompany.com/oauth2/callback'"}),"https://internal.yourcompany.com/oauth2/callback'")),Object(r.b)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),Object(r.b)("li",{parentName:"ol"},"Create a mapper with ",Object(r.b)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",Object(r.b)("strong",{parentName:"li"},"Token Claim Name")," 'groups'."),Object(r.b)("li",{parentName:"ol"},"Create a mapper with ",Object(r.b)("strong",{parentName:"li"},"Mapper Type")," 'Audience' and ",Object(r.b)("strong",{parentName:"li"},"Included Client Audience")," and ",Object(r.b)("strong",{parentName:"li"},"Included Custom Audience")," set to your client name.")),Object(r.b)("p",null,"Make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=keycloak-oidc\n --client-id=\n --client-secret=\n --redirect-url=https://myapp.com/oauth2/callback\n --oidc-issuer-url=https:///auth//basic\n --allowed-role= // Optional, required realm role\n --allowed-role=: // Optional, required client role\n")),Object(r.b)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),Object(r.b)("p",null,"This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/issues/994"}),"994"),")."),Object(r.b)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"}),"these steps to add an application"),". Make sure to enable at least the ",Object(r.b)("inlineCode",{parentName:"p"},"openid"),", ",Object(r.b)("inlineCode",{parentName:"p"},"profile")," and ",Object(r.b)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://myapp.com/oauth2/callback"}),"https://myapp.com/oauth2/callback"),"."),Object(r.b)("p",null,"If you need projects filtering, add the extra ",Object(r.b)("inlineCode",{parentName:"p"},"read_api")," scope to your application."),Object(r.b)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/next/configuration/overview#generating-a-cookie-secret"}),"these steps")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' --provider="gitlab"\n --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n --client-id=GITLAB_CLIENT_ID\n --client-secret=GITLAB_CLIENT_SECRET\n --cookie-secret=COOKIE_SECRET\n')),Object(r.b)("p",null,"Restricting by group membership is possible with the following option:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),Object(r.b)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--oidc-issuer-url=""\n')),Object(r.b)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),Object(r.b)("p",null,"For LinkedIn, the registration steps are:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://www.linkedin.com/secure/developer"}),"https://www.linkedin.com/secure/developer")),Object(r.b)("li",{parentName:"ol"},"In the OAuth User Agreement section:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),Object(r.b)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),Object(r.b)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),Object(r.b)("li",{parentName:"ol"},"Take note of the ",Object(r.b)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",Object(r.b)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),Object(r.b)("h3",{id:"microsoft-azure-ad-provider"},"Microsoft Azure AD Provider"),Object(r.b)("p",null,"For adding an application to the Microsoft Azure AD follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"}),"these steps to add an application"),"."),Object(r.b)("p",null,"Take note of your ",Object(r.b)("inlineCode",{parentName:"p"},"TenantId")," if applicable for your situation. The ",Object(r.b)("inlineCode",{parentName:"p"},"TenantId")," can be used to override the default ",Object(r.b)("inlineCode",{parentName:"p"},"common")," authorization server with a tenant specific server."),Object(r.b)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),Object(r.b)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."),Object(r.b)("p",null,"This provider was originally built against CoreOS Dex and we will use it as an example.\nThe OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below."),Object(r.b)("h4",{id:"dex"},"Dex"),Object(r.b)("p",null,"To configure the OIDC provider for Dex, perform the following steps:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Download Dex:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"go get github.com/dexidp/dex\n")),Object(r.b)("p",{parentName:"li"},"See the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://dexidp.io/docs/getting-started/"}),"getting started guide")," for more details.")),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the ",Object(r.b)("inlineCode",{parentName:"p"},"staticClients")," section of ",Object(r.b)("inlineCode",{parentName:"p"},"examples/config-dev.yaml"),":"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"- id: oauth2-proxy\nredirectURIs:\n- 'http://127.0.0.1:4180/oauth2/callback'\nname: 'oauth2-proxy'\nsecret: proxy\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Launch Dex: from ",Object(r.b)("inlineCode",{parentName:"p"},"$GOPATH/github.com/dexidp/dex"),", run:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"bin/dex serve examples/config-dev.yaml\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"In a second terminal, run the oauth2-proxy with the following args:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-provider oidc\n-provider-display-name "My OIDC Provider"\n-client-id oauth2-proxy\n-client-secret proxy\n-redirect-url http://127.0.0.1:4180/oauth2/callback\n-oidc-issuer-url http://127.0.0.1:5556/dex\n-cookie-secure=false\n-cookie-secret=secret\n-email-domain kilgore.trout\n')),Object(r.b)("p",{parentName:"li"},"To serve the current working directory as a web site under the ",Object(r.b)("inlineCode",{parentName:"p"},"/static")," endpoint, add:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"-upstream file://$PWD/#/static/\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Test the setup by visiting ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"http://127.0.0.1:4180"}),"http://127.0.0.1:4180")," or ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"http://127.0.0.1:4180/static"}),"http://127.0.0.1:4180/static")," ."))),Object(r.b)("p",null,"See also ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment"}),"our local testing environment")," for a self-contained example using Docker and etcd as storage for Dex."),Object(r.b)("h4",{id:"okta"},"Okta"),Object(r.b)("p",null,"To configure the OIDC provider for Okta, perform the following steps:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",Object(r.b)("inlineCode",{parentName:"li"},"example.oktapreview.com")),Object(r.b)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",Object(r.b)("inlineCode",{parentName:"li"},"default")," will work.")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Security")," then select ",Object(r.b)("strong",{parentName:"li"},"API")),Object(r.b)("li",{parentName:"ul"},"Click ",Object(r.b)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),Object(r.b)("li",{parentName:"ul"},"Fill out the ",Object(r.b)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),Object(r.b)("li",{parentName:"ul"},"For ",Object(r.b)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://example.corp.com"}),"https://example.corp.com")),Object(r.b)("li",{parentName:"ul"},"Fill out a ",Object(r.b)("strong",{parentName:"li"},"Description")),Object(r.b)("li",{parentName:"ul"},"Add any ",Object(r.b)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),Object(r.b)("li",{parentName:"ul"},"The default settings will work for other options.\n",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"}),"See Okta documentation for more information on Authorization Servers"))),Object(r.b)("ol",{start:3},Object(r.b)("li",{parentName:"ol"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Applications")," then select ",Object(r.b)("strong",{parentName:"li"},"Add Application"),".")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"Web")," for the ",Object(r.b)("strong",{parentName:"li"},"Platform")," setting."),Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"OpenID Connect")," and click ",Object(r.b)("strong",{parentName:"li"},"Create")),Object(r.b)("li",{parentName:"ul"},"Pick an ",Object(r.b)("strong",{parentName:"li"},"Application Name")," such as ",Object(r.b)("inlineCode",{parentName:"li"},"Example App"),"."),Object(r.b)("li",{parentName:"ul"},"Set the ",Object(r.b)("strong",{parentName:"li"},"Login redirect URI")," to ",Object(r.b)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"General")," set the ",Object(r.b)("strong",{parentName:"li"},"Allowed grant types")," to ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token"),"."),Object(r.b)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client Secret"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),Object(r.b)("ol",{start:4},Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Create a configuration file like the following:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n "https://example.corp.com"\n]\nemail_domains = [\n "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')))),Object(r.b)("p",null,"The ",Object(r.b)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",Object(r.b)("strong",{parentName:"p"},"Authorization Server"),"'s ",Object(r.b)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://corp.okta.com"}),"https://corp.okta.com")," .\nThe ",Object(r.b)("inlineCode",{parentName:"p"},"client_id")," and ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",Object(r.b)("inlineCode",{parentName:"p"},"cookie_secret")," to encrypt the cookie."),Object(r.b)("p",null,"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),Object(r.b)("h4",{id:"okta---localhost"},"Okta - localhost"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Signup for developer account: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/signup/"}),"https://developer.okta.com/signup/")),Object(r.b)("li",{parentName:"ol"},"Create New ",Object(r.b)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),Object(r.b)("li",{parentName:"ol"},"Example Application Settings for localhost:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Name:")," My Web App"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Group assignments:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Everyone")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Grant type allowed:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token")))),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),Object(r.b)("li",{parentName:"ol"},"Example config file ",Object(r.b)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n "http://0.0.0.0:8080"\n]\nemail_domains = [\n "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),Object(r.b)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),Object(r.b)("h3",{id:"logingov-provider"},"login.gov Provider"),Object(r.b)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://login.gov/developers/"}),"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),Object(r.b)("p",null,"A developer guide is available here: ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://developers.login.gov/"}),"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),Object(r.b)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),Object(r.b)("p",null,"First, register your application in the dashboard. The important bits are:"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Identity protocol: make this ",Object(r.b)("inlineCode",{parentName:"li"},"Openid connect")),Object(r.b)("li",{parentName:"ul"},"Issuer: do what they say for OpenID Connect. We will refer to this string as ",Object(r.b)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),Object(r.b)("li",{parentName:"ul"},"Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",Object(r.b)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",Object(r.b)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",Object(r.b)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),Object(r.b)("li",{parentName:"ul"},"Return to App URL: Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/")),Object(r.b)("li",{parentName:"ul"},"Redirect URIs: Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),Object(r.b)("li",{parentName:"ul"},"Attribute Bundle: Make sure that email is selected.")),Object(r.b)("p",null,"Now start the proxy up with the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'./oauth2-proxy -provider login.gov \\\n -client-id=${LOGINGOV_ISSUER} \\\n -redirect-url=http://localhost:4180/oauth2/callback \\\n -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n -cookie-secure=false \\\n -email-domain=gsa.gov \\\n -upstream=http://localhost:3000/ \\\n -cookie-secret=somerandomstring12341234567890AB \\\n -cookie-domain=localhost \\\n -skip-provider-button=true \\\n -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),Object(r.b)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",Object(r.b)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",Object(r.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",Object(r.b)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),Object(r.b)("p",null,"Once it is running, you should be able to go to ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:3000/"),". In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),Object(r.b)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),Object(r.b)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),Object(r.b)("p",null,"In this case, you can set the ",Object(r.b)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," -provider oidc\n -client-id oauth2-proxy\n -client-secret proxy\n -redirect-url http://127.0.0.1:4180/oauth2/callback\n -oidc-issuer-url http://127.0.0.1:5556\n -skip-oidc-discovery\n -login-url http://127.0.0.1:5556/authorize\n -redeem-url http://127.0.0.1:5556/token\n -oidc-jwks-url http://127.0.0.1:5556/keys\n -cookie-secure=false\n -email-domain example.com\n")),Object(r.b)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),Object(r.b)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),Object(r.b)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",Object(r.b)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",Object(r.b)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),Object(r.b)("p",null,"Refer to the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"}),"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',Object(r.b)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' -provider nextcloud\n -client-id \n -client-secret \n -login-url="/index.php/apps/oauth2/authorize"\n -redeem-url="/index.php/apps/oauth2/api/v1/token"\n -validate-url="/ocs/v2.php/cloud/user?format=json"\n')),Object(r.b)("p",null,"Note: in ",Object(r.b)("em",{parentName:"p"},"all")," cases the validate-url will ",Object(r.b)("em",{parentName:"p"},"not")," have the ",Object(r.b)("inlineCode",{parentName:"p"},"index.php"),"."),Object(r.b)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://cloud.digitalocean.com/account/api/applications"}),"Create a new OAuth application"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),Object(r.b)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',Object(r.b)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=digitalocean\n --client-id=\n --client-secret=\n")),Object(r.b)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",Object(r.b)("inlineCode",{parentName:"p"},"https:///oauth2/callback"),". If you need to change it, you can use the ",Object(r.b)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),Object(r.b)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"}),"Add a new OAuth consumer"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},'In "Callback URL" use ',Object(r.b)("inlineCode",{parentName:"li"},"https:///oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"")," with the actual hostname that oauth2-proxy is running on."),Object(r.b)("li",{parentName:"ul"},"In Permissions section select:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"Account -> Email"),Object(r.b)("li",{parentName:"ul"},"Team membership -> Read"),Object(r.b)("li",{parentName:"ul"},"Repositories -> Read"))))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=bitbucket\n --client-id=\n --client-secret=\n")),Object(r.b)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-team="),". To restrict the access to only these users who has access to one selected repository use ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-repository="),"."),Object(r.b)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new application: ",Object(r.b)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",Object(r.b)("inlineCode",{parentName:"li"},"https:///oauth2/callback")),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),Object(r.b)("li",{parentName:"ol"},"Pass the following options to the proxy:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' --provider="github"\n --redirect-url="https:///oauth2/callback"\n --provider-display-name="Gitea"\n --client-id="< client_id as generated by Gitea >"\n --client-secret="< client_secret as generated by Gitea >"\n --login-url="https://< your gitea host >/login/oauth/authorize"\n --redeem-url="https://< your gitea host >/login/oauth/access_token"\n --validate-url="https://< your gitea host >/api/v1"\n')),Object(r.b)("h2",{id:"email-authentication"},"Email Authentication"),Object(r.b)("p",null,"To authorize by email domain use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),Object(r.b)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),Object(r.b)("p",null,"Follow the examples in the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"}),Object(r.b)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",Object(r.b)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",Object(r.b)("inlineCode",{parentName:"p"},"case")," to\n",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"}),Object(r.b)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",Object(r.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",Object(r.b)("inlineCode",{parentName:"p"},"Provider"),"."))}b.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/3b8c55ea.3a181e89.js b/3b8c55ea.3a181e89.js deleted file mode 100644 index 6f511b8b..00000000 --- a/3b8c55ea.3a181e89.js +++ /dev/null @@ -1 +0,0 @@ -(window.webpackJsonp=window.webpackJsonp||[]).push([[14],{116:function(e,t,n){"use strict";n.d(t,"a",(function(){return b})),n.d(t,"b",(function(){return d}));var r=n(0),a=n.n(r);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function i(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function c(e){for(var t=1;t=0||(a[n]=e[n]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(a[n]=e[n])}return a}var l=a.a.createContext({}),u=function(e){var t=a.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},b=function(e){var t=u(e.components);return a.a.createElement(l.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return a.a.createElement(a.a.Fragment,{},t)}},m=a.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,o=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),b=u(n),m=r,d=b["".concat(i,".").concat(m)]||b[m]||s[m]||o;return n?a.a.createElement(d,c(c({ref:t},l),{},{components:n})):a.a.createElement(d,c({ref:t},l))}));function d(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var o=n.length,i=new Array(o);i[0]=m;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:r,i[1]=c;for(var l=2;l=0||(r[n]=e[n]);return r}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(i=0;i=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}var u=r.a.createContext({}),l=function(e){var t=r.a.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},d=function(e){var t=l(e.components);return r.a.createElement(u.Provider,{value:t},e.children)},p={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},b=r.a.forwardRef((function(e,t){var n=e.components,i=e.mdxType,o=e.originalType,a=e.parentName,u=c(e,["components","mdxType","originalType","parentName"]),d=l(n),b=i,m=d["".concat(a,".").concat(b)]||d[b]||p[b]||o;return n?r.a.createElement(m,s(s({ref:t},u),{},{components:n})):r.a.createElement(m,s({ref:t},u))}));function m(e,t){var n=arguments,i=t&&t.mdxType;if("string"==typeof e||i){var o=n.length,a=new Array(o);a[0]=b;var s={};for(var c in t)hasOwnProperty.call(t,c)&&(s[c]=t[c]);s.originalType=e,s.mdxType="string"==typeof e?e:i,a[1]=s;for(var u=2;u=0||(n[a]=e[a]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(o=0;o=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(n[a]=e[a])}return n}var p=n.a.createContext({}),b=function(e){var t=n.a.useContext(p),a=t;return e&&(a="function"==typeof e?e(t):l(l({},t),e)),a},s=function(e){var t=b(e.components);return n.a.createElement(p.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return n.a.createElement(n.a.Fragment,{},t)}},d=n.a.forwardRef((function(e,t){var a=e.components,o=e.mdxType,r=e.originalType,i=e.parentName,p=c(e,["components","mdxType","originalType","parentName"]),s=b(a),d=o,h=s["".concat(i,".").concat(d)]||s[d]||u[d]||r;return a?n.a.createElement(h,l(l({ref:t},p),{},{components:a})):n.a.createElement(h,l({ref:t},p))}));function h(e,t){var a=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var r=a.length,i=new Array(r);i[0]=d;var l={};for(var c in t)hasOwnProperty.call(t,c)&&(l[c]=t[c]);l.originalType=e,l.mdxType="string"==typeof e?e:o,i[1]=l;for(var p=2;p\n --client-secret=\n")),Object(r.b)("p",null,"Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/6.1.x/configuration/session_storage#redis-storage"}),"redis session storage")," should resolve this."),Object(r.b)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new FB App from ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.facebook.com/"}),"https://developers.facebook.com/")),Object(r.b)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://github.com/settings/developers"}),"https://github.com/settings/developers")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*")),Object(r.b)("p",null,"NOTE: When ",Object(r.b)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),Object(r.b)("p",null,"To restrict by organization only, include the following flag:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-org="": restrict logins to members of this organisation\n')),Object(r.b)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",Object(r.b)("inlineCode",{parentName:"p"},"-github-org"),":"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),Object(r.b)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),Object(r.b)("p",null,"If you'd like to allow access to users with ",Object(r.b)("strong",{parentName:"p"},"read only")," access to a ",Object(r.b)("strong",{parentName:"p"},"public")," repository you will need to provide a ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/settings/tokens"}),"token")," for a user that has write access to the repository. The token must be created with at least the ",Object(r.b)("inlineCode",{parentName:"p"},"public_repo")," scope:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-token="": the token to use when verifying repository collaborators\n')),Object(r.b)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-user="": allow logins by username, separated by a comma\n')),Object(r.b)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-login-url="http(s):///login/oauth/authorize"\n-redeem-url="http(s):///login/oauth/access_token"\n-validate-url="http(s):///api/v3"\n')),Object(r.b)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create new client in your Keycloak with ",Object(r.b)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",Object(r.b)("strong",{parentName:"li"},"Valid Redirect URIs")," '",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://internal.yourcompany.com/oauth2/callback'"}),"https://internal.yourcompany.com/oauth2/callback'")),Object(r.b)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),Object(r.b)("li",{parentName:"ol"},"Create a mapper with ",Object(r.b)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",Object(r.b)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),Object(r.b)("p",null,"Make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-provider=keycloak\n-client-id=\n-client-secret=\n-login-url="http(s):///realms//protocol/openid-connect/auth"\n-redeem-url="http(s):///realms//protocol/openid-connect/token"\n-validate-url="http(s):///realms//protocol/openid-connect/userinfo"\n-keycloak-group=\n')),Object(r.b)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak you should define the 'keycloak-group' value to /admin."),Object(r.b)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),Object(r.b)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"}),"these steps to add an application"),". Make sure to enable at least the ",Object(r.b)("inlineCode",{parentName:"p"},"openid"),", ",Object(r.b)("inlineCode",{parentName:"p"},"profile")," and ",Object(r.b)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://myapp.com/oauth2/callback"}),"https://myapp.com/oauth2/callback"),"."),Object(r.b)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/6.1.x/configuration/overview#generating-a-cookie-secret"}),"these steps")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' --provider="gitlab"\n --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n --client-id=GITLAB_CLIENT_ID\n --client-secret=GITLAB_CLIENT_SECRET\n --cookie-secret=COOKIE_SECRET\n')),Object(r.b)("p",null,"Restricting by group membership is possible with the following option:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),Object(r.b)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--oidc-issuer-url=""\n')),Object(r.b)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),Object(r.b)("p",null,"For LinkedIn, the registration steps are:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://www.linkedin.com/secure/developer"}),"https://www.linkedin.com/secure/developer")),Object(r.b)("li",{parentName:"ol"},"In the OAuth User Agreement section:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),Object(r.b)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),Object(r.b)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),Object(r.b)("li",{parentName:"ol"},"Take note of the ",Object(r.b)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",Object(r.b)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),Object(r.b)("h3",{id:"microsoft-azure-ad-provider"},"Microsoft Azure AD Provider"),Object(r.b)("p",null,"For adding an application to the Microsoft Azure AD follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"}),"these steps to add an application"),"."),Object(r.b)("p",null,"Take note of your ",Object(r.b)("inlineCode",{parentName:"p"},"TenantId")," if applicable for your situation. The ",Object(r.b)("inlineCode",{parentName:"p"},"TenantId")," can be used to override the default ",Object(r.b)("inlineCode",{parentName:"p"},"common")," authorization server with a tenant specific server."),Object(r.b)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),Object(r.b)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects. This provider was originally built against CoreOS Dex and we will use it as an example."),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Launch a Dex instance using the ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://dexidp.io/docs/getting-started/"}),"getting started guide"),"."),Object(r.b)("li",{parentName:"ol"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks."),Object(r.b)("li",{parentName:"ol"},"Login with the fixture use in the dex guide and run the oauth2-proxy with the following args:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' -provider oidc\n -provider-display-name "My OIDC Provider"\n -client-id oauth2-proxy\n -client-secret proxy\n -redirect-url http://127.0.0.1:4180/oauth2/callback\n -oidc-issuer-url http://127.0.0.1:5556\n -cookie-secure=false\n -email-domain example.com\n')),Object(r.b)("p",null,"The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta. To configure the OIDC provider for Okta, perform\nthe following steps:"),Object(r.b)("h4",{id:"configuring-the-oidc-provider-with-okta"},"Configuring the OIDC Provider with Okta"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",Object(r.b)("inlineCode",{parentName:"li"},"example.oktapreview.com")),Object(r.b)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",Object(r.b)("inlineCode",{parentName:"li"},"default")," will work.")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Security")," then select ",Object(r.b)("strong",{parentName:"li"},"API")),Object(r.b)("li",{parentName:"ul"},"Click ",Object(r.b)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),Object(r.b)("li",{parentName:"ul"},"Fill out the ",Object(r.b)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),Object(r.b)("li",{parentName:"ul"},"For ",Object(r.b)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://example.corp.com"}),"https://example.corp.com")),Object(r.b)("li",{parentName:"ul"},"Fill out a ",Object(r.b)("strong",{parentName:"li"},"Description")),Object(r.b)("li",{parentName:"ul"},"Add any ",Object(r.b)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),Object(r.b)("li",{parentName:"ul"},"The default settings will work for other options.\n",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"}),"See Okta documentation for more information on Authorization Servers"))),Object(r.b)("ol",{start:3},Object(r.b)("li",{parentName:"ol"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Applications")," then select ",Object(r.b)("strong",{parentName:"li"},"Add Application"),".")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"Web")," for the ",Object(r.b)("strong",{parentName:"li"},"Platform")," setting."),Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"OpenID Connect")," and click ",Object(r.b)("strong",{parentName:"li"},"Create")),Object(r.b)("li",{parentName:"ul"},"Pick an ",Object(r.b)("strong",{parentName:"li"},"Application Name")," such as ",Object(r.b)("inlineCode",{parentName:"li"},"Example App"),"."),Object(r.b)("li",{parentName:"ul"},"Set the ",Object(r.b)("strong",{parentName:"li"},"Login redirect URI")," to ",Object(r.b)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"General")," set the ",Object(r.b)("strong",{parentName:"li"},"Allowed grant types")," to ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token"),"."),Object(r.b)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client Secret"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),Object(r.b)("ol",{start:4},Object(r.b)("li",{parentName:"ol"},"Create a configuration file like the following:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n "https://example.corp.com"\n]\nemail_domains = [\n "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')),Object(r.b)("p",null,"The ",Object(r.b)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",Object(r.b)("strong",{parentName:"p"},"Authorization Server"),"'s ",Object(r.b)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://corp.okta.com"}),"https://corp.okta.com"),"\nThe ",Object(r.b)("inlineCode",{parentName:"p"},"client_id")," and ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," to encrypt the cookie."),Object(r.b)("p",null,"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),Object(r.b)("h4",{id:"configuring-the-oidc-provider-with-okta---localhost"},"Configuring the OIDC Provider with Okta - localhost"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Signup for developer account: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/signup/"}),"https://developer.okta.com/signup/")),Object(r.b)("li",{parentName:"ol"},"Create New ",Object(r.b)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),Object(r.b)("li",{parentName:"ol"},"Example Application Settings for localhost:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Name:")," My Web App"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Group assignments:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Everyone")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Grant type allowed:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token")))),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),Object(r.b)("li",{parentName:"ol"},"Example config file ",Object(r.b)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n "http://0.0.0.0:8080"\n]\nemail_domains = [\n "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),Object(r.b)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),Object(r.b)("h3",{id:"logingov-provider"},"login.gov Provider"),Object(r.b)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://login.gov/developers/"}),"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),Object(r.b)("p",null,"A developer guide is available here: ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://developers.login.gov/"}),"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),Object(r.b)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),Object(r.b)("p",null,"First, register your application in the dashboard. The important bits are:"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Identity protocol: make this ",Object(r.b)("inlineCode",{parentName:"li"},"Openid connect")),Object(r.b)("li",{parentName:"ul"},"Issuer: do what they say for OpenID Connect. We will refer to this string as ",Object(r.b)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),Object(r.b)("li",{parentName:"ul"},"Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",Object(r.b)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",Object(r.b)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",Object(r.b)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),Object(r.b)("li",{parentName:"ul"},"Return to App URL: Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/")),Object(r.b)("li",{parentName:"ul"},"Redirect URIs: Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),Object(r.b)("li",{parentName:"ul"},"Attribute Bundle: Make sure that email is selected.")),Object(r.b)("p",null,"Now start the proxy up with the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'./oauth2-proxy -provider login.gov \\\n -client-id=${LOGINGOV_ISSUER} \\\n -redirect-url=http://localhost:4180/oauth2/callback \\\n -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n -cookie-secure=false \\\n -email-domain=gsa.gov \\\n -upstream=http://localhost:3000/ \\\n -cookie-secret=somerandomstring12341234567890AB \\\n -cookie-domain=localhost \\\n -skip-provider-button=true \\\n -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),Object(r.b)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",Object(r.b)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",Object(r.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",Object(r.b)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),Object(r.b)("p",null,"Once it is running, you should be able to go to ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:3000/"),". In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),Object(r.b)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),Object(r.b)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),Object(r.b)("p",null,"In this case, you can set the ",Object(r.b)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," -provider oidc\n -client-id oauth2-proxy\n -client-secret proxy\n -redirect-url http://127.0.0.1:4180/oauth2/callback\n -oidc-issuer-url http://127.0.0.1:5556\n -skip-oidc-discovery\n -login-url http://127.0.0.1:5556/authorize\n -redeem-url http://127.0.0.1:5556/token\n -oidc-jwks-url http://127.0.0.1:5556/keys\n -cookie-secure=false\n -email-domain example.com\n")),Object(r.b)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),Object(r.b)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),Object(r.b)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",Object(r.b)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",Object(r.b)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),Object(r.b)("p",null,"Refer to the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"}),"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',Object(r.b)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' -provider nextcloud\n -client-id \n -client-secret \n -login-url="/index.php/apps/oauth2/authorize"\n -redeem-url="/index.php/apps/oauth2/api/v1/token"\n -validate-url="/ocs/v2.php/cloud/user?format=json"\n')),Object(r.b)("p",null,"Note: in ",Object(r.b)("em",{parentName:"p"},"all")," cases the validate-url will ",Object(r.b)("em",{parentName:"p"},"not")," have the ",Object(r.b)("inlineCode",{parentName:"p"},"index.php"),"."),Object(r.b)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://cloud.digitalocean.com/account/api/applications"}),"Create a new OAuth application"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),Object(r.b)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',Object(r.b)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=digitalocean\n --client-id=\n --client-secret=\n")),Object(r.b)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",Object(r.b)("inlineCode",{parentName:"p"},"https:///oauth2/callback"),". If you need to change it, you can use the ",Object(r.b)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),Object(r.b)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"}),"Add a new OAuth consumer"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},'In "Callback URL" use ',Object(r.b)("inlineCode",{parentName:"li"},"https:///oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"")," with the actual hostname that oauth2-proxy is running on."),Object(r.b)("li",{parentName:"ul"},"In Permissions section select:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"Account -> Email"),Object(r.b)("li",{parentName:"ul"},"Team membership -> Read"),Object(r.b)("li",{parentName:"ul"},"Repositories -> Read"))))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=bitbucket\n --client-id=\n --client-secret=\n")),Object(r.b)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-team="),". To restrict the access to only these users who has access to one selected repository use ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-repository="),"."),Object(r.b)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new application: ",Object(r.b)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",Object(r.b)("inlineCode",{parentName:"li"},"https:///oauth2/callback")),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),Object(r.b)("li",{parentName:"ol"},"Pass the following options to the proxy:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' --provider="github"\n --redirect-url="https:///oauth2/callback"\n --provider-display-name="Gitea"\n --client-id="< client_id as generated by Gitea >"\n --client-secret="< client_secret as generated by Gitea >"\n --login-url="https://< your gitea host >/login/oauth/authorize"\n --redeem-url="https://< your gitea host >/login/oauth/access_token"\n --validate-url="https://< your gitea host >/api/v1"\n')),Object(r.b)("h2",{id:"email-authentication"},"Email Authentication"),Object(r.b)("p",null,"To authorize by email domain use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),Object(r.b)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),Object(r.b)("p",null,"Follow the examples in the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"}),Object(r.b)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",Object(r.b)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",Object(r.b)("inlineCode",{parentName:"p"},"case")," to\n",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"}),Object(r.b)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",Object(r.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",Object(r.b)("inlineCode",{parentName:"p"},"Provider"),"."))}b.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/3fa022c7.05712c0a.js b/3fa022c7.05712c0a.js deleted file mode 100644 index 1294e3da..00000000 --- a/3fa022c7.05712c0a.js +++ /dev/null @@ -1 +0,0 @@ -(window.webpackJsonp=window.webpackJsonp||[]).push([[17],{116:function(e,t,a){"use strict";a.d(t,"a",(function(){return p})),a.d(t,"b",(function(){return O}));var n=a(0),r=a.n(n);function b(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function i(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function l(e){for(var t=1;t=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var b=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var o=r.a.createContext({}),s=function(e){var t=r.a.useContext(o),a=t;return e&&(a="function"==typeof e?e(t):l(l({},t),e)),a},p=function(e){var t=s(e.components);return r.a.createElement(o.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},u=r.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,b=e.originalType,i=e.parentName,o=c(e,["components","mdxType","originalType","parentName"]),p=s(a),u=n,O=p["".concat(i,".").concat(u)]||p[u]||d[u]||b;return a?r.a.createElement(O,l(l({ref:t},o),{},{components:a})):r.a.createElement(O,l({ref:t},o))}));function O(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var b=a.length,i=new Array(b);i[0]=u;var l={};for(var c in t)hasOwnProperty.call(t,c)&&(l[c]=t[c]);l.originalType=e,l.mdxType="string"==typeof e?e:n,i[1]=l;for(var o=2;o - + - -Page Not Found | OAuth2 Proxy - - - + +Page Not Found | OAuth2 Proxy + +
-

Page Not Found

We could not find what you were looking for.

Please contact the owner of the site that linked you to the original URL and let them know their link is broken.

Copyright © 2022 OAuth2 Proxy.
- - - +

Page Not Found

We could not find what you were looking for.

Please contact the owner of the site that linked you to the original URL and let them know their link is broken.

Copyright © 2022 OAuth2 Proxy.
+ + \ No newline at end of file diff --git a/41de83de.9aa82ee1.js b/41de83de.9aa82ee1.js deleted file mode 100644 index 39fa5447..00000000 --- a/41de83de.9aa82ee1.js +++ /dev/null @@ -1 +0,0 @@ -(window.webpackJsonp=window.webpackJsonp||[]).push([[18],{116:function(e,t,r){"use strict";r.d(t,"a",(function(){return l})),r.d(t,"b",(function(){return f}));var n=r(0),o=r.n(n);function i(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function a(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function c(e){for(var t=1;t=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var u=o.a.createContext({}),p=function(e){var t=o.a.useContext(u),r=t;return e&&(r="function"==typeof e?e(t):c(c({},t),e)),r},l=function(e){var t=p(e.components);return o.a.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,i=e.originalType,a=e.parentName,u=s(e,["components","mdxType","originalType","parentName"]),l=p(r),b=n,f=l["".concat(a,".").concat(b)]||l[b]||d[b]||i;return r?o.a.createElement(f,c(c({ref:t},u),{},{components:r})):o.a.createElement(f,c({ref:t},u))}));function f(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var i=r.length,a=new Array(i);a[0]=b;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:n,a[1]=c;for(var u=2;u=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var u=o.a.createContext({}),p=function(e){var t=o.a.useContext(u),r=t;return e&&(r="function"==typeof e?e(t):c(c({},t),e)),r},l=function(e){var t=p(e.components);return o.a.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,i=e.originalType,a=e.parentName,u=s(e,["components","mdxType","originalType","parentName"]),l=p(r),b=n,f=l["".concat(a,".").concat(b)]||l[b]||d[b]||i;return r?o.a.createElement(f,c(c({ref:t},u),{},{components:r})):o.a.createElement(f,c({ref:t},u))}));function f(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var i=r.length,a=new Array(i);a[0]=b;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:n,a[1]=c;for(var u=2;u=0||(r[n]=e[n]);return r}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(a=0;a=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}var s=r.a.createContext({}),u=function(e){var t=r.a.useContext(s),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},p=function(e){var t=u(e.components);return r.a.createElement(s.Provider,{value:t},e.children)},m={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},d=r.a.forwardRef((function(e,t){var n=e.components,a=e.mdxType,o=e.originalType,l=e.parentName,s=i(e,["components","mdxType","originalType","parentName"]),p=u(n),d=a,y=p["".concat(l,".").concat(d)]||p[d]||m[d]||o;return n?r.a.createElement(y,c(c({ref:t},s),{},{components:n})):r.a.createElement(y,c({ref:t},s))}));function y(e,t){var n=arguments,a=t&&t.mdxType;if("string"==typeof e||a){var o=n.length,l=new Array(o);l[0]=d;var c={};for(var i in t)hasOwnProperty.call(t,i)&&(c[i]=t[i]);c.originalType=e,c.mdxType="string"==typeof e?e:a,l[1]=c;for(var s=2;s{const n=document.createElement("textarea"),a=document.activeElement;n.value=e,n.setAttribute("readonly",""),n.style.contain="strict",n.style.position="absolute",n.style.left="-9999px",n.style.fontSize="12pt";const r=document.getSelection();let o=!1;r.rangeCount>0&&(o=r.getRangeAt(0)),t.append(n),n.select(),n.selectionStart=0,n.selectionEnd=e.length;let l=!1;try{l=document.execCommand("copy")}catch(c){}return n.remove(),o&&(r.removeAllRanges(),r.addRange(o)),a&&a.focus(),l};e.exports=a,e.exports.default=a},135:function(e,t){e.exports.parse=function(e){var t=e.split(",").map((function(e){return function(e){if(/^-?\d+$/.test(e))return parseInt(e,10);var t;if(t=e.match(/^(-?\d+)(-|\.\.\.?|\u2025|\u2026|\u22EF)(-?\d+)$/)){var n=t[1],a=t[2],r=t[3];if(n&&r){var o=[],l=(n=parseInt(n))<(r=parseInt(r))?1:-1;"-"!=a&&".."!=a&&"\u2025"!=a||(r+=l);for(var c=n;c!=r;c+=l)o.push(c);return o}}return[]}(e)}));return 0===t.length?[]:1===t.length?Array.isArray(t[0])?t[0]:t:t.reduce((function(e,t){return Array.isArray(e)||(e=[e]),Array.isArray(t)||(t=[t]),e.concat(t)}))}},136:function(e,t,n){"use strict";var a=n(2),r=n(0),o=n.n(r),l=n(123),c=n(117),i={plain:{backgroundColor:"#2a2734",color:"#9a86fd"},styles:[{types:["comment","prolog","doctype","cdata","punctuation"],style:{color:"#6c6783"}},{types:["namespace"],style:{opacity:.7}},{types:["tag","operator","number"],style:{color:"#e09142"}},{types:["property","function"],style:{color:"#9a86fd"}},{types:["tag-id","selector","atrule-id"],style:{color:"#eeebff"}},{types:["attr-name"],style:{color:"#c4b9fe"}},{types:["boolean","string","entity","url","attr-value","keyword","control","directive","unit","statement","regex","at-rule","placeholder","variable"],style:{color:"#ffcc99"}},{types:["deleted"],style:{textDecorationLine:"line-through"}},{types:["inserted"],style:{textDecorationLine:"underline"}},{types:["italic"],style:{fontStyle:"italic"}},{types:["important","bold"],style:{fontWeight:"bold"}},{types:["important"],style:{color:"#c4b9fe"}}]},s={Prism:n(20).a,theme:i};function u(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function p(){return(p=Object.assign||function(e){for(var t=1;t0&&e[n-1]===t?e:e.concat(t)},f=function(e,t){var n=e.plain,a=Object.create(null),r=e.styles.reduce((function(e,n){var a=n.languages,r=n.style;return a&&!a.includes(t)||n.types.forEach((function(t){var n=p({},e[t],r);e[t]=n})),e}),a);return r.root=n,r.plain=p({},n,{backgroundColor:null}),r};function h(e,t){var n={};for(var a in e)Object.prototype.hasOwnProperty.call(e,a)&&-1===t.indexOf(a)&&(n[a]=e[a]);return n}var b=function(e){function t(){for(var t=this,n=[],a=arguments.length;a--;)n[a]=arguments[a];e.apply(this,n),u(this,"getThemeDict",(function(e){if(void 0!==t.themeDict&&e.theme===t.prevTheme&&e.language===t.prevLanguage)return t.themeDict;t.prevTheme=e.theme,t.prevLanguage=e.language;var n=e.theme?f(e.theme,e.language):void 0;return t.themeDict=n})),u(this,"getLineProps",(function(e){var n=e.key,a=e.className,r=e.style,o=p({},h(e,["key","className","style","line"]),{className:"token-line",style:void 0,key:void 0}),l=t.getThemeDict(t.props);return void 0!==l&&(o.style=l.plain),void 0!==r&&(o.style=void 0!==o.style?p({},o.style,r):r),void 0!==n&&(o.key=n),a&&(o.className+=" "+a),o})),u(this,"getStyleForToken",(function(e){var n=e.types,a=e.empty,r=n.length,o=t.getThemeDict(t.props);if(void 0!==o){if(1===r&&"plain"===n[0])return a?{display:"inline-block"}:void 0;if(1===r&&!a)return o[n[0]];var l=a?{display:"inline-block"}:{},c=n.map((function(e){return o[e]}));return Object.assign.apply(Object,[l].concat(c))}})),u(this,"getTokenProps",(function(e){var n=e.key,a=e.className,r=e.style,o=e.token,l=p({},h(e,["key","className","style","token"]),{className:"token "+o.types.join(" "),children:o.content,style:t.getStyleForToken(o),key:void 0});return void 0!==r&&(l.style=void 0!==l.style?p({},l.style,r):r),void 0!==n&&(l.key=n),a&&(l.className+=" "+a),l}))}return e&&(t.__proto__=e),t.prototype=Object.create(e&&e.prototype),t.prototype.constructor=t,t.prototype.render=function(){var e=this.props,t=e.Prism,n=e.language,a=e.code,r=e.children,o=this.getThemeDict(this.props),l=t.languages[n];return r({tokens:function(e){for(var t=[[]],n=[e],a=[0],r=[e.length],o=0,l=0,c=[],i=[c];l>-1;){for(;(o=a[l]++)0?u:["plain"],s=p):(u=y(u,p.type),p.alias&&(u=y(u,p.alias)),s=p.content),"string"==typeof s){var f=s.split(m),h=f.length;c.push({types:u,content:f[0]});for(var b=1;b0}))}l&&T.test(l)&&(k=l.match(T)[0].split("title=")[1].replace(/"+/g,""));var x=n&&n.replace(/language-/,"");!x&&i.defaultLanguage&&(x=i.defaultLanguage);var S=t.replace(/\n$/,"");if(0===g.length&&void 0!==x){for(var I,D="",L=function(e){switch(e){case"js":case"javascript":case"ts":case"typescript":return _(["js","jsBlock"]);case"jsx":case"tsx":return _(["js","jsBlock","jsx"]);case"html":return _(["js","jsBlock","html"]);case"python":case"py":return _(["python"]);default:return _()}}(x),M=t.replace(/\n$/,"").split("\n"),B=0;B=0||(a[n]=e[n]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(a[n]=e[n])}return a}var l=a.a.createContext({}),s=function(e){var t=a.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},u=function(e){var t=s(e.components);return a.a.createElement(l.Provider,{value:t},e.children)},b={inlineCode:"code",wrapper:function(e){var t=e.children;return a.a.createElement(a.a.Fragment,{},t)}},m=a.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,o=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),u=s(n),m=r,d=u["".concat(i,".").concat(m)]||u[m]||b[m]||o;return n?a.a.createElement(d,c(c({ref:t},l),{},{components:n})):a.a.createElement(d,c({ref:t},l))}));function d(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var o=n.length,i=new Array(o);i[0]=m;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:r,i[1]=c;for(var l=2;l=0||(a[n]=e[n]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(a[n]=e[n])}return a}var i=a.a.createContext({}),u=function(e){var t=a.a.useContext(i),n=t;return e&&(n="function"==typeof e?e(t):l(l({},t),e)),n},p=function(e){var t=u(e.components);return a.a.createElement(i.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return a.a.createElement(a.a.Fragment,{},t)}},y=a.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,o=e.originalType,c=e.parentName,i=s(e,["components","mdxType","originalType","parentName"]),p=u(n),y=r,m=p["".concat(c,".").concat(y)]||p[y]||d[y]||o;return n?a.a.createElement(m,l(l({ref:t},i),{},{components:n})):a.a.createElement(m,l({ref:t},i))}));function m(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var o=n.length,c=new Array(o);c[0]=y;var l={};for(var s in t)hasOwnProperty.call(t,s)&&(l[s]=t[s]);l.originalType=e,l.mdxType="string"==typeof e?e:r,c[1]=l;for(var i=2;i{const n=document.createElement("textarea"),r=document.activeElement;n.value=e,n.setAttribute("readonly",""),n.style.contain="strict",n.style.position="absolute",n.style.left="-9999px",n.style.fontSize="12pt";const a=document.getSelection();let o=!1;a.rangeCount>0&&(o=a.getRangeAt(0)),t.append(n),n.select(),n.selectionStart=0,n.selectionEnd=e.length;let c=!1;try{c=document.execCommand("copy")}catch(l){}return n.remove(),o&&(a.removeAllRanges(),a.addRange(o)),r&&r.focus(),c};e.exports=r,e.exports.default=r},135:function(e,t){e.exports.parse=function(e){var t=e.split(",").map((function(e){return function(e){if(/^-?\d+$/.test(e))return parseInt(e,10);var t;if(t=e.match(/^(-?\d+)(-|\.\.\.?|\u2025|\u2026|\u22EF)(-?\d+)$/)){var n=t[1],r=t[2],a=t[3];if(n&&a){var o=[],c=(n=parseInt(n))<(a=parseInt(a))?1:-1;"-"!=r&&".."!=r&&"\u2025"!=r||(a+=c);for(var l=n;l!=a;l+=c)o.push(l);return o}}return[]}(e)}));return 0===t.length?[]:1===t.length?Array.isArray(t[0])?t[0]:t:t.reduce((function(e,t){return Array.isArray(e)||(e=[e]),Array.isArray(t)||(t=[t]),e.concat(t)}))}},136:function(e,t,n){"use strict";var r=n(2),a=n(0),o=n.n(a),c=n(123),l=n(117),s={plain:{backgroundColor:"#2a2734",color:"#9a86fd"},styles:[{types:["comment","prolog","doctype","cdata","punctuation"],style:{color:"#6c6783"}},{types:["namespace"],style:{opacity:.7}},{types:["tag","operator","number"],style:{color:"#e09142"}},{types:["property","function"],style:{color:"#9a86fd"}},{types:["tag-id","selector","atrule-id"],style:{color:"#eeebff"}},{types:["attr-name"],style:{color:"#c4b9fe"}},{types:["boolean","string","entity","url","attr-value","keyword","control","directive","unit","statement","regex","at-rule","placeholder","variable"],style:{color:"#ffcc99"}},{types:["deleted"],style:{textDecorationLine:"line-through"}},{types:["inserted"],style:{textDecorationLine:"underline"}},{types:["italic"],style:{fontStyle:"italic"}},{types:["important","bold"],style:{fontWeight:"bold"}},{types:["important"],style:{color:"#c4b9fe"}}]},i={Prism:n(20).a,theme:s};function u(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function p(){return(p=Object.assign||function(e){for(var t=1;t0&&e[n-1]===t?e:e.concat(t)},f=function(e,t){var n=e.plain,r=Object.create(null),a=e.styles.reduce((function(e,n){var r=n.languages,a=n.style;return r&&!r.includes(t)||n.types.forEach((function(t){var n=p({},e[t],a);e[t]=n})),e}),r);return a.root=n,a.plain=p({},n,{backgroundColor:null}),a};function h(e,t){var n={};for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&-1===t.indexOf(r)&&(n[r]=e[r]);return n}var g=function(e){function t(){for(var t=this,n=[],r=arguments.length;r--;)n[r]=arguments[r];e.apply(this,n),u(this,"getThemeDict",(function(e){if(void 0!==t.themeDict&&e.theme===t.prevTheme&&e.language===t.prevLanguage)return t.themeDict;t.prevTheme=e.theme,t.prevLanguage=e.language;var n=e.theme?f(e.theme,e.language):void 0;return t.themeDict=n})),u(this,"getLineProps",(function(e){var n=e.key,r=e.className,a=e.style,o=p({},h(e,["key","className","style","line"]),{className:"token-line",style:void 0,key:void 0}),c=t.getThemeDict(t.props);return void 0!==c&&(o.style=c.plain),void 0!==a&&(o.style=void 0!==o.style?p({},o.style,a):a),void 0!==n&&(o.key=n),r&&(o.className+=" "+r),o})),u(this,"getStyleForToken",(function(e){var n=e.types,r=e.empty,a=n.length,o=t.getThemeDict(t.props);if(void 0!==o){if(1===a&&"plain"===n[0])return r?{display:"inline-block"}:void 0;if(1===a&&!r)return o[n[0]];var c=r?{display:"inline-block"}:{},l=n.map((function(e){return o[e]}));return Object.assign.apply(Object,[c].concat(l))}})),u(this,"getTokenProps",(function(e){var n=e.key,r=e.className,a=e.style,o=e.token,c=p({},h(e,["key","className","style","token"]),{className:"token "+o.types.join(" "),children:o.content,style:t.getStyleForToken(o),key:void 0});return void 0!==a&&(c.style=void 0!==c.style?p({},c.style,a):a),void 0!==n&&(c.key=n),r&&(c.className+=" "+r),c}))}return e&&(t.__proto__=e),t.prototype=Object.create(e&&e.prototype),t.prototype.constructor=t,t.prototype.render=function(){var e=this.props,t=e.Prism,n=e.language,r=e.code,a=e.children,o=this.getThemeDict(this.props),c=t.languages[n];return a({tokens:function(e){for(var t=[[]],n=[e],r=[0],a=[e.length],o=0,c=0,l=[],s=[l];c>-1;){for(;(o=r[c]++)0?u:["plain"],i=p):(u=m(u,p.type),p.alias&&(u=m(u,p.alias)),i=p.content),"string"==typeof i){var f=i.split(d),h=f.length;l.push({types:u,content:f[0]});for(var g=1;g0}))}c&&S.test(c)&&(j=c.match(S)[0].split("title=")[1].replace(/"+/g,""));var w=n&&n.replace(/language-/,"");!w&&s.defaultLanguage&&(w=s.defaultLanguage);var L=t.replace(/\n$/,"");if(0===v.length&&void 0!==w){for(var B,D="",_=function(e){switch(e){case"js":case"javascript":case"ts":case"typescript":return P(["js","jsBlock"]);case"jsx":case"tsx":return P(["js","jsBlock","jsx"]);case"html":return P(["js","jsBlock","html"]);case"python":case"py":return P(["python"]);default:return P()}}(w),A=t.replace(/\n$/,"").split("\n"),I=0;I=n}));if(t){if(t.getBoundingClientRect().top>=n){var r=e[e.indexOf(t)-1];return null!=r?r:t}return t}return e[e.length-1]}();if(r)for(var a=0,l=!1,s=document.getElementsByClassName(e);a=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var u=o.a.createContext({}),p=function(e){var t=o.a.useContext(u),r=t;return e&&(r="function"==typeof e?e(t):c(c({},t),e)),r},l=function(e){var t=p(e.components);return o.a.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,i=e.originalType,a=e.parentName,u=s(e,["components","mdxType","originalType","parentName"]),l=p(r),b=n,f=l["".concat(a,".").concat(b)]||l[b]||d[b]||i;return r?o.a.createElement(f,c(c({ref:t},u),{},{components:r})):o.a.createElement(f,c({ref:t},u))}));function f(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var i=r.length,a=new Array(i);a[0]=b;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:n,a[1]=c;for(var u=2;u=0||(a[r]=e[r]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(a[r]=e[r])}return a}var l=a.a.createContext({}),u=function(e){var t=a.a.useContext(l),r=t;return e&&(r="function"==typeof e?e(t):c(c({},t),e)),r},b=function(e){var t=u(e.components);return a.a.createElement(l.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return a.a.createElement(a.a.Fragment,{},t)}},d=a.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,o=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),b=u(r),d=n,m=b["".concat(i,".").concat(d)]||b[d]||s[d]||o;return r?a.a.createElement(m,c(c({ref:t},l),{},{components:r})):a.a.createElement(m,c({ref:t},l))}));function m(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var o=r.length,i=new Array(o);i[0]=d;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:n,i[1]=c;for(var l=2;l&1 | grep OK\noauth2-proxy-x.y.z.linux-amd64: OK\n")),Object(o.b)("ol",{start:2},Object(o.b)("li",{parentName:"ol"},Object(o.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/7.1.x/configuration/oauth_provider"}),"Select a Provider and Register an OAuth Application with a Provider")),Object(o.b)("li",{parentName:"ol"},Object(o.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/7.1.x/configuration/overview"}),"Configure OAuth2 Proxy using config file, command line options, or environment variables")),Object(o.b)("li",{parentName:"ol"},Object(o.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/7.1.x/configuration/tls"}),"Configure SSL or Deploy behind a SSL endpoint")," (example provided for Nginx)")))}u.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/6f497b56.9a644fc6.js b/6f497b56.9a644fc6.js deleted file mode 100644 index 19110267..00000000 --- a/6f497b56.9a644fc6.js +++ /dev/null @@ -1 +0,0 @@ -(window.webpackJsonp=window.webpackJsonp||[]).push([[23],{116:function(e,t,r){"use strict";r.d(t,"a",(function(){return l})),r.d(t,"b",(function(){return f}));var n=r(0),a=r.n(n);function o(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function i(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function s(e){for(var t=1;t=0||(a[r]=e[r]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(a[r]=e[r])}return a}var c=a.a.createContext({}),p=function(e){var t=a.a.useContext(c),r=t;return e&&(r="function"==typeof e?e(t):s(s({},t),e)),r},l=function(e){var t=p(e.components);return a.a.createElement(c.Provider,{value:t},e.children)},b={inlineCode:"code",wrapper:function(e){var t=e.children;return a.a.createElement(a.a.Fragment,{},t)}},d=a.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,o=e.originalType,i=e.parentName,c=u(e,["components","mdxType","originalType","parentName"]),l=p(r),d=n,f=l["".concat(i,".").concat(d)]||l[d]||b[d]||o;return r?a.a.createElement(f,s(s({ref:t},c),{},{components:r})):a.a.createElement(f,s({ref:t},c))}));function f(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var o=r.length,i=new Array(o);i[0]=d;var s={};for(var u in t)hasOwnProperty.call(t,u)&&(s[u]=t[u]);s.originalType=e,s.mdxType="string"==typeof e?e:n,i[1]=s;for(var c=2;c=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var b=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var o=r.a.createContext({}),d=function(e){var t=r.a.useContext(o),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},s=function(e){var t=d(e.components);return r.a.createElement(o.Provider,{value:t},e.children)},p={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},O=r.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,b=e.originalType,l=e.parentName,o=c(e,["components","mdxType","originalType","parentName"]),s=d(a),O=n,j=s["".concat(l,".").concat(O)]||s[O]||p[O]||b;return a?r.a.createElement(j,i(i({ref:t},o),{},{components:a})):r.a.createElement(j,i({ref:t},o))}));function j(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var b=a.length,l=new Array(b);l[0]=O;var i={};for(var c in t)hasOwnProperty.call(t,c)&&(i[c]=t[c]);i.originalType=e,i.mdxType="string"==typeof e?e:n,l[1]=i;for(var o=2;oauth_request directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",children:[]},{value:"Configuring for use with the Traefik (v2) ForwardAuth middleware",id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware",children:[{value:"ForwardAuth with 401 errors middleware",id:"forwardauth-with-401-errors-middleware",children:[]},{value:"ForwardAuth with static upstreams configuration",id:"forwardauth-with-static-upstreams-configuration",children:[]}]}],s={rightToc:d};function p(e){var t=e.components,a=Object(r.a)(e,["components"]);return Object(b.b)("wrapper",Object(n.a)({},s,a,{components:t,mdxType:"MDXLayout"}),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#command-line-options"}),"command line options"),", ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#environment-variables"}),"environment variables")," or ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file")," (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."),Object(b.b)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),Object(b.b)("p",null,"To generate a strong cookie secret use one of the below commands:"),Object(b.b)(l.a,{defaultValue:"python",values:[{label:"Python",value:"python"},{label:"Bash",value:"bash"},{label:"OpenSSL",value:"openssl"},{label:"PowerShell",value:"powershell"},{label:"Terraform",value:"terraform"}],mdxType:"Tabs"},Object(b.b)(i.a,{value:"python",mdxType:"TabItem"},Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-shell"}),"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'\n"))),Object(b.b)(i.a,{value:"bash",mdxType:"TabItem"},Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-shell"}),"cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1 | base64\n"))),Object(b.b)(i.a,{value:"openssl",mdxType:"TabItem"},Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-shell"}),"openssl rand -base64 32 | tr -- '+/' '-_'\n"))),Object(b.b)(i.a,{value:"powershell",mdxType:"TabItem"},Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-shell"}),'# Add System.Web assembly to session, just in case\nAdd-Type -AssemblyName System.Web\n[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")\n'))),Object(b.b)(i.a,{value:"terraform",mdxType:"TabItem"},Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-shell"}),'# Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret\nresource "random_password" "cookie_secret" {\n length = 32\n override_special = "-_"\n}\n')))),Object(b.b)("h3",{id:"config-file"},"Config File"),Object(b.b)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),Object(b.b)("p",null,"An example ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"}),"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",Object(b.b)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),Object(b.b)("h3",{id:"command-line-options"},"Command Line Options"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Option"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Default"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--acr-values")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"optional, see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"}),"docs")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--approval-prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth approval_prompt"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"force"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log authentication attempts"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for authentication log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate against emails via file (one per line)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--azure-tenant")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"go to a tenant-specific or common (tenant-independent) endpoint."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"common"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--basic-auth-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the password to set when passing the HTTP Basic Auth header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-id")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client ID, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the file with OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--config")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to config file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Optional cookie domains to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-expire")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"expire timeframe for cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"168h0m0s")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-httponly")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HttpOnly cookie flag"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the name of the cookie that the oauth_proxy creates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"an optional cookie path to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"/poc/"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-refresh")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"refresh the cookie after this duration; ",Object(b.b)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote1"}),"1"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the seed string for secure cookies (optionally base64 encoded)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secure")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://owasp.org/www-community/controls/SecureFlag"}),"secure (HTTPS only) cookie flag")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-samesite")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set SameSite cookie attribute (",Object(b.b)("inlineCode",{parentName:"td"},'"lax"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"strict"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"none"'),", or ",Object(b.b)("inlineCode",{parentName:"td"},'""'),")."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--custom-templates-dir")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to custom html templates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--custom-sign-in-logo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),'path or a URL to an custom image for the sign_in page logo. Use \\"-\\" to disable default logo.'),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"display username / password login form if an htpasswd file is provided"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--email-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate emails with the specified domain (may be given multiple times). Use ",Object(b.b)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--errors-to-info-log")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"redirects error-level logging to default log channel instead of stderr"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"if ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",Object(b.b)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",Object(b.b)("inlineCode",{parentName:"td"},"iss"),", ",Object(b.b)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--exclude-logging-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"comma separated list of paths to exclude from logging, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"/ping,/path2"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--flush-interval")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"period between flushing response buffers when streaming responses"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"1s"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--force-https")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enforce https redirect"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"false"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--force-json-errors")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"force JSON errors instead of HTTP error pages or redirects"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"false"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--banner")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) banner string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--footer")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) footer string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-org")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this organisation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-team")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these teams (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to collaborators of this repository formatted as ",Object(b.b)("inlineCode",{parentName:"td"},"orgname/repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the token to use when verifying repository collaborators (must have push access to the repository)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gitlab-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these groups (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gitlab-projects")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these projects (may be given multiple times) formatted as ",Object(b.b)("inlineCode",{parentName:"td"},"orgname/repo=accesslevel"),". Access level should be a value matching ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://docs.gitlab.com/ee/api/members.html#valid-access-levels"}),"Gitlab access levels"),", defaulted to 20 if absent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-admin-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the google admin to impersonate for api calls"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this google group (may be given multiple times)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-service-account-json")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the path to the service account json credentials"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--htpasswd-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"additionally authenticate against a htpasswd file. Entries must be created with ",Object(b.b)("inlineCode",{parentName:"td"},"htpasswd -B")," for bcrypt encryption"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--htpasswd-user-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the groups to be set on sessions for htpasswd users"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--http-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"[http://]:")," or ",Object(b.b)("inlineCode",{parentName:"td"},"unix://")," to listen on for HTTP clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"127.0.0.1:4180"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--https-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},":")," to listen on for HTTPS clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'":443"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-compress")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Should rotated log files be compressed using gzip"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-filename")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File to log requests to, empty for ",Object(b.b)("inlineCode",{parentName:"td"},"stdout")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (stdout)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-local-time")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Use local time in log files and backup filenames instead of UTC"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true (local time)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-age")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of days to retain old log files"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"7")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-backups")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of old log files to retain; 0 to disable"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-size")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum size in megabytes of the log file before rotation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"100")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"private key in PEM format used to sign JWT, so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},'--jwt-key="${OAUTH2_PROXY_JWT_KEY}"'),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to the private key file in PEM format used to sign the JWT so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem"),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--login-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authentication endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-allow-unverified-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"don't fail if an email address in an id_token is not verified"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-issuer-verification")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-nonce")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip verifying the OIDC ID Token's nonce claim"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-issuer-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OpenID Connect issuer URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://accounts.google.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OIDC JWKS URI for token verification; required if OIDC discovery is disabled"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-email-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which OIDC claim contains the user's email"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"email"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-groups-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which OIDC claim contains the user groups"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"groups"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")," this adds the X-Auth-Request-Access-Token header to the response"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OIDC IDToken to upstream via Authorization Bearer header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prefer-email-to-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-host-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass the request Host Header to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--profile-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Profile access endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"}),"OIDC prompt"),"; if present, ",Object(b.b)("inlineCode",{parentName:"td"},"approval-prompt")," is ignored"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth provider"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"google")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-ca-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-display-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Override the provider's name with the given string; used for the sign-in page"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"(depends on provider)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the ping endpoint that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/ping"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-user-agent")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"a User-Agent that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (don't check user agent)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--metrics-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the address prometheus metrics will be scraped from"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-prefix")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the url root path that this proxy should be nested under (e.g. /",Object(b.b)("inlineCode",{parentName:"td"},"/sign_in"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/oauth2"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-websockets")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enables WebSocket proxying"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pubjwk-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"JWK pubkey access endpoint: required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Header used to determine the real IP of the client, requires ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"X-Real-IP")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Token redemption endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redirect-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Redirect URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://internalapp.yourcompany.com/oauth2/callback"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis cluster connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"URL of redis server for redis session storage (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis password. Applicable for all Redis configurations. Will override any password set in ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel master name. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis sentinel connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis cluster. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis via sentinels. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-id-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Request header to use as the request ID in logging"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"X-Request-Id")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for request log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--resource")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The resource that is protected (Azure AD only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--scope")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth scope specification"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-cookie-minimal")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-store-type")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"/oauth2-proxy/docs/configuration/session_storage"}),"Session data storage backend"),"; redis or cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"cookie")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token"),", X-Auth-Request-Access-Token is added to response headers."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set Authorization Bearer response header (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HTTP Basic Auth information in response (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--show-debug-on-error")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--signature-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GAP-Signature request signature key (algorithm:secretkey)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--silence-ping-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"disable logging of requests to ping endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-preflight")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip authentication for OPTIONS requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-regex")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"(DEPRECATED for ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-route"),") bypass authentication for requests paths that match (may be given multiple times)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-route")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-strip-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strips ",Object(b.b)("inlineCode",{parentName:"td"},"X-Forwarded-*")," style authentication headers & ",Object(b.b)("inlineCode",{parentName:"td"},"Authorization")," header if they would be set by oauth2-proxy"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip requests that have verified JWT bearer tokens (the token must have ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields"}),Object(b.b)("inlineCode",{parentName:"a"},"aud"))," that matches this client id or one of the extras from ",Object(b.b)("inlineCode",{parentName:"td"},"extra-jwt-issuers"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-oidc-discovery")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass OIDC endpoint discovery. ",Object(b.b)("inlineCode",{parentName:"td"},"--login-url"),", ",Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")," must be configured in this case"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-provider-button")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip sign-in-page to directly reach the next step: oauth/start"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS providers"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-upstream-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS upstreams"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log standard runtime information"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for standard log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-cert-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to certificate file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to private key file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--upstream")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the http url(s) of the upstream endpoint, file:// paths for static files or ",Object(b.b)("inlineCode",{parentName:"td"},"static://")," for static response. Routing is based on the path"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--allowed-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this group (may be given multiple times)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--allowed-role")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--validate-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Access token validation endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--version")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"n/a"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"print version string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--whitelist-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allowed domains for redirection after authentication. Prefix domain with a ",Object(b.b)("inlineCode",{parentName:"td"},".")," to allow subdomains (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".example.com"),")","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote2"}),"2"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--trusted-ip")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," and optionally ",Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")," this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))))),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote1"},"1"),"]",": Only these providers support ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-refresh"),": GitLab, Google and OIDC"),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote2"},"2"),"]",": When using the ",Object(b.b)("inlineCode",{parentName:"p"},"whitelist-domain")," option, any domain prefixed with a ",Object(b.b)("inlineCode",{parentName:"p"},".")," will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:8080"),". To allow any port, use ",Object(b.b)("inlineCode",{parentName:"p"},"*"),": ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:*"),"."),Object(b.b)("p",null,"See below for provider specific options"),Object(b.b)("h3",{id:"upstreams-configuration"},"Upstreams Configuration"),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/")," for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/some/path/")," then it will only be requests that start with ",Object(b.b)("inlineCode",{parentName:"p"},"/some/path/")," which are forwarded to the upstream."),Object(b.b)("p",null,"Static file paths are configured as a file:// URL. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/")," will serve the files from that directory at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/var/www/static/"),", which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/#/static/")," will make ",Object(b.b)("inlineCode",{parentName:"p"},"/var/www/static/")," available at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/static/"),"."),Object(b.b)("p",null,"Multiple upstreams can either be configured by supplying a comma separated list to the ",Object(b.b)("inlineCode",{parentName:"p"},"--upstream")," parameter, supplying the parameter multiple times or providing a list in the ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file"),". When multiple upstreams are used routing to them will be based on the path they are set up with."),Object(b.b)("h3",{id:"environment-variables"},"Environment variables"),Object(b.b)("p",null,"Every command line argument can be specified as an environment variable by\nprefixing it with ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_"),", capitalising it, and replacing hyphens (",Object(b.b)("inlineCode",{parentName:"p"},"-"),")\nwith underscores (",Object(b.b)("inlineCode",{parentName:"p"},"_"),"). If the argument can be specified multiple times, the\nenvironment variable should be plural (trailing ",Object(b.b)("inlineCode",{parentName:"p"},"S"),")."),Object(b.b)("p",null,"This is particularly useful for storing secrets outside of a configuration file\nor the command line."),Object(b.b)("p",null,"For example, the ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-secret")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_COOKIE_SECRET"),",\nand the ",Object(b.b)("inlineCode",{parentName:"p"},"--email-domain")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_EMAIL_DOMAINS"),"."),Object(b.b)("h2",{id:"logging-configuration"},"Logging Configuration"),Object(b.b)("p",null,"By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the ",Object(b.b)("inlineCode",{parentName:"p"},"--logging-filename")," command."),Object(b.b)("p",null,"If logging to a file you can also configure the maximum file size (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-size"),"), age (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-age"),"), max backup logs (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-backups"),"), and if backup logs should be compressed (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-compress"),")."),Object(b.b)("p",null,"There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging"),", ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging"),", and ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging"),"."),Object(b.b)("p",null,"Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log."),Object(b.b)("p",null,"Logging of requests to the ",Object(b.b)("inlineCode",{parentName:"p"},"/ping")," endpoint (or using ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-user-agent"),") can be disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--silence-ping-logging")," reducing log volume. This flag appends the ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-path")," to ",Object(b.b)("inlineCode",{parentName:"p"},"--exclude-logging-paths"),"."),Object(b.b)("h3",{id:"auth-log-format"},"Auth Log Format"),Object(b.b)("p",null,"Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{})," - - [19/Mar/2015:17:20:19 -0400] [] \n")),Object(b.b)("p",null,"The status block will contain one of the below strings:"),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthSuccess")," If a user has authenticated successfully by any method"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthFailure")," If the user failed to authenticate explicitly"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthError")," If there was an unexpected error during authentication")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for auth logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authenticated via OAuth2"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the auth attempt.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestID"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"00010203-0405-4607-8809-0a0b0c0d0e0f"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request ID pulled from the ",Object(b.b)("inlineCode",{parentName:"td"},"--request-id-header"),". Random UUID if empty")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Status"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"AuthSuccess"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The status of the auth request. See above for details.")))),Object(b.b)("h3",{id:"request-log-format"},"Request Log Format"),Object(b.b)("p",null,"HTTP request logs will output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),' - - [19/Mar/2015:17:20:19 -0400] GET "/path/" HTTP/1.1 "" \n')),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}\n")),Object(b.b)("p",null,"Available variables for request logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestDuration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0.001"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The time in seconds that a request took to process.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestID"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"00010203-0405-4607-8809-0a0b0c0d0e0f"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request ID pulled from the ",Object(b.b)("inlineCode",{parentName:"td"},"--request-id-header"),". Random UUID if empty")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestURI"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),'"/oauth2/auth"'),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The URI path of the request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ResponseSize"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"12"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The size in bytes of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"StatusCode"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"200"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The HTTP status code of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The upstream data of the HTTP request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")))),Object(b.b)("h3",{id:"standard-log-format"},"Standard Log Format"),Object(b.b)("p",null,"All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[19/Mar/2015:17:20:19 -0400] [main.go:40] \n")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging-format")," flag. The default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[{{.Timestamp}}] [{{.File}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for standard logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"main.go:40"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The file and line number of the logging statement.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP: listening on 127.0.0.1:4180"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the log statement.")))),Object(b.b)("h2",{id:"configuring-for-use-with-the-nginx-auth_request-directive"},"Configuring for use with the Nginx ",Object(b.b)("inlineCode",{parentName:"h2"},"auth_request")," directive"),Object(b.b)("p",null,"The ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"http://nginx.org/en/docs/http/ngx_http_auth_request_module.html"}),"Nginx ",Object(b.b)("inlineCode",{parentName:"a"},"auth_request")," directive")," allows Nginx to authenticate requests via the oauth2-proxy's ",Object(b.b)("inlineCode",{parentName:"p"},"/auth")," endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-nginx"}),'server {\n listen 443 ssl;\n server_name ...;\n include ssl/ssl.conf;\n\n location /oauth2/ {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n proxy_set_header X-Auth-Request-Redirect $request_uri;\n # or, if you are handling multiple domains:\n # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;\n }\n location = /oauth2/auth {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n # nginx auth_request includes headers but not body\n proxy_set_header Content-Length "";\n proxy_pass_request_body off;\n }\n\n location / {\n auth_request /oauth2/auth;\n error_page 401 = /oauth2/sign_in;\n\n # pass information via X-User and X-Email headers to backend,\n # requires running with --set-xauthrequest flag\n auth_request_set $user $upstream_http_x_auth_request_user;\n auth_request_set $email $upstream_http_x_auth_request_email;\n proxy_set_header X-User $user;\n proxy_set_header X-Email $email;\n\n # if you enabled --pass-access-token, this will pass the token to the backend\n auth_request_set $token $upstream_http_x_auth_request_access_token;\n proxy_set_header X-Access-Token $token;\n\n # if you enabled --cookie-refresh, this is needed for it to work with auth_request\n auth_request_set $auth_cookie $upstream_http_set_cookie;\n add_header Set-Cookie $auth_cookie;\n\n # When using the --set-authorization-header flag, some provider\'s cookies can exceed the 4kb\n # limit and so the OAuth2 Proxy splits these into multiple parts.\n # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\n # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\n auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;\n\n # Extract the Cookie attributes from the first Set-Cookie header and append them\n # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\n if ($auth_cookie ~* "(; .*)") {\n set $auth_cookie_name_0 $auth_cookie;\n set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";\n }\n\n # Send both Set-Cookie headers now if there was a second part\n if ($auth_cookie_name_upstream_1) {\n add_header Set-Cookie $auth_cookie_name_0;\n add_header Set-Cookie $auth_cookie_name_1;\n }\n\n proxy_pass http://backend/;\n # or "root /path/to/site;" or "fastcgi_pass ..." etc\n }\n}\n')),Object(b.b)("p",null,"When you use ingress-nginx in Kubernetes, you MUST use ",Object(b.b)("inlineCode",{parentName:"p"},"kubernetes/ingress-nginx")," (which includes the Lua module) and the following configuration snippet for your ",Object(b.b)("inlineCode",{parentName:"p"},"Ingress"),".\nVariables set with ",Object(b.b)("inlineCode",{parentName:"p"},"auth_request_set")," are not ",Object(b.b)("inlineCode",{parentName:"p"},"set"),"-able in plain nginx config when the location is processed via ",Object(b.b)("inlineCode",{parentName:"p"},"proxy_pass")," and then may only be processed by Lua.\nNote that ",Object(b.b)("inlineCode",{parentName:"p"},"nginxinc/kubernetes-ingress")," does not include the Lua module."),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'nginx.ingress.kubernetes.io/auth-response-headers: Authorization\nnginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri\nnginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth\nnginx.ingress.kubernetes.io/configuration-snippet: |\n auth_request_set $name_upstream_1 $upstream_cookie_name_1;\n\n access_by_lua_block {\n if ngx.var.name_upstream_1 ~= "" then\n ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")\n end\n }\n')),Object(b.b)("p",null,"It is recommended to use ",Object(b.b)("inlineCode",{parentName:"p"},"--session-store-type=redis")," when expecting large sessions/OIDC tokens (",Object(b.b)("em",{parentName:"p"},"e.g.")," with MS Azure)."),Object(b.b)("p",null,"You have to substitute ",Object(b.b)("em",{parentName:"p"},"name"),' with the actual cookie name you configured via --cookie-name parameter. If you don\'t set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".'),Object(b.b)("h2",{id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware"},"Configuring for use with the Traefik (v2) ",Object(b.b)("inlineCode",{parentName:"h2"},"ForwardAuth")," middleware"),Object(b.b)("p",null,Object(b.b)("strong",{parentName:"p"},"This option requires ",Object(b.b)("inlineCode",{parentName:"strong"},"--reverse-proxy")," option to be set.")),Object(b.b)("h3",{id:"forwardauth-with-401-errors-middleware"},"ForwardAuth with 401 errors middleware"),Object(b.b)("p",null,"The ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"}),"Traefik v2 ",Object(b.b)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," allows Traefik to authenticate requests via the oauth2-proxy's ",Object(b.b)("inlineCode",{parentName:"p"},"/oauth2/auth")," endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'http:\n routers:\n a-service:\n rule: "Host(`a-service.example.com`)"\n service: a-service-backend\n middlewares:\n - oauth-errors\n - oauth-auth\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth:\n rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n oauth-errors:\n errors:\n status:\n - "401-403"\n service: oauth-backend\n query: "/oauth2/sign_in"\n')),Object(b.b)("h3",{id:"forwardauth-with-static-upstreams-configuration"},"ForwardAuth with static upstreams configuration"),Object(b.b)("p",null,"Redirect to sign_in functionality provided without the use of ",Object(b.b)("inlineCode",{parentName:"p"},"errors")," middleware with ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"}),"Traefik v2 ",Object(b.b)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," pointing to oauth2-proxy service's ",Object(b.b)("inlineCode",{parentName:"p"},"/")," endpoint"),Object(b.b)("p",null,Object(b.b)("strong",{parentName:"p"},"Following options need to be set on ",Object(b.b)("inlineCode",{parentName:"strong"},"oauth2-proxy"),":")),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"--upstream=static://202"),": Configures a static response for authenticated sessions"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"--reverse-proxy=true"),": Enables the use of ",Object(b.b)("inlineCode",{parentName:"li"},"X-Forwarded-*")," headers to determine redirects correctly")),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'http:\n routers:\n a-service-route-1:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n a-service-route-2:\n rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-wo-redirect # unauthenticated session will return a 401\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n services-oauth2-route:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth2-proxy-route:\n rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n b-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.3:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth-redirect:\n forwardAuth:\n address: https://oauth.example.com/\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n oauth-auth-wo-redirect:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n')),Object(b.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"If you set up your OAuth2 provider to rotate your client secret, you can use the ",Object(b.b)("inlineCode",{parentName:"p"},"client-secret-file")," option to reload the secret when it is updated."))))}p.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/7874e99f.6f7ac14d.js b/7874e99f.6f7ac14d.js deleted file mode 100644 index 461724eb..00000000 --- a/7874e99f.6f7ac14d.js +++ /dev/null @@ -1 +0,0 @@ -(window.webpackJsonp=window.webpackJsonp||[]).push([[25],{116:function(e,t,a){"use strict";a.d(t,"a",(function(){return O})),a.d(t,"b",(function(){return s}));var n=a(0),b=a.n(n);function r(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function l(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function i(e){for(var t=1;t=0||(b[a]=e[a]);return b}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(b[a]=e[a])}return b}var o=b.a.createContext({}),p=function(e){var t=b.a.useContext(o),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},O=function(e){var t=p(e.components);return b.a.createElement(o.Provider,{value:t},e.children)},j={inlineCode:"code",wrapper:function(e){var t=e.children;return b.a.createElement(b.a.Fragment,{},t)}},d=b.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,r=e.originalType,l=e.parentName,o=c(e,["components","mdxType","originalType","parentName"]),O=p(a),d=n,s=O["".concat(l,".").concat(d)]||O[d]||j[d]||r;return a?b.a.createElement(s,i(i({ref:t},o),{},{components:a})):b.a.createElement(s,i({ref:t},o))}));function s(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var r=a.length,l=new Array(r);l[0]=d;var i={};for(var c in t)hasOwnProperty.call(t,c)&&(i[c]=t[c]);i.originalType=e,i.mdxType="string"==typeof e?e:n,l[1]=i;for(var o=2;o=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var l=o.a.createContext({}),u=function(e){var t=o.a.useContext(l),r=t;return e&&(r="function"==typeof e?e(t):c(c({},t),e)),r},b=function(e){var t=u(e.components);return o.a.createElement(l.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},d=o.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,a=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),b=u(r),d=n,m=b["".concat(i,".").concat(d)]||b[d]||s[d]||a;return r?o.a.createElement(m,c(c({ref:t},l),{},{components:r})):o.a.createElement(m,c({ref:t},l))}));function m(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var a=r.length,i=new Array(a);i[0]=d;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:n,i[1]=c;for(var l=2;l&1 | grep OK\noauth2-proxy-x.y.z.linux-amd64: OK\n")),Object(a.b)("ol",{start:2},Object(a.b)("li",{parentName:"ol"},Object(a.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider"}),"Select a Provider and Register an OAuth Application with a Provider")),Object(a.b)("li",{parentName:"ol"},Object(a.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/6.1.x/configuration/overview"}),"Configure OAuth2 Proxy using config file, command line options, or environment variables")),Object(a.b)("li",{parentName:"ol"},Object(a.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/6.1.x/configuration/tls"}),"Configure SSL or Deploy behind a SSL endpoint")," (example provided for Nginx)")))}u.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/7dcecc8d.cbd1bb5d.js b/7dcecc8d.cbd1bb5d.js deleted file mode 100644 index f1beb302..00000000 --- a/7dcecc8d.cbd1bb5d.js +++ /dev/null @@ -1 +0,0 @@ -(window.webpackJsonp=window.webpackJsonp||[]).push([[27],{116:function(e,t,a){"use strict";a.d(t,"a",(function(){return s})),a.d(t,"b",(function(){return h}));var o=a(0),n=a.n(o);function r(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function i(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,o)}return a}function l(e){for(var t=1;t=0||(n[a]=e[a]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(o=0;o=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(n[a]=e[a])}return n}var p=n.a.createContext({}),b=function(e){var t=n.a.useContext(p),a=t;return e&&(a="function"==typeof e?e(t):l(l({},t),e)),a},s=function(e){var t=b(e.components);return n.a.createElement(p.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return n.a.createElement(n.a.Fragment,{},t)}},d=n.a.forwardRef((function(e,t){var a=e.components,o=e.mdxType,r=e.originalType,i=e.parentName,p=c(e,["components","mdxType","originalType","parentName"]),s=b(a),d=o,h=s["".concat(i,".").concat(d)]||s[d]||u[d]||r;return a?n.a.createElement(h,l(l({ref:t},p),{},{components:a})):n.a.createElement(h,l({ref:t},p))}));function h(e,t){var a=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var r=a.length,i=new Array(r);i[0]=d;var l={};for(var c in t)hasOwnProperty.call(t,c)&&(l[c]=t[c]);l.originalType=e,l.mdxType="string"==typeof e?e:o,i[1]=l;for(var p=2;p\n --client-secret=\n")),Object(r.b)("p",null,"Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/7.0.x/configuration/session_storage#redis-storage"}),"redis session storage")," should resolve this."),Object(r.b)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new FB App from ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.facebook.com/"}),"https://developers.facebook.com/")),Object(r.b)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://github.com/settings/developers"}),"https://github.com/settings/developers")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*")),Object(r.b)("p",null,"NOTE: When ",Object(r.b)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),Object(r.b)("p",null,"To restrict by organization only, include the following flag:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-org="": restrict logins to members of this organisation\n')),Object(r.b)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",Object(r.b)("inlineCode",{parentName:"p"},"-github-org"),":"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),Object(r.b)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),Object(r.b)("p",null,"If you'd like to allow access to users with ",Object(r.b)("strong",{parentName:"p"},"read only")," access to a ",Object(r.b)("strong",{parentName:"p"},"public")," repository you will need to provide a ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/settings/tokens"}),"token")," for a user that has write access to the repository. The token must be created with at least the ",Object(r.b)("inlineCode",{parentName:"p"},"public_repo")," scope:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-token="": the token to use when verifying repository collaborators\n')),Object(r.b)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-user="": allow logins by username, separated by a comma\n')),Object(r.b)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-login-url="http(s):///login/oauth/authorize"\n-redeem-url="http(s):///login/oauth/access_token"\n-validate-url="http(s):///api/v3"\n')),Object(r.b)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create new client in your Keycloak with ",Object(r.b)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",Object(r.b)("strong",{parentName:"li"},"Valid Redirect URIs")," '",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://internal.yourcompany.com/oauth2/callback'"}),"https://internal.yourcompany.com/oauth2/callback'")),Object(r.b)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),Object(r.b)("li",{parentName:"ol"},"Create a mapper with ",Object(r.b)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",Object(r.b)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),Object(r.b)("p",null,"Make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--provider=keycloak\n--client-id=\n--client-secret=\n--login-url="http(s):///auth/realms//protocol/openid-connect/auth"\n--redeem-url="http(s):///auth/realms//protocol/openid-connect/token"\n--profile-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n--validate-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n--keycloak-group=\n--keycloak-group=\n')),Object(r.b)("p",null,"For group based authorization, the optional ",Object(r.b)("inlineCode",{parentName:"p"},"--keycloak-group")," (legacy) or ",Object(r.b)("inlineCode",{parentName:"p"},"--allowed-group")," (global standard)\nflags can be used to specify which groups to limit access to."),Object(r.b)("p",null,"If these are unset but a ",Object(r.b)("inlineCode",{parentName:"p"},"groups")," mapper is set up above in step (3), the provider will still\npopulate the ",Object(r.b)("inlineCode",{parentName:"p"},"X-Forwarded-Groups")," header to your upstream server with the ",Object(r.b)("inlineCode",{parentName:"p"},"groups")," data in the\nKeycloak userinfo endpoint response."),Object(r.b)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak\nyou should define the 'keycloak-group' value to /admin."),Object(r.b)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),Object(r.b)("p",null,"This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/issues/994"}),"994"),")."),Object(r.b)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"}),"these steps to add an application"),". Make sure to enable at least the ",Object(r.b)("inlineCode",{parentName:"p"},"openid"),", ",Object(r.b)("inlineCode",{parentName:"p"},"profile")," and ",Object(r.b)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://myapp.com/oauth2/callback"}),"https://myapp.com/oauth2/callback"),"."),Object(r.b)("p",null,"If you need projects filtering, add the extra ",Object(r.b)("inlineCode",{parentName:"p"},"read_api")," scope to your application."),Object(r.b)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/7.0.x/configuration/overview#generating-a-cookie-secret"}),"these steps")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' --provider="gitlab"\n --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n --client-id=GITLAB_CLIENT_ID\n --client-secret=GITLAB_CLIENT_SECRET\n --cookie-secret=COOKIE_SECRET\n')),Object(r.b)("p",null,"Restricting by group membership is possible with the following option:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),Object(r.b)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--oidc-issuer-url=""\n')),Object(r.b)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),Object(r.b)("p",null,"For LinkedIn, the registration steps are:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://www.linkedin.com/secure/developer"}),"https://www.linkedin.com/secure/developer")),Object(r.b)("li",{parentName:"ol"},"In the OAuth User Agreement section:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),Object(r.b)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),Object(r.b)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),Object(r.b)("li",{parentName:"ol"},"Take note of the ",Object(r.b)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",Object(r.b)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),Object(r.b)("h3",{id:"microsoft-azure-ad-provider"},"Microsoft Azure AD Provider"),Object(r.b)("p",null,"For adding an application to the Microsoft Azure AD follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"}),"these steps to add an application"),"."),Object(r.b)("p",null,"Take note of your ",Object(r.b)("inlineCode",{parentName:"p"},"TenantId")," if applicable for your situation. The ",Object(r.b)("inlineCode",{parentName:"p"},"TenantId")," can be used to override the default ",Object(r.b)("inlineCode",{parentName:"p"},"common")," authorization server with a tenant specific server."),Object(r.b)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),Object(r.b)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."),Object(r.b)("p",null,"This provider was originally built against CoreOS Dex and we will use it as an example.\nThe OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below."),Object(r.b)("h4",{id:"dex"},"Dex"),Object(r.b)("p",null,"To configure the OIDC provider for Dex, perform the following steps:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Download Dex:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"go get github.com/dexidp/dex\n")),Object(r.b)("p",{parentName:"li"},"See the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://dexidp.io/docs/getting-started/"}),"getting started guide")," for more details.")),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the ",Object(r.b)("inlineCode",{parentName:"p"},"staticClients")," section of ",Object(r.b)("inlineCode",{parentName:"p"},"examples/config-dev.yaml"),":"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"- id: oauth2-proxy\nredirectURIs:\n- 'http://127.0.0.1:4180/oauth2/callback'\nname: 'oauth2-proxy'\nsecret: proxy\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Launch Dex: from ",Object(r.b)("inlineCode",{parentName:"p"},"$GOPATH/github.com/dexidp/dex"),", run:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"bin/dex serve examples/config-dev.yaml\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"In a second terminal, run the oauth2-proxy with the following args:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-provider oidc\n-provider-display-name "My OIDC Provider"\n-client-id oauth2-proxy\n-client-secret proxy\n-redirect-url http://127.0.0.1:4180/oauth2/callback\n-oidc-issuer-url http://127.0.0.1:5556/dex\n-cookie-secure=false\n-cookie-secret=secret\n-email-domain kilgore.trout\n')),Object(r.b)("p",{parentName:"li"},"To serve the current working directory as a web site under the ",Object(r.b)("inlineCode",{parentName:"p"},"/static")," endpoint, add:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"-upstream file://$PWD/#/static/\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Test the setup by visiting ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"http://127.0.0.1:4180"}),"http://127.0.0.1:4180")," or ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"http://127.0.0.1:4180/static"}),"http://127.0.0.1:4180/static")," ."))),Object(r.b)("p",null,"See also ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment"}),"our local testing environment")," for a self-contained example using Docker and etcd as storage for Dex."),Object(r.b)("h4",{id:"okta"},"Okta"),Object(r.b)("p",null,"To configure the OIDC provider for Okta, perform the following steps:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",Object(r.b)("inlineCode",{parentName:"li"},"example.oktapreview.com")),Object(r.b)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",Object(r.b)("inlineCode",{parentName:"li"},"default")," will work.")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Security")," then select ",Object(r.b)("strong",{parentName:"li"},"API")),Object(r.b)("li",{parentName:"ul"},"Click ",Object(r.b)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),Object(r.b)("li",{parentName:"ul"},"Fill out the ",Object(r.b)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),Object(r.b)("li",{parentName:"ul"},"For ",Object(r.b)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://example.corp.com"}),"https://example.corp.com")),Object(r.b)("li",{parentName:"ul"},"Fill out a ",Object(r.b)("strong",{parentName:"li"},"Description")),Object(r.b)("li",{parentName:"ul"},"Add any ",Object(r.b)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),Object(r.b)("li",{parentName:"ul"},"The default settings will work for other options.\n",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"}),"See Okta documentation for more information on Authorization Servers"))),Object(r.b)("ol",{start:3},Object(r.b)("li",{parentName:"ol"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Applications")," then select ",Object(r.b)("strong",{parentName:"li"},"Add Application"),".")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"Web")," for the ",Object(r.b)("strong",{parentName:"li"},"Platform")," setting."),Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"OpenID Connect")," and click ",Object(r.b)("strong",{parentName:"li"},"Create")),Object(r.b)("li",{parentName:"ul"},"Pick an ",Object(r.b)("strong",{parentName:"li"},"Application Name")," such as ",Object(r.b)("inlineCode",{parentName:"li"},"Example App"),"."),Object(r.b)("li",{parentName:"ul"},"Set the ",Object(r.b)("strong",{parentName:"li"},"Login redirect URI")," to ",Object(r.b)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"General")," set the ",Object(r.b)("strong",{parentName:"li"},"Allowed grant types")," to ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token"),"."),Object(r.b)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client Secret"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),Object(r.b)("ol",{start:4},Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Create a configuration file like the following:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n "https://example.corp.com"\n]\nemail_domains = [\n "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')))),Object(r.b)("p",null,"The ",Object(r.b)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",Object(r.b)("strong",{parentName:"p"},"Authorization Server"),"'s ",Object(r.b)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://corp.okta.com"}),"https://corp.okta.com")," .\nThe ",Object(r.b)("inlineCode",{parentName:"p"},"client_id")," and ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," to encrypt the cookie."),Object(r.b)("p",null,"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),Object(r.b)("h4",{id:"okta---localhost"},"Okta - localhost"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Signup for developer account: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/signup/"}),"https://developer.okta.com/signup/")),Object(r.b)("li",{parentName:"ol"},"Create New ",Object(r.b)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),Object(r.b)("li",{parentName:"ol"},"Example Application Settings for localhost:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Name:")," My Web App"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Group assignments:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Everyone")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Grant type allowed:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token")))),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),Object(r.b)("li",{parentName:"ol"},"Example config file ",Object(r.b)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n "http://0.0.0.0:8080"\n]\nemail_domains = [\n "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),Object(r.b)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),Object(r.b)("h3",{id:"logingov-provider"},"login.gov Provider"),Object(r.b)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://login.gov/developers/"}),"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),Object(r.b)("p",null,"A developer guide is available here: ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://developers.login.gov/"}),"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),Object(r.b)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),Object(r.b)("p",null,"First, register your application in the dashboard. The important bits are:"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Identity protocol: make this ",Object(r.b)("inlineCode",{parentName:"li"},"Openid connect")),Object(r.b)("li",{parentName:"ul"},"Issuer: do what they say for OpenID Connect. We will refer to this string as ",Object(r.b)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),Object(r.b)("li",{parentName:"ul"},"Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",Object(r.b)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",Object(r.b)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",Object(r.b)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),Object(r.b)("li",{parentName:"ul"},"Return to App URL: Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/")),Object(r.b)("li",{parentName:"ul"},"Redirect URIs: Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),Object(r.b)("li",{parentName:"ul"},"Attribute Bundle: Make sure that email is selected.")),Object(r.b)("p",null,"Now start the proxy up with the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'./oauth2-proxy -provider login.gov \\\n -client-id=${LOGINGOV_ISSUER} \\\n -redirect-url=http://localhost:4180/oauth2/callback \\\n -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n -cookie-secure=false \\\n -email-domain=gsa.gov \\\n -upstream=http://localhost:3000/ \\\n -cookie-secret=somerandomstring12341234567890AB \\\n -cookie-domain=localhost \\\n -skip-provider-button=true \\\n -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),Object(r.b)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",Object(r.b)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",Object(r.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",Object(r.b)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),Object(r.b)("p",null,"Once it is running, you should be able to go to ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:3000/"),". In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),Object(r.b)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),Object(r.b)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),Object(r.b)("p",null,"In this case, you can set the ",Object(r.b)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," -provider oidc\n -client-id oauth2-proxy\n -client-secret proxy\n -redirect-url http://127.0.0.1:4180/oauth2/callback\n -oidc-issuer-url http://127.0.0.1:5556\n -skip-oidc-discovery\n -login-url http://127.0.0.1:5556/authorize\n -redeem-url http://127.0.0.1:5556/token\n -oidc-jwks-url http://127.0.0.1:5556/keys\n -cookie-secure=false\n -email-domain example.com\n")),Object(r.b)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),Object(r.b)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),Object(r.b)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",Object(r.b)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",Object(r.b)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),Object(r.b)("p",null,"Refer to the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"}),"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',Object(r.b)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' -provider nextcloud\n -client-id \n -client-secret \n -login-url="/index.php/apps/oauth2/authorize"\n -redeem-url="/index.php/apps/oauth2/api/v1/token"\n -validate-url="/ocs/v2.php/cloud/user?format=json"\n')),Object(r.b)("p",null,"Note: in ",Object(r.b)("em",{parentName:"p"},"all")," cases the validate-url will ",Object(r.b)("em",{parentName:"p"},"not")," have the ",Object(r.b)("inlineCode",{parentName:"p"},"index.php"),"."),Object(r.b)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://cloud.digitalocean.com/account/api/applications"}),"Create a new OAuth application"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),Object(r.b)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',Object(r.b)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=digitalocean\n --client-id=\n --client-secret=\n")),Object(r.b)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",Object(r.b)("inlineCode",{parentName:"p"},"https:///oauth2/callback"),". If you need to change it, you can use the ",Object(r.b)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),Object(r.b)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"}),"Add a new OAuth consumer"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},'In "Callback URL" use ',Object(r.b)("inlineCode",{parentName:"li"},"https:///oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"")," with the actual hostname that oauth2-proxy is running on."),Object(r.b)("li",{parentName:"ul"},"In Permissions section select:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"Account -> Email"),Object(r.b)("li",{parentName:"ul"},"Team membership -> Read"),Object(r.b)("li",{parentName:"ul"},"Repositories -> Read"))))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=bitbucket\n --client-id=\n --client-secret=\n")),Object(r.b)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-team="),". To restrict the access to only these users who has access to one selected repository use ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-repository="),"."),Object(r.b)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new application: ",Object(r.b)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",Object(r.b)("inlineCode",{parentName:"li"},"https:///oauth2/callback")),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),Object(r.b)("li",{parentName:"ol"},"Pass the following options to the proxy:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' --provider="github"\n --redirect-url="https:///oauth2/callback"\n --provider-display-name="Gitea"\n --client-id="< client_id as generated by Gitea >"\n --client-secret="< client_secret as generated by Gitea >"\n --login-url="https://< your gitea host >/login/oauth/authorize"\n --redeem-url="https://< your gitea host >/login/oauth/access_token"\n --validate-url="https://< your gitea host >/api/v1"\n')),Object(r.b)("h2",{id:"email-authentication"},"Email Authentication"),Object(r.b)("p",null,"To authorize by email domain use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),Object(r.b)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),Object(r.b)("p",null,"Follow the examples in the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"}),Object(r.b)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",Object(r.b)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",Object(r.b)("inlineCode",{parentName:"p"},"case")," to\n",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"}),Object(r.b)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",Object(r.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",Object(r.b)("inlineCode",{parentName:"p"},"Provider"),"."))}b.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/8c826f25.f531f433.js b/8c826f25.f531f433.js deleted file mode 100644 index a8ecf5c4..00000000 --- a/8c826f25.f531f433.js +++ /dev/null @@ -1 +0,0 @@ -(window.webpackJsonp=window.webpackJsonp||[]).push([[28],{116:function(e,t,a){"use strict";a.d(t,"a",(function(){return s})),a.d(t,"b",(function(){return j}));var n=a(0),r=a.n(n);function b(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function l(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function i(e){for(var t=1;t=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var b=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var o=r.a.createContext({}),d=function(e){var t=r.a.useContext(o),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},s=function(e){var t=d(e.components);return r.a.createElement(o.Provider,{value:t},e.children)},p={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},O=r.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,b=e.originalType,l=e.parentName,o=c(e,["components","mdxType","originalType","parentName"]),s=d(a),O=n,j=s["".concat(l,".").concat(O)]||s[O]||p[O]||b;return a?r.a.createElement(j,i(i({ref:t},o),{},{components:a})):r.a.createElement(j,i({ref:t},o))}));function j(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var b=a.length,l=new Array(b);l[0]=O;var i={};for(var c in t)hasOwnProperty.call(t,c)&&(i[c]=t[c]);i.originalType=e,i.mdxType="string"==typeof e?e:n,l[1]=i;for(var o=2;oauth_request directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",children:[]},{value:"Configuring for use with the Traefik (v2) ForwardAuth middleware",id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware",children:[{value:"ForwardAuth with 401 errors middleware",id:"forwardauth-with-401-errors-middleware",children:[]},{value:"ForwardAuth with static upstreams configuration",id:"forwardauth-with-static-upstreams-configuration",children:[]}]}],s={rightToc:d};function p(e){var t=e.components,a=Object(r.a)(e,["components"]);return Object(b.b)("wrapper",Object(n.a)({},s,a,{components:t,mdxType:"MDXLayout"}),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#command-line-options"}),"command line options"),", ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#environment-variables"}),"environment variables")," or ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file")," (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."),Object(b.b)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),Object(b.b)("p",null,"To generate a strong cookie secret use one of the below commands:"),Object(b.b)(l.a,{defaultValue:"python",values:[{label:"Python",value:"python"},{label:"Bash",value:"bash"},{label:"OpenSSL",value:"openssl"},{label:"PowerShell",value:"powershell"},{label:"Terraform",value:"terraform"}],mdxType:"Tabs"},Object(b.b)(i.a,{value:"python",mdxType:"TabItem"},Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-shell"}),"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'\n"))),Object(b.b)(i.a,{value:"bash",mdxType:"TabItem"},Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-shell"}),"cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1 | base64\n"))),Object(b.b)(i.a,{value:"openssl",mdxType:"TabItem"},Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-shell"}),"openssl rand -base64 32 | tr -- '+/' '-_'\n"))),Object(b.b)(i.a,{value:"powershell",mdxType:"TabItem"},Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-shell"}),'# Add System.Web assembly to session, just in case\nAdd-Type -AssemblyName System.Web\n[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")\n'))),Object(b.b)(i.a,{value:"terraform",mdxType:"TabItem"},Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-shell"}),'# Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret\nresource "random_password" "cookie_secret" {\n length = 32\n override_special = "-_"\n}\n')))),Object(b.b)("h3",{id:"config-file"},"Config File"),Object(b.b)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),Object(b.b)("p",null,"An example ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"}),"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",Object(b.b)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),Object(b.b)("h3",{id:"command-line-options"},"Command Line Options"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Option"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Default"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--acr-values")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"optional, see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"}),"docs")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--approval-prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth approval_prompt"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"force"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log authentication attempts"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for authentication log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate against emails via file (one per line)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--azure-tenant")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"go to a tenant-specific or common (tenant-independent) endpoint."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"common"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--basic-auth-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the password to set when passing the HTTP Basic Auth header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-id")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client ID, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the file with OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--config")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to config file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Optional cookie domains to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-expire")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"expire timeframe for cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"168h0m0s")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-httponly")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HttpOnly cookie flag"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the name of the cookie that the oauth_proxy creates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"an optional cookie path to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"/poc/"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-refresh")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"refresh the cookie after this duration; ",Object(b.b)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote1"}),"1"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the seed string for secure cookies (optionally base64 encoded)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secure")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://owasp.org/www-community/controls/SecureFlag"}),"secure (HTTPS only) cookie flag")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-samesite")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set SameSite cookie attribute (",Object(b.b)("inlineCode",{parentName:"td"},'"lax"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"strict"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"none"'),", or ",Object(b.b)("inlineCode",{parentName:"td"},'""'),")."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--custom-templates-dir")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to custom html templates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"display username / password login form if an htpasswd file is provided"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--email-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate emails with the specified domain (may be given multiple times). Use ",Object(b.b)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--errors-to-info-log")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"redirects error-level logging to default log channel instead of stderr"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"if ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",Object(b.b)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",Object(b.b)("inlineCode",{parentName:"td"},"iss"),", ",Object(b.b)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--exclude-logging-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"comma separated list of paths to exclude from logging, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"/ping,/path2"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--flush-interval")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"period between flushing response buffers when streaming responses"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"1s"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--force-https")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enforce https redirect"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"false"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--banner")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) banner string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--footer")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) footer string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gcp-healthchecks")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will enable ",Object(b.b)("inlineCode",{parentName:"td"},"/liveness_check"),", ",Object(b.b)("inlineCode",{parentName:"td"},"/readiness_check"),", and ",Object(b.b)("inlineCode",{parentName:"td"},"/")," (with the proper user-agent) endpoints that will make it work well with GCP App Engine and GKE Ingresses"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-org")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this organisation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-team")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these teams (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to collaborators of this repository formatted as ",Object(b.b)("inlineCode",{parentName:"td"},"orgname/repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the token to use when verifying repository collaborators (must have push access to the repository)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gitlab-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these groups (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gitlab-projects")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these projects (may be given multiple times) formatted as ",Object(b.b)("inlineCode",{parentName:"td"},"orgname/repo=accesslevel"),". Access level should be a value matching ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://docs.gitlab.com/ee/api/members.html#valid-access-levels"}),"Gitlab access levels"),", defaulted to 20 if absent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-admin-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the google admin to impersonate for api calls"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this google group (may be given multiple times)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-service-account-json")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the path to the service account json credentials"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--htpasswd-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"additionally authenticate against a htpasswd file. Entries must be created with ",Object(b.b)("inlineCode",{parentName:"td"},"htpasswd -B")," for bcrypt encryption"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--http-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"[http://]:")," or ",Object(b.b)("inlineCode",{parentName:"td"},"unix://")," to listen on for HTTP clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"127.0.0.1:4180"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--https-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},":")," to listen on for HTTPS clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'":443"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-compress")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Should rotated log files be compressed using gzip"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-filename")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File to log requests to, empty for ",Object(b.b)("inlineCode",{parentName:"td"},"stdout")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (stdout)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-local-time")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Use local time in log files and backup filenames instead of UTC"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true (local time)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-age")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of days to retain old log files"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"7")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-backups")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of old log files to retain; 0 to disable"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-size")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum size in megabytes of the log file before rotation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"100")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"private key in PEM format used to sign JWT, so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},'--jwt-key="${OAUTH2_PROXY_JWT_KEY}"'),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to the private key file in PEM format used to sign the JWT so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem"),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--login-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authentication endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-allow-unverified-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"don't fail if an email address in an id_token is not verified"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-issuer-verification")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-issuer-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OpenID Connect issuer URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://accounts.google.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OIDC JWKS URI for token verification; required if OIDC discovery is disabled"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-email-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which OIDC claim contains the user's email"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"email"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-groups-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which OIDC claim contains the user groups"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"groups"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")," this adds the X-Auth-Request-Access-Token header to the response"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OIDC IDToken to upstream via Authorization Bearer header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prefer-email-to-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-host-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass the request Host Header to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--profile-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Profile access endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"}),"OIDC prompt"),"; if present, ",Object(b.b)("inlineCode",{parentName:"td"},"approval-prompt")," is ignored"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth provider"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"google")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-ca-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-display-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Override the provider's name with the given string; used for the sign-in page"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"(depends on provider)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the ping endpoint that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/ping"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-user-agent")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"a User-Agent that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (don't check user agent)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-prefix")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the url root path that this proxy should be nested under (e.g. /",Object(b.b)("inlineCode",{parentName:"td"},"/sign_in"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/oauth2"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-websockets")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enables WebSocket proxying"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pubjwk-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"JWK pubkey access endpoint: required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Header used to determine the real IP of the client, requires ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"X-Real-IP")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Token redemption endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redirect-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Redirect URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://internalapp.yourcompany.com/oauth2/callback"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis cluster connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"URL of redis server for redis session storage (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis password. Applicable for all Redis configurations. Will override any password set in ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel master name. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis sentinel connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis cluster. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis via sentinels. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for request log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--resource")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The resource that is protected (Azure AD only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--scope")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth scope specification"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-cookie-minimal")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-store-type")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"/oauth2-proxy/docs/7.0.x/configuration/session_storage"}),"Session data storage backend"),"; redis or cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"cookie")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token"),", X-Auth-Request-Access-Token is added to response headers."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set Authorization Bearer response header (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HTTP Basic Auth information in response (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--signature-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GAP-Signature request signature key (algorithm:secretkey)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--silence-ping-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"disable logging of requests to ping endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-preflight")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip authentication for OPTIONS requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-regex")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"(DEPRECATED for ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-route"),") bypass authentication for requests paths that match (may be given multiple times)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-route")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-strip-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strips ",Object(b.b)("inlineCode",{parentName:"td"},"X-Forwarded-*")," style authentication headers & ",Object(b.b)("inlineCode",{parentName:"td"},"Authorization")," header if they would be set by oauth2-proxy"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip requests that have verified JWT bearer tokens (the token must have ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields"}),Object(b.b)("inlineCode",{parentName:"a"},"aud"))," that matches this client id or one of the extras from ",Object(b.b)("inlineCode",{parentName:"td"},"extra-jwt-issuers"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-oidc-discovery")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass OIDC endpoint discovery. ",Object(b.b)("inlineCode",{parentName:"td"},"--login-url"),", ",Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")," must be configured in this case"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-provider-button")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip sign-in-page to directly reach the next step: oauth/start"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS providers"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-upstream-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS upstreams"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log standard runtime information"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for standard log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-cert-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to certificate file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to private key file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--upstream")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the http url(s) of the upstream endpoint, file:// paths for static files or ",Object(b.b)("inlineCode",{parentName:"td"},"static://")," for static response. Routing is based on the path"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--allowed-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this group (may be given multiple times)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--validate-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Access token validation endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--version")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"n/a"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"print version string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--whitelist-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allowed domains for redirection after authentication. Prefix domain with a ",Object(b.b)("inlineCode",{parentName:"td"},".")," to allow subdomains (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".example.com"),")","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote2"}),"2"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--trusted-ip")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," and optionally ",Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")," this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))))),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote1"},"1"),"]",": Only these providers support ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-refresh"),": GitLab, Google and OIDC"),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote2"},"2"),"]",": When using the ",Object(b.b)("inlineCode",{parentName:"p"},"whitelist-domain")," option, any domain prefixed with a ",Object(b.b)("inlineCode",{parentName:"p"},".")," will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:8080"),". To allow any port, use ",Object(b.b)("inlineCode",{parentName:"p"},"*"),": ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:*"),"."),Object(b.b)("p",null,"See below for provider specific options"),Object(b.b)("h3",{id:"upstreams-configuration"},"Upstreams Configuration"),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/")," for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/some/path/")," then it will only be requests that start with ",Object(b.b)("inlineCode",{parentName:"p"},"/some/path/")," which are forwarded to the upstream."),Object(b.b)("p",null,"Static file paths are configured as a file:// URL. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/")," will serve the files from that directory at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/var/www/static/"),", which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/#/static/")," will make ",Object(b.b)("inlineCode",{parentName:"p"},"/var/www/static/")," available at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/static/"),"."),Object(b.b)("p",null,"Multiple upstreams can either be configured by supplying a comma separated list to the ",Object(b.b)("inlineCode",{parentName:"p"},"--upstream")," parameter, supplying the parameter multiple times or providing a list in the ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file"),". When multiple upstreams are used routing to them will be based on the path they are set up with."),Object(b.b)("h3",{id:"environment-variables"},"Environment variables"),Object(b.b)("p",null,"Every command line argument can be specified as an environment variable by\nprefixing it with ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_"),", capitalising it, and replacing hyphens (",Object(b.b)("inlineCode",{parentName:"p"},"-"),")\nwith underscores (",Object(b.b)("inlineCode",{parentName:"p"},"_"),"). If the argument can be specified multiple times, the\nenvironment variable should be plural (trailing ",Object(b.b)("inlineCode",{parentName:"p"},"S"),")."),Object(b.b)("p",null,"This is particularly useful for storing secrets outside of a configuration file\nor the command line."),Object(b.b)("p",null,"For example, the ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-secret")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_COOKIE_SECRET"),",\nand the ",Object(b.b)("inlineCode",{parentName:"p"},"--email-domain")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_EMAIL_DOMAINS"),"."),Object(b.b)("h2",{id:"logging-configuration"},"Logging Configuration"),Object(b.b)("p",null,"By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the ",Object(b.b)("inlineCode",{parentName:"p"},"--logging-filename")," command."),Object(b.b)("p",null,"If logging to a file you can also configure the maximum file size (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-size"),"), age (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-age"),"), max backup logs (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-backups"),"), and if backup logs should be compressed (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-compress"),")."),Object(b.b)("p",null,"There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging"),", ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging"),", and ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging"),"."),Object(b.b)("p",null,"Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log."),Object(b.b)("p",null,"Logging of requests to the ",Object(b.b)("inlineCode",{parentName:"p"},"/ping")," endpoint (or using ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-user-agent"),") can be disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--silence-ping-logging")," reducing log volume. This flag appends the ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-path")," to ",Object(b.b)("inlineCode",{parentName:"p"},"--exclude-logging-paths"),"."),Object(b.b)("h3",{id:"auth-log-format"},"Auth Log Format"),Object(b.b)("p",null,"Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{})," - [19/Mar/2015:17:20:19 -0400] [] \n")),Object(b.b)("p",null,"The status block will contain one of the below strings:"),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthSuccess")," If a user has authenticated successfully by any method"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthFailure")," If the user failed to authenticate explicitly"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthError")," If there was an unexpected error during authentication")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for auth logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Status"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"AuthSuccess"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The status of the auth request. See above for details.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authenticated via OAuth2"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the auth attempt.")))),Object(b.b)("h3",{id:"request-log-format"},"Request Log Format"),Object(b.b)("p",null,"HTTP request logs will output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),' - [19/Mar/2015:17:20:19 -0400] GET "/path/" HTTP/1.1 "" \n')),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}\n")),Object(b.b)("p",null,"Available variables for request logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestDuration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0.001"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The time in seconds that a request took to process.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestURI"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),'"/oauth2/auth"'),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The URI path of the request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ResponseSize"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"12"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The size in bytes of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"StatusCode"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"200"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The HTTP status code of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The upstream data of the HTTP request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")))),Object(b.b)("h3",{id:"standard-log-format"},"Standard Log Format"),Object(b.b)("p",null,"All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[19/Mar/2015:17:20:19 -0400] [main.go:40] \n")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging-format")," flag. The default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[{{.Timestamp}}] [{{.File}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for standard logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"main.go:40"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The file and line number of the logging statement.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP: listening on 127.0.0.1:4180"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the log statement.")))),Object(b.b)("h2",{id:"configuring-for-use-with-the-nginx-auth_request-directive"},"Configuring for use with the Nginx ",Object(b.b)("inlineCode",{parentName:"h2"},"auth_request")," directive"),Object(b.b)("p",null,"The ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"http://nginx.org/en/docs/http/ngx_http_auth_request_module.html"}),"Nginx ",Object(b.b)("inlineCode",{parentName:"a"},"auth_request")," directive")," allows Nginx to authenticate requests via the oauth2-proxy's ",Object(b.b)("inlineCode",{parentName:"p"},"/auth")," endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-nginx"}),'server {\n listen 443 ssl;\n server_name ...;\n include ssl/ssl.conf;\n\n location /oauth2/ {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n proxy_set_header X-Auth-Request-Redirect $request_uri;\n # or, if you are handling multiple domains:\n # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;\n }\n location = /oauth2/auth {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n # nginx auth_request includes headers but not body\n proxy_set_header Content-Length "";\n proxy_pass_request_body off;\n }\n\n location / {\n auth_request /oauth2/auth;\n error_page 401 = /oauth2/sign_in;\n\n # pass information via X-User and X-Email headers to backend,\n # requires running with --set-xauthrequest flag\n auth_request_set $user $upstream_http_x_auth_request_user;\n auth_request_set $email $upstream_http_x_auth_request_email;\n proxy_set_header X-User $user;\n proxy_set_header X-Email $email;\n\n # if you enabled --pass-access-token, this will pass the token to the backend\n auth_request_set $token $upstream_http_x_auth_request_access_token;\n proxy_set_header X-Access-Token $token;\n\n # if you enabled --cookie-refresh, this is needed for it to work with auth_request\n auth_request_set $auth_cookie $upstream_http_set_cookie;\n add_header Set-Cookie $auth_cookie;\n\n # When using the --set-authorization-header flag, some provider\'s cookies can exceed the 4kb\n # limit and so the OAuth2 Proxy splits these into multiple parts.\n # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\n # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\n auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;\n\n # Extract the Cookie attributes from the first Set-Cookie header and append them\n # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\n if ($auth_cookie ~* "(; .*)") {\n set $auth_cookie_name_0 $auth_cookie;\n set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";\n }\n\n # Send both Set-Cookie headers now if there was a second part\n if ($auth_cookie_name_upstream_1) {\n add_header Set-Cookie $auth_cookie_name_0;\n add_header Set-Cookie $auth_cookie_name_1;\n }\n\n proxy_pass http://backend/;\n # or "root /path/to/site;" or "fastcgi_pass ..." etc\n }\n}\n')),Object(b.b)("p",null,"When you use ingress-nginx in Kubernetes, you MUST use ",Object(b.b)("inlineCode",{parentName:"p"},"kubernetes/ingress-nginx")," (which includes the Lua module) and the following configuration snippet for your ",Object(b.b)("inlineCode",{parentName:"p"},"Ingress"),".\nVariables set with ",Object(b.b)("inlineCode",{parentName:"p"},"auth_request_set")," are not ",Object(b.b)("inlineCode",{parentName:"p"},"set"),"-able in plain nginx config when the location is processed via ",Object(b.b)("inlineCode",{parentName:"p"},"proxy_pass")," and then may only be processed by Lua.\nNote that ",Object(b.b)("inlineCode",{parentName:"p"},"nginxinc/kubernetes-ingress")," does not include the Lua module."),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'nginx.ingress.kubernetes.io/auth-response-headers: Authorization\nnginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri\nnginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth\nnginx.ingress.kubernetes.io/configuration-snippet: |\n auth_request_set $name_upstream_1 $upstream_cookie_name_1;\n\n access_by_lua_block {\n if ngx.var.name_upstream_1 ~= "" then\n ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")\n end\n }\n')),Object(b.b)("p",null,"It is recommended to use ",Object(b.b)("inlineCode",{parentName:"p"},"--session-store-type=redis")," when expecting large sessions/OIDC tokens (",Object(b.b)("em",{parentName:"p"},"e.g.")," with MS Azure)."),Object(b.b)("p",null,"You have to substitute ",Object(b.b)("em",{parentName:"p"},"name"),' with the actual cookie name you configured via --cookie-name parameter. If you don\'t set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".'),Object(b.b)("h2",{id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware"},"Configuring for use with the Traefik (v2) ",Object(b.b)("inlineCode",{parentName:"h2"},"ForwardAuth")," middleware"),Object(b.b)("p",null,Object(b.b)("strong",{parentName:"p"},"This option requires ",Object(b.b)("inlineCode",{parentName:"strong"},"--reverse-proxy")," option to be set.")),Object(b.b)("h3",{id:"forwardauth-with-401-errors-middleware"},"ForwardAuth with 401 errors middleware"),Object(b.b)("p",null,"The ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"}),"Traefik v2 ",Object(b.b)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," allows Traefik to authenticate requests via the oauth2-proxy's ",Object(b.b)("inlineCode",{parentName:"p"},"/oauth2/auth")," endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'http:\n routers:\n a-service:\n rule: "Host(`a-service.example.com`)"\n service: a-service-backend\n middlewares:\n - oauth-errors\n - oauth-auth\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth:\n rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n oauth-errors:\n errors:\n status:\n - "401-403"\n service: oauth-backend\n query: "/oauth2/sign_in"\n')),Object(b.b)("h3",{id:"forwardauth-with-static-upstreams-configuration"},"ForwardAuth with static upstreams configuration"),Object(b.b)("p",null,"Redirect to sign_in functionality provided without the use of ",Object(b.b)("inlineCode",{parentName:"p"},"errors")," middleware with ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"}),"Traefik v2 ",Object(b.b)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," pointing to oauth2-proxy service's ",Object(b.b)("inlineCode",{parentName:"p"},"/")," endpoint"),Object(b.b)("p",null,Object(b.b)("strong",{parentName:"p"},"Following options need to be set on ",Object(b.b)("inlineCode",{parentName:"strong"},"oauth2-proxy"),":")),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"--upstream=static://202"),": Configures a static response for authenticated sessions"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"--reverseproxy=true"),": Enables the use of ",Object(b.b)("inlineCode",{parentName:"li"},"X-Forwarded-*")," headers to determine redirects correctly")),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'http:\n routers:\n a-service-route-1:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n a-service-route-2:\n rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-wo-redirect # unauthenticated session will return a 401\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n services-oauth2-route:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth2-proxy-route:\n rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n b-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.3:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth-redirect:\n forwardAuth:\n address: https://oauth.example.com/\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n oauth-auth-wo-redirect:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n')),Object(b.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"If you set up your OAuth2 provider to rotate your client secret, you can use the ",Object(b.b)("inlineCode",{parentName:"p"},"client-secret-file")," option to reload the secret when it is updated."))))}p.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/92147208.114088bc.js b/92147208.114088bc.js deleted file mode 100644 index 0d5586be..00000000 --- a/92147208.114088bc.js +++ /dev/null @@ -1 +0,0 @@ -(window.webpackJsonp=window.webpackJsonp||[]).push([[29],{116:function(e,t,a){"use strict";a.d(t,"a",(function(){return p})),a.d(t,"b",(function(){return j}));var n=a(0),r=a.n(n);function b(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function l(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function i(e){for(var t=1;t=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var b=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var o=r.a.createContext({}),d=function(e){var t=r.a.useContext(o),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},p=function(e){var t=d(e.components);return r.a.createElement(o.Provider,{value:t},e.children)},O={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},s=r.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,b=e.originalType,l=e.parentName,o=c(e,["components","mdxType","originalType","parentName"]),p=d(a),s=n,j=p["".concat(l,".").concat(s)]||p[s]||O[s]||b;return a?r.a.createElement(j,i(i({ref:t},o),{},{components:a})):r.a.createElement(j,i({ref:t},o))}));function j(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var b=a.length,l=new Array(b);l[0]=s;var i={};for(var c in t)hasOwnProperty.call(t,c)&&(i[c]=t[c]);i.originalType=e,i.mdxType="string"==typeof e?e:n,l[1]=i;for(var o=2;oauth_request directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",children:[]},{value:"Configuring for use with the Traefik (v2) ForwardAuth middleware",id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware",children:[{value:"ForwardAuth with 401 errors middleware",id:"forwardauth-with-401-errors-middleware",children:[]},{value:"ForwardAuth with static upstreams configuration",id:"forwardauth-with-static-upstreams-configuration",children:[]}]}],o={rightToc:c};function d(e){var t=e.components,a=Object(r.a)(e,["components"]);return Object(b.b)("wrapper",Object(n.a)({},o,a,{components:t,mdxType:"MDXLayout"}),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#command-line-options"}),"command line options"),", ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#environment-variables"}),"environment variables")," or ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file")," (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."),Object(b.b)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),Object(b.b)("p",null,"To generate a strong cookie secret use ",Object(b.b)("inlineCode",{parentName:"p"},"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(16)).decode())'")),Object(b.b)("h3",{id:"config-file"},"Config File"),Object(b.b)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),Object(b.b)("p",null,"An example ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"}),"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",Object(b.b)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),Object(b.b)("h3",{id:"command-line-options"},"Command Line Options"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Option"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Default"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--acr-values")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"optional, see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"}),"docs")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--approval-prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth approval_prompt"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"force"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log authentication attempts"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for authentication log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate against emails via file (one per line)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--azure-tenant")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"go to a tenant-specific or common (tenant-independent) endpoint."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"common"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--basic-auth-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the password to set when passing the HTTP Basic Auth header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-id")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client ID, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the file with OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--config")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to config file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Optional cookie domains to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-expire")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"expire timeframe for cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"168h0m0s")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-httponly")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HttpOnly cookie flag"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the name of the cookie that the oauth_proxy creates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"an optional cookie path to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"/poc/"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-refresh")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"refresh the cookie after this duration; ",Object(b.b)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote1"}),"1"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the seed string for secure cookies (optionally base64 encoded)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secure")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://owasp.org/www-community/controls/SecureFlag"}),"secure (HTTPS only) cookie flag")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-samesite")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set SameSite cookie attribute (",Object(b.b)("inlineCode",{parentName:"td"},'"lax"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"strict"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"none"'),", or ",Object(b.b)("inlineCode",{parentName:"td"},'""'),")."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--custom-templates-dir")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to custom html templates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--custom-sign-in-logo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),'path to an custom image for the sign_in page logo. Use \\"-\\" to disable default logo.'),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"display username / password login form if an htpasswd file is provided"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--email-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate emails with the specified domain (may be given multiple times). Use ",Object(b.b)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--errors-to-info-log")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"redirects error-level logging to default log channel instead of stderr"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"if ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",Object(b.b)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",Object(b.b)("inlineCode",{parentName:"td"},"iss"),", ",Object(b.b)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--exclude-logging-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"comma separated list of paths to exclude from logging, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"/ping,/path2"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--flush-interval")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"period between flushing response buffers when streaming responses"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"1s"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--force-https")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enforce https redirect"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"false"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--banner")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) banner string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--footer")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) footer string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-org")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this organisation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-team")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these teams (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to collaborators of this repository formatted as ",Object(b.b)("inlineCode",{parentName:"td"},"orgname/repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the token to use when verifying repository collaborators (must have push access to the repository)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gitlab-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these groups (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gitlab-projects")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these projects (may be given multiple times) formatted as ",Object(b.b)("inlineCode",{parentName:"td"},"orgname/repo=accesslevel"),". Access level should be a value matching ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://docs.gitlab.com/ee/api/members.html#valid-access-levels"}),"Gitlab access levels"),", defaulted to 20 if absent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-admin-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the google admin to impersonate for api calls"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this google group (may be given multiple times)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-service-account-json")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the path to the service account json credentials"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--htpasswd-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"additionally authenticate against a htpasswd file. Entries must be created with ",Object(b.b)("inlineCode",{parentName:"td"},"htpasswd -B")," for bcrypt encryption"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--htpasswd-user-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the groups to be set on sessions for htpasswd users"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--http-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"[http://]:")," or ",Object(b.b)("inlineCode",{parentName:"td"},"unix://")," to listen on for HTTP clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"127.0.0.1:4180"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--https-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},":")," to listen on for HTTPS clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'":443"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-compress")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Should rotated log files be compressed using gzip"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-filename")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File to log requests to, empty for ",Object(b.b)("inlineCode",{parentName:"td"},"stdout")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (stdout)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-local-time")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Use local time in log files and backup filenames instead of UTC"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true (local time)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-age")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of days to retain old log files"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"7")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-backups")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of old log files to retain; 0 to disable"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-size")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum size in megabytes of the log file before rotation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"100")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"private key in PEM format used to sign JWT, so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},'--jwt-key="${OAUTH2_PROXY_JWT_KEY}"'),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to the private key file in PEM format used to sign the JWT so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem"),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--login-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authentication endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-allow-unverified-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"don't fail if an email address in an id_token is not verified"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-issuer-verification")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-issuer-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OpenID Connect issuer URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://accounts.google.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OIDC JWKS URI for token verification; required if OIDC discovery is disabled"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-email-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which OIDC claim contains the user's email"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"email"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-groups-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which OIDC claim contains the user groups"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"groups"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")," this adds the X-Auth-Request-Access-Token header to the response"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OIDC IDToken to upstream via Authorization Bearer header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prefer-email-to-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-host-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass the request Host Header to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--profile-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Profile access endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"}),"OIDC prompt"),"; if present, ",Object(b.b)("inlineCode",{parentName:"td"},"approval-prompt")," is ignored"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth provider"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"google")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-ca-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-display-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Override the provider's name with the given string; used for the sign-in page"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"(depends on provider)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the ping endpoint that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/ping"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-user-agent")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"a User-Agent that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (don't check user agent)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--metrics-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the address /metrics will be served on"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--metrics-secure-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the address /metrics will be served on via HTTPS"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--metrics-tls-cert-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to certificate file for secure metrics server"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--metrics-tls-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to private key file for secure metrics server"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-prefix")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the url root path that this proxy should be nested under (e.g. /",Object(b.b)("inlineCode",{parentName:"td"},"/sign_in"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/oauth2"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-websockets")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enables WebSocket proxying"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pubjwk-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"JWK pubkey access endpoint: required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Header used to determine the real IP of the client, requires ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"X-Real-IP")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Token redemption endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redirect-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Redirect URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://internalapp.yourcompany.com/oauth2/callback"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis cluster connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"URL of redis server for redis session storage (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis password. Applicable for all Redis configurations. Will override any password set in ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel master name. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis sentinel connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis cluster. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis via sentinels. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-id-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Request header to use as the request ID in logging"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"X-Request-Id")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for request log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--resource")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The resource that is protected (Azure AD only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--scope")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth scope specification"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-cookie-minimal")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-store-type")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"/oauth2-proxy/docs/7.1.x/configuration/session_storage"}),"Session data storage backend"),"; redis or cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"cookie")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token"),", X-Auth-Request-Access-Token is added to response headers."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set Authorization Bearer response header (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HTTP Basic Auth information in response (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--show-debug-on-error")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--signature-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GAP-Signature request signature key (algorithm:secretkey)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--silence-ping-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"disable logging of requests to ping endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-preflight")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip authentication for OPTIONS requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-regex")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"(DEPRECATED for ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-route"),") bypass authentication for requests paths that match (may be given multiple times)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-route")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-strip-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strips ",Object(b.b)("inlineCode",{parentName:"td"},"X-Forwarded-*")," style authentication headers & ",Object(b.b)("inlineCode",{parentName:"td"},"Authorization")," header if they would be set by oauth2-proxy"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip requests that have verified JWT bearer tokens (the token must have ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields"}),Object(b.b)("inlineCode",{parentName:"a"},"aud"))," that matches this client id or one of the extras from ",Object(b.b)("inlineCode",{parentName:"td"},"extra-jwt-issuers"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-oidc-discovery")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass OIDC endpoint discovery. ",Object(b.b)("inlineCode",{parentName:"td"},"--login-url"),", ",Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")," must be configured in this case"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-provider-button")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip sign-in-page to directly reach the next step: oauth/start"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS providers"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-upstream-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS upstreams"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log standard runtime information"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for standard log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-cert-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to certificate file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to private key file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--upstream")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the http url(s) of the upstream endpoint, file:// paths for static files or ",Object(b.b)("inlineCode",{parentName:"td"},"static://")," for static response. Routing is based on the path"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--allowed-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this group (may be given multiple times)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--validate-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Access token validation endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--version")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"n/a"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"print version string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--whitelist-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allowed domains for redirection after authentication. Prefix domain with a ",Object(b.b)("inlineCode",{parentName:"td"},".")," to allow subdomains (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".example.com"),")","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote2"}),"2"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--trusted-ip")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," and optionally ",Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")," this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))))),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote1"},"1"),"]",": Only these providers support ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-refresh"),": GitLab, Google and OIDC"),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote2"},"2"),"]",": When using the ",Object(b.b)("inlineCode",{parentName:"p"},"whitelist-domain")," option, any domain prefixed with a ",Object(b.b)("inlineCode",{parentName:"p"},".")," will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:8080"),". To allow any port, use ",Object(b.b)("inlineCode",{parentName:"p"},"*"),": ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:*"),"."),Object(b.b)("p",null,"See below for provider specific options"),Object(b.b)("h3",{id:"upstreams-configuration"},"Upstreams Configuration"),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/")," for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/some/path/")," then it will only be requests that start with ",Object(b.b)("inlineCode",{parentName:"p"},"/some/path/")," which are forwarded to the upstream."),Object(b.b)("p",null,"Static file paths are configured as a file:// URL. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/")," will serve the files from that directory at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/var/www/static/"),", which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/#/static/")," will make ",Object(b.b)("inlineCode",{parentName:"p"},"/var/www/static/")," available at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/static/"),"."),Object(b.b)("p",null,"Multiple upstreams can either be configured by supplying a comma separated list to the ",Object(b.b)("inlineCode",{parentName:"p"},"--upstream")," parameter, supplying the parameter multiple times or providing a list in the ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file"),". When multiple upstreams are used routing to them will be based on the path they are set up with."),Object(b.b)("h3",{id:"environment-variables"},"Environment variables"),Object(b.b)("p",null,"Every command line argument can be specified as an environment variable by\nprefixing it with ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_"),", capitalising it, and replacing hyphens (",Object(b.b)("inlineCode",{parentName:"p"},"-"),")\nwith underscores (",Object(b.b)("inlineCode",{parentName:"p"},"_"),"). If the argument can be specified multiple times, the\nenvironment variable should be plural (trailing ",Object(b.b)("inlineCode",{parentName:"p"},"S"),")."),Object(b.b)("p",null,"This is particularly useful for storing secrets outside of a configuration file\nor the command line."),Object(b.b)("p",null,"For example, the ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-secret")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_COOKIE_SECRET"),",\nand the ",Object(b.b)("inlineCode",{parentName:"p"},"--email-domain")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_EMAIL_DOMAINS"),"."),Object(b.b)("h2",{id:"logging-configuration"},"Logging Configuration"),Object(b.b)("p",null,"By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the ",Object(b.b)("inlineCode",{parentName:"p"},"--logging-filename")," command."),Object(b.b)("p",null,"If logging to a file you can also configure the maximum file size (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-size"),"), age (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-age"),"), max backup logs (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-backups"),"), and if backup logs should be compressed (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-compress"),")."),Object(b.b)("p",null,"There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging"),", ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging"),", and ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging"),"."),Object(b.b)("p",null,"Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log."),Object(b.b)("p",null,"Logging of requests to the ",Object(b.b)("inlineCode",{parentName:"p"},"/ping")," endpoint (or using ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-user-agent"),") can be disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--silence-ping-logging")," reducing log volume. This flag appends the ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-path")," to ",Object(b.b)("inlineCode",{parentName:"p"},"--exclude-logging-paths"),"."),Object(b.b)("h3",{id:"auth-log-format"},"Auth Log Format"),Object(b.b)("p",null,"Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{})," - - [19/Mar/2015:17:20:19 -0400] [] \n")),Object(b.b)("p",null,"The status block will contain one of the below strings:"),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthSuccess")," If a user has authenticated successfully by any method"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthFailure")," If the user failed to authenticate explicitly"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthError")," If there was an unexpected error during authentication")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for auth logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authenticated via OAuth2"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the auth attempt.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestID"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"00010203-0405-4607-8809-0a0b0c0d0e0f"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request ID pulled from the ",Object(b.b)("inlineCode",{parentName:"td"},"--request-id-header"),". Random UUID if empty")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Status"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"AuthSuccess"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The status of the auth request. See above for details.")))),Object(b.b)("h3",{id:"request-log-format"},"Request Log Format"),Object(b.b)("p",null,"HTTP request logs will output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),' - - [19/Mar/2015:17:20:19 -0400] GET "/path/" HTTP/1.1 "" \n')),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}\n")),Object(b.b)("p",null,"Available variables for request logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestDuration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0.001"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The time in seconds that a request took to process.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestID"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"00010203-0405-4607-8809-0a0b0c0d0e0f"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request ID pulled from the ",Object(b.b)("inlineCode",{parentName:"td"},"--request-id-header"),". Random UUID if empty")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestURI"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),'"/oauth2/auth"'),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The URI path of the request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ResponseSize"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"12"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The size in bytes of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"StatusCode"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"200"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The HTTP status code of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The upstream data of the HTTP request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")))),Object(b.b)("h3",{id:"standard-log-format"},"Standard Log Format"),Object(b.b)("p",null,"All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[19/Mar/2015:17:20:19 -0400] [main.go:40] \n")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging-format")," flag. The default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[{{.Timestamp}}] [{{.File}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for standard logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"main.go:40"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The file and line number of the logging statement.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP: listening on 127.0.0.1:4180"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the log statement.")))),Object(b.b)("h2",{id:"configuring-for-use-with-the-nginx-auth_request-directive"},"Configuring for use with the Nginx ",Object(b.b)("inlineCode",{parentName:"h2"},"auth_request")," directive"),Object(b.b)("p",null,"The ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"http://nginx.org/en/docs/http/ngx_http_auth_request_module.html"}),"Nginx ",Object(b.b)("inlineCode",{parentName:"a"},"auth_request")," directive")," allows Nginx to authenticate requests via the oauth2-proxy's ",Object(b.b)("inlineCode",{parentName:"p"},"/auth")," endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-nginx"}),'server {\n listen 443 ssl;\n server_name ...;\n include ssl/ssl.conf;\n\n location /oauth2/ {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n proxy_set_header X-Auth-Request-Redirect $request_uri;\n # or, if you are handling multiple domains:\n # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;\n }\n location = /oauth2/auth {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n # nginx auth_request includes headers but not body\n proxy_set_header Content-Length "";\n proxy_pass_request_body off;\n }\n\n location / {\n auth_request /oauth2/auth;\n error_page 401 = /oauth2/sign_in;\n\n # pass information via X-User and X-Email headers to backend,\n # requires running with --set-xauthrequest flag\n auth_request_set $user $upstream_http_x_auth_request_user;\n auth_request_set $email $upstream_http_x_auth_request_email;\n proxy_set_header X-User $user;\n proxy_set_header X-Email $email;\n\n # if you enabled --pass-access-token, this will pass the token to the backend\n auth_request_set $token $upstream_http_x_auth_request_access_token;\n proxy_set_header X-Access-Token $token;\n\n # if you enabled --cookie-refresh, this is needed for it to work with auth_request\n auth_request_set $auth_cookie $upstream_http_set_cookie;\n add_header Set-Cookie $auth_cookie;\n\n # When using the --set-authorization-header flag, some provider\'s cookies can exceed the 4kb\n # limit and so the OAuth2 Proxy splits these into multiple parts.\n # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\n # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\n auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;\n\n # Extract the Cookie attributes from the first Set-Cookie header and append them\n # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\n if ($auth_cookie ~* "(; .*)") {\n set $auth_cookie_name_0 $auth_cookie;\n set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";\n }\n\n # Send both Set-Cookie headers now if there was a second part\n if ($auth_cookie_name_upstream_1) {\n add_header Set-Cookie $auth_cookie_name_0;\n add_header Set-Cookie $auth_cookie_name_1;\n }\n\n proxy_pass http://backend/;\n # or "root /path/to/site;" or "fastcgi_pass ..." etc\n }\n}\n')),Object(b.b)("p",null,"When you use ingress-nginx in Kubernetes, you MUST use ",Object(b.b)("inlineCode",{parentName:"p"},"kubernetes/ingress-nginx")," (which includes the Lua module) and the following configuration snippet for your ",Object(b.b)("inlineCode",{parentName:"p"},"Ingress"),".\nVariables set with ",Object(b.b)("inlineCode",{parentName:"p"},"auth_request_set")," are not ",Object(b.b)("inlineCode",{parentName:"p"},"set"),"-able in plain nginx config when the location is processed via ",Object(b.b)("inlineCode",{parentName:"p"},"proxy_pass")," and then may only be processed by Lua.\nNote that ",Object(b.b)("inlineCode",{parentName:"p"},"nginxinc/kubernetes-ingress")," does not include the Lua module."),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'nginx.ingress.kubernetes.io/auth-response-headers: Authorization\nnginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri\nnginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth\nnginx.ingress.kubernetes.io/configuration-snippet: |\n auth_request_set $name_upstream_1 $upstream_cookie_name_1;\n\n access_by_lua_block {\n if ngx.var.name_upstream_1 ~= "" then\n ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")\n end\n }\n')),Object(b.b)("p",null,"It is recommended to use ",Object(b.b)("inlineCode",{parentName:"p"},"--session-store-type=redis")," when expecting large sessions/OIDC tokens (",Object(b.b)("em",{parentName:"p"},"e.g.")," with MS Azure)."),Object(b.b)("p",null,"You have to substitute ",Object(b.b)("em",{parentName:"p"},"name"),' with the actual cookie name you configured via --cookie-name parameter. If you don\'t set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".'),Object(b.b)("h2",{id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware"},"Configuring for use with the Traefik (v2) ",Object(b.b)("inlineCode",{parentName:"h2"},"ForwardAuth")," middleware"),Object(b.b)("p",null,Object(b.b)("strong",{parentName:"p"},"This option requires ",Object(b.b)("inlineCode",{parentName:"strong"},"--reverse-proxy")," option to be set.")),Object(b.b)("h3",{id:"forwardauth-with-401-errors-middleware"},"ForwardAuth with 401 errors middleware"),Object(b.b)("p",null,"The ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"}),"Traefik v2 ",Object(b.b)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," allows Traefik to authenticate requests via the oauth2-proxy's ",Object(b.b)("inlineCode",{parentName:"p"},"/oauth2/auth")," endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'http:\n routers:\n a-service:\n rule: "Host(`a-service.example.com`)"\n service: a-service-backend\n middlewares:\n - oauth-errors\n - oauth-auth\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth:\n rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n oauth-errors:\n errors:\n status:\n - "401-403"\n service: oauth-backend\n query: "/oauth2/sign_in"\n')),Object(b.b)("h3",{id:"forwardauth-with-static-upstreams-configuration"},"ForwardAuth with static upstreams configuration"),Object(b.b)("p",null,"Redirect to sign_in functionality provided without the use of ",Object(b.b)("inlineCode",{parentName:"p"},"errors")," middleware with ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"}),"Traefik v2 ",Object(b.b)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," pointing to oauth2-proxy service's ",Object(b.b)("inlineCode",{parentName:"p"},"/")," endpoint"),Object(b.b)("p",null,Object(b.b)("strong",{parentName:"p"},"Following options need to be set on ",Object(b.b)("inlineCode",{parentName:"strong"},"oauth2-proxy"),":")),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"--upstream=static://202"),": Configures a static response for authenticated sessions"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"--reverseproxy=true"),": Enables the use of ",Object(b.b)("inlineCode",{parentName:"li"},"X-Forwarded-*")," headers to determine redirects correctly")),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'http:\n routers:\n a-service-route-1:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n a-service-route-2:\n rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-wo-redirect # unauthenticated session will return a 401\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n services-oauth2-route:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth2-proxy-route:\n rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n b-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.3:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth-redirect:\n forwardAuth:\n address: https://oauth.example.com/\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n oauth-auth-wo-redirect:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n')),Object(b.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"If you set up your OAuth2 provider to rotate your client secret, you can use the ",Object(b.b)("inlineCode",{parentName:"p"},"client-secret-file")," option to reload the secret when it is updated."))))}d.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/935f2afb.1429e449.js b/935f2afb.1429e449.js deleted file mode 100644 index 572008e1..00000000 --- a/935f2afb.1429e449.js +++ /dev/null @@ -1 +0,0 @@ -(window.webpackJsonp=window.webpackJsonp||[]).push([[30],{88:function(o){o.exports=JSON.parse('{"pluginId":"default","version":"current","label":"Next","isLast":false,"docsSidebars":{"docs":[{"type":"link","label":"Installation","href":"/oauth2-proxy/docs/next/"},{"type":"link","label":"Behaviour","href":"/oauth2-proxy/docs/next/behaviour"},{"collapsed":false,"type":"category","label":"Configuration","items":[{"type":"link","label":"Overview","href":"/oauth2-proxy/docs/next/configuration/overview"},{"type":"link","label":"OAuth Provider Configuration","href":"/oauth2-proxy/docs/next/configuration/oauth_provider"},{"type":"link","label":"Session Storage","href":"/oauth2-proxy/docs/next/configuration/session_storage"},{"type":"link","label":"TLS Configuration","href":"/oauth2-proxy/docs/next/configuration/tls"},{"type":"link","label":"Alpha Configuration","href":"/oauth2-proxy/docs/next/configuration/alpha-config"}]},{"collapsed":false,"type":"category","label":"Features","items":[{"type":"link","label":"Endpoints","href":"/oauth2-proxy/docs/next/features/endpoints"}]},{"collapsed":false,"type":"category","label":"Community","items":[{"type":"link","label":"Security","href":"/oauth2-proxy/docs/next/community/security"}]}]},"permalinkToSidebar":{"/oauth2-proxy/docs/next/behaviour":"docs","/oauth2-proxy/docs/next/community/security":"docs","/oauth2-proxy/docs/next/configuration/alpha-config":"docs","/oauth2-proxy/docs/next/configuration/oauth_provider":"docs","/oauth2-proxy/docs/next/configuration/overview":"docs","/oauth2-proxy/docs/next/configuration/session_storage":"docs","/oauth2-proxy/docs/next/configuration/tls":"docs","/oauth2-proxy/docs/next/features/endpoints":"docs","/oauth2-proxy/docs/next/":"docs"}}')}}]); \ No newline at end of file diff --git a/94285305.cff6b03f.js b/94285305.cff6b03f.js deleted file mode 100644 index 9ae43846..00000000 --- a/94285305.cff6b03f.js +++ /dev/null @@ -1 +0,0 @@ -(window.webpackJsonp=window.webpackJsonp||[]).push([[31],{116:function(e,t,r){"use strict";r.d(t,"a",(function(){return l})),r.d(t,"b",(function(){return f}));var n=r(0),o=r.n(n);function i(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function a(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function c(e){for(var t=1;t=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var u=o.a.createContext({}),p=function(e){var t=o.a.useContext(u),r=t;return e&&(r="function"==typeof e?e(t):c(c({},t),e)),r},l=function(e){var t=p(e.components);return o.a.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,i=e.originalType,a=e.parentName,u=s(e,["components","mdxType","originalType","parentName"]),l=p(r),b=n,f=l["".concat(a,".").concat(b)]||l[b]||d[b]||i;return r?o.a.createElement(f,c(c({ref:t},u),{},{components:r})):o.a.createElement(f,c({ref:t},u))}));function f(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var i=r.length,a=new Array(i);a[0]=b;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:n,a[1]=c;for(var u=2;u=0||(a[r]=e[r]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(a[r]=e[r])}return a}var l=a.a.createContext({}),u=function(e){var t=a.a.useContext(l),r=t;return e&&(r="function"==typeof e?e(t):c(c({},t),e)),r},b=function(e){var t=u(e.components);return a.a.createElement(l.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return a.a.createElement(a.a.Fragment,{},t)}},d=a.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,o=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),b=u(r),d=n,m=b["".concat(i,".").concat(d)]||b[d]||s[d]||o;return r?a.a.createElement(m,c(c({ref:t},l),{},{components:r})):a.a.createElement(m,c({ref:t},l))}));function m(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var o=r.length,i=new Array(o);i[0]=d;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:n,i[1]=c;for(var l=2;l=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var l=o.a.createContext({}),s=function(e){var t=o.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},u=function(e){var t=s(e.components);return o.a.createElement(l.Provider,{value:t},e.children)},m={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,a=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),u=s(n),b=r,d=u["".concat(i,".").concat(b)]||u[b]||m[b]||a;return n?o.a.createElement(d,c(c({ref:t},l),{},{components:n})):o.a.createElement(d,c({ref:t},l))}));function d(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var a=n.length,i=new Array(a);i[0]=b;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:r,i[1]=c;for(var l=2;l=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var l=i.a.createContext({}),u=function(e){var t=i.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},b=function(e){var t=u(e.components);return i.a.createElement(l.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return i.a.createElement(i.a.Fragment,{},t)}},p=i.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,o=e.originalType,a=e.parentName,l=c(e,["components","mdxType","originalType","parentName"]),b=u(n),p=r,h=b["".concat(a,".").concat(p)]||b[p]||d[p]||o;return n?i.a.createElement(h,s(s({ref:t},l),{},{components:n})):i.a.createElement(h,s({ref:t},l))}));function h(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var o=n.length,a=new Array(o);a[0]=p;var s={};for(var c in t)hasOwnProperty.call(t,c)&&(s[c]=t[c]);s.originalType=e,s.mdxType="string"==typeof e?e:r,a[1]=s;for(var l=2;l=0||(n[a]=e[a]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(o=0;o=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(n[a]=e[a])}return n}var p=n.a.createContext({}),b=function(e){var t=n.a.useContext(p),a=t;return e&&(a="function"==typeof e?e(t):l(l({},t),e)),a},s=function(e){var t=b(e.components);return n.a.createElement(p.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return n.a.createElement(n.a.Fragment,{},t)}},d=n.a.forwardRef((function(e,t){var a=e.components,o=e.mdxType,r=e.originalType,i=e.parentName,p=c(e,["components","mdxType","originalType","parentName"]),s=b(a),d=o,h=s["".concat(i,".").concat(d)]||s[d]||u[d]||r;return a?n.a.createElement(h,l(l({ref:t},p),{},{components:a})):n.a.createElement(h,l({ref:t},p))}));function h(e,t){var a=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var r=a.length,i=new Array(r);i[0]=d;var l={};for(var c in t)hasOwnProperty.call(t,c)&&(l[c]=t[c]);l.originalType=e,l.mdxType="string"==typeof e?e:o,i[1]=l;for(var p=2;p\n --client-secret=\n --oidc-issuer-url=https://sts.windows.net/{tenant-id}/\n")),Object(r.b)("p",null,"Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the ",Object(r.b)("inlineCode",{parentName:"p"},"proxy_buffer_size")," in nginx or implementing the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/configuration/session_storage#redis-storage"}),"redis session storage")," should resolve this."),Object(r.b)("h3",{id:"adfs-auth-provider"},"ADFS Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Open the ADFS administration console on your Windows Server and add a new Application Group"),Object(r.b)("li",{parentName:"ol"},"Provide a name for the integration, select Server Application from the Standalone applications section and click Next"),Object(r.b)("li",{parentName:"ol"},"Follow the wizard to get the client-id, client-secret and configure the application credentials"),Object(r.b)("li",{parentName:"ol"},"Configure the proxy with")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=adfs\n --client-id=\n --client-secret=\n")),Object(r.b)("p",null,"Note: When using the ADFS Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/configuration/session_storage#redis-storage"}),"redis session storage")," should resolve this."),Object(r.b)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new FB App from ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.facebook.com/"}),"https://developers.facebook.com/")),Object(r.b)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://github.com/settings/developers"}),"https://github.com/settings/developers")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*")),Object(r.b)("p",null,"NOTE: When ",Object(r.b)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),Object(r.b)("p",null,"To restrict by organization only, include the following flag:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-org="": restrict logins to members of this organisation\n')),Object(r.b)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",Object(r.b)("inlineCode",{parentName:"p"},"-github-org"),":"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),Object(r.b)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),Object(r.b)("p",null,"If you'd like to allow access to users with ",Object(r.b)("strong",{parentName:"p"},"read only")," access to a ",Object(r.b)("strong",{parentName:"p"},"public")," repository you will need to provide a ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/settings/tokens"}),"token")," for a user that has write access to the repository. The token must be created with at least the ",Object(r.b)("inlineCode",{parentName:"p"},"public_repo")," scope:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-token="": the token to use when verifying repository collaborators\n')),Object(r.b)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-user="": allow logins by username, separated by a comma\n')),Object(r.b)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-login-url="http(s):///login/oauth/authorize"\n-redeem-url="http(s):///login/oauth/access_token"\n-validate-url="http(s):///api/v3"\n')),Object(r.b)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),Object(r.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(r.b)("div",Object(o.a)({parentName:"div"},{className:"admonition-heading"}),Object(r.b)("h5",{parentName:"div"},Object(r.b)("span",Object(o.a)({parentName:"h5"},{className:"admonition-icon"}),Object(r.b)("svg",Object(o.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(r.b)("path",Object(o.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(r.b)("div",Object(o.a)({parentName:"div"},{className:"admonition-content"}),Object(r.b)("p",{parentName:"div"},"This is the legacy provider for Keycloak, use ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"#keycloak-oidc-auth-provider"}),"Keycloak OIDC Auth Provider")," if possible."))),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",Object(r.b)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",Object(r.b)("strong",{parentName:"li"},"Valid Redirect URIs")," '",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://internal.yourcompany.com/oauth2/callback'"}),"https://internal.yourcompany.com/oauth2/callback'")),Object(r.b)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),Object(r.b)("li",{parentName:"ol"},"Create a mapper with ",Object(r.b)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",Object(r.b)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),Object(r.b)("p",null,"Make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' --provider=keycloak\n --client-id=\n --client-secret=\n --login-url="http(s):///auth/realms//protocol/openid-connect/auth"\n --redeem-url="http(s):///auth/realms//protocol/openid-connect/token"\n --profile-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n --validate-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n --keycloak-group=\n --keycloak-group=\n')),Object(r.b)("p",null,"For group based authorization, the optional ",Object(r.b)("inlineCode",{parentName:"p"},"--keycloak-group")," (legacy) or ",Object(r.b)("inlineCode",{parentName:"p"},"--allowed-group")," (global standard)\nflags can be used to specify which groups to limit access to."),Object(r.b)("p",null,"If these are unset but a ",Object(r.b)("inlineCode",{parentName:"p"},"groups")," mapper is set up above in step (3), the provider will still\npopulate the ",Object(r.b)("inlineCode",{parentName:"p"},"X-Forwarded-Groups")," header to your upstream server with the ",Object(r.b)("inlineCode",{parentName:"p"},"groups")," data in the\nKeycloak userinfo endpoint response."),Object(r.b)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak\nyou should define the 'keycloak-group' value to /admin."),Object(r.b)("h3",{id:"keycloak-oidc-auth-provider"},"Keycloak OIDC Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",Object(r.b)("strong",{parentName:"li"},"Access Type")," 'confidental', ",Object(r.b)("strong",{parentName:"li"},"Client protocol")," 'openid-connect' and ",Object(r.b)("strong",{parentName:"li"},"Valid Redirect URIs")," '",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://internal.yourcompany.com/oauth2/callback'"}),"https://internal.yourcompany.com/oauth2/callback'")),Object(r.b)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),Object(r.b)("li",{parentName:"ol"},"Create a mapper with ",Object(r.b)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",Object(r.b)("strong",{parentName:"li"},"Token Claim Name")," 'groups'."),Object(r.b)("li",{parentName:"ol"},"Create a mapper with ",Object(r.b)("strong",{parentName:"li"},"Mapper Type")," 'Audience' and ",Object(r.b)("strong",{parentName:"li"},"Included Client Audience")," and ",Object(r.b)("strong",{parentName:"li"},"Included Custom Audience")," set to your client name.")),Object(r.b)("p",null,"Make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=keycloak-oidc\n --client-id=\n --client-secret=\n --redirect-url=https://myapp.com/oauth2/callback\n --oidc-issuer-url=https:///auth/realms/\n --allowed-role= // Optional, required realm role\n --allowed-role=: // Optional, required client role\n")),Object(r.b)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),Object(r.b)("p",null,"This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/issues/994"}),"994"),")."),Object(r.b)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"}),"these steps to add an application"),". Make sure to enable at least the ",Object(r.b)("inlineCode",{parentName:"p"},"openid"),", ",Object(r.b)("inlineCode",{parentName:"p"},"profile")," and ",Object(r.b)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://myapp.com/oauth2/callback"}),"https://myapp.com/oauth2/callback"),"."),Object(r.b)("p",null,"If you need projects filtering, add the extra ",Object(r.b)("inlineCode",{parentName:"p"},"read_api")," scope to your application."),Object(r.b)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/configuration/overview#generating-a-cookie-secret"}),"these steps")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' --provider="gitlab"\n --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n --client-id=GITLAB_CLIENT_ID\n --client-secret=GITLAB_CLIENT_SECRET\n --cookie-secret=COOKIE_SECRET\n')),Object(r.b)("p",null,"Restricting by group membership is possible with the following option:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),Object(r.b)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--oidc-issuer-url=""\n')),Object(r.b)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),Object(r.b)("p",null,"For LinkedIn, the registration steps are:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://www.linkedin.com/secure/developer"}),"https://www.linkedin.com/secure/developer")),Object(r.b)("li",{parentName:"ol"},"In the OAuth User Agreement section:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),Object(r.b)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),Object(r.b)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),Object(r.b)("li",{parentName:"ol"},"Take note of the ",Object(r.b)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",Object(r.b)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),Object(r.b)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),Object(r.b)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."),Object(r.b)("p",null,"This provider was originally built against CoreOS Dex and we will use it as an example.\nThe OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below."),Object(r.b)("h4",{id:"dex"},"Dex"),Object(r.b)("p",null,"To configure the OIDC provider for Dex, perform the following steps:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Download Dex:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"go get github.com/dexidp/dex\n")),Object(r.b)("p",{parentName:"li"},"See the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://dexidp.io/docs/getting-started/"}),"getting started guide")," for more details.")),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the ",Object(r.b)("inlineCode",{parentName:"p"},"staticClients")," section of ",Object(r.b)("inlineCode",{parentName:"p"},"examples/config-dev.yaml"),":"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"- id: oauth2-proxy\nredirectURIs:\n- 'http://127.0.0.1:4180/oauth2/callback'\nname: 'oauth2-proxy'\nsecret: proxy\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Launch Dex: from ",Object(r.b)("inlineCode",{parentName:"p"},"$GOPATH/github.com/dexidp/dex"),", run:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"bin/dex serve examples/config-dev.yaml\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"In a second terminal, run the oauth2-proxy with the following args:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-provider oidc\n-provider-display-name "My OIDC Provider"\n-client-id oauth2-proxy\n-client-secret proxy\n-redirect-url http://127.0.0.1:4180/oauth2/callback\n-oidc-issuer-url http://127.0.0.1:5556/dex\n-cookie-secure=false\n-cookie-secret=secret\n-email-domain kilgore.trout\n')),Object(r.b)("p",{parentName:"li"},"To serve the current working directory as a web site under the ",Object(r.b)("inlineCode",{parentName:"p"},"/static")," endpoint, add:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"-upstream file://$PWD/#/static/\n"))),Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Test the setup by visiting ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"http://127.0.0.1:4180"}),"http://127.0.0.1:4180")," or ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"http://127.0.0.1:4180/static"}),"http://127.0.0.1:4180/static")," ."))),Object(r.b)("p",null,"See also ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment"}),"our local testing environment")," for a self-contained example using Docker and etcd as storage for Dex."),Object(r.b)("h4",{id:"okta"},"Okta"),Object(r.b)("p",null,"To configure the OIDC provider for Okta, perform the following steps:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",Object(r.b)("inlineCode",{parentName:"li"},"example.oktapreview.com")),Object(r.b)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",Object(r.b)("inlineCode",{parentName:"li"},"default")," will work.")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Security")," then select ",Object(r.b)("strong",{parentName:"li"},"API")),Object(r.b)("li",{parentName:"ul"},"Click ",Object(r.b)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),Object(r.b)("li",{parentName:"ul"},"Fill out the ",Object(r.b)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),Object(r.b)("li",{parentName:"ul"},"For ",Object(r.b)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://example.corp.com"}),"https://example.corp.com")),Object(r.b)("li",{parentName:"ul"},"Fill out a ",Object(r.b)("strong",{parentName:"li"},"Description")),Object(r.b)("li",{parentName:"ul"},"Add any ",Object(r.b)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),Object(r.b)("li",{parentName:"ul"},"The default settings will work for other options.\n",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"}),"See Okta documentation for more information on Authorization Servers"))),Object(r.b)("ol",{start:3},Object(r.b)("li",{parentName:"ol"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Applications")," then select ",Object(r.b)("strong",{parentName:"li"},"Add Application"),".")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"Web")," for the ",Object(r.b)("strong",{parentName:"li"},"Platform")," setting."),Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"OpenID Connect")," and click ",Object(r.b)("strong",{parentName:"li"},"Create")),Object(r.b)("li",{parentName:"ul"},"Pick an ",Object(r.b)("strong",{parentName:"li"},"Application Name")," such as ",Object(r.b)("inlineCode",{parentName:"li"},"Example App"),"."),Object(r.b)("li",{parentName:"ul"},"Set the ",Object(r.b)("strong",{parentName:"li"},"Login redirect URI")," to ",Object(r.b)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"General")," set the ",Object(r.b)("strong",{parentName:"li"},"Allowed grant types")," to ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token"),"."),Object(r.b)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client Secret"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),Object(r.b)("ol",{start:4},Object(r.b)("li",{parentName:"ol"},Object(r.b)("p",{parentName:"li"},"Create a configuration file like the following:"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n "https://example.corp.com"\n]\nemail_domains = [\n "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')))),Object(r.b)("p",null,"The ",Object(r.b)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",Object(r.b)("strong",{parentName:"p"},"Authorization Server"),"'s ",Object(r.b)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://corp.okta.com"}),"https://corp.okta.com")," .\nThe ",Object(r.b)("inlineCode",{parentName:"p"},"client_id")," and ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",Object(r.b)("inlineCode",{parentName:"p"},"cookie_secret")," to encrypt the cookie."),Object(r.b)("p",null,"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),Object(r.b)("h4",{id:"okta---localhost"},"Okta - localhost"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Signup for developer account: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/signup/"}),"https://developer.okta.com/signup/")),Object(r.b)("li",{parentName:"ol"},"Create New ",Object(r.b)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),Object(r.b)("li",{parentName:"ol"},"Example Application Settings for localhost:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Name:")," My Web App"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Group assignments:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Everyone")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Grant type allowed:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token")))),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),Object(r.b)("li",{parentName:"ol"},"Example config file ",Object(r.b)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n "http://0.0.0.0:8080"\n]\nemail_domains = [\n "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),Object(r.b)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),Object(r.b)("h3",{id:"logingov-provider"},"login.gov Provider"),Object(r.b)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://login.gov/developers/"}),"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),Object(r.b)("p",null,"A developer guide is available here: ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://developers.login.gov/"}),"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),Object(r.b)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),Object(r.b)("p",null,"First, register your application in the dashboard. The important bits are:"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Identity protocol: make this ",Object(r.b)("inlineCode",{parentName:"li"},"Openid connect")),Object(r.b)("li",{parentName:"ul"},"Issuer: do what they say for OpenID Connect. We will refer to this string as ",Object(r.b)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),Object(r.b)("li",{parentName:"ul"},"Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",Object(r.b)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",Object(r.b)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",Object(r.b)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),Object(r.b)("li",{parentName:"ul"},"Return to App URL: Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/")),Object(r.b)("li",{parentName:"ul"},"Redirect URIs: Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),Object(r.b)("li",{parentName:"ul"},"Attribute Bundle: Make sure that email is selected.")),Object(r.b)("p",null,"Now start the proxy up with the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'./oauth2-proxy -provider login.gov \\\n -client-id=${LOGINGOV_ISSUER} \\\n -redirect-url=http://localhost:4180/oauth2/callback \\\n -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n -cookie-secure=false \\\n -email-domain=gsa.gov \\\n -upstream=http://localhost:3000/ \\\n -cookie-secret=somerandomstring12341234567890AB \\\n -cookie-domain=localhost \\\n -skip-provider-button=true \\\n -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),Object(r.b)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",Object(r.b)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",Object(r.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",Object(r.b)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),Object(r.b)("p",null,"Once it is running, you should be able to go to ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:3000/"),". In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),Object(r.b)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),Object(r.b)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),Object(r.b)("p",null,"In this case, you can set the ",Object(r.b)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," -provider oidc\n -client-id oauth2-proxy\n -client-secret proxy\n -redirect-url http://127.0.0.1:4180/oauth2/callback\n -oidc-issuer-url http://127.0.0.1:5556\n -skip-oidc-discovery\n -login-url http://127.0.0.1:5556/authorize\n -redeem-url http://127.0.0.1:5556/token\n -oidc-jwks-url http://127.0.0.1:5556/keys\n -cookie-secure=false\n -email-domain example.com\n")),Object(r.b)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),Object(r.b)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),Object(r.b)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",Object(r.b)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",Object(r.b)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),Object(r.b)("p",null,"Refer to the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"}),"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',Object(r.b)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' -provider nextcloud\n -client-id \n -client-secret \n -login-url="/index.php/apps/oauth2/authorize"\n -redeem-url="/index.php/apps/oauth2/api/v1/token"\n -validate-url="/ocs/v2.php/cloud/user?format=json"\n')),Object(r.b)("p",null,"Note: in ",Object(r.b)("em",{parentName:"p"},"all")," cases the validate-url will ",Object(r.b)("em",{parentName:"p"},"not")," have the ",Object(r.b)("inlineCode",{parentName:"p"},"index.php"),"."),Object(r.b)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://cloud.digitalocean.com/account/api/applications"}),"Create a new OAuth application"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),Object(r.b)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',Object(r.b)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=digitalocean\n --client-id=\n --client-secret=\n")),Object(r.b)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",Object(r.b)("inlineCode",{parentName:"p"},"https:///oauth2/callback"),". If you need to change it, you can use the ",Object(r.b)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),Object(r.b)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"}),"Add a new OAuth consumer"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},'In "Callback URL" use ',Object(r.b)("inlineCode",{parentName:"li"},"https:///oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"")," with the actual hostname that oauth2-proxy is running on."),Object(r.b)("li",{parentName:"ul"},"In Permissions section select:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"Account -> Email"),Object(r.b)("li",{parentName:"ul"},"Team membership -> Read"),Object(r.b)("li",{parentName:"ul"},"Repositories -> Read"))))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=bitbucket\n --client-id=\n --client-secret=\n")),Object(r.b)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-team="),". To restrict the access to only these users who has access to one selected repository use ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-repository="),"."),Object(r.b)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new application: ",Object(r.b)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",Object(r.b)("inlineCode",{parentName:"li"},"https:///oauth2/callback")),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),Object(r.b)("li",{parentName:"ol"},"Pass the following options to the proxy:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' --provider="github"\n --redirect-url="https:///oauth2/callback"\n --provider-display-name="Gitea"\n --client-id="< client_id as generated by Gitea >"\n --client-secret="< client_secret as generated by Gitea >"\n --login-url="https://< your gitea host >/login/oauth/authorize"\n --redeem-url="https://< your gitea host >/login/oauth/access_token"\n --validate-url="https://< your gitea host >/api/v1"\n')),Object(r.b)("h2",{id:"email-authentication"},"Email Authentication"),Object(r.b)("p",null,"To authorize by email domain use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),Object(r.b)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),Object(r.b)("p",null,"Follow the examples in the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"}),Object(r.b)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",Object(r.b)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",Object(r.b)("inlineCode",{parentName:"p"},"case")," to\n",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"}),Object(r.b)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",Object(r.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",Object(r.b)("inlineCode",{parentName:"p"},"Provider"),"."))}b.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/a37c03cb.fe04e9e0.js b/a37c03cb.fe04e9e0.js deleted file mode 100644 index b9a06ac4..00000000 --- a/a37c03cb.fe04e9e0.js +++ /dev/null @@ -1 +0,0 @@ -(window.webpackJsonp=window.webpackJsonp||[]).push([[36],{116:function(e,t,n){"use strict";n.d(t,"a",(function(){return u})),n.d(t,"b",(function(){return d}));var r=n(0),o=n.n(r);function a(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function i(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function c(e){for(var t=1;t=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var l=o.a.createContext({}),s=function(e){var t=o.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},u=function(e){var t=s(e.components);return o.a.createElement(l.Provider,{value:t},e.children)},m={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,a=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),u=s(n),b=r,d=u["".concat(i,".").concat(b)]||u[b]||m[b]||a;return n?o.a.createElement(d,c(c({ref:t},l),{},{components:n})):o.a.createElement(d,c({ref:t},l))}));function d(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var a=n.length,i=new Array(a);i[0]=b;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:r,i[1]=c;for(var l=2;l=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var u=o.a.createContext({}),p=function(e){var t=o.a.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},l=function(e){var t=p(e.components);return o.a.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},h=o.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,i=e.originalType,a=e.parentName,u=s(e,["components","mdxType","originalType","parentName"]),l=p(n),h=r,b=l["".concat(a,".").concat(h)]||l[h]||d[h]||i;return n?o.a.createElement(b,c(c({ref:t},u),{},{components:n})):o.a.createElement(b,c({ref:t},u))}));function b(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var i=n.length,a=new Array(i);a[0]=h;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:r,a[1]=c;for(var u=2;u=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var u=o.a.createContext({}),p=function(e){var t=o.a.useContext(u),r=t;return e&&(r="function"==typeof e?e(t):c(c({},t),e)),r},l=function(e){var t=p(e.components);return o.a.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,i=e.originalType,a=e.parentName,u=s(e,["components","mdxType","originalType","parentName"]),l=p(r),b=n,f=l["".concat(a,".").concat(b)]||l[b]||d[b]||i;return r?o.a.createElement(f,c(c({ref:t},u),{},{components:r})):o.a.createElement(f,c({ref:t},u))}));function f(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var i=r.length,a=new Array(i);a[0]=b;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:n,a[1]=c;for(var u=2;u=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var b=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var o=r.a.createContext({}),d=function(e){var t=r.a.useContext(o),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},p=function(e){var t=d(e.components);return r.a.createElement(o.Provider,{value:t},e.children)},O={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},j=r.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,b=e.originalType,l=e.parentName,o=c(e,["components","mdxType","originalType","parentName"]),p=d(a),j=n,s=p["".concat(l,".").concat(j)]||p[j]||O[j]||b;return a?r.a.createElement(s,i(i({ref:t},o),{},{components:a})):r.a.createElement(s,i({ref:t},o))}));function s(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var b=a.length,l=new Array(b);l[0]=j;var i={};for(var c in t)hasOwnProperty.call(t,c)&&(i[c]=t[c]);i.originalType=e,i.mdxType="string"==typeof e?e:n,l[1]=i;for(var o=2;oauth_request directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",children:[]}],p={rightToc:d};function O(e){var t=e.components,a=Object(r.a)(e,["components"]);return Object(b.b)("wrapper",Object(n.a)({},p,a,{components:t,mdxType:"MDXLayout"}),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#command-line-options"}),"command line options"),", ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#environment-variables"}),"environment variables")," or ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file")," (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."),Object(b.b)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),Object(b.b)("p",null,"To generate a strong cookie secret use one of the below commands:"),Object(b.b)(l.a,{defaultValue:"python",values:[{label:"Python",value:"python"},{label:"Bash",value:"bash"},{label:"OpenSSL",value:"openssl"},{label:"PowerShell",value:"powershell"},{label:"Terraform",value:"terraform"}],mdxType:"Tabs"},Object(b.b)(i.a,{value:"python",mdxType:"TabItem"},Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-shell"}),"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'\n"))),Object(b.b)(i.a,{value:"bash",mdxType:"TabItem"},Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-shell"}),"cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1 | base64\n"))),Object(b.b)(i.a,{value:"openssl",mdxType:"TabItem"},Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-shell"}),"openssl rand -base64 32 | tr -- '+/' '-_'\n"))),Object(b.b)(i.a,{value:"powershell",mdxType:"TabItem"},Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-shell"}),'# Add System.Web assembly to session, just in case\nAdd-Type -AssemblyName System.Web\n[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")\n'))),Object(b.b)(i.a,{value:"terraform",mdxType:"TabItem"},Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-shell"}),'# Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret\nresource "random_password" "cookie_secret" {\n length = 32\n override_special = "-_"\n}\n')))),Object(b.b)("h3",{id:"config-file"},"Config File"),Object(b.b)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),Object(b.b)("p",null,"An example ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"}),"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",Object(b.b)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),Object(b.b)("h3",{id:"command-line-options"},"Command Line Options"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Option"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Default"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--acr-values")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"optional, see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"}),"docs")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--approval-prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth approval_prompt"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"force"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log authentication attempts"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for authentication log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate against emails via file (one per line)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--azure-tenant")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"go to a tenant-specific or common (tenant-independent) endpoint."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"common"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--basic-auth-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the password to set when passing the HTTP Basic Auth header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-id")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client ID, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the file with OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--config")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to config file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Optional cookie domains to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-expire")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"expire timeframe for cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"168h0m0s")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-httponly")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HttpOnly cookie flag"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the name of the cookie that the oauth_proxy creates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"an optional cookie path to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"/poc/"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-refresh")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"refresh the cookie after this duration; ",Object(b.b)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote1"}),"1"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the seed string for secure cookies (optionally base64 encoded)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secure")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://owasp.org/www-community/controls/SecureFlag"}),"secure (HTTPS only) cookie flag")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-samesite")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set SameSite cookie attribute (",Object(b.b)("inlineCode",{parentName:"td"},'"lax"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"strict"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"none"'),", or ",Object(b.b)("inlineCode",{parentName:"td"},'""'),")."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--custom-templates-dir")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to custom html templates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"display username / password login form if an htpasswd file is provided"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--email-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate emails with the specified domain (may be given multiple times). Use ",Object(b.b)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--errors-to-info-log")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"redirects error-level logging to default log channel instead of stderr"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"if ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",Object(b.b)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",Object(b.b)("inlineCode",{parentName:"td"},"iss"),", ",Object(b.b)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--exclude-logging-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"comma separated list of paths to exclude from logging, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"/ping,/path2"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--flush-interval")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"period between flushing response buffers when streaming responses"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"1s"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--force-https")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enforce https redirect"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"false"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--banner")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) banner string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--footer")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) footer string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gcp-healthchecks")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will enable ",Object(b.b)("inlineCode",{parentName:"td"},"/liveness_check"),", ",Object(b.b)("inlineCode",{parentName:"td"},"/readiness_check"),", and ",Object(b.b)("inlineCode",{parentName:"td"},"/")," (with the proper user-agent) endpoints that will make it work well with GCP App Engine and GKE Ingresses"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-org")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this organisation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-team")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these teams (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to collaborators of this repository formatted as ",Object(b.b)("inlineCode",{parentName:"td"},"orgname/repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the token to use when verifying repository collaborators (must have push access to the repository)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gitlab-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these groups (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-admin-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the google admin to impersonate for api calls"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this google group (may be given multiple times)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-service-account-json")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the path to the service account json credentials"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--htpasswd-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"additionally authenticate against a htpasswd file. Entries must be created with ",Object(b.b)("inlineCode",{parentName:"td"},"htpasswd -s")," for SHA encryption"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--http-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"[http://]:")," or ",Object(b.b)("inlineCode",{parentName:"td"},"unix://")," to listen on for HTTP clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"127.0.0.1:4180"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--https-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},":")," to listen on for HTTPS clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'":443"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-compress")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Should rotated log files be compressed using gzip"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-filename")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File to log requests to, empty for ",Object(b.b)("inlineCode",{parentName:"td"},"stdout")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (stdout)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-local-time")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Use local time in log files and backup filenames instead of UTC"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true (local time)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-age")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of days to retain old log files"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"7")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-backups")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of old log files to retain; 0 to disable"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-size")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum size in megabytes of the log file before rotation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"100")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"private key in PEM format used to sign JWT, so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},'--jwt-key="${OAUTH2_PROXY_JWT_KEY}"'),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to the private key file in PEM format used to sign the JWT so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem"),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--login-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authentication endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-allow-unverified-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"don't fail if an email address in an id_token is not verified"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-issuer-verification")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-issuer-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OpenID Connect issuer URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://accounts.google.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OIDC JWKS URI for token verification; required if OIDC discovery is disabled"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")," this adds the X-Auth-Request-Access-Token header to the response"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OIDC IDToken to upstream via Authorization Bearer header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prefer-email-to-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-host-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass the request Host Header to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--profile-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Profile access endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"}),"OIDC prompt"),"; if present, ",Object(b.b)("inlineCode",{parentName:"td"},"approval-prompt")," is ignored"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth provider"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"google")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-ca-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-display-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Override the provider's name with the given string; used for the sign-in page"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"(depends on provider)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the ping endpoint that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/ping"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-user-agent")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"a User-Agent that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (don't check user agent)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-prefix")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the url root path that this proxy should be nested under (e.g. /",Object(b.b)("inlineCode",{parentName:"td"},"/sign_in"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/oauth2"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-websockets")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enables WebSocket proxying"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pubjwk-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"JWK pubkey access endpoint: required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Header used to determine the real IP of the client, requires ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"X-Real-IP")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Token redemption endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redirect-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Redirect URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://internalapp.yourcompany.com/oauth2/callback"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis cluster connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"URL of redis server for redis session storage (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis password. Applicable for all Redis configurations. Will override any password set in ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel master name. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis sentinel connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis cluster. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis via sentinels. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for request log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--resource")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The resource that is protected (Azure AD only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--scope")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth scope specification"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-cookie-minimal")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-store-type")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"/oauth2-proxy/docs/6.1.x/configuration/session_storage"}),"Session data storage backend"),"; redis or cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"cookie")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set X-Auth-Request-User, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token"),", X-Auth-Request-Access-Token is added to response headers."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set Authorization Bearer response header (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HTTP Basic Auth information in response (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--signature-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GAP-Signature request signature key (algorithm:secretkey)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--silence-ping-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"disable logging of requests to ping endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-preflight")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip authentication for OPTIONS requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-regex")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass authentication for requests paths that match (may be given multiple times)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-strip-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strips ",Object(b.b)("inlineCode",{parentName:"td"},"X-Forwarded-*")," style authentication headers & ",Object(b.b)("inlineCode",{parentName:"td"},"Authorization")," header if they would be set by oauth2-proxy for request paths in ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-regex")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip requests that have verified JWT bearer tokens (the token must have ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields"}),Object(b.b)("inlineCode",{parentName:"a"},"aud"))," that matches this client id or one of the extras from ",Object(b.b)("inlineCode",{parentName:"td"},"extra-jwt-issuers"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-oidc-discovery")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass OIDC endpoint discovery. ",Object(b.b)("inlineCode",{parentName:"td"},"--login-url"),", ",Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")," must be configured in this case"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-provider-button")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip sign-in-page to directly reach the next step: oauth/start"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS providers"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-upstream-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS upstreams"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log standard runtime information"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for standard log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-cert-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to certificate file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to private key file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--upstream")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the http url(s) of the upstream endpoint, file:// paths for static files or ",Object(b.b)("inlineCode",{parentName:"td"},"static://")," for static response. Routing is based on the path"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--user-id-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which claim contains the user ID"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"[",'"email"',"]")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--validate-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Access token validation endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--version")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"n/a"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"print version string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--whitelist-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allowed domains for redirection after authentication. Prefix domain with a ",Object(b.b)("inlineCode",{parentName:"td"},".")," to allow subdomains (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".example.com"),")","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote2"}),"2"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--trusted-ip")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," and optionally ",Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")," this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))))),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote1"},"1"),"]",": Only these providers support ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-refresh"),": GitLab, Google and OIDC"),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote2"},"2"),"]",": When using the ",Object(b.b)("inlineCode",{parentName:"p"},"whitelist-domain")," option, any domain prefixed with a ",Object(b.b)("inlineCode",{parentName:"p"},".")," will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:8080"),". To allow any port, use ",Object(b.b)("inlineCode",{parentName:"p"},"*"),": ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:*"),"."),Object(b.b)("p",null,"See below for provider specific options"),Object(b.b)("h3",{id:"upstreams-configuration"},"Upstreams Configuration"),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/")," for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/some/path/")," then it will only be requests that start with ",Object(b.b)("inlineCode",{parentName:"p"},"/some/path/")," which are forwarded to the upstream."),Object(b.b)("p",null,"Static file paths are configured as a file:// URL. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/")," will serve the files from that directory at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/var/www/static/"),", which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/#/static/")," will make ",Object(b.b)("inlineCode",{parentName:"p"},"/var/www/static/")," available at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/static/"),"."),Object(b.b)("p",null,"Multiple upstreams can either be configured by supplying a comma separated list to the ",Object(b.b)("inlineCode",{parentName:"p"},"--upstream")," parameter, supplying the parameter multiple times or providing a list in the ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file"),". When multiple upstreams are used routing to them will be based on the path they are set up with."),Object(b.b)("h3",{id:"environment-variables"},"Environment variables"),Object(b.b)("p",null,"Every command line argument can be specified as an environment variable by\nprefixing it with ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_"),", capitalising it, and replacing hyphens (",Object(b.b)("inlineCode",{parentName:"p"},"-"),")\nwith underscores (",Object(b.b)("inlineCode",{parentName:"p"},"_"),"). If the argument can be specified multiple times, the\nenvironment variable should be plural (trailing ",Object(b.b)("inlineCode",{parentName:"p"},"S"),")."),Object(b.b)("p",null,"This is particularly useful for storing secrets outside of a configuration file\nor the command line."),Object(b.b)("p",null,"For example, the ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-secret")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_COOKIE_SECRET"),",\nand the ",Object(b.b)("inlineCode",{parentName:"p"},"--email-domain")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_EMAIL_DOMAINS"),"."),Object(b.b)("h2",{id:"logging-configuration"},"Logging Configuration"),Object(b.b)("p",null,"By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the ",Object(b.b)("inlineCode",{parentName:"p"},"--logging-filename")," command."),Object(b.b)("p",null,"If logging to a file you can also configure the maximum file size (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-size"),"), age (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-age"),"), max backup logs (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-backups"),"), and if backup logs should be compressed (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-compress"),")."),Object(b.b)("p",null,"There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging"),", ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging"),", and ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging"),"."),Object(b.b)("p",null,"Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log."),Object(b.b)("p",null,"Logging of requests to the ",Object(b.b)("inlineCode",{parentName:"p"},"/ping")," endpoint (or using ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-user-agent"),") can be disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--silence-ping-logging")," reducing log volume. This flag appends the ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-path")," to ",Object(b.b)("inlineCode",{parentName:"p"},"--exclude-logging-paths"),"."),Object(b.b)("h3",{id:"auth-log-format"},"Auth Log Format"),Object(b.b)("p",null,"Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{})," - [19/Mar/2015:17:20:19 -0400] [] \n")),Object(b.b)("p",null,"The status block will contain one of the below strings:"),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthSuccess")," If a user has authenticated successfully by any method"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthFailure")," If the user failed to authenticate explicitly"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthError")," If there was an unexpected error during authentication")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for auth logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Status"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"AuthSuccess"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The status of the auth request. See above for details.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authenticated via OAuth2"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the auth attempt.")))),Object(b.b)("h3",{id:"request-log-format"},"Request Log Format"),Object(b.b)("p",null,"HTTP request logs will output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),' - [19/Mar/2015:17:20:19 -0400] GET "/path/" HTTP/1.1 "" \n')),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}\n")),Object(b.b)("p",null,"Available variables for request logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestDuration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0.001"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The time in seconds that a request took to process.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestURI"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),'"/oauth2/auth"'),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The URI path of the request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ResponseSize"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"12"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The size in bytes of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"StatusCode"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"200"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The HTTP status code of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The upstream data of the HTTP request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")))),Object(b.b)("h3",{id:"standard-log-format"},"Standard Log Format"),Object(b.b)("p",null,"All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[19/Mar/2015:17:20:19 -0400] [main.go:40] \n")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging-format")," flag. The default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[{{.Timestamp}}] [{{.File}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for standard logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"main.go:40"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The file and line number of the logging statement.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP: listening on 127.0.0.1:4180"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the log statement.")))),Object(b.b)("h2",{id:"configuring-for-use-with-the-nginx-auth_request-directive"},"Configuring for use with the Nginx ",Object(b.b)("inlineCode",{parentName:"h2"},"auth_request")," directive"),Object(b.b)("p",null,"The ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"http://nginx.org/en/docs/http/ngx_http_auth_request_module.html"}),"Nginx ",Object(b.b)("inlineCode",{parentName:"a"},"auth_request")," directive")," allows Nginx to authenticate requests via the oauth2-proxy's ",Object(b.b)("inlineCode",{parentName:"p"},"/auth")," endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-nginx"}),'server {\n listen 443 ssl;\n server_name ...;\n include ssl/ssl.conf;\n\n location /oauth2/ {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n proxy_set_header X-Auth-Request-Redirect $request_uri;\n # or, if you are handling multiple domains:\n # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;\n }\n location = /oauth2/auth {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n # nginx auth_request includes headers but not body\n proxy_set_header Content-Length "";\n proxy_pass_request_body off;\n }\n\n location / {\n auth_request /oauth2/auth;\n error_page 401 = /oauth2/sign_in;\n\n # pass information via X-User and X-Email headers to backend,\n # requires running with --set-xauthrequest flag\n auth_request_set $user $upstream_http_x_auth_request_user;\n auth_request_set $email $upstream_http_x_auth_request_email;\n proxy_set_header X-User $user;\n proxy_set_header X-Email $email;\n\n # if you enabled --pass-access-token, this will pass the token to the backend\n auth_request_set $token $upstream_http_x_auth_request_access_token;\n proxy_set_header X-Access-Token $token;\n\n # if you enabled --cookie-refresh, this is needed for it to work with auth_request\n auth_request_set $auth_cookie $upstream_http_set_cookie;\n add_header Set-Cookie $auth_cookie;\n\n # When using the --set-authorization-header flag, some provider\'s cookies can exceed the 4kb\n # limit and so the OAuth2 Proxy splits these into multiple parts.\n # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\n # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\n auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;\n\n # Extract the Cookie attributes from the first Set-Cookie header and append them\n # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\n if ($auth_cookie ~* "(; .*)") {\n set $auth_cookie_name_0 $auth_cookie;\n set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";\n }\n\n # Send both Set-Cookie headers now if there was a second part\n if ($auth_cookie_name_upstream_1) {\n add_header Set-Cookie $auth_cookie_name_0;\n add_header Set-Cookie $auth_cookie_name_1;\n }\n\n proxy_pass http://backend/;\n # or "root /path/to/site;" or "fastcgi_pass ..." etc\n }\n}\n')),Object(b.b)("p",null,"When you use ingress-nginx in Kubernetes, you MUST use ",Object(b.b)("inlineCode",{parentName:"p"},"kubernetes/ingress-nginx")," (which includes the Lua module) and the following configuration snippet for your ",Object(b.b)("inlineCode",{parentName:"p"},"Ingress"),".\nVariables set with ",Object(b.b)("inlineCode",{parentName:"p"},"auth_request_set")," are not ",Object(b.b)("inlineCode",{parentName:"p"},"set"),"-able in plain nginx config when the location is processed via ",Object(b.b)("inlineCode",{parentName:"p"},"proxy_pass")," and then may only be processed by Lua.\nNote that ",Object(b.b)("inlineCode",{parentName:"p"},"nginxinc/kubernetes-ingress")," does not include the Lua module."),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'nginx.ingress.kubernetes.io/auth-response-headers: Authorization\nnginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri\nnginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth\nnginx.ingress.kubernetes.io/configuration-snippet: |\n auth_request_set $name_upstream_1 $upstream_cookie_name_1;\n\n access_by_lua_block {\n if ngx.var.name_upstream_1 ~= "" then\n ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")\n end\n }\n')),Object(b.b)("p",null,"It is recommended to use ",Object(b.b)("inlineCode",{parentName:"p"},"--session-store-type=redis")," when expecting large sessions/OIDC tokens (",Object(b.b)("em",{parentName:"p"},"e.g.")," with MS Azure)."),Object(b.b)("p",null,"You have to substitute ",Object(b.b)("em",{parentName:"p"},"name"),' with the actual cookie name you configured via --cookie-name parameter. If you don\'t set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".'),Object(b.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"If you set up your OAuth2 provider to rotate your client secret, you can use the ",Object(b.b)("inlineCode",{parentName:"p"},"client-secret-file")," option to reload the secret when it is updated."))))}O.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/css/styles.19258e03.css b/assets/css/styles.19258e03.css new file mode 100644 index 00000000..00404d15 --- /dev/null +++ b/assets/css/styles.19258e03.css @@ -0,0 +1 @@ +.container,.row .col{padding:0 var(--ifm-spacing-horizontal);width:100%}.row .col,img{max-width:100%}.markdown>h2,.markdown>h3,.markdown>h4,.markdown>h5,.markdown>h6{margin-bottom:calc(var(--ifm-heading-vertical-rhythm-bottom)*var(--ifm-leading))}.markdown li,body{word-wrap:break-word}body,ol ol,ol ul,ul ol,ul ul{margin:0}pre,table{overflow:auto}blockquote,pre{margin:0 0 var(--ifm-spacing-vertical)}.breadcrumbs__link,.button{transition-timing-function:var(--ifm-transition-timing-default)}.button,code{vertical-align:middle}.button--outline.button--active,.button--outline:active,.button--outline:hover,:root{--ifm-button-color:var(--ifm-font-color-base-inverse)}.avatar__photo,.card,.text--truncate{overflow:hidden}.menu__link:hover,a{transition:color var(--ifm-transition-fast) var(--ifm-transition-timing-default)}.navbar__title,.text--truncate{text-overflow:ellipsis;white-space:nowrap}.button,.dropdown__link,.navbar__title,.text--truncate{white-space:nowrap}.navbar--dark,:root{--ifm-navbar-link-hover-color:var(--ifm-color-primary)}.menu,.navbar-sidebar{overflow-x:hidden}:root,html[data-theme=dark]{--ifm-color-emphasis-500:var(--ifm-color-gray-500)}.admonition-icon svg,.alert__icon svg{fill:var(--ifm-alert-foreground-color)}.toggle_Pssr,html{-webkit-tap-highlight-color:transparent}:root{--ifm-color-scheme:light;--ifm-dark-value:10%;--ifm-darker-value:15%;--ifm-darkest-value:30%;--ifm-light-value:15%;--ifm-lighter-value:30%;--ifm-lightest-value:50%;--ifm-contrast-background-value:90%;--ifm-contrast-foreground-value:70%;--ifm-contrast-background-dark-value:70%;--ifm-contrast-foreground-dark-value:90%;--ifm-color-primary:#3578e5;--ifm-color-secondary:#ebedf0;--ifm-color-success:#00a400;--ifm-color-info:#54c7ec;--ifm-color-warning:#ffba00;--ifm-color-danger:#fa383e;--ifm-color-primary-dark:#306cce;--ifm-color-primary-darker:#2d66c3;--ifm-color-primary-darkest:#2554a0;--ifm-color-primary-light:#538ce9;--ifm-color-primary-lighter:#72a1ed;--ifm-color-primary-lightest:#9abcf2;--ifm-color-primary-contrast-background:#ebf2fc;--ifm-color-primary-contrast-foreground:#102445;--ifm-color-secondary-dark:#d4d5d8;--ifm-color-secondary-darker:#c8c9cc;--ifm-color-secondary-darkest:#a4a6a8;--ifm-color-secondary-light:#eef0f2;--ifm-color-secondary-lighter:#f1f2f5;--ifm-color-secondary-lightest:#f5f6f8;--ifm-color-secondary-contrast-background:#fdfdfe;--ifm-color-secondary-contrast-foreground:#474748;--ifm-color-success-dark:#009400;--ifm-color-success-darker:#008b00;--ifm-color-success-darkest:#007300;--ifm-color-success-light:#26b226;--ifm-color-success-lighter:#4dbf4d;--ifm-color-success-lightest:#80d280;--ifm-color-success-contrast-background:#e6f6e6;--ifm-color-success-contrast-foreground:#003100;--ifm-color-info-dark:#4cb3d4;--ifm-color-info-darker:#47a9c9;--ifm-color-info-darkest:#3b8ba5;--ifm-color-info-light:#6ecfef;--ifm-color-info-lighter:#87d8f2;--ifm-color-info-lightest:#aae3f6;--ifm-color-info-contrast-background:#eef9fd;--ifm-color-info-contrast-foreground:#193c47;--ifm-color-warning-dark:#e6a700;--ifm-color-warning-darker:#d99e00;--ifm-color-warning-darkest:#b38200;--ifm-color-warning-light:#ffc426;--ifm-color-warning-lighter:#ffcf4d;--ifm-color-warning-lightest:#ffdd80;--ifm-color-warning-contrast-background:#fff8e6;--ifm-color-warning-contrast-foreground:#4d3800;--ifm-color-danger-dark:#e13238;--ifm-color-danger-darker:#d53035;--ifm-color-danger-darkest:#af272b;--ifm-color-danger-light:#fb565b;--ifm-color-danger-lighter:#fb7478;--ifm-color-danger-lightest:#fd9c9f;--ifm-color-danger-contrast-background:#ffebec;--ifm-color-danger-contrast-foreground:#4b1113;--ifm-color-white:#fff;--ifm-color-black:#000;--ifm-color-gray-0:var(--ifm-color-white);--ifm-color-gray-100:#f5f6f7;--ifm-color-gray-200:#ebedf0;--ifm-color-gray-300:#dadde1;--ifm-color-gray-400:#ccd0d5;--ifm-color-gray-500:#bec3c9;--ifm-color-gray-600:#8d949e;--ifm-color-gray-700:#606770;--ifm-color-gray-800:#444950;--ifm-color-gray-900:#1c1e21;--ifm-color-gray-1000:var(--ifm-color-black);--ifm-color-emphasis-0:var(--ifm-color-gray-0);--ifm-color-emphasis-100:var(--ifm-color-gray-100);--ifm-color-emphasis-200:var(--ifm-color-gray-200);--ifm-color-emphasis-300:var(--ifm-color-gray-300);--ifm-color-emphasis-400:var(--ifm-color-gray-400);--ifm-color-emphasis-600:var(--ifm-color-gray-600);--ifm-color-emphasis-700:var(--ifm-color-gray-700);--ifm-color-emphasis-800:var(--ifm-color-gray-800);--ifm-color-emphasis-900:var(--ifm-color-gray-900);--ifm-color-emphasis-1000:var(--ifm-color-gray-1000);--ifm-color-content:var(--ifm-color-emphasis-900);--ifm-color-content-inverse:var(--ifm-color-emphasis-0);--ifm-color-content-secondary:#525860;--ifm-background-color:transparent;--ifm-background-surface-color:var(--ifm-color-content-inverse);--ifm-global-border-width:1px;--ifm-global-radius:0.4rem;--ifm-hover-overlay:rgba(0,0,0,.05);--ifm-font-color-base:var(--ifm-color-content);--ifm-font-color-base-inverse:var(--ifm-color-content-inverse);--ifm-font-color-secondary:var(--ifm-color-content-secondary);--ifm-font-family-base:system-ui,-apple-system,Segoe UI,Roboto,Ubuntu,Cantarell,Noto Sans,sans-serif,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol";--ifm-font-family-monospace:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",monospace;--ifm-font-size-base:100%;--ifm-font-weight-light:300;--ifm-font-weight-normal:400;--ifm-font-weight-semibold:500;--ifm-font-weight-bold:700;--ifm-font-weight-base:var(--ifm-font-weight-normal);--ifm-line-height-base:1.65;--ifm-global-spacing:1rem;--ifm-spacing-vertical:var(--ifm-global-spacing);--ifm-spacing-horizontal:var(--ifm-global-spacing);--ifm-transition-fast:200ms;--ifm-transition-slow:400ms;--ifm-transition-timing-default:cubic-bezier(0.08,0.52,0.52,1);--ifm-global-shadow-lw:0 1px 2px 0 rgba(0,0,0,.1);--ifm-global-shadow-md:0 5px 40px rgba(0,0,0,.2);--ifm-global-shadow-tl:0 12px 28px 0 rgba(0,0,0,.2),0 2px 4px 0 rgba(0,0,0,.1);--ifm-z-index-dropdown:2;--ifm-z-index-fixed:3;--ifm-z-index-overlay:4;--ifm-container-width:1140px;--ifm-container-width-xl:1320px;--ifm-code-background:#f6f7f8;--ifm-code-border-radius:var(--ifm-global-radius);--ifm-code-font-size:90%;--ifm-code-padding-horizontal:0.1rem;--ifm-code-padding-vertical:0.1rem;--ifm-pre-background:var(--ifm-color-emphasis-100);--ifm-pre-border-radius:var(--ifm-code-border-radius);--ifm-pre-color:inherit;--ifm-pre-line-height:1.45;--ifm-pre-padding:1rem;--ifm-heading-color:inherit;--ifm-heading-margin-top:0;--ifm-heading-margin-bottom:var(--ifm-spacing-vertical);--ifm-heading-font-family:var(--ifm-font-family-base);--ifm-heading-font-weight:var(--ifm-font-weight-bold);--ifm-heading-line-height:1.25;--ifm-h1-font-size:2rem;--ifm-h2-font-size:1.5rem;--ifm-h3-font-size:1.25rem;--ifm-h4-font-size:1rem;--ifm-h5-font-size:0.875rem;--ifm-h6-font-size:0.85rem;--ifm-image-alignment-padding:1.25rem;--ifm-leading-desktop:1.25;--ifm-leading:calc(var(--ifm-leading-desktop)*1rem);--ifm-list-left-padding:2rem;--ifm-list-margin:1rem;--ifm-list-item-margin:0.25rem;--ifm-list-paragraph-margin:1rem;--ifm-table-cell-padding:0.75rem;--ifm-table-background:transparent;--ifm-table-stripe-background:var(--ifm-color-emphasis-100);--ifm-table-border-width:1px;--ifm-table-border-color:var(--ifm-color-emphasis-300);--ifm-table-head-background:inherit;--ifm-table-head-color:inherit;--ifm-table-head-font-weight:var(--ifm-font-weight-bold);--ifm-table-cell-color:inherit;--ifm-link-color:var(--ifm-color-primary);--ifm-link-decoration:none;--ifm-link-hover-color:var(--ifm-link-color);--ifm-link-hover-decoration:underline;--ifm-paragraph-margin-bottom:var(--ifm-leading);--ifm-blockquote-font-size:var(--ifm-font-size-base);--ifm-blockquote-border-left-width:2px;--ifm-blockquote-padding-horizontal:var(--ifm-spacing-horizontal);--ifm-blockquote-padding-vertical:0;--ifm-blockquote-shadow:none;--ifm-blockquote-color:var(--ifm-color-emphasis-800);--ifm-blockquote-border-color:var(--ifm-color-emphasis-300);--ifm-hr-border-color:var(--ifm-color-emphasis-500);--ifm-hr-border-width:1px;--ifm-hr-margin-vertical:1.5rem;--ifm-scrollbar-size:7px;--ifm-scrollbar-track-background-color:#f1f1f1;--ifm-scrollbar-thumb-background-color:silver;--ifm-scrollbar-thumb-hover-background-color:#a7a7a7;--ifm-alert-background-color:inherit;--ifm-alert-border-color:inherit;--ifm-alert-border-radius:var(--ifm-global-radius);--ifm-alert-border-width:0px;--ifm-alert-border-left-width:5px;--ifm-alert-color:var(--ifm-font-color-base);--ifm-alert-padding-horizontal:var(--ifm-spacing-horizontal);--ifm-alert-padding-vertical:var(--ifm-spacing-vertical);--ifm-alert-shadow:var(--ifm-global-shadow-lw);--ifm-avatar-intro-margin:1rem;--ifm-avatar-intro-alignment:inherit;--ifm-avatar-photo-size-sm:2rem;--ifm-avatar-photo-size-md:3rem;--ifm-avatar-photo-size-lg:4rem;--ifm-avatar-photo-size-xl:6rem;--ifm-badge-background-color:inherit;--ifm-badge-border-color:inherit;--ifm-badge-border-radius:var(--ifm-global-radius);--ifm-badge-border-width:var(--ifm-global-border-width);--ifm-badge-color:var(--ifm-color-white);--ifm-badge-padding-horizontal:calc(var(--ifm-spacing-horizontal)*0.5);--ifm-badge-padding-vertical:calc(var(--ifm-spacing-vertical)*0.25);--ifm-breadcrumb-border-radius:1.5rem;--ifm-breadcrumb-spacing:0.0625rem;--ifm-breadcrumb-color-active:var(--ifm-color-primary);--ifm-breadcrumb-item-background-active:var(--ifm-hover-overlay);--ifm-breadcrumb-padding-horizontal:1rem;--ifm-breadcrumb-padding-vertical:0.5rem;--ifm-breadcrumb-size-multiplier:1;--ifm-breadcrumb-separator:url('data:image/svg+xml;utf8,');--ifm-breadcrumb-separator-filter:none;--ifm-breadcrumb-separator-size:0.5rem;--ifm-breadcrumb-separator-size-multiplier:1.25;--ifm-button-background-color:inherit;--ifm-button-border-color:var(--ifm-button-background-color);--ifm-button-border-width:var(--ifm-global-border-width);--ifm-button-font-weight:var(--ifm-font-weight-bold);--ifm-button-padding-horizontal:1.5rem;--ifm-button-padding-vertical:0.375rem;--ifm-button-size-multiplier:1;--ifm-button-transition-duration:var(--ifm-transition-fast);--ifm-button-border-radius:calc(var(--ifm-global-radius)*var(--ifm-button-size-multiplier));--ifm-button-group-margin:2px;--ifm-card-background-color:var(--ifm-background-surface-color);--ifm-card-border-radius:calc(var(--ifm-global-radius)*2);--ifm-card-horizontal-spacing:var(--ifm-global-spacing);--ifm-card-vertical-spacing:var(--ifm-global-spacing);--ifm-toc-border-color:var(--ifm-color-emphasis-300);--ifm-toc-link-color:var(--ifm-color-content-secondary);--ifm-toc-padding-vertical:0.5rem;--ifm-toc-padding-horizontal:0.5rem;--ifm-dropdown-background-color:var(--ifm-background-surface-color);--ifm-dropdown-font-weight:var(--ifm-font-weight-semibold);--ifm-dropdown-link-color:var(--ifm-font-color-base);--ifm-dropdown-hover-background-color:var(--ifm-hover-overlay);--ifm-footer-background-color:var(--ifm-color-emphasis-100);--ifm-footer-color:inherit;--ifm-footer-link-color:var(--ifm-color-emphasis-700);--ifm-footer-link-hover-color:var(--ifm-color-primary);--ifm-footer-link-horizontal-spacing:0.5rem;--ifm-footer-padding-horizontal:calc(var(--ifm-spacing-horizontal)*2);--ifm-footer-padding-vertical:calc(var(--ifm-spacing-vertical)*2);--ifm-footer-title-color:inherit;--ifm-hero-background-color:var(--ifm-background-surface-color);--ifm-hero-text-color:var(--ifm-color-emphasis-800);--ifm-menu-color:var(--ifm-color-emphasis-700);--ifm-menu-color-active:var(--ifm-color-primary);--ifm-menu-color-background-active:var(--ifm-hover-overlay);--ifm-menu-color-background-hover:var(--ifm-hover-overlay);--ifm-menu-link-padding-horizontal:1rem;--ifm-menu-link-padding-vertical:0.375rem;--ifm-menu-link-sublist-icon:url('data:image/svg+xml;utf8,');--ifm-menu-link-sublist-icon-filter:none;--ifm-navbar-background-color:var(--ifm-background-surface-color);--ifm-navbar-height:3.75rem;--ifm-navbar-item-padding-horizontal:0.75rem;--ifm-navbar-item-padding-vertical:0.25rem;--ifm-navbar-link-color:var(--ifm-font-color-base);--ifm-navbar-link-active-color:var(--ifm-link-color);--ifm-navbar-padding-horizontal:var(--ifm-spacing-horizontal);--ifm-navbar-padding-vertical:calc(var(--ifm-spacing-vertical)*0.5);--ifm-navbar-shadow:var(--ifm-global-shadow-lw);--ifm-navbar-search-input-background-color:var(--ifm-color-emphasis-200);--ifm-navbar-search-input-color:var(--ifm-color-emphasis-800);--ifm-navbar-search-input-placeholder-color:var(--ifm-color-emphasis-500);--ifm-navbar-search-input-icon:url('data:image/svg+xml;utf8,');--ifm-navbar-sidebar-width:83vw;--ifm-pagination-border-radius:calc(var(--ifm-global-radius)*var(--ifm-pagination-size-multiplier));--ifm-pagination-color-active:var(--ifm-color-primary);--ifm-pagination-font-size:1rem;--ifm-pagination-item-active-background:var(--ifm-hover-overlay);--ifm-pagination-page-spacing:0.0625rem;--ifm-pagination-padding-horizontal:calc(var(--ifm-spacing-horizontal)*1);--ifm-pagination-padding-vertical:calc(var(--ifm-spacing-vertical)*0.25);--ifm-pagination-size-multiplier:1;--ifm-pagination-nav-border-radius:var(--ifm-global-radius);--ifm-pagination-nav-color-hover:var(--ifm-color-primary);--ifm-pills-color-active:var(--ifm-color-primary);--ifm-pills-color-background-active:var(--ifm-hover-overlay);--ifm-pills-spacing:0.0625rem;--ifm-tabs-color:var(--ifm-font-color-secondary);--ifm-tabs-color-active:var(--ifm-color-primary);--ifm-tabs-color-active-border:var(--ifm-tabs-color-active);--ifm-tabs-padding-horizontal:1rem;--ifm-tabs-padding-vertical:1rem;--ifm-tabs-spacing:0.0625rem;--ifm-color-primary:#25c2a0;--ifm-color-primary-dark:#21af90;--ifm-color-primary-darker:#1fa588;--ifm-color-primary-darkest:#1a8870;--ifm-color-primary-light:#46cbae;--ifm-color-primary-lighter:#66d4bd;--ifm-color-primary-lightest:#92e0d0;--ifm-code-font-size:95%;--docusaurus-announcement-bar-height:auto;--docusaurus-tag-list-border:var(--ifm-color-emphasis-300);--collapse-button-bg-color-dark:#2e333a;--doc-sidebar-width:300px;--doc-sidebar-hidden-width:30px}.badge--danger,.badge--info,.badge--primary,.badge--secondary,.badge--success,.badge--warning{--ifm-badge-border-color:var(--ifm-badge-background-color)}.button--link,.button--outline{--ifm-button-background-color:transparent}*{box-sizing:border-box}html{-webkit-font-smoothing:antialiased;text-rendering:optimizelegibility;-webkit-text-size-adjust:100%;-moz-text-size-adjust:100%;text-size-adjust:100%;background-color:var(--ifm-background-color);color:var(--ifm-font-color-base);color-scheme:var(--ifm-color-scheme);font:var(--ifm-font-size-base)/var(--ifm-line-height-base) var(--ifm-font-family-base)}iframe{border:0;color-scheme:auto}.container{margin:0 auto;max-width:var(--ifm-container-width)}.padding-bottom--none,.padding-vert--none{padding-bottom:0!important}.padding-top--none,.padding-vert--none{padding-top:0!important}.padding-horiz--none,.padding-left--none{padding-left:0!important}.padding-horiz--none,.padding-right--none{padding-right:0!important}.container--fluid{max-width:inherit}.row{display:flex;flex-direction:row;flex-wrap:wrap;margin:0 calc(var(--ifm-spacing-horizontal)*-1)}.margin-bottom--none,.margin-vert--none,.markdown>:last-child{margin-bottom:0!important}.margin-top--none,.margin-vert--none,.tabItem_LplD{margin-top:0!important}.row .col{--ifm-col-width:100%;flex:1 0;margin-left:0}.row .col[class*=col--]{flex:0 0 var(--ifm-col-width);max-width:var(--ifm-col-width)}.row .col.col--1{--ifm-col-width:8.33333%}.row .col.col--offset-1{margin-left:8.33333%}.row .col.col--2{--ifm-col-width:16.66667%}.row .col.col--offset-2{margin-left:16.66667%}.row .col.col--3{--ifm-col-width:25%}.row .col.col--offset-3{margin-left:25%}.row .col.col--4{--ifm-col-width:33.33333%}.row .col.col--offset-4{margin-left:33.33333%}.row .col.col--5{--ifm-col-width:41.66667%}.row .col.col--offset-5{margin-left:41.66667%}.row .col.col--6{--ifm-col-width:50%}.row .col.col--offset-6{margin-left:50%}.row .col.col--7{--ifm-col-width:58.33333%}.row .col.col--offset-7{margin-left:58.33333%}.row .col.col--8{--ifm-col-width:66.66667%}.row .col.col--offset-8{margin-left:66.66667%}.row .col.col--9{--ifm-col-width:75%}.row .col.col--offset-9{margin-left:75%}.row .col.col--10{--ifm-col-width:83.33333%}.row .col.col--offset-10{margin-left:83.33333%}.row .col.col--11{--ifm-col-width:91.66667%}.row .col.col--offset-11{margin-left:91.66667%}.row .col.col--12{--ifm-col-width:100%}.row .col.col--offset-12{margin-left:100%}.row--no-gutters{margin-left:0;margin-right:0}.margin-horiz--none,.margin-left--none{margin-left:0!important}.margin-horiz--none,.margin-right--none{margin-right:0!important}.row--no-gutters>.col{padding-left:0;padding-right:0}.row--align-top{align-items:flex-start}.row--align-bottom{align-items:flex-end}.row--align-center{align-items:center}.row--align-stretch{align-items:stretch}.row--align-baseline{align-items:baseline}.margin--none{margin:0!important}.margin-bottom--xs,.margin-vert--xs{margin-bottom:.25rem!important}.margin-top--xs,.margin-vert--xs{margin-top:.25rem!important}.margin-horiz--xs,.margin-left--xs{margin-left:.25rem!important}.margin-horiz--xs,.margin-right--xs{margin-right:.25rem!important}.margin--xs{margin:.25rem!important}.margin-bottom--sm,.margin-vert--sm{margin-bottom:.5rem!important}.margin-top--sm,.margin-vert--sm{margin-top:.5rem!important}.margin-horiz--sm,.margin-left--sm{margin-left:.5rem!important}.margin-horiz--sm,.margin-right--sm{margin-right:.5rem!important}.margin--sm{margin:.5rem!important}.margin-bottom--md,.margin-vert--md{margin-bottom:1rem!important}.margin-top--md,.margin-vert--md{margin-top:1rem!important}.margin-horiz--md,.margin-left--md{margin-left:1rem!important}.margin-horiz--md,.margin-right--md{margin-right:1rem!important}.margin--md{margin:1rem!important}.margin-bottom--lg,.margin-vert--lg{margin-bottom:2rem!important}.margin-top--lg,.margin-vert--lg{margin-top:2rem!important}.margin-horiz--lg,.margin-left--lg{margin-left:2rem!important}.margin-horiz--lg,.margin-right--lg{margin-right:2rem!important}.margin--lg{margin:2rem!important}.margin-bottom--xl,.margin-vert--xl{margin-bottom:5rem!important}.margin-top--xl,.margin-vert--xl{margin-top:5rem!important}.margin-horiz--xl,.margin-left--xl{margin-left:5rem!important}.margin-horiz--xl,.margin-right--xl{margin-right:5rem!important}.margin--xl{margin:5rem!important}.padding--none{padding:0!important}.padding-bottom--xs,.padding-vert--xs{padding-bottom:.25rem!important}.padding-top--xs,.padding-vert--xs{padding-top:.25rem!important}.padding-horiz--xs,.padding-left--xs{padding-left:.25rem!important}.padding-horiz--xs,.padding-right--xs{padding-right:.25rem!important}.padding--xs{padding:.25rem!important}.padding-bottom--sm,.padding-vert--sm{padding-bottom:.5rem!important}.padding-top--sm,.padding-vert--sm{padding-top:.5rem!important}.padding-horiz--sm,.padding-left--sm{padding-left:.5rem!important}.padding-horiz--sm,.padding-right--sm{padding-right:.5rem!important}.padding--sm{padding:.5rem!important}.padding-bottom--md,.padding-vert--md{padding-bottom:1rem!important}.padding-top--md,.padding-vert--md{padding-top:1rem!important}.padding-horiz--md,.padding-left--md{padding-left:1rem!important}.padding-horiz--md,.padding-right--md{padding-right:1rem!important}.padding--md{padding:1rem!important}.padding-bottom--lg,.padding-vert--lg{padding-bottom:2rem!important}.padding-top--lg,.padding-vert--lg{padding-top:2rem!important}.padding-horiz--lg,.padding-left--lg{padding-left:2rem!important}.padding-horiz--lg,.padding-right--lg{padding-right:2rem!important}.padding--lg{padding:2rem!important}.padding-bottom--xl,.padding-vert--xl{padding-bottom:5rem!important}.padding-top--xl,.padding-vert--xl{padding-top:5rem!important}.padding-horiz--xl,.padding-left--xl{padding-left:5rem!important}.padding-horiz--xl,.padding-right--xl{padding-right:5rem!important}.padding--xl{padding:5rem!important}code{background-color:var(--ifm-code-background);border:.1rem solid rgba(0,0,0,.1);border-radius:var(--ifm-code-border-radius);font-family:var(--ifm-font-family-monospace);font-size:var(--ifm-code-font-size);padding:var(--ifm-code-padding-vertical) var(--ifm-code-padding-horizontal)}a code{color:inherit}pre{background-color:var(--ifm-pre-background);border-radius:var(--ifm-pre-border-radius);color:var(--ifm-pre-color);font:var(--ifm-code-font-size)/var(--ifm-pre-line-height) var(--ifm-font-family-monospace);padding:var(--ifm-pre-padding)}pre code{background-color:transparent;border:none;font-size:100%;line-height:inherit;padding:0}kbd{background-color:var(--ifm-color-emphasis-0);border:1px solid var(--ifm-color-emphasis-400);border-radius:.2rem;box-shadow:inset 0 -1px 0 var(--ifm-color-emphasis-400);color:var(--ifm-color-emphasis-800);font:80% var(--ifm-font-family-monospace);padding:.15rem .3rem}h1,h2,h3,h4,h5,h6{color:var(--ifm-heading-color);font-family:var(--ifm-heading-font-family);font-weight:var(--ifm-heading-font-weight);line-height:var(--ifm-heading-line-height);margin:var(--ifm-heading-margin-top) 0 var(--ifm-heading-margin-bottom) 0}h1{font-size:var(--ifm-h1-font-size)}h2{font-size:var(--ifm-h2-font-size)}h3{font-size:var(--ifm-h3-font-size)}h4{font-size:var(--ifm-h4-font-size)}h5{font-size:var(--ifm-h5-font-size)}h6{font-size:var(--ifm-h6-font-size)}img{height:auto}img[align=right]{padding-left:var(--image-alignment-padding)}img[align=left]{padding-right:var(--image-alignment-padding)}.markdown{--ifm-h1-vertical-rhythm-top:3;--ifm-h2-vertical-rhythm-top:2;--ifm-h3-vertical-rhythm-top:1.5;--ifm-heading-vertical-rhythm-top:1.25;--ifm-h1-vertical-rhythm-bottom:1.25;--ifm-heading-vertical-rhythm-bottom:1}.markdown:after,.markdown:before{content:"";display:table}.markdown:after{clear:both}.markdown h1:first-child{--ifm-h1-font-size:3rem;margin-bottom:calc(var(--ifm-h1-vertical-rhythm-bottom)*var(--ifm-leading))}.markdown>h2{--ifm-h2-font-size:2rem;margin-top:calc(var(--ifm-h2-vertical-rhythm-top)*var(--ifm-leading))}.markdown>h3{--ifm-h3-font-size:1.5rem;margin-top:calc(var(--ifm-h3-vertical-rhythm-top)*var(--ifm-leading))}.markdown>h4,.markdown>h5,.markdown>h6{margin-top:calc(var(--ifm-heading-vertical-rhythm-top)*var(--ifm-leading))}.markdown>p,.markdown>pre,.markdown>ul{margin-bottom:var(--ifm-leading)}.markdown li>p{margin-top:var(--ifm-list-paragraph-margin)}.markdown li+li{margin-top:var(--ifm-list-item-margin)}ol,ul{margin:0 0 var(--ifm-list-margin);padding-left:var(--ifm-list-left-padding)}ol ol,ul ol{list-style-type:lower-roman}ol ol ol,ol ul ol,ul ol ol,ul ul ol{list-style-type:lower-alpha}table{border-collapse:collapse;display:block;margin-bottom:var(--ifm-spacing-vertical)}table thead tr{border-bottom:2px solid var(--ifm-table-border-color)}table tr{background-color:var(--ifm-table-background);border-top:var(--ifm-table-border-width) solid var(--ifm-table-border-color)}table tr:nth-child(2n){background-color:var(--ifm-table-stripe-background)}table td,table th{border:var(--ifm-table-border-width) solid var(--ifm-table-border-color);padding:var(--ifm-table-cell-padding)}table th{background-color:var(--ifm-table-head-background);color:var(--ifm-table-head-color);font-weight:var(--ifm-table-head-font-weight)}table td{color:var(--ifm-table-cell-color)}strong{font-weight:var(--ifm-font-weight-bold)}a{color:var(--ifm-link-color);text-decoration:var(--ifm-link-decoration)}a:hover{color:var(--ifm-link-hover-color);text-decoration:var(--ifm-link-hover-decoration)}.breadcrumbs__link:hover,.button:hover,.text--no-decoration,.text--no-decoration:hover,a:not([href]){text-decoration:none}p{margin:0 0 var(--ifm-paragraph-margin-bottom)}blockquote{border-left-width:0;border:0 solid var(--ifm-blockquote-border-color);border-left:var(--ifm-blockquote-border-left-width) solid var(--ifm-blockquote-border-color);box-shadow:var(--ifm-blockquote-shadow);color:var(--ifm-blockquote-color);font-size:var(--ifm-blockquote-font-size);padding:var(--ifm-blockquote-padding-vertical) var(--ifm-blockquote-padding-horizontal)}blockquote>:first-child{margin-top:0}blockquote>:last-child{margin-bottom:0}hr{border:var(--ifm-hr-border-width) solid var(--ifm-hr-border-color);margin:var(--ifm-hr-margin-vertical) 0}.shadow--lw{box-shadow:var(--ifm-global-shadow-lw)!important}.shadow--md{box-shadow:var(--ifm-global-shadow-md)!important}.shadow--tl{box-shadow:var(--ifm-global-shadow-tl)!important}.text--primary{color:var(--ifm-color-primary)}.text--secondary{color:var(--ifm-color-secondary)}.text--success{color:var(--ifm-color-success)}.text--info{color:var(--ifm-color-info)}.text--warning{color:var(--ifm-color-warning)}.text--danger{color:var(--ifm-color-danger)}.text--center{text-align:center}.text--left{text-align:left}.text--justify{text-align:justify}.text--right{text-align:right}.text--capitalize{text-transform:capitalize}.text--lowercase{text-transform:lowercase}.admonition h5,.alert__heading,.text--uppercase{text-transform:uppercase}.text--light{font-weight:var(--ifm-font-weight-light)}.text--normal{font-weight:var(--ifm-font-weight-normal)}.text--semibold{font-weight:var(--ifm-font-weight-semibold)}.text--bold{font-weight:var(--ifm-font-weight-bold)}.text--italic{font-style:italic}.text--break{word-wrap:break-word!important;word-break:break-word!important}.clean-btn{background:none;border:none;color:inherit;cursor:pointer;font-family:inherit;padding:0}.alert,.alert .close{color:var(--ifm-alert-foreground-color)}.alert--primary{--ifm-alert-background-color:var(--ifm-color-primary-contrast-background);--ifm-alert-background-color-highlight:rgba(53,120,229,.15);--ifm-alert-foreground-color:var(--ifm-color-primary-contrast-foreground);--ifm-alert-border-color:var(--ifm-color-primary-dark)}.alert--secondary{--ifm-alert-background-color:var(--ifm-color-secondary-contrast-background);--ifm-alert-background-color-highlight:rgba(235,237,240,.15);--ifm-alert-foreground-color:var(--ifm-color-secondary-contrast-foreground);--ifm-alert-border-color:var(--ifm-color-secondary-dark)}.alert--success{--ifm-alert-background-color:var(--ifm-color-success-contrast-background);--ifm-alert-background-color-highlight:rgba(0,164,0,.15);--ifm-alert-foreground-color:var(--ifm-color-success-contrast-foreground);--ifm-alert-border-color:var(--ifm-color-success-dark)}.alert--info{--ifm-alert-background-color:var(--ifm-color-info-contrast-background);--ifm-alert-background-color-highlight:rgba(84,199,236,.15);--ifm-alert-foreground-color:var(--ifm-color-info-contrast-foreground);--ifm-alert-border-color:var(--ifm-color-info-dark)}.alert--warning{--ifm-alert-background-color:var(--ifm-color-warning-contrast-background);--ifm-alert-background-color-highlight:rgba(255,186,0,.15);--ifm-alert-foreground-color:var(--ifm-color-warning-contrast-foreground);--ifm-alert-border-color:var(--ifm-color-warning-dark)}.alert--danger{--ifm-alert-background-color:var(--ifm-color-danger-contrast-background);--ifm-alert-background-color-highlight:rgba(250,56,62,.15);--ifm-alert-foreground-color:var(--ifm-color-danger-contrast-foreground);--ifm-alert-border-color:var(--ifm-color-danger-dark)}.alert{--ifm-code-background:var(--ifm-alert-background-color-highlight);--ifm-link-color:var(--ifm-alert-foreground-color);--ifm-link-hover-color:var(--ifm-alert-foreground-color);--ifm-link-decoration:underline;--ifm-tabs-color:var(--ifm-alert-foreground-color);--ifm-tabs-color-active:var(--ifm-alert-foreground-color);--ifm-tabs-color-active-border:var(--ifm-alert-border-color);background-color:var(--ifm-alert-background-color);border-left-width:var(--ifm-alert-border-width);border:var(--ifm-alert-border-width) solid var(--ifm-alert-border-color);border-left:var(--ifm-alert-border-left-width) solid var(--ifm-alert-border-color);border-radius:var(--ifm-alert-border-radius);box-shadow:var(--ifm-alert-shadow);padding:var(--ifm-alert-padding-vertical) var(--ifm-alert-padding-horizontal)}.alert__heading{align-items:center;display:flex;font:700 var(--ifm-h5-font-size)/var(--ifm-heading-line-height) var(--ifm-heading-font-family);margin-bottom:.5rem}.alert__icon{display:inline-flex;margin-right:.4em}.alert__icon svg{stroke:var(--ifm-alert-foreground-color);stroke-width:0}.alert .close{margin:calc(var(--ifm-alert-padding-vertical)*-1) calc(var(--ifm-alert-padding-horizontal)*-1) 0 0;opacity:.75}.alert .close:focus,.alert .close:hover{opacity:1}.alert a{-webkit-text-decoration-color:var(--ifm-alert-border-color);text-decoration-color:var(--ifm-alert-border-color)}.alert a:hover{text-decoration-thickness:2px}.avatar,.navbar,.navbar>.container,.navbar>.container-fluid{display:flex}.avatar__photo-link,.tocCollapsibleContent_MpvI a{display:block}.avatar__photo{border-radius:50%;height:var(--ifm-avatar-photo-size-md);width:var(--ifm-avatar-photo-size-md)}.avatar__photo--sm{height:var(--ifm-avatar-photo-size-sm);width:var(--ifm-avatar-photo-size-sm)}.avatar__photo--lg{height:var(--ifm-avatar-photo-size-lg);width:var(--ifm-avatar-photo-size-lg)}.avatar__photo--xl{height:var(--ifm-avatar-photo-size-xl);width:var(--ifm-avatar-photo-size-xl)}.card--full-height,.navbar__logo img,body,html{height:100%}.avatar__photo+.avatar__intro{margin-left:var(--ifm-avatar-intro-margin)}.avatar__intro{display:flex;flex:1 1;flex-direction:column;justify-content:center;text-align:var(--ifm-avatar-intro-alignment)}.badge,.breadcrumbs__item,.breadcrumbs__link,.button,.dropdown>.navbar__link:after{display:inline-block}.avatar__name{font:700 var(--ifm-h4-font-size)/var(--ifm-heading-line-height) var(--ifm-font-family-base)}.avatar__subtitle{margin-top:.25rem}.avatar--vertical{--ifm-avatar-intro-alignment:center;--ifm-avatar-intro-margin:0.5rem;align-items:center;flex-direction:column}.avatar--vertical .avatar__intro{margin-left:0}.badge{background-color:var(--ifm-badge-background-color);border:var(--ifm-badge-border-width) solid var(--ifm-badge-border-color);border-radius:var(--ifm-badge-border-radius);color:var(--ifm-badge-color);font-size:75%;font-weight:var(--ifm-font-weight-bold);line-height:1;padding:var(--ifm-badge-padding-vertical) var(--ifm-badge-padding-horizontal)}.badge--primary{--ifm-badge-background-color:var(--ifm-color-primary)}.badge--secondary{--ifm-badge-background-color:var(--ifm-color-secondary);color:var(--ifm-color-black)}.breadcrumbs__link,.button.button--secondary.button--outline:not(.button--active):not(:hover){color:var(--ifm-font-color-base)}.badge--success{--ifm-badge-background-color:var(--ifm-color-success)}.badge--info{--ifm-badge-background-color:var(--ifm-color-info)}.badge--warning{--ifm-badge-background-color:var(--ifm-color-warning)}.badge--danger{--ifm-badge-background-color:var(--ifm-color-danger)}.breadcrumbs{margin-bottom:0;padding-left:0}.breadcrumbs__item:not(:first-child){margin-left:var(--ifm-breadcrumb-spacing)}.breadcrumbs__item:not(:last-child){margin-right:var(--ifm-breadcrumb-spacing)}.breadcrumbs__item:not(:last-child):after{background:var(--ifm-breadcrumb-separator) center;content:" ";display:inline-block;-webkit-filter:var(--ifm-breadcrumb-separator-filter);filter:var(--ifm-breadcrumb-separator-filter);height:calc(var(--ifm-breadcrumb-separator-size)*var(--ifm-breadcrumb-size-multiplier)*var(--ifm-breadcrumb-separator-size-multiplier));margin:0 .5rem;opacity:.5;width:calc(var(--ifm-breadcrumb-separator-size)*var(--ifm-breadcrumb-size-multiplier)*var(--ifm-breadcrumb-separator-size-multiplier))}.breadcrumbs__item--active .breadcrumbs__link{color:var(--ifm-breadcrumb-color-active)}.breadcrumbs__item--active .breadcrumbs__link,.breadcrumbs__item:not(.breadcrumbs__item--active):hover .breadcrumbs__link{background:var(--ifm-breadcrumb-item-background-active)}.breadcrumbs__link{border-radius:var(--ifm-breadcrumb-border-radius);font-size:calc(1rem*var(--ifm-breadcrumb-size-multiplier));padding:calc(var(--ifm-breadcrumb-padding-vertical)*var(--ifm-breadcrumb-size-multiplier)) calc(var(--ifm-breadcrumb-padding-horizontal)*var(--ifm-breadcrumb-size-multiplier));transition-duration:var(--ifm-transition-fast);transition-property:background,color}.breadcrumbs--sm{--ifm-breadcrumb-size-multiplier:0.8}.breadcrumbs--lg{--ifm-breadcrumb-size-multiplier:1.2}.button{background-color:var(--ifm-button-background-color);border:var(--ifm-button-border-width) solid var(--ifm-button-border-color);border-radius:var(--ifm-button-border-radius);cursor:pointer;font-size:calc(.875rem*var(--ifm-button-size-multiplier));font-weight:var(--ifm-button-font-weight);line-height:1.5;padding:calc(var(--ifm-button-padding-vertical)*var(--ifm-button-size-multiplier)) calc(var(--ifm-button-padding-horizontal)*var(--ifm-button-size-multiplier));text-align:center;transition-duration:var(--ifm-button-transition-duration);transition-property:color,background,border-color;-webkit-user-select:none;-ms-user-select:none;user-select:none}.copyButton_wuS7,.toggle_Pssr{-webkit-user-select:none;-ms-user-select:none}.button,.button:hover{color:var(--ifm-button-color)}.button--outline{--ifm-button-color:var(--ifm-button-border-color)}.button--outline:hover{--ifm-button-background-color:var(--ifm-button-border-color)}.button--link{--ifm-button-border-color:transparent;color:var(--ifm-link-color);text-decoration:var(--ifm-link-decoration)}.button--link.button--active,.button--link:active,.button--link:hover{color:var(--ifm-link-hover-color);text-decoration:var(--ifm-link-hover-decoration)}.button.disabled,.button:disabled,.button[disabled]{opacity:.65;pointer-events:none}.button--sm{--ifm-button-size-multiplier:0.8}.button--lg{--ifm-button-size-multiplier:1.35}.button--block{display:block;width:100%}.button.button--secondary{color:var(--ifm-color-gray-900)}.button--primary{--ifm-button-border-color:var(--ifm-color-primary)}.button--primary:not(.button--outline){--ifm-button-background-color:var(--ifm-color-primary)}.button--primary:not(.button--outline):hover{--ifm-button-background-color:var(--ifm-color-primary-dark);--ifm-button-border-color:var(--ifm-color-primary-dark)}.button--primary.button--active,.button--primary:active{--ifm-button-border-color:var(--ifm-color-primary-darker);--ifm-button-background-color:var(--ifm-color-primary-darker);background-color:var(--ifm-color-primary-darker);border-color:var(--ifm-color-primary-darker)}.button--secondary{--ifm-button-border-color:var(--ifm-color-secondary)}.button--secondary:not(.button--outline){--ifm-button-background-color:var(--ifm-color-secondary)}.button--secondary:not(.button--outline):hover{--ifm-button-background-color:var(--ifm-color-secondary-dark);--ifm-button-border-color:var(--ifm-color-secondary-dark)}.button--secondary.button--active,.button--secondary:active{--ifm-button-border-color:var(--ifm-color-secondary-darker);--ifm-button-background-color:var(--ifm-color-secondary-darker);background-color:var(--ifm-color-secondary-darker);border-color:var(--ifm-color-secondary-darker)}.button--success{--ifm-button-border-color:var(--ifm-color-success)}.button--success:not(.button--outline){--ifm-button-background-color:var(--ifm-color-success)}.button--success:not(.button--outline):hover{--ifm-button-background-color:var(--ifm-color-success-dark);--ifm-button-border-color:var(--ifm-color-success-dark)}.button--success.button--active,.button--success:active{--ifm-button-border-color:var(--ifm-color-success-darker);--ifm-button-background-color:var(--ifm-color-success-darker);background-color:var(--ifm-color-success-darker);border-color:var(--ifm-color-success-darker)}.button--info{--ifm-button-border-color:var(--ifm-color-info)}.button--info:not(.button--outline){--ifm-button-background-color:var(--ifm-color-info)}.button--info:not(.button--outline):hover{--ifm-button-background-color:var(--ifm-color-info-dark);--ifm-button-border-color:var(--ifm-color-info-dark)}.button--info.button--active,.button--info:active{--ifm-button-border-color:var(--ifm-color-info-darker);--ifm-button-background-color:var(--ifm-color-info-darker);background-color:var(--ifm-color-info-darker);border-color:var(--ifm-color-info-darker)}.button--warning{--ifm-button-border-color:var(--ifm-color-warning)}.button--warning:not(.button--outline){--ifm-button-background-color:var(--ifm-color-warning)}.button--warning:not(.button--outline):hover{--ifm-button-background-color:var(--ifm-color-warning-dark);--ifm-button-border-color:var(--ifm-color-warning-dark)}.button--warning.button--active,.button--warning:active{--ifm-button-border-color:var(--ifm-color-warning-darker);--ifm-button-background-color:var(--ifm-color-warning-darker);background-color:var(--ifm-color-warning-darker);border-color:var(--ifm-color-warning-darker)}.button--danger{--ifm-button-border-color:var(--ifm-color-danger)}.button--danger:not(.button--outline){--ifm-button-background-color:var(--ifm-color-danger)}.button--danger:not(.button--outline):hover{--ifm-button-background-color:var(--ifm-color-danger-dark);--ifm-button-border-color:var(--ifm-color-danger-dark)}.button--danger.button--active,.button--danger:active{--ifm-button-border-color:var(--ifm-color-danger-darker);--ifm-button-background-color:var(--ifm-color-danger-darker);background-color:var(--ifm-color-danger-darker);border-color:var(--ifm-color-danger-darker)}.button-group{display:inline-flex}.button-group>.button:not(:first-child){border-bottom-left-radius:0;border-top-left-radius:0;margin-left:var(--ifm-button-group-margin)}.button-group>.button:not(:last-child){border-bottom-right-radius:0;border-top-right-radius:0}.button-group>.button--active{z-index:1}.button-group--block{display:flex;justify-content:stretch}.button-group--block>.button{flex-grow:1}.card{background-color:var(--ifm-card-background-color);border-radius:var(--ifm-card-border-radius);box-shadow:var(--ifm-global-shadow-lw);display:flex;flex-direction:column}.card__image{padding-top:var(--ifm-card-vertical-spacing)}.card__image:first-child{padding-top:0}.card__body,.card__footer,.card__header{padding:var(--ifm-card-vertical-spacing) var(--ifm-card-horizontal-spacing)}.card__body:not(:last-child),.card__footer:not(:last-child),.card__header:not(:last-child){padding-bottom:0}.admonition-content>:last-child,.card__body>:last-child,.card__footer>:last-child,.card__header>:last-child{margin-bottom:0}.card__footer{margin-top:auto}.table-of-contents{font-size:.8rem;margin-bottom:0;padding:var(--ifm-toc-padding-vertical) 0}.table-of-contents,.table-of-contents ul{list-style:none;padding-left:var(--ifm-toc-padding-horizontal)}.table-of-contents li{margin:var(--ifm-toc-padding-vertical) var(--ifm-toc-padding-horizontal)}.table-of-contents__left-border{border-left:1px solid var(--ifm-toc-border-color)}.table-of-contents__link{color:var(--ifm-toc-link-color)}.table-of-contents__link--active,.table-of-contents__link--active code,.table-of-contents__link:hover,.table-of-contents__link:hover code{color:var(--ifm-color-primary);text-decoration:none}.close{color:var(--ifm-color-black);float:right;font-size:1.5rem;font-weight:var(--ifm-font-weight-bold);line-height:1;opacity:.5;padding:1rem;transition:opacity var(--ifm-transition-fast) var(--ifm-transition-timing-default)}.close:hover{opacity:.7}.close:focus{opacity:.8}.dropdown{display:inline-flex;font-weight:var(--ifm-dropdown-font-weight);position:relative;vertical-align:top}.dropdown--hoverable:hover .dropdown__menu,.dropdown--show .dropdown__menu{opacity:1;-webkit-transform:translateY(0);transform:translateY(0);visibility:visible}.dropdown--right .dropdown__menu{left:inherit;right:0}.dropdown--nocaret .navbar__link:after{content:none!important}.dropdown__menu{background-color:var(--ifm-dropdown-background-color);border-radius:var(--ifm-global-radius);box-shadow:var(--ifm-global-shadow-md);left:0;list-style:none;max-height:80vh;min-width:10rem;opacity:0;overflow-y:auto;padding:.5rem;position:absolute;top:calc(100% - var(--ifm-navbar-item-padding-vertical) + .3rem);-webkit-transform:translateY(-.625rem);transform:translateY(-.625rem);transition-duration:var(--ifm-transition-fast);transition-property:opacity,transform,visibility,-webkit-transform;transition-timing-function:var(--ifm-transition-timing-default);visibility:hidden;z-index:var(--ifm-z-index-dropdown)}.menu__caret,.menu__link,.menu__list-item-collapsible{border-radius:.25rem;transition:background var(--ifm-transition-fast) var(--ifm-transition-timing-default)}.dropdown__link{border-radius:.25rem;color:var(--ifm-dropdown-link-color);display:block;font-size:.875rem;margin-top:.2rem;padding:.25rem .5rem}.dropdown__link--active,.dropdown__link:hover{background-color:var(--ifm-dropdown-hover-background-color);color:var(--ifm-dropdown-link-color);text-decoration:none}.dropdown__link--active,.dropdown__link--active:hover{--ifm-dropdown-link-color:var(--ifm-link-color)}.dropdown>.navbar__link:after{border-color:currentcolor transparent;border-style:solid;border-width:.4em .4em 0;content:"";margin-left:.3em;position:relative;top:2px;-webkit-transform:translateY(-50%);transform:translateY(-50%)}.footer{background-color:var(--ifm-footer-background-color);color:var(--ifm-footer-color);padding:var(--ifm-footer-padding-vertical) var(--ifm-footer-padding-horizontal)}.footer--dark{--ifm-footer-background-color:#303846;--ifm-footer-color:var(--ifm-footer-link-color);--ifm-footer-link-color:var(--ifm-color-secondary);--ifm-footer-title-color:var(--ifm-color-white)}.footer__links{margin-bottom:1rem}.footer__link-item{color:var(--ifm-footer-link-color);line-height:2}.footer__link-item:hover{color:var(--ifm-footer-link-hover-color)}.footer__link-separator{margin:0 var(--ifm-footer-link-horizontal-spacing)}.footer__logo{margin-top:1rem;max-width:10rem}.footer__title{color:var(--ifm-footer-title-color);font:700 var(--ifm-h4-font-size)/var(--ifm-heading-line-height) var(--ifm-font-family-base);margin-bottom:var(--ifm-heading-margin-bottom)}.menu,.navbar__link{font-weight:var(--ifm-font-weight-semibold)}.footer__item{margin-top:0}.footer__items{list-style:none;margin-bottom:0;padding-left:0}[type=checkbox]{padding:0}.hero{align-items:center;background-color:var(--ifm-hero-background-color);color:var(--ifm-hero-text-color);display:flex;padding:4rem 2rem}.hero--primary{--ifm-hero-background-color:var(--ifm-color-primary);--ifm-hero-text-color:var(--ifm-font-color-base-inverse)}.hero--dark{--ifm-hero-background-color:#303846;--ifm-hero-text-color:var(--ifm-color-white)}.hero__title{font-size:3rem}.hero__subtitle{font-size:1.5rem}.menu__list{list-style:none;margin:0;padding-left:0}.menu__caret,.menu__link{padding:var(--ifm-menu-link-padding-vertical) var(--ifm-menu-link-padding-horizontal)}.menu__list .menu__list{flex:0 0 100%;margin-top:.25rem;padding-left:var(--ifm-menu-link-padding-horizontal)}.menu__list-item:not(:first-child){margin-top:.25rem}.menu__list-item--collapsed .menu__list{height:0;overflow:hidden}.menu__caret:before,.menu__link--sublist:after{-webkit-filter:var(--ifm-menu-link-sublist-icon-filter);height:1.25rem;width:1.25rem;content:""}.details_lb9f[data-collapsed=false].isBrowser_bmU9>summary:before,.details_lb9f[open]:not(.isBrowser_bmU9)>summary:before,.menu__list-item--collapsed .menu__caret:before,.menu__list-item--collapsed .menu__link--sublist:after{-webkit-transform:rotate(90deg);transform:rotate(90deg)}.menu__list-item-collapsible{display:flex;flex-wrap:wrap;position:relative}.menu__caret:hover,.menu__link:hover,.menu__list-item-collapsible--active,.menu__list-item-collapsible:hover{background:var(--ifm-menu-color-background-hover)}.menu__list-item-collapsible .menu__link--active,.menu__list-item-collapsible .menu__link:hover{background:none!important}.menu__caret,.menu__link{display:flex}.menu__link{color:var(--ifm-menu-color);flex:1;justify-content:space-between;line-height:1.25}.menu__link:hover{color:var(--ifm-menu-color);text-decoration:none}.menu__link--sublist:after{background:var(--ifm-menu-link-sublist-icon) 50%/2rem 2rem;filter:var(--ifm-menu-link-sublist-icon-filter);min-width:1.25rem;-webkit-transform:rotate(180deg);transform:rotate(180deg);transition:-webkit-transform var(--ifm-transition-fast) linear;transition:transform var(--ifm-transition-fast) linear;transition:transform var(--ifm-transition-fast) linear,-webkit-transform var(--ifm-transition-fast) linear}.menu__link--active,.menu__link--active:hover{color:var(--ifm-menu-color-active)}.navbar__brand,.navbar__link{color:var(--ifm-navbar-link-color)}.menu__link--active:not(.menu__link--sublist){background:var(--ifm-menu-color-background-active)}.menu__caret{margin-left:.1rem}.menu__caret:before{background:var(--ifm-menu-link-sublist-icon) 50%/2rem 2rem;filter:var(--ifm-menu-link-sublist-icon-filter);-webkit-transform:rotate(180deg);transform:rotate(180deg);transition:-webkit-transform var(--ifm-transition-fast) linear;transition:transform var(--ifm-transition-fast) linear;transition:transform var(--ifm-transition-fast) linear,-webkit-transform var(--ifm-transition-fast) linear}.navbar--dark,html[data-theme=dark]{--ifm-menu-link-sublist-icon-filter:invert(100%) sepia(94%) saturate(17%) hue-rotate(223deg) brightness(104%) contrast(98%)}.navbar{background-color:var(--ifm-navbar-background-color);box-shadow:var(--ifm-navbar-shadow);height:var(--ifm-navbar-height);padding:var(--ifm-navbar-padding-vertical) var(--ifm-navbar-padding-horizontal)}.navbar--fixed-top{position:-webkit-sticky;position:sticky;top:0;z-index:var(--ifm-z-index-fixed)}.navbar-sidebar,.navbar-sidebar__backdrop{bottom:0;opacity:0;position:fixed;transition-timing-function:ease-in-out;visibility:hidden;top:0;left:0}.navbar__inner{display:flex;flex-wrap:wrap;justify-content:space-between;width:100%}.navbar__brand{align-items:center;display:flex;margin-right:1rem;min-width:0}.navbar__brand:hover{color:var(--ifm-navbar-link-hover-color);text-decoration:none}.navbar__title{flex:1 1 auto;overflow:hidden}.navbar__toggle{display:none;margin-right:.5rem}.navbar__logo{flex:0 0 auto;height:2rem;margin-right:.5rem}.navbar__items{align-items:center;display:flex;flex:1;min-width:0}.navbar__items--center{flex:0 0 auto}.navbar__items--center .navbar__brand{margin:0}.navbar__items--center+.navbar__items--right{flex:1}.navbar__items--right{flex:0 0 auto;justify-content:flex-end}.navbar__items--right>:last-child{padding-right:0}.navbar__item{display:inline-block;padding:var(--ifm-navbar-item-padding-vertical) var(--ifm-navbar-item-padding-horizontal)}#nprogress,.navbar__item.dropdown .navbar__link:not([href]){pointer-events:none}.navbar__link--active,.navbar__link:hover{color:var(--ifm-navbar-link-hover-color);text-decoration:none}.navbar--dark,.navbar--primary{--ifm-menu-color:var(--ifm-color-gray-300);--ifm-navbar-link-color:var(--ifm-color-gray-100);--ifm-navbar-search-input-background-color:hsla(0,0%,100%,.1);--ifm-navbar-search-input-placeholder-color:hsla(0,0%,100%,.5);color:var(--ifm-color-white)}.navbar--dark{--ifm-navbar-background-color:#242526;--ifm-menu-color-background-active:hsla(0,0%,100%,.05);--ifm-navbar-search-input-color:var(--ifm-color-white)}.navbar--primary{--ifm-navbar-background-color:var(--ifm-color-primary);--ifm-navbar-link-hover-color:var(--ifm-color-white);--ifm-menu-color-active:var(--ifm-color-white);--ifm-navbar-search-input-color:var(--ifm-color-emphasis-500)}.navbar__search-input{-webkit-appearance:none;appearance:none;background:var(--ifm-navbar-search-input-background-color) var(--ifm-navbar-search-input-icon) no-repeat .75rem center/1rem 1rem;border:none;border-radius:2rem;color:var(--ifm-navbar-search-input-color);cursor:text;display:inline-block;font-size:.9rem;height:2rem;padding:0 .5rem 0 2.25rem;width:12.5rem}.navbar__search-input:-ms-input-placeholder{color:var(--ifm-navbar-search-input-placeholder-color)}.navbar__search-input::-webkit-input-placeholder{color:var(--ifm-navbar-search-input-placeholder-color)}.navbar__search-input::placeholder{color:var(--ifm-navbar-search-input-placeholder-color)}.navbar-sidebar{background-color:var(--ifm-navbar-background-color);box-shadow:var(--ifm-global-shadow-md);-webkit-transform:translate3d(-100%,0,0);transform:translate3d(-100%,0,0);transition-duration:.25s;transition-property:opacity,visibility,transform,-webkit-transform;width:var(--ifm-navbar-sidebar-width)}.navbar-sidebar--show .navbar-sidebar,.navbar-sidebar--show .navbar-sidebar__backdrop{opacity:1;visibility:visible}.navbar-sidebar--show .navbar-sidebar{-webkit-transform:translateZ(0);transform:translateZ(0)}.navbar-sidebar__backdrop{background-color:rgba(0,0,0,.6);right:0;transition-duration:.1s;transition-property:opacity,visibility}.navbar-sidebar__brand{align-items:center;box-shadow:var(--ifm-navbar-shadow);display:flex;flex:1;height:var(--ifm-navbar-height);padding:var(--ifm-navbar-padding-vertical) var(--ifm-navbar-padding-horizontal)}.navbar-sidebar__items{display:flex;height:calc(100% - var(--ifm-navbar-height));-webkit-transform:translateZ(0);transform:translateZ(0);transition:-webkit-transform var(--ifm-transition-fast) ease-in-out;transition:transform var(--ifm-transition-fast) ease-in-out;transition:transform var(--ifm-transition-fast) ease-in-out,-webkit-transform var(--ifm-transition-fast) ease-in-out}.navbar-sidebar__items--show-secondary{-webkit-transform:translate3d(calc((var(--ifm-navbar-sidebar-width))*-1),0,0);transform:translate3d(calc((var(--ifm-navbar-sidebar-width))*-1),0,0)}.navbar-sidebar__item{flex-shrink:0;padding:.5rem;width:calc(var(--ifm-navbar-sidebar-width))}.navbar-sidebar__back{background:var(--ifm-menu-color-background-active);font-size:15px;font-weight:var(--ifm-button-font-weight);margin:0 0 .2rem -.5rem;padding:.6rem 1.5rem;position:relative;text-align:left;top:-.5rem;width:calc(100% + 1rem)}.navbar-sidebar__close{display:flex;margin-left:auto}.pagination__item,.pagination__link{display:inline-block}.pagination{font-size:var(--ifm-pagination-font-size);padding-left:0}.pagination--sm{--ifm-pagination-font-size:0.8rem;--ifm-pagination-padding-horizontal:0.8rem;--ifm-pagination-padding-vertical:0.2rem}.pagination--lg{--ifm-pagination-font-size:1.2rem;--ifm-pagination-padding-horizontal:1.2rem;--ifm-pagination-padding-vertical:0.3rem}.pagination__item:not(:first-child){margin-left:var(--ifm-pagination-page-spacing)}.pagination__item:not(:last-child){margin-right:var(--ifm-pagination-page-spacing)}.pagination__item>span{padding:var(--ifm-pagination-padding-vertical)}.pagination__item--active .pagination__link{color:var(--ifm-pagination-color-active)}.pagination__item--active .pagination__link,.pagination__item:not(.pagination__item--active):hover .pagination__link{background:var(--ifm-pagination-item-active-background)}.pagination__item--disabled,.pagination__item[disabled]{opacity:.25;pointer-events:none}.pagination__link{border-radius:var(--ifm-pagination-border-radius);color:var(--ifm-font-color-base);padding:var(--ifm-pagination-padding-vertical) var(--ifm-pagination-padding-horizontal);transition:background var(--ifm-transition-fast) var(--ifm-transition-timing-default)}.pagination__link:hover{text-decoration:none}.docs-wrapper,.pagination-nav{display:flex}.pagination-nav__item{display:flex;flex:1 50%;max-width:50%}.pagination-nav__item--next{text-align:right}.pagination-nav__item+.pagination-nav__item{margin-left:var(--ifm-spacing-horizontal)}.pagination-nav__link{border:1px solid var(--ifm-color-emphasis-300);border-radius:var(--ifm-pagination-nav-border-radius);flex-grow:1;line-height:var(--ifm-heading-line-height);padding:var(--ifm-global-spacing);transition:border-color var(--ifm-transition-fast) var(--ifm-transition-timing-default)}.pagination-nav__link:hover{border-color:var(--ifm-pagination-nav-color-hover);text-decoration:none}.pagination-nav__label{font-size:var(--ifm-h4-font-size);font-weight:var(--ifm-heading-font-weight);word-break:break-word}.pagination-nav__item:first-child .pagination-nav__label:before{content:"« "}.pagination-nav__item--next .pagination-nav__label:after{content:" »"}.pagination-nav__sublabel{color:var(--ifm-color-content-secondary);font-size:var(--ifm-h5-font-size);font-weight:var(--ifm-font-weight-semibold);margin-bottom:.25rem}.pills,.sidebarMenuCloseIcon_uo5v,.tabs{font-weight:var(--ifm-font-weight-bold)}.pills{padding-left:0}.pills__item{border-radius:.5rem;cursor:pointer;display:inline-block;padding:.25rem 1rem;transition:background var(--ifm-transition-fast) var(--ifm-transition-timing-default)}.pills__item--active{background:var(--ifm-pills-color-background-active);color:var(--ifm-pills-color-active)}.pills__item:not(.pills__item--active):hover{background-color:var(--ifm-pills-color-background-active)}.pills__item:not(:first-child){margin-left:var(--ifm-pills-spacing)}.pills__item:not(:last-child){margin-right:var(--ifm-pills-spacing)}.docItemContainer_vinB article>:first-child,.docItemContainer_vinB header+*,.pills__item+.pills__item{margin-top:0}.pills--block{display:flex;justify-content:stretch}.pills--block .pills__item{flex-grow:1;text-align:center}.tabs{color:var(--ifm-tabs-color);display:flex;margin-bottom:0;overflow-x:auto;padding-left:0}.tabs__item{border-bottom:3px solid transparent;border-radius:var(--ifm-global-radius);cursor:pointer;display:inline-flex;padding:var(--ifm-tabs-padding-vertical) var(--ifm-tabs-padding-horizontal);transition:background-color var(--ifm-transition-fast) var(--ifm-transition-timing-default)}.tabs__item--active{border-bottom-color:var(--ifm-tabs-color-active-border);border-bottom-left-radius:0;border-bottom-right-radius:0;color:var(--ifm-tabs-color-active)}.tabs__item:hover{background-color:var(--ifm-hover-overlay)}.tabs--block{justify-content:stretch}.tabs--block .tabs__item{flex-grow:1;justify-content:center}html[data-theme=dark]{--ifm-color-scheme:dark;--ifm-color-emphasis-0:var(--ifm-color-gray-1000);--ifm-color-emphasis-100:var(--ifm-color-gray-900);--ifm-color-emphasis-200:var(--ifm-color-gray-800);--ifm-color-emphasis-300:var(--ifm-color-gray-700);--ifm-color-emphasis-400:var(--ifm-color-gray-600);--ifm-color-emphasis-600:var(--ifm-color-gray-400);--ifm-color-emphasis-700:var(--ifm-color-gray-300);--ifm-color-emphasis-800:var(--ifm-color-gray-200);--ifm-color-emphasis-900:var(--ifm-color-gray-100);--ifm-color-emphasis-1000:var(--ifm-color-gray-0);--ifm-background-color:#18191a;--ifm-background-surface-color:#242526;--ifm-hover-overlay:hsla(0,0%,100%,.05);--ifm-color-content-secondary:#fff;--ifm-breadcrumb-separator-filter:invert(64%) sepia(11%) saturate(0%) hue-rotate(149deg) brightness(99%) contrast(95%);--ifm-code-background:#333437;--ifm-scrollbar-track-background-color:#444;--ifm-scrollbar-thumb-background-color:#686868;--ifm-scrollbar-thumb-hover-background-color:#7a7a7a;--ifm-color-primary-contrast-background:#102445;--ifm-color-primary-contrast-foreground:#ebf2fc;--ifm-color-secondary-contrast-background:#474748;--ifm-color-secondary-contrast-foreground:#fdfdfe;--ifm-color-success-contrast-background:#003100;--ifm-color-success-contrast-foreground:#e6f6e6;--ifm-color-info-contrast-background:#193c47;--ifm-color-info-contrast-foreground:#eef9fd;--ifm-color-warning-contrast-background:#4d3800;--ifm-color-warning-contrast-foreground:#fff8e6;--ifm-color-danger-contrast-background:#4b1113;--ifm-color-danger-contrast-foreground:#ffebec}.admonition h5{margin-bottom:8px;margin-top:0}.admonition-icon{display:inline-block;margin-right:.4em;vertical-align:middle}.admonition-icon svg{stroke-width:0;stroke:var(--ifm-alert-foreground-color);display:inline-block;height:22px;width:22px}.admonition{margin-bottom:1em}.docusaurus-highlight-code-line{background-color:#484d5b;display:block;margin:0 calc(var(--ifm-pre-padding)*-1);padding:0 var(--ifm-pre-padding)}#nprogress .bar{background:#29d;height:2px;left:0;position:fixed;top:0;width:100%;z-index:5}#nprogress .peg{box-shadow:0 0 10px #29d,0 0 5px #29d;height:100%;opacity:1;position:absolute;right:0;-webkit-transform:rotate(3deg) translateY(-4px);transform:rotate(3deg) translateY(-4px);width:100px}#docusaurus-base-url-issue-banner-container{display:none}.details_lb9f{--docusaurus-details-summary-arrow-size:0.38rem;--docusaurus-details-transition:transform 200ms ease;--docusaurus-details-decoration-color:grey}.details_lb9f>summary{cursor:pointer;list-style:none;padding-left:1rem;position:relative}.details_lb9f>summary::-webkit-details-marker{display:none}.details_lb9f>summary:before{border:var(--docusaurus-details-summary-arrow-size) solid transparent;border-left:var(--docusaurus-details-summary-arrow-size) solid var(--docusaurus-details-decoration-color);content:"";left:0;position:absolute;top:.45rem;-webkit-transform:rotate(0);transform:rotate(0);-webkit-transform-origin:calc(var(--docusaurus-details-summary-arrow-size)/2) 50%;transform-origin:calc(var(--docusaurus-details-summary-arrow-size)/2) 50%;transition:var(--docusaurus-details-transition)}.collapsibleContent_i85q{border-top:1px solid var(--docusaurus-details-decoration-color);margin-top:1rem;padding-top:1rem}body:not(.navigation-with-keyboard) :not(input):focus{outline:0}.skipToContent_ZgBM{background-color:var(--ifm-background-surface-color);color:var(--ifm-color-emphasis-900);left:100%;padding:calc(var(--ifm-global-spacing)/2) var(--ifm-global-spacing);position:fixed;top:1rem;z-index:calc(var(--ifm-z-index-fixed) + 1)}.skipToContent_ZgBM:focus{box-shadow:var(--ifm-global-shadow-md);left:1rem}.announcementBar_IbjG{align-items:center;background-color:var(--ifm-color-white);border-bottom:1px solid var(--ifm-color-emphasis-100);color:var(--ifm-color-black);display:flex;height:var(--docusaurus-announcement-bar-height)}.collapseSidebarButton_cwdi,.docSidebarContainer_rKC_,.sidebarLogo_FJUI,.themedImage_W2Cr,html[data-announcement-bar-initially-dismissed=true] .announcementBar_IbjG{display:none}.announcementBarPlaceholder_NC_W{flex:0 0 10px}.announcementBarClose_FG1z{align-self:stretch;flex:0 0 30px;line-height:0;padding:0}.announcementBarContent_KsVm{flex:1 1 auto;font-size:85%;padding:5px 0;text-align:center}.announcementBarContent_KsVm a{color:inherit;text-decoration:underline}.toggle_Pssr{cursor:pointer;position:relative;touch-action:pan-x;user-select:none}.toggleScreenReader_JnkT{clip:rect(0 0 0 0);border:0;height:1px;margin:-1px;overflow:hidden;position:absolute;width:1px}.toggleDisabled_jDku{cursor:not-allowed}.toggleTrack_SSoT{background-color:#4d4d4d;border-radius:30px;height:24px;transition:.2s;width:50px}.toggleTrackCheck_XobZ,.toggleTrackX_YkSC{bottom:0;height:10px;margin:auto 0;top:0;position:absolute}.toggleTrackCheck_XobZ{left:8px;opacity:0;transition:opacity .25s;width:14px}.toggleChecked_cnQY .toggleTrackCheck_XobZ,.toggleTrackX_YkSC,[data-theme=dark] .toggle_Pssr .toggleTrackCheck_XobZ{opacity:1;transition:opacity .25s}.toggleTrackX_YkSC{right:10px;width:10px}.toggleChecked_cnQY .toggleTrackX_YkSC,[data-theme=dark] .toggle_Pssr .toggleTrackX_YkSC{opacity:0}.toggleTrackThumb_uRm4{background-color:#fafafa;border:1px solid #4d4d4d;border-radius:50%;height:22px;left:1px;position:absolute;top:1px;transition:.25s;width:22px}.toggleFocused_A7DC .toggleTrackThumb_uRm4,.toggle_Pssr:hover .toggleTrackThumb_uRm4{box-shadow:0 0 2px 3px var(--ifm-color-primary)}.toggleChecked_cnQY .toggleTrackThumb_uRm4,[data-theme=dark] .toggle_Pssr .toggleTrackThumb_uRm4{left:27px}.toggle_Pssr:active:not(.toggleDisabled_jDku) .toggleTrackThumb_uRm4{box-shadow:0 0 5px 5px var(--ifm-color-primary)}.toggleIcon_eZtF{align-items:center;display:flex;height:10px;justify-content:center;width:10px}.iconExternalLink_I5OW{margin-left:.3rem;position:relative;top:1px}.iconLanguage_dNtB{margin-right:5px;vertical-align:text-bottom}html[data-theme=dark] .themedImage--dark_oUvU,html[data-theme=light] .themedImage--light_TfLj{display:initial}.navbarHideable_aKYr{transition:-webkit-transform var(--ifm-transition-fast) ease;transition:transform var(--ifm-transition-fast) ease;transition:transform var(--ifm-transition-fast) ease,-webkit-transform var(--ifm-transition-fast) ease}.navbarHidden_KUhG{-webkit-transform:translate3d(0,calc(-100% - 2px),0);transform:translate3d(0,calc(-100% - 2px),0)}.navbarSidebarToggle_nL8I{margin-right:1rem}.footerLogoLink_RC3H{opacity:.5;transition:opacity var(--ifm-transition-fast) var(--ifm-transition-timing-default)}.codeBlockContent_wNvx:hover>.copyButton_wuS7,.codeBlockTitle_BvAR:hover+.codeBlockContent_wNvx .copyButton_wuS7,.copyButton_wuS7:focus,.footerLogoLink_RC3H:hover,.hash-link:focus,:hover>.hash-link{opacity:1}#__docusaurus{display:flex;flex-direction:column;min-height:100%}.main-wrapper{flex:1 0 auto}.docusaurus-mt-lg{margin-top:3rem}.iconEdit_dcUD{margin-right:.3em;vertical-align:sub}.tag_hD8n{border:1px solid var(--docusaurus-tag-list-border);transition:border var(--ifm-transition-fast)}.tag_hD8n:hover{--docusaurus-tag-list-border:var(--ifm-link-color);text-decoration:none}.tagRegular_D6E_{border-radius:.5rem;font-size:90%;padding:.3rem .5rem}.tagWithCount_i0QQ{align-items:center;border-left:0;display:flex;padding:0 .5rem 0 1rem;position:relative}.tagWithCount_i0QQ:after,.tagWithCount_i0QQ:before{border:1px solid var(--docusaurus-tag-list-border);content:"";position:absolute;top:50%;transition:inherit}.tagWithCount_i0QQ:before{border-bottom:0;border-right:0;height:1.18rem;right:100%;-webkit-transform:translate(50%,-50%) rotate(-45deg);transform:translate(50%,-50%) rotate(-45deg);width:1.18rem}.tagWithCount_i0QQ:after{border-radius:50%;height:.5rem;left:0;-webkit-transform:translateY(-50%);transform:translateY(-50%);width:.5rem}.tagWithCount_i0QQ span{background:var(--ifm-color-secondary);border-radius:var(--ifm-global-radius);color:var(--ifm-color-black);font-size:.7rem;line-height:1.2;margin-left:.3rem;padding:.1rem .4rem}.tags_XVD_{display:inline}.tag_JSN8{display:inline-block;margin:0 .4rem .5rem 0}.lastUpdated_foO9{font-size:smaller;font-style:italic;margin-top:.2rem}.sidebarMenuIcon_LfgG{vertical-align:middle}.sidebarMenuCloseIcon_uo5v{align-items:center;display:inline-flex;font-size:1.5rem;height:24px;justify-content:center;line-height:.9;width:24px}.codeBlockContainer_I0IT{border-radius:var(--ifm-global-radius);box-shadow:var(--ifm-global-shadow-lw);margin-bottom:var(--ifm-leading)}.codeBlockContent_wNvx{direction:ltr;position:relative}.codeBlockTitle_BvAR{border-bottom:1px solid var(--ifm-color-emphasis-300);border-top-left-radius:var(--ifm-global-radius);border-top-right-radius:var(--ifm-global-radius);font-size:var(--ifm-code-font-size);font-weight:500;padding:.75rem var(--ifm-pre-padding)}.codeBlockStandalone_csWH,.codeBlock_jd64{padding:0;border-radius:var(--ifm-global-radius)}.codeBlock_jd64{margin:0}.codeBlockTitle_BvAR+.codeBlockContent_wNvx .codeBlock_jd64{border-top-left-radius:0;border-top-right-radius:0}.copyButton_wuS7{background:rgba(0,0,0,.3);border-radius:var(--ifm-global-radius);color:var(--ifm-color-white);opacity:0;padding:.4rem .5rem;position:absolute;right:calc(var(--ifm-pre-padding)/2);top:calc(var(--ifm-pre-padding)/2);transition:opacity .2s ease-in-out;user-select:none}.codeBlockLines_mRuA{float:left;font:inherit;min-width:100%;padding:var(--ifm-pre-padding)}.hash-link{opacity:0;padding-left:.5rem;transition:opacity var(--ifm-transition-fast);-webkit-user-select:none;-ms-user-select:none;user-select:none}.hash-link:before{content:"#"}.anchorWithStickyNavbar_mojV{scroll-margin-top:calc(var(--ifm-navbar-height) + .5rem)}.anchorWithHideOnScrollNavbar_R0VQ{scroll-margin-top:.5rem}.details_BAp3{--docusaurus-details-decoration-color:var(--ifm-alert-border-color);--docusaurus-details-transition:transform var(--ifm-transition-fast) ease;border:1px solid var(--ifm-alert-border-color);margin:0 0 var(--ifm-spacing-vertical)}ul.contains-task-list{list-style:none;padding-left:0}.tableOfContents_cNA8{max-height:calc(100vh - var(--ifm-navbar-height) - 2rem);overflow-y:auto;position:-webkit-sticky;position:sticky;top:calc(var(--ifm-navbar-height) + 1rem)}.tocCollapsible_jdIR{background-color:var(--ifm-menu-color-background-active);border-radius:var(--ifm-global-radius);margin:1rem 0}.tocCollapsibleButton_Fzxq{align-items:center;display:flex;font-size:inherit;justify-content:space-between;padding:.4rem .8rem;width:100%}.tocCollapsibleButton_Fzxq:after{background:var(--ifm-menu-link-sublist-icon) 50% 50%/2rem 2rem no-repeat;content:"";-webkit-filter:var(--ifm-menu-link-sublist-icon-filter);filter:var(--ifm-menu-link-sublist-icon-filter);height:1.25rem;-webkit-transform:rotate(180deg);transform:rotate(180deg);transition:-webkit-transform var(--ifm-transition-fast);transition:transform var(--ifm-transition-fast);transition:transform var(--ifm-transition-fast),-webkit-transform var(--ifm-transition-fast);width:1.25rem}.tocCollapsibleContent_MpvI>ul{border-left:none;border-top:1px solid var(--ifm-color-emphasis-300);font-size:15px;padding:.2rem 0}.tocCollapsibleContent_MpvI ul li{margin:.4rem .8rem}.tocCollapsibleExpanded_laf4 .tocCollapsibleButton_Fzxq:after{-webkit-transform:none;transform:none}.backToTopButton_RiI4{background-color:var(--ifm-color-emphasis-200);border-radius:50%;bottom:1.3rem;box-shadow:var(--ifm-global-shadow-lw);height:3rem;opacity:0;position:fixed;right:1.3rem;-webkit-transform:scale(0);transform:scale(0);transition:all var(--ifm-transition-fast) var(--ifm-transition-timing-default);width:3rem;z-index:var(--ifm-z-index-fixed)}.backToTopButton_RiI4:after{background-color:var(--ifm-color-emphasis-1000);content:" ";display:inline-block;height:100%;-webkit-mask:var(--ifm-menu-link-sublist-icon) 50%/2rem 2rem no-repeat;mask:var(--ifm-menu-link-sublist-icon) 50%/2rem 2rem no-repeat;width:100%}.backToTopButtonShow_ssHd{opacity:1;-webkit-transform:scale(1);transform:scale(1)}.docMainContainer_TCnq,.docPage_P2Lg{display:flex;width:100%}.mdxPageWrapper_zHyg{justify-content:center}@media (min-width:997px){:root{--docusaurus-announcement-bar-height:30px}.announcementBarClose_FG1z,.announcementBarPlaceholder_NC_W{flex-basis:50px}.lastUpdated_foO9{text-align:right}.menuLinkText_QVir{cursor:auto}.menuLinkText_QVir:hover{background:none}.menuLinkText_QVir.hasHref_VCh3{cursor:pointer}.sidebar_CW9Y{display:flex;flex-direction:column;height:100%;max-height:100vh;padding-top:var(--ifm-navbar-height);position:-webkit-sticky;position:sticky;top:0;transition:opacity 50ms;width:var(--doc-sidebar-width)}.sidebarWithHideableNavbar_FoYL{padding-top:0}.sidebarHidden_D64r{height:0;opacity:0;overflow:hidden;visibility:hidden}.sidebarLogo_FJUI{align-items:center;color:inherit!important;display:flex!important;margin:0 var(--ifm-navbar-padding-horizontal);max-height:var(--ifm-navbar-height);min-height:var(--ifm-navbar-height);text-decoration:none!important}.sidebarLogo_FJUI img{height:2rem;margin-right:.5rem}.menu_SkdO{flex-grow:1;padding:.5rem}.menuWithAnnouncementBar_x19h{margin-bottom:var(--docusaurus-announcement-bar-height)}.collapseSidebarButton_cwdi{background-color:var(--ifm-button-background-color);border:1px solid var(--ifm-toc-border-color);border-radius:0;bottom:0;display:block!important;height:40px;position:-webkit-sticky;position:sticky}.collapseSidebarButtonIcon_xORG{margin-top:4px;-webkit-transform:rotate(180deg);transform:rotate(180deg)}.expandSidebarButtonIcon_AV8S,html[dir=rtl] .collapseSidebarButtonIcon_xORG{-webkit-transform:rotate(0);transform:rotate(0)}html[data-theme=dark] .collapseSidebarButton_cwdi,html[data-theme=dark] .collapsedDocSidebar_Xgr6:focus,html[data-theme=dark] .collapsedDocSidebar_Xgr6:hover{background-color:var(--collapse-button-bg-color-dark)}.collapsedDocSidebar_Xgr6:focus,.collapsedDocSidebar_Xgr6:hover,html[data-theme=dark] .collapseSidebarButton_cwdi:focus,html[data-theme=dark] .collapseSidebarButton_cwdi:hover{background-color:var(--ifm-color-emphasis-200)}.docItemCol_DM6M{max-width:75%!important}.tocMobile_TmEX{display:none}.docMainContainer_TCnq{flex-grow:1;max-width:calc(100% - var(--doc-sidebar-width))}.docMainContainerEnhanced_WDCb{max-width:calc(100% - var(--doc-sidebar-hidden-width))}.docSidebarContainer_rKC_{border-right:1px solid var(--ifm-toc-border-color);-webkit-clip-path:inset(0);clip-path:inset(0);display:block;margin-top:calc(var(--ifm-navbar-height)*-1);transition:width var(--ifm-transition-fast) ease;width:var(--doc-sidebar-width);will-change:width}.docSidebarContainerHidden_nvlY{cursor:pointer;width:var(--doc-sidebar-hidden-width)}.collapsedDocSidebar_Xgr6{align-items:center;display:flex;height:100%;justify-content:center;max-height:100vh;position:-webkit-sticky;position:sticky;top:0;transition:background-color var(--ifm-transition-fast) ease}html[dir=rtl] .expandSidebarButtonIcon_AV8S{-webkit-transform:rotate(180deg);transform:rotate(180deg)}.docItemWrapperEnhanced_r_WG{max-width:calc(var(--ifm-container-width) + var(--doc-sidebar-width))!important}}@media (min-width:1440px){.container{max-width:var(--ifm-container-width-xl)}}@media (max-width:996px){.row .col.col.col{--ifm-col-width:100%;flex-basis:var(--ifm-col-width);margin-left:0}.footer{--ifm-footer-padding-horizontal:0}.footer__link-separator,.navbar__item,.tableOfContents_cNA8,.toggle_TdHA{display:none}.footer__col{margin-bottom:calc(var(--ifm-spacing-vertical)*3)}.footer__link-item{display:block}.hero{padding-left:0;padding-right:0}.navbar>.container,.navbar>.container-fluid{padding:0}.navbar__toggle{display:inherit}.navbar__search-input{width:9rem}.pills--block,.tabs--block{flex-direction:column}.pills--block .pills__item:not(:first-child){margin-top:var(--ifm-pills-spacing)}.pills--block .pills__item:not(:last-child){margin-bottom:var(--ifm-pills-spacing)}.tabs--block .tabs__item:not(:first-child){margin-top:var(--ifm-tabs-spacing)}.tabs--block .tabs__item:not(:last-child){margin-bottom:var(--ifm-tabs-spacing)}.docItemContainer_WX_Y{padding:0 .3rem}}@media (hover:hover){.backToTopButton_RiI4:hover{background-color:var(--ifm-color-emphasis-300)}}@media (pointer:fine){.thin-scrollbar{scrollbar-width:thin}.thin-scrollbar::-webkit-scrollbar{height:var(--ifm-scrollbar-size);width:var(--ifm-scrollbar-size)}.thin-scrollbar::-webkit-scrollbar-track{background:var(--ifm-scrollbar-track-background-color);border-radius:10px}.thin-scrollbar::-webkit-scrollbar-thumb{background:var(--ifm-scrollbar-thumb-background-color);border-radius:10px}.thin-scrollbar::-webkit-scrollbar-thumb:hover{background:var(--ifm-scrollbar-thumb-hover-background-color)}}@media print{.announcementBar_IbjG,.footer,.menu,.navbar,.pagination-nav,.table-of-contents{display:none}.tabs{page-break-inside:avoid}.codeBlockLines_mRuA{white-space:pre-wrap}} \ No newline at end of file diff --git a/assets/js/001ca130.df12b21c.js b/assets/js/001ca130.df12b21c.js new file mode 100644 index 00000000..b8503685 --- /dev/null +++ b/assets/js/001ca130.df12b21c.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[4431],{3905:function(e,t,n){n.d(t,{Zo:function(){return l},kt:function(){return h}});var r=n(7294);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function i(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function a(e){for(var t=1;t=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var u=r.createContext({}),p=function(e){var t=r.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):a(a({},t),e)),n},l=function(e){var t=p(e.components);return r.createElement(u.Provider,{value:t},e.children)},c={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},d=r.forwardRef((function(e,t){var n=e.components,o=e.mdxType,i=e.originalType,u=e.parentName,l=s(e,["components","mdxType","originalType","parentName"]),d=p(n),h=o,f=d["".concat(u,".").concat(h)]||d[h]||c[h]||i;return n?r.createElement(f,a(a({ref:t},l),{},{components:n})):r.createElement(f,a({ref:t},l))}));function h(e,t){var n=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var i=n.length,a=new Array(i);a[0]=d;var s={};for(var u in t)hasOwnProperty.call(t,u)&&(s[u]=t[u]);s.originalType=e,s.mdxType="string"==typeof e?e:o,a[1]=s;for(var p=2;p=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var l=r.createContext({}),c=function(e){var t=r.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):i(i({},t),e)),n},u=function(e){var t=c(e.components);return r.createElement(l.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},m=r.forwardRef((function(e,t){var n=e.components,o=e.mdxType,a=e.originalType,l=e.parentName,u=p(e,["components","mdxType","originalType","parentName"]),m=c(n),d=o,f=m["".concat(l,".").concat(d)]||m[d]||s[d]||a;return n?r.createElement(f,i(i({ref:t},u),{},{components:n})):r.createElement(f,i({ref:t},u))}));function d(e,t){var n=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var a=n.length,i=new Array(a);i[0]=m;var p={};for(var l in t)hasOwnProperty.call(t,l)&&(p[l]=t[l]);p.originalType=e,p.mdxType="string"==typeof e?e:o,i[1]=p;for(var c=2;c=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var p=n.createContext({}),u=function(e){var t=n.useContext(p),r=t;return e&&(r="function"==typeof e?e(t):i(i({},t),e)),r},c=function(e){var t=u(e.components);return n.createElement(p.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return n.createElement(n.Fragment,{},t)}},d=n.forwardRef((function(e,t){var r=e.components,o=e.mdxType,a=e.originalType,p=e.parentName,c=l(e,["components","mdxType","originalType","parentName"]),d=u(r),f=o,m=d["".concat(p,".").concat(f)]||d[f]||s[f]||a;return r?n.createElement(m,i(i({ref:t},c),{},{components:r})):n.createElement(m,i({ref:t},c))}));function f(e,t){var r=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var a=r.length,i=new Array(a);i[0]=d;var l={};for(var p in t)hasOwnProperty.call(t,p)&&(l[p]=t[p]);l.originalType=e,l.mdxType="string"==typeof e?e:o,i[1]=l;for(var u=2;u&1 | grep OK\noauth2-proxy-x.y.z.linux-amd64: OK\n")),(0,a.kt)("ol",{start:2},(0,a.kt)("li",{parentName:"ol"},(0,a.kt)("a",{parentName:"li",href:"/oauth2-proxy/docs/7.0.x/configuration/oauth_provider"},"Select a Provider and Register an OAuth Application with a Provider")),(0,a.kt)("li",{parentName:"ol"},(0,a.kt)("a",{parentName:"li",href:"/oauth2-proxy/docs/7.0.x/configuration/overview"},"Configure OAuth2 Proxy using config file, command line options, or environment variables")),(0,a.kt)("li",{parentName:"ol"},(0,a.kt)("a",{parentName:"li",href:"/oauth2-proxy/docs/7.0.x/configuration/tls"},"Configure SSL or Deploy behind a SSL endpoint")," (example provided for Nginx)")))}d.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/js/0f425520.1fb0ef81.js b/assets/js/0f425520.1fb0ef81.js new file mode 100644 index 00000000..5bf0dd79 --- /dev/null +++ b/assets/js/0f425520.1fb0ef81.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[7240],{3905:function(t,e,n){n.d(e,{Zo:function(){return s},kt:function(){return k}});var a=n(7294);function r(t,e,n){return e in t?Object.defineProperty(t,e,{value:n,enumerable:!0,configurable:!0,writable:!0}):t[e]=n,t}function l(t,e){var n=Object.keys(t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(t);e&&(a=a.filter((function(e){return Object.getOwnPropertyDescriptor(t,e).enumerable}))),n.push.apply(n,a)}return n}function i(t){for(var e=1;e=0||(r[n]=t[n]);return r}(t,e);if(Object.getOwnPropertySymbols){var l=Object.getOwnPropertySymbols(t);for(a=0;a=0||Object.prototype.propertyIsEnumerable.call(t,n)&&(r[n]=t[n])}return r}var d=a.createContext({}),p=function(t){var e=a.useContext(d),n=e;return t&&(n="function"==typeof t?t(e):i(i({},e),t)),n},s=function(t){var e=p(t.components);return a.createElement(d.Provider,{value:e},t.children)},u={inlineCode:"code",wrapper:function(t){var e=t.children;return a.createElement(a.Fragment,{},e)}},m=a.forwardRef((function(t,e){var n=t.components,r=t.mdxType,l=t.originalType,d=t.parentName,s=o(t,["components","mdxType","originalType","parentName"]),m=p(n),k=r,g=m["".concat(d,".").concat(k)]||m[k]||u[k]||l;return n?a.createElement(g,i(i({ref:e},s),{},{components:n})):a.createElement(g,i({ref:e},s))}));function k(t,e){var n=arguments,r=e&&e.mdxType;if("string"==typeof t||r){var l=n.length,i=new Array(l);i[0]=m;var o={};for(var d in e)hasOwnProperty.call(e,d)&&(o[d]=e[d]);o.originalType=t,o.mdxType="string"==typeof t?t:r,i[1]=o;for(var p=2;p child <"+("string"==typeof t.type?t.type:t.type.name)+'>: all children of the component should be , and every should have a unique "value" prop.')})),h=null!=m?m:N.map((function(t){var e=t.props;return{value:e.value,label:e.label,attributes:e.attributes}})),c=(0,i.lx)(h,(function(t,e){return t.value===e.value}));if(c.length>0)throw new Error('Docusaurus error: Duplicate values "'+c.map((function(t){return t.value})).join(", ")+'" found in . Every value needs to be unique.');var f=null===u?u:null!=(e=null!=u?u:null==(n=N.find((function(t){return t.props.default})))?void 0:n.props.value)?e:null==(l=N[0])?void 0:l.props.value;if(null!==f&&!h.some((function(t){return t.value===f})))throw new Error('Docusaurus error: The has a defaultValue "'+f+'" but none of its children has the corresponding value. Available values are: '+h.map((function(t){return t.value})).join(", ")+". If you intend to show no default tab, use defaultValue={null} instead.");var b=(0,i.UB)(),y=b.tabGroupChoices,v=b.setTabGroupChoices,C=(0,r.useState)(f),w=C[0],_=C[1],x=[],T=(0,i.o5)().blockElementScrollPositionUntilNextRender;if(null!=k){var q=y[k];null!=q&&q!==w&&h.some((function(t){return t.value===q}))&&_(q)}var A=function(t){var e=t.currentTarget,n=x.indexOf(e),a=h[n].value;a!==w&&(T(e),_(a),null!=k&&v(k,a))},R=function(t){var e,n=null;switch(t.key){case"ArrowRight":var a=x.indexOf(t.currentTarget)+1;n=x[a]||x[0];break;case"ArrowLeft":var r=x.indexOf(t.currentTarget)-1;n=x[r]||x[x.length-1]}null==(e=n)||e.focus()};return r.createElement("div",{className:"tabs-container"},r.createElement("ul",{role:"tablist","aria-orientation":"horizontal",className:(0,o.Z)("tabs",{"tabs--block":s},g)},h.map((function(t){var e=t.value,n=t.label,l=t.attributes;return r.createElement("li",(0,a.Z)({role:"tab",tabIndex:w===e?0:-1,"aria-selected":w===e,key:e,ref:function(t){return x.push(t)},onKeyDown:R,onFocus:A,onClick:A},l,{className:(0,o.Z)("tabs__item",d,null==l?void 0:l.className,{"tabs__item--active":w===e})}),null!=n?n:e)}))),p?(0,r.cloneElement)(N.filter((function(t){return t.props.value===w}))[0],{className:"margin-vert--md"}):r.createElement("div",{className:"margin-vert--md"},N.map((function(t,e){return(0,r.cloneElement)(t,{key:e,hidden:t.props.value!==w})}))))}function s(t){var e=(0,l.Z)();return r.createElement(p,(0,a.Z)({key:String(e)},t))}},4826:function(t,e,n){n.r(e),n.d(e,{frontMatter:function(){return p},contentTitle:function(){return s},metadata:function(){return u},toc:function(){return m},default:function(){return g}});var a=n(7462),r=n(3366),l=(n(7294),n(3905)),i=n(9877),o=n(8215),d=["components"],p={id:"overview",title:"Overview"},s=void 0,u={unversionedId:"configuration/overview",id:"configuration/overview",title:"Overview",description:"oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings).",source:"@site/docs/configuration/overview.md",sourceDirName:"configuration",slug:"/configuration/overview",permalink:"/oauth2-proxy/docs/next/configuration/overview",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/overview.md",tags:[],version:"current",frontMatter:{id:"overview",title:"Overview"},sidebar:"docs",previous:{title:"Behaviour",permalink:"/oauth2-proxy/docs/next/behaviour"},next:{title:"OAuth Provider Configuration",permalink:"/oauth2-proxy/docs/next/configuration/oauth_provider"}},m=[{value:"Generating a Cookie Secret",id:"generating-a-cookie-secret",children:[],level:3},{value:"Config File",id:"config-file",children:[],level:3},{value:"Command Line Options",id:"command-line-options",children:[],level:3},{value:"Upstreams Configuration",id:"upstreams-configuration",children:[],level:3},{value:"Environment variables",id:"environment-variables",children:[],level:3},{value:"Logging Configuration",id:"logging-configuration",children:[{value:"Auth Log Format",id:"auth-log-format",children:[],level:3},{value:"Request Log Format",id:"request-log-format",children:[],level:3},{value:"Standard Log Format",id:"standard-log-format",children:[],level:3}],level:2},{value:"Configuring for use with the Nginx auth_request directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",children:[],level:2},{value:"Configuring for use with the Traefik (v2) ForwardAuth middleware",id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware",children:[{value:"ForwardAuth with 401 errors middleware",id:"forwardauth-with-401-errors-middleware",children:[],level:3},{value:"ForwardAuth with static upstreams configuration",id:"forwardauth-with-static-upstreams-configuration",children:[],level:3}],level:2}],k={toc:m};function g(t){var e=t.components,n=(0,r.Z)(t,d);return(0,l.kt)("wrapper",(0,a.Z)({},k,n,{components:e,mdxType:"MDXLayout"}),(0,l.kt)("p",null,(0,l.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",(0,l.kt)("a",{parentName:"p",href:"#command-line-options"},"command line options"),", ",(0,l.kt)("a",{parentName:"p",href:"#environment-variables"},"environment variables")," or ",(0,l.kt)("a",{parentName:"p",href:"#config-file"},"config file")," (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."),(0,l.kt)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),(0,l.kt)("p",null,"To generate a strong cookie secret use one of the below commands:"),(0,l.kt)(i.Z,{defaultValue:"python",values:[{label:"Python",value:"python"},{label:"Bash",value:"bash"},{label:"OpenSSL",value:"openssl"},{label:"PowerShell",value:"powershell"},{label:"Terraform",value:"terraform"}],mdxType:"Tabs"},(0,l.kt)(o.Z,{value:"python",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'\n"))),(0,l.kt)(o.Z,{value:"bash",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\\n' | tr -- '+/' '-_'; echo\n"))),(0,l.kt)(o.Z,{value:"openssl",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"openssl rand -base64 32 | tr -- '+/' '-_'\n"))),(0,l.kt)(o.Z,{value:"powershell",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},'# Add System.Web assembly to session, just in case\nAdd-Type -AssemblyName System.Web\n[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")\n'))),(0,l.kt)(o.Z,{value:"terraform",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},'# Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret\nresource "random_password" "cookie_secret" {\n length = 32\n override_special = "-_"\n}\n')))),(0,l.kt)("h3",{id:"config-file"},"Config File"),(0,l.kt)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),(0,l.kt)("p",null,"An example ",(0,l.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"},"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",(0,l.kt)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),(0,l.kt)("h3",{id:"command-line-options"},"Command Line Options"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Option"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"),(0,l.kt)("th",{parentName:"tr",align:null},"Default"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--acr-values")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"optional, see ",(0,l.kt)("a",{parentName:"td",href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"},"docs")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--approval-prompt")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth approval_prompt"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"force"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log authentication attempts"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for authentication log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate against emails via file (one per line)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--azure-tenant")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"go to a tenant-specific or common (tenant-independent) endpoint."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"common"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--basic-auth-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the password to set when passing the HTTP Basic Auth header"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-id")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client ID, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the file with OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--config")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to config file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Optional cookie domains to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-expire")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"expire timeframe for cookie"),(0,l.kt)("td",{parentName:"tr",align:null},"168h0m0s")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-httponly")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set HttpOnly cookie flag"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the name of the cookie that the oauth_proxy creates"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"an optional cookie path to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"/poc/"),")"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-refresh")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"refresh the cookie after this duration; ",(0,l.kt)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",(0,l.kt)("a",{parentName:"td",href:"#footnote1"},"1"),"]"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the seed string for secure cookies (optionally base64 encoded)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secure")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set ",(0,l.kt)("a",{parentName:"td",href:"https://owasp.org/www-community/controls/SecureFlag"},"secure (HTTPS only) cookie flag")),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-samesite")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"set SameSite cookie attribute (",(0,l.kt)("inlineCode",{parentName:"td"},'"lax"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"strict"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"none"'),", or ",(0,l.kt)("inlineCode",{parentName:"td"},'""'),")."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--custom-templates-dir")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to custom html templates"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--custom-sign-in-logo")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},'path or a URL to an custom image for the sign_in page logo. Use \\"-\\" to disable default logo.'),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"display username / password login form if an htpasswd file is provided"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--email-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate emails with the specified domain (may be given multiple times). Use ",(0,l.kt)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--errors-to-info-log")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"redirects error-level logging to default log channel instead of stderr"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"if ",(0,l.kt)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",(0,l.kt)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",(0,l.kt)("inlineCode",{parentName:"td"},"iss"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--exclude-logging-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"comma separated list of paths to exclude from logging, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"/ping,/path2"')),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--flush-interval")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"period between flushing response buffers when streaming responses"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"1s"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--force-https")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"enforce https redirect"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"false"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--force-json-errors")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"force JSON errors instead of HTTP error pages or redirects"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"false"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--banner")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) banner string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--footer")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) footer string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-org")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this organisation"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-team")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these teams (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-repo")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to collaborators of this repository formatted as ",(0,l.kt)("inlineCode",{parentName:"td"},"orgname/repo")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-token")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the token to use when verifying repository collaborators (must have push access to the repository)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-user")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gitlab-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these groups (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gitlab-projects")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these projects (may be given multiple times) formatted as ",(0,l.kt)("inlineCode",{parentName:"td"},"orgname/repo=accesslevel"),". Access level should be a value matching ",(0,l.kt)("a",{parentName:"td",href:"https://docs.gitlab.com/ee/api/members.html#valid-access-levels"},"Gitlab access levels"),", defaulted to 20 if absent"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-admin-email")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the google admin to impersonate for api calls"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this google group (may be given multiple times)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-service-account-json")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the path to the service account json credentials"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--htpasswd-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"additionally authenticate against a htpasswd file. Entries must be created with ",(0,l.kt)("inlineCode",{parentName:"td"},"htpasswd -B")," for bcrypt encryption"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--htpasswd-user-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"the groups to be set on sessions for htpasswd users"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--http-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"[http://]:")," or ",(0,l.kt)("inlineCode",{parentName:"td"},"unix://")," to listen on for HTTP clients"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"127.0.0.1:4180"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--https-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},":")," to listen on for HTTPS clients"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'":443"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-compress")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Should rotated log files be compressed using gzip"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-filename")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"File to log requests to, empty for ",(0,l.kt)("inlineCode",{parentName:"td"},"stdout")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (stdout)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-local-time")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Use local time in log files and backup filenames instead of UTC"),(0,l.kt)("td",{parentName:"tr",align:null},"true (local time)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-age")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum number of days to retain old log files"),(0,l.kt)("td",{parentName:"tr",align:null},"7")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-backups")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum number of old log files to retain; 0 to disable"),(0,l.kt)("td",{parentName:"tr",align:null},"0")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-size")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum size in megabytes of the log file before rotation"),(0,l.kt)("td",{parentName:"tr",align:null},"100")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"private key in PEM format used to sign JWT, so that you can say something like ",(0,l.kt)("inlineCode",{parentName:"td"},'--jwt-key="${OAUTH2_PROXY_JWT_KEY}"'),": required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to the private key file in PEM format used to sign the JWT so that you can say something like ",(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem"),": required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--login-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Authentication endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-allow-unverified-email")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"don't fail if an email address in an id_token is not verified"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-issuer-verification")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-nonce")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip verifying the OIDC ID Token's nonce claim"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-issuer-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OpenID Connect issuer URL, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"https://accounts.google.com"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-jwks-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OIDC JWKS URI for token verification; required if OIDC discovery is disabled"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-email-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which OIDC claim contains the user's email"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"email"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-groups-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which OIDC claim contains the user groups"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"groups"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-audience-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which OIDC claim contains the audience"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"aud"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-extra-audience")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"additional audiences which are allowed to pass verification"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"[]"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-access-token")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with ",(0,l.kt)("inlineCode",{parentName:"td"},"--set-xauthrequest")," this adds the X-Auth-Request-Access-Token header to the response"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-authorization-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass OIDC IDToken to upstream via Authorization Bearer header"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-basic-auth")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--prefer-email-to-user")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-basic-auth")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-user-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-host-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass the request Host Header to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-user-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--profile-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Profile access endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--prompt")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"},"OIDC prompt"),"; if present, ",(0,l.kt)("inlineCode",{parentName:"td"},"approval-prompt")," is ignored"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth provider"),(0,l.kt)("td",{parentName:"tr",align:null},"google")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider-ca-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider-display-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Override the provider's name with the given string; used for the sign-in page"),(0,l.kt)("td",{parentName:"tr",align:null},"(depends on provider)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ping-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the ping endpoint that can be used for basic health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/ping"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ping-user-agent")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"a User-Agent that can be used for basic health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (don't check user agent)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--metrics-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the address prometheus metrics will be scraped from"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--proxy-prefix")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the url root path that this proxy should be nested under (e.g. /",(0,l.kt)("inlineCode",{parentName:"td"},"/sign_in"),")"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/oauth2"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--proxy-websockets")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"enables WebSocket proxying"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pubjwk-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"JWK pubkey access endpoint: required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--real-client-ip-header")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Header used to determine the real IP of the client, requires ",(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")," to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)"),(0,l.kt)("td",{parentName:"tr",align:null},"X-Real-IP")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redeem-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Token redemption endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redirect-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Redirect URL, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"https://internalapp.yourcompany.com/oauth2/callback"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"List of Redis cluster connection URLs (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-cluster")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"URL of redis server for redis session storage (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),")"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis password. Applicable for all Redis configurations. Will override any password set in ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-url")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-password")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis sentinel master name. Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"List of Redis sentinel connection URLs (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-cluster")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Connect to redis cluster. Must set ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")," to use this feature"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Connect to redis via sentinels. Must set ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")," to use this feature"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-id-header")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Request header to use as the request ID in logging"),(0,l.kt)("td",{parentName:"tr",align:null},"X-Request-Id")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log requests"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for request log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--resource")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"The resource that is protected (Azure AD only)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--scope")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth scope specification"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--session-cookie-minimal")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--session-store-type")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"/oauth2-proxy/docs/next/configuration/session_storage"},"Session data storage backend"),"; redis or cookie"),(0,l.kt)("td",{parentName:"tr",align:null},"cookie")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-xauthrequest")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-access-token"),", X-Auth-Request-Access-Token is added to response headers."),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-authorization-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set Authorization Bearer response header (useful in Nginx auth_request mode)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-basic-auth")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set HTTP Basic Auth information in response (useful in Nginx auth_request mode)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--show-debug-on-error")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--signature-key")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"GAP-Signature request signature key (algorithm:secretkey)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--silence-ping-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"disable logging of requests to ping endpoint"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-preflight")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip authentication for OPTIONS requests"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-regex")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"(DEPRECATED for ",(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-route"),") bypass authentication for requests paths that match (may be given multiple times)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-route")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-strip-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"strips ",(0,l.kt)("inlineCode",{parentName:"td"},"X-Forwarded-*")," style authentication headers & ",(0,l.kt)("inlineCode",{parentName:"td"},"Authorization")," header if they would be set by oauth2-proxy"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip requests that have verified JWT bearer tokens (the token must have ",(0,l.kt)("a",{parentName:"td",href:"https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields"},(0,l.kt)("inlineCode",{parentName:"a"},"aud"))," that matches this client id or one of the extras from ",(0,l.kt)("inlineCode",{parentName:"td"},"extra-jwt-issuers"),")"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-oidc-discovery")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"bypass OIDC endpoint discovery. ",(0,l.kt)("inlineCode",{parentName:"td"},"--login-url"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"--redeem-url")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-jwks-url")," must be configured in this case"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-provider-button")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip sign-in-page to directly reach the next step: oauth/start"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ssl-insecure-skip-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip validation of certificates presented when using HTTPS providers"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ssl-upstream-insecure-skip-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip validation of certificates presented when using HTTPS upstreams"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--standard-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log standard runtime information"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--standard-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for standard log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-cert-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to certificate file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-key-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to private key file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-min-version")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"minimum TLS version that is acceptable, either ",(0,l.kt)("inlineCode",{parentName:"td"},'"TLS1.2"')," or ",(0,l.kt)("inlineCode",{parentName:"td"},'"TLS1.3"')),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"TLS1.2"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--upstream")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"the http url(s) of the upstream endpoint, file:// paths for static files or ",(0,l.kt)("inlineCode",{parentName:"td"},"static://")," for static response. Routing is based on the path"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--allowed-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this group (may be given multiple times)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--allowed-role")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--validate-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Access token validation endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--version")),(0,l.kt)("td",{parentName:"tr",align:null},"n/a"),(0,l.kt)("td",{parentName:"tr",align:null},"print version string"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--whitelist-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"allowed domains for redirection after authentication. Prefix domain with a ",(0,l.kt)("inlineCode",{parentName:"td"},".")," or a ",(0,l.kt)("inlineCode",{parentName:"td"},"*.")," to allow subdomains (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},".example.com"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"*.example.com"),")","\xa0","[",(0,l.kt)("a",{parentName:"td",href:"#footnote2"},"2"),"]"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--trusted-ip")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with ",(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")," and optionally ",(0,l.kt)("inlineCode",{parentName:"td"},"--real-client-ip-header")," this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them."),(0,l.kt)("td",{parentName:"tr",align:null})))),(0,l.kt)("p",null,"[",(0,l.kt)("a",{name:"footnote1"},"1"),"]",": Only these providers support ",(0,l.kt)("inlineCode",{parentName:"p"},"--cookie-refresh"),": GitLab, Google and OIDC"),(0,l.kt)("p",null,"[",(0,l.kt)("a",{name:"footnote2"},"2"),"]",": When using the ",(0,l.kt)("inlineCode",{parentName:"p"},"whitelist-domain")," option, any domain prefixed with a ",(0,l.kt)("inlineCode",{parentName:"p"},".")," or a ",(0,l.kt)("inlineCode",{parentName:"p"},"*.")," will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: ",(0,l.kt)("inlineCode",{parentName:"p"},"example.com:8080"),". To allow any port, use ",(0,l.kt)("inlineCode",{parentName:"p"},"*"),": ",(0,l.kt)("inlineCode",{parentName:"p"},"example.com:*"),"."),(0,l.kt)("p",null,"See below for provider specific options"),(0,l.kt)("h3",{id:"upstreams-configuration"},"Upstreams Configuration"),(0,l.kt)("p",null,(0,l.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as ",(0,l.kt)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/")," for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide ",(0,l.kt)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/some/path/")," then it will only be requests that start with ",(0,l.kt)("inlineCode",{parentName:"p"},"/some/path/")," which are forwarded to the upstream."),(0,l.kt)("p",null,"Static file paths are configured as a file:// URL. ",(0,l.kt)("inlineCode",{parentName:"p"},"file:///var/www/static/")," will serve the files from that directory at ",(0,l.kt)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/var/www/static/"),", which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. ",(0,l.kt)("inlineCode",{parentName:"p"},"file:///var/www/static/#/static/")," will make ",(0,l.kt)("inlineCode",{parentName:"p"},"/var/www/static/")," available at ",(0,l.kt)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/static/"),"."),(0,l.kt)("p",null,"Multiple upstreams can either be configured by supplying a comma separated list to the ",(0,l.kt)("inlineCode",{parentName:"p"},"--upstream")," parameter, supplying the parameter multiple times or providing a list in the ",(0,l.kt)("a",{parentName:"p",href:"#config-file"},"config file"),". When multiple upstreams are used routing to them will be based on the path they are set up with."),(0,l.kt)("h3",{id:"environment-variables"},"Environment variables"),(0,l.kt)("p",null,"Every command line argument can be specified as an environment variable by\nprefixing it with ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_"),", capitalising it, and replacing hyphens (",(0,l.kt)("inlineCode",{parentName:"p"},"-"),")\nwith underscores (",(0,l.kt)("inlineCode",{parentName:"p"},"_"),"). If the argument can be specified multiple times, the\nenvironment variable should be plural (trailing ",(0,l.kt)("inlineCode",{parentName:"p"},"S"),")."),(0,l.kt)("p",null,"This is particularly useful for storing secrets outside of a configuration file\nor the command line."),(0,l.kt)("p",null,"For example, the ",(0,l.kt)("inlineCode",{parentName:"p"},"--cookie-secret")," flag becomes ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_COOKIE_SECRET"),",\nand the ",(0,l.kt)("inlineCode",{parentName:"p"},"--email-domain")," flag becomes ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_EMAIL_DOMAINS"),"."),(0,l.kt)("h2",{id:"logging-configuration"},"Logging Configuration"),(0,l.kt)("p",null,"By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the ",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-filename")," command."),(0,l.kt)("p",null,"If logging to a file you can also configure the maximum file size (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-size"),"), age (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-age"),"), max backup logs (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-backups"),"), and if backup logs should be compressed (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-compress"),")."),(0,l.kt)("p",null,"There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with ",(0,l.kt)("inlineCode",{parentName:"p"},"--standard-logging"),", ",(0,l.kt)("inlineCode",{parentName:"p"},"--auth-logging"),", and ",(0,l.kt)("inlineCode",{parentName:"p"},"--request-logging"),"."),(0,l.kt)("p",null,"Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log."),(0,l.kt)("p",null,"Logging of requests to the ",(0,l.kt)("inlineCode",{parentName:"p"},"/ping")," endpoint (or using ",(0,l.kt)("inlineCode",{parentName:"p"},"--ping-user-agent"),") can be disabled with ",(0,l.kt)("inlineCode",{parentName:"p"},"--silence-ping-logging")," reducing log volume. This flag appends the ",(0,l.kt)("inlineCode",{parentName:"p"},"--ping-path")," to ",(0,l.kt)("inlineCode",{parentName:"p"},"--exclude-logging-paths"),"."),(0,l.kt)("h3",{id:"auth-log-format"},"Auth Log Format"),(0,l.kt)("p",null,"Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"}," - - [19/Mar/2015:17:20:19 -0400] [] \n")),(0,l.kt)("p",null,"The status block will contain one of the below strings:"),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthSuccess")," If a user has authenticated successfully by any method"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthFailure")," If the user failed to authenticate explicitly"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthError")," If there was an unexpected error during authentication")),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--auth-logging-format")," flag.\nThe default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}\n")),(0,l.kt)("p",null,"Available variables for auth logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Client"),(0,l.kt)("td",{parentName:"tr",align:null},"74.125.224.72"),(0,l.kt)("td",{parentName:"tr",align:null},"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Host"),(0,l.kt)("td",{parentName:"tr",align:null},"domain.com"),(0,l.kt)("td",{parentName:"tr",align:null},"The value of the Host header.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Message"),(0,l.kt)("td",{parentName:"tr",align:null},"Authenticated via OAuth2"),(0,l.kt)("td",{parentName:"tr",align:null},"The details of the auth attempt.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Protocol"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP/1.0"),(0,l.kt)("td",{parentName:"tr",align:null},"The request protocol.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestID"),(0,l.kt)("td",{parentName:"tr",align:null},"00010203-0405-4607-8809-0a0b0c0d0e0f"),(0,l.kt)("td",{parentName:"tr",align:null},"The request ID pulled from the ",(0,l.kt)("inlineCode",{parentName:"td"},"--request-id-header"),". Random UUID if empty")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestMethod"),(0,l.kt)("td",{parentName:"tr",align:null},"GET"),(0,l.kt)("td",{parentName:"tr",align:null},"The request method.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"UserAgent"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The full user agent as reported by the requesting client.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Username"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"mailto:username@email.com"},"username@email.com")),(0,l.kt)("td",{parentName:"tr",align:null},"The email or username of the auth request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Status"),(0,l.kt)("td",{parentName:"tr",align:null},"AuthSuccess"),(0,l.kt)("td",{parentName:"tr",align:null},"The status of the auth request. See above for details.")))),(0,l.kt)("h3",{id:"request-log-format"},"Request Log Format"),(0,l.kt)("p",null,"HTTP request logs will output by default in the below format:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},' - - [19/Mar/2015:17:20:19 -0400] GET "/path/" HTTP/1.1 "" \n')),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--request-logging-format")," flag.\nThe default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}\n")),(0,l.kt)("p",null,"Available variables for request logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Client"),(0,l.kt)("td",{parentName:"tr",align:null},"74.125.224.72"),(0,l.kt)("td",{parentName:"tr",align:null},"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Host"),(0,l.kt)("td",{parentName:"tr",align:null},"domain.com"),(0,l.kt)("td",{parentName:"tr",align:null},"The value of the Host header.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Protocol"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP/1.0"),(0,l.kt)("td",{parentName:"tr",align:null},"The request protocol.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestDuration"),(0,l.kt)("td",{parentName:"tr",align:null},"0.001"),(0,l.kt)("td",{parentName:"tr",align:null},"The time in seconds that a request took to process.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestID"),(0,l.kt)("td",{parentName:"tr",align:null},"00010203-0405-4607-8809-0a0b0c0d0e0f"),(0,l.kt)("td",{parentName:"tr",align:null},"The request ID pulled from the ",(0,l.kt)("inlineCode",{parentName:"td"},"--request-id-header"),". Random UUID if empty")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestMethod"),(0,l.kt)("td",{parentName:"tr",align:null},"GET"),(0,l.kt)("td",{parentName:"tr",align:null},"The request method.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestURI"),(0,l.kt)("td",{parentName:"tr",align:null},'"/oauth2/auth"'),(0,l.kt)("td",{parentName:"tr",align:null},"The URI path of the request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"ResponseSize"),(0,l.kt)("td",{parentName:"tr",align:null},"12"),(0,l.kt)("td",{parentName:"tr",align:null},"The size in bytes of the response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"StatusCode"),(0,l.kt)("td",{parentName:"tr",align:null},"200"),(0,l.kt)("td",{parentName:"tr",align:null},"The HTTP status code of the response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The upstream data of the HTTP request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"UserAgent"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The full user agent as reported by the requesting client.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Username"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"mailto:username@email.com"},"username@email.com")),(0,l.kt)("td",{parentName:"tr",align:null},"The email or username of the auth request.")))),(0,l.kt)("h3",{id:"standard-log-format"},"Standard Log Format"),(0,l.kt)("p",null,"All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"[19/Mar/2015:17:20:19 -0400] [main.go:40] \n")),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--standard-logging-format")," flag. The default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"[{{.Timestamp}}] [{{.File}}] {{.Message}}\n")),(0,l.kt)("p",null,"Available variables for standard logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"File"),(0,l.kt)("td",{parentName:"tr",align:null},"main.go:40"),(0,l.kt)("td",{parentName:"tr",align:null},"The file and line number of the logging statement.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Message"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP: listening on 127.0.0.1:4180"),(0,l.kt)("td",{parentName:"tr",align:null},"The details of the log statement.")))),(0,l.kt)("h2",{id:"configuring-for-use-with-the-nginx-auth_request-directive"},"Configuring for use with the Nginx ",(0,l.kt)("inlineCode",{parentName:"h2"},"auth_request")," directive"),(0,l.kt)("p",null,"The ",(0,l.kt)("a",{parentName:"p",href:"http://nginx.org/en/docs/http/ngx_http_auth_request_module.html"},"Nginx ",(0,l.kt)("inlineCode",{parentName:"a"},"auth_request")," directive")," allows Nginx to authenticate requests via the oauth2-proxy's ",(0,l.kt)("inlineCode",{parentName:"p"},"/auth")," endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-nginx"},'server {\n listen 443 ssl;\n server_name ...;\n include ssl/ssl.conf;\n\n location /oauth2/ {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n proxy_set_header X-Auth-Request-Redirect $request_uri;\n # or, if you are handling multiple domains:\n # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;\n }\n location = /oauth2/auth {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n # nginx auth_request includes headers but not body\n proxy_set_header Content-Length "";\n proxy_pass_request_body off;\n }\n\n location / {\n auth_request /oauth2/auth;\n error_page 401 = /oauth2/sign_in;\n\n # pass information via X-User and X-Email headers to backend,\n # requires running with --set-xauthrequest flag\n auth_request_set $user $upstream_http_x_auth_request_user;\n auth_request_set $email $upstream_http_x_auth_request_email;\n proxy_set_header X-User $user;\n proxy_set_header X-Email $email;\n\n # if you enabled --pass-access-token, this will pass the token to the backend\n auth_request_set $token $upstream_http_x_auth_request_access_token;\n proxy_set_header X-Access-Token $token;\n\n # if you enabled --cookie-refresh, this is needed for it to work with auth_request\n auth_request_set $auth_cookie $upstream_http_set_cookie;\n add_header Set-Cookie $auth_cookie;\n\n # When using the --set-authorization-header flag, some provider\'s cookies can exceed the 4kb\n # limit and so the OAuth2 Proxy splits these into multiple parts.\n # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\n # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\n auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;\n\n # Extract the Cookie attributes from the first Set-Cookie header and append them\n # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\n if ($auth_cookie ~* "(; .*)") {\n set $auth_cookie_name_0 $auth_cookie;\n set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";\n }\n\n # Send both Set-Cookie headers now if there was a second part\n if ($auth_cookie_name_upstream_1) {\n add_header Set-Cookie $auth_cookie_name_0;\n add_header Set-Cookie $auth_cookie_name_1;\n }\n\n proxy_pass http://backend/;\n # or "root /path/to/site;" or "fastcgi_pass ..." etc\n }\n}\n')),(0,l.kt)("p",null,"When you use ingress-nginx in Kubernetes, you MUST use ",(0,l.kt)("inlineCode",{parentName:"p"},"kubernetes/ingress-nginx")," (which includes the Lua module) and the following configuration snippet for your ",(0,l.kt)("inlineCode",{parentName:"p"},"Ingress"),".\nVariables set with ",(0,l.kt)("inlineCode",{parentName:"p"},"auth_request_set")," are not ",(0,l.kt)("inlineCode",{parentName:"p"},"set"),"-able in plain nginx config when the location is processed via ",(0,l.kt)("inlineCode",{parentName:"p"},"proxy_pass")," and then may only be processed by Lua.\nNote that ",(0,l.kt)("inlineCode",{parentName:"p"},"nginxinc/kubernetes-ingress")," does not include the Lua module."),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'nginx.ingress.kubernetes.io/auth-response-headers: Authorization\nnginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri\nnginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth\nnginx.ingress.kubernetes.io/configuration-snippet: |\n auth_request_set $name_upstream_1 $upstream_cookie_name_1;\n\n access_by_lua_block {\n if ngx.var.name_upstream_1 ~= "" then\n ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")\n end\n }\n')),(0,l.kt)("p",null,"It is recommended to use ",(0,l.kt)("inlineCode",{parentName:"p"},"--session-store-type=redis")," when expecting large sessions/OIDC tokens (",(0,l.kt)("em",{parentName:"p"},"e.g.")," with MS Azure)."),(0,l.kt)("p",null,"You have to substitute ",(0,l.kt)("em",{parentName:"p"},"name"),' with the actual cookie name you configured via --cookie-name parameter. If you don\'t set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".'),(0,l.kt)("h2",{id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware"},"Configuring for use with the Traefik (v2) ",(0,l.kt)("inlineCode",{parentName:"h2"},"ForwardAuth")," middleware"),(0,l.kt)("p",null,(0,l.kt)("strong",{parentName:"p"},"This option requires ",(0,l.kt)("inlineCode",{parentName:"strong"},"--reverse-proxy")," option to be set.")),(0,l.kt)("h3",{id:"forwardauth-with-401-errors-middleware"},"ForwardAuth with 401 errors middleware"),(0,l.kt)("p",null,"The ",(0,l.kt)("a",{parentName:"p",href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"},"Traefik v2 ",(0,l.kt)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," allows Traefik to authenticate requests via the oauth2-proxy's ",(0,l.kt)("inlineCode",{parentName:"p"},"/oauth2/auth")," endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'http:\n routers:\n a-service:\n rule: "Host(`a-service.example.com`)"\n service: a-service-backend\n middlewares:\n - oauth-errors\n - oauth-auth\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth:\n rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n oauth-errors:\n errors:\n status:\n - "401-403"\n service: oauth-backend\n query: "/oauth2/sign_in"\n')),(0,l.kt)("h3",{id:"forwardauth-with-static-upstreams-configuration"},"ForwardAuth with static upstreams configuration"),(0,l.kt)("p",null,"Redirect to sign_in functionality provided without the use of ",(0,l.kt)("inlineCode",{parentName:"p"},"errors")," middleware with ",(0,l.kt)("a",{parentName:"p",href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"},"Traefik v2 ",(0,l.kt)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," pointing to oauth2-proxy service's ",(0,l.kt)("inlineCode",{parentName:"p"},"/")," endpoint"),(0,l.kt)("p",null,(0,l.kt)("strong",{parentName:"p"},"Following options need to be set on ",(0,l.kt)("inlineCode",{parentName:"strong"},"oauth2-proxy"),":")),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"--upstream=static://202"),": Configures a static response for authenticated sessions"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"--reverse-proxy=true"),": Enables the use of ",(0,l.kt)("inlineCode",{parentName:"li"},"X-Forwarded-*")," headers to determine redirects correctly")),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'http:\n routers:\n a-service-route-1:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n a-service-route-2:\n rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-wo-redirect # unauthenticated session will return a 401\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n services-oauth2-route:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth2-proxy-route:\n rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n b-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.3:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth-redirect:\n forwardAuth:\n address: https://oauth.example.com/\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n oauth-auth-wo-redirect:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n')),(0,l.kt)("div",{className:"admonition admonition-note alert alert--secondary"},(0,l.kt)("div",{parentName:"div",className:"admonition-heading"},(0,l.kt)("h5",{parentName:"div"},(0,l.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,l.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,l.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"}))),"note")),(0,l.kt)("div",{parentName:"div",className:"admonition-content"},(0,l.kt)("p",{parentName:"div"},"If you set up your OAuth2 provider to rotate your client secret, you can use the ",(0,l.kt)("inlineCode",{parentName:"p"},"client-secret-file")," option to reload the secret when it is updated."))))}g.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/js/17896441.b571fd1c.js b/assets/js/17896441.b571fd1c.js new file mode 100644 index 00000000..641653f9 --- /dev/null +++ b/assets/js/17896441.b571fd1c.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[7918],{1980:function(e,t,a){a.r(t),a.d(t,{default:function(){return G}});var n=a(7294),l=a(6010),i=a(7462),r=a(5999),s=a(9960);var o=function(e){var t=e.permalink,a=e.title,l=e.subLabel;return n.createElement(s.Z,{className:"pagination-nav__link",to:t},l&&n.createElement("div",{className:"pagination-nav__sublabel"},l),n.createElement("div",{className:"pagination-nav__label"},a))};var c=function(e){var t=e.previous,a=e.next;return n.createElement("nav",{className:"pagination-nav docusaurus-mt-lg","aria-label":(0,r.I)({id:"theme.docs.paginator.navAriaLabel",message:"Docs pages navigation",description:"The ARIA label for the docs pagination"})},n.createElement("div",{className:"pagination-nav__item"},t&&n.createElement(o,(0,i.Z)({},t,{subLabel:n.createElement(r.Z,{id:"theme.docs.paginator.previous",description:"The label used to navigate to the previous doc"},"Previous")}))),n.createElement("div",{className:"pagination-nav__item pagination-nav__item--next"},a&&n.createElement(o,(0,i.Z)({},a,{subLabel:n.createElement(r.Z,{id:"theme.docs.paginator.next",description:"The label used to navigate to the next doc"},"Next")}))))},d=a(2263),m=a(5551),u=a(9548);var v={unreleased:function(e){var t=e.siteTitle,a=e.versionMetadata;return n.createElement(r.Z,{id:"theme.docs.versions.unreleasedVersionLabel",description:"The label used to tell the user that he's browsing an unreleased doc version",values:{siteTitle:t,versionLabel:n.createElement("b",null,a.label)}},"This is unreleased documentation for {siteTitle} {versionLabel} version.")},unmaintained:function(e){var t=e.siteTitle,a=e.versionMetadata;return n.createElement(r.Z,{id:"theme.docs.versions.unmaintainedVersionLabel",description:"The label used to tell the user that he's browsing an unmaintained doc version",values:{siteTitle:t,versionLabel:n.createElement("b",null,a.label)}},"This is documentation for {siteTitle} {versionLabel}, which is no longer actively maintained.")}};function g(e){var t=v[e.versionMetadata.banner];return n.createElement(t,e)}function h(e){var t=e.versionLabel,a=e.to,l=e.onClick;return n.createElement(r.Z,{id:"theme.docs.versions.latestVersionSuggestionLabel",description:"The label used to tell the user to check the latest version",values:{versionLabel:t,latestVersionLink:n.createElement("b",null,n.createElement(s.Z,{to:a,onClick:l},n.createElement(r.Z,{id:"theme.docs.versions.latestVersionLinkLabel",description:"The label used for the latest version suggestion link label"},"latest version")))}},"For up-to-date documentation, see the {latestVersionLink} ({versionLabel}).")}function p(e){var t,a=e.className,i=e.versionMetadata,r=(0,d.Z)().siteConfig.title,s=(0,m.useActivePlugin)({failfast:!0}).pluginId,o=(0,u.J)(s).savePreferredVersionName,c=(0,m.useDocVersionSuggestions)(s),v=c.latestDocSuggestion,p=c.latestVersionSuggestion,E=null!=v?v:(t=p).docs.find((function(e){return e.id===t.mainDocId}));return n.createElement("div",{className:(0,l.Z)(a,u.kM.docs.docVersionBanner,"alert alert--warning margin-bottom--md"),role:"alert"},n.createElement("div",null,n.createElement(g,{siteTitle:r,versionMetadata:i})),n.createElement("div",{className:"margin-top--md"},n.createElement(h,{versionLabel:p.label,to:E.path,onClick:function(){return o(p.name)}})))}function E(e){var t=e.className,a=(0,u.E6)();return a.banner?n.createElement(p,{className:t,versionMetadata:a}):null}function b(e){var t=e.className,a=(0,u.E6)();return a.badge?n.createElement("span",{className:(0,l.Z)(t,u.kM.docs.docVersionBadge,"badge badge--secondary")},"Version: ",a.label):null}var f=a(1217);function N(e){var t=e.lastUpdatedAt,a=e.formattedLastUpdatedAt;return n.createElement(r.Z,{id:"theme.lastUpdated.atDate",description:"The words used to describe on which date a page has been last updated",values:{date:n.createElement("b",null,n.createElement("time",{dateTime:new Date(1e3*t).toISOString()},a))}}," on {date}")}function k(e){var t=e.lastUpdatedBy;return n.createElement(r.Z,{id:"theme.lastUpdated.byUser",description:"The words used to describe by who the page has been last updated",values:{user:n.createElement("b",null,t)}}," by {user}")}function Z(e){var t=e.lastUpdatedAt,a=e.formattedLastUpdatedAt,l=e.lastUpdatedBy;return n.createElement("span",{className:u.kM.common.lastUpdated},n.createElement(r.Z,{id:"theme.lastUpdated.lastUpdatedAtBy",description:"The sentence used to display when a page has been last updated, and by who",values:{atDate:t&&a?n.createElement(N,{lastUpdatedAt:t,formattedLastUpdatedAt:a}):"",byUser:l?n.createElement(k,{lastUpdatedBy:l}):""}},"Last updated{atDate}{byUser}"),!1)}var L=a(3366),_="iconEdit_dcUD",U=["className"];var C=function(e){var t=e.className,a=(0,L.Z)(e,U);return n.createElement("svg",(0,i.Z)({fill:"currentColor",height:"20",width:"20",viewBox:"0 0 40 40",className:(0,l.Z)(_,t),"aria-hidden":"true"},a),n.createElement("g",null,n.createElement("path",{d:"m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"})))};function T(e){var t=e.editUrl;return n.createElement("a",{href:t,target:"_blank",rel:"noreferrer noopener",className:u.kM.common.editThisPage},n.createElement(C,null),n.createElement(r.Z,{id:"theme.common.editThisPage",description:"The link label to edit the current page"},"Edit this page"))}var y="tag_hD8n",M="tagRegular_D6E_",A="tagWithCount_i0QQ";var w=function(e){var t,a=e.permalink,i=e.name,r=e.count;return n.createElement(s.Z,{href:a,className:(0,l.Z)(y,(t={},t[M]=!r,t[A]=r,t))},i,r&&n.createElement("span",null,r))},x="tags_XVD_",H="tag_JSN8";function D(e){var t=e.tags;return n.createElement(n.Fragment,null,n.createElement("b",null,n.createElement(r.Z,{id:"theme.tags.tagsListLabel",description:"The label alongside a tag list"},"Tags:")),n.createElement("ul",{className:(0,l.Z)(x,"padding--none","margin-left--sm")},t.map((function(e){var t=e.label,a=e.permalink;return n.createElement("li",{key:a,className:H},n.createElement(w,{name:t,permalink:a}))}))))}var V="lastUpdated_foO9";function B(e){return n.createElement("div",{className:(0,l.Z)(u.kM.docs.docFooterTagsRow,"row margin-bottom--sm")},n.createElement("div",{className:"col"},n.createElement(D,e)))}function S(e){var t=e.editUrl,a=e.lastUpdatedAt,i=e.lastUpdatedBy,r=e.formattedLastUpdatedAt;return n.createElement("div",{className:(0,l.Z)(u.kM.docs.docFooterEditMetaRow,"row")},n.createElement("div",{className:"col"},t&&n.createElement(T,{editUrl:t})),n.createElement("div",{className:(0,l.Z)("col",V)},(a||i)&&n.createElement(Z,{lastUpdatedAt:a,formattedLastUpdatedAt:r,lastUpdatedBy:i})))}function I(e){var t=e.content.metadata,a=t.editUrl,i=t.lastUpdatedAt,r=t.formattedLastUpdatedAt,s=t.lastUpdatedBy,o=t.tags,c=o.length>0,d=!!(a||i||s);return c||d?n.createElement("footer",{className:(0,l.Z)(u.kM.docs.docFooter,"docusaurus-mt-lg")},c&&n.createElement(B,{tags:o}),d&&n.createElement(S,{editUrl:a,lastUpdatedAt:i,lastUpdatedBy:s,formattedLastUpdatedAt:r})):null}var O=a(1575),F="tocCollapsible_jdIR",R="tocCollapsibleButton_Fzxq",P="tocCollapsibleContent_MpvI",z="tocCollapsibleExpanded_laf4",q=a(5002);function Q(e){var t,a=e.toc,i=e.className,s=e.minHeadingLevel,o=e.maxHeadingLevel,c=(0,u.uR)({initialState:!0}),d=c.collapsed,m=c.toggleCollapsed;return n.createElement("div",{className:(0,l.Z)(F,(t={},t[z]=!d,t),i)},n.createElement("button",{type:"button",className:(0,l.Z)("clean-btn",R),onClick:m},n.createElement(r.Z,{id:"theme.TOCCollapsible.toggleButtonLabel",description:"The label used by the button on the collapsible TOC component"},"On this page")),n.createElement(u.zF,{lazy:!0,className:P,collapsed:d},n.createElement(q.Z,{toc:a,minHeadingLevel:s,maxHeadingLevel:o})))}var W=a(9649),j="docItemContainer_vinB",J="docItemCol_DM6M",X="tocMobile_TmEX";function G(e){var t,a=e.content,i=a.metadata,r=a.frontMatter,s=r.image,o=r.keywords,d=r.hide_title,m=r.hide_table_of_contents,v=r.toc_min_heading_level,g=r.toc_max_heading_level,h=i.description,p=i.title,N=!d&&void 0===a.contentTitle,k=(0,u.iP)(),Z=!m&&a.toc&&a.toc.length>0,L=Z&&("desktop"===k||"ssr"===k);return n.createElement(n.Fragment,null,n.createElement(f.Z,{title:p,description:h,keywords:o,image:s}),n.createElement("div",{className:"row"},n.createElement("div",{className:(0,l.Z)("col",(t={},t[J]=!m,t))},n.createElement(E,null),n.createElement("div",{className:j},n.createElement("article",null,n.createElement(b,null),Z&&n.createElement(Q,{toc:a.toc,minHeadingLevel:v,maxHeadingLevel:g,className:(0,l.Z)(u.kM.docs.docTocMobile,X)}),n.createElement("div",{className:(0,l.Z)(u.kM.docs.docMarkdown,"markdown")},N&&n.createElement("header",null,n.createElement(W.Z,{as:"h1"},p)),n.createElement(a,null)),n.createElement(I,e)),n.createElement(c,{previous:i.previous,next:i.next}))),L&&n.createElement("div",{className:"col col--3"},n.createElement(O.Z,{toc:a.toc,minHeadingLevel:v,maxHeadingLevel:g,className:u.kM.docs.docTocDesktop}))))}},9649:function(e,t,a){a.d(t,{Z:function(){return g}});var n=a(7462),l=a(3366),i=a(7294),r=a(6010),s=a(5999),o=a(9548),c="anchorWithStickyNavbar_mojV",d="anchorWithHideOnScrollNavbar_R0VQ",m=["as","id"],u=["as"];function v(e){var t,a=e.as,u=e.id,v=(0,l.Z)(e,m),g=(0,o.LU)().navbar.hideOnScroll;return u?i.createElement(a,(0,n.Z)({},v,{className:(0,r.Z)("anchor",(t={},t[d]=g,t[c]=!g,t)),id:u}),v.children,i.createElement("a",{className:"hash-link",href:"#"+u,title:(0,s.I)({id:"theme.common.headingLinkTitle",message:"Direct link to heading",description:"Title for link to heading"})},"\u200b")):i.createElement(a,v)}function g(e){var t=e.as,a=(0,l.Z)(e,u);return"h1"===t?i.createElement("h1",(0,n.Z)({},a,{id:void 0}),a.children):i.createElement(v,(0,n.Z)({as:t},a))}},1575:function(e,t,a){a.d(t,{Z:function(){return d}});var n=a(7462),l=a(3366),i=a(7294),r=a(6010),s=a(5002),o="tableOfContents_cNA8",c=["className"];var d=function(e){var t=e.className,a=(0,l.Z)(e,c);return i.createElement("div",{className:(0,r.Z)(o,"thin-scrollbar",t)},i.createElement(s.Z,(0,n.Z)({},a,{linkClassName:"table-of-contents__link toc-highlight",linkActiveClassName:"table-of-contents__link--active"})))}},5002:function(e,t,a){a.d(t,{Z:function(){return c}});var n=a(7462),l=a(3366),i=a(7294),r=a(9548),s=["toc","className","linkClassName","linkActiveClassName","minHeadingLevel","maxHeadingLevel"];function o(e){var t=e.toc,a=e.className,n=e.linkClassName,l=e.isChild;return t.length?i.createElement("ul",{className:l?void 0:a},t.map((function(e){return i.createElement("li",{key:e.id},i.createElement("a",{href:"#"+e.id,className:null!=n?n:void 0,dangerouslySetInnerHTML:{__html:e.value}}),i.createElement(o,{isChild:!0,toc:e.children,className:a,linkClassName:n}))}))):null}function c(e){var t=e.toc,a=e.className,c=void 0===a?"table-of-contents table-of-contents__left-border":a,d=e.linkClassName,m=void 0===d?"table-of-contents__link":d,u=e.linkActiveClassName,v=void 0===u?void 0:u,g=e.minHeadingLevel,h=e.maxHeadingLevel,p=(0,l.Z)(e,s),E=(0,r.LU)(),b=null!=g?g:E.tableOfContents.minHeadingLevel,f=null!=h?h:E.tableOfContents.maxHeadingLevel,N=(0,r.DA)({toc:t,minHeadingLevel:b,maxHeadingLevel:f}),k=(0,i.useMemo)((function(){if(m&&v)return{linkClassName:m,linkActiveClassName:v,minHeadingLevel:b,maxHeadingLevel:f}}),[m,v,b,f]);return(0,r.Si)(k),i.createElement(o,(0,n.Z)({toc:N,className:c,linkClassName:m},p))}}}]); \ No newline at end of file diff --git a/assets/js/1999cd7b.67af2e9d.js b/assets/js/1999cd7b.67af2e9d.js new file mode 100644 index 00000000..1d81bc1a --- /dev/null +++ b/assets/js/1999cd7b.67af2e9d.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[1898],{3905:function(e,t,n){n.d(t,{Zo:function(){return c},kt:function(){return h}});var r=n(7294);function i(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function o(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function s(e){for(var t=1;t=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var l=r.createContext({}),u=function(e){var t=r.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},c=function(e){var t=u(e.components);return r.createElement(l.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},p=r.forwardRef((function(e,t){var n=e.components,i=e.mdxType,o=e.originalType,l=e.parentName,c=a(e,["components","mdxType","originalType","parentName"]),p=u(n),h=i,k=p["".concat(l,".").concat(h)]||p[h]||d[h]||o;return n?r.createElement(k,s(s({ref:t},c),{},{components:n})):r.createElement(k,s({ref:t},c))}));function h(e,t){var n=arguments,i=t&&t.mdxType;if("string"==typeof e||i){var o=n.length,s=new Array(o);s[0]=p;var a={};for(var l in t)hasOwnProperty.call(t,l)&&(a[l]=t[l]);a.originalType=e,a.mdxType="string"==typeof e?e:i,s[1]=a;for(var u=2;u0&&(t=requestAnimationFrame(e),window.scrollTo(0,Math.floor(.85*a)))}(),function(){return t&&cancelAnimationFrame(t)})},cancelScrollToTop:function(){return null==e.current?void 0:e.current()}}}var X=function(){var e,t=(0,n.useState)(!1),a=t[0],l=t[1],r=(0,n.useRef)(!1),o=K(),s=o.smoothScrollTop,d=o.cancelScrollToTop;return(0,c.RF)((function(e,t){var a=e.scrollY,n=null==t?void 0:t.scrollY;if(n)if(r.current)r.current=!1;else{var o=a=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var l=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var s=n.createContext({}),p=function(e){var t=n.useContext(s),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},d=function(e){var t=p(e.components);return n.createElement(s.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return n.createElement(n.Fragment,{},t)}},m=n.forwardRef((function(e,t){var a=e.components,r=e.mdxType,l=e.originalType,s=e.parentName,d=o(e,["components","mdxType","originalType","parentName"]),m=p(a),k=r,h=m["".concat(s,".").concat(k)]||m[k]||u[k]||l;return a?n.createElement(h,i(i({ref:t},d),{},{components:a})):n.createElement(h,i({ref:t},d))}));function k(e,t){var a=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var l=a.length,i=new Array(l);i[0]=m;var o={};for(var s in t)hasOwnProperty.call(t,s)&&(o[s]=t[s]);o.originalType=e,o.mdxType="string"==typeof e?e:r,i[1]=o;for(var p=2;pstring alias)",id:"string-alias",children:[],level:4}],level:3},{value:"Header",id:"header",children:[],level:3},{value:"HeaderValue",id:"headervalue",children:[],level:3},{value:"SecretSource",id:"secretsource",children:[],level:3},{value:"Server",id:"server",children:[],level:3},{value:"TLS",id:"tls",children:[],level:3},{value:"Upstream",id:"upstream",children:[],level:3},{value:"Upstreams",id:"upstreams",children:[{value:"([]Upstream alias)",id:"upstream-alias",children:[],level:4}],level:3}],level:2}],u={toc:d};function m(e){var t=e.components,a=(0,r.Z)(e,i);return(0,l.kt)("wrapper",(0,n.Z)({},u,a,{components:t,mdxType:"MDXLayout"}),(0,l.kt)("div",{className:"admonition admonition-warning alert alert--danger"},(0,l.kt)("div",{parentName:"div",className:"admonition-heading"},(0,l.kt)("h5",{parentName:"div"},(0,l.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,l.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"12",height:"16",viewBox:"0 0 12 16"},(0,l.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M5.05.31c.81 2.17.41 3.38-.52 4.31C3.55 5.67 1.98 6.45.9 7.98c-1.45 2.05-1.7 6.53 3.53 7.7-2.2-1.16-2.67-4.52-.3-6.61-.61 2.03.53 3.33 1.94 2.86 1.39-.47 2.3.53 2.27 1.67-.02.78-.31 1.44-1.13 1.81 3.42-.59 4.78-3.42 4.78-5.56 0-2.84-2.53-3.22-1.25-5.61-1.52.13-2.03 1.13-1.89 2.75.09 1.08-1.02 1.8-1.86 1.33-.67-.41-.66-1.19-.06-1.78C8.18 5.31 8.68 2.45 5.05.32L5.03.3l.02.01z"}))),"warning")),(0,l.kt)("div",{parentName:"div",className:"admonition-content"},(0,l.kt)("p",{parentName:"div"},"This page contains documentation for alpha features.\nWe reserve the right to make breaking changes to the features detailed within this page with no notice."),(0,l.kt)("p",{parentName:"div"},"Options described in this page may be changed, removed, renamed or moved without prior warning.\nPlease beware of this before you use alpha configuration options."))),(0,l.kt)("p",null,"This page details a set of ",(0,l.kt)("strong",{parentName:"p"},"alpha")," configuration options in a new format.\nGoing forward we are intending to add structured configuration in YAML format to\nreplace the existing TOML based configuration file and flags."),(0,l.kt)("p",null,"Below is a reference for the structure of the configuration, with\n",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions")," as the root of the configuration."),(0,l.kt)("p",null,"When using alpha configuration, your config file will look something like below:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},"upstreams:\n - id: ...\n ...\ninjectRequestHeaders:\n - name: ...\n ...\ninjectResponseHeaders:\n - name: ...\n ...\n")),(0,l.kt)("p",null,"Please browse the ",(0,l.kt)("a",{parentName:"p",href:"#configuration-reference"},"reference")," below for the structure\nof the new configuration format."),(0,l.kt)("h2",{id:"using-alpha-configuration"},"Using Alpha Configuration"),(0,l.kt)("p",null,"To use the new ",(0,l.kt)("strong",{parentName:"p"},"alpha")," configuration, generate a YAML file based on the format\ndescribed in the ",(0,l.kt)("a",{parentName:"p",href:"#configuration-reference"},"reference")," below."),(0,l.kt)("p",null,"Provide the path to this file using the ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config")," flag."),(0,l.kt)("div",{className:"admonition admonition-note alert alert--secondary"},(0,l.kt)("div",{parentName:"div",className:"admonition-heading"},(0,l.kt)("h5",{parentName:"div"},(0,l.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,l.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,l.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"}))),"note")),(0,l.kt)("div",{parentName:"div",className:"admonition-content"},(0,l.kt)("p",{parentName:"div"},"When using the ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config")," flag, some options are no longer available.\nSee ",(0,l.kt)("a",{parentName:"p",href:"#removed-options"},"removed options")," below for more information."))),(0,l.kt)("h3",{id:"converting-configuration-to-the-new-structure"},"Converting configuration to the new structure"),(0,l.kt)("p",null,"Before adding the new ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config")," option, start OAuth2 Proxy using the\n",(0,l.kt)("inlineCode",{parentName:"p"},"convert-config-to-alpha")," flag to convert existing configuration to the new format."),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-bash"},"oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg\n")),(0,l.kt)("p",null,"This will convert any options supported by the new format to YAML and print the\nnew configuration to ",(0,l.kt)("inlineCode",{parentName:"p"},"STDOUT"),"."),(0,l.kt)("p",null,"Copy this to a new file, remove any options from your existing configuration\nnoted in ",(0,l.kt)("a",{parentName:"p",href:"#removed-options"},"removed options")," and then start OAuth2 Proxy using\nthe new config."),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-bash"},"oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg\n")),(0,l.kt)("h2",{id:"removed-options"},"Removed options"),(0,l.kt)("p",null,"The following flags/options and their respective environment variables are no\nlonger available when using alpha configuration:"),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"flush-interval"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"flush_interval")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-host-header"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_host_header")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"proxy-websockets"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"proxy_websockets")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"ssl-upstream-insecure-skip-verify"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"ssl_upstream_insecure_skip_verify")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"upstream"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"upstreams"))),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-basic-auth"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_basic_auth")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-access-token"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_access_token")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-user-headers"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_user_headers")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-authorization-header"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_authorization_header")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"set-basic-auth"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"set_basic_auth")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"set-xauthrequest"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"set_xauthrequest")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"set-authorization-header"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"set_authorization_header")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"prefer-email-to-user"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"prefer_email_to_user")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"basic-auth-password"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"basic_auth_password")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"skip-auth-strip-headers"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"skip_auth_strip_headers"))),(0,l.kt)("p",null,"Attempting to use these options via flags or via config when ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config"),"\nset will result in an error."),(0,l.kt)("div",{className:"admonition admonition-important alert alert--info"},(0,l.kt)("div",{parentName:"div",className:"admonition-heading"},(0,l.kt)("h5",{parentName:"div"},(0,l.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,l.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,l.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"}))),"important")),(0,l.kt)("div",{parentName:"div",className:"admonition-content"},(0,l.kt)("p",{parentName:"div"},"You must remove these options before starting OAuth2 Proxy with ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config")))),(0,l.kt)("h2",{id:"configuration-reference"},"Configuration Reference"),(0,l.kt)("h3",{id:"alphaoptions"},"AlphaOptions"),(0,l.kt)("p",null,"AlphaOptions contains alpha structured configuration options.\nUsage of these options allows users to access alpha features that are not\navailable as part of the primary configuration structure for OAuth2 Proxy."),(0,l.kt)("div",{className:"admonition admonition-warning alert alert--danger"},(0,l.kt)("div",{parentName:"div",className:"admonition-heading"},(0,l.kt)("h5",{parentName:"div"},(0,l.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,l.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"12",height:"16",viewBox:"0 0 12 16"},(0,l.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M5.05.31c.81 2.17.41 3.38-.52 4.31C3.55 5.67 1.98 6.45.9 7.98c-1.45 2.05-1.7 6.53 3.53 7.7-2.2-1.16-2.67-4.52-.3-6.61-.61 2.03.53 3.33 1.94 2.86 1.39-.47 2.3.53 2.27 1.67-.02.78-.31 1.44-1.13 1.81 3.42-.59 4.78-3.42 4.78-5.56 0-2.84-2.53-3.22-1.25-5.61-1.52.13-2.03 1.13-1.89 2.75.09 1.08-1.02 1.8-1.86 1.33-.67-.41-.66-1.19-.06-1.78C8.18 5.31 8.68 2.45 5.05.32L5.03.3l.02.01z"}))),"warning")),(0,l.kt)("div",{parentName:"div",className:"admonition-content"},(0,l.kt)("p",{parentName:"div"},"The options within this structure are considered alpha.\nThey may change between releases without notice."))),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"upstreams")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#upstreams"},"Upstreams"))),(0,l.kt)("td",{parentName:"tr",align:null},"Upstreams is used to configure upstream servers.",(0,l.kt)("br",null),"Once a user is authenticated, requests to the server will be proxied to",(0,l.kt)("br",null),"these upstream servers based on the path mappings defined in this list.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"injectRequestHeaders")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#header"},"[]Header"))),(0,l.kt)("td",{parentName:"tr",align:null},"InjectRequestHeaders is used to configure headers that should be added",(0,l.kt)("br",null),"to requests to upstream servers.",(0,l.kt)("br",null),"Headers may source values from either the authenticated user's session",(0,l.kt)("br",null),"or from a static secret value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"injectResponseHeaders")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#header"},"[]Header"))),(0,l.kt)("td",{parentName:"tr",align:null},"InjectResponseHeaders is used to configure headers that should be added",(0,l.kt)("br",null),"to responses from the proxy.",(0,l.kt)("br",null),"This is typically used when using the proxy as an external authentication",(0,l.kt)("br",null),"provider in conjunction with another proxy such as NGINX and its",(0,l.kt)("br",null),"auth_request module.",(0,l.kt)("br",null),"Headers may source values from either the authenticated user's session",(0,l.kt)("br",null),"or from a static secret value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"server")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#server"},"Server"))),(0,l.kt)("td",{parentName:"tr",align:null},"Server is used to configure the HTTP(S) server for the proxy application.",(0,l.kt)("br",null),"You may choose to run both HTTP and HTTPS servers simultaneously.",(0,l.kt)("br",null),"This can be done by setting the BindAddress and the SecureBindAddress simultaneously.",(0,l.kt)("br",null),"To use the secure server you must configure a TLS certificate and key.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"metricsServer")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#server"},"Server"))),(0,l.kt)("td",{parentName:"tr",align:null},"MetricsServer is used to configure the HTTP(S) server for metrics.",(0,l.kt)("br",null),"You may choose to run both HTTP and HTTPS servers simultaneously.",(0,l.kt)("br",null),"This can be done by setting the BindAddress and the SecureBindAddress simultaneously.",(0,l.kt)("br",null),"To use the secure server you must configure a TLS certificate and key.")))),(0,l.kt)("h3",{id:"claimsource"},"ClaimSource"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#headervalue"},"HeaderValue"),")"),(0,l.kt)("p",null,"ClaimSource allows loading a header value from a claim within the session"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"claim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Claim is the name of the claim in the session that the value should be",(0,l.kt)("br",null),"loaded from.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"prefix")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Prefix is an optional prefix that will be prepended to the value of the",(0,l.kt)("br",null),"claim if it is non-empty.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"basicAuthPassword")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,l.kt)("td",{parentName:"tr",align:null},"BasicAuthPassword converts this claim into a basic auth header.",(0,l.kt)("br",null),"Note the value of claim will become the basic auth username and the",(0,l.kt)("br",null),"basicAuthPassword will be used as the password value.")))),(0,l.kt)("h3",{id:"duration"},"Duration"),(0,l.kt)("h4",{id:"string-alias"},"(",(0,l.kt)("inlineCode",{parentName:"h4"},"string")," alias)"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#upstream"},"Upstream"),")"),(0,l.kt)("p",null,'Duration is as string representation of a period of time.\nA duration string is a is a possibly signed sequence of decimal numbers,\neach with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".\nValid time units are "ns", "us" (or "\xb5s"), "ms", "s", "m", "h".'),(0,l.kt)("h3",{id:"header"},"Header"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions"),")"),(0,l.kt)("p",null,"Header represents an individual header that will be added to a request or\nresponse header."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"name")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Name is the header name to be used for this set of values.",(0,l.kt)("br",null),"Names should be unique within a list of Headers.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"preserveRequestValue")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"PreserveRequestValue determines whether any values for this header",(0,l.kt)("br",null),"should be preserved for the request to the upstream server.",(0,l.kt)("br",null),"This option only applies to injected request headers.",(0,l.kt)("br",null),"Defaults to false (headers that match this header will be stripped).")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"values")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#headervalue"},"[]HeaderValue"))),(0,l.kt)("td",{parentName:"tr",align:null},"Values contains the desired values for this header")))),(0,l.kt)("h3",{id:"headervalue"},"HeaderValue"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#header"},"Header"),")"),(0,l.kt)("p",null,"HeaderValue represents a single header value and the sources that can\nmake up the header value"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"value")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]byte")),(0,l.kt)("td",{parentName:"tr",align:null},"Value expects a base64 encoded string value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"fromEnv")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"FromEnv expects the name of an environment variable.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"fromFile")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"FromFile expects a path to a file containing the secret value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"claim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Claim is the name of the claim in the session that the value should be",(0,l.kt)("br",null),"loaded from.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"prefix")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Prefix is an optional prefix that will be prepended to the value of the",(0,l.kt)("br",null),"claim if it is non-empty.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"basicAuthPassword")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,l.kt)("td",{parentName:"tr",align:null},"BasicAuthPassword converts this claim into a basic auth header.",(0,l.kt)("br",null),"Note the value of claim will become the basic auth username and the",(0,l.kt)("br",null),"basicAuthPassword will be used as the password value.")))),(0,l.kt)("h3",{id:"secretsource"},"SecretSource"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#claimsource"},"ClaimSource"),", ",(0,l.kt)("a",{parentName:"p",href:"#headervalue"},"HeaderValue"),", ",(0,l.kt)("a",{parentName:"p",href:"#tls"},"TLS"),")"),(0,l.kt)("p",null,"SecretSource references an individual secret value.\nOnly one source within the struct should be defined at any time."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"value")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]byte")),(0,l.kt)("td",{parentName:"tr",align:null},"Value expects a base64 encoded string value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"fromEnv")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"FromEnv expects the name of an environment variable.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"fromFile")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"FromFile expects a path to a file containing the secret value.")))),(0,l.kt)("h3",{id:"server"},"Server"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions"),")"),(0,l.kt)("p",null,"Server represents the configuration for an HTTP(S) server"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"BindAddress")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"BindAddress is the address on which to serve traffic.",(0,l.kt)("br",null),'Leave blank or set to "-" to disable.')),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"SecureBindAddress")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"SecureBindAddress is the address on which to serve secure traffic.",(0,l.kt)("br",null),'Leave blank or set to "-" to disable.')),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"TLS")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#tls"},"TLS"))),(0,l.kt)("td",{parentName:"tr",align:null},"TLS contains the information for loading the certificate and key for the",(0,l.kt)("br",null),"secure traffic.")))),(0,l.kt)("h3",{id:"tls"},"TLS"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#server"},"Server"),")"),(0,l.kt)("p",null,"TLS contains the information for loading a TLS certifcate and key."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"Key")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,l.kt)("td",{parentName:"tr",align:null},"Key is the TLS key data to use.",(0,l.kt)("br",null),"Typically this will come from a file.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"Cert")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,l.kt)("td",{parentName:"tr",align:null},"Cert is the TLS certificate data to use.",(0,l.kt)("br",null),"Typically this will come from a file.")))),(0,l.kt)("h3",{id:"upstream"},"Upstream"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#upstreams"},"Upstreams"),")"),(0,l.kt)("p",null,"Upstream represents the configuration for an upstream server.\nRequests will be proxied to this upstream if the path matches the request path."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"id")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ID should be a unique identifier for the upstream.",(0,l.kt)("br",null),"This value is required for all upstreams.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"path")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Path is used to map requests to the upstream server.",(0,l.kt)("br",null),"The closest match will take precedence and all Paths must be unique.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"uri")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"The URI of the upstream server. This may be an HTTP(S) server of a File",(0,l.kt)("br",null),"based URL. It may include a path, in which case all requests will be served",(0,l.kt)("br",null),"under that path.",(0,l.kt)("br",null),"Eg:",(0,l.kt)("br",null),"- http://localhost:8080",(0,l.kt)("br",null),"- ",(0,l.kt)("a",{parentName:"td",href:"https://service.localhost"},"https://service.localhost"),(0,l.kt)("br",null),"- ",(0,l.kt)("a",{parentName:"td",href:"https://service.localhost/path"},"https://service.localhost/path"),(0,l.kt)("br",null),"- file://host/path",(0,l.kt)("br",null),'If the URI\'s path is "/base" and the incoming request was for "/dir",',(0,l.kt)("br",null),'the upstream request will be for "/base/dir".')),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"insecureSkipTLSVerify")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.",(0,l.kt)("br",null),"This option is insecure and will allow potential Man-In-The-Middle attacks",(0,l.kt)("br",null),"betweem OAuth2 Proxy and the usptream server.",(0,l.kt)("br",null),"Defaults to false.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"static")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"Static will make all requests to this upstream have a static response.",(0,l.kt)("br",null),'The response will have a body of "Authenticated" and a response code',(0,l.kt)("br",null),"matching StaticCode.",(0,l.kt)("br",null),"If StaticCode is not set, the response will return a 200 response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"staticCode")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"int")),(0,l.kt)("td",{parentName:"tr",align:null},"StaticCode determines the response code for the Static response.",(0,l.kt)("br",null),"This option can only be used with Static enabled.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"flushInterval")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#duration"},"Duration"))),(0,l.kt)("td",{parentName:"tr",align:null},"FlushInterval is the period between flushing the response buffer when",(0,l.kt)("br",null),"streaming response from the upstream.",(0,l.kt)("br",null),"Defaults to 1 second.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"passHostHeader")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"PassHostHeader determines whether the request host header should be proxied",(0,l.kt)("br",null),"to the upstream server.",(0,l.kt)("br",null),"Defaults to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"proxyWebSockets")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"ProxyWebSockets enables proxying of websockets to upstream servers",(0,l.kt)("br",null),"Defaults to true.")))),(0,l.kt)("h3",{id:"upstreams"},"Upstreams"),(0,l.kt)("h4",{id:"upstream-alias"},"(",(0,l.kt)("a",{parentName:"h4",href:"#upstream"},"[]Upstream")," alias)"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions"),")"),(0,l.kt)("p",null,"Upstreams is a collection of definitions for upstream servers."))}m.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/js/300a9996.f753e41d.js b/assets/js/300a9996.f753e41d.js new file mode 100644 index 00000000..bca2b29d --- /dev/null +++ b/assets/js/300a9996.f753e41d.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[2593],{3905:function(e,t,n){n.d(t,{Zo:function(){return c},kt:function(){return m}});var r=n(7294);function i(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function o(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function a(e){for(var t=1;t=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var u=r.createContext({}),l=function(e){var t=r.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):a(a({},t),e)),n},c=function(e){var t=l(e.components);return r.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},p=r.forwardRef((function(e,t){var n=e.components,i=e.mdxType,o=e.originalType,u=e.parentName,c=s(e,["components","mdxType","originalType","parentName"]),p=l(n),m=i,y=p["".concat(u,".").concat(m)]||p[m]||d[m]||o;return n?r.createElement(y,a(a({ref:t},c),{},{components:n})):r.createElement(y,a({ref:t},c))}));function m(e,t){var n=arguments,i=t&&t.mdxType;if("string"==typeof e||i){var o=n.length,a=new Array(o);a[0]=p;var s={};for(var u in t)hasOwnProperty.call(t,u)&&(s[u]=t[u]);s.originalType=e,s.mdxType="string"==typeof e?e:i,a[1]=s;for(var l=2;l=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var u=r.createContext({}),l=function(e){var t=r.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):a(a({},t),e)),n},c=function(e){var t=l(e.components);return r.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},p=r.forwardRef((function(e,t){var n=e.components,i=e.mdxType,o=e.originalType,u=e.parentName,c=s(e,["components","mdxType","originalType","parentName"]),p=l(n),m=i,y=p["".concat(u,".").concat(m)]||p[m]||d[m]||o;return n?r.createElement(y,a(a({ref:t},c),{},{components:n})):r.createElement(y,a({ref:t},c))}));function m(e,t){var n=arguments,i=t&&t.mdxType;if("string"==typeof e||i){var o=n.length,a=new Array(o);a[0]=p;var s={};for(var u in t)hasOwnProperty.call(t,u)&&(s[u]=t[u]);s.originalType=e,s.mdxType="string"==typeof e?e:i,a[1]=s;for(var l=2;l=0||(n[o]=e[o]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(a=0;a=0||Object.prototype.propertyIsEnumerable.call(e,o)&&(n[o]=e[o])}return n}var p=a.createContext({}),s=function(e){var t=a.useContext(p),o=t;return e&&(o="function"==typeof e?e(t):i(i({},t),e)),o},c=function(e){var t=s(e.components);return a.createElement(p.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return a.createElement(a.Fragment,{},t)}},d=a.forwardRef((function(e,t){var o=e.components,n=e.mdxType,r=e.originalType,p=e.parentName,c=l(e,["components","mdxType","originalType","parentName"]),d=s(o),h=n,m=d["".concat(p,".").concat(h)]||d[h]||u[h]||r;return o?a.createElement(m,i(i({ref:t},c),{},{components:o})):a.createElement(m,i({ref:t},c))}));function h(e,t){var o=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var r=o.length,i=new Array(r);i[0]=d;var l={};for(var p in t)hasOwnProperty.call(t,p)&&(l[p]=t[p]);l.originalType=e,l.mdxType="string"==typeof e?e:n,i[1]=l;for(var s=2;s\n --client-secret=\n --oidc-issuer-url=https://sts.windows.net/{tenant-id}/\n")),(0,r.kt)("p",null,"Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/next/configuration/session_storage#redis-storage"},"redis session storage")," should resolve this."),(0,r.kt)("h3",{id:"adfs-auth-provider"},"ADFS Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Open the ADFS administration console on your Windows Server and add a new Application Group"),(0,r.kt)("li",{parentName:"ol"},"Provide a name for the integration, select Server Application from the Standalone applications section and click Next"),(0,r.kt)("li",{parentName:"ol"},"Follow the wizard to get the client-id, client-secret and configure the application credentials"),(0,r.kt)("li",{parentName:"ol"},"Configure the proxy with")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=adfs\n --client-id=\n --client-secret=\n")),(0,r.kt)("p",null,"Note: When using the ADFS Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/next/configuration/session_storage#redis-storage"},"redis session storage")," should resolve this."),(0,r.kt)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new FB App from ",(0,r.kt)("a",{parentName:"li",href:"https://developers.facebook.com/"},"https://developers.facebook.com/")),(0,r.kt)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),(0,r.kt)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://github.com/settings/developers"},"https://github.com/settings/developers")),(0,r.kt)("li",{parentName:"ol"},"Under ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),(0,r.kt)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=*")),(0,r.kt)("p",null,"NOTE: When ",(0,r.kt)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),(0,r.kt)("p",null,"To restrict by organization only, include the following flag:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-org="": restrict logins to members of this organisation\n')),(0,r.kt)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",(0,r.kt)("inlineCode",{parentName:"p"},"-github-org"),":"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),(0,r.kt)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),(0,r.kt)("p",null,"If you'd like to allow access to users with ",(0,r.kt)("strong",{parentName:"p"},"read only")," access to a ",(0,r.kt)("strong",{parentName:"p"},"public")," repository you will need to provide a ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/settings/tokens"},"token")," for a user that has write access to the repository. The token must be created with at least the ",(0,r.kt)("inlineCode",{parentName:"p"},"public_repo")," scope:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-token="": the token to use when verifying repository collaborators\n')),(0,r.kt)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-user="": allow logins by username, separated by a comma\n')),(0,r.kt)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-login-url="http(s):///login/oauth/authorize"\n-redeem-url="http(s):///login/oauth/access_token"\n-validate-url="http(s):///api/v3"\n')),(0,r.kt)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),(0,r.kt)("div",{className:"admonition admonition-note alert alert--secondary"},(0,r.kt)("div",{parentName:"div",className:"admonition-heading"},(0,r.kt)("h5",{parentName:"div"},(0,r.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,r.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,r.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"}))),"note")),(0,r.kt)("div",{parentName:"div",className:"admonition-content"},(0,r.kt)("p",{parentName:"div"},"This is the legacy provider for Keycloak, use ",(0,r.kt)("a",{parentName:"p",href:"#keycloak-oidc-auth-provider"},"Keycloak OIDC Auth Provider")," if possible."))),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",(0,r.kt)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",(0,r.kt)("strong",{parentName:"li"},"Valid Redirect URIs")," '",(0,r.kt)("a",{parentName:"li",href:"https://internal.yourcompany.com/oauth2/callback'"},"https://internal.yourcompany.com/oauth2/callback'")),(0,r.kt)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",(0,r.kt)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),(0,r.kt)("p",null,"Make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider=keycloak\n --client-id=\n --client-secret=\n --login-url="http(s):///auth/realms//protocol/openid-connect/auth"\n --redeem-url="http(s):///auth/realms//protocol/openid-connect/token"\n --profile-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n --validate-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n --keycloak-group=\n --keycloak-group=\n')),(0,r.kt)("p",null,"For group based authorization, the optional ",(0,r.kt)("inlineCode",{parentName:"p"},"--keycloak-group")," (legacy) or ",(0,r.kt)("inlineCode",{parentName:"p"},"--allowed-group")," (global standard)\nflags can be used to specify which groups to limit access to."),(0,r.kt)("p",null,"If these are unset but a ",(0,r.kt)("inlineCode",{parentName:"p"},"groups")," mapper is set up above in step (3), the provider will still\npopulate the ",(0,r.kt)("inlineCode",{parentName:"p"},"X-Forwarded-Groups")," header to your upstream server with the ",(0,r.kt)("inlineCode",{parentName:"p"},"groups")," data in the\nKeycloak userinfo endpoint response."),(0,r.kt)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak\nyou should define the 'keycloak-group' value to /admin."),(0,r.kt)("h3",{id:"keycloak-oidc-auth-provider"},"Keycloak OIDC Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",(0,r.kt)("strong",{parentName:"li"},"Access Type")," 'confidental', ",(0,r.kt)("strong",{parentName:"li"},"Client protocol")," 'openid-connect' and ",(0,r.kt)("strong",{parentName:"li"},"Valid Redirect URIs")," '",(0,r.kt)("a",{parentName:"li",href:"https://internal.yourcompany.com/oauth2/callback'"},"https://internal.yourcompany.com/oauth2/callback'")),(0,r.kt)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",(0,r.kt)("strong",{parentName:"li"},"Token Claim Name")," 'groups'."),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Audience' and ",(0,r.kt)("strong",{parentName:"li"},"Included Client Audience")," and ",(0,r.kt)("strong",{parentName:"li"},"Included Custom Audience")," set to your client name.")),(0,r.kt)("p",null,"Make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=keycloak-oidc\n --client-id=\n --client-secret=\n --redirect-url=https://myapp.com/oauth2/callback\n --oidc-issuer-url=https:///auth//basic\n --allowed-role= // Optional, required realm role\n --allowed-role=: // Optional, required client role\n")),(0,r.kt)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),(0,r.kt)("p",null,"This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/issues/994"},"994"),")."),(0,r.kt)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",(0,r.kt)("a",{parentName:"p",href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"},"these steps to add an application"),". Make sure to enable at least the ",(0,r.kt)("inlineCode",{parentName:"p"},"openid"),", ",(0,r.kt)("inlineCode",{parentName:"p"},"profile")," and ",(0,r.kt)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",(0,r.kt)("a",{parentName:"p",href:"https://myapp.com/oauth2/callback"},"https://myapp.com/oauth2/callback"),"."),(0,r.kt)("p",null,"If you need projects filtering, add the extra ",(0,r.kt)("inlineCode",{parentName:"p"},"read_api")," scope to your application."),(0,r.kt)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/next/configuration/overview#generating-a-cookie-secret"},"these steps")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider="gitlab"\n --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n --client-id=GITLAB_CLIENT_ID\n --client-secret=GITLAB_CLIENT_SECRET\n --cookie-secret=COOKIE_SECRET\n')),(0,r.kt)("p",null,"Restricting by group membership is possible with the following option:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),(0,r.kt)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--oidc-issuer-url=""\n')),(0,r.kt)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),(0,r.kt)("p",null,"For LinkedIn, the registration steps are:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://www.linkedin.com/secure/developer"},"https://www.linkedin.com/secure/developer")),(0,r.kt)("li",{parentName:"ol"},"In the OAuth User Agreement section:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),(0,r.kt)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),(0,r.kt)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),(0,r.kt)("li",{parentName:"ol"},"Take note of the ",(0,r.kt)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",(0,r.kt)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),(0,r.kt)("h3",{id:"microsoft-azure-ad-provider"},"Microsoft Azure AD Provider"),(0,r.kt)("p",null,"For adding an application to the Microsoft Azure AD follow ",(0,r.kt)("a",{parentName:"p",href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"},"these steps to add an application"),"."),(0,r.kt)("p",null,"Take note of your ",(0,r.kt)("inlineCode",{parentName:"p"},"TenantId")," if applicable for your situation. The ",(0,r.kt)("inlineCode",{parentName:"p"},"TenantId")," can be used to override the default ",(0,r.kt)("inlineCode",{parentName:"p"},"common")," authorization server with a tenant specific server."),(0,r.kt)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),(0,r.kt)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."),(0,r.kt)("p",null,"This provider was originally built against CoreOS Dex and we will use it as an example.\nThe OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below."),(0,r.kt)("h4",{id:"dex"},"Dex"),(0,r.kt)("p",null,"To configure the OIDC provider for Dex, perform the following steps:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Download Dex:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"go get github.com/dexidp/dex\n")),(0,r.kt)("p",{parentName:"li"},"See the ",(0,r.kt)("a",{parentName:"p",href:"https://dexidp.io/docs/getting-started/"},"getting started guide")," for more details.")),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the ",(0,r.kt)("inlineCode",{parentName:"p"},"staticClients")," section of ",(0,r.kt)("inlineCode",{parentName:"p"},"examples/config-dev.yaml"),":"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"- id: oauth2-proxy\nredirectURIs:\n- 'http://127.0.0.1:4180/oauth2/callback'\nname: 'oauth2-proxy'\nsecret: proxy\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Launch Dex: from ",(0,r.kt)("inlineCode",{parentName:"p"},"$GOPATH/github.com/dexidp/dex"),", run:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"bin/dex serve examples/config-dev.yaml\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"In a second terminal, run the oauth2-proxy with the following args:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'-provider oidc\n-provider-display-name "My OIDC Provider"\n-client-id oauth2-proxy\n-client-secret proxy\n-redirect-url http://127.0.0.1:4180/oauth2/callback\n-oidc-issuer-url http://127.0.0.1:5556/dex\n-cookie-secure=false\n-cookie-secret=secret\n-email-domain kilgore.trout\n')),(0,r.kt)("p",{parentName:"li"},"To serve the current working directory as a web site under the ",(0,r.kt)("inlineCode",{parentName:"p"},"/static")," endpoint, add:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"-upstream file://$PWD/#/static/\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Test the setup by visiting ",(0,r.kt)("a",{parentName:"p",href:"http://127.0.0.1:4180"},"http://127.0.0.1:4180")," or ",(0,r.kt)("a",{parentName:"p",href:"http://127.0.0.1:4180/static"},"http://127.0.0.1:4180/static")," ."))),(0,r.kt)("p",null,"See also ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment"},"our local testing environment")," for a self-contained example using Docker and etcd as storage for Dex."),(0,r.kt)("h4",{id:"okta"},"Okta"),(0,r.kt)("p",null,"To configure the OIDC provider for Okta, perform the following steps:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",(0,r.kt)("inlineCode",{parentName:"li"},"example.oktapreview.com")),(0,r.kt)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",(0,r.kt)("inlineCode",{parentName:"li"},"default")," will work.")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Security")," then select ",(0,r.kt)("strong",{parentName:"li"},"API")),(0,r.kt)("li",{parentName:"ul"},"Click ",(0,r.kt)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),(0,r.kt)("li",{parentName:"ul"},"Fill out the ",(0,r.kt)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),(0,r.kt)("li",{parentName:"ul"},"For ",(0,r.kt)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",(0,r.kt)("a",{parentName:"li",href:"https://example.corp.com"},"https://example.corp.com")),(0,r.kt)("li",{parentName:"ul"},"Fill out a ",(0,r.kt)("strong",{parentName:"li"},"Description")),(0,r.kt)("li",{parentName:"ul"},"Add any ",(0,r.kt)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),(0,r.kt)("li",{parentName:"ul"},"The default settings will work for other options.\n",(0,r.kt)("a",{parentName:"li",href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"},"See Okta documentation for more information on Authorization Servers"))),(0,r.kt)("ol",{start:3},(0,r.kt)("li",{parentName:"ol"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Applications")," then select ",(0,r.kt)("strong",{parentName:"li"},"Add Application"),".")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Select ",(0,r.kt)("strong",{parentName:"li"},"Web")," for the ",(0,r.kt)("strong",{parentName:"li"},"Platform")," setting."),(0,r.kt)("li",{parentName:"ul"},"Select ",(0,r.kt)("strong",{parentName:"li"},"OpenID Connect")," and click ",(0,r.kt)("strong",{parentName:"li"},"Create")),(0,r.kt)("li",{parentName:"ul"},"Pick an ",(0,r.kt)("strong",{parentName:"li"},"Application Name")," such as ",(0,r.kt)("inlineCode",{parentName:"li"},"Example App"),"."),(0,r.kt)("li",{parentName:"ul"},"Set the ",(0,r.kt)("strong",{parentName:"li"},"Login redirect URI")," to ",(0,r.kt)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),(0,r.kt)("li",{parentName:"ul"},"Under ",(0,r.kt)("strong",{parentName:"li"},"General")," set the ",(0,r.kt)("strong",{parentName:"li"},"Allowed grant types")," to ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization Code")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Refresh Token"),"."),(0,r.kt)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",(0,r.kt)("inlineCode",{parentName:"li"},"Client ID")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Client Secret"),"."),(0,r.kt)("li",{parentName:"ul"},"Under ",(0,r.kt)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),(0,r.kt)("ol",{start:4},(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Create a configuration file like the following:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n "https://example.corp.com"\n]\nemail_domains = [\n "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')))),(0,r.kt)("p",null,"The ",(0,r.kt)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",(0,r.kt)("strong",{parentName:"p"},"Authorization Server"),"'s ",(0,r.kt)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",(0,r.kt)("a",{parentName:"p",href:"https://corp.okta.com"},"https://corp.okta.com")," .\nThe ",(0,r.kt)("inlineCode",{parentName:"p"},"client_id")," and ",(0,r.kt)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",(0,r.kt)("inlineCode",{parentName:"p"},"cookie_secret")," to encrypt the cookie."),(0,r.kt)("p",null,"Then you can start the oauth2-proxy with ",(0,r.kt)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),(0,r.kt)("h4",{id:"okta---localhost"},"Okta - localhost"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Signup for developer account: ",(0,r.kt)("a",{parentName:"li",href:"https://developer.okta.com/signup/"},"https://developer.okta.com/signup/")),(0,r.kt)("li",{parentName:"ol"},"Create New ",(0,r.kt)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),(0,r.kt)("li",{parentName:"ol"},"Example Application Settings for localhost:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Name:")," My Web App"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Group assignments:")," ",(0,r.kt)("inlineCode",{parentName:"li"},"Everyone")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Grant type allowed:")," ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization Code")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Refresh Token")))),(0,r.kt)("li",{parentName:"ol"},"Make note of the ",(0,r.kt)("inlineCode",{parentName:"li"},"Client ID")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),(0,r.kt)("li",{parentName:"ol"},"Make note of the ",(0,r.kt)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),(0,r.kt)("li",{parentName:"ol"},"Example config file ",(0,r.kt)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n "http://0.0.0.0:8080"\n]\nemail_domains = [\n "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),(0,r.kt)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",(0,r.kt)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),(0,r.kt)("h3",{id:"logingov-provider"},"login.gov Provider"),(0,r.kt)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",(0,r.kt)("a",{parentName:"p",href:"https://login.gov/developers/"},"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),(0,r.kt)("p",null,"A developer guide is available here: ",(0,r.kt)("a",{parentName:"p",href:"https://developers.login.gov/"},"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),(0,r.kt)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),(0,r.kt)("p",null,"First, register your application in the dashboard. The important bits are:"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Identity protocol: make this ",(0,r.kt)("inlineCode",{parentName:"li"},"Openid connect")),(0,r.kt)("li",{parentName:"ul"},"Issuer: do what they say for OpenID Connect. We will refer to this string as ",(0,r.kt)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),(0,r.kt)("li",{parentName:"ul"},"Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",(0,r.kt)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",(0,r.kt)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",(0,r.kt)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),(0,r.kt)("li",{parentName:"ul"},"Return to App URL: Make this be ",(0,r.kt)("inlineCode",{parentName:"li"},"http://localhost:4180/")),(0,r.kt)("li",{parentName:"ul"},"Redirect URIs: Make this be ",(0,r.kt)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),(0,r.kt)("li",{parentName:"ul"},"Attribute Bundle: Make sure that email is selected.")),(0,r.kt)("p",null,"Now start the proxy up with the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'./oauth2-proxy -provider login.gov \\\n -client-id=${LOGINGOV_ISSUER} \\\n -redirect-url=http://localhost:4180/oauth2/callback \\\n -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n -cookie-secure=false \\\n -email-domain=gsa.gov \\\n -upstream=http://localhost:3000/ \\\n -cookie-secret=somerandomstring12341234567890AB \\\n -cookie-domain=localhost \\\n -skip-provider-button=true \\\n -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),(0,r.kt)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",(0,r.kt)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",(0,r.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",(0,r.kt)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),(0,r.kt)("p",null,"Once it is running, you should be able to go to ",(0,r.kt)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",(0,r.kt)("inlineCode",{parentName:"p"},"http://localhost:3000/"),". In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),(0,r.kt)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),(0,r.kt)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),(0,r.kt)("p",null,"In this case, you can set the ",(0,r.kt)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," -provider oidc\n -client-id oauth2-proxy\n -client-secret proxy\n -redirect-url http://127.0.0.1:4180/oauth2/callback\n -oidc-issuer-url http://127.0.0.1:5556\n -skip-oidc-discovery\n -login-url http://127.0.0.1:5556/authorize\n -redeem-url http://127.0.0.1:5556/token\n -oidc-jwks-url http://127.0.0.1:5556/keys\n -cookie-secure=false\n -email-domain example.com\n")),(0,r.kt)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),(0,r.kt)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),(0,r.kt)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",(0,r.kt)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",(0,r.kt)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),(0,r.kt)("p",null,"Refer to the ",(0,r.kt)("a",{parentName:"p",href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"},"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',(0,r.kt)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' -provider nextcloud\n -client-id \n -client-secret \n -login-url="/index.php/apps/oauth2/authorize"\n -redeem-url="/index.php/apps/oauth2/api/v1/token"\n -validate-url="/ocs/v2.php/cloud/user?format=json"\n')),(0,r.kt)("p",null,"Note: in ",(0,r.kt)("em",{parentName:"p"},"all")," cases the validate-url will ",(0,r.kt)("em",{parentName:"p"},"not")," have the ",(0,r.kt)("inlineCode",{parentName:"p"},"index.php"),"."),(0,r.kt)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("a",{parentName:"li",href:"https://cloud.digitalocean.com/account/api/applications"},"Create a new OAuth application"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),(0,r.kt)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',(0,r.kt)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",(0,r.kt)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),(0,r.kt)("p",null,"To use the provider, pass the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=digitalocean\n --client-id=\n --client-secret=\n")),(0,r.kt)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",(0,r.kt)("inlineCode",{parentName:"p"},"https:///oauth2/callback"),". If you need to change it, you can use the ",(0,r.kt)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),(0,r.kt)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("a",{parentName:"li",href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"},"Add a new OAuth consumer"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},'In "Callback URL" use ',(0,r.kt)("inlineCode",{parentName:"li"},"https:///oauth2/callback"),", substituting ",(0,r.kt)("inlineCode",{parentName:"li"},"")," with the actual hostname that oauth2-proxy is running on."),(0,r.kt)("li",{parentName:"ul"},"In Permissions section select:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"Account -> Email"),(0,r.kt)("li",{parentName:"ul"},"Team membership -> Read"),(0,r.kt)("li",{parentName:"ul"},"Repositories -> Read"))))),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),(0,r.kt)("p",null,"To use the provider, pass the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=bitbucket\n --client-id=\n --client-secret=\n")),(0,r.kt)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",(0,r.kt)("inlineCode",{parentName:"p"},"--bitbucket-team="),". To restrict the access to only these users who has access to one selected repository use ",(0,r.kt)("inlineCode",{parentName:"p"},"--bitbucket-repository="),"."),(0,r.kt)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new application: ",(0,r.kt)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),(0,r.kt)("li",{parentName:"ol"},"Under ",(0,r.kt)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",(0,r.kt)("inlineCode",{parentName:"li"},"https:///oauth2/callback")),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),(0,r.kt)("li",{parentName:"ol"},"Pass the following options to the proxy:")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider="github"\n --redirect-url="https:///oauth2/callback"\n --provider-display-name="Gitea"\n --client-id="< client_id as generated by Gitea >"\n --client-secret="< client_secret as generated by Gitea >"\n --login-url="https://< your gitea host >/login/oauth/authorize"\n --redeem-url="https://< your gitea host >/login/oauth/access_token"\n --validate-url="https://< your gitea host >/api/v1"\n')),(0,r.kt)("h2",{id:"email-authentication"},"Email Authentication"),(0,r.kt)("p",null,"To authorize by email domain use ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",(0,r.kt)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),(0,r.kt)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),(0,r.kt)("p",null,"Follow the examples in the ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"},(0,r.kt)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",(0,r.kt)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",(0,r.kt)("inlineCode",{parentName:"p"},"case")," to\n",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"},(0,r.kt)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",(0,r.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",(0,r.kt)("inlineCode",{parentName:"p"},"Provider"),"."))}d.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/js/3b8c55ea.cd62c80a.js b/assets/js/3b8c55ea.cd62c80a.js new file mode 100644 index 00000000..c1a8f3a4 --- /dev/null +++ b/assets/js/3b8c55ea.cd62c80a.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[3217],{3905:function(e,t,n){n.d(t,{Zo:function(){return c},kt:function(){return f}});var r=n(7294);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function i(e){for(var t=1;t=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var p=r.createContext({}),u=function(e){var t=r.useContext(p),n=t;return e&&(n="function"==typeof e?e(t):i(i({},t),e)),n},c=function(e){var t=u(e.components);return r.createElement(p.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},m=r.forwardRef((function(e,t){var n=e.components,o=e.mdxType,a=e.originalType,p=e.parentName,c=l(e,["components","mdxType","originalType","parentName"]),m=u(n),f=o,d=m["".concat(p,".").concat(f)]||m[f]||s[f]||a;return n?r.createElement(d,i(i({ref:t},c),{},{components:n})):r.createElement(d,i({ref:t},c))}));function f(e,t){var n=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var a=n.length,i=new Array(a);i[0]=m;var l={};for(var p in t)hasOwnProperty.call(t,p)&&(l[p]=t[p]);l.originalType=e,l.mdxType="string"==typeof e?e:o,i[1]=l;for(var u=2;u=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var u=r.createContext({}),l=function(e){var t=r.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):a(a({},t),e)),n},c=function(e){var t=l(e.components);return r.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},p=r.forwardRef((function(e,t){var n=e.components,i=e.mdxType,o=e.originalType,u=e.parentName,c=s(e,["components","mdxType","originalType","parentName"]),p=l(n),m=i,y=p["".concat(u,".").concat(m)]||p[m]||d[m]||o;return n?r.createElement(y,a(a({ref:t},c),{},{components:n})):r.createElement(y,a({ref:t},c))}));function m(e,t){var n=arguments,i=t&&t.mdxType;if("string"==typeof e||i){var o=n.length,a=new Array(o);a[0]=p;var s={};for(var u in t)hasOwnProperty.call(t,u)&&(s[u]=t[u]);s.originalType=e,s.mdxType="string"==typeof e?e:i,a[1]=s;for(var l=2;l=0||(n[o]=e[o]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(a=0;a=0||Object.prototype.propertyIsEnumerable.call(e,o)&&(n[o]=e[o])}return n}var p=a.createContext({}),s=function(e){var t=a.useContext(p),o=t;return e&&(o="function"==typeof e?e(t):i(i({},t),e)),o},u=function(e){var t=s(e.components);return a.createElement(p.Provider,{value:t},e.children)},c={inlineCode:"code",wrapper:function(e){var t=e.children;return a.createElement(a.Fragment,{},t)}},d=a.forwardRef((function(e,t){var o=e.components,n=e.mdxType,r=e.originalType,p=e.parentName,u=l(e,["components","mdxType","originalType","parentName"]),d=s(o),h=n,m=d["".concat(p,".").concat(h)]||d[h]||c[h]||r;return o?a.createElement(m,i(i({ref:t},u),{},{components:o})):a.createElement(m,i({ref:t},u))}));function h(e,t){var o=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var r=o.length,i=new Array(r);i[0]=d;var l={};for(var p in t)hasOwnProperty.call(t,p)&&(l[p]=t[p]);l.originalType=e,l.mdxType="string"==typeof e?e:n,i[1]=l;for(var s=2;s\n --client-secret=\n")),(0,r.kt)("p",null,"Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/6.1.x/configuration/session_storage#redis-storage"},"redis session storage")," should resolve this."),(0,r.kt)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new FB App from ",(0,r.kt)("a",{parentName:"li",href:"https://developers.facebook.com/"},"https://developers.facebook.com/")),(0,r.kt)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),(0,r.kt)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://github.com/settings/developers"},"https://github.com/settings/developers")),(0,r.kt)("li",{parentName:"ol"},"Under ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),(0,r.kt)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=*")),(0,r.kt)("p",null,"NOTE: When ",(0,r.kt)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),(0,r.kt)("p",null,"To restrict by organization only, include the following flag:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-org="": restrict logins to members of this organisation\n')),(0,r.kt)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",(0,r.kt)("inlineCode",{parentName:"p"},"-github-org"),":"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),(0,r.kt)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),(0,r.kt)("p",null,"If you'd like to allow access to users with ",(0,r.kt)("strong",{parentName:"p"},"read only")," access to a ",(0,r.kt)("strong",{parentName:"p"},"public")," repository you will need to provide a ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/settings/tokens"},"token")," for a user that has write access to the repository. The token must be created with at least the ",(0,r.kt)("inlineCode",{parentName:"p"},"public_repo")," scope:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-token="": the token to use when verifying repository collaborators\n')),(0,r.kt)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-user="": allow logins by username, separated by a comma\n')),(0,r.kt)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-login-url="http(s):///login/oauth/authorize"\n-redeem-url="http(s):///login/oauth/access_token"\n-validate-url="http(s):///api/v3"\n')),(0,r.kt)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create new client in your Keycloak with ",(0,r.kt)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",(0,r.kt)("strong",{parentName:"li"},"Valid Redirect URIs")," '",(0,r.kt)("a",{parentName:"li",href:"https://internal.yourcompany.com/oauth2/callback'"},"https://internal.yourcompany.com/oauth2/callback'")),(0,r.kt)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",(0,r.kt)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),(0,r.kt)("p",null,"Make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-provider=keycloak\n-client-id=\n-client-secret=\n-login-url="http(s):///realms//protocol/openid-connect/auth"\n-redeem-url="http(s):///realms//protocol/openid-connect/token"\n-validate-url="http(s):///realms//protocol/openid-connect/userinfo"\n-keycloak-group=\n')),(0,r.kt)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak you should define the 'keycloak-group' value to /admin."),(0,r.kt)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),(0,r.kt)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",(0,r.kt)("a",{parentName:"p",href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"},"these steps to add an application"),". Make sure to enable at least the ",(0,r.kt)("inlineCode",{parentName:"p"},"openid"),", ",(0,r.kt)("inlineCode",{parentName:"p"},"profile")," and ",(0,r.kt)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",(0,r.kt)("a",{parentName:"p",href:"https://myapp.com/oauth2/callback"},"https://myapp.com/oauth2/callback"),"."),(0,r.kt)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/6.1.x/configuration/overview#generating-a-cookie-secret"},"these steps")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider="gitlab"\n --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n --client-id=GITLAB_CLIENT_ID\n --client-secret=GITLAB_CLIENT_SECRET\n --cookie-secret=COOKIE_SECRET\n')),(0,r.kt)("p",null,"Restricting by group membership is possible with the following option:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),(0,r.kt)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--oidc-issuer-url=""\n')),(0,r.kt)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),(0,r.kt)("p",null,"For LinkedIn, the registration steps are:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://www.linkedin.com/secure/developer"},"https://www.linkedin.com/secure/developer")),(0,r.kt)("li",{parentName:"ol"},"In the OAuth User Agreement section:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),(0,r.kt)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),(0,r.kt)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),(0,r.kt)("li",{parentName:"ol"},"Take note of the ",(0,r.kt)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",(0,r.kt)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),(0,r.kt)("h3",{id:"microsoft-azure-ad-provider"},"Microsoft Azure AD Provider"),(0,r.kt)("p",null,"For adding an application to the Microsoft Azure AD follow ",(0,r.kt)("a",{parentName:"p",href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"},"these steps to add an application"),"."),(0,r.kt)("p",null,"Take note of your ",(0,r.kt)("inlineCode",{parentName:"p"},"TenantId")," if applicable for your situation. The ",(0,r.kt)("inlineCode",{parentName:"p"},"TenantId")," can be used to override the default ",(0,r.kt)("inlineCode",{parentName:"p"},"common")," authorization server with a tenant specific server."),(0,r.kt)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),(0,r.kt)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects. This provider was originally built against CoreOS Dex and we will use it as an example."),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Launch a Dex instance using the ",(0,r.kt)("a",{parentName:"li",href:"https://dexidp.io/docs/getting-started/"},"getting started guide"),"."),(0,r.kt)("li",{parentName:"ol"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks."),(0,r.kt)("li",{parentName:"ol"},"Login with the fixture use in the dex guide and run the oauth2-proxy with the following args:")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' -provider oidc\n -provider-display-name "My OIDC Provider"\n -client-id oauth2-proxy\n -client-secret proxy\n -redirect-url http://127.0.0.1:4180/oauth2/callback\n -oidc-issuer-url http://127.0.0.1:5556\n -cookie-secure=false\n -email-domain example.com\n')),(0,r.kt)("p",null,"The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta. To configure the OIDC provider for Okta, perform\nthe following steps:"),(0,r.kt)("h4",{id:"configuring-the-oidc-provider-with-okta"},"Configuring the OIDC Provider with Okta"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",(0,r.kt)("inlineCode",{parentName:"li"},"example.oktapreview.com")),(0,r.kt)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",(0,r.kt)("inlineCode",{parentName:"li"},"default")," will work.")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Security")," then select ",(0,r.kt)("strong",{parentName:"li"},"API")),(0,r.kt)("li",{parentName:"ul"},"Click ",(0,r.kt)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),(0,r.kt)("li",{parentName:"ul"},"Fill out the ",(0,r.kt)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),(0,r.kt)("li",{parentName:"ul"},"For ",(0,r.kt)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",(0,r.kt)("a",{parentName:"li",href:"https://example.corp.com"},"https://example.corp.com")),(0,r.kt)("li",{parentName:"ul"},"Fill out a ",(0,r.kt)("strong",{parentName:"li"},"Description")),(0,r.kt)("li",{parentName:"ul"},"Add any ",(0,r.kt)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),(0,r.kt)("li",{parentName:"ul"},"The default settings will work for other options.\n",(0,r.kt)("a",{parentName:"li",href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"},"See Okta documentation for more information on Authorization Servers"))),(0,r.kt)("ol",{start:3},(0,r.kt)("li",{parentName:"ol"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Applications")," then select ",(0,r.kt)("strong",{parentName:"li"},"Add Application"),".")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Select ",(0,r.kt)("strong",{parentName:"li"},"Web")," for the ",(0,r.kt)("strong",{parentName:"li"},"Platform")," setting."),(0,r.kt)("li",{parentName:"ul"},"Select ",(0,r.kt)("strong",{parentName:"li"},"OpenID Connect")," and click ",(0,r.kt)("strong",{parentName:"li"},"Create")),(0,r.kt)("li",{parentName:"ul"},"Pick an ",(0,r.kt)("strong",{parentName:"li"},"Application Name")," such as ",(0,r.kt)("inlineCode",{parentName:"li"},"Example App"),"."),(0,r.kt)("li",{parentName:"ul"},"Set the ",(0,r.kt)("strong",{parentName:"li"},"Login redirect URI")," to ",(0,r.kt)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),(0,r.kt)("li",{parentName:"ul"},"Under ",(0,r.kt)("strong",{parentName:"li"},"General")," set the ",(0,r.kt)("strong",{parentName:"li"},"Allowed grant types")," to ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization Code")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Refresh Token"),"."),(0,r.kt)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",(0,r.kt)("inlineCode",{parentName:"li"},"Client ID")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Client Secret"),"."),(0,r.kt)("li",{parentName:"ul"},"Under ",(0,r.kt)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),(0,r.kt)("ol",{start:4},(0,r.kt)("li",{parentName:"ol"},"Create a configuration file like the following:")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n "https://example.corp.com"\n]\nemail_domains = [\n "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')),(0,r.kt)("p",null,"The ",(0,r.kt)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",(0,r.kt)("strong",{parentName:"p"},"Authorization Server"),"'s ",(0,r.kt)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",(0,r.kt)("a",{parentName:"p",href:"https://corp.okta.com"},"https://corp.okta.com"),"\nThe ",(0,r.kt)("inlineCode",{parentName:"p"},"client_id")," and ",(0,r.kt)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",(0,r.kt)("inlineCode",{parentName:"p"},"client_secret")," to encrypt the cookie."),(0,r.kt)("p",null,"Then you can start the oauth2-proxy with ",(0,r.kt)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),(0,r.kt)("h4",{id:"configuring-the-oidc-provider-with-okta---localhost"},"Configuring the OIDC Provider with Okta - localhost"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Signup for developer account: ",(0,r.kt)("a",{parentName:"li",href:"https://developer.okta.com/signup/"},"https://developer.okta.com/signup/")),(0,r.kt)("li",{parentName:"ol"},"Create New ",(0,r.kt)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),(0,r.kt)("li",{parentName:"ol"},"Example Application Settings for localhost:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Name:")," My Web App"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Group assignments:")," ",(0,r.kt)("inlineCode",{parentName:"li"},"Everyone")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Grant type allowed:")," ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization Code")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Refresh Token")))),(0,r.kt)("li",{parentName:"ol"},"Make note of the ",(0,r.kt)("inlineCode",{parentName:"li"},"Client ID")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),(0,r.kt)("li",{parentName:"ol"},"Make note of the ",(0,r.kt)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),(0,r.kt)("li",{parentName:"ol"},"Example config file ",(0,r.kt)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n "http://0.0.0.0:8080"\n]\nemail_domains = [\n "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),(0,r.kt)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",(0,r.kt)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),(0,r.kt)("h3",{id:"logingov-provider"},"login.gov Provider"),(0,r.kt)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",(0,r.kt)("a",{parentName:"p",href:"https://login.gov/developers/"},"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),(0,r.kt)("p",null,"A developer guide is available here: ",(0,r.kt)("a",{parentName:"p",href:"https://developers.login.gov/"},"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),(0,r.kt)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),(0,r.kt)("p",null,"First, register your application in the dashboard. The important bits are:"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Identity protocol: make this ",(0,r.kt)("inlineCode",{parentName:"li"},"Openid connect")),(0,r.kt)("li",{parentName:"ul"},"Issuer: do what they say for OpenID Connect. We will refer to this string as ",(0,r.kt)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),(0,r.kt)("li",{parentName:"ul"},"Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",(0,r.kt)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",(0,r.kt)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",(0,r.kt)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),(0,r.kt)("li",{parentName:"ul"},"Return to App URL: Make this be ",(0,r.kt)("inlineCode",{parentName:"li"},"http://localhost:4180/")),(0,r.kt)("li",{parentName:"ul"},"Redirect URIs: Make this be ",(0,r.kt)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),(0,r.kt)("li",{parentName:"ul"},"Attribute Bundle: Make sure that email is selected.")),(0,r.kt)("p",null,"Now start the proxy up with the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'./oauth2-proxy -provider login.gov \\\n -client-id=${LOGINGOV_ISSUER} \\\n -redirect-url=http://localhost:4180/oauth2/callback \\\n -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n -cookie-secure=false \\\n -email-domain=gsa.gov \\\n -upstream=http://localhost:3000/ \\\n -cookie-secret=somerandomstring12341234567890AB \\\n -cookie-domain=localhost \\\n -skip-provider-button=true \\\n -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),(0,r.kt)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",(0,r.kt)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",(0,r.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",(0,r.kt)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),(0,r.kt)("p",null,"Once it is running, you should be able to go to ",(0,r.kt)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",(0,r.kt)("inlineCode",{parentName:"p"},"http://localhost:3000/"),". In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),(0,r.kt)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),(0,r.kt)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),(0,r.kt)("p",null,"In this case, you can set the ",(0,r.kt)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," -provider oidc\n -client-id oauth2-proxy\n -client-secret proxy\n -redirect-url http://127.0.0.1:4180/oauth2/callback\n -oidc-issuer-url http://127.0.0.1:5556\n -skip-oidc-discovery\n -login-url http://127.0.0.1:5556/authorize\n -redeem-url http://127.0.0.1:5556/token\n -oidc-jwks-url http://127.0.0.1:5556/keys\n -cookie-secure=false\n -email-domain example.com\n")),(0,r.kt)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),(0,r.kt)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),(0,r.kt)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",(0,r.kt)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",(0,r.kt)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),(0,r.kt)("p",null,"Refer to the ",(0,r.kt)("a",{parentName:"p",href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"},"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',(0,r.kt)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' -provider nextcloud\n -client-id \n -client-secret \n -login-url="/index.php/apps/oauth2/authorize"\n -redeem-url="/index.php/apps/oauth2/api/v1/token"\n -validate-url="/ocs/v2.php/cloud/user?format=json"\n')),(0,r.kt)("p",null,"Note: in ",(0,r.kt)("em",{parentName:"p"},"all")," cases the validate-url will ",(0,r.kt)("em",{parentName:"p"},"not")," have the ",(0,r.kt)("inlineCode",{parentName:"p"},"index.php"),"."),(0,r.kt)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("a",{parentName:"li",href:"https://cloud.digitalocean.com/account/api/applications"},"Create a new OAuth application"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),(0,r.kt)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',(0,r.kt)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",(0,r.kt)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),(0,r.kt)("p",null,"To use the provider, pass the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=digitalocean\n --client-id=\n --client-secret=\n")),(0,r.kt)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",(0,r.kt)("inlineCode",{parentName:"p"},"https:///oauth2/callback"),". If you need to change it, you can use the ",(0,r.kt)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),(0,r.kt)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("a",{parentName:"li",href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"},"Add a new OAuth consumer"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},'In "Callback URL" use ',(0,r.kt)("inlineCode",{parentName:"li"},"https:///oauth2/callback"),", substituting ",(0,r.kt)("inlineCode",{parentName:"li"},"")," with the actual hostname that oauth2-proxy is running on."),(0,r.kt)("li",{parentName:"ul"},"In Permissions section select:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"Account -> Email"),(0,r.kt)("li",{parentName:"ul"},"Team membership -> Read"),(0,r.kt)("li",{parentName:"ul"},"Repositories -> Read"))))),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),(0,r.kt)("p",null,"To use the provider, pass the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=bitbucket\n --client-id=\n --client-secret=\n")),(0,r.kt)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",(0,r.kt)("inlineCode",{parentName:"p"},"--bitbucket-team="),". To restrict the access to only these users who has access to one selected repository use ",(0,r.kt)("inlineCode",{parentName:"p"},"--bitbucket-repository="),"."),(0,r.kt)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new application: ",(0,r.kt)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),(0,r.kt)("li",{parentName:"ol"},"Under ",(0,r.kt)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",(0,r.kt)("inlineCode",{parentName:"li"},"https:///oauth2/callback")),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),(0,r.kt)("li",{parentName:"ol"},"Pass the following options to the proxy:")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider="github"\n --redirect-url="https:///oauth2/callback"\n --provider-display-name="Gitea"\n --client-id="< client_id as generated by Gitea >"\n --client-secret="< client_secret as generated by Gitea >"\n --login-url="https://< your gitea host >/login/oauth/authorize"\n --redeem-url="https://< your gitea host >/login/oauth/access_token"\n --validate-url="https://< your gitea host >/api/v1"\n')),(0,r.kt)("h2",{id:"email-authentication"},"Email Authentication"),(0,r.kt)("p",null,"To authorize by email domain use ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",(0,r.kt)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),(0,r.kt)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),(0,r.kt)("p",null,"Follow the examples in the ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"},(0,r.kt)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",(0,r.kt)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",(0,r.kt)("inlineCode",{parentName:"p"},"case")," to\n",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"},(0,r.kt)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",(0,r.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",(0,r.kt)("inlineCode",{parentName:"p"},"Provider"),"."))}d.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/js/3fa022c7.d245265c.js b/assets/js/3fa022c7.d245265c.js new file mode 100644 index 00000000..8b582e68 --- /dev/null +++ b/assets/js/3fa022c7.d245265c.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[8967],{3905:function(e,t,a){a.d(t,{Zo:function(){return d},kt:function(){return h}});var n=a(7294);function r(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function i(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function l(e){for(var t=1;t=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var s=n.createContext({}),p=function(e){var t=n.useContext(s),a=t;return e&&(a="function"==typeof e?e(t):l(l({},t),e)),a},d=function(e){var t=p(e.components);return n.createElement(s.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return n.createElement(n.Fragment,{},t)}},m=n.forwardRef((function(e,t){var a=e.components,r=e.mdxType,i=e.originalType,s=e.parentName,d=o(e,["components","mdxType","originalType","parentName"]),m=p(a),h=r,k=m["".concat(s,".").concat(h)]||m[h]||u[h]||i;return a?n.createElement(k,l(l({ref:t},d),{},{components:a})):n.createElement(k,l({ref:t},d))}));function h(e,t){var a=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var i=a.length,l=new Array(i);l[0]=m;var o={};for(var s in t)hasOwnProperty.call(t,s)&&(o[s]=t[s]);o.originalType=e,o.mdxType="string"==typeof e?e:r,l[1]=o;for(var p=2;pstring alias)",id:"string-alias",children:[],level:4}],level:3},{value:"Header",id:"header",children:[],level:3},{value:"HeaderValue",id:"headervalue",children:[],level:3},{value:"SecretSource",id:"secretsource",children:[],level:3},{value:"Upstream",id:"upstream",children:[],level:3},{value:"Upstreams",id:"upstreams",children:[{value:"([]Upstream alias)",id:"upstream-alias",children:[],level:4}],level:3}],level:2}],u={toc:d};function m(e){var t=e.components,a=(0,r.Z)(e,l);return(0,i.kt)("wrapper",(0,n.Z)({},u,a,{components:t,mdxType:"MDXLayout"}),(0,i.kt)("div",{className:"admonition admonition-warning alert alert--danger"},(0,i.kt)("div",{parentName:"div",className:"admonition-heading"},(0,i.kt)("h5",{parentName:"div"},(0,i.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,i.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"12",height:"16",viewBox:"0 0 12 16"},(0,i.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M5.05.31c.81 2.17.41 3.38-.52 4.31C3.55 5.67 1.98 6.45.9 7.98c-1.45 2.05-1.7 6.53 3.53 7.7-2.2-1.16-2.67-4.52-.3-6.61-.61 2.03.53 3.33 1.94 2.86 1.39-.47 2.3.53 2.27 1.67-.02.78-.31 1.44-1.13 1.81 3.42-.59 4.78-3.42 4.78-5.56 0-2.84-2.53-3.22-1.25-5.61-1.52.13-2.03 1.13-1.89 2.75.09 1.08-1.02 1.8-1.86 1.33-.67-.41-.66-1.19-.06-1.78C8.18 5.31 8.68 2.45 5.05.32L5.03.3l.02.01z"}))),"warning")),(0,i.kt)("div",{parentName:"div",className:"admonition-content"},(0,i.kt)("p",{parentName:"div"},"This page contains documentation for alpha features.\nWe reserve the right to make breaking changes to the features detailed within this page with no notice."),(0,i.kt)("p",{parentName:"div"},"Options described in this page may be changed, removed, renamed or moved without prior warning.\nPlease beware of this before you use alpha configuration options."))),(0,i.kt)("p",null,"This page details a set of ",(0,i.kt)("strong",{parentName:"p"},"alpha")," configuration options in a new format.\nGoing forward we are intending to add structured configuration in YAML format to\nreplace the existing TOML based configuration file and flags."),(0,i.kt)("p",null,"Below is a reference for the structure of the configuration, with\n",(0,i.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions")," as the root of the configuration."),(0,i.kt)("p",null,"When using alpha configuration, your config file will look something like below:"),(0,i.kt)("pre",null,(0,i.kt)("code",{parentName:"pre",className:"language-yaml"},"upstreams:\n - id: ...\n ...\ninjectRequestHeaders:\n - name: ...\n ...\ninjectResponseHeaders:\n - name: ...\n ...\n")),(0,i.kt)("p",null,"Please browse the ",(0,i.kt)("a",{parentName:"p",href:"#configuration-reference"},"reference")," below for the structure\nof the new configuration format."),(0,i.kt)("h2",{id:"using-alpha-configuration"},"Using Alpha Configuration"),(0,i.kt)("p",null,"To use the new ",(0,i.kt)("strong",{parentName:"p"},"alpha")," configuration, generate a YAML file based on the format\ndescribed in the ",(0,i.kt)("a",{parentName:"p",href:"#configuration-reference"},"reference")," below."),(0,i.kt)("p",null,"Provide the path to this file using the ",(0,i.kt)("inlineCode",{parentName:"p"},"--alpha-config")," flag."),(0,i.kt)("div",{className:"admonition admonition-note alert alert--secondary"},(0,i.kt)("div",{parentName:"div",className:"admonition-heading"},(0,i.kt)("h5",{parentName:"div"},(0,i.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,i.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,i.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"}))),"note")),(0,i.kt)("div",{parentName:"div",className:"admonition-content"},(0,i.kt)("p",{parentName:"div"},"When using the ",(0,i.kt)("inlineCode",{parentName:"p"},"--alpha-config")," flag, some options are no longer available.\nSee ",(0,i.kt)("a",{parentName:"p",href:"#removed-options"},"removed options")," below for more information."))),(0,i.kt)("h3",{id:"converting-configuration-to-the-new-structure"},"Converting configuration to the new structure"),(0,i.kt)("p",null,"Before adding the new ",(0,i.kt)("inlineCode",{parentName:"p"},"--alpha-config")," option, start OAuth2 Proxy using the\n",(0,i.kt)("inlineCode",{parentName:"p"},"convert-config-to-alpha")," flag to convert existing configuration to the new format."),(0,i.kt)("pre",null,(0,i.kt)("code",{parentName:"pre",className:"language-bash"},"oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg\n")),(0,i.kt)("p",null,"This will convert any options supported by the new format to YAML and print the\nnew configuration to ",(0,i.kt)("inlineCode",{parentName:"p"},"STDOUT"),"."),(0,i.kt)("p",null,"Copy this to a new file, remove any options from your existing configuration\nnoted in ",(0,i.kt)("a",{parentName:"p",href:"#removed-options"},"removed options")," and then start OAuth2 Proxy using\nthe new config."),(0,i.kt)("pre",null,(0,i.kt)("code",{parentName:"pre",className:"language-bash"},"oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg\n")),(0,i.kt)("h2",{id:"removed-options"},"Removed options"),(0,i.kt)("p",null,"The following flags/options and their respective environment variables are no\nlonger available when using alpha configuration:"),(0,i.kt)("ul",null,(0,i.kt)("li",{parentName:"ul"},(0,i.kt)("inlineCode",{parentName:"li"},"flush-interval"),"/",(0,i.kt)("inlineCode",{parentName:"li"},"flush_interval")),(0,i.kt)("li",{parentName:"ul"},(0,i.kt)("inlineCode",{parentName:"li"},"pass-host-header"),"/",(0,i.kt)("inlineCode",{parentName:"li"},"pass_host_header")),(0,i.kt)("li",{parentName:"ul"},(0,i.kt)("inlineCode",{parentName:"li"},"proxy-websockets"),"/",(0,i.kt)("inlineCode",{parentName:"li"},"proxy_websockets")),(0,i.kt)("li",{parentName:"ul"},(0,i.kt)("inlineCode",{parentName:"li"},"ssl-upstream-insecure-skip-verify"),"/",(0,i.kt)("inlineCode",{parentName:"li"},"ssl_upstream_insecure_skip_verify")),(0,i.kt)("li",{parentName:"ul"},(0,i.kt)("inlineCode",{parentName:"li"},"upstream"),"/",(0,i.kt)("inlineCode",{parentName:"li"},"upstreams"))),(0,i.kt)("ul",null,(0,i.kt)("li",{parentName:"ul"},(0,i.kt)("inlineCode",{parentName:"li"},"pass-basic-auth"),"/",(0,i.kt)("inlineCode",{parentName:"li"},"pass_basic_auth")),(0,i.kt)("li",{parentName:"ul"},(0,i.kt)("inlineCode",{parentName:"li"},"pass-access-token"),"/",(0,i.kt)("inlineCode",{parentName:"li"},"pass_access_token")),(0,i.kt)("li",{parentName:"ul"},(0,i.kt)("inlineCode",{parentName:"li"},"pass-user-headers"),"/",(0,i.kt)("inlineCode",{parentName:"li"},"pass_user_headers")),(0,i.kt)("li",{parentName:"ul"},(0,i.kt)("inlineCode",{parentName:"li"},"pass-authorization-header"),"/",(0,i.kt)("inlineCode",{parentName:"li"},"pass_authorization_header")),(0,i.kt)("li",{parentName:"ul"},(0,i.kt)("inlineCode",{parentName:"li"},"set-basic-auth"),"/",(0,i.kt)("inlineCode",{parentName:"li"},"set_basic_auth")),(0,i.kt)("li",{parentName:"ul"},(0,i.kt)("inlineCode",{parentName:"li"},"set-xauthrequest"),"/",(0,i.kt)("inlineCode",{parentName:"li"},"set_xauthrequest")),(0,i.kt)("li",{parentName:"ul"},(0,i.kt)("inlineCode",{parentName:"li"},"set-authorization-header"),"/",(0,i.kt)("inlineCode",{parentName:"li"},"set_authorization_header")),(0,i.kt)("li",{parentName:"ul"},(0,i.kt)("inlineCode",{parentName:"li"},"prefer-email-to-user"),"/",(0,i.kt)("inlineCode",{parentName:"li"},"prefer_email_to_user")),(0,i.kt)("li",{parentName:"ul"},(0,i.kt)("inlineCode",{parentName:"li"},"basic-auth-password"),"/",(0,i.kt)("inlineCode",{parentName:"li"},"basic_auth_password")),(0,i.kt)("li",{parentName:"ul"},(0,i.kt)("inlineCode",{parentName:"li"},"skip-auth-strip-headers"),"/",(0,i.kt)("inlineCode",{parentName:"li"},"skip_auth_strip_headers"))),(0,i.kt)("p",null,"Attempting to use these options via flags or via config when ",(0,i.kt)("inlineCode",{parentName:"p"},"--alpha-config"),"\nset will result in an error."),(0,i.kt)("div",{className:"admonition admonition-important alert alert--info"},(0,i.kt)("div",{parentName:"div",className:"admonition-heading"},(0,i.kt)("h5",{parentName:"div"},(0,i.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,i.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,i.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"}))),"important")),(0,i.kt)("div",{parentName:"div",className:"admonition-content"},(0,i.kt)("p",{parentName:"div"},"You must remove these options before starting OAuth2 Proxy with ",(0,i.kt)("inlineCode",{parentName:"p"},"--alpha-config")))),(0,i.kt)("h2",{id:"configuration-reference"},"Configuration Reference"),(0,i.kt)("h3",{id:"alphaoptions"},"AlphaOptions"),(0,i.kt)("p",null,"AlphaOptions contains alpha structured configuration options.\nUsage of these options allows users to access alpha features that are not\navailable as part of the primary configuration structure for OAuth2 Proxy."),(0,i.kt)("div",{className:"admonition admonition-warning alert alert--danger"},(0,i.kt)("div",{parentName:"div",className:"admonition-heading"},(0,i.kt)("h5",{parentName:"div"},(0,i.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,i.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"12",height:"16",viewBox:"0 0 12 16"},(0,i.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M5.05.31c.81 2.17.41 3.38-.52 4.31C3.55 5.67 1.98 6.45.9 7.98c-1.45 2.05-1.7 6.53 3.53 7.7-2.2-1.16-2.67-4.52-.3-6.61-.61 2.03.53 3.33 1.94 2.86 1.39-.47 2.3.53 2.27 1.67-.02.78-.31 1.44-1.13 1.81 3.42-.59 4.78-3.42 4.78-5.56 0-2.84-2.53-3.22-1.25-5.61-1.52.13-2.03 1.13-1.89 2.75.09 1.08-1.02 1.8-1.86 1.33-.67-.41-.66-1.19-.06-1.78C8.18 5.31 8.68 2.45 5.05.32L5.03.3l.02.01z"}))),"warning")),(0,i.kt)("div",{parentName:"div",className:"admonition-content"},(0,i.kt)("p",{parentName:"div"},"The options within this structure are considered alpha.\nThey may change between releases without notice."))),(0,i.kt)("table",null,(0,i.kt)("thead",{parentName:"table"},(0,i.kt)("tr",{parentName:"thead"},(0,i.kt)("th",{parentName:"tr",align:null},"Field"),(0,i.kt)("th",{parentName:"tr",align:null},"Type"),(0,i.kt)("th",{parentName:"tr",align:null},"Description"))),(0,i.kt)("tbody",{parentName:"table"},(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"upstreams")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},(0,i.kt)("a",{parentName:"em",href:"#upstreams"},"Upstreams"))),(0,i.kt)("td",{parentName:"tr",align:null},"Upstreams is used to configure upstream servers.",(0,i.kt)("br",null),"Once a user is authenticated, requests to the server will be proxied to",(0,i.kt)("br",null),"these upstream servers based on the path mappings defined in this list.")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"injectRequestHeaders")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},(0,i.kt)("a",{parentName:"em",href:"#header"},"[]Header"))),(0,i.kt)("td",{parentName:"tr",align:null},"InjectRequestHeaders is used to configure headers that should be added",(0,i.kt)("br",null),"to requests to upstream servers.",(0,i.kt)("br",null),"Headers may source values from either the authenticated user's session",(0,i.kt)("br",null),"or from a static secret value.")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"injectResponseHeaders")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},(0,i.kt)("a",{parentName:"em",href:"#header"},"[]Header"))),(0,i.kt)("td",{parentName:"tr",align:null},"InjectResponseHeaders is used to configure headers that should be added",(0,i.kt)("br",null),"to responses from the proxy.",(0,i.kt)("br",null),"This is typically used when using the proxy as an external authentication",(0,i.kt)("br",null),"provider in conjunction with another proxy such as NGINX and its",(0,i.kt)("br",null),"auth_request module.",(0,i.kt)("br",null),"Headers may source values from either the authenticated user's session",(0,i.kt)("br",null),"or from a static secret value.")))),(0,i.kt)("h3",{id:"claimsource"},"ClaimSource"),(0,i.kt)("p",null,"(",(0,i.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,i.kt)("a",{parentName:"p",href:"#headervalue"},"HeaderValue"),")"),(0,i.kt)("p",null,"ClaimSource allows loading a header value from a claim within the session"),(0,i.kt)("table",null,(0,i.kt)("thead",{parentName:"table"},(0,i.kt)("tr",{parentName:"thead"},(0,i.kt)("th",{parentName:"tr",align:null},"Field"),(0,i.kt)("th",{parentName:"tr",align:null},"Type"),(0,i.kt)("th",{parentName:"tr",align:null},"Description"))),(0,i.kt)("tbody",{parentName:"table"},(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"claim")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},"string")),(0,i.kt)("td",{parentName:"tr",align:null},"Claim is the name of the claim in the session that the value should be",(0,i.kt)("br",null),"loaded from.")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"prefix")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},"string")),(0,i.kt)("td",{parentName:"tr",align:null},"Prefix is an optional prefix that will be prepended to the value of the",(0,i.kt)("br",null),"claim if it is non-empty.")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"basicAuthPassword")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},(0,i.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,i.kt)("td",{parentName:"tr",align:null},"BasicAuthPassword converts this claim into a basic auth header.",(0,i.kt)("br",null),"Note the value of claim will become the basic auth username and the",(0,i.kt)("br",null),"basicAuthPassword will be used as the password value.")))),(0,i.kt)("h3",{id:"duration"},"Duration"),(0,i.kt)("h4",{id:"string-alias"},"(",(0,i.kt)("inlineCode",{parentName:"h4"},"string")," alias)"),(0,i.kt)("p",null,"(",(0,i.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,i.kt)("a",{parentName:"p",href:"#upstream"},"Upstream"),")"),(0,i.kt)("p",null,'Duration is as string representation of a period of time.\nA duration string is a is a possibly signed sequence of decimal numbers,\neach with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".\nValid time units are "ns", "us" (or "\xb5s"), "ms", "s", "m", "h".'),(0,i.kt)("h3",{id:"header"},"Header"),(0,i.kt)("p",null,"(",(0,i.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,i.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions"),")"),(0,i.kt)("p",null,"Header represents an individual header that will be added to a request or\nresponse header."),(0,i.kt)("table",null,(0,i.kt)("thead",{parentName:"table"},(0,i.kt)("tr",{parentName:"thead"},(0,i.kt)("th",{parentName:"tr",align:null},"Field"),(0,i.kt)("th",{parentName:"tr",align:null},"Type"),(0,i.kt)("th",{parentName:"tr",align:null},"Description"))),(0,i.kt)("tbody",{parentName:"table"},(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"name")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},"string")),(0,i.kt)("td",{parentName:"tr",align:null},"Name is the header name to be used for this set of values.",(0,i.kt)("br",null),"Names should be unique within a list of Headers.")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"preserveRequestValue")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},"bool")),(0,i.kt)("td",{parentName:"tr",align:null},"PreserveRequestValue determines whether any values for this header",(0,i.kt)("br",null),"should be preserved for the request to the upstream server.",(0,i.kt)("br",null),"This option only applies to injected request headers.",(0,i.kt)("br",null),"Defaults to false (headers that match this header will be stripped).")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"values")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},(0,i.kt)("a",{parentName:"em",href:"#headervalue"},"[]HeaderValue"))),(0,i.kt)("td",{parentName:"tr",align:null},"Values contains the desired values for this header")))),(0,i.kt)("h3",{id:"headervalue"},"HeaderValue"),(0,i.kt)("p",null,"(",(0,i.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,i.kt)("a",{parentName:"p",href:"#header"},"Header"),")"),(0,i.kt)("p",null,"HeaderValue represents a single header value and the sources that can\nmake up the header value"),(0,i.kt)("table",null,(0,i.kt)("thead",{parentName:"table"},(0,i.kt)("tr",{parentName:"thead"},(0,i.kt)("th",{parentName:"tr",align:null},"Field"),(0,i.kt)("th",{parentName:"tr",align:null},"Type"),(0,i.kt)("th",{parentName:"tr",align:null},"Description"))),(0,i.kt)("tbody",{parentName:"table"},(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"value")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},"[]byte")),(0,i.kt)("td",{parentName:"tr",align:null},"Value expects a base64 encoded string value.")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"fromEnv")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},"string")),(0,i.kt)("td",{parentName:"tr",align:null},"FromEnv expects the name of an environment variable.")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"fromFile")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},"string")),(0,i.kt)("td",{parentName:"tr",align:null},"FromFile expects a path to a file containing the secret value.")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"claim")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},"string")),(0,i.kt)("td",{parentName:"tr",align:null},"Claim is the name of the claim in the session that the value should be",(0,i.kt)("br",null),"loaded from.")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"prefix")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},"string")),(0,i.kt)("td",{parentName:"tr",align:null},"Prefix is an optional prefix that will be prepended to the value of the",(0,i.kt)("br",null),"claim if it is non-empty.")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"basicAuthPassword")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},(0,i.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,i.kt)("td",{parentName:"tr",align:null},"BasicAuthPassword converts this claim into a basic auth header.",(0,i.kt)("br",null),"Note the value of claim will become the basic auth username and the",(0,i.kt)("br",null),"basicAuthPassword will be used as the password value.")))),(0,i.kt)("h3",{id:"secretsource"},"SecretSource"),(0,i.kt)("p",null,"(",(0,i.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,i.kt)("a",{parentName:"p",href:"#claimsource"},"ClaimSource"),", ",(0,i.kt)("a",{parentName:"p",href:"#headervalue"},"HeaderValue"),")"),(0,i.kt)("p",null,"SecretSource references an individual secret value.\nOnly one source within the struct should be defined at any time."),(0,i.kt)("table",null,(0,i.kt)("thead",{parentName:"table"},(0,i.kt)("tr",{parentName:"thead"},(0,i.kt)("th",{parentName:"tr",align:null},"Field"),(0,i.kt)("th",{parentName:"tr",align:null},"Type"),(0,i.kt)("th",{parentName:"tr",align:null},"Description"))),(0,i.kt)("tbody",{parentName:"table"},(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"value")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},"[]byte")),(0,i.kt)("td",{parentName:"tr",align:null},"Value expects a base64 encoded string value.")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"fromEnv")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},"string")),(0,i.kt)("td",{parentName:"tr",align:null},"FromEnv expects the name of an environment variable.")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"fromFile")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},"string")),(0,i.kt)("td",{parentName:"tr",align:null},"FromFile expects a path to a file containing the secret value.")))),(0,i.kt)("h3",{id:"upstream"},"Upstream"),(0,i.kt)("p",null,"(",(0,i.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,i.kt)("a",{parentName:"p",href:"#upstreams"},"Upstreams"),")"),(0,i.kt)("p",null,"Upstream represents the configuration for an upstream server.\nRequests will be proxied to this upstream if the path matches the request path."),(0,i.kt)("table",null,(0,i.kt)("thead",{parentName:"table"},(0,i.kt)("tr",{parentName:"thead"},(0,i.kt)("th",{parentName:"tr",align:null},"Field"),(0,i.kt)("th",{parentName:"tr",align:null},"Type"),(0,i.kt)("th",{parentName:"tr",align:null},"Description"))),(0,i.kt)("tbody",{parentName:"table"},(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"id")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},"string")),(0,i.kt)("td",{parentName:"tr",align:null},"ID should be a unique identifier for the upstream.",(0,i.kt)("br",null),"This value is required for all upstreams.")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"path")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},"string")),(0,i.kt)("td",{parentName:"tr",align:null},"Path is used to map requests to the upstream server.",(0,i.kt)("br",null),"The closest match will take precedence and all Paths must be unique.")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"uri")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},"string")),(0,i.kt)("td",{parentName:"tr",align:null},"The URI of the upstream server. This may be an HTTP(S) server of a File",(0,i.kt)("br",null),"based URL. It may include a path, in which case all requests will be served",(0,i.kt)("br",null),"under that path.",(0,i.kt)("br",null),"Eg:",(0,i.kt)("br",null),"- http://localhost:8080",(0,i.kt)("br",null),"- ",(0,i.kt)("a",{parentName:"td",href:"https://service.localhost"},"https://service.localhost"),(0,i.kt)("br",null),"- ",(0,i.kt)("a",{parentName:"td",href:"https://service.localhost/path"},"https://service.localhost/path"),(0,i.kt)("br",null),"- file://host/path",(0,i.kt)("br",null),'If the URI\'s path is "/base" and the incoming request was for "/dir",',(0,i.kt)("br",null),'the upstream request will be for "/base/dir".')),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"insecureSkipTLSVerify")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},"bool")),(0,i.kt)("td",{parentName:"tr",align:null},"InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.",(0,i.kt)("br",null),"This option is insecure and will allow potential Man-In-The-Middle attacks",(0,i.kt)("br",null),"betweem OAuth2 Proxy and the usptream server.",(0,i.kt)("br",null),"Defaults to false.")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"static")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},"bool")),(0,i.kt)("td",{parentName:"tr",align:null},"Static will make all requests to this upstream have a static response.",(0,i.kt)("br",null),'The response will have a body of "Authenticated" and a response code',(0,i.kt)("br",null),"matching StaticCode.",(0,i.kt)("br",null),"If StaticCode is not set, the response will return a 200 response.")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"staticCode")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},"int")),(0,i.kt)("td",{parentName:"tr",align:null},"StaticCode determines the response code for the Static response.",(0,i.kt)("br",null),"This option can only be used with Static enabled.")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"flushInterval")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},(0,i.kt)("a",{parentName:"em",href:"#duration"},"Duration"))),(0,i.kt)("td",{parentName:"tr",align:null},"FlushInterval is the period between flushing the response buffer when",(0,i.kt)("br",null),"streaming response from the upstream.",(0,i.kt)("br",null),"Defaults to 1 second.")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"passHostHeader")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},"bool")),(0,i.kt)("td",{parentName:"tr",align:null},"PassHostHeader determines whether the request host header should be proxied",(0,i.kt)("br",null),"to the upstream server.",(0,i.kt)("br",null),"Defaults to true.")),(0,i.kt)("tr",{parentName:"tbody"},(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("inlineCode",{parentName:"td"},"proxyWebSockets")),(0,i.kt)("td",{parentName:"tr",align:null},(0,i.kt)("em",{parentName:"td"},"bool")),(0,i.kt)("td",{parentName:"tr",align:null},"ProxyWebSockets enables proxying of websockets to upstream servers",(0,i.kt)("br",null),"Defaults to true.")))),(0,i.kt)("h3",{id:"upstreams"},"Upstreams"),(0,i.kt)("h4",{id:"upstream-alias"},"(",(0,i.kt)("a",{parentName:"h4",href:"#upstream"},"[]Upstream")," alias)"),(0,i.kt)("p",null,"(",(0,i.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,i.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions"),")"),(0,i.kt)("p",null,"Upstreams is a collection of definitions for upstream servers."))}m.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/js/41de83de.41ba64ac.js b/assets/js/41de83de.41ba64ac.js new file mode 100644 index 00000000..6a9f3819 --- /dev/null +++ b/assets/js/41de83de.41ba64ac.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[7250],{3905:function(e,t,r){r.d(t,{Zo:function(){return p},kt:function(){return f}});var n=r(7294);function o(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function i(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function a(e){for(var t=1;t=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var s=n.createContext({}),c=function(e){var t=n.useContext(s),r=t;return e&&(r="function"==typeof e?e(t):a(a({},t),e)),r},p=function(e){var t=c(e.components);return n.createElement(s.Provider,{value:t},e.children)},l={inlineCode:"code",wrapper:function(e){var t=e.children;return n.createElement(n.Fragment,{},t)}},d=n.forwardRef((function(e,t){var r=e.components,o=e.mdxType,i=e.originalType,s=e.parentName,p=u(e,["components","mdxType","originalType","parentName"]),d=c(r),f=o,h=d["".concat(s,".").concat(f)]||d[f]||l[f]||i;return r?n.createElement(h,a(a({ref:t},p),{},{components:r})):n.createElement(h,a({ref:t},p))}));function f(e,t){var r=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var i=r.length,a=new Array(i);a[0]=d;var u={};for(var s in t)hasOwnProperty.call(t,s)&&(u[s]=t[s]);u.originalType=e,u.mdxType="string"==typeof e?e:o,a[1]=u;for(var c=2;c=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var s=n.createContext({}),c=function(e){var t=n.useContext(s),r=t;return e&&(r="function"==typeof e?e(t):a(a({},t),e)),r},p=function(e){var t=c(e.components);return n.createElement(s.Provider,{value:t},e.children)},l={inlineCode:"code",wrapper:function(e){var t=e.children;return n.createElement(n.Fragment,{},t)}},d=n.forwardRef((function(e,t){var r=e.components,o=e.mdxType,i=e.originalType,s=e.parentName,p=u(e,["components","mdxType","originalType","parentName"]),d=c(r),f=o,h=d["".concat(s,".").concat(f)]||d[f]||l[f]||i;return r?n.createElement(h,a(a({ref:t},p),{},{components:r})):n.createElement(h,a({ref:t},p))}));function f(e,t){var r=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var i=r.length,a=new Array(i);a[0]=d;var u={};for(var s in t)hasOwnProperty.call(t,s)&&(u[s]=t[s]);u.originalType=e,u.mdxType="string"==typeof e?e:o,a[1]=u;for(var c=2;c=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var l=r.createContext({}),c=function(e){var t=r.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):i(i({},t),e)),n},s=function(e){var t=c(e.components);return r.createElement(l.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},m=r.forwardRef((function(e,t){var n=e.components,o=e.mdxType,a=e.originalType,l=e.parentName,s=p(e,["components","mdxType","originalType","parentName"]),m=c(n),d=o,f=m["".concat(l,".").concat(d)]||m[d]||u[d]||a;return n?r.createElement(f,i(i({ref:t},s),{},{components:n})):r.createElement(f,i({ref:t},s))}));function d(e,t){var n=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var a=n.length,i=new Array(a);i[0]=m;var p={};for(var l in t)hasOwnProperty.call(t,l)&&(p[l]=t[l]);p.originalType=e,p.mdxType="string"==typeof e?e:o,i[1]=p;for(var c=2;c=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var i=r.createContext({}),s=function(e){var t=r.useContext(i),n=t;return e&&(n="function"==typeof e?e(t):l(l({},t),e)),n},u=function(e){var t=s(e.components);return r.createElement(i.Provider,{value:t},e.children)},p={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},d=r.forwardRef((function(e,t){var n=e.components,o=e.mdxType,a=e.originalType,i=e.parentName,u=c(e,["components","mdxType","originalType","parentName"]),d=s(n),m=o,y=d["".concat(i,".").concat(m)]||d[m]||p[m]||a;return n?r.createElement(y,l(l({ref:t},u),{},{components:n})):r.createElement(y,l({ref:t},u))}));function m(e,t){var n=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var a=n.length,l=new Array(a);l[0]=d;var c={};for(var i in t)hasOwnProperty.call(t,i)&&(c[i]=t[i]);c.originalType=e,c.mdxType="string"==typeof e?e:o,l[1]=c;for(var s=2;s0&&e[n-1]===t?e:e.concat(t)},h=function(e,t){var n=e.plain,r=Object.create(null),o=e.styles.reduce((function(e,n){var r=n.languages,o=n.style;return r&&!r.includes(t)||n.types.forEach((function(t){var n=d({},e[t],o);e[t]=n})),e}),r);return o.root=n,o.plain=d({},n,{backgroundColor:null}),o};function g(e,t){var n={};for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&-1===t.indexOf(r)&&(n[r]=e[r]);return n}var v=function(e){function t(){for(var t=this,n=[],r=arguments.length;r--;)n[r]=arguments[r];e.apply(this,n),p(this,"getThemeDict",(function(e){if(void 0!==t.themeDict&&e.theme===t.prevTheme&&e.language===t.prevLanguage)return t.themeDict;t.prevTheme=e.theme,t.prevLanguage=e.language;var n=e.theme?h(e.theme,e.language):void 0;return t.themeDict=n})),p(this,"getLineProps",(function(e){var n=e.key,r=e.className,o=e.style,a=d({},g(e,["key","className","style","line"]),{className:"token-line",style:void 0,key:void 0}),l=t.getThemeDict(t.props);return void 0!==l&&(a.style=l.plain),void 0!==o&&(a.style=void 0!==a.style?d({},a.style,o):o),void 0!==n&&(a.key=n),r&&(a.className+=" "+r),a})),p(this,"getStyleForToken",(function(e){var n=e.types,r=e.empty,o=n.length,a=t.getThemeDict(t.props);if(void 0!==a){if(1===o&&"plain"===n[0])return r?{display:"inline-block"}:void 0;if(1===o&&!r)return a[n[0]];var l=r?{display:"inline-block"}:{},c=n.map((function(e){return a[e]}));return Object.assign.apply(Object,[l].concat(c))}})),p(this,"getTokenProps",(function(e){var n=e.key,r=e.className,o=e.style,a=e.token,l=d({},g(e,["key","className","style","token"]),{className:"token "+a.types.join(" "),children:a.content,style:t.getStyleForToken(a),key:void 0});return void 0!==o&&(l.style=void 0!==l.style?d({},l.style,o):o),void 0!==n&&(l.key=n),r&&(l.className+=" "+r),l})),p(this,"tokenize",(function(e,t,n,r){var o={code:t,grammar:n,language:r,tokens:[]};e.hooks.run("before-tokenize",o);var a=o.tokens=e.tokenize(o.code,o.grammar,o.language);return e.hooks.run("after-tokenize",o),a}))}return e&&(t.__proto__=e),t.prototype=Object.create(e&&e.prototype),t.prototype.constructor=t,t.prototype.render=function(){var e=this.props,t=e.Prism,n=e.language,r=e.code,o=e.children,a=this.getThemeDict(this.props),l=t.languages[n];return o({tokens:function(e){for(var t=[[]],n=[e],r=[0],o=[e.length],a=0,l=0,c=[],i=[c];l>-1;){for(;(a=r[l]++)0?u:["plain"],s=p):(u=f(u,p.type),p.alias&&(u=f(u,p.alias)),s=p.content),"string"==typeof s){var d=s.split(m),h=d.length;c.push({types:u,content:d[0]});for(var g=1;g0&&(c=l.getRangeAt(0)),r.append(o),o.select(),o.selectionStart=0,o.selectionEnd=e.length;var i=!1;try{i=document.execCommand("copy")}catch(s){}o.remove(),c&&(l.removeAllRanges(),l.addRange(c)),a&&a.focus()}(L),f(!0),setTimeout((function(){return f(!1)}),2e3)};return a.createElement(b,(0,r.Z)({},u,{key:String(g),theme:w,code:L,language:null!=A?A:"text"}),(function(e){var t,n=e.className,o=e.style,c=e.tokens,s=e.getLineProps,u=e.getTokenProps;return a.createElement("div",{className:(0,i.Z)(O,l,(t={},t["language-"+A]=A&&!l.includes("language-"+A),t),E.kM.common.codeBlock)},C&&a.createElement("div",{style:o,className:T},C),a.createElement("div",{className:(0,i.Z)(Z,A)},a.createElement("pre",{tabIndex:0,className:(0,i.Z)(n,N,"thin-scrollbar"),style:o},a.createElement("code",{className:x},c.map((function(e,t){1===e.length&&"\n"===e[0].content&&(e[0].content="");var n=s({line:e,key:t});return D.includes(t)&&(n.className+=" docusaurus-highlight-code-line"),a.createElement("span",(0,r.Z)({key:t},n),e.map((function(e,t){return a.createElement("span",(0,r.Z)({key:t},u({token:e,key:t})))})),a.createElement("br",null))})))),a.createElement("button",{type:"button","aria-label":(0,k.I)({id:"theme.CodeBlock.copyButtonAriaLabel",message:"Copy code to clipboard",description:"The ARIA label for copy code blocks button"}),className:(0,i.Z)(P,"clean-btn"),onClick:_},y?a.createElement(k.Z,{id:"theme.CodeBlock.copied",description:"The copied button label on code blocks"},"Copied"):a.createElement(k.Z,{id:"theme.CodeBlock.copy",description:"The copy button label on code blocks"},"Copy"))))}))}var w=n(9649),S="details_BAp3";function A(e){var t=Object.assign({},e);return a.createElement(E.PO,(0,r.Z)({},t,{className:(0,i.Z)("alert alert--info",S,t.className)}))}var B=["mdxType","originalType"];var D={head:function(e){var t=a.Children.map(e.children,(function(e){return function(e){var t,n;if(null!=e&&null!=(t=e.props)&&t.mdxType&&null!=e&&null!=(n=e.props)&&n.originalType){var r=e.props,l=(r.mdxType,r.originalType,(0,o.Z)(r,B));return a.createElement(e.props.originalType,l)}return e}(e)}));return a.createElement(l.Z,e,t)},code:function(e){return a.Children.toArray(e.children).every((function(e){return"string"==typeof e&&!e.includes("\n")}))?a.createElement("code",e):a.createElement(C,e)},a:function(e){return a.createElement(c.Z,e)},pre:function(e){var t;return a.createElement(C,(0,a.isValidElement)(e.children)&&"code"===e.children.props.originalType?null==(t=e.children)?void 0:t.props:Object.assign({},e))},details:function(e){var t=a.Children.toArray(e.children),n=t.find((function(e){var t;return"summary"===(null==e||null==(t=e.props)?void 0:t.mdxType)})),o=a.createElement(a.Fragment,null,t.filter((function(e){return e!==n})));return a.createElement(A,(0,r.Z)({},e,{summary:n}),o)},h1:function(e){return a.createElement(w.Z,(0,r.Z)({as:"h1"},e))},h2:function(e){return a.createElement(w.Z,(0,r.Z)({as:"h2"},e))},h3:function(e){return a.createElement(w.Z,(0,r.Z)({as:"h3"},e))},h4:function(e){return a.createElement(w.Z,(0,r.Z)({as:"h4"},e))},h5:function(e){return a.createElement(w.Z,(0,r.Z)({as:"h5"},e))},h6:function(e){return a.createElement(w.Z,(0,r.Z)({as:"h6"},e))}}}}]); \ No newline at end of file diff --git a/assets/js/5a047177.1f48e99a.js b/assets/js/5a047177.1f48e99a.js new file mode 100644 index 00000000..c6c7e960 --- /dev/null +++ b/assets/js/5a047177.1f48e99a.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[2598],{3905:function(e,t,r){r.d(t,{Zo:function(){return p},kt:function(){return f}});var n=r(7294);function o(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function i(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function a(e){for(var t=1;t=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var s=n.createContext({}),c=function(e){var t=n.useContext(s),r=t;return e&&(r="function"==typeof e?e(t):a(a({},t),e)),r},p=function(e){var t=c(e.components);return n.createElement(s.Provider,{value:t},e.children)},l={inlineCode:"code",wrapper:function(e){var t=e.children;return n.createElement(n.Fragment,{},t)}},d=n.forwardRef((function(e,t){var r=e.components,o=e.mdxType,i=e.originalType,s=e.parentName,p=u(e,["components","mdxType","originalType","parentName"]),d=c(r),f=o,h=d["".concat(s,".").concat(f)]||d[f]||l[f]||i;return r?n.createElement(h,a(a({ref:t},p),{},{components:r})):n.createElement(h,a({ref:t},p))}));function f(e,t){var r=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var i=r.length,a=new Array(i);a[0]=d;var u={};for(var s in t)hasOwnProperty.call(t,s)&&(u[s]=t[s]);u.originalType=e,u.mdxType="string"==typeof e?e:o,a[1]=u;for(var c=2;c=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var p=r.createContext({}),u=function(e){var t=r.useContext(p),n=t;return e&&(n="function"==typeof e?e(t):i(i({},t),e)),n},c=function(e){var t=u(e.components);return r.createElement(p.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},m=r.forwardRef((function(e,t){var n=e.components,o=e.mdxType,a=e.originalType,p=e.parentName,c=l(e,["components","mdxType","originalType","parentName"]),m=u(n),f=o,d=m["".concat(p,".").concat(f)]||m[f]||s[f]||a;return n?r.createElement(d,i(i({ref:t},c),{},{components:n})):r.createElement(d,i({ref:t},c))}));function f(e,t){var n=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var a=n.length,i=new Array(a);i[0]=m;var l={};for(var p in t)hasOwnProperty.call(t,p)&&(l[p]=t[p]);l.originalType=e,l.mdxType="string"==typeof e?e:o,i[1]=l;for(var u=2;u&1 | grep OK\noauth2-proxy-x.y.z.linux-amd64: OK\n")),(0,a.kt)("ol",{start:2},(0,a.kt)("li",{parentName:"ol"},(0,a.kt)("a",{parentName:"li",href:"/oauth2-proxy/docs/7.1.x/configuration/oauth_provider"},"Select a Provider and Register an OAuth Application with a Provider")),(0,a.kt)("li",{parentName:"ol"},(0,a.kt)("a",{parentName:"li",href:"/oauth2-proxy/docs/7.1.x/configuration/overview"},"Configure OAuth2 Proxy using config file, command line options, or environment variables")),(0,a.kt)("li",{parentName:"ol"},(0,a.kt)("a",{parentName:"li",href:"/oauth2-proxy/docs/7.1.x/configuration/tls"},"Configure SSL or Deploy behind a SSL endpoint")," (example provided for Nginx)")))}m.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/js/6f497b56.d1fafb1d.js b/assets/js/6f497b56.d1fafb1d.js new file mode 100644 index 00000000..6bfee25a --- /dev/null +++ b/assets/js/6f497b56.d1fafb1d.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[2114],{3905:function(e,t,r){r.d(t,{Zo:function(){return p},kt:function(){return d}});var n=r(7294);function a(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function o(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function i(e){for(var t=1;t=0||(a[r]=e[r]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(a[r]=e[r])}return a}var u=n.createContext({}),c=function(e){var t=n.useContext(u),r=t;return e&&(r="function"==typeof e?e(t):i(i({},t),e)),r},p=function(e){var t=c(e.components);return n.createElement(u.Provider,{value:t},e.children)},l={inlineCode:"code",wrapper:function(e){var t=e.children;return n.createElement(n.Fragment,{},t)}},f=n.forwardRef((function(e,t){var r=e.components,a=e.mdxType,o=e.originalType,u=e.parentName,p=s(e,["components","mdxType","originalType","parentName"]),f=c(r),d=a,m=f["".concat(u,".").concat(d)]||f[d]||l[d]||o;return r?n.createElement(m,i(i({ref:t},p),{},{components:r})):n.createElement(m,i({ref:t},p))}));function d(e,t){var r=arguments,a=t&&t.mdxType;if("string"==typeof e||a){var o=r.length,i=new Array(o);i[0]=f;var s={};for(var u in t)hasOwnProperty.call(t,u)&&(s[u]=t[u]);s.originalType=e,s.mdxType="string"==typeof e?e:a,i[1]=s;for(var c=2;c=0||(r[n]=t[n]);return r}(t,e);if(Object.getOwnPropertySymbols){var l=Object.getOwnPropertySymbols(t);for(a=0;a=0||Object.prototype.propertyIsEnumerable.call(t,n)&&(r[n]=t[n])}return r}var d=a.createContext({}),s=function(t){var e=a.useContext(d),n=e;return t&&(n="function"==typeof t?t(e):i(i({},e),t)),n},p=function(t){var e=s(t.components);return a.createElement(d.Provider,{value:e},t.children)},u={inlineCode:"code",wrapper:function(t){var e=t.children;return a.createElement(a.Fragment,{},e)}},m=a.forwardRef((function(t,e){var n=t.components,r=t.mdxType,l=t.originalType,d=t.parentName,p=o(t,["components","mdxType","originalType","parentName"]),m=s(n),k=r,g=m["".concat(d,".").concat(k)]||m[k]||u[k]||l;return n?a.createElement(g,i(i({ref:e},p),{},{components:n})):a.createElement(g,i({ref:e},p))}));function k(t,e){var n=arguments,r=e&&e.mdxType;if("string"==typeof t||r){var l=n.length,i=new Array(l);i[0]=m;var o={};for(var d in e)hasOwnProperty.call(e,d)&&(o[d]=e[d]);o.originalType=t,o.mdxType="string"==typeof t?t:r,i[1]=o;for(var s=2;s child <"+("string"==typeof t.type?t.type:t.type.name)+'>: all children of the component should be , and every should have a unique "value" prop.')})),h=null!=m?m:N.map((function(t){var e=t.props;return{value:e.value,label:e.label,attributes:e.attributes}})),c=(0,i.lx)(h,(function(t,e){return t.value===e.value}));if(c.length>0)throw new Error('Docusaurus error: Duplicate values "'+c.map((function(t){return t.value})).join(", ")+'" found in . Every value needs to be unique.');var f=null===u?u:null!=(e=null!=u?u:null==(n=N.find((function(t){return t.props.default})))?void 0:n.props.value)?e:null==(l=N[0])?void 0:l.props.value;if(null!==f&&!h.some((function(t){return t.value===f})))throw new Error('Docusaurus error: The has a defaultValue "'+f+'" but none of its children has the corresponding value. Available values are: '+h.map((function(t){return t.value})).join(", ")+". If you intend to show no default tab, use defaultValue={null} instead.");var b=(0,i.UB)(),y=b.tabGroupChoices,v=b.setTabGroupChoices,C=(0,r.useState)(f),w=C[0],_=C[1],x=[],T=(0,i.o5)().blockElementScrollPositionUntilNextRender;if(null!=k){var q=y[k];null!=q&&q!==w&&h.some((function(t){return t.value===q}))&&_(q)}var A=function(t){var e=t.currentTarget,n=x.indexOf(e),a=h[n].value;a!==w&&(T(e),_(a),null!=k&&v(k,a))},R=function(t){var e,n=null;switch(t.key){case"ArrowRight":var a=x.indexOf(t.currentTarget)+1;n=x[a]||x[0];break;case"ArrowLeft":var r=x.indexOf(t.currentTarget)-1;n=x[r]||x[x.length-1]}null==(e=n)||e.focus()};return r.createElement("div",{className:"tabs-container"},r.createElement("ul",{role:"tablist","aria-orientation":"horizontal",className:(0,o.Z)("tabs",{"tabs--block":p},g)},h.map((function(t){var e=t.value,n=t.label,l=t.attributes;return r.createElement("li",(0,a.Z)({role:"tab",tabIndex:w===e?0:-1,"aria-selected":w===e,key:e,ref:function(t){return x.push(t)},onKeyDown:R,onFocus:A,onClick:A},l,{className:(0,o.Z)("tabs__item",d,null==l?void 0:l.className,{"tabs__item--active":w===e})}),null!=n?n:e)}))),s?(0,r.cloneElement)(N.filter((function(t){return t.props.value===w}))[0],{className:"margin-vert--md"}):r.createElement("div",{className:"margin-vert--md"},N.map((function(t,e){return(0,r.cloneElement)(t,{key:e,hidden:t.props.value!==w})}))))}function p(t){var e=(0,l.Z)();return r.createElement(s,(0,a.Z)({key:String(e)},t))}},6104:function(t,e,n){n.r(e),n.d(e,{frontMatter:function(){return s},contentTitle:function(){return p},metadata:function(){return u},toc:function(){return m},default:function(){return g}});var a=n(7462),r=n(3366),l=(n(7294),n(3905)),i=n(9877),o=n(8215),d=["components"],s={id:"overview",title:"Overview"},p=void 0,u={unversionedId:"configuration/overview",id:"version-7.2.x/configuration/overview",title:"Overview",description:"oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings).",source:"@site/versioned_docs/version-7.2.x/configuration/overview.md",sourceDirName:"configuration",slug:"/configuration/overview",permalink:"/oauth2-proxy/docs/configuration/overview",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.2.x/configuration/overview.md",tags:[],version:"7.2.x",frontMatter:{id:"overview",title:"Overview"},sidebar:"version-7.2.x/docs",previous:{title:"Behaviour",permalink:"/oauth2-proxy/docs/behaviour"},next:{title:"OAuth Provider Configuration",permalink:"/oauth2-proxy/docs/configuration/oauth_provider"}},m=[{value:"Generating a Cookie Secret",id:"generating-a-cookie-secret",children:[],level:3},{value:"Config File",id:"config-file",children:[],level:3},{value:"Command Line Options",id:"command-line-options",children:[],level:3},{value:"Upstreams Configuration",id:"upstreams-configuration",children:[],level:3},{value:"Environment variables",id:"environment-variables",children:[],level:3},{value:"Logging Configuration",id:"logging-configuration",children:[{value:"Auth Log Format",id:"auth-log-format",children:[],level:3},{value:"Request Log Format",id:"request-log-format",children:[],level:3},{value:"Standard Log Format",id:"standard-log-format",children:[],level:3}],level:2},{value:"Configuring for use with the Nginx auth_request directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",children:[],level:2},{value:"Configuring for use with the Traefik (v2) ForwardAuth middleware",id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware",children:[{value:"ForwardAuth with 401 errors middleware",id:"forwardauth-with-401-errors-middleware",children:[],level:3},{value:"ForwardAuth with static upstreams configuration",id:"forwardauth-with-static-upstreams-configuration",children:[],level:3}],level:2}],k={toc:m};function g(t){var e=t.components,n=(0,r.Z)(t,d);return(0,l.kt)("wrapper",(0,a.Z)({},k,n,{components:e,mdxType:"MDXLayout"}),(0,l.kt)("p",null,(0,l.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",(0,l.kt)("a",{parentName:"p",href:"#command-line-options"},"command line options"),", ",(0,l.kt)("a",{parentName:"p",href:"#environment-variables"},"environment variables")," or ",(0,l.kt)("a",{parentName:"p",href:"#config-file"},"config file")," (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."),(0,l.kt)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),(0,l.kt)("p",null,"To generate a strong cookie secret use one of the below commands:"),(0,l.kt)(i.Z,{defaultValue:"python",values:[{label:"Python",value:"python"},{label:"Bash",value:"bash"},{label:"OpenSSL",value:"openssl"},{label:"PowerShell",value:"powershell"},{label:"Terraform",value:"terraform"}],mdxType:"Tabs"},(0,l.kt)(o.Z,{value:"python",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'\n"))),(0,l.kt)(o.Z,{value:"bash",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\\n' | tr -- '+/' '-_'; echo\n"))),(0,l.kt)(o.Z,{value:"openssl",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"openssl rand -base64 32 | tr -- '+/' '-_'\n"))),(0,l.kt)(o.Z,{value:"powershell",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},'# Add System.Web assembly to session, just in case\nAdd-Type -AssemblyName System.Web\n[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")\n'))),(0,l.kt)(o.Z,{value:"terraform",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},'# Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret\nresource "random_password" "cookie_secret" {\n length = 32\n override_special = "-_"\n}\n')))),(0,l.kt)("h3",{id:"config-file"},"Config File"),(0,l.kt)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),(0,l.kt)("p",null,"An example ",(0,l.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"},"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",(0,l.kt)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),(0,l.kt)("h3",{id:"command-line-options"},"Command Line Options"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Option"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"),(0,l.kt)("th",{parentName:"tr",align:null},"Default"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--acr-values")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"optional, see ",(0,l.kt)("a",{parentName:"td",href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"},"docs")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--approval-prompt")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth approval_prompt"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"force"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log authentication attempts"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for authentication log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate against emails via file (one per line)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--azure-tenant")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"go to a tenant-specific or common (tenant-independent) endpoint."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"common"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--basic-auth-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the password to set when passing the HTTP Basic Auth header"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-id")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client ID, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the file with OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--config")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to config file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Optional cookie domains to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-expire")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"expire timeframe for cookie"),(0,l.kt)("td",{parentName:"tr",align:null},"168h0m0s")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-httponly")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set HttpOnly cookie flag"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the name of the cookie that the oauth_proxy creates"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"an optional cookie path to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"/poc/"),")"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-refresh")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"refresh the cookie after this duration; ",(0,l.kt)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",(0,l.kt)("a",{parentName:"td",href:"#footnote1"},"1"),"]"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the seed string for secure cookies (optionally base64 encoded)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secure")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set ",(0,l.kt)("a",{parentName:"td",href:"https://owasp.org/www-community/controls/SecureFlag"},"secure (HTTPS only) cookie flag")),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-samesite")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"set SameSite cookie attribute (",(0,l.kt)("inlineCode",{parentName:"td"},'"lax"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"strict"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"none"'),", or ",(0,l.kt)("inlineCode",{parentName:"td"},'""'),")."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--custom-templates-dir")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to custom html templates"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--custom-sign-in-logo")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},'path or a URL to an custom image for the sign_in page logo. Use \\"-\\" to disable default logo.'),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"display username / password login form if an htpasswd file is provided"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--email-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate emails with the specified domain (may be given multiple times). Use ",(0,l.kt)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--errors-to-info-log")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"redirects error-level logging to default log channel instead of stderr"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"if ",(0,l.kt)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",(0,l.kt)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",(0,l.kt)("inlineCode",{parentName:"td"},"iss"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--exclude-logging-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"comma separated list of paths to exclude from logging, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"/ping,/path2"')),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--flush-interval")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"period between flushing response buffers when streaming responses"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"1s"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--force-https")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"enforce https redirect"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"false"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--force-json-errors")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"force JSON errors instead of HTTP error pages or redirects"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"false"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--banner")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) banner string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--footer")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) footer string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-org")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this organisation"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-team")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these teams (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-repo")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to collaborators of this repository formatted as ",(0,l.kt)("inlineCode",{parentName:"td"},"orgname/repo")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-token")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the token to use when verifying repository collaborators (must have push access to the repository)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-user")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gitlab-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these groups (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gitlab-projects")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these projects (may be given multiple times) formatted as ",(0,l.kt)("inlineCode",{parentName:"td"},"orgname/repo=accesslevel"),". Access level should be a value matching ",(0,l.kt)("a",{parentName:"td",href:"https://docs.gitlab.com/ee/api/members.html#valid-access-levels"},"Gitlab access levels"),", defaulted to 20 if absent"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-admin-email")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the google admin to impersonate for api calls"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this google group (may be given multiple times)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-service-account-json")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the path to the service account json credentials"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--htpasswd-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"additionally authenticate against a htpasswd file. Entries must be created with ",(0,l.kt)("inlineCode",{parentName:"td"},"htpasswd -B")," for bcrypt encryption"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--htpasswd-user-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"the groups to be set on sessions for htpasswd users"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--http-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"[http://]:")," or ",(0,l.kt)("inlineCode",{parentName:"td"},"unix://")," to listen on for HTTP clients"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"127.0.0.1:4180"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--https-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},":")," to listen on for HTTPS clients"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'":443"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-compress")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Should rotated log files be compressed using gzip"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-filename")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"File to log requests to, empty for ",(0,l.kt)("inlineCode",{parentName:"td"},"stdout")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (stdout)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-local-time")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Use local time in log files and backup filenames instead of UTC"),(0,l.kt)("td",{parentName:"tr",align:null},"true (local time)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-age")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum number of days to retain old log files"),(0,l.kt)("td",{parentName:"tr",align:null},"7")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-backups")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum number of old log files to retain; 0 to disable"),(0,l.kt)("td",{parentName:"tr",align:null},"0")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-size")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum size in megabytes of the log file before rotation"),(0,l.kt)("td",{parentName:"tr",align:null},"100")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"private key in PEM format used to sign JWT, so that you can say something like ",(0,l.kt)("inlineCode",{parentName:"td"},'--jwt-key="${OAUTH2_PROXY_JWT_KEY}"'),": required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to the private key file in PEM format used to sign the JWT so that you can say something like ",(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem"),": required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--login-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Authentication endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-allow-unverified-email")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"don't fail if an email address in an id_token is not verified"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-issuer-verification")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-nonce")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip verifying the OIDC ID Token's nonce claim"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-issuer-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OpenID Connect issuer URL, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"https://accounts.google.com"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-jwks-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OIDC JWKS URI for token verification; required if OIDC discovery is disabled"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-email-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which OIDC claim contains the user's email"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"email"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-groups-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which OIDC claim contains the user groups"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"groups"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-access-token")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with ",(0,l.kt)("inlineCode",{parentName:"td"},"--set-xauthrequest")," this adds the X-Auth-Request-Access-Token header to the response"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-authorization-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass OIDC IDToken to upstream via Authorization Bearer header"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-basic-auth")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--prefer-email-to-user")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-basic-auth")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-user-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-host-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass the request Host Header to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-user-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--profile-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Profile access endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--prompt")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"},"OIDC prompt"),"; if present, ",(0,l.kt)("inlineCode",{parentName:"td"},"approval-prompt")," is ignored"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth provider"),(0,l.kt)("td",{parentName:"tr",align:null},"google")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider-ca-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider-display-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Override the provider's name with the given string; used for the sign-in page"),(0,l.kt)("td",{parentName:"tr",align:null},"(depends on provider)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ping-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the ping endpoint that can be used for basic health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/ping"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ping-user-agent")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"a User-Agent that can be used for basic health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (don't check user agent)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--metrics-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the address prometheus metrics will be scraped from"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--proxy-prefix")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the url root path that this proxy should be nested under (e.g. /",(0,l.kt)("inlineCode",{parentName:"td"},"/sign_in"),")"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/oauth2"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--proxy-websockets")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"enables WebSocket proxying"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pubjwk-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"JWK pubkey access endpoint: required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--real-client-ip-header")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Header used to determine the real IP of the client, requires ",(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")," to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)"),(0,l.kt)("td",{parentName:"tr",align:null},"X-Real-IP")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redeem-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Token redemption endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redirect-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Redirect URL, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"https://internalapp.yourcompany.com/oauth2/callback"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"List of Redis cluster connection URLs (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-cluster")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"URL of redis server for redis session storage (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),")"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis password. Applicable for all Redis configurations. Will override any password set in ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-url")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-password")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis sentinel master name. Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"List of Redis sentinel connection URLs (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-cluster")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Connect to redis cluster. Must set ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")," to use this feature"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Connect to redis via sentinels. Must set ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")," to use this feature"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-id-header")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Request header to use as the request ID in logging"),(0,l.kt)("td",{parentName:"tr",align:null},"X-Request-Id")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log requests"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for request log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--resource")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"The resource that is protected (Azure AD only)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--scope")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth scope specification"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--session-cookie-minimal")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--session-store-type")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"/oauth2-proxy/docs/configuration/session_storage"},"Session data storage backend"),"; redis or cookie"),(0,l.kt)("td",{parentName:"tr",align:null},"cookie")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-xauthrequest")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-access-token"),", X-Auth-Request-Access-Token is added to response headers."),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-authorization-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set Authorization Bearer response header (useful in Nginx auth_request mode)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-basic-auth")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set HTTP Basic Auth information in response (useful in Nginx auth_request mode)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--show-debug-on-error")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--signature-key")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"GAP-Signature request signature key (algorithm:secretkey)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--silence-ping-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"disable logging of requests to ping endpoint"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-preflight")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip authentication for OPTIONS requests"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-regex")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"(DEPRECATED for ",(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-route"),") bypass authentication for requests paths that match (may be given multiple times)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-route")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-strip-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"strips ",(0,l.kt)("inlineCode",{parentName:"td"},"X-Forwarded-*")," style authentication headers & ",(0,l.kt)("inlineCode",{parentName:"td"},"Authorization")," header if they would be set by oauth2-proxy"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip requests that have verified JWT bearer tokens (the token must have ",(0,l.kt)("a",{parentName:"td",href:"https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields"},(0,l.kt)("inlineCode",{parentName:"a"},"aud"))," that matches this client id or one of the extras from ",(0,l.kt)("inlineCode",{parentName:"td"},"extra-jwt-issuers"),")"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-oidc-discovery")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"bypass OIDC endpoint discovery. ",(0,l.kt)("inlineCode",{parentName:"td"},"--login-url"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"--redeem-url")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-jwks-url")," must be configured in this case"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-provider-button")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip sign-in-page to directly reach the next step: oauth/start"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ssl-insecure-skip-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip validation of certificates presented when using HTTPS providers"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ssl-upstream-insecure-skip-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip validation of certificates presented when using HTTPS upstreams"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--standard-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log standard runtime information"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--standard-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for standard log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-cert-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to certificate file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-key-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to private key file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--upstream")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"the http url(s) of the upstream endpoint, file:// paths for static files or ",(0,l.kt)("inlineCode",{parentName:"td"},"static://")," for static response. Routing is based on the path"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--allowed-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this group (may be given multiple times)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--allowed-role")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--validate-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Access token validation endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--version")),(0,l.kt)("td",{parentName:"tr",align:null},"n/a"),(0,l.kt)("td",{parentName:"tr",align:null},"print version string"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--whitelist-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"allowed domains for redirection after authentication. Prefix domain with a ",(0,l.kt)("inlineCode",{parentName:"td"},".")," to allow subdomains (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},".example.com"),")","\xa0","[",(0,l.kt)("a",{parentName:"td",href:"#footnote2"},"2"),"]"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--trusted-ip")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with ",(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")," and optionally ",(0,l.kt)("inlineCode",{parentName:"td"},"--real-client-ip-header")," this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them."),(0,l.kt)("td",{parentName:"tr",align:null})))),(0,l.kt)("p",null,"[",(0,l.kt)("a",{name:"footnote1"},"1"),"]",": Only these providers support ",(0,l.kt)("inlineCode",{parentName:"p"},"--cookie-refresh"),": GitLab, Google and OIDC"),(0,l.kt)("p",null,"[",(0,l.kt)("a",{name:"footnote2"},"2"),"]",": When using the ",(0,l.kt)("inlineCode",{parentName:"p"},"whitelist-domain")," option, any domain prefixed with a ",(0,l.kt)("inlineCode",{parentName:"p"},".")," will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: ",(0,l.kt)("inlineCode",{parentName:"p"},"example.com:8080"),". To allow any port, use ",(0,l.kt)("inlineCode",{parentName:"p"},"*"),": ",(0,l.kt)("inlineCode",{parentName:"p"},"example.com:*"),"."),(0,l.kt)("p",null,"See below for provider specific options"),(0,l.kt)("h3",{id:"upstreams-configuration"},"Upstreams Configuration"),(0,l.kt)("p",null,(0,l.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as ",(0,l.kt)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/")," for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide ",(0,l.kt)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/some/path/")," then it will only be requests that start with ",(0,l.kt)("inlineCode",{parentName:"p"},"/some/path/")," which are forwarded to the upstream."),(0,l.kt)("p",null,"Static file paths are configured as a file:// URL. ",(0,l.kt)("inlineCode",{parentName:"p"},"file:///var/www/static/")," will serve the files from that directory at ",(0,l.kt)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/var/www/static/"),", which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. ",(0,l.kt)("inlineCode",{parentName:"p"},"file:///var/www/static/#/static/")," will make ",(0,l.kt)("inlineCode",{parentName:"p"},"/var/www/static/")," available at ",(0,l.kt)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/static/"),"."),(0,l.kt)("p",null,"Multiple upstreams can either be configured by supplying a comma separated list to the ",(0,l.kt)("inlineCode",{parentName:"p"},"--upstream")," parameter, supplying the parameter multiple times or providing a list in the ",(0,l.kt)("a",{parentName:"p",href:"#config-file"},"config file"),". When multiple upstreams are used routing to them will be based on the path they are set up with."),(0,l.kt)("h3",{id:"environment-variables"},"Environment variables"),(0,l.kt)("p",null,"Every command line argument can be specified as an environment variable by\nprefixing it with ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_"),", capitalising it, and replacing hyphens (",(0,l.kt)("inlineCode",{parentName:"p"},"-"),")\nwith underscores (",(0,l.kt)("inlineCode",{parentName:"p"},"_"),"). If the argument can be specified multiple times, the\nenvironment variable should be plural (trailing ",(0,l.kt)("inlineCode",{parentName:"p"},"S"),")."),(0,l.kt)("p",null,"This is particularly useful for storing secrets outside of a configuration file\nor the command line."),(0,l.kt)("p",null,"For example, the ",(0,l.kt)("inlineCode",{parentName:"p"},"--cookie-secret")," flag becomes ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_COOKIE_SECRET"),",\nand the ",(0,l.kt)("inlineCode",{parentName:"p"},"--email-domain")," flag becomes ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_EMAIL_DOMAINS"),"."),(0,l.kt)("h2",{id:"logging-configuration"},"Logging Configuration"),(0,l.kt)("p",null,"By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the ",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-filename")," command."),(0,l.kt)("p",null,"If logging to a file you can also configure the maximum file size (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-size"),"), age (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-age"),"), max backup logs (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-backups"),"), and if backup logs should be compressed (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-compress"),")."),(0,l.kt)("p",null,"There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with ",(0,l.kt)("inlineCode",{parentName:"p"},"--standard-logging"),", ",(0,l.kt)("inlineCode",{parentName:"p"},"--auth-logging"),", and ",(0,l.kt)("inlineCode",{parentName:"p"},"--request-logging"),"."),(0,l.kt)("p",null,"Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log."),(0,l.kt)("p",null,"Logging of requests to the ",(0,l.kt)("inlineCode",{parentName:"p"},"/ping")," endpoint (or using ",(0,l.kt)("inlineCode",{parentName:"p"},"--ping-user-agent"),") can be disabled with ",(0,l.kt)("inlineCode",{parentName:"p"},"--silence-ping-logging")," reducing log volume. This flag appends the ",(0,l.kt)("inlineCode",{parentName:"p"},"--ping-path")," to ",(0,l.kt)("inlineCode",{parentName:"p"},"--exclude-logging-paths"),"."),(0,l.kt)("h3",{id:"auth-log-format"},"Auth Log Format"),(0,l.kt)("p",null,"Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"}," - - [19/Mar/2015:17:20:19 -0400] [] \n")),(0,l.kt)("p",null,"The status block will contain one of the below strings:"),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthSuccess")," If a user has authenticated successfully by any method"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthFailure")," If the user failed to authenticate explicitly"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthError")," If there was an unexpected error during authentication")),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--auth-logging-format")," flag.\nThe default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}\n")),(0,l.kt)("p",null,"Available variables for auth logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Client"),(0,l.kt)("td",{parentName:"tr",align:null},"74.125.224.72"),(0,l.kt)("td",{parentName:"tr",align:null},"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Host"),(0,l.kt)("td",{parentName:"tr",align:null},"domain.com"),(0,l.kt)("td",{parentName:"tr",align:null},"The value of the Host header.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Message"),(0,l.kt)("td",{parentName:"tr",align:null},"Authenticated via OAuth2"),(0,l.kt)("td",{parentName:"tr",align:null},"The details of the auth attempt.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Protocol"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP/1.0"),(0,l.kt)("td",{parentName:"tr",align:null},"The request protocol.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestID"),(0,l.kt)("td",{parentName:"tr",align:null},"00010203-0405-4607-8809-0a0b0c0d0e0f"),(0,l.kt)("td",{parentName:"tr",align:null},"The request ID pulled from the ",(0,l.kt)("inlineCode",{parentName:"td"},"--request-id-header"),". Random UUID if empty")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestMethod"),(0,l.kt)("td",{parentName:"tr",align:null},"GET"),(0,l.kt)("td",{parentName:"tr",align:null},"The request method.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"UserAgent"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The full user agent as reported by the requesting client.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Username"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"mailto:username@email.com"},"username@email.com")),(0,l.kt)("td",{parentName:"tr",align:null},"The email or username of the auth request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Status"),(0,l.kt)("td",{parentName:"tr",align:null},"AuthSuccess"),(0,l.kt)("td",{parentName:"tr",align:null},"The status of the auth request. See above for details.")))),(0,l.kt)("h3",{id:"request-log-format"},"Request Log Format"),(0,l.kt)("p",null,"HTTP request logs will output by default in the below format:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},' - - [19/Mar/2015:17:20:19 -0400] GET "/path/" HTTP/1.1 "" \n')),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--request-logging-format")," flag.\nThe default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}\n")),(0,l.kt)("p",null,"Available variables for request logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Client"),(0,l.kt)("td",{parentName:"tr",align:null},"74.125.224.72"),(0,l.kt)("td",{parentName:"tr",align:null},"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Host"),(0,l.kt)("td",{parentName:"tr",align:null},"domain.com"),(0,l.kt)("td",{parentName:"tr",align:null},"The value of the Host header.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Protocol"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP/1.0"),(0,l.kt)("td",{parentName:"tr",align:null},"The request protocol.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestDuration"),(0,l.kt)("td",{parentName:"tr",align:null},"0.001"),(0,l.kt)("td",{parentName:"tr",align:null},"The time in seconds that a request took to process.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestID"),(0,l.kt)("td",{parentName:"tr",align:null},"00010203-0405-4607-8809-0a0b0c0d0e0f"),(0,l.kt)("td",{parentName:"tr",align:null},"The request ID pulled from the ",(0,l.kt)("inlineCode",{parentName:"td"},"--request-id-header"),". Random UUID if empty")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestMethod"),(0,l.kt)("td",{parentName:"tr",align:null},"GET"),(0,l.kt)("td",{parentName:"tr",align:null},"The request method.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestURI"),(0,l.kt)("td",{parentName:"tr",align:null},'"/oauth2/auth"'),(0,l.kt)("td",{parentName:"tr",align:null},"The URI path of the request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"ResponseSize"),(0,l.kt)("td",{parentName:"tr",align:null},"12"),(0,l.kt)("td",{parentName:"tr",align:null},"The size in bytes of the response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"StatusCode"),(0,l.kt)("td",{parentName:"tr",align:null},"200"),(0,l.kt)("td",{parentName:"tr",align:null},"The HTTP status code of the response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The upstream data of the HTTP request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"UserAgent"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The full user agent as reported by the requesting client.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Username"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"mailto:username@email.com"},"username@email.com")),(0,l.kt)("td",{parentName:"tr",align:null},"The email or username of the auth request.")))),(0,l.kt)("h3",{id:"standard-log-format"},"Standard Log Format"),(0,l.kt)("p",null,"All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"[19/Mar/2015:17:20:19 -0400] [main.go:40] \n")),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--standard-logging-format")," flag. The default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"[{{.Timestamp}}] [{{.File}}] {{.Message}}\n")),(0,l.kt)("p",null,"Available variables for standard logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"File"),(0,l.kt)("td",{parentName:"tr",align:null},"main.go:40"),(0,l.kt)("td",{parentName:"tr",align:null},"The file and line number of the logging statement.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Message"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP: listening on 127.0.0.1:4180"),(0,l.kt)("td",{parentName:"tr",align:null},"The details of the log statement.")))),(0,l.kt)("h2",{id:"configuring-for-use-with-the-nginx-auth_request-directive"},"Configuring for use with the Nginx ",(0,l.kt)("inlineCode",{parentName:"h2"},"auth_request")," directive"),(0,l.kt)("p",null,"The ",(0,l.kt)("a",{parentName:"p",href:"http://nginx.org/en/docs/http/ngx_http_auth_request_module.html"},"Nginx ",(0,l.kt)("inlineCode",{parentName:"a"},"auth_request")," directive")," allows Nginx to authenticate requests via the oauth2-proxy's ",(0,l.kt)("inlineCode",{parentName:"p"},"/auth")," endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-nginx"},'server {\n listen 443 ssl;\n server_name ...;\n include ssl/ssl.conf;\n\n location /oauth2/ {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n proxy_set_header X-Auth-Request-Redirect $request_uri;\n # or, if you are handling multiple domains:\n # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;\n }\n location = /oauth2/auth {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n # nginx auth_request includes headers but not body\n proxy_set_header Content-Length "";\n proxy_pass_request_body off;\n }\n\n location / {\n auth_request /oauth2/auth;\n error_page 401 = /oauth2/sign_in;\n\n # pass information via X-User and X-Email headers to backend,\n # requires running with --set-xauthrequest flag\n auth_request_set $user $upstream_http_x_auth_request_user;\n auth_request_set $email $upstream_http_x_auth_request_email;\n proxy_set_header X-User $user;\n proxy_set_header X-Email $email;\n\n # if you enabled --pass-access-token, this will pass the token to the backend\n auth_request_set $token $upstream_http_x_auth_request_access_token;\n proxy_set_header X-Access-Token $token;\n\n # if you enabled --cookie-refresh, this is needed for it to work with auth_request\n auth_request_set $auth_cookie $upstream_http_set_cookie;\n add_header Set-Cookie $auth_cookie;\n\n # When using the --set-authorization-header flag, some provider\'s cookies can exceed the 4kb\n # limit and so the OAuth2 Proxy splits these into multiple parts.\n # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\n # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\n auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;\n\n # Extract the Cookie attributes from the first Set-Cookie header and append them\n # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\n if ($auth_cookie ~* "(; .*)") {\n set $auth_cookie_name_0 $auth_cookie;\n set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";\n }\n\n # Send both Set-Cookie headers now if there was a second part\n if ($auth_cookie_name_upstream_1) {\n add_header Set-Cookie $auth_cookie_name_0;\n add_header Set-Cookie $auth_cookie_name_1;\n }\n\n proxy_pass http://backend/;\n # or "root /path/to/site;" or "fastcgi_pass ..." etc\n }\n}\n')),(0,l.kt)("p",null,"When you use ingress-nginx in Kubernetes, you MUST use ",(0,l.kt)("inlineCode",{parentName:"p"},"kubernetes/ingress-nginx")," (which includes the Lua module) and the following configuration snippet for your ",(0,l.kt)("inlineCode",{parentName:"p"},"Ingress"),".\nVariables set with ",(0,l.kt)("inlineCode",{parentName:"p"},"auth_request_set")," are not ",(0,l.kt)("inlineCode",{parentName:"p"},"set"),"-able in plain nginx config when the location is processed via ",(0,l.kt)("inlineCode",{parentName:"p"},"proxy_pass")," and then may only be processed by Lua.\nNote that ",(0,l.kt)("inlineCode",{parentName:"p"},"nginxinc/kubernetes-ingress")," does not include the Lua module."),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'nginx.ingress.kubernetes.io/auth-response-headers: Authorization\nnginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri\nnginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth\nnginx.ingress.kubernetes.io/configuration-snippet: |\n auth_request_set $name_upstream_1 $upstream_cookie_name_1;\n\n access_by_lua_block {\n if ngx.var.name_upstream_1 ~= "" then\n ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")\n end\n }\n')),(0,l.kt)("p",null,"It is recommended to use ",(0,l.kt)("inlineCode",{parentName:"p"},"--session-store-type=redis")," when expecting large sessions/OIDC tokens (",(0,l.kt)("em",{parentName:"p"},"e.g.")," with MS Azure)."),(0,l.kt)("p",null,"You have to substitute ",(0,l.kt)("em",{parentName:"p"},"name"),' with the actual cookie name you configured via --cookie-name parameter. If you don\'t set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".'),(0,l.kt)("h2",{id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware"},"Configuring for use with the Traefik (v2) ",(0,l.kt)("inlineCode",{parentName:"h2"},"ForwardAuth")," middleware"),(0,l.kt)("p",null,(0,l.kt)("strong",{parentName:"p"},"This option requires ",(0,l.kt)("inlineCode",{parentName:"strong"},"--reverse-proxy")," option to be set.")),(0,l.kt)("h3",{id:"forwardauth-with-401-errors-middleware"},"ForwardAuth with 401 errors middleware"),(0,l.kt)("p",null,"The ",(0,l.kt)("a",{parentName:"p",href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"},"Traefik v2 ",(0,l.kt)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," allows Traefik to authenticate requests via the oauth2-proxy's ",(0,l.kt)("inlineCode",{parentName:"p"},"/oauth2/auth")," endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'http:\n routers:\n a-service:\n rule: "Host(`a-service.example.com`)"\n service: a-service-backend\n middlewares:\n - oauth-errors\n - oauth-auth\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth:\n rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n oauth-errors:\n errors:\n status:\n - "401-403"\n service: oauth-backend\n query: "/oauth2/sign_in"\n')),(0,l.kt)("h3",{id:"forwardauth-with-static-upstreams-configuration"},"ForwardAuth with static upstreams configuration"),(0,l.kt)("p",null,"Redirect to sign_in functionality provided without the use of ",(0,l.kt)("inlineCode",{parentName:"p"},"errors")," middleware with ",(0,l.kt)("a",{parentName:"p",href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"},"Traefik v2 ",(0,l.kt)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," pointing to oauth2-proxy service's ",(0,l.kt)("inlineCode",{parentName:"p"},"/")," endpoint"),(0,l.kt)("p",null,(0,l.kt)("strong",{parentName:"p"},"Following options need to be set on ",(0,l.kt)("inlineCode",{parentName:"strong"},"oauth2-proxy"),":")),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"--upstream=static://202"),": Configures a static response for authenticated sessions"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"--reverse-proxy=true"),": Enables the use of ",(0,l.kt)("inlineCode",{parentName:"li"},"X-Forwarded-*")," headers to determine redirects correctly")),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'http:\n routers:\n a-service-route-1:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n a-service-route-2:\n rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-wo-redirect # unauthenticated session will return a 401\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n services-oauth2-route:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth2-proxy-route:\n rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n b-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.3:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth-redirect:\n forwardAuth:\n address: https://oauth.example.com/\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n oauth-auth-wo-redirect:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n')),(0,l.kt)("div",{className:"admonition admonition-note alert alert--secondary"},(0,l.kt)("div",{parentName:"div",className:"admonition-heading"},(0,l.kt)("h5",{parentName:"div"},(0,l.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,l.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,l.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"}))),"note")),(0,l.kt)("div",{parentName:"div",className:"admonition-content"},(0,l.kt)("p",{parentName:"div"},"If you set up your OAuth2 provider to rotate your client secret, you can use the ",(0,l.kt)("inlineCode",{parentName:"p"},"client-secret-file")," option to reload the secret when it is updated."))))}g.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/js/7874e99f.97b5d23c.js b/assets/js/7874e99f.97b5d23c.js new file mode 100644 index 00000000..2bc182be --- /dev/null +++ b/assets/js/7874e99f.97b5d23c.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[6482],{3905:function(t,e,a){a.d(e,{Zo:function(){return s},kt:function(){return k}});var n=a(7294);function r(t,e,a){return e in t?Object.defineProperty(t,e,{value:a,enumerable:!0,configurable:!0,writable:!0}):t[e]=a,t}function l(t,e){var a=Object.keys(t);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(t);e&&(n=n.filter((function(e){return Object.getOwnPropertyDescriptor(t,e).enumerable}))),a.push.apply(a,n)}return a}function i(t){for(var e=1;e=0||(r[a]=t[a]);return r}(t,e);if(Object.getOwnPropertySymbols){var l=Object.getOwnPropertySymbols(t);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(t,a)&&(r[a]=t[a])}return r}var p=n.createContext({}),d=function(t){var e=n.useContext(p),a=e;return t&&(a="function"==typeof t?t(e):i(i({},e),t)),a},s=function(t){var e=d(t.components);return n.createElement(p.Provider,{value:e},t.children)},m={inlineCode:"code",wrapper:function(t){var e=t.children;return n.createElement(n.Fragment,{},e)}},u=n.forwardRef((function(t,e){var a=t.components,r=t.mdxType,l=t.originalType,p=t.parentName,s=o(t,["components","mdxType","originalType","parentName"]),u=d(a),k=r,N=u["".concat(p,".").concat(k)]||u[k]||m[k]||l;return a?n.createElement(N,i(i({ref:e},s),{},{components:a})):n.createElement(N,i({ref:e},s))}));function k(t,e){var a=arguments,r=e&&e.mdxType;if("string"==typeof t||r){var l=a.length,i=new Array(l);i[0]=u;var o={};for(var p in e)hasOwnProperty.call(e,p)&&(o[p]=e[p]);o.originalType=t,o.mdxType="string"==typeof t?t:r,i[1]=o;for(var d=2;dstring alias)",id:"string-alias",children:[],level:4}],level:3},{value:"GitHubOptions",id:"githuboptions",children:[],level:3},{value:"GitLabOptions",id:"gitlaboptions",children:[],level:3},{value:"GoogleOptions",id:"googleoptions",children:[],level:3},{value:"Header",id:"header",children:[],level:3},{value:"HeaderValue",id:"headervalue",children:[],level:3},{value:"KeycloakOptions",id:"keycloakoptions",children:[],level:3},{value:"LoginGovOptions",id:"logingovoptions",children:[],level:3},{value:"OIDCOptions",id:"oidcoptions",children:[],level:3},{value:"Provider",id:"provider",children:[],level:3},{value:"Providers",id:"providers",children:[{value:"([]Provider alias)",id:"provider-alias",children:[],level:4}],level:3},{value:"SecretSource",id:"secretsource",children:[],level:3},{value:"Server",id:"server",children:[],level:3},{value:"TLS",id:"tls",children:[],level:3},{value:"Upstream",id:"upstream",children:[],level:3},{value:"UpstreamConfig",id:"upstreamconfig",children:[],level:3}],level:2}],m={toc:s};function u(t){var e=t.components,a=(0,r.Z)(t,i);return(0,l.kt)("wrapper",(0,n.Z)({},m,a,{components:e,mdxType:"MDXLayout"}),(0,l.kt)("div",{className:"admonition admonition-warning alert alert--danger"},(0,l.kt)("div",{parentName:"div",className:"admonition-heading"},(0,l.kt)("h5",{parentName:"div"},(0,l.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,l.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"12",height:"16",viewBox:"0 0 12 16"},(0,l.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M5.05.31c.81 2.17.41 3.38-.52 4.31C3.55 5.67 1.98 6.45.9 7.98c-1.45 2.05-1.7 6.53 3.53 7.7-2.2-1.16-2.67-4.52-.3-6.61-.61 2.03.53 3.33 1.94 2.86 1.39-.47 2.3.53 2.27 1.67-.02.78-.31 1.44-1.13 1.81 3.42-.59 4.78-3.42 4.78-5.56 0-2.84-2.53-3.22-1.25-5.61-1.52.13-2.03 1.13-1.89 2.75.09 1.08-1.02 1.8-1.86 1.33-.67-.41-.66-1.19-.06-1.78C8.18 5.31 8.68 2.45 5.05.32L5.03.3l.02.01z"}))),"warning")),(0,l.kt)("div",{parentName:"div",className:"admonition-content"},(0,l.kt)("p",{parentName:"div"},"This page contains documentation for alpha features.\nWe reserve the right to make breaking changes to the features detailed within this page with no notice."),(0,l.kt)("p",{parentName:"div"},"Options described in this page may be changed, removed, renamed or moved without prior warning.\nPlease beware of this before you use alpha configuration options."))),(0,l.kt)("p",null,"This page details a set of ",(0,l.kt)("strong",{parentName:"p"},"alpha")," configuration options in a new format.\nGoing forward we are intending to add structured configuration in YAML format to\nreplace the existing TOML based configuration file and flags."),(0,l.kt)("p",null,"Below is a reference for the structure of the configuration, with\n",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions")," as the root of the configuration."),(0,l.kt)("p",null,"When using alpha configuration, your config file will look something like below:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},"upstreams:\n - id: ...\n ...\ninjectRequestHeaders:\n - name: ...\n ...\ninjectResponseHeaders:\n - name: ...\n ...\n")),(0,l.kt)("p",null,"Please browse the ",(0,l.kt)("a",{parentName:"p",href:"#configuration-reference"},"reference")," below for the structure\nof the new configuration format."),(0,l.kt)("h2",{id:"using-alpha-configuration"},"Using Alpha Configuration"),(0,l.kt)("p",null,"To use the new ",(0,l.kt)("strong",{parentName:"p"},"alpha")," configuration, generate a YAML file based on the format\ndescribed in the ",(0,l.kt)("a",{parentName:"p",href:"#configuration-reference"},"reference")," below."),(0,l.kt)("p",null,"Provide the path to this file using the ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config")," flag."),(0,l.kt)("div",{className:"admonition admonition-note alert alert--secondary"},(0,l.kt)("div",{parentName:"div",className:"admonition-heading"},(0,l.kt)("h5",{parentName:"div"},(0,l.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,l.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,l.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"}))),"note")),(0,l.kt)("div",{parentName:"div",className:"admonition-content"},(0,l.kt)("p",{parentName:"div"},"When using the ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config")," flag, some options are no longer available.\nSee ",(0,l.kt)("a",{parentName:"p",href:"#removed-options"},"removed options")," below for more information."))),(0,l.kt)("h3",{id:"converting-configuration-to-the-new-structure"},"Converting configuration to the new structure"),(0,l.kt)("p",null,"Before adding the new ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config")," option, start OAuth2 Proxy using the\n",(0,l.kt)("inlineCode",{parentName:"p"},"convert-config-to-alpha")," flag to convert existing configuration to the new format."),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-bash"},"oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg\n")),(0,l.kt)("p",null,"This will convert any options supported by the new format to YAML and print the\nnew configuration to ",(0,l.kt)("inlineCode",{parentName:"p"},"STDOUT"),"."),(0,l.kt)("p",null,"Copy this to a new file, remove any options from your existing configuration\nnoted in ",(0,l.kt)("a",{parentName:"p",href:"#removed-options"},"removed options")," and then start OAuth2 Proxy using\nthe new config."),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-bash"},"oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg\n")),(0,l.kt)("h2",{id:"removed-options"},"Removed options"),(0,l.kt)("p",null,"The following flags/options and their respective environment variables are no\nlonger available when using alpha configuration:"),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"flush-interval"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"flush_interval")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-host-header"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_host_header")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"proxy-websockets"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"proxy_websockets")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"ssl-upstream-insecure-skip-verify"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"ssl_upstream_insecure_skip_verify")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"upstream"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"upstreams"))),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-basic-auth"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_basic_auth")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-access-token"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_access_token")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-user-headers"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_user_headers")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-authorization-header"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_authorization_header")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"set-basic-auth"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"set_basic_auth")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"set-xauthrequest"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"set_xauthrequest")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"set-authorization-header"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"set_authorization_header")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"prefer-email-to-user"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"prefer_email_to_user")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"basic-auth-password"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"basic_auth_password")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"skip-auth-strip-headers"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"skip_auth_strip_headers"))),(0,l.kt)("p",null,"Attempting to use these options via flags or via config when ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config"),"\nset will result in an error."),(0,l.kt)("div",{className:"admonition admonition-important alert alert--info"},(0,l.kt)("div",{parentName:"div",className:"admonition-heading"},(0,l.kt)("h5",{parentName:"div"},(0,l.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,l.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,l.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"}))),"important")),(0,l.kt)("div",{parentName:"div",className:"admonition-content"},(0,l.kt)("p",{parentName:"div"},"You must remove these options before starting OAuth2 Proxy with ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config")))),(0,l.kt)("h2",{id:"configuration-reference"},"Configuration Reference"),(0,l.kt)("h3",{id:"adfsoptions"},"ADFSOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"skipScope")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"Skip adding the scope parameter in login request",(0,l.kt)("br",null),"Default value is 'false'")))),(0,l.kt)("h3",{id:"alphaoptions"},"AlphaOptions"),(0,l.kt)("p",null,"AlphaOptions contains alpha structured configuration options.\nUsage of these options allows users to access alpha features that are not\navailable as part of the primary configuration structure for OAuth2 Proxy."),(0,l.kt)("div",{className:"admonition admonition-warning alert alert--danger"},(0,l.kt)("div",{parentName:"div",className:"admonition-heading"},(0,l.kt)("h5",{parentName:"div"},(0,l.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,l.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"12",height:"16",viewBox:"0 0 12 16"},(0,l.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M5.05.31c.81 2.17.41 3.38-.52 4.31C3.55 5.67 1.98 6.45.9 7.98c-1.45 2.05-1.7 6.53 3.53 7.7-2.2-1.16-2.67-4.52-.3-6.61-.61 2.03.53 3.33 1.94 2.86 1.39-.47 2.3.53 2.27 1.67-.02.78-.31 1.44-1.13 1.81 3.42-.59 4.78-3.42 4.78-5.56 0-2.84-2.53-3.22-1.25-5.61-1.52.13-2.03 1.13-1.89 2.75.09 1.08-1.02 1.8-1.86 1.33-.67-.41-.66-1.19-.06-1.78C8.18 5.31 8.68 2.45 5.05.32L5.03.3l.02.01z"}))),"warning")),(0,l.kt)("div",{parentName:"div",className:"admonition-content"},(0,l.kt)("p",{parentName:"div"},"The options within this structure are considered alpha.\nThey may change between releases without notice."))),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"upstreamConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#upstreamconfig"},"UpstreamConfig"))),(0,l.kt)("td",{parentName:"tr",align:null},"UpstreamConfig is used to configure upstream servers.",(0,l.kt)("br",null),"Once a user is authenticated, requests to the server will be proxied to",(0,l.kt)("br",null),"these upstream servers based on the path mappings defined in this list.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"injectRequestHeaders")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#header"},"[]Header"))),(0,l.kt)("td",{parentName:"tr",align:null},"InjectRequestHeaders is used to configure headers that should be added",(0,l.kt)("br",null),"to requests to upstream servers.",(0,l.kt)("br",null),"Headers may source values from either the authenticated user's session",(0,l.kt)("br",null),"or from a static secret value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"injectResponseHeaders")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#header"},"[]Header"))),(0,l.kt)("td",{parentName:"tr",align:null},"InjectResponseHeaders is used to configure headers that should be added",(0,l.kt)("br",null),"to responses from the proxy.",(0,l.kt)("br",null),"This is typically used when using the proxy as an external authentication",(0,l.kt)("br",null),"provider in conjunction with another proxy such as NGINX and its",(0,l.kt)("br",null),"auth_request module.",(0,l.kt)("br",null),"Headers may source values from either the authenticated user's session",(0,l.kt)("br",null),"or from a static secret value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"server")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#server"},"Server"))),(0,l.kt)("td",{parentName:"tr",align:null},"Server is used to configure the HTTP(S) server for the proxy application.",(0,l.kt)("br",null),"You may choose to run both HTTP and HTTPS servers simultaneously.",(0,l.kt)("br",null),"This can be done by setting the BindAddress and the SecureBindAddress simultaneously.",(0,l.kt)("br",null),"To use the secure server you must configure a TLS certificate and key.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"metricsServer")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#server"},"Server"))),(0,l.kt)("td",{parentName:"tr",align:null},"MetricsServer is used to configure the HTTP(S) server for metrics.",(0,l.kt)("br",null),"You may choose to run both HTTP and HTTPS servers simultaneously.",(0,l.kt)("br",null),"This can be done by setting the BindAddress and the SecureBindAddress simultaneously.",(0,l.kt)("br",null),"To use the secure server you must configure a TLS certificate and key.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"providers")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#providers"},"Providers"))),(0,l.kt)("td",{parentName:"tr",align:null},"Providers is used to configure multiple providers.")))),(0,l.kt)("h3",{id:"azureoptions"},"AzureOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"tenant")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Tenant directs to a tenant-specific or common (tenant-independent) endpoint",(0,l.kt)("br",null),"Default value is 'common'")))),(0,l.kt)("h3",{id:"bitbucketoptions"},"BitbucketOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"team")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Team sets restrict logins to members of this team")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"repository")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Repository sets restrict logins to user with access to this repository")))),(0,l.kt)("h3",{id:"claimsource"},"ClaimSource"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#headervalue"},"HeaderValue"),")"),(0,l.kt)("p",null,"ClaimSource allows loading a header value from a claim within the session"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"claim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Claim is the name of the claim in the session that the value should be",(0,l.kt)("br",null),"loaded from.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"prefix")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Prefix is an optional prefix that will be prepended to the value of the",(0,l.kt)("br",null),"claim if it is non-empty.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"basicAuthPassword")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,l.kt)("td",{parentName:"tr",align:null},"BasicAuthPassword converts this claim into a basic auth header.",(0,l.kt)("br",null),"Note the value of claim will become the basic auth username and the",(0,l.kt)("br",null),"basicAuthPassword will be used as the password value.")))),(0,l.kt)("h3",{id:"duration"},"Duration"),(0,l.kt)("h4",{id:"string-alias"},"(",(0,l.kt)("inlineCode",{parentName:"h4"},"string")," alias)"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#upstream"},"Upstream"),")"),(0,l.kt)("p",null,'Duration is as string representation of a period of time.\nA duration string is a is a possibly signed sequence of decimal numbers,\neach with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".\nValid time units are "ns", "us" (or "\xb5s"), "ms", "s", "m", "h".'),(0,l.kt)("h3",{id:"githuboptions"},"GitHubOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"org")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Org sets restrict logins to members of this organisation")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"team")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Team sets restrict logins to members of this team")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"repo")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Repo sets restrict logins to collaborators of this repository")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"token")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Token is the token to use when verifying repository collaborators",(0,l.kt)("br",null),"it must have push access to the repository")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"users")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Users allows users with these usernames to login",(0,l.kt)("br",null),"even if they do not belong to the specified org and team or collaborators")))),(0,l.kt)("h3",{id:"gitlaboptions"},"GitLabOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"group")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Group sets restrict logins to members of this group")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"projects")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Projects restricts logins to members of any of these projects")))),(0,l.kt)("h3",{id:"googleoptions"},"GoogleOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"group")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Groups sets restrict logins to members of this google group")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"adminEmail")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"AdminEmail is the google admin to impersonate for api calls")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"serviceAccountJson")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ServiceAccountJSON is the path to the service account json credentials")))),(0,l.kt)("h3",{id:"header"},"Header"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions"),")"),(0,l.kt)("p",null,"Header represents an individual header that will be added to a request or\nresponse header."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"name")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Name is the header name to be used for this set of values.",(0,l.kt)("br",null),"Names should be unique within a list of Headers.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"preserveRequestValue")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"PreserveRequestValue determines whether any values for this header",(0,l.kt)("br",null),"should be preserved for the request to the upstream server.",(0,l.kt)("br",null),"This option only applies to injected request headers.",(0,l.kt)("br",null),"Defaults to false (headers that match this header will be stripped).")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"values")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#headervalue"},"[]HeaderValue"))),(0,l.kt)("td",{parentName:"tr",align:null},"Values contains the desired values for this header")))),(0,l.kt)("h3",{id:"headervalue"},"HeaderValue"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#header"},"Header"),")"),(0,l.kt)("p",null,"HeaderValue represents a single header value and the sources that can\nmake up the header value"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"value")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]byte")),(0,l.kt)("td",{parentName:"tr",align:null},"Value expects a base64 encoded string value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"fromEnv")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"FromEnv expects the name of an environment variable.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"fromFile")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"FromFile expects a path to a file containing the secret value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"claim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Claim is the name of the claim in the session that the value should be",(0,l.kt)("br",null),"loaded from.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"prefix")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Prefix is an optional prefix that will be prepended to the value of the",(0,l.kt)("br",null),"claim if it is non-empty.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"basicAuthPassword")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,l.kt)("td",{parentName:"tr",align:null},"BasicAuthPassword converts this claim into a basic auth header.",(0,l.kt)("br",null),"Note the value of claim will become the basic auth username and the",(0,l.kt)("br",null),"basicAuthPassword will be used as the password value.")))),(0,l.kt)("h3",{id:"keycloakoptions"},"KeycloakOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"groups")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Group enables to restrict login to members of indicated group")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"roles")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Role enables to restrict login to users with role (only available when using the keycloak-oidc provider)")))),(0,l.kt)("h3",{id:"logingovoptions"},"LoginGovOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"jwtKey")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"JWTKey is a private key in PEM format used to sign JWT,")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"jwtKeyFile")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"JWTKeyFile is a path to the private key file in PEM format used to sign the JWT")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"pubjwkURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"PubJWKURL is the JWK pubkey access endpoint")))),(0,l.kt)("h3",{id:"oidcoptions"},"OIDCOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"issuerURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"IssuerURL is the OpenID Connect issuer URL",(0,l.kt)("br",null),"eg: ",(0,l.kt)("a",{parentName:"td",href:"https://accounts.google.com"},"https://accounts.google.com"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"insecureAllowUnverifiedEmail")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"InsecureAllowUnverifiedEmail prevents failures if an email address in an id_token is not verified",(0,l.kt)("br",null),"default set to 'false'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"insecureSkipIssuerVerification")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"InsecureSkipIssuerVerification skips verification of ID token issuers. When false, ID Token Issuers must match the OIDC discovery URL",(0,l.kt)("br",null),"default set to 'false'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"insecureSkipNonce")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"InsecureSkipNonce skips verifying the ID Token's nonce claim that must match",(0,l.kt)("br",null),"the random nonce sent in the initial OAuth flow. Otherwise, the nonce is checked",(0,l.kt)("br",null),"after the initial OAuth redeem & subsequent token refreshes.",(0,l.kt)("br",null),"default set to 'true'",(0,l.kt)("br",null),"Warning: In a future release, this will change to 'false' by default for enhanced security.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"skipDiscovery")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"SkipDiscovery allows to skip OIDC discovery and use manually supplied Endpoints",(0,l.kt)("br",null),"default set to 'false'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"jwksURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"JwksURL is the OpenID Connect JWKS URL",(0,l.kt)("br",null),"eg: ",(0,l.kt)("a",{parentName:"td",href:"https://www.googleapis.com/oauth2/v3/certs"},"https://www.googleapis.com/oauth2/v3/certs"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"emailClaim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"EmailClaim indicates which claim contains the user email,",(0,l.kt)("br",null),"default set to 'email'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"groupsClaim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"GroupsClaim indicates which claim contains the user groups",(0,l.kt)("br",null),"default set to 'groups'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"userIDClaim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"UserIDClaim indicates which claim contains the user ID",(0,l.kt)("br",null),"default set to 'email'")))),(0,l.kt)("h3",{id:"provider"},"Provider"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#providers"},"Providers"),")"),(0,l.kt)("p",null,"Provider holds all configuration for a single provider"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"clientID")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ClientID is the OAuth Client ID that is defined in the provider",(0,l.kt)("br",null),"This value is required for all providers.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"clientSecret")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ClientSecret is the OAuth Client Secret that is defined in the provider",(0,l.kt)("br",null),"This value is required for all providers.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"clientSecretFile")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ClientSecretFile is the name of the file",(0,l.kt)("br",null),"containing the OAuth Client Secret, it will be used if ClientSecret is not set.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"keycloakConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#keycloakoptions"},"KeycloakOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"KeycloakConfig holds all configurations for Keycloak provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"azureConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#azureoptions"},"AzureOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"AzureConfig holds all configurations for Azure provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"ADFSConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#adfsoptions"},"ADFSOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"ADFSConfig holds all configurations for ADFS provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"bitbucketConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#bitbucketoptions"},"BitbucketOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"BitbucketConfig holds all configurations for Bitbucket provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"githubConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#githuboptions"},"GitHubOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"GitHubConfig holds all configurations for GitHubC provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"gitlabConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#gitlaboptions"},"GitLabOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"GitLabConfig holds all configurations for GitLab provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"googleConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#googleoptions"},"GoogleOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"GoogleConfig holds all configurations for Google provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"oidcConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#oidcoptions"},"OIDCOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"OIDCConfig holds all configurations for OIDC provider",(0,l.kt)("br",null),"or providers utilize OIDC configurations.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"loginGovConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#logingovoptions"},"LoginGovOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"LoginGovConfig holds all configurations for LoginGov provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"id")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ID should be a unique identifier for the provider.",(0,l.kt)("br",null),"This value is required for all providers.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"provider")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Type is the OAuth provider",(0,l.kt)("br",null),"must be set from the supported providers group,",(0,l.kt)("br",null),"otherwise 'Google' is set as default")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"name")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Name is the providers display name",(0,l.kt)("br",null),"if set, it will be shown to the users in the login page.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"caFiles")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"CAFiles is a list of paths to CA certificates that should be used when connecting to the provider.",(0,l.kt)("br",null),"If not specified, the default Go trust sources are used instead")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"loginURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"LoginURL is the authentication endpoint")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"redeemURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"RedeemURL is the token redemption endpoint")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"profileURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ProfileURL is the profile access endpoint")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"resource")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ProtectedResource is the resource that is protected (Azure AD and ADFS only)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"validateURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ValidateURL is the access token validation endpoint")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"scope")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Scope is the OAuth scope specification")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"prompt")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Prompt is OIDC prompt")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"approvalPrompt")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ApprovalPrompt is the OAuth approval_prompt",(0,l.kt)("br",null),"default is set to 'force'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"allowedGroups")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"AllowedGroups is a list of restrict logins to members of this group")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"acrValues")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"AcrValues is a string of acr values")))),(0,l.kt)("h3",{id:"providers"},"Providers"),(0,l.kt)("h4",{id:"provider-alias"},"(",(0,l.kt)("a",{parentName:"h4",href:"#provider"},"[]Provider")," alias)"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions"),")"),(0,l.kt)("p",null,"Providers is a collection of definitions for providers."),(0,l.kt)("h3",{id:"secretsource"},"SecretSource"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#claimsource"},"ClaimSource"),", ",(0,l.kt)("a",{parentName:"p",href:"#headervalue"},"HeaderValue"),", ",(0,l.kt)("a",{parentName:"p",href:"#tls"},"TLS"),")"),(0,l.kt)("p",null,"SecretSource references an individual secret value.\nOnly one source within the struct should be defined at any time."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"value")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]byte")),(0,l.kt)("td",{parentName:"tr",align:null},"Value expects a base64 encoded string value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"fromEnv")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"FromEnv expects the name of an environment variable.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"fromFile")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"FromFile expects a path to a file containing the secret value.")))),(0,l.kt)("h3",{id:"server"},"Server"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions"),")"),(0,l.kt)("p",null,"Server represents the configuration for an HTTP(S) server"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"BindAddress")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"BindAddress is the address on which to serve traffic.",(0,l.kt)("br",null),'Leave blank or set to "-" to disable.')),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"SecureBindAddress")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"SecureBindAddress is the address on which to serve secure traffic.",(0,l.kt)("br",null),'Leave blank or set to "-" to disable.')),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"TLS")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#tls"},"TLS"))),(0,l.kt)("td",{parentName:"tr",align:null},"TLS contains the information for loading the certificate and key for the",(0,l.kt)("br",null),"secure traffic.")))),(0,l.kt)("h3",{id:"tls"},"TLS"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#server"},"Server"),")"),(0,l.kt)("p",null,"TLS contains the information for loading a TLS certifcate and key."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"Key")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,l.kt)("td",{parentName:"tr",align:null},"Key is the TLS key data to use.",(0,l.kt)("br",null),"Typically this will come from a file.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"Cert")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,l.kt)("td",{parentName:"tr",align:null},"Cert is the TLS certificate data to use.",(0,l.kt)("br",null),"Typically this will come from a file.")))),(0,l.kt)("h3",{id:"upstream"},"Upstream"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#upstreamconfig"},"UpstreamConfig"),")"),(0,l.kt)("p",null,"Upstream represents the configuration for an upstream server.\nRequests will be proxied to this upstream if the path matches the request path."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"id")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ID should be a unique identifier for the upstream.",(0,l.kt)("br",null),"This value is required for all upstreams.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"path")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Path is used to map requests to the upstream server.",(0,l.kt)("br",null),"The closest match will take precedence and all Paths must be unique.",(0,l.kt)("br",null),"Path can also take a pattern when used with RewriteTarget.",(0,l.kt)("br",null),"Path segments can be captured and matched using regular experessions.",(0,l.kt)("br",null),"Eg:",(0,l.kt)("br",null),"- ",(0,l.kt)("inlineCode",{parentName:"td"},"^/foo$"),": Match only the explicit path ",(0,l.kt)("inlineCode",{parentName:"td"},"/foo"),(0,l.kt)("br",null),"- ",(0,l.kt)("inlineCode",{parentName:"td"},"^/bar/$"),": Match any path prefixed with ",(0,l.kt)("inlineCode",{parentName:"td"},"/bar/"),(0,l.kt)("br",null),"- ",(0,l.kt)("inlineCode",{parentName:"td"},"^/baz/(.*)$"),": Match any path prefixed with ",(0,l.kt)("inlineCode",{parentName:"td"},"/baz")," and capture the remaining path for use with RewriteTarget")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"rewriteTarget")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"RewriteTarget allows users to rewrite the request path before it is sent to",(0,l.kt)("br",null),"the upstream server.",(0,l.kt)("br",null),"Use the Path to capture segments for reuse within the rewrite target.",(0,l.kt)("br",null),"Eg: With a Path of ",(0,l.kt)("inlineCode",{parentName:"td"},"^/baz/(.*)"),", a RewriteTarget of ",(0,l.kt)("inlineCode",{parentName:"td"},"/foo/$1")," would rewrite",(0,l.kt)("br",null),"the request ",(0,l.kt)("inlineCode",{parentName:"td"},"/baz/abc/123")," to ",(0,l.kt)("inlineCode",{parentName:"td"},"/foo/abc/123")," before proxying to the",(0,l.kt)("br",null),"upstream server.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"uri")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"The URI of the upstream server. This may be an HTTP(S) server of a File",(0,l.kt)("br",null),"based URL. It may include a path, in which case all requests will be served",(0,l.kt)("br",null),"under that path.",(0,l.kt)("br",null),"Eg:",(0,l.kt)("br",null),"- http://localhost:8080",(0,l.kt)("br",null),"- ",(0,l.kt)("a",{parentName:"td",href:"https://service.localhost"},"https://service.localhost"),(0,l.kt)("br",null),"- ",(0,l.kt)("a",{parentName:"td",href:"https://service.localhost/path"},"https://service.localhost/path"),(0,l.kt)("br",null),"- file://host/path",(0,l.kt)("br",null),'If the URI\'s path is "/base" and the incoming request was for "/dir",',(0,l.kt)("br",null),'the upstream request will be for "/base/dir".')),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"insecureSkipTLSVerify")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.",(0,l.kt)("br",null),"This option is insecure and will allow potential Man-In-The-Middle attacks",(0,l.kt)("br",null),"betweem OAuth2 Proxy and the usptream server.",(0,l.kt)("br",null),"Defaults to false.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"static")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"Static will make all requests to this upstream have a static response.",(0,l.kt)("br",null),'The response will have a body of "Authenticated" and a response code',(0,l.kt)("br",null),"matching StaticCode.",(0,l.kt)("br",null),"If StaticCode is not set, the response will return a 200 response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"staticCode")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"int")),(0,l.kt)("td",{parentName:"tr",align:null},"StaticCode determines the response code for the Static response.",(0,l.kt)("br",null),"This option can only be used with Static enabled.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"flushInterval")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#duration"},"Duration"))),(0,l.kt)("td",{parentName:"tr",align:null},"FlushInterval is the period between flushing the response buffer when",(0,l.kt)("br",null),"streaming response from the upstream.",(0,l.kt)("br",null),"Defaults to 1 second.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"passHostHeader")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"PassHostHeader determines whether the request host header should be proxied",(0,l.kt)("br",null),"to the upstream server.",(0,l.kt)("br",null),"Defaults to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"proxyWebSockets")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"ProxyWebSockets enables proxying of websockets to upstream servers",(0,l.kt)("br",null),"Defaults to true.")))),(0,l.kt)("h3",{id:"upstreamconfig"},"UpstreamConfig"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions"),")"),(0,l.kt)("p",null,"UpstreamConfig is a collection of definitions for upstream servers."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"proxyRawPath")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"ProxyRawPath will pass the raw url path to upstream allowing for url's",(0,l.kt)("br",null),'like: "/%2F/" which would otherwise be redirected to "/"')),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"upstreams")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#upstream"},"[]Upstream"))),(0,l.kt)("td",{parentName:"tr",align:null},"Upstreams represents the configuration for the upstream servers.",(0,l.kt)("br",null),"Requests will be proxied to this upstream if the path matches the request path.")))))}u.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/js/7b04b1d5.d117d167.js b/assets/js/7b04b1d5.d117d167.js new file mode 100644 index 00000000..f8b0c7d8 --- /dev/null +++ b/assets/js/7b04b1d5.d117d167.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[4998],{3905:function(e,t,r){r.d(t,{Zo:function(){return c},kt:function(){return f}});var n=r(7294);function o(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function a(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function i(e){for(var t=1;t=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var p=n.createContext({}),u=function(e){var t=n.useContext(p),r=t;return e&&(r="function"==typeof e?e(t):i(i({},t),e)),r},c=function(e){var t=u(e.components);return n.createElement(p.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return n.createElement(n.Fragment,{},t)}},d=n.forwardRef((function(e,t){var r=e.components,o=e.mdxType,a=e.originalType,p=e.parentName,c=l(e,["components","mdxType","originalType","parentName"]),d=u(r),f=o,m=d["".concat(p,".").concat(f)]||d[f]||s[f]||a;return r?n.createElement(m,i(i({ref:t},c),{},{components:r})):n.createElement(m,i({ref:t},c))}));function f(e,t){var r=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var a=r.length,i=new Array(a);i[0]=d;var l={};for(var p in t)hasOwnProperty.call(t,p)&&(l[p]=t[p]);l.originalType=e,l.mdxType="string"==typeof e?e:o,i[1]=l;for(var u=2;u&1 | grep OK\noauth2-proxy-x.y.z.linux-amd64: OK\n")),(0,a.kt)("ol",{start:2},(0,a.kt)("li",{parentName:"ol"},(0,a.kt)("a",{parentName:"li",href:"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider"},"Select a Provider and Register an OAuth Application with a Provider")),(0,a.kt)("li",{parentName:"ol"},(0,a.kt)("a",{parentName:"li",href:"/oauth2-proxy/docs/6.1.x/configuration/overview"},"Configure OAuth2 Proxy using config file, command line options, or environment variables")),(0,a.kt)("li",{parentName:"ol"},(0,a.kt)("a",{parentName:"li",href:"/oauth2-proxy/docs/6.1.x/configuration/tls"},"Configure SSL or Deploy behind a SSL endpoint")," (example provided for Nginx)")))}d.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/js/7dcecc8d.02aac3e1.js b/assets/js/7dcecc8d.02aac3e1.js new file mode 100644 index 00000000..abe3daf0 --- /dev/null +++ b/assets/js/7dcecc8d.02aac3e1.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[1351],{3905:function(e,t,o){o.d(t,{Zo:function(){return u},kt:function(){return h}});var a=o(7294);function n(e,t,o){return t in e?Object.defineProperty(e,t,{value:o,enumerable:!0,configurable:!0,writable:!0}):e[t]=o,e}function r(e,t){var o=Object.keys(e);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);t&&(a=a.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),o.push.apply(o,a)}return o}function i(e){for(var t=1;t=0||(n[o]=e[o]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(a=0;a=0||Object.prototype.propertyIsEnumerable.call(e,o)&&(n[o]=e[o])}return n}var p=a.createContext({}),s=function(e){var t=a.useContext(p),o=t;return e&&(o="function"==typeof e?e(t):i(i({},t),e)),o},u=function(e){var t=s(e.components);return a.createElement(p.Provider,{value:t},e.children)},c={inlineCode:"code",wrapper:function(e){var t=e.children;return a.createElement(a.Fragment,{},t)}},d=a.forwardRef((function(e,t){var o=e.components,n=e.mdxType,r=e.originalType,p=e.parentName,u=l(e,["components","mdxType","originalType","parentName"]),d=s(o),h=n,m=d["".concat(p,".").concat(h)]||d[h]||c[h]||r;return o?a.createElement(m,i(i({ref:t},u),{},{components:o})):a.createElement(m,i({ref:t},u))}));function h(e,t){var o=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var r=o.length,i=new Array(r);i[0]=d;var l={};for(var p in t)hasOwnProperty.call(t,p)&&(l[p]=t[p]);l.originalType=e,l.mdxType="string"==typeof e?e:n,i[1]=l;for(var s=2;s\n --client-secret=\n")),(0,r.kt)("p",null,"Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/7.0.x/configuration/session_storage#redis-storage"},"redis session storage")," should resolve this."),(0,r.kt)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new FB App from ",(0,r.kt)("a",{parentName:"li",href:"https://developers.facebook.com/"},"https://developers.facebook.com/")),(0,r.kt)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),(0,r.kt)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://github.com/settings/developers"},"https://github.com/settings/developers")),(0,r.kt)("li",{parentName:"ol"},"Under ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),(0,r.kt)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=*")),(0,r.kt)("p",null,"NOTE: When ",(0,r.kt)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),(0,r.kt)("p",null,"To restrict by organization only, include the following flag:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-org="": restrict logins to members of this organisation\n')),(0,r.kt)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",(0,r.kt)("inlineCode",{parentName:"p"},"-github-org"),":"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),(0,r.kt)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),(0,r.kt)("p",null,"If you'd like to allow access to users with ",(0,r.kt)("strong",{parentName:"p"},"read only")," access to a ",(0,r.kt)("strong",{parentName:"p"},"public")," repository you will need to provide a ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/settings/tokens"},"token")," for a user that has write access to the repository. The token must be created with at least the ",(0,r.kt)("inlineCode",{parentName:"p"},"public_repo")," scope:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-token="": the token to use when verifying repository collaborators\n')),(0,r.kt)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-user="": allow logins by username, separated by a comma\n')),(0,r.kt)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-login-url="http(s):///login/oauth/authorize"\n-redeem-url="http(s):///login/oauth/access_token"\n-validate-url="http(s):///api/v3"\n')),(0,r.kt)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create new client in your Keycloak with ",(0,r.kt)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",(0,r.kt)("strong",{parentName:"li"},"Valid Redirect URIs")," '",(0,r.kt)("a",{parentName:"li",href:"https://internal.yourcompany.com/oauth2/callback'"},"https://internal.yourcompany.com/oauth2/callback'")),(0,r.kt)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",(0,r.kt)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),(0,r.kt)("p",null,"Make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--provider=keycloak\n--client-id=\n--client-secret=\n--login-url="http(s):///auth/realms//protocol/openid-connect/auth"\n--redeem-url="http(s):///auth/realms//protocol/openid-connect/token"\n--profile-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n--validate-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n--keycloak-group=\n--keycloak-group=\n')),(0,r.kt)("p",null,"For group based authorization, the optional ",(0,r.kt)("inlineCode",{parentName:"p"},"--keycloak-group")," (legacy) or ",(0,r.kt)("inlineCode",{parentName:"p"},"--allowed-group")," (global standard)\nflags can be used to specify which groups to limit access to."),(0,r.kt)("p",null,"If these are unset but a ",(0,r.kt)("inlineCode",{parentName:"p"},"groups")," mapper is set up above in step (3), the provider will still\npopulate the ",(0,r.kt)("inlineCode",{parentName:"p"},"X-Forwarded-Groups")," header to your upstream server with the ",(0,r.kt)("inlineCode",{parentName:"p"},"groups")," data in the\nKeycloak userinfo endpoint response."),(0,r.kt)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak\nyou should define the 'keycloak-group' value to /admin."),(0,r.kt)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),(0,r.kt)("p",null,"This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/issues/994"},"994"),")."),(0,r.kt)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",(0,r.kt)("a",{parentName:"p",href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"},"these steps to add an application"),". Make sure to enable at least the ",(0,r.kt)("inlineCode",{parentName:"p"},"openid"),", ",(0,r.kt)("inlineCode",{parentName:"p"},"profile")," and ",(0,r.kt)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",(0,r.kt)("a",{parentName:"p",href:"https://myapp.com/oauth2/callback"},"https://myapp.com/oauth2/callback"),"."),(0,r.kt)("p",null,"If you need projects filtering, add the extra ",(0,r.kt)("inlineCode",{parentName:"p"},"read_api")," scope to your application."),(0,r.kt)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/7.0.x/configuration/overview#generating-a-cookie-secret"},"these steps")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider="gitlab"\n --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n --client-id=GITLAB_CLIENT_ID\n --client-secret=GITLAB_CLIENT_SECRET\n --cookie-secret=COOKIE_SECRET\n')),(0,r.kt)("p",null,"Restricting by group membership is possible with the following option:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),(0,r.kt)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--oidc-issuer-url=""\n')),(0,r.kt)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),(0,r.kt)("p",null,"For LinkedIn, the registration steps are:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://www.linkedin.com/secure/developer"},"https://www.linkedin.com/secure/developer")),(0,r.kt)("li",{parentName:"ol"},"In the OAuth User Agreement section:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),(0,r.kt)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),(0,r.kt)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),(0,r.kt)("li",{parentName:"ol"},"Take note of the ",(0,r.kt)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",(0,r.kt)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),(0,r.kt)("h3",{id:"microsoft-azure-ad-provider"},"Microsoft Azure AD Provider"),(0,r.kt)("p",null,"For adding an application to the Microsoft Azure AD follow ",(0,r.kt)("a",{parentName:"p",href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"},"these steps to add an application"),"."),(0,r.kt)("p",null,"Take note of your ",(0,r.kt)("inlineCode",{parentName:"p"},"TenantId")," if applicable for your situation. The ",(0,r.kt)("inlineCode",{parentName:"p"},"TenantId")," can be used to override the default ",(0,r.kt)("inlineCode",{parentName:"p"},"common")," authorization server with a tenant specific server."),(0,r.kt)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),(0,r.kt)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."),(0,r.kt)("p",null,"This provider was originally built against CoreOS Dex and we will use it as an example.\nThe OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below."),(0,r.kt)("h4",{id:"dex"},"Dex"),(0,r.kt)("p",null,"To configure the OIDC provider for Dex, perform the following steps:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Download Dex:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"go get github.com/dexidp/dex\n")),(0,r.kt)("p",{parentName:"li"},"See the ",(0,r.kt)("a",{parentName:"p",href:"https://dexidp.io/docs/getting-started/"},"getting started guide")," for more details.")),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the ",(0,r.kt)("inlineCode",{parentName:"p"},"staticClients")," section of ",(0,r.kt)("inlineCode",{parentName:"p"},"examples/config-dev.yaml"),":"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"- id: oauth2-proxy\nredirectURIs:\n- 'http://127.0.0.1:4180/oauth2/callback'\nname: 'oauth2-proxy'\nsecret: proxy\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Launch Dex: from ",(0,r.kt)("inlineCode",{parentName:"p"},"$GOPATH/github.com/dexidp/dex"),", run:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"bin/dex serve examples/config-dev.yaml\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"In a second terminal, run the oauth2-proxy with the following args:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'-provider oidc\n-provider-display-name "My OIDC Provider"\n-client-id oauth2-proxy\n-client-secret proxy\n-redirect-url http://127.0.0.1:4180/oauth2/callback\n-oidc-issuer-url http://127.0.0.1:5556/dex\n-cookie-secure=false\n-cookie-secret=secret\n-email-domain kilgore.trout\n')),(0,r.kt)("p",{parentName:"li"},"To serve the current working directory as a web site under the ",(0,r.kt)("inlineCode",{parentName:"p"},"/static")," endpoint, add:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"-upstream file://$PWD/#/static/\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Test the setup by visiting ",(0,r.kt)("a",{parentName:"p",href:"http://127.0.0.1:4180"},"http://127.0.0.1:4180")," or ",(0,r.kt)("a",{parentName:"p",href:"http://127.0.0.1:4180/static"},"http://127.0.0.1:4180/static")," ."))),(0,r.kt)("p",null,"See also ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment"},"our local testing environment")," for a self-contained example using Docker and etcd as storage for Dex."),(0,r.kt)("h4",{id:"okta"},"Okta"),(0,r.kt)("p",null,"To configure the OIDC provider for Okta, perform the following steps:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",(0,r.kt)("inlineCode",{parentName:"li"},"example.oktapreview.com")),(0,r.kt)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",(0,r.kt)("inlineCode",{parentName:"li"},"default")," will work.")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Security")," then select ",(0,r.kt)("strong",{parentName:"li"},"API")),(0,r.kt)("li",{parentName:"ul"},"Click ",(0,r.kt)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),(0,r.kt)("li",{parentName:"ul"},"Fill out the ",(0,r.kt)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),(0,r.kt)("li",{parentName:"ul"},"For ",(0,r.kt)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",(0,r.kt)("a",{parentName:"li",href:"https://example.corp.com"},"https://example.corp.com")),(0,r.kt)("li",{parentName:"ul"},"Fill out a ",(0,r.kt)("strong",{parentName:"li"},"Description")),(0,r.kt)("li",{parentName:"ul"},"Add any ",(0,r.kt)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),(0,r.kt)("li",{parentName:"ul"},"The default settings will work for other options.\n",(0,r.kt)("a",{parentName:"li",href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"},"See Okta documentation for more information on Authorization Servers"))),(0,r.kt)("ol",{start:3},(0,r.kt)("li",{parentName:"ol"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Applications")," then select ",(0,r.kt)("strong",{parentName:"li"},"Add Application"),".")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Select ",(0,r.kt)("strong",{parentName:"li"},"Web")," for the ",(0,r.kt)("strong",{parentName:"li"},"Platform")," setting."),(0,r.kt)("li",{parentName:"ul"},"Select ",(0,r.kt)("strong",{parentName:"li"},"OpenID Connect")," and click ",(0,r.kt)("strong",{parentName:"li"},"Create")),(0,r.kt)("li",{parentName:"ul"},"Pick an ",(0,r.kt)("strong",{parentName:"li"},"Application Name")," such as ",(0,r.kt)("inlineCode",{parentName:"li"},"Example App"),"."),(0,r.kt)("li",{parentName:"ul"},"Set the ",(0,r.kt)("strong",{parentName:"li"},"Login redirect URI")," to ",(0,r.kt)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),(0,r.kt)("li",{parentName:"ul"},"Under ",(0,r.kt)("strong",{parentName:"li"},"General")," set the ",(0,r.kt)("strong",{parentName:"li"},"Allowed grant types")," to ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization Code")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Refresh Token"),"."),(0,r.kt)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",(0,r.kt)("inlineCode",{parentName:"li"},"Client ID")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Client Secret"),"."),(0,r.kt)("li",{parentName:"ul"},"Under ",(0,r.kt)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),(0,r.kt)("ol",{start:4},(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Create a configuration file like the following:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n "https://example.corp.com"\n]\nemail_domains = [\n "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')))),(0,r.kt)("p",null,"The ",(0,r.kt)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",(0,r.kt)("strong",{parentName:"p"},"Authorization Server"),"'s ",(0,r.kt)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",(0,r.kt)("a",{parentName:"p",href:"https://corp.okta.com"},"https://corp.okta.com")," .\nThe ",(0,r.kt)("inlineCode",{parentName:"p"},"client_id")," and ",(0,r.kt)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",(0,r.kt)("inlineCode",{parentName:"p"},"client_secret")," to encrypt the cookie."),(0,r.kt)("p",null,"Then you can start the oauth2-proxy with ",(0,r.kt)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),(0,r.kt)("h4",{id:"okta---localhost"},"Okta - localhost"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Signup for developer account: ",(0,r.kt)("a",{parentName:"li",href:"https://developer.okta.com/signup/"},"https://developer.okta.com/signup/")),(0,r.kt)("li",{parentName:"ol"},"Create New ",(0,r.kt)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),(0,r.kt)("li",{parentName:"ol"},"Example Application Settings for localhost:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Name:")," My Web App"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Group assignments:")," ",(0,r.kt)("inlineCode",{parentName:"li"},"Everyone")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Grant type allowed:")," ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization Code")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Refresh Token")))),(0,r.kt)("li",{parentName:"ol"},"Make note of the ",(0,r.kt)("inlineCode",{parentName:"li"},"Client ID")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),(0,r.kt)("li",{parentName:"ol"},"Make note of the ",(0,r.kt)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),(0,r.kt)("li",{parentName:"ol"},"Example config file ",(0,r.kt)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n "http://0.0.0.0:8080"\n]\nemail_domains = [\n "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),(0,r.kt)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",(0,r.kt)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),(0,r.kt)("h3",{id:"logingov-provider"},"login.gov Provider"),(0,r.kt)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",(0,r.kt)("a",{parentName:"p",href:"https://login.gov/developers/"},"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),(0,r.kt)("p",null,"A developer guide is available here: ",(0,r.kt)("a",{parentName:"p",href:"https://developers.login.gov/"},"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),(0,r.kt)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),(0,r.kt)("p",null,"First, register your application in the dashboard. The important bits are:"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Identity protocol: make this ",(0,r.kt)("inlineCode",{parentName:"li"},"Openid connect")),(0,r.kt)("li",{parentName:"ul"},"Issuer: do what they say for OpenID Connect. We will refer to this string as ",(0,r.kt)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),(0,r.kt)("li",{parentName:"ul"},"Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",(0,r.kt)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",(0,r.kt)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",(0,r.kt)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),(0,r.kt)("li",{parentName:"ul"},"Return to App URL: Make this be ",(0,r.kt)("inlineCode",{parentName:"li"},"http://localhost:4180/")),(0,r.kt)("li",{parentName:"ul"},"Redirect URIs: Make this be ",(0,r.kt)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),(0,r.kt)("li",{parentName:"ul"},"Attribute Bundle: Make sure that email is selected.")),(0,r.kt)("p",null,"Now start the proxy up with the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'./oauth2-proxy -provider login.gov \\\n -client-id=${LOGINGOV_ISSUER} \\\n -redirect-url=http://localhost:4180/oauth2/callback \\\n -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n -cookie-secure=false \\\n -email-domain=gsa.gov \\\n -upstream=http://localhost:3000/ \\\n -cookie-secret=somerandomstring12341234567890AB \\\n -cookie-domain=localhost \\\n -skip-provider-button=true \\\n -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),(0,r.kt)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",(0,r.kt)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",(0,r.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",(0,r.kt)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),(0,r.kt)("p",null,"Once it is running, you should be able to go to ",(0,r.kt)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",(0,r.kt)("inlineCode",{parentName:"p"},"http://localhost:3000/"),". In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),(0,r.kt)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),(0,r.kt)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),(0,r.kt)("p",null,"In this case, you can set the ",(0,r.kt)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," -provider oidc\n -client-id oauth2-proxy\n -client-secret proxy\n -redirect-url http://127.0.0.1:4180/oauth2/callback\n -oidc-issuer-url http://127.0.0.1:5556\n -skip-oidc-discovery\n -login-url http://127.0.0.1:5556/authorize\n -redeem-url http://127.0.0.1:5556/token\n -oidc-jwks-url http://127.0.0.1:5556/keys\n -cookie-secure=false\n -email-domain example.com\n")),(0,r.kt)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),(0,r.kt)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),(0,r.kt)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",(0,r.kt)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",(0,r.kt)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),(0,r.kt)("p",null,"Refer to the ",(0,r.kt)("a",{parentName:"p",href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"},"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',(0,r.kt)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' -provider nextcloud\n -client-id \n -client-secret \n -login-url="/index.php/apps/oauth2/authorize"\n -redeem-url="/index.php/apps/oauth2/api/v1/token"\n -validate-url="/ocs/v2.php/cloud/user?format=json"\n')),(0,r.kt)("p",null,"Note: in ",(0,r.kt)("em",{parentName:"p"},"all")," cases the validate-url will ",(0,r.kt)("em",{parentName:"p"},"not")," have the ",(0,r.kt)("inlineCode",{parentName:"p"},"index.php"),"."),(0,r.kt)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("a",{parentName:"li",href:"https://cloud.digitalocean.com/account/api/applications"},"Create a new OAuth application"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),(0,r.kt)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',(0,r.kt)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",(0,r.kt)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),(0,r.kt)("p",null,"To use the provider, pass the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=digitalocean\n --client-id=\n --client-secret=\n")),(0,r.kt)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",(0,r.kt)("inlineCode",{parentName:"p"},"https:///oauth2/callback"),". If you need to change it, you can use the ",(0,r.kt)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),(0,r.kt)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("a",{parentName:"li",href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"},"Add a new OAuth consumer"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},'In "Callback URL" use ',(0,r.kt)("inlineCode",{parentName:"li"},"https:///oauth2/callback"),", substituting ",(0,r.kt)("inlineCode",{parentName:"li"},"")," with the actual hostname that oauth2-proxy is running on."),(0,r.kt)("li",{parentName:"ul"},"In Permissions section select:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"Account -> Email"),(0,r.kt)("li",{parentName:"ul"},"Team membership -> Read"),(0,r.kt)("li",{parentName:"ul"},"Repositories -> Read"))))),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),(0,r.kt)("p",null,"To use the provider, pass the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=bitbucket\n --client-id=\n --client-secret=\n")),(0,r.kt)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",(0,r.kt)("inlineCode",{parentName:"p"},"--bitbucket-team="),". To restrict the access to only these users who has access to one selected repository use ",(0,r.kt)("inlineCode",{parentName:"p"},"--bitbucket-repository="),"."),(0,r.kt)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new application: ",(0,r.kt)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),(0,r.kt)("li",{parentName:"ol"},"Under ",(0,r.kt)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",(0,r.kt)("inlineCode",{parentName:"li"},"https:///oauth2/callback")),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),(0,r.kt)("li",{parentName:"ol"},"Pass the following options to the proxy:")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider="github"\n --redirect-url="https:///oauth2/callback"\n --provider-display-name="Gitea"\n --client-id="< client_id as generated by Gitea >"\n --client-secret="< client_secret as generated by Gitea >"\n --login-url="https://< your gitea host >/login/oauth/authorize"\n --redeem-url="https://< your gitea host >/login/oauth/access_token"\n --validate-url="https://< your gitea host >/api/v1"\n')),(0,r.kt)("h2",{id:"email-authentication"},"Email Authentication"),(0,r.kt)("p",null,"To authorize by email domain use ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",(0,r.kt)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),(0,r.kt)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),(0,r.kt)("p",null,"Follow the examples in the ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"},(0,r.kt)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",(0,r.kt)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",(0,r.kt)("inlineCode",{parentName:"p"},"case")," to\n",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"},(0,r.kt)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",(0,r.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",(0,r.kt)("inlineCode",{parentName:"p"},"Provider"),"."))}d.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/js/8c826f25.83c9869e.js b/assets/js/8c826f25.83c9869e.js new file mode 100644 index 00000000..8dff12a2 --- /dev/null +++ b/assets/js/8c826f25.83c9869e.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[9890],{3905:function(t,e,n){n.d(e,{Zo:function(){return p},kt:function(){return k}});var a=n(7294);function r(t,e,n){return e in t?Object.defineProperty(t,e,{value:n,enumerable:!0,configurable:!0,writable:!0}):t[e]=n,t}function l(t,e){var n=Object.keys(t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(t);e&&(a=a.filter((function(e){return Object.getOwnPropertyDescriptor(t,e).enumerable}))),n.push.apply(n,a)}return n}function i(t){for(var e=1;e=0||(r[n]=t[n]);return r}(t,e);if(Object.getOwnPropertySymbols){var l=Object.getOwnPropertySymbols(t);for(a=0;a=0||Object.prototype.propertyIsEnumerable.call(t,n)&&(r[n]=t[n])}return r}var d=a.createContext({}),s=function(t){var e=a.useContext(d),n=e;return t&&(n="function"==typeof t?t(e):i(i({},e),t)),n},p=function(t){var e=s(t.components);return a.createElement(d.Provider,{value:e},t.children)},u={inlineCode:"code",wrapper:function(t){var e=t.children;return a.createElement(a.Fragment,{},e)}},m=a.forwardRef((function(t,e){var n=t.components,r=t.mdxType,l=t.originalType,d=t.parentName,p=o(t,["components","mdxType","originalType","parentName"]),m=s(n),k=r,g=m["".concat(d,".").concat(k)]||m[k]||u[k]||l;return n?a.createElement(g,i(i({ref:e},p),{},{components:n})):a.createElement(g,i({ref:e},p))}));function k(t,e){var n=arguments,r=e&&e.mdxType;if("string"==typeof t||r){var l=n.length,i=new Array(l);i[0]=m;var o={};for(var d in e)hasOwnProperty.call(e,d)&&(o[d]=e[d]);o.originalType=t,o.mdxType="string"==typeof t?t:r,i[1]=o;for(var s=2;s child <"+("string"==typeof t.type?t.type:t.type.name)+'>: all children of the component should be , and every should have a unique "value" prop.')})),h=null!=m?m:N.map((function(t){var e=t.props;return{value:e.value,label:e.label,attributes:e.attributes}})),c=(0,i.lx)(h,(function(t,e){return t.value===e.value}));if(c.length>0)throw new Error('Docusaurus error: Duplicate values "'+c.map((function(t){return t.value})).join(", ")+'" found in . Every value needs to be unique.');var f=null===u?u:null!=(e=null!=u?u:null==(n=N.find((function(t){return t.props.default})))?void 0:n.props.value)?e:null==(l=N[0])?void 0:l.props.value;if(null!==f&&!h.some((function(t){return t.value===f})))throw new Error('Docusaurus error: The has a defaultValue "'+f+'" but none of its children has the corresponding value. Available values are: '+h.map((function(t){return t.value})).join(", ")+". If you intend to show no default tab, use defaultValue={null} instead.");var b=(0,i.UB)(),y=b.tabGroupChoices,v=b.setTabGroupChoices,C=(0,r.useState)(f),w=C[0],_=C[1],x=[],T=(0,i.o5)().blockElementScrollPositionUntilNextRender;if(null!=k){var A=y[k];null!=A&&A!==w&&h.some((function(t){return t.value===A}))&&_(A)}var q=function(t){var e=t.currentTarget,n=x.indexOf(e),a=h[n].value;a!==w&&(T(e),_(a),null!=k&&v(k,a))},P=function(t){var e,n=null;switch(t.key){case"ArrowRight":var a=x.indexOf(t.currentTarget)+1;n=x[a]||x[0];break;case"ArrowLeft":var r=x.indexOf(t.currentTarget)-1;n=x[r]||x[x.length-1]}null==(e=n)||e.focus()};return r.createElement("div",{className:"tabs-container"},r.createElement("ul",{role:"tablist","aria-orientation":"horizontal",className:(0,o.Z)("tabs",{"tabs--block":p},g)},h.map((function(t){var e=t.value,n=t.label,l=t.attributes;return r.createElement("li",(0,a.Z)({role:"tab",tabIndex:w===e?0:-1,"aria-selected":w===e,key:e,ref:function(t){return x.push(t)},onKeyDown:P,onFocus:q,onClick:q},l,{className:(0,o.Z)("tabs__item",d,null==l?void 0:l.className,{"tabs__item--active":w===e})}),null!=n?n:e)}))),s?(0,r.cloneElement)(N.filter((function(t){return t.props.value===w}))[0],{className:"margin-vert--md"}):r.createElement("div",{className:"margin-vert--md"},N.map((function(t,e){return(0,r.cloneElement)(t,{key:e,hidden:t.props.value!==w})}))))}function p(t){var e=(0,l.Z)();return r.createElement(s,(0,a.Z)({key:String(e)},t))}},5508:function(t,e,n){n.r(e),n.d(e,{frontMatter:function(){return s},contentTitle:function(){return p},metadata:function(){return u},toc:function(){return m},default:function(){return g}});var a=n(7462),r=n(3366),l=(n(7294),n(3905)),i=n(9877),o=n(8215),d=["components"],s={id:"overview",title:"Overview"},p=void 0,u={unversionedId:"configuration/overview",id:"version-7.0.x/configuration/overview",title:"Overview",description:"oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings).",source:"@site/versioned_docs/version-7.0.x/configuration/overview.md",sourceDirName:"configuration",slug:"/configuration/overview",permalink:"/oauth2-proxy/docs/7.0.x/configuration/overview",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.0.x/configuration/overview.md",tags:[],version:"7.0.x",frontMatter:{id:"overview",title:"Overview"},sidebar:"version-7.0.x/docs",previous:{title:"Behaviour",permalink:"/oauth2-proxy/docs/7.0.x/behaviour"},next:{title:"OAuth Provider Configuration",permalink:"/oauth2-proxy/docs/7.0.x/configuration/oauth_provider"}},m=[{value:"Generating a Cookie Secret",id:"generating-a-cookie-secret",children:[],level:3},{value:"Config File",id:"config-file",children:[],level:3},{value:"Command Line Options",id:"command-line-options",children:[],level:3},{value:"Upstreams Configuration",id:"upstreams-configuration",children:[],level:3},{value:"Environment variables",id:"environment-variables",children:[],level:3},{value:"Logging Configuration",id:"logging-configuration",children:[{value:"Auth Log Format",id:"auth-log-format",children:[],level:3},{value:"Request Log Format",id:"request-log-format",children:[],level:3},{value:"Standard Log Format",id:"standard-log-format",children:[],level:3}],level:2},{value:"Configuring for use with the Nginx auth_request directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",children:[],level:2},{value:"Configuring for use with the Traefik (v2) ForwardAuth middleware",id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware",children:[{value:"ForwardAuth with 401 errors middleware",id:"forwardauth-with-401-errors-middleware",children:[],level:3},{value:"ForwardAuth with static upstreams configuration",id:"forwardauth-with-static-upstreams-configuration",children:[],level:3}],level:2}],k={toc:m};function g(t){var e=t.components,n=(0,r.Z)(t,d);return(0,l.kt)("wrapper",(0,a.Z)({},k,n,{components:e,mdxType:"MDXLayout"}),(0,l.kt)("p",null,(0,l.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",(0,l.kt)("a",{parentName:"p",href:"#command-line-options"},"command line options"),", ",(0,l.kt)("a",{parentName:"p",href:"#environment-variables"},"environment variables")," or ",(0,l.kt)("a",{parentName:"p",href:"#config-file"},"config file")," (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."),(0,l.kt)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),(0,l.kt)("p",null,"To generate a strong cookie secret use one of the below commands:"),(0,l.kt)(i.Z,{defaultValue:"python",values:[{label:"Python",value:"python"},{label:"Bash",value:"bash"},{label:"OpenSSL",value:"openssl"},{label:"PowerShell",value:"powershell"},{label:"Terraform",value:"terraform"}],mdxType:"Tabs"},(0,l.kt)(o.Z,{value:"python",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'\n"))),(0,l.kt)(o.Z,{value:"bash",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\\n' | tr -- '+/' '-_'; echo\n"))),(0,l.kt)(o.Z,{value:"openssl",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"openssl rand -base64 32 | tr -- '+/' '-_'\n"))),(0,l.kt)(o.Z,{value:"powershell",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},'# Add System.Web assembly to session, just in case\nAdd-Type -AssemblyName System.Web\n[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")\n'))),(0,l.kt)(o.Z,{value:"terraform",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},'# Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret\nresource "random_password" "cookie_secret" {\n length = 32\n override_special = "-_"\n}\n')))),(0,l.kt)("h3",{id:"config-file"},"Config File"),(0,l.kt)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),(0,l.kt)("p",null,"An example ",(0,l.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"},"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",(0,l.kt)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),(0,l.kt)("h3",{id:"command-line-options"},"Command Line Options"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Option"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"),(0,l.kt)("th",{parentName:"tr",align:null},"Default"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--acr-values")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"optional, see ",(0,l.kt)("a",{parentName:"td",href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"},"docs")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--approval-prompt")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth approval_prompt"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"force"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log authentication attempts"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for authentication log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate against emails via file (one per line)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--azure-tenant")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"go to a tenant-specific or common (tenant-independent) endpoint."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"common"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--basic-auth-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the password to set when passing the HTTP Basic Auth header"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-id")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client ID, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the file with OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--config")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to config file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Optional cookie domains to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-expire")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"expire timeframe for cookie"),(0,l.kt)("td",{parentName:"tr",align:null},"168h0m0s")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-httponly")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set HttpOnly cookie flag"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the name of the cookie that the oauth_proxy creates"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"an optional cookie path to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"/poc/"),")"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-refresh")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"refresh the cookie after this duration; ",(0,l.kt)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",(0,l.kt)("a",{parentName:"td",href:"#footnote1"},"1"),"]"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the seed string for secure cookies (optionally base64 encoded)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secure")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set ",(0,l.kt)("a",{parentName:"td",href:"https://owasp.org/www-community/controls/SecureFlag"},"secure (HTTPS only) cookie flag")),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-samesite")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"set SameSite cookie attribute (",(0,l.kt)("inlineCode",{parentName:"td"},'"lax"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"strict"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"none"'),", or ",(0,l.kt)("inlineCode",{parentName:"td"},'""'),")."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--custom-templates-dir")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to custom html templates"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"display username / password login form if an htpasswd file is provided"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--email-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate emails with the specified domain (may be given multiple times). Use ",(0,l.kt)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--errors-to-info-log")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"redirects error-level logging to default log channel instead of stderr"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"if ",(0,l.kt)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",(0,l.kt)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",(0,l.kt)("inlineCode",{parentName:"td"},"iss"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--exclude-logging-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"comma separated list of paths to exclude from logging, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"/ping,/path2"')),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--flush-interval")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"period between flushing response buffers when streaming responses"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"1s"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--force-https")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"enforce https redirect"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"false"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--banner")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) banner string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--footer")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) footer string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gcp-healthchecks")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will enable ",(0,l.kt)("inlineCode",{parentName:"td"},"/liveness_check"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"/readiness_check"),", and ",(0,l.kt)("inlineCode",{parentName:"td"},"/")," (with the proper user-agent) endpoints that will make it work well with GCP App Engine and GKE Ingresses"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-org")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this organisation"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-team")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these teams (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-repo")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to collaborators of this repository formatted as ",(0,l.kt)("inlineCode",{parentName:"td"},"orgname/repo")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-token")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the token to use when verifying repository collaborators (must have push access to the repository)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-user")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gitlab-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these groups (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gitlab-projects")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these projects (may be given multiple times) formatted as ",(0,l.kt)("inlineCode",{parentName:"td"},"orgname/repo=accesslevel"),". Access level should be a value matching ",(0,l.kt)("a",{parentName:"td",href:"https://docs.gitlab.com/ee/api/members.html#valid-access-levels"},"Gitlab access levels"),", defaulted to 20 if absent"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-admin-email")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the google admin to impersonate for api calls"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this google group (may be given multiple times)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-service-account-json")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the path to the service account json credentials"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--htpasswd-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"additionally authenticate against a htpasswd file. Entries must be created with ",(0,l.kt)("inlineCode",{parentName:"td"},"htpasswd -B")," for bcrypt encryption"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--http-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"[http://]:")," or ",(0,l.kt)("inlineCode",{parentName:"td"},"unix://")," to listen on for HTTP clients"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"127.0.0.1:4180"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--https-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},":")," to listen on for HTTPS clients"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'":443"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-compress")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Should rotated log files be compressed using gzip"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-filename")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"File to log requests to, empty for ",(0,l.kt)("inlineCode",{parentName:"td"},"stdout")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (stdout)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-local-time")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Use local time in log files and backup filenames instead of UTC"),(0,l.kt)("td",{parentName:"tr",align:null},"true (local time)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-age")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum number of days to retain old log files"),(0,l.kt)("td",{parentName:"tr",align:null},"7")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-backups")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum number of old log files to retain; 0 to disable"),(0,l.kt)("td",{parentName:"tr",align:null},"0")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-size")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum size in megabytes of the log file before rotation"),(0,l.kt)("td",{parentName:"tr",align:null},"100")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"private key in PEM format used to sign JWT, so that you can say something like ",(0,l.kt)("inlineCode",{parentName:"td"},'--jwt-key="${OAUTH2_PROXY_JWT_KEY}"'),": required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to the private key file in PEM format used to sign the JWT so that you can say something like ",(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem"),": required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--login-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Authentication endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-allow-unverified-email")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"don't fail if an email address in an id_token is not verified"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-issuer-verification")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-issuer-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OpenID Connect issuer URL, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"https://accounts.google.com"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-jwks-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OIDC JWKS URI for token verification; required if OIDC discovery is disabled"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-email-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which OIDC claim contains the user's email"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"email"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-groups-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which OIDC claim contains the user groups"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"groups"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-access-token")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with ",(0,l.kt)("inlineCode",{parentName:"td"},"--set-xauthrequest")," this adds the X-Auth-Request-Access-Token header to the response"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-authorization-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass OIDC IDToken to upstream via Authorization Bearer header"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-basic-auth")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--prefer-email-to-user")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-basic-auth")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-user-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-host-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass the request Host Header to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-user-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--profile-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Profile access endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--prompt")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"},"OIDC prompt"),"; if present, ",(0,l.kt)("inlineCode",{parentName:"td"},"approval-prompt")," is ignored"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth provider"),(0,l.kt)("td",{parentName:"tr",align:null},"google")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider-ca-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider-display-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Override the provider's name with the given string; used for the sign-in page"),(0,l.kt)("td",{parentName:"tr",align:null},"(depends on provider)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ping-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the ping endpoint that can be used for basic health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/ping"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ping-user-agent")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"a User-Agent that can be used for basic health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (don't check user agent)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--proxy-prefix")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the url root path that this proxy should be nested under (e.g. /",(0,l.kt)("inlineCode",{parentName:"td"},"/sign_in"),")"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/oauth2"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--proxy-websockets")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"enables WebSocket proxying"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pubjwk-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"JWK pubkey access endpoint: required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--real-client-ip-header")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Header used to determine the real IP of the client, requires ",(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")," to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)"),(0,l.kt)("td",{parentName:"tr",align:null},"X-Real-IP")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redeem-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Token redemption endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redirect-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Redirect URL, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"https://internalapp.yourcompany.com/oauth2/callback"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"List of Redis cluster connection URLs (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-cluster")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"URL of redis server for redis session storage (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),")"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis password. Applicable for all Redis configurations. Will override any password set in ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-url")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-password")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis sentinel master name. Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"List of Redis sentinel connection URLs (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-cluster")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Connect to redis cluster. Must set ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")," to use this feature"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Connect to redis via sentinels. Must set ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")," to use this feature"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log requests"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for request log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--resource")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"The resource that is protected (Azure AD only)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--scope")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth scope specification"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--session-cookie-minimal")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--session-store-type")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"/oauth2-proxy/docs/7.0.x/configuration/session_storage"},"Session data storage backend"),"; redis or cookie"),(0,l.kt)("td",{parentName:"tr",align:null},"cookie")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-xauthrequest")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-access-token"),", X-Auth-Request-Access-Token is added to response headers."),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-authorization-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set Authorization Bearer response header (useful in Nginx auth_request mode)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-basic-auth")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set HTTP Basic Auth information in response (useful in Nginx auth_request mode)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--signature-key")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"GAP-Signature request signature key (algorithm:secretkey)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--silence-ping-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"disable logging of requests to ping endpoint"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-preflight")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip authentication for OPTIONS requests"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-regex")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"(DEPRECATED for ",(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-route"),") bypass authentication for requests paths that match (may be given multiple times)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-route")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-strip-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"strips ",(0,l.kt)("inlineCode",{parentName:"td"},"X-Forwarded-*")," style authentication headers & ",(0,l.kt)("inlineCode",{parentName:"td"},"Authorization")," header if they would be set by oauth2-proxy"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip requests that have verified JWT bearer tokens (the token must have ",(0,l.kt)("a",{parentName:"td",href:"https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields"},(0,l.kt)("inlineCode",{parentName:"a"},"aud"))," that matches this client id or one of the extras from ",(0,l.kt)("inlineCode",{parentName:"td"},"extra-jwt-issuers"),")"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-oidc-discovery")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"bypass OIDC endpoint discovery. ",(0,l.kt)("inlineCode",{parentName:"td"},"--login-url"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"--redeem-url")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-jwks-url")," must be configured in this case"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-provider-button")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip sign-in-page to directly reach the next step: oauth/start"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ssl-insecure-skip-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip validation of certificates presented when using HTTPS providers"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ssl-upstream-insecure-skip-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip validation of certificates presented when using HTTPS upstreams"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--standard-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log standard runtime information"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--standard-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for standard log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-cert-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to certificate file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-key-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to private key file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--upstream")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"the http url(s) of the upstream endpoint, file:// paths for static files or ",(0,l.kt)("inlineCode",{parentName:"td"},"static://")," for static response. Routing is based on the path"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--allowed-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this group (may be given multiple times)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--validate-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Access token validation endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--version")),(0,l.kt)("td",{parentName:"tr",align:null},"n/a"),(0,l.kt)("td",{parentName:"tr",align:null},"print version string"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--whitelist-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"allowed domains for redirection after authentication. Prefix domain with a ",(0,l.kt)("inlineCode",{parentName:"td"},".")," to allow subdomains (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},".example.com"),")","\xa0","[",(0,l.kt)("a",{parentName:"td",href:"#footnote2"},"2"),"]"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--trusted-ip")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with ",(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")," and optionally ",(0,l.kt)("inlineCode",{parentName:"td"},"--real-client-ip-header")," this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them."),(0,l.kt)("td",{parentName:"tr",align:null})))),(0,l.kt)("p",null,"[",(0,l.kt)("a",{name:"footnote1"},"1"),"]",": Only these providers support ",(0,l.kt)("inlineCode",{parentName:"p"},"--cookie-refresh"),": GitLab, Google and OIDC"),(0,l.kt)("p",null,"[",(0,l.kt)("a",{name:"footnote2"},"2"),"]",": When using the ",(0,l.kt)("inlineCode",{parentName:"p"},"whitelist-domain")," option, any domain prefixed with a ",(0,l.kt)("inlineCode",{parentName:"p"},".")," will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: ",(0,l.kt)("inlineCode",{parentName:"p"},"example.com:8080"),". To allow any port, use ",(0,l.kt)("inlineCode",{parentName:"p"},"*"),": ",(0,l.kt)("inlineCode",{parentName:"p"},"example.com:*"),"."),(0,l.kt)("p",null,"See below for provider specific options"),(0,l.kt)("h3",{id:"upstreams-configuration"},"Upstreams Configuration"),(0,l.kt)("p",null,(0,l.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as ",(0,l.kt)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/")," for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide ",(0,l.kt)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/some/path/")," then it will only be requests that start with ",(0,l.kt)("inlineCode",{parentName:"p"},"/some/path/")," which are forwarded to the upstream."),(0,l.kt)("p",null,"Static file paths are configured as a file:// URL. ",(0,l.kt)("inlineCode",{parentName:"p"},"file:///var/www/static/")," will serve the files from that directory at ",(0,l.kt)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/var/www/static/"),", which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. ",(0,l.kt)("inlineCode",{parentName:"p"},"file:///var/www/static/#/static/")," will make ",(0,l.kt)("inlineCode",{parentName:"p"},"/var/www/static/")," available at ",(0,l.kt)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/static/"),"."),(0,l.kt)("p",null,"Multiple upstreams can either be configured by supplying a comma separated list to the ",(0,l.kt)("inlineCode",{parentName:"p"},"--upstream")," parameter, supplying the parameter multiple times or providing a list in the ",(0,l.kt)("a",{parentName:"p",href:"#config-file"},"config file"),". When multiple upstreams are used routing to them will be based on the path they are set up with."),(0,l.kt)("h3",{id:"environment-variables"},"Environment variables"),(0,l.kt)("p",null,"Every command line argument can be specified as an environment variable by\nprefixing it with ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_"),", capitalising it, and replacing hyphens (",(0,l.kt)("inlineCode",{parentName:"p"},"-"),")\nwith underscores (",(0,l.kt)("inlineCode",{parentName:"p"},"_"),"). If the argument can be specified multiple times, the\nenvironment variable should be plural (trailing ",(0,l.kt)("inlineCode",{parentName:"p"},"S"),")."),(0,l.kt)("p",null,"This is particularly useful for storing secrets outside of a configuration file\nor the command line."),(0,l.kt)("p",null,"For example, the ",(0,l.kt)("inlineCode",{parentName:"p"},"--cookie-secret")," flag becomes ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_COOKIE_SECRET"),",\nand the ",(0,l.kt)("inlineCode",{parentName:"p"},"--email-domain")," flag becomes ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_EMAIL_DOMAINS"),"."),(0,l.kt)("h2",{id:"logging-configuration"},"Logging Configuration"),(0,l.kt)("p",null,"By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the ",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-filename")," command."),(0,l.kt)("p",null,"If logging to a file you can also configure the maximum file size (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-size"),"), age (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-age"),"), max backup logs (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-backups"),"), and if backup logs should be compressed (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-compress"),")."),(0,l.kt)("p",null,"There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with ",(0,l.kt)("inlineCode",{parentName:"p"},"--standard-logging"),", ",(0,l.kt)("inlineCode",{parentName:"p"},"--auth-logging"),", and ",(0,l.kt)("inlineCode",{parentName:"p"},"--request-logging"),"."),(0,l.kt)("p",null,"Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log."),(0,l.kt)("p",null,"Logging of requests to the ",(0,l.kt)("inlineCode",{parentName:"p"},"/ping")," endpoint (or using ",(0,l.kt)("inlineCode",{parentName:"p"},"--ping-user-agent"),") can be disabled with ",(0,l.kt)("inlineCode",{parentName:"p"},"--silence-ping-logging")," reducing log volume. This flag appends the ",(0,l.kt)("inlineCode",{parentName:"p"},"--ping-path")," to ",(0,l.kt)("inlineCode",{parentName:"p"},"--exclude-logging-paths"),"."),(0,l.kt)("h3",{id:"auth-log-format"},"Auth Log Format"),(0,l.kt)("p",null,"Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"}," - [19/Mar/2015:17:20:19 -0400] [] \n")),(0,l.kt)("p",null,"The status block will contain one of the below strings:"),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthSuccess")," If a user has authenticated successfully by any method"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthFailure")," If the user failed to authenticate explicitly"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthError")," If there was an unexpected error during authentication")),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--auth-logging-format")," flag.\nThe default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"{{.Client}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}\n")),(0,l.kt)("p",null,"Available variables for auth logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Client"),(0,l.kt)("td",{parentName:"tr",align:null},"74.125.224.72"),(0,l.kt)("td",{parentName:"tr",align:null},"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Host"),(0,l.kt)("td",{parentName:"tr",align:null},"domain.com"),(0,l.kt)("td",{parentName:"tr",align:null},"The value of the Host header.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Protocol"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP/1.0"),(0,l.kt)("td",{parentName:"tr",align:null},"The request protocol.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestMethod"),(0,l.kt)("td",{parentName:"tr",align:null},"GET"),(0,l.kt)("td",{parentName:"tr",align:null},"The request method.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"UserAgent"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The full user agent as reported by the requesting client.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Username"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"mailto:username@email.com"},"username@email.com")),(0,l.kt)("td",{parentName:"tr",align:null},"The email or username of the auth request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Status"),(0,l.kt)("td",{parentName:"tr",align:null},"AuthSuccess"),(0,l.kt)("td",{parentName:"tr",align:null},"The status of the auth request. See above for details.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Message"),(0,l.kt)("td",{parentName:"tr",align:null},"Authenticated via OAuth2"),(0,l.kt)("td",{parentName:"tr",align:null},"The details of the auth attempt.")))),(0,l.kt)("h3",{id:"request-log-format"},"Request Log Format"),(0,l.kt)("p",null,"HTTP request logs will output by default in the below format:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},' - [19/Mar/2015:17:20:19 -0400] GET "/path/" HTTP/1.1 "" \n')),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--request-logging-format")," flag.\nThe default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}\n")),(0,l.kt)("p",null,"Available variables for request logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Client"),(0,l.kt)("td",{parentName:"tr",align:null},"74.125.224.72"),(0,l.kt)("td",{parentName:"tr",align:null},"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Host"),(0,l.kt)("td",{parentName:"tr",align:null},"domain.com"),(0,l.kt)("td",{parentName:"tr",align:null},"The value of the Host header.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Protocol"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP/1.0"),(0,l.kt)("td",{parentName:"tr",align:null},"The request protocol.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestDuration"),(0,l.kt)("td",{parentName:"tr",align:null},"0.001"),(0,l.kt)("td",{parentName:"tr",align:null},"The time in seconds that a request took to process.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestMethod"),(0,l.kt)("td",{parentName:"tr",align:null},"GET"),(0,l.kt)("td",{parentName:"tr",align:null},"The request method.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestURI"),(0,l.kt)("td",{parentName:"tr",align:null},'"/oauth2/auth"'),(0,l.kt)("td",{parentName:"tr",align:null},"The URI path of the request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"ResponseSize"),(0,l.kt)("td",{parentName:"tr",align:null},"12"),(0,l.kt)("td",{parentName:"tr",align:null},"The size in bytes of the response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"StatusCode"),(0,l.kt)("td",{parentName:"tr",align:null},"200"),(0,l.kt)("td",{parentName:"tr",align:null},"The HTTP status code of the response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The upstream data of the HTTP request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"UserAgent"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The full user agent as reported by the requesting client.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Username"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"mailto:username@email.com"},"username@email.com")),(0,l.kt)("td",{parentName:"tr",align:null},"The email or username of the auth request.")))),(0,l.kt)("h3",{id:"standard-log-format"},"Standard Log Format"),(0,l.kt)("p",null,"All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"[19/Mar/2015:17:20:19 -0400] [main.go:40] \n")),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--standard-logging-format")," flag. The default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"[{{.Timestamp}}] [{{.File}}] {{.Message}}\n")),(0,l.kt)("p",null,"Available variables for standard logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"File"),(0,l.kt)("td",{parentName:"tr",align:null},"main.go:40"),(0,l.kt)("td",{parentName:"tr",align:null},"The file and line number of the logging statement.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Message"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP: listening on 127.0.0.1:4180"),(0,l.kt)("td",{parentName:"tr",align:null},"The details of the log statement.")))),(0,l.kt)("h2",{id:"configuring-for-use-with-the-nginx-auth_request-directive"},"Configuring for use with the Nginx ",(0,l.kt)("inlineCode",{parentName:"h2"},"auth_request")," directive"),(0,l.kt)("p",null,"The ",(0,l.kt)("a",{parentName:"p",href:"http://nginx.org/en/docs/http/ngx_http_auth_request_module.html"},"Nginx ",(0,l.kt)("inlineCode",{parentName:"a"},"auth_request")," directive")," allows Nginx to authenticate requests via the oauth2-proxy's ",(0,l.kt)("inlineCode",{parentName:"p"},"/auth")," endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-nginx"},'server {\n listen 443 ssl;\n server_name ...;\n include ssl/ssl.conf;\n\n location /oauth2/ {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n proxy_set_header X-Auth-Request-Redirect $request_uri;\n # or, if you are handling multiple domains:\n # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;\n }\n location = /oauth2/auth {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n # nginx auth_request includes headers but not body\n proxy_set_header Content-Length "";\n proxy_pass_request_body off;\n }\n\n location / {\n auth_request /oauth2/auth;\n error_page 401 = /oauth2/sign_in;\n\n # pass information via X-User and X-Email headers to backend,\n # requires running with --set-xauthrequest flag\n auth_request_set $user $upstream_http_x_auth_request_user;\n auth_request_set $email $upstream_http_x_auth_request_email;\n proxy_set_header X-User $user;\n proxy_set_header X-Email $email;\n\n # if you enabled --pass-access-token, this will pass the token to the backend\n auth_request_set $token $upstream_http_x_auth_request_access_token;\n proxy_set_header X-Access-Token $token;\n\n # if you enabled --cookie-refresh, this is needed for it to work with auth_request\n auth_request_set $auth_cookie $upstream_http_set_cookie;\n add_header Set-Cookie $auth_cookie;\n\n # When using the --set-authorization-header flag, some provider\'s cookies can exceed the 4kb\n # limit and so the OAuth2 Proxy splits these into multiple parts.\n # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\n # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\n auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;\n\n # Extract the Cookie attributes from the first Set-Cookie header and append them\n # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\n if ($auth_cookie ~* "(; .*)") {\n set $auth_cookie_name_0 $auth_cookie;\n set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";\n }\n\n # Send both Set-Cookie headers now if there was a second part\n if ($auth_cookie_name_upstream_1) {\n add_header Set-Cookie $auth_cookie_name_0;\n add_header Set-Cookie $auth_cookie_name_1;\n }\n\n proxy_pass http://backend/;\n # or "root /path/to/site;" or "fastcgi_pass ..." etc\n }\n}\n')),(0,l.kt)("p",null,"When you use ingress-nginx in Kubernetes, you MUST use ",(0,l.kt)("inlineCode",{parentName:"p"},"kubernetes/ingress-nginx")," (which includes the Lua module) and the following configuration snippet for your ",(0,l.kt)("inlineCode",{parentName:"p"},"Ingress"),".\nVariables set with ",(0,l.kt)("inlineCode",{parentName:"p"},"auth_request_set")," are not ",(0,l.kt)("inlineCode",{parentName:"p"},"set"),"-able in plain nginx config when the location is processed via ",(0,l.kt)("inlineCode",{parentName:"p"},"proxy_pass")," and then may only be processed by Lua.\nNote that ",(0,l.kt)("inlineCode",{parentName:"p"},"nginxinc/kubernetes-ingress")," does not include the Lua module."),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'nginx.ingress.kubernetes.io/auth-response-headers: Authorization\nnginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri\nnginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth\nnginx.ingress.kubernetes.io/configuration-snippet: |\n auth_request_set $name_upstream_1 $upstream_cookie_name_1;\n\n access_by_lua_block {\n if ngx.var.name_upstream_1 ~= "" then\n ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")\n end\n }\n')),(0,l.kt)("p",null,"It is recommended to use ",(0,l.kt)("inlineCode",{parentName:"p"},"--session-store-type=redis")," when expecting large sessions/OIDC tokens (",(0,l.kt)("em",{parentName:"p"},"e.g.")," with MS Azure)."),(0,l.kt)("p",null,"You have to substitute ",(0,l.kt)("em",{parentName:"p"},"name"),' with the actual cookie name you configured via --cookie-name parameter. If you don\'t set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".'),(0,l.kt)("h2",{id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware"},"Configuring for use with the Traefik (v2) ",(0,l.kt)("inlineCode",{parentName:"h2"},"ForwardAuth")," middleware"),(0,l.kt)("p",null,(0,l.kt)("strong",{parentName:"p"},"This option requires ",(0,l.kt)("inlineCode",{parentName:"strong"},"--reverse-proxy")," option to be set.")),(0,l.kt)("h3",{id:"forwardauth-with-401-errors-middleware"},"ForwardAuth with 401 errors middleware"),(0,l.kt)("p",null,"The ",(0,l.kt)("a",{parentName:"p",href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"},"Traefik v2 ",(0,l.kt)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," allows Traefik to authenticate requests via the oauth2-proxy's ",(0,l.kt)("inlineCode",{parentName:"p"},"/oauth2/auth")," endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'http:\n routers:\n a-service:\n rule: "Host(`a-service.example.com`)"\n service: a-service-backend\n middlewares:\n - oauth-errors\n - oauth-auth\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth:\n rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n oauth-errors:\n errors:\n status:\n - "401-403"\n service: oauth-backend\n query: "/oauth2/sign_in"\n')),(0,l.kt)("h3",{id:"forwardauth-with-static-upstreams-configuration"},"ForwardAuth with static upstreams configuration"),(0,l.kt)("p",null,"Redirect to sign_in functionality provided without the use of ",(0,l.kt)("inlineCode",{parentName:"p"},"errors")," middleware with ",(0,l.kt)("a",{parentName:"p",href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"},"Traefik v2 ",(0,l.kt)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," pointing to oauth2-proxy service's ",(0,l.kt)("inlineCode",{parentName:"p"},"/")," endpoint"),(0,l.kt)("p",null,(0,l.kt)("strong",{parentName:"p"},"Following options need to be set on ",(0,l.kt)("inlineCode",{parentName:"strong"},"oauth2-proxy"),":")),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"--upstream=static://202"),": Configures a static response for authenticated sessions"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"--reverseproxy=true"),": Enables the use of ",(0,l.kt)("inlineCode",{parentName:"li"},"X-Forwarded-*")," headers to determine redirects correctly")),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'http:\n routers:\n a-service-route-1:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n a-service-route-2:\n rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-wo-redirect # unauthenticated session will return a 401\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n services-oauth2-route:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth2-proxy-route:\n rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n b-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.3:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth-redirect:\n forwardAuth:\n address: https://oauth.example.com/\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n oauth-auth-wo-redirect:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n')),(0,l.kt)("div",{className:"admonition admonition-note alert alert--secondary"},(0,l.kt)("div",{parentName:"div",className:"admonition-heading"},(0,l.kt)("h5",{parentName:"div"},(0,l.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,l.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,l.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"}))),"note")),(0,l.kt)("div",{parentName:"div",className:"admonition-content"},(0,l.kt)("p",{parentName:"div"},"If you set up your OAuth2 provider to rotate your client secret, you can use the ",(0,l.kt)("inlineCode",{parentName:"p"},"client-secret-file")," option to reload the secret when it is updated."))))}g.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/js/92147208.dd46efff.js b/assets/js/92147208.dd46efff.js new file mode 100644 index 00000000..f005b902 --- /dev/null +++ b/assets/js/92147208.dd46efff.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[2098],{3905:function(t,e,n){n.d(e,{Zo:function(){return s},kt:function(){return k}});var a=n(7294);function r(t,e,n){return e in t?Object.defineProperty(t,e,{value:n,enumerable:!0,configurable:!0,writable:!0}):t[e]=n,t}function l(t,e){var n=Object.keys(t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(t);e&&(a=a.filter((function(e){return Object.getOwnPropertyDescriptor(t,e).enumerable}))),n.push.apply(n,a)}return n}function i(t){for(var e=1;e=0||(r[n]=t[n]);return r}(t,e);if(Object.getOwnPropertySymbols){var l=Object.getOwnPropertySymbols(t);for(a=0;a=0||Object.prototype.propertyIsEnumerable.call(t,n)&&(r[n]=t[n])}return r}var d=a.createContext({}),p=function(t){var e=a.useContext(d),n=e;return t&&(n="function"==typeof t?t(e):i(i({},e),t)),n},s=function(t){var e=p(t.components);return a.createElement(d.Provider,{value:e},t.children)},m={inlineCode:"code",wrapper:function(t){var e=t.children;return a.createElement(a.Fragment,{},e)}},u=a.forwardRef((function(t,e){var n=t.components,r=t.mdxType,l=t.originalType,d=t.parentName,s=o(t,["components","mdxType","originalType","parentName"]),u=p(n),k=r,g=u["".concat(d,".").concat(k)]||u[k]||m[k]||l;return n?a.createElement(g,i(i({ref:e},s),{},{components:n})):a.createElement(g,i({ref:e},s))}));function k(t,e){var n=arguments,r=e&&e.mdxType;if("string"==typeof t||r){var l=n.length,i=new Array(l);i[0]=u;var o={};for(var d in e)hasOwnProperty.call(e,d)&&(o[d]=e[d]);o.originalType=t,o.mdxType="string"==typeof t?t:r,i[1]=o;for(var p=2;pauth_request directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",children:[],level:2},{value:"Configuring for use with the Traefik (v2) ForwardAuth middleware",id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware",children:[{value:"ForwardAuth with 401 errors middleware",id:"forwardauth-with-401-errors-middleware",children:[],level:3},{value:"ForwardAuth with static upstreams configuration",id:"forwardauth-with-static-upstreams-configuration",children:[],level:3}],level:2}],m={toc:s};function u(t){var e=t.components,n=(0,r.Z)(t,i);return(0,l.kt)("wrapper",(0,a.Z)({},m,n,{components:e,mdxType:"MDXLayout"}),(0,l.kt)("p",null,(0,l.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",(0,l.kt)("a",{parentName:"p",href:"#command-line-options"},"command line options"),", ",(0,l.kt)("a",{parentName:"p",href:"#environment-variables"},"environment variables")," or ",(0,l.kt)("a",{parentName:"p",href:"#config-file"},"config file")," (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."),(0,l.kt)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),(0,l.kt)("p",null,"To generate a strong cookie secret use ",(0,l.kt)("inlineCode",{parentName:"p"},"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'")),(0,l.kt)("h3",{id:"config-file"},"Config File"),(0,l.kt)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),(0,l.kt)("p",null,"An example ",(0,l.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"},"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",(0,l.kt)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),(0,l.kt)("h3",{id:"command-line-options"},"Command Line Options"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Option"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"),(0,l.kt)("th",{parentName:"tr",align:null},"Default"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--acr-values")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"optional, see ",(0,l.kt)("a",{parentName:"td",href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"},"docs")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--approval-prompt")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth approval_prompt"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"force"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log authentication attempts"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for authentication log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate against emails via file (one per line)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--azure-tenant")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"go to a tenant-specific or common (tenant-independent) endpoint."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"common"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--basic-auth-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the password to set when passing the HTTP Basic Auth header"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-id")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client ID, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the file with OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--config")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to config file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Optional cookie domains to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-expire")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"expire timeframe for cookie"),(0,l.kt)("td",{parentName:"tr",align:null},"168h0m0s")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-httponly")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set HttpOnly cookie flag"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the name of the cookie that the oauth_proxy creates"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"an optional cookie path to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"/poc/"),")"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-refresh")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"refresh the cookie after this duration; ",(0,l.kt)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",(0,l.kt)("a",{parentName:"td",href:"#footnote1"},"1"),"]"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the seed string for secure cookies (optionally base64 encoded)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secure")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set ",(0,l.kt)("a",{parentName:"td",href:"https://owasp.org/www-community/controls/SecureFlag"},"secure (HTTPS only) cookie flag")),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-samesite")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"set SameSite cookie attribute (",(0,l.kt)("inlineCode",{parentName:"td"},'"lax"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"strict"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"none"'),", or ",(0,l.kt)("inlineCode",{parentName:"td"},'""'),")."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--custom-templates-dir")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to custom html templates"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--custom-sign-in-logo")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},'path to an custom image for the sign_in page logo. Use \\"-\\" to disable default logo.'),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"display username / password login form if an htpasswd file is provided"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--email-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate emails with the specified domain (may be given multiple times). Use ",(0,l.kt)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--errors-to-info-log")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"redirects error-level logging to default log channel instead of stderr"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"if ",(0,l.kt)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",(0,l.kt)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",(0,l.kt)("inlineCode",{parentName:"td"},"iss"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--exclude-logging-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"comma separated list of paths to exclude from logging, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"/ping,/path2"')),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--flush-interval")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"period between flushing response buffers when streaming responses"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"1s"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--force-https")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"enforce https redirect"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"false"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--banner")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) banner string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--footer")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) footer string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-org")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this organisation"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-team")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these teams (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-repo")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to collaborators of this repository formatted as ",(0,l.kt)("inlineCode",{parentName:"td"},"orgname/repo")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-token")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the token to use when verifying repository collaborators (must have push access to the repository)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-user")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gitlab-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these groups (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gitlab-projects")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these projects (may be given multiple times) formatted as ",(0,l.kt)("inlineCode",{parentName:"td"},"orgname/repo=accesslevel"),". Access level should be a value matching ",(0,l.kt)("a",{parentName:"td",href:"https://docs.gitlab.com/ee/api/members.html#valid-access-levels"},"Gitlab access levels"),", defaulted to 20 if absent"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-admin-email")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the google admin to impersonate for api calls"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this google group (may be given multiple times)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-service-account-json")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the path to the service account json credentials"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--htpasswd-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"additionally authenticate against a htpasswd file. Entries must be created with ",(0,l.kt)("inlineCode",{parentName:"td"},"htpasswd -B")," for bcrypt encryption"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--htpasswd-user-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"the groups to be set on sessions for htpasswd users"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--http-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"[http://]:")," or ",(0,l.kt)("inlineCode",{parentName:"td"},"unix://")," to listen on for HTTP clients"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"127.0.0.1:4180"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--https-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},":")," to listen on for HTTPS clients"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'":443"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-compress")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Should rotated log files be compressed using gzip"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-filename")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"File to log requests to, empty for ",(0,l.kt)("inlineCode",{parentName:"td"},"stdout")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (stdout)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-local-time")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Use local time in log files and backup filenames instead of UTC"),(0,l.kt)("td",{parentName:"tr",align:null},"true (local time)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-age")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum number of days to retain old log files"),(0,l.kt)("td",{parentName:"tr",align:null},"7")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-backups")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum number of old log files to retain; 0 to disable"),(0,l.kt)("td",{parentName:"tr",align:null},"0")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-size")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum size in megabytes of the log file before rotation"),(0,l.kt)("td",{parentName:"tr",align:null},"100")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"private key in PEM format used to sign JWT, so that you can say something like ",(0,l.kt)("inlineCode",{parentName:"td"},'--jwt-key="${OAUTH2_PROXY_JWT_KEY}"'),": required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to the private key file in PEM format used to sign the JWT so that you can say something like ",(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem"),": required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--login-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Authentication endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-allow-unverified-email")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"don't fail if an email address in an id_token is not verified"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-issuer-verification")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-issuer-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OpenID Connect issuer URL, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"https://accounts.google.com"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-jwks-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OIDC JWKS URI for token verification; required if OIDC discovery is disabled"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-email-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which OIDC claim contains the user's email"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"email"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-groups-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which OIDC claim contains the user groups"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"groups"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-access-token")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with ",(0,l.kt)("inlineCode",{parentName:"td"},"--set-xauthrequest")," this adds the X-Auth-Request-Access-Token header to the response"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-authorization-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass OIDC IDToken to upstream via Authorization Bearer header"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-basic-auth")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--prefer-email-to-user")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-basic-auth")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-user-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-host-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass the request Host Header to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-user-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--profile-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Profile access endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--prompt")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"},"OIDC prompt"),"; if present, ",(0,l.kt)("inlineCode",{parentName:"td"},"approval-prompt")," is ignored"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth provider"),(0,l.kt)("td",{parentName:"tr",align:null},"google")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider-ca-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider-display-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Override the provider's name with the given string; used for the sign-in page"),(0,l.kt)("td",{parentName:"tr",align:null},"(depends on provider)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ping-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the ping endpoint that can be used for basic health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/ping"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ping-user-agent")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"a User-Agent that can be used for basic health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (don't check user agent)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--metrics-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the address /metrics will be served on"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--metrics-secure-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the address /metrics will be served on via HTTPS"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--metrics-tls-cert-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to certificate file for secure metrics server"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--metrics-tls-key-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to private key file for secure metrics server"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--proxy-prefix")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the url root path that this proxy should be nested under (e.g. /",(0,l.kt)("inlineCode",{parentName:"td"},"/sign_in"),")"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/oauth2"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--proxy-websockets")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"enables WebSocket proxying"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pubjwk-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"JWK pubkey access endpoint: required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--real-client-ip-header")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Header used to determine the real IP of the client, requires ",(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")," to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)"),(0,l.kt)("td",{parentName:"tr",align:null},"X-Real-IP")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redeem-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Token redemption endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redirect-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Redirect URL, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"https://internalapp.yourcompany.com/oauth2/callback"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"List of Redis cluster connection URLs (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-cluster")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"URL of redis server for redis session storage (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),")"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis password. Applicable for all Redis configurations. Will override any password set in ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-url")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-password")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis sentinel master name. Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"List of Redis sentinel connection URLs (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-cluster")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Connect to redis cluster. Must set ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")," to use this feature"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Connect to redis via sentinels. Must set ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")," to use this feature"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-id-header")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Request header to use as the request ID in logging"),(0,l.kt)("td",{parentName:"tr",align:null},"X-Request-Id")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log requests"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for request log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--resource")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"The resource that is protected (Azure AD only)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--scope")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth scope specification"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--session-cookie-minimal")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--session-store-type")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"/oauth2-proxy/docs/7.1.x/configuration/session_storage"},"Session data storage backend"),"; redis or cookie"),(0,l.kt)("td",{parentName:"tr",align:null},"cookie")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-xauthrequest")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-access-token"),", X-Auth-Request-Access-Token is added to response headers."),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-authorization-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set Authorization Bearer response header (useful in Nginx auth_request mode)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-basic-auth")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set HTTP Basic Auth information in response (useful in Nginx auth_request mode)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--show-debug-on-error")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--signature-key")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"GAP-Signature request signature key (algorithm:secretkey)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--silence-ping-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"disable logging of requests to ping endpoint"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-preflight")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip authentication for OPTIONS requests"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-regex")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"(DEPRECATED for ",(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-route"),") bypass authentication for requests paths that match (may be given multiple times)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-route")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-strip-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"strips ",(0,l.kt)("inlineCode",{parentName:"td"},"X-Forwarded-*")," style authentication headers & ",(0,l.kt)("inlineCode",{parentName:"td"},"Authorization")," header if they would be set by oauth2-proxy"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip requests that have verified JWT bearer tokens (the token must have ",(0,l.kt)("a",{parentName:"td",href:"https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields"},(0,l.kt)("inlineCode",{parentName:"a"},"aud"))," that matches this client id or one of the extras from ",(0,l.kt)("inlineCode",{parentName:"td"},"extra-jwt-issuers"),")"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-oidc-discovery")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"bypass OIDC endpoint discovery. ",(0,l.kt)("inlineCode",{parentName:"td"},"--login-url"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"--redeem-url")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-jwks-url")," must be configured in this case"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-provider-button")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip sign-in-page to directly reach the next step: oauth/start"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ssl-insecure-skip-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip validation of certificates presented when using HTTPS providers"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ssl-upstream-insecure-skip-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip validation of certificates presented when using HTTPS upstreams"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--standard-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log standard runtime information"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--standard-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for standard log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-cert-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to certificate file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-key-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to private key file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--upstream")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"the http url(s) of the upstream endpoint, file:// paths for static files or ",(0,l.kt)("inlineCode",{parentName:"td"},"static://")," for static response. Routing is based on the path"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--allowed-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this group (may be given multiple times)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--validate-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Access token validation endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--version")),(0,l.kt)("td",{parentName:"tr",align:null},"n/a"),(0,l.kt)("td",{parentName:"tr",align:null},"print version string"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--whitelist-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"allowed domains for redirection after authentication. Prefix domain with a ",(0,l.kt)("inlineCode",{parentName:"td"},".")," to allow subdomains (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},".example.com"),")","\xa0","[",(0,l.kt)("a",{parentName:"td",href:"#footnote2"},"2"),"]"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--trusted-ip")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with ",(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")," and optionally ",(0,l.kt)("inlineCode",{parentName:"td"},"--real-client-ip-header")," this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them."),(0,l.kt)("td",{parentName:"tr",align:null})))),(0,l.kt)("p",null,"[",(0,l.kt)("a",{name:"footnote1"},"1"),"]",": Only these providers support ",(0,l.kt)("inlineCode",{parentName:"p"},"--cookie-refresh"),": GitLab, Google and OIDC"),(0,l.kt)("p",null,"[",(0,l.kt)("a",{name:"footnote2"},"2"),"]",": When using the ",(0,l.kt)("inlineCode",{parentName:"p"},"whitelist-domain")," option, any domain prefixed with a ",(0,l.kt)("inlineCode",{parentName:"p"},".")," will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: ",(0,l.kt)("inlineCode",{parentName:"p"},"example.com:8080"),". To allow any port, use ",(0,l.kt)("inlineCode",{parentName:"p"},"*"),": ",(0,l.kt)("inlineCode",{parentName:"p"},"example.com:*"),"."),(0,l.kt)("p",null,"See below for provider specific options"),(0,l.kt)("h3",{id:"upstreams-configuration"},"Upstreams Configuration"),(0,l.kt)("p",null,(0,l.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as ",(0,l.kt)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/")," for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide ",(0,l.kt)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/some/path/")," then it will only be requests that start with ",(0,l.kt)("inlineCode",{parentName:"p"},"/some/path/")," which are forwarded to the upstream."),(0,l.kt)("p",null,"Static file paths are configured as a file:// URL. ",(0,l.kt)("inlineCode",{parentName:"p"},"file:///var/www/static/")," will serve the files from that directory at ",(0,l.kt)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/var/www/static/"),", which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. ",(0,l.kt)("inlineCode",{parentName:"p"},"file:///var/www/static/#/static/")," will make ",(0,l.kt)("inlineCode",{parentName:"p"},"/var/www/static/")," available at ",(0,l.kt)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/static/"),"."),(0,l.kt)("p",null,"Multiple upstreams can either be configured by supplying a comma separated list to the ",(0,l.kt)("inlineCode",{parentName:"p"},"--upstream")," parameter, supplying the parameter multiple times or providing a list in the ",(0,l.kt)("a",{parentName:"p",href:"#config-file"},"config file"),". When multiple upstreams are used routing to them will be based on the path they are set up with."),(0,l.kt)("h3",{id:"environment-variables"},"Environment variables"),(0,l.kt)("p",null,"Every command line argument can be specified as an environment variable by\nprefixing it with ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_"),", capitalising it, and replacing hyphens (",(0,l.kt)("inlineCode",{parentName:"p"},"-"),")\nwith underscores (",(0,l.kt)("inlineCode",{parentName:"p"},"_"),"). If the argument can be specified multiple times, the\nenvironment variable should be plural (trailing ",(0,l.kt)("inlineCode",{parentName:"p"},"S"),")."),(0,l.kt)("p",null,"This is particularly useful for storing secrets outside of a configuration file\nor the command line."),(0,l.kt)("p",null,"For example, the ",(0,l.kt)("inlineCode",{parentName:"p"},"--cookie-secret")," flag becomes ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_COOKIE_SECRET"),",\nand the ",(0,l.kt)("inlineCode",{parentName:"p"},"--email-domain")," flag becomes ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_EMAIL_DOMAINS"),"."),(0,l.kt)("h2",{id:"logging-configuration"},"Logging Configuration"),(0,l.kt)("p",null,"By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the ",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-filename")," command."),(0,l.kt)("p",null,"If logging to a file you can also configure the maximum file size (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-size"),"), age (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-age"),"), max backup logs (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-backups"),"), and if backup logs should be compressed (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-compress"),")."),(0,l.kt)("p",null,"There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with ",(0,l.kt)("inlineCode",{parentName:"p"},"--standard-logging"),", ",(0,l.kt)("inlineCode",{parentName:"p"},"--auth-logging"),", and ",(0,l.kt)("inlineCode",{parentName:"p"},"--request-logging"),"."),(0,l.kt)("p",null,"Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log."),(0,l.kt)("p",null,"Logging of requests to the ",(0,l.kt)("inlineCode",{parentName:"p"},"/ping")," endpoint (or using ",(0,l.kt)("inlineCode",{parentName:"p"},"--ping-user-agent"),") can be disabled with ",(0,l.kt)("inlineCode",{parentName:"p"},"--silence-ping-logging")," reducing log volume. This flag appends the ",(0,l.kt)("inlineCode",{parentName:"p"},"--ping-path")," to ",(0,l.kt)("inlineCode",{parentName:"p"},"--exclude-logging-paths"),"."),(0,l.kt)("h3",{id:"auth-log-format"},"Auth Log Format"),(0,l.kt)("p",null,"Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"}," - - [19/Mar/2015:17:20:19 -0400] [] \n")),(0,l.kt)("p",null,"The status block will contain one of the below strings:"),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthSuccess")," If a user has authenticated successfully by any method"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthFailure")," If the user failed to authenticate explicitly"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthError")," If there was an unexpected error during authentication")),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--auth-logging-format")," flag.\nThe default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}\n")),(0,l.kt)("p",null,"Available variables for auth logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Client"),(0,l.kt)("td",{parentName:"tr",align:null},"74.125.224.72"),(0,l.kt)("td",{parentName:"tr",align:null},"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Host"),(0,l.kt)("td",{parentName:"tr",align:null},"domain.com"),(0,l.kt)("td",{parentName:"tr",align:null},"The value of the Host header.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Message"),(0,l.kt)("td",{parentName:"tr",align:null},"Authenticated via OAuth2"),(0,l.kt)("td",{parentName:"tr",align:null},"The details of the auth attempt.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Protocol"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP/1.0"),(0,l.kt)("td",{parentName:"tr",align:null},"The request protocol.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestID"),(0,l.kt)("td",{parentName:"tr",align:null},"00010203-0405-4607-8809-0a0b0c0d0e0f"),(0,l.kt)("td",{parentName:"tr",align:null},"The request ID pulled from the ",(0,l.kt)("inlineCode",{parentName:"td"},"--request-id-header"),". Random UUID if empty")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestMethod"),(0,l.kt)("td",{parentName:"tr",align:null},"GET"),(0,l.kt)("td",{parentName:"tr",align:null},"The request method.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"UserAgent"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The full user agent as reported by the requesting client.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Username"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"mailto:username@email.com"},"username@email.com")),(0,l.kt)("td",{parentName:"tr",align:null},"The email or username of the auth request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Status"),(0,l.kt)("td",{parentName:"tr",align:null},"AuthSuccess"),(0,l.kt)("td",{parentName:"tr",align:null},"The status of the auth request. See above for details.")))),(0,l.kt)("h3",{id:"request-log-format"},"Request Log Format"),(0,l.kt)("p",null,"HTTP request logs will output by default in the below format:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},' - - [19/Mar/2015:17:20:19 -0400] GET "/path/" HTTP/1.1 "" \n')),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--request-logging-format")," flag.\nThe default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}\n")),(0,l.kt)("p",null,"Available variables for request logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Client"),(0,l.kt)("td",{parentName:"tr",align:null},"74.125.224.72"),(0,l.kt)("td",{parentName:"tr",align:null},"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Host"),(0,l.kt)("td",{parentName:"tr",align:null},"domain.com"),(0,l.kt)("td",{parentName:"tr",align:null},"The value of the Host header.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Protocol"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP/1.0"),(0,l.kt)("td",{parentName:"tr",align:null},"The request protocol.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestDuration"),(0,l.kt)("td",{parentName:"tr",align:null},"0.001"),(0,l.kt)("td",{parentName:"tr",align:null},"The time in seconds that a request took to process.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestID"),(0,l.kt)("td",{parentName:"tr",align:null},"00010203-0405-4607-8809-0a0b0c0d0e0f"),(0,l.kt)("td",{parentName:"tr",align:null},"The request ID pulled from the ",(0,l.kt)("inlineCode",{parentName:"td"},"--request-id-header"),". Random UUID if empty")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestMethod"),(0,l.kt)("td",{parentName:"tr",align:null},"GET"),(0,l.kt)("td",{parentName:"tr",align:null},"The request method.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestURI"),(0,l.kt)("td",{parentName:"tr",align:null},'"/oauth2/auth"'),(0,l.kt)("td",{parentName:"tr",align:null},"The URI path of the request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"ResponseSize"),(0,l.kt)("td",{parentName:"tr",align:null},"12"),(0,l.kt)("td",{parentName:"tr",align:null},"The size in bytes of the response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"StatusCode"),(0,l.kt)("td",{parentName:"tr",align:null},"200"),(0,l.kt)("td",{parentName:"tr",align:null},"The HTTP status code of the response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The upstream data of the HTTP request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"UserAgent"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The full user agent as reported by the requesting client.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Username"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"mailto:username@email.com"},"username@email.com")),(0,l.kt)("td",{parentName:"tr",align:null},"The email or username of the auth request.")))),(0,l.kt)("h3",{id:"standard-log-format"},"Standard Log Format"),(0,l.kt)("p",null,"All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"[19/Mar/2015:17:20:19 -0400] [main.go:40] \n")),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--standard-logging-format")," flag. The default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"[{{.Timestamp}}] [{{.File}}] {{.Message}}\n")),(0,l.kt)("p",null,"Available variables for standard logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"File"),(0,l.kt)("td",{parentName:"tr",align:null},"main.go:40"),(0,l.kt)("td",{parentName:"tr",align:null},"The file and line number of the logging statement.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Message"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP: listening on 127.0.0.1:4180"),(0,l.kt)("td",{parentName:"tr",align:null},"The details of the log statement.")))),(0,l.kt)("h2",{id:"configuring-for-use-with-the-nginx-auth_request-directive"},"Configuring for use with the Nginx ",(0,l.kt)("inlineCode",{parentName:"h2"},"auth_request")," directive"),(0,l.kt)("p",null,"The ",(0,l.kt)("a",{parentName:"p",href:"http://nginx.org/en/docs/http/ngx_http_auth_request_module.html"},"Nginx ",(0,l.kt)("inlineCode",{parentName:"a"},"auth_request")," directive")," allows Nginx to authenticate requests via the oauth2-proxy's ",(0,l.kt)("inlineCode",{parentName:"p"},"/auth")," endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-nginx"},'server {\n listen 443 ssl;\n server_name ...;\n include ssl/ssl.conf;\n\n location /oauth2/ {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n proxy_set_header X-Auth-Request-Redirect $request_uri;\n # or, if you are handling multiple domains:\n # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;\n }\n location = /oauth2/auth {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n # nginx auth_request includes headers but not body\n proxy_set_header Content-Length "";\n proxy_pass_request_body off;\n }\n\n location / {\n auth_request /oauth2/auth;\n error_page 401 = /oauth2/sign_in;\n\n # pass information via X-User and X-Email headers to backend,\n # requires running with --set-xauthrequest flag\n auth_request_set $user $upstream_http_x_auth_request_user;\n auth_request_set $email $upstream_http_x_auth_request_email;\n proxy_set_header X-User $user;\n proxy_set_header X-Email $email;\n\n # if you enabled --pass-access-token, this will pass the token to the backend\n auth_request_set $token $upstream_http_x_auth_request_access_token;\n proxy_set_header X-Access-Token $token;\n\n # if you enabled --cookie-refresh, this is needed for it to work with auth_request\n auth_request_set $auth_cookie $upstream_http_set_cookie;\n add_header Set-Cookie $auth_cookie;\n\n # When using the --set-authorization-header flag, some provider\'s cookies can exceed the 4kb\n # limit and so the OAuth2 Proxy splits these into multiple parts.\n # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\n # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\n auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;\n\n # Extract the Cookie attributes from the first Set-Cookie header and append them\n # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\n if ($auth_cookie ~* "(; .*)") {\n set $auth_cookie_name_0 $auth_cookie;\n set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";\n }\n\n # Send both Set-Cookie headers now if there was a second part\n if ($auth_cookie_name_upstream_1) {\n add_header Set-Cookie $auth_cookie_name_0;\n add_header Set-Cookie $auth_cookie_name_1;\n }\n\n proxy_pass http://backend/;\n # or "root /path/to/site;" or "fastcgi_pass ..." etc\n }\n}\n')),(0,l.kt)("p",null,"When you use ingress-nginx in Kubernetes, you MUST use ",(0,l.kt)("inlineCode",{parentName:"p"},"kubernetes/ingress-nginx")," (which includes the Lua module) and the following configuration snippet for your ",(0,l.kt)("inlineCode",{parentName:"p"},"Ingress"),".\nVariables set with ",(0,l.kt)("inlineCode",{parentName:"p"},"auth_request_set")," are not ",(0,l.kt)("inlineCode",{parentName:"p"},"set"),"-able in plain nginx config when the location is processed via ",(0,l.kt)("inlineCode",{parentName:"p"},"proxy_pass")," and then may only be processed by Lua.\nNote that ",(0,l.kt)("inlineCode",{parentName:"p"},"nginxinc/kubernetes-ingress")," does not include the Lua module."),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'nginx.ingress.kubernetes.io/auth-response-headers: Authorization\nnginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri\nnginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth\nnginx.ingress.kubernetes.io/configuration-snippet: |\n auth_request_set $name_upstream_1 $upstream_cookie_name_1;\n\n access_by_lua_block {\n if ngx.var.name_upstream_1 ~= "" then\n ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")\n end\n }\n')),(0,l.kt)("p",null,"It is recommended to use ",(0,l.kt)("inlineCode",{parentName:"p"},"--session-store-type=redis")," when expecting large sessions/OIDC tokens (",(0,l.kt)("em",{parentName:"p"},"e.g.")," with MS Azure)."),(0,l.kt)("p",null,"You have to substitute ",(0,l.kt)("em",{parentName:"p"},"name"),' with the actual cookie name you configured via --cookie-name parameter. If you don\'t set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".'),(0,l.kt)("h2",{id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware"},"Configuring for use with the Traefik (v2) ",(0,l.kt)("inlineCode",{parentName:"h2"},"ForwardAuth")," middleware"),(0,l.kt)("p",null,(0,l.kt)("strong",{parentName:"p"},"This option requires ",(0,l.kt)("inlineCode",{parentName:"strong"},"--reverse-proxy")," option to be set.")),(0,l.kt)("h3",{id:"forwardauth-with-401-errors-middleware"},"ForwardAuth with 401 errors middleware"),(0,l.kt)("p",null,"The ",(0,l.kt)("a",{parentName:"p",href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"},"Traefik v2 ",(0,l.kt)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," allows Traefik to authenticate requests via the oauth2-proxy's ",(0,l.kt)("inlineCode",{parentName:"p"},"/oauth2/auth")," endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'http:\n routers:\n a-service:\n rule: "Host(`a-service.example.com`)"\n service: a-service-backend\n middlewares:\n - oauth-errors\n - oauth-auth\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth:\n rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n oauth-errors:\n errors:\n status:\n - "401-403"\n service: oauth-backend\n query: "/oauth2/sign_in"\n')),(0,l.kt)("h3",{id:"forwardauth-with-static-upstreams-configuration"},"ForwardAuth with static upstreams configuration"),(0,l.kt)("p",null,"Redirect to sign_in functionality provided without the use of ",(0,l.kt)("inlineCode",{parentName:"p"},"errors")," middleware with ",(0,l.kt)("a",{parentName:"p",href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"},"Traefik v2 ",(0,l.kt)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," pointing to oauth2-proxy service's ",(0,l.kt)("inlineCode",{parentName:"p"},"/")," endpoint"),(0,l.kt)("p",null,(0,l.kt)("strong",{parentName:"p"},"Following options need to be set on ",(0,l.kt)("inlineCode",{parentName:"strong"},"oauth2-proxy"),":")),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"--upstream=static://202"),": Configures a static response for authenticated sessions"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"--reverseproxy=true"),": Enables the use of ",(0,l.kt)("inlineCode",{parentName:"li"},"X-Forwarded-*")," headers to determine redirects correctly")),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'http:\n routers:\n a-service-route-1:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n a-service-route-2:\n rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-wo-redirect # unauthenticated session will return a 401\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n services-oauth2-route:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth2-proxy-route:\n rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n b-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.3:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth-redirect:\n forwardAuth:\n address: https://oauth.example.com/\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n oauth-auth-wo-redirect:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n')),(0,l.kt)("div",{className:"admonition admonition-note alert alert--secondary"},(0,l.kt)("div",{parentName:"div",className:"admonition-heading"},(0,l.kt)("h5",{parentName:"div"},(0,l.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,l.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,l.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"}))),"note")),(0,l.kt)("div",{parentName:"div",className:"admonition-content"},(0,l.kt)("p",{parentName:"div"},"If you set up your OAuth2 provider to rotate your client secret, you can use the ",(0,l.kt)("inlineCode",{parentName:"p"},"client-secret-file")," option to reload the secret when it is updated."))))}u.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/js/935f2afb.4a3f1d92.js b/assets/js/935f2afb.4a3f1d92.js new file mode 100644 index 00000000..c1e5c1e7 --- /dev/null +++ b/assets/js/935f2afb.4a3f1d92.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[53],{1109:function(e){e.exports=JSON.parse('{"pluginId":"default","version":"current","label":"Next","banner":"unreleased","badge":true,"className":"docs-version-current","isLast":false,"docsSidebars":{"docs":[{"type":"link","label":"Installation","href":"/oauth2-proxy/docs/next/","docId":"installation"},{"type":"link","label":"Behaviour","href":"/oauth2-proxy/docs/next/behaviour","docId":"behaviour"},{"type":"category","label":"Configuration","collapsed":false,"items":[{"type":"link","label":"Overview","href":"/oauth2-proxy/docs/next/configuration/overview","docId":"configuration/overview"},{"type":"link","label":"OAuth Provider Configuration","href":"/oauth2-proxy/docs/next/configuration/oauth_provider","docId":"configuration/oauth_provider"},{"type":"link","label":"Session Storage","href":"/oauth2-proxy/docs/next/configuration/session_storage","docId":"configuration/session_storage"},{"type":"link","label":"TLS Configuration","href":"/oauth2-proxy/docs/next/configuration/tls","docId":"configuration/tls"},{"type":"link","label":"Alpha Configuration","href":"/oauth2-proxy/docs/next/configuration/alpha-config","docId":"configuration/alpha-config"}],"collapsible":true},{"type":"category","label":"Features","collapsed":false,"items":[{"type":"link","label":"Endpoints","href":"/oauth2-proxy/docs/next/features/endpoints","docId":"features/endpoints"}],"collapsible":true},{"type":"category","label":"Community","collapsed":false,"items":[{"type":"link","label":"Security","href":"/oauth2-proxy/docs/next/community/security","docId":"community/security"}],"collapsible":true}]},"docs":{"behaviour":{"id":"behaviour","title":"Behaviour","description":"1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy\'s session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).","sidebar":"docs"},"community/security":{"id":"community/security","title":"Security","description":"OAuth2 Proxy is a community project.","sidebar":"docs"},"configuration/alpha-config":{"id":"configuration/alpha-config","title":"Alpha Configuration","description":"This page contains documentation for alpha features.","sidebar":"docs"},"configuration/oauth_provider":{"id":"configuration/oauth_provider","title":"OAuth Provider Configuration","description":"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on.","sidebar":"docs"},"configuration/overview":{"id":"configuration/overview","title":"Overview","description":"oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings).","sidebar":"docs"},"configuration/session_storage":{"id":"configuration/session_storage","title":"Session Storage","description":"Sessions allow a user\'s authentication to be tracked between multiple HTTP","sidebar":"docs"},"configuration/tls":{"id":"configuration/tls","title":"TLS Configuration","description":"There are two recommended configurations:","sidebar":"docs"},"features/endpoints":{"id":"features/endpoints","title":"Endpoints","description":"OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.","sidebar":"docs"},"installation":{"id":"installation","title":"Installation","description":"1. Choose how to deploy:","sidebar":"docs"}}}')}}]); \ No newline at end of file diff --git a/assets/js/94285305.1f5fc964.js b/assets/js/94285305.1f5fc964.js new file mode 100644 index 00000000..f8e26707 --- /dev/null +++ b/assets/js/94285305.1f5fc964.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[2822],{3905:function(e,t,r){r.d(t,{Zo:function(){return p},kt:function(){return f}});var n=r(7294);function o(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function i(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function a(e){for(var t=1;t=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var c=n.createContext({}),s=function(e){var t=n.useContext(c),r=t;return e&&(r="function"==typeof e?e(t):a(a({},t),e)),r},p=function(e){var t=s(e.components);return n.createElement(c.Provider,{value:t},e.children)},l={inlineCode:"code",wrapper:function(e){var t=e.children;return n.createElement(n.Fragment,{},t)}},d=n.forwardRef((function(e,t){var r=e.components,o=e.mdxType,i=e.originalType,c=e.parentName,p=u(e,["components","mdxType","originalType","parentName"]),d=s(r),f=o,h=d["".concat(c,".").concat(f)]||d[f]||l[f]||i;return r?n.createElement(h,a(a({ref:t},p),{},{components:r})):n.createElement(h,a({ref:t},p))}));function f(e,t){var r=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var i=r.length,a=new Array(i);a[0]=d;var u={};for(var c in t)hasOwnProperty.call(t,c)&&(u[c]=t[c]);u.originalType=e,u.mdxType="string"==typeof e?e:o,a[1]=u;for(var s=2;s=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var p=r.createContext({}),u=function(e){var t=r.useContext(p),n=t;return e&&(n="function"==typeof e?e(t):i(i({},t),e)),n},c=function(e){var t=u(e.components);return r.createElement(p.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},m=r.forwardRef((function(e,t){var n=e.components,o=e.mdxType,a=e.originalType,p=e.parentName,c=l(e,["components","mdxType","originalType","parentName"]),m=u(n),f=o,d=m["".concat(p,".").concat(f)]||m[f]||s[f]||a;return n?r.createElement(d,i(i({ref:t},c),{},{components:n})):r.createElement(d,i({ref:t},c))}));function f(e,t){var n=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var a=n.length,i=new Array(a);i[0]=m;var l={};for(var p in t)hasOwnProperty.call(t,p)&&(l[p]=t[p]);l.originalType=e,l.mdxType="string"==typeof e?e:o,i[1]=l;for(var u=2;u=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var l=r.createContext({}),c=function(e){var t=r.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):i(i({},t),e)),n},u=function(e){var t=c(e.components);return r.createElement(l.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},m=r.forwardRef((function(e,t){var n=e.components,o=e.mdxType,a=e.originalType,l=e.parentName,u=p(e,["components","mdxType","originalType","parentName"]),m=c(n),d=o,f=m["".concat(l,".").concat(d)]||m[d]||s[d]||a;return n?r.createElement(f,i(i({ref:t},u),{},{components:n})):r.createElement(f,i({ref:t},u))}));function d(e,t){var n=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var a=n.length,i=new Array(a);i[0]=m;var p={};for(var l in t)hasOwnProperty.call(t,l)&&(p[l]=t[l]);p.originalType=e,p.mdxType="string"==typeof e?e:o,i[1]=p;for(var c=2;c0&&r.createElement(s,{years:o})))}}}]); \ No newline at end of file diff --git a/assets/js/9f61b932.2752973c.js b/assets/js/9f61b932.2752973c.js new file mode 100644 index 00000000..60656f84 --- /dev/null +++ b/assets/js/9f61b932.2752973c.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[8583],{3905:function(e,t,n){n.d(t,{Zo:function(){return c},kt:function(){return h}});var r=n(7294);function i(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function o(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function a(e){for(var t=1;t=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var l=r.createContext({}),u=function(e){var t=r.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):a(a({},t),e)),n},c=function(e){var t=u(e.components);return r.createElement(l.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},p=r.forwardRef((function(e,t){var n=e.components,i=e.mdxType,o=e.originalType,l=e.parentName,c=s(e,["components","mdxType","originalType","parentName"]),p=u(n),h=i,k=p["".concat(l,".").concat(h)]||p[h]||d[h]||o;return n?r.createElement(k,a(a({ref:t},c),{},{components:n})):r.createElement(k,a({ref:t},c))}));function h(e,t){var n=arguments,i=t&&t.mdxType;if("string"==typeof e||i){var o=n.length,a=new Array(o);a[0]=p;var s={};for(var l in t)hasOwnProperty.call(t,l)&&(s[l]=t[l]);s.originalType=e,s.mdxType="string"==typeof e?e:i,a[1]=s;for(var u=2;u=0||(n[o]=e[o]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(a=0;a=0||Object.prototype.propertyIsEnumerable.call(e,o)&&(n[o]=e[o])}return n}var p=a.createContext({}),s=function(e){var t=a.useContext(p),o=t;return e&&(o="function"==typeof e?e(t):i(i({},t),e)),o},c=function(e){var t=s(e.components);return a.createElement(p.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return a.createElement(a.Fragment,{},t)}},d=a.forwardRef((function(e,t){var o=e.components,n=e.mdxType,r=e.originalType,p=e.parentName,c=l(e,["components","mdxType","originalType","parentName"]),d=s(o),h=n,m=d["".concat(p,".").concat(h)]||d[h]||u[h]||r;return o?a.createElement(m,i(i({ref:t},c),{},{components:o})):a.createElement(m,i({ref:t},c))}));function h(e,t){var o=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var r=o.length,i=new Array(r);i[0]=d;var l={};for(var p in t)hasOwnProperty.call(t,p)&&(l[p]=t[p]);l.originalType=e,l.mdxType="string"==typeof e?e:n,i[1]=l;for(var s=2;s\n --client-secret=\n --oidc-issuer-url=https://sts.windows.net/{tenant-id}/\n")),(0,r.kt)("p",null,"Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the ",(0,r.kt)("inlineCode",{parentName:"p"},"proxy_buffer_size")," in nginx or implementing the ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/configuration/session_storage#redis-storage"},"redis session storage")," should resolve this."),(0,r.kt)("h3",{id:"adfs-auth-provider"},"ADFS Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Open the ADFS administration console on your Windows Server and add a new Application Group"),(0,r.kt)("li",{parentName:"ol"},"Provide a name for the integration, select Server Application from the Standalone applications section and click Next"),(0,r.kt)("li",{parentName:"ol"},"Follow the wizard to get the client-id, client-secret and configure the application credentials"),(0,r.kt)("li",{parentName:"ol"},"Configure the proxy with")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=adfs\n --client-id=\n --client-secret=\n")),(0,r.kt)("p",null,"Note: When using the ADFS Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/configuration/session_storage#redis-storage"},"redis session storage")," should resolve this."),(0,r.kt)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new FB App from ",(0,r.kt)("a",{parentName:"li",href:"https://developers.facebook.com/"},"https://developers.facebook.com/")),(0,r.kt)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),(0,r.kt)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://github.com/settings/developers"},"https://github.com/settings/developers")),(0,r.kt)("li",{parentName:"ol"},"Under ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),(0,r.kt)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=*")),(0,r.kt)("p",null,"NOTE: When ",(0,r.kt)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),(0,r.kt)("p",null,"To restrict by organization only, include the following flag:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-org="": restrict logins to members of this organisation\n')),(0,r.kt)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",(0,r.kt)("inlineCode",{parentName:"p"},"-github-org"),":"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),(0,r.kt)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),(0,r.kt)("p",null,"If you'd like to allow access to users with ",(0,r.kt)("strong",{parentName:"p"},"read only")," access to a ",(0,r.kt)("strong",{parentName:"p"},"public")," repository you will need to provide a ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/settings/tokens"},"token")," for a user that has write access to the repository. The token must be created with at least the ",(0,r.kt)("inlineCode",{parentName:"p"},"public_repo")," scope:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-token="": the token to use when verifying repository collaborators\n')),(0,r.kt)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-user="": allow logins by username, separated by a comma\n')),(0,r.kt)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-login-url="http(s):///login/oauth/authorize"\n-redeem-url="http(s):///login/oauth/access_token"\n-validate-url="http(s):///api/v3"\n')),(0,r.kt)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),(0,r.kt)("div",{className:"admonition admonition-note alert alert--secondary"},(0,r.kt)("div",{parentName:"div",className:"admonition-heading"},(0,r.kt)("h5",{parentName:"div"},(0,r.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,r.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,r.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"}))),"note")),(0,r.kt)("div",{parentName:"div",className:"admonition-content"},(0,r.kt)("p",{parentName:"div"},"This is the legacy provider for Keycloak, use ",(0,r.kt)("a",{parentName:"p",href:"#keycloak-oidc-auth-provider"},"Keycloak OIDC Auth Provider")," if possible."))),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",(0,r.kt)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",(0,r.kt)("strong",{parentName:"li"},"Valid Redirect URIs")," '",(0,r.kt)("a",{parentName:"li",href:"https://internal.yourcompany.com/oauth2/callback'"},"https://internal.yourcompany.com/oauth2/callback'")),(0,r.kt)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",(0,r.kt)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),(0,r.kt)("p",null,"Make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider=keycloak\n --client-id=\n --client-secret=\n --login-url="http(s):///auth/realms//protocol/openid-connect/auth"\n --redeem-url="http(s):///auth/realms//protocol/openid-connect/token"\n --profile-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n --validate-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n --keycloak-group=\n --keycloak-group=\n')),(0,r.kt)("p",null,"For group based authorization, the optional ",(0,r.kt)("inlineCode",{parentName:"p"},"--keycloak-group")," (legacy) or ",(0,r.kt)("inlineCode",{parentName:"p"},"--allowed-group")," (global standard)\nflags can be used to specify which groups to limit access to."),(0,r.kt)("p",null,"If these are unset but a ",(0,r.kt)("inlineCode",{parentName:"p"},"groups")," mapper is set up above in step (3), the provider will still\npopulate the ",(0,r.kt)("inlineCode",{parentName:"p"},"X-Forwarded-Groups")," header to your upstream server with the ",(0,r.kt)("inlineCode",{parentName:"p"},"groups")," data in the\nKeycloak userinfo endpoint response."),(0,r.kt)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak\nyou should define the 'keycloak-group' value to /admin."),(0,r.kt)("h3",{id:"keycloak-oidc-auth-provider"},"Keycloak OIDC Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create new client in your Keycloak realm with ",(0,r.kt)("strong",{parentName:"li"},"Access Type")," 'confidental', ",(0,r.kt)("strong",{parentName:"li"},"Client protocol")," 'openid-connect' and ",(0,r.kt)("strong",{parentName:"li"},"Valid Redirect URIs")," '",(0,r.kt)("a",{parentName:"li",href:"https://internal.yourcompany.com/oauth2/callback'"},"https://internal.yourcompany.com/oauth2/callback'")),(0,r.kt)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",(0,r.kt)("strong",{parentName:"li"},"Token Claim Name")," 'groups'."),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Audience' and ",(0,r.kt)("strong",{parentName:"li"},"Included Client Audience")," and ",(0,r.kt)("strong",{parentName:"li"},"Included Custom Audience")," set to your client name.")),(0,r.kt)("p",null,"Make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=keycloak-oidc\n --client-id=\n --client-secret=\n --redirect-url=https://myapp.com/oauth2/callback\n --oidc-issuer-url=https:///auth/realms/\n --allowed-role= // Optional, required realm role\n --allowed-role=: // Optional, required client role\n")),(0,r.kt)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),(0,r.kt)("p",null,"This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/issues/994"},"994"),")."),(0,r.kt)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",(0,r.kt)("a",{parentName:"p",href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"},"these steps to add an application"),". Make sure to enable at least the ",(0,r.kt)("inlineCode",{parentName:"p"},"openid"),", ",(0,r.kt)("inlineCode",{parentName:"p"},"profile")," and ",(0,r.kt)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",(0,r.kt)("a",{parentName:"p",href:"https://myapp.com/oauth2/callback"},"https://myapp.com/oauth2/callback"),"."),(0,r.kt)("p",null,"If you need projects filtering, add the extra ",(0,r.kt)("inlineCode",{parentName:"p"},"read_api")," scope to your application."),(0,r.kt)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/configuration/overview#generating-a-cookie-secret"},"these steps")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider="gitlab"\n --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n --client-id=GITLAB_CLIENT_ID\n --client-secret=GITLAB_CLIENT_SECRET\n --cookie-secret=COOKIE_SECRET\n')),(0,r.kt)("p",null,"Restricting by group membership is possible with the following option:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),(0,r.kt)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--oidc-issuer-url=""\n')),(0,r.kt)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),(0,r.kt)("p",null,"For LinkedIn, the registration steps are:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://www.linkedin.com/secure/developer"},"https://www.linkedin.com/secure/developer")),(0,r.kt)("li",{parentName:"ol"},"In the OAuth User Agreement section:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),(0,r.kt)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),(0,r.kt)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),(0,r.kt)("li",{parentName:"ol"},"Take note of the ",(0,r.kt)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",(0,r.kt)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),(0,r.kt)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),(0,r.kt)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."),(0,r.kt)("p",null,"This provider was originally built against CoreOS Dex and we will use it as an example.\nThe OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below."),(0,r.kt)("h4",{id:"dex"},"Dex"),(0,r.kt)("p",null,"To configure the OIDC provider for Dex, perform the following steps:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Download Dex:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"go get github.com/dexidp/dex\n")),(0,r.kt)("p",{parentName:"li"},"See the ",(0,r.kt)("a",{parentName:"p",href:"https://dexidp.io/docs/getting-started/"},"getting started guide")," for more details.")),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the ",(0,r.kt)("inlineCode",{parentName:"p"},"staticClients")," section of ",(0,r.kt)("inlineCode",{parentName:"p"},"examples/config-dev.yaml"),":"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"- id: oauth2-proxy\nredirectURIs:\n- 'http://127.0.0.1:4180/oauth2/callback'\nname: 'oauth2-proxy'\nsecret: proxy\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Launch Dex: from ",(0,r.kt)("inlineCode",{parentName:"p"},"$GOPATH/github.com/dexidp/dex"),", run:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"bin/dex serve examples/config-dev.yaml\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"In a second terminal, run the oauth2-proxy with the following args:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'-provider oidc\n-provider-display-name "My OIDC Provider"\n-client-id oauth2-proxy\n-client-secret proxy\n-redirect-url http://127.0.0.1:4180/oauth2/callback\n-oidc-issuer-url http://127.0.0.1:5556/dex\n-cookie-secure=false\n-cookie-secret=secret\n-email-domain kilgore.trout\n')),(0,r.kt)("p",{parentName:"li"},"To serve the current working directory as a web site under the ",(0,r.kt)("inlineCode",{parentName:"p"},"/static")," endpoint, add:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"-upstream file://$PWD/#/static/\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Test the setup by visiting ",(0,r.kt)("a",{parentName:"p",href:"http://127.0.0.1:4180"},"http://127.0.0.1:4180")," or ",(0,r.kt)("a",{parentName:"p",href:"http://127.0.0.1:4180/static"},"http://127.0.0.1:4180/static")," ."))),(0,r.kt)("p",null,"See also ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment"},"our local testing environment")," for a self-contained example using Docker and etcd as storage for Dex."),(0,r.kt)("h4",{id:"okta"},"Okta"),(0,r.kt)("p",null,"To configure the OIDC provider for Okta, perform the following steps:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",(0,r.kt)("inlineCode",{parentName:"li"},"example.oktapreview.com")),(0,r.kt)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",(0,r.kt)("inlineCode",{parentName:"li"},"default")," will work.")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Security")," then select ",(0,r.kt)("strong",{parentName:"li"},"API")),(0,r.kt)("li",{parentName:"ul"},"Click ",(0,r.kt)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),(0,r.kt)("li",{parentName:"ul"},"Fill out the ",(0,r.kt)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),(0,r.kt)("li",{parentName:"ul"},"For ",(0,r.kt)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",(0,r.kt)("a",{parentName:"li",href:"https://example.corp.com"},"https://example.corp.com")),(0,r.kt)("li",{parentName:"ul"},"Fill out a ",(0,r.kt)("strong",{parentName:"li"},"Description")),(0,r.kt)("li",{parentName:"ul"},"Add any ",(0,r.kt)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),(0,r.kt)("li",{parentName:"ul"},"The default settings will work for other options.\n",(0,r.kt)("a",{parentName:"li",href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"},"See Okta documentation for more information on Authorization Servers"))),(0,r.kt)("ol",{start:3},(0,r.kt)("li",{parentName:"ol"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Applications")," then select ",(0,r.kt)("strong",{parentName:"li"},"Add Application"),".")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Select ",(0,r.kt)("strong",{parentName:"li"},"Web")," for the ",(0,r.kt)("strong",{parentName:"li"},"Platform")," setting."),(0,r.kt)("li",{parentName:"ul"},"Select ",(0,r.kt)("strong",{parentName:"li"},"OpenID Connect")," and click ",(0,r.kt)("strong",{parentName:"li"},"Create")),(0,r.kt)("li",{parentName:"ul"},"Pick an ",(0,r.kt)("strong",{parentName:"li"},"Application Name")," such as ",(0,r.kt)("inlineCode",{parentName:"li"},"Example App"),"."),(0,r.kt)("li",{parentName:"ul"},"Set the ",(0,r.kt)("strong",{parentName:"li"},"Login redirect URI")," to ",(0,r.kt)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),(0,r.kt)("li",{parentName:"ul"},"Under ",(0,r.kt)("strong",{parentName:"li"},"General")," set the ",(0,r.kt)("strong",{parentName:"li"},"Allowed grant types")," to ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization Code")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Refresh Token"),"."),(0,r.kt)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",(0,r.kt)("inlineCode",{parentName:"li"},"Client ID")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Client Secret"),"."),(0,r.kt)("li",{parentName:"ul"},"Under ",(0,r.kt)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),(0,r.kt)("ol",{start:4},(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Create a configuration file like the following:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n "https://example.corp.com"\n]\nemail_domains = [\n "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')))),(0,r.kt)("p",null,"The ",(0,r.kt)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",(0,r.kt)("strong",{parentName:"p"},"Authorization Server"),"'s ",(0,r.kt)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",(0,r.kt)("a",{parentName:"p",href:"https://corp.okta.com"},"https://corp.okta.com")," .\nThe ",(0,r.kt)("inlineCode",{parentName:"p"},"client_id")," and ",(0,r.kt)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",(0,r.kt)("inlineCode",{parentName:"p"},"cookie_secret")," to encrypt the cookie."),(0,r.kt)("p",null,"Then you can start the oauth2-proxy with ",(0,r.kt)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),(0,r.kt)("h4",{id:"okta---localhost"},"Okta - localhost"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Signup for developer account: ",(0,r.kt)("a",{parentName:"li",href:"https://developer.okta.com/signup/"},"https://developer.okta.com/signup/")),(0,r.kt)("li",{parentName:"ol"},"Create New ",(0,r.kt)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),(0,r.kt)("li",{parentName:"ol"},"Example Application Settings for localhost:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Name:")," My Web App"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Group assignments:")," ",(0,r.kt)("inlineCode",{parentName:"li"},"Everyone")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Grant type allowed:")," ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization Code")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Refresh Token")))),(0,r.kt)("li",{parentName:"ol"},"Make note of the ",(0,r.kt)("inlineCode",{parentName:"li"},"Client ID")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),(0,r.kt)("li",{parentName:"ol"},"Make note of the ",(0,r.kt)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),(0,r.kt)("li",{parentName:"ol"},"Example config file ",(0,r.kt)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n "http://0.0.0.0:8080"\n]\nemail_domains = [\n "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),(0,r.kt)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",(0,r.kt)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),(0,r.kt)("h3",{id:"logingov-provider"},"login.gov Provider"),(0,r.kt)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",(0,r.kt)("a",{parentName:"p",href:"https://login.gov/developers/"},"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),(0,r.kt)("p",null,"A developer guide is available here: ",(0,r.kt)("a",{parentName:"p",href:"https://developers.login.gov/"},"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),(0,r.kt)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),(0,r.kt)("p",null,"First, register your application in the dashboard. The important bits are:"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Identity protocol: make this ",(0,r.kt)("inlineCode",{parentName:"li"},"Openid connect")),(0,r.kt)("li",{parentName:"ul"},"Issuer: do what they say for OpenID Connect. We will refer to this string as ",(0,r.kt)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),(0,r.kt)("li",{parentName:"ul"},"Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",(0,r.kt)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",(0,r.kt)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",(0,r.kt)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),(0,r.kt)("li",{parentName:"ul"},"Return to App URL: Make this be ",(0,r.kt)("inlineCode",{parentName:"li"},"http://localhost:4180/")),(0,r.kt)("li",{parentName:"ul"},"Redirect URIs: Make this be ",(0,r.kt)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),(0,r.kt)("li",{parentName:"ul"},"Attribute Bundle: Make sure that email is selected.")),(0,r.kt)("p",null,"Now start the proxy up with the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'./oauth2-proxy -provider login.gov \\\n -client-id=${LOGINGOV_ISSUER} \\\n -redirect-url=http://localhost:4180/oauth2/callback \\\n -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n -cookie-secure=false \\\n -email-domain=gsa.gov \\\n -upstream=http://localhost:3000/ \\\n -cookie-secret=somerandomstring12341234567890AB \\\n -cookie-domain=localhost \\\n -skip-provider-button=true \\\n -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),(0,r.kt)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",(0,r.kt)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",(0,r.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",(0,r.kt)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),(0,r.kt)("p",null,"Once it is running, you should be able to go to ",(0,r.kt)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",(0,r.kt)("inlineCode",{parentName:"p"},"http://localhost:3000/"),". In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),(0,r.kt)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),(0,r.kt)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),(0,r.kt)("p",null,"In this case, you can set the ",(0,r.kt)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," -provider oidc\n -client-id oauth2-proxy\n -client-secret proxy\n -redirect-url http://127.0.0.1:4180/oauth2/callback\n -oidc-issuer-url http://127.0.0.1:5556\n -skip-oidc-discovery\n -login-url http://127.0.0.1:5556/authorize\n -redeem-url http://127.0.0.1:5556/token\n -oidc-jwks-url http://127.0.0.1:5556/keys\n -cookie-secure=false\n -email-domain example.com\n")),(0,r.kt)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),(0,r.kt)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),(0,r.kt)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",(0,r.kt)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",(0,r.kt)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),(0,r.kt)("p",null,"Refer to the ",(0,r.kt)("a",{parentName:"p",href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"},"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',(0,r.kt)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' -provider nextcloud\n -client-id \n -client-secret \n -login-url="/index.php/apps/oauth2/authorize"\n -redeem-url="/index.php/apps/oauth2/api/v1/token"\n -validate-url="/ocs/v2.php/cloud/user?format=json"\n')),(0,r.kt)("p",null,"Note: in ",(0,r.kt)("em",{parentName:"p"},"all")," cases the validate-url will ",(0,r.kt)("em",{parentName:"p"},"not")," have the ",(0,r.kt)("inlineCode",{parentName:"p"},"index.php"),"."),(0,r.kt)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("a",{parentName:"li",href:"https://cloud.digitalocean.com/account/api/applications"},"Create a new OAuth application"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),(0,r.kt)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',(0,r.kt)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",(0,r.kt)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),(0,r.kt)("p",null,"To use the provider, pass the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=digitalocean\n --client-id=\n --client-secret=\n")),(0,r.kt)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",(0,r.kt)("inlineCode",{parentName:"p"},"https:///oauth2/callback"),". If you need to change it, you can use the ",(0,r.kt)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),(0,r.kt)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("a",{parentName:"li",href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"},"Add a new OAuth consumer"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},'In "Callback URL" use ',(0,r.kt)("inlineCode",{parentName:"li"},"https:///oauth2/callback"),", substituting ",(0,r.kt)("inlineCode",{parentName:"li"},"")," with the actual hostname that oauth2-proxy is running on."),(0,r.kt)("li",{parentName:"ul"},"In Permissions section select:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"Account -> Email"),(0,r.kt)("li",{parentName:"ul"},"Team membership -> Read"),(0,r.kt)("li",{parentName:"ul"},"Repositories -> Read"))))),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),(0,r.kt)("p",null,"To use the provider, pass the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=bitbucket\n --client-id=\n --client-secret=\n")),(0,r.kt)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",(0,r.kt)("inlineCode",{parentName:"p"},"--bitbucket-team="),". To restrict the access to only these users who has access to one selected repository use ",(0,r.kt)("inlineCode",{parentName:"p"},"--bitbucket-repository="),"."),(0,r.kt)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new application: ",(0,r.kt)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),(0,r.kt)("li",{parentName:"ol"},"Under ",(0,r.kt)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",(0,r.kt)("inlineCode",{parentName:"li"},"https:///oauth2/callback")),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),(0,r.kt)("li",{parentName:"ol"},"Pass the following options to the proxy:")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider="github"\n --redirect-url="https:///oauth2/callback"\n --provider-display-name="Gitea"\n --client-id="< client_id as generated by Gitea >"\n --client-secret="< client_secret as generated by Gitea >"\n --login-url="https://< your gitea host >/login/oauth/authorize"\n --redeem-url="https://< your gitea host >/login/oauth/access_token"\n --validate-url="https://< your gitea host >/api/v1"\n')),(0,r.kt)("h2",{id:"email-authentication"},"Email Authentication"),(0,r.kt)("p",null,"To authorize by email domain use ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",(0,r.kt)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),(0,r.kt)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),(0,r.kt)("p",null,"Follow the examples in the ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"},(0,r.kt)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",(0,r.kt)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",(0,r.kt)("inlineCode",{parentName:"p"},"case")," to\n",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"},(0,r.kt)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",(0,r.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",(0,r.kt)("inlineCode",{parentName:"p"},"Provider"),"."))}d.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/js/a37c03cb.4fbaf920.js b/assets/js/a37c03cb.4fbaf920.js new file mode 100644 index 00000000..d2c91574 --- /dev/null +++ b/assets/js/a37c03cb.4fbaf920.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[2871],{3905:function(e,t,n){n.d(t,{Zo:function(){return s},kt:function(){return d}});var r=n(7294);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function i(e){for(var t=1;t=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var l=r.createContext({}),c=function(e){var t=r.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):i(i({},t),e)),n},s=function(e){var t=c(e.components);return r.createElement(l.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},m=r.forwardRef((function(e,t){var n=e.components,o=e.mdxType,a=e.originalType,l=e.parentName,s=p(e,["components","mdxType","originalType","parentName"]),m=c(n),d=o,f=m["".concat(l,".").concat(d)]||m[d]||u[d]||a;return n?r.createElement(f,i(i({ref:t},s),{},{components:n})):r.createElement(f,i({ref:t},s))}));function d(e,t){var n=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var a=n.length,i=new Array(a);i[0]=m;var p={};for(var l in t)hasOwnProperty.call(t,l)&&(p[l]=t[l]);p.originalType=e,p.mdxType="string"==typeof e?e:o,i[1]=p;for(var c=2;c=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var u=r.createContext({}),p=function(e){var t=r.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):a(a({},t),e)),n},l=function(e){var t=p(e.components);return r.createElement(u.Provider,{value:t},e.children)},c={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},d=r.forwardRef((function(e,t){var n=e.components,o=e.mdxType,i=e.originalType,u=e.parentName,l=s(e,["components","mdxType","originalType","parentName"]),d=p(n),h=o,f=d["".concat(u,".").concat(h)]||d[h]||c[h]||i;return n?r.createElement(f,a(a({ref:t},l),{},{components:n})):r.createElement(f,a({ref:t},l))}));function h(e,t){var n=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var i=n.length,a=new Array(i);a[0]=d;var s={};for(var u in t)hasOwnProperty.call(t,u)&&(s[u]=t[u]);s.originalType=e,s.mdxType="string"==typeof e?e:o,a[1]=s;for(var p=2;p=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var s=n.createContext({}),c=function(e){var t=n.useContext(s),r=t;return e&&(r="function"==typeof e?e(t):a(a({},t),e)),r},p=function(e){var t=c(e.components);return n.createElement(s.Provider,{value:t},e.children)},l={inlineCode:"code",wrapper:function(e){var t=e.children;return n.createElement(n.Fragment,{},t)}},d=n.forwardRef((function(e,t){var r=e.components,o=e.mdxType,i=e.originalType,s=e.parentName,p=u(e,["components","mdxType","originalType","parentName"]),d=c(r),f=o,h=d["".concat(s,".").concat(f)]||d[f]||l[f]||i;return r?n.createElement(h,a(a({ref:t},p),{},{components:r})):n.createElement(h,a({ref:t},p))}));function f(e,t){var r=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var i=r.length,a=new Array(i);a[0]=d;var u={};for(var s in t)hasOwnProperty.call(t,s)&&(u[s]=t[s]);u.originalType=e,u.mdxType="string"==typeof e?e:o,a[1]=u;for(var c=2;c=0||(r[n]=t[n]);return r}(t,e);if(Object.getOwnPropertySymbols){var l=Object.getOwnPropertySymbols(t);for(a=0;a=0||Object.prototype.propertyIsEnumerable.call(t,n)&&(r[n]=t[n])}return r}var d=a.createContext({}),p=function(t){var e=a.useContext(d),n=e;return t&&(n="function"==typeof t?t(e):i(i({},e),t)),n},s=function(t){var e=p(t.components);return a.createElement(d.Provider,{value:e},t.children)},m={inlineCode:"code",wrapper:function(t){var e=t.children;return a.createElement(a.Fragment,{},e)}},u=a.forwardRef((function(t,e){var n=t.components,r=t.mdxType,l=t.originalType,d=t.parentName,s=o(t,["components","mdxType","originalType","parentName"]),u=p(n),k=r,g=u["".concat(d,".").concat(k)]||u[k]||m[k]||l;return n?a.createElement(g,i(i({ref:e},s),{},{components:n})):a.createElement(g,i({ref:e},s))}));function k(t,e){var n=arguments,r=e&&e.mdxType;if("string"==typeof t||r){var l=n.length,i=new Array(l);i[0]=u;var o={};for(var d in e)hasOwnProperty.call(e,d)&&(o[d]=e[d]);o.originalType=t,o.mdxType="string"==typeof t?t:r,i[1]=o;for(var p=2;p child <"+("string"==typeof t.type?t.type:t.type.name)+'>: all children of the component should be , and every should have a unique "value" prop.')})),h=null!=u?u:N.map((function(t){var e=t.props;return{value:e.value,label:e.label,attributes:e.attributes}})),c=(0,i.lx)(h,(function(t,e){return t.value===e.value}));if(c.length>0)throw new Error('Docusaurus error: Duplicate values "'+c.map((function(t){return t.value})).join(", ")+'" found in . Every value needs to be unique.');var f=null===m?m:null!=(e=null!=m?m:null==(n=N.find((function(t){return t.props.default})))?void 0:n.props.value)?e:null==(l=N[0])?void 0:l.props.value;if(null!==f&&!h.some((function(t){return t.value===f})))throw new Error('Docusaurus error: The has a defaultValue "'+f+'" but none of its children has the corresponding value. Available values are: '+h.map((function(t){return t.value})).join(", ")+". If you intend to show no default tab, use defaultValue={null} instead.");var b=(0,i.UB)(),y=b.tabGroupChoices,v=b.setTabGroupChoices,C=(0,r.useState)(f),w=C[0],_=C[1],T=[],x=(0,i.o5)().blockElementScrollPositionUntilNextRender;if(null!=k){var q=y[k];null!=q&&q!==w&&h.some((function(t){return t.value===q}))&&_(q)}var O=function(t){var e=t.currentTarget,n=T.indexOf(e),a=h[n].value;a!==w&&(x(e),_(a),null!=k&&v(k,a))},S=function(t){var e,n=null;switch(t.key){case"ArrowRight":var a=T.indexOf(t.currentTarget)+1;n=T[a]||T[0];break;case"ArrowLeft":var r=T.indexOf(t.currentTarget)-1;n=T[r]||T[T.length-1]}null==(e=n)||e.focus()};return r.createElement("div",{className:"tabs-container"},r.createElement("ul",{role:"tablist","aria-orientation":"horizontal",className:(0,o.Z)("tabs",{"tabs--block":s},g)},h.map((function(t){var e=t.value,n=t.label,l=t.attributes;return r.createElement("li",(0,a.Z)({role:"tab",tabIndex:w===e?0:-1,"aria-selected":w===e,key:e,ref:function(t){return T.push(t)},onKeyDown:S,onFocus:O,onClick:O},l,{className:(0,o.Z)("tabs__item",d,null==l?void 0:l.className,{"tabs__item--active":w===e})}),null!=n?n:e)}))),p?(0,r.cloneElement)(N.filter((function(t){return t.props.value===w}))[0],{className:"margin-vert--md"}):r.createElement("div",{className:"margin-vert--md"},N.map((function(t,e){return(0,r.cloneElement)(t,{key:e,hidden:t.props.value!==w})}))))}function s(t){var e=(0,l.Z)();return r.createElement(p,(0,a.Z)({key:String(e)},t))}},7324:function(t,e,n){n.r(e),n.d(e,{frontMatter:function(){return p},contentTitle:function(){return s},metadata:function(){return m},toc:function(){return u},default:function(){return g}});var a=n(7462),r=n(3366),l=(n(7294),n(3905)),i=n(9877),o=n(8215),d=["components"],p={id:"overview",title:"Overview"},s=void 0,m={unversionedId:"configuration/overview",id:"version-6.1.x/configuration/overview",title:"Overview",description:"oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings).",source:"@site/versioned_docs/version-6.1.x/configuration/overview.md",sourceDirName:"configuration",slug:"/configuration/overview",permalink:"/oauth2-proxy/docs/6.1.x/configuration/overview",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-6.1.x/configuration/overview.md",tags:[],version:"6.1.x",frontMatter:{id:"overview",title:"Overview"},sidebar:"version-6.1.x/docs",previous:{title:"Behaviour",permalink:"/oauth2-proxy/docs/6.1.x/behaviour"},next:{title:"OAuth Provider Configuration",permalink:"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider"}},u=[{value:"Generating a Cookie Secret",id:"generating-a-cookie-secret",children:[],level:3},{value:"Config File",id:"config-file",children:[],level:3},{value:"Command Line Options",id:"command-line-options",children:[],level:3},{value:"Upstreams Configuration",id:"upstreams-configuration",children:[],level:3},{value:"Environment variables",id:"environment-variables",children:[],level:3},{value:"Logging Configuration",id:"logging-configuration",children:[{value:"Auth Log Format",id:"auth-log-format",children:[],level:3},{value:"Request Log Format",id:"request-log-format",children:[],level:3},{value:"Standard Log Format",id:"standard-log-format",children:[],level:3}],level:2},{value:"Configuring for use with the Nginx auth_request directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",children:[],level:2}],k={toc:u};function g(t){var e=t.components,n=(0,r.Z)(t,d);return(0,l.kt)("wrapper",(0,a.Z)({},k,n,{components:e,mdxType:"MDXLayout"}),(0,l.kt)("p",null,(0,l.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",(0,l.kt)("a",{parentName:"p",href:"#command-line-options"},"command line options"),", ",(0,l.kt)("a",{parentName:"p",href:"#environment-variables"},"environment variables")," or ",(0,l.kt)("a",{parentName:"p",href:"#config-file"},"config file")," (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."),(0,l.kt)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),(0,l.kt)("p",null,"To generate a strong cookie secret use one of the below commands:"),(0,l.kt)(i.Z,{defaultValue:"python",values:[{label:"Python",value:"python"},{label:"Bash",value:"bash"},{label:"OpenSSL",value:"openssl"},{label:"PowerShell",value:"powershell"},{label:"Terraform",value:"terraform"}],mdxType:"Tabs"},(0,l.kt)(o.Z,{value:"python",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'\n"))),(0,l.kt)(o.Z,{value:"bash",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\\n' | tr -- '+/' '-_'; echo\n"))),(0,l.kt)(o.Z,{value:"openssl",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"openssl rand -base64 32 | tr -- '+/' '-_'\n"))),(0,l.kt)(o.Z,{value:"powershell",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},'# Add System.Web assembly to session, just in case\nAdd-Type -AssemblyName System.Web\n[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")\n'))),(0,l.kt)(o.Z,{value:"terraform",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},'# Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret\nresource "random_password" "cookie_secret" {\n length = 32\n override_special = "-_"\n}\n')))),(0,l.kt)("h3",{id:"config-file"},"Config File"),(0,l.kt)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),(0,l.kt)("p",null,"An example ",(0,l.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"},"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",(0,l.kt)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),(0,l.kt)("h3",{id:"command-line-options"},"Command Line Options"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Option"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"),(0,l.kt)("th",{parentName:"tr",align:null},"Default"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--acr-values")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"optional, see ",(0,l.kt)("a",{parentName:"td",href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"},"docs")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--approval-prompt")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth approval_prompt"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"force"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log authentication attempts"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for authentication log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate against emails via file (one per line)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--azure-tenant")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"go to a tenant-specific or common (tenant-independent) endpoint."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"common"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--basic-auth-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the password to set when passing the HTTP Basic Auth header"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-id")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client ID, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the file with OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--config")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to config file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Optional cookie domains to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-expire")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"expire timeframe for cookie"),(0,l.kt)("td",{parentName:"tr",align:null},"168h0m0s")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-httponly")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set HttpOnly cookie flag"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the name of the cookie that the oauth_proxy creates"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"an optional cookie path to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"/poc/"),")"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-refresh")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"refresh the cookie after this duration; ",(0,l.kt)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",(0,l.kt)("a",{parentName:"td",href:"#footnote1"},"1"),"]"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the seed string for secure cookies (optionally base64 encoded)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secure")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set ",(0,l.kt)("a",{parentName:"td",href:"https://owasp.org/www-community/controls/SecureFlag"},"secure (HTTPS only) cookie flag")),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-samesite")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"set SameSite cookie attribute (",(0,l.kt)("inlineCode",{parentName:"td"},'"lax"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"strict"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"none"'),", or ",(0,l.kt)("inlineCode",{parentName:"td"},'""'),")."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--custom-templates-dir")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to custom html templates"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"display username / password login form if an htpasswd file is provided"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--email-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate emails with the specified domain (may be given multiple times). Use ",(0,l.kt)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--errors-to-info-log")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"redirects error-level logging to default log channel instead of stderr"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"if ",(0,l.kt)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",(0,l.kt)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",(0,l.kt)("inlineCode",{parentName:"td"},"iss"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--exclude-logging-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"comma separated list of paths to exclude from logging, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"/ping,/path2"')),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--flush-interval")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"period between flushing response buffers when streaming responses"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"1s"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--force-https")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"enforce https redirect"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"false"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--banner")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) banner string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--footer")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) footer string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gcp-healthchecks")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will enable ",(0,l.kt)("inlineCode",{parentName:"td"},"/liveness_check"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"/readiness_check"),", and ",(0,l.kt)("inlineCode",{parentName:"td"},"/")," (with the proper user-agent) endpoints that will make it work well with GCP App Engine and GKE Ingresses"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-org")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this organisation"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-team")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these teams (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-repo")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to collaborators of this repository formatted as ",(0,l.kt)("inlineCode",{parentName:"td"},"orgname/repo")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-token")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the token to use when verifying repository collaborators (must have push access to the repository)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-user")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gitlab-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these groups (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-admin-email")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the google admin to impersonate for api calls"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this google group (may be given multiple times)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-service-account-json")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the path to the service account json credentials"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--htpasswd-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"additionally authenticate against a htpasswd file. Entries must be created with ",(0,l.kt)("inlineCode",{parentName:"td"},"htpasswd -s")," for SHA encryption"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--http-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"[http://]:")," or ",(0,l.kt)("inlineCode",{parentName:"td"},"unix://")," to listen on for HTTP clients"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"127.0.0.1:4180"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--https-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},":")," to listen on for HTTPS clients"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'":443"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-compress")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Should rotated log files be compressed using gzip"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-filename")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"File to log requests to, empty for ",(0,l.kt)("inlineCode",{parentName:"td"},"stdout")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (stdout)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-local-time")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Use local time in log files and backup filenames instead of UTC"),(0,l.kt)("td",{parentName:"tr",align:null},"true (local time)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-age")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum number of days to retain old log files"),(0,l.kt)("td",{parentName:"tr",align:null},"7")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-backups")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum number of old log files to retain; 0 to disable"),(0,l.kt)("td",{parentName:"tr",align:null},"0")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-size")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum size in megabytes of the log file before rotation"),(0,l.kt)("td",{parentName:"tr",align:null},"100")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"private key in PEM format used to sign JWT, so that you can say something like ",(0,l.kt)("inlineCode",{parentName:"td"},'--jwt-key="${OAUTH2_PROXY_JWT_KEY}"'),": required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to the private key file in PEM format used to sign the JWT so that you can say something like ",(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem"),": required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--login-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Authentication endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-allow-unverified-email")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"don't fail if an email address in an id_token is not verified"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-issuer-verification")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-issuer-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OpenID Connect issuer URL, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"https://accounts.google.com"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-jwks-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OIDC JWKS URI for token verification; required if OIDC discovery is disabled"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-access-token")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with ",(0,l.kt)("inlineCode",{parentName:"td"},"--set-xauthrequest")," this adds the X-Auth-Request-Access-Token header to the response"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-authorization-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass OIDC IDToken to upstream via Authorization Bearer header"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-basic-auth")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--prefer-email-to-user")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-basic-auth")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-user-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-host-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass the request Host Header to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-user-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--profile-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Profile access endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--prompt")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"},"OIDC prompt"),"; if present, ",(0,l.kt)("inlineCode",{parentName:"td"},"approval-prompt")," is ignored"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth provider"),(0,l.kt)("td",{parentName:"tr",align:null},"google")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider-ca-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider-display-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Override the provider's name with the given string; used for the sign-in page"),(0,l.kt)("td",{parentName:"tr",align:null},"(depends on provider)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ping-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the ping endpoint that can be used for basic health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/ping"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ping-user-agent")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"a User-Agent that can be used for basic health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (don't check user agent)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--proxy-prefix")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the url root path that this proxy should be nested under (e.g. /",(0,l.kt)("inlineCode",{parentName:"td"},"/sign_in"),")"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/oauth2"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--proxy-websockets")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"enables WebSocket proxying"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pubjwk-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"JWK pubkey access endpoint: required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--real-client-ip-header")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Header used to determine the real IP of the client, requires ",(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")," to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)"),(0,l.kt)("td",{parentName:"tr",align:null},"X-Real-IP")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redeem-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Token redemption endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redirect-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Redirect URL, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"https://internalapp.yourcompany.com/oauth2/callback"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"List of Redis cluster connection URLs (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-cluster")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"URL of redis server for redis session storage (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),")"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis password. Applicable for all Redis configurations. Will override any password set in ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-url")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-password")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis sentinel master name. Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"List of Redis sentinel connection URLs (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-cluster")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Connect to redis cluster. Must set ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")," to use this feature"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Connect to redis via sentinels. Must set ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")," to use this feature"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log requests"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for request log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--resource")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"The resource that is protected (Azure AD only)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--scope")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth scope specification"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--session-cookie-minimal")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--session-store-type")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"/oauth2-proxy/docs/6.1.x/configuration/session_storage"},"Session data storage backend"),"; redis or cookie"),(0,l.kt)("td",{parentName:"tr",align:null},"cookie")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-xauthrequest")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set X-Auth-Request-User, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-access-token"),", X-Auth-Request-Access-Token is added to response headers."),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-authorization-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set Authorization Bearer response header (useful in Nginx auth_request mode)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-basic-auth")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set HTTP Basic Auth information in response (useful in Nginx auth_request mode)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--signature-key")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"GAP-Signature request signature key (algorithm:secretkey)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--silence-ping-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"disable logging of requests to ping endpoint"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-preflight")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip authentication for OPTIONS requests"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-regex")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"bypass authentication for requests paths that match (may be given multiple times)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-strip-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"strips ",(0,l.kt)("inlineCode",{parentName:"td"},"X-Forwarded-*")," style authentication headers & ",(0,l.kt)("inlineCode",{parentName:"td"},"Authorization")," header if they would be set by oauth2-proxy for request paths in ",(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-regex")),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip requests that have verified JWT bearer tokens (the token must have ",(0,l.kt)("a",{parentName:"td",href:"https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields"},(0,l.kt)("inlineCode",{parentName:"a"},"aud"))," that matches this client id or one of the extras from ",(0,l.kt)("inlineCode",{parentName:"td"},"extra-jwt-issuers"),")"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-oidc-discovery")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"bypass OIDC endpoint discovery. ",(0,l.kt)("inlineCode",{parentName:"td"},"--login-url"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"--redeem-url")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-jwks-url")," must be configured in this case"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-provider-button")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip sign-in-page to directly reach the next step: oauth/start"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ssl-insecure-skip-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip validation of certificates presented when using HTTPS providers"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ssl-upstream-insecure-skip-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip validation of certificates presented when using HTTPS upstreams"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--standard-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log standard runtime information"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--standard-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for standard log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-cert-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to certificate file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-key-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to private key file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--upstream")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"the http url(s) of the upstream endpoint, file:// paths for static files or ",(0,l.kt)("inlineCode",{parentName:"td"},"static://")," for static response. Routing is based on the path"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--user-id-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which claim contains the user ID"),(0,l.kt)("td",{parentName:"tr",align:null},"[",'"email"',"]")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--validate-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Access token validation endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--version")),(0,l.kt)("td",{parentName:"tr",align:null},"n/a"),(0,l.kt)("td",{parentName:"tr",align:null},"print version string"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--whitelist-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"allowed domains for redirection after authentication. Prefix domain with a ",(0,l.kt)("inlineCode",{parentName:"td"},".")," to allow subdomains (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},".example.com"),")","\xa0","[",(0,l.kt)("a",{parentName:"td",href:"#footnote2"},"2"),"]"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--trusted-ip")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with ",(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")," and optionally ",(0,l.kt)("inlineCode",{parentName:"td"},"--real-client-ip-header")," this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them."),(0,l.kt)("td",{parentName:"tr",align:null})))),(0,l.kt)("p",null,"[",(0,l.kt)("a",{name:"footnote1"},"1"),"]",": Only these providers support ",(0,l.kt)("inlineCode",{parentName:"p"},"--cookie-refresh"),": GitLab, Google and OIDC"),(0,l.kt)("p",null,"[",(0,l.kt)("a",{name:"footnote2"},"2"),"]",": When using the ",(0,l.kt)("inlineCode",{parentName:"p"},"whitelist-domain")," option, any domain prefixed with a ",(0,l.kt)("inlineCode",{parentName:"p"},".")," will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: ",(0,l.kt)("inlineCode",{parentName:"p"},"example.com:8080"),". To allow any port, use ",(0,l.kt)("inlineCode",{parentName:"p"},"*"),": ",(0,l.kt)("inlineCode",{parentName:"p"},"example.com:*"),"."),(0,l.kt)("p",null,"See below for provider specific options"),(0,l.kt)("h3",{id:"upstreams-configuration"},"Upstreams Configuration"),(0,l.kt)("p",null,(0,l.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as ",(0,l.kt)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/")," for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide ",(0,l.kt)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/some/path/")," then it will only be requests that start with ",(0,l.kt)("inlineCode",{parentName:"p"},"/some/path/")," which are forwarded to the upstream."),(0,l.kt)("p",null,"Static file paths are configured as a file:// URL. ",(0,l.kt)("inlineCode",{parentName:"p"},"file:///var/www/static/")," will serve the files from that directory at ",(0,l.kt)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/var/www/static/"),", which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. ",(0,l.kt)("inlineCode",{parentName:"p"},"file:///var/www/static/#/static/")," will make ",(0,l.kt)("inlineCode",{parentName:"p"},"/var/www/static/")," available at ",(0,l.kt)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/static/"),"."),(0,l.kt)("p",null,"Multiple upstreams can either be configured by supplying a comma separated list to the ",(0,l.kt)("inlineCode",{parentName:"p"},"--upstream")," parameter, supplying the parameter multiple times or providing a list in the ",(0,l.kt)("a",{parentName:"p",href:"#config-file"},"config file"),". When multiple upstreams are used routing to them will be based on the path they are set up with."),(0,l.kt)("h3",{id:"environment-variables"},"Environment variables"),(0,l.kt)("p",null,"Every command line argument can be specified as an environment variable by\nprefixing it with ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_"),", capitalising it, and replacing hyphens (",(0,l.kt)("inlineCode",{parentName:"p"},"-"),")\nwith underscores (",(0,l.kt)("inlineCode",{parentName:"p"},"_"),"). If the argument can be specified multiple times, the\nenvironment variable should be plural (trailing ",(0,l.kt)("inlineCode",{parentName:"p"},"S"),")."),(0,l.kt)("p",null,"This is particularly useful for storing secrets outside of a configuration file\nor the command line."),(0,l.kt)("p",null,"For example, the ",(0,l.kt)("inlineCode",{parentName:"p"},"--cookie-secret")," flag becomes ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_COOKIE_SECRET"),",\nand the ",(0,l.kt)("inlineCode",{parentName:"p"},"--email-domain")," flag becomes ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_EMAIL_DOMAINS"),"."),(0,l.kt)("h2",{id:"logging-configuration"},"Logging Configuration"),(0,l.kt)("p",null,"By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the ",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-filename")," command."),(0,l.kt)("p",null,"If logging to a file you can also configure the maximum file size (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-size"),"), age (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-age"),"), max backup logs (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-backups"),"), and if backup logs should be compressed (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-compress"),")."),(0,l.kt)("p",null,"There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with ",(0,l.kt)("inlineCode",{parentName:"p"},"--standard-logging"),", ",(0,l.kt)("inlineCode",{parentName:"p"},"--auth-logging"),", and ",(0,l.kt)("inlineCode",{parentName:"p"},"--request-logging"),"."),(0,l.kt)("p",null,"Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log."),(0,l.kt)("p",null,"Logging of requests to the ",(0,l.kt)("inlineCode",{parentName:"p"},"/ping")," endpoint (or using ",(0,l.kt)("inlineCode",{parentName:"p"},"--ping-user-agent"),") can be disabled with ",(0,l.kt)("inlineCode",{parentName:"p"},"--silence-ping-logging")," reducing log volume. This flag appends the ",(0,l.kt)("inlineCode",{parentName:"p"},"--ping-path")," to ",(0,l.kt)("inlineCode",{parentName:"p"},"--exclude-logging-paths"),"."),(0,l.kt)("h3",{id:"auth-log-format"},"Auth Log Format"),(0,l.kt)("p",null,"Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"}," - [19/Mar/2015:17:20:19 -0400] [] \n")),(0,l.kt)("p",null,"The status block will contain one of the below strings:"),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthSuccess")," If a user has authenticated successfully by any method"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthFailure")," If the user failed to authenticate explicitly"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthError")," If there was an unexpected error during authentication")),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--auth-logging-format")," flag.\nThe default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"{{.Client}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}\n")),(0,l.kt)("p",null,"Available variables for auth logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Client"),(0,l.kt)("td",{parentName:"tr",align:null},"74.125.224.72"),(0,l.kt)("td",{parentName:"tr",align:null},"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Host"),(0,l.kt)("td",{parentName:"tr",align:null},"domain.com"),(0,l.kt)("td",{parentName:"tr",align:null},"The value of the Host header.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Protocol"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP/1.0"),(0,l.kt)("td",{parentName:"tr",align:null},"The request protocol.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestMethod"),(0,l.kt)("td",{parentName:"tr",align:null},"GET"),(0,l.kt)("td",{parentName:"tr",align:null},"The request method.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"UserAgent"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The full user agent as reported by the requesting client.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Username"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"mailto:username@email.com"},"username@email.com")),(0,l.kt)("td",{parentName:"tr",align:null},"The email or username of the auth request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Status"),(0,l.kt)("td",{parentName:"tr",align:null},"AuthSuccess"),(0,l.kt)("td",{parentName:"tr",align:null},"The status of the auth request. See above for details.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Message"),(0,l.kt)("td",{parentName:"tr",align:null},"Authenticated via OAuth2"),(0,l.kt)("td",{parentName:"tr",align:null},"The details of the auth attempt.")))),(0,l.kt)("h3",{id:"request-log-format"},"Request Log Format"),(0,l.kt)("p",null,"HTTP request logs will output by default in the below format:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},' - [19/Mar/2015:17:20:19 -0400] GET "/path/" HTTP/1.1 "" \n')),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--request-logging-format")," flag.\nThe default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}\n")),(0,l.kt)("p",null,"Available variables for request logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Client"),(0,l.kt)("td",{parentName:"tr",align:null},"74.125.224.72"),(0,l.kt)("td",{parentName:"tr",align:null},"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Host"),(0,l.kt)("td",{parentName:"tr",align:null},"domain.com"),(0,l.kt)("td",{parentName:"tr",align:null},"The value of the Host header.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Protocol"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP/1.0"),(0,l.kt)("td",{parentName:"tr",align:null},"The request protocol.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestDuration"),(0,l.kt)("td",{parentName:"tr",align:null},"0.001"),(0,l.kt)("td",{parentName:"tr",align:null},"The time in seconds that a request took to process.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestMethod"),(0,l.kt)("td",{parentName:"tr",align:null},"GET"),(0,l.kt)("td",{parentName:"tr",align:null},"The request method.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestURI"),(0,l.kt)("td",{parentName:"tr",align:null},'"/oauth2/auth"'),(0,l.kt)("td",{parentName:"tr",align:null},"The URI path of the request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"ResponseSize"),(0,l.kt)("td",{parentName:"tr",align:null},"12"),(0,l.kt)("td",{parentName:"tr",align:null},"The size in bytes of the response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"StatusCode"),(0,l.kt)("td",{parentName:"tr",align:null},"200"),(0,l.kt)("td",{parentName:"tr",align:null},"The HTTP status code of the response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The upstream data of the HTTP request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"UserAgent"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The full user agent as reported by the requesting client.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Username"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"mailto:username@email.com"},"username@email.com")),(0,l.kt)("td",{parentName:"tr",align:null},"The email or username of the auth request.")))),(0,l.kt)("h3",{id:"standard-log-format"},"Standard Log Format"),(0,l.kt)("p",null,"All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"[19/Mar/2015:17:20:19 -0400] [main.go:40] \n")),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--standard-logging-format")," flag. The default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"[{{.Timestamp}}] [{{.File}}] {{.Message}}\n")),(0,l.kt)("p",null,"Available variables for standard logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"File"),(0,l.kt)("td",{parentName:"tr",align:null},"main.go:40"),(0,l.kt)("td",{parentName:"tr",align:null},"The file and line number of the logging statement.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Message"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP: listening on 127.0.0.1:4180"),(0,l.kt)("td",{parentName:"tr",align:null},"The details of the log statement.")))),(0,l.kt)("h2",{id:"configuring-for-use-with-the-nginx-auth_request-directive"},"Configuring for use with the Nginx ",(0,l.kt)("inlineCode",{parentName:"h2"},"auth_request")," directive"),(0,l.kt)("p",null,"The ",(0,l.kt)("a",{parentName:"p",href:"http://nginx.org/en/docs/http/ngx_http_auth_request_module.html"},"Nginx ",(0,l.kt)("inlineCode",{parentName:"a"},"auth_request")," directive")," allows Nginx to authenticate requests via the oauth2-proxy's ",(0,l.kt)("inlineCode",{parentName:"p"},"/auth")," endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-nginx"},'server {\n listen 443 ssl;\n server_name ...;\n include ssl/ssl.conf;\n\n location /oauth2/ {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n proxy_set_header X-Auth-Request-Redirect $request_uri;\n # or, if you are handling multiple domains:\n # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;\n }\n location = /oauth2/auth {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n # nginx auth_request includes headers but not body\n proxy_set_header Content-Length "";\n proxy_pass_request_body off;\n }\n\n location / {\n auth_request /oauth2/auth;\n error_page 401 = /oauth2/sign_in;\n\n # pass information via X-User and X-Email headers to backend,\n # requires running with --set-xauthrequest flag\n auth_request_set $user $upstream_http_x_auth_request_user;\n auth_request_set $email $upstream_http_x_auth_request_email;\n proxy_set_header X-User $user;\n proxy_set_header X-Email $email;\n\n # if you enabled --pass-access-token, this will pass the token to the backend\n auth_request_set $token $upstream_http_x_auth_request_access_token;\n proxy_set_header X-Access-Token $token;\n\n # if you enabled --cookie-refresh, this is needed for it to work with auth_request\n auth_request_set $auth_cookie $upstream_http_set_cookie;\n add_header Set-Cookie $auth_cookie;\n\n # When using the --set-authorization-header flag, some provider\'s cookies can exceed the 4kb\n # limit and so the OAuth2 Proxy splits these into multiple parts.\n # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\n # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\n auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;\n\n # Extract the Cookie attributes from the first Set-Cookie header and append them\n # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\n if ($auth_cookie ~* "(; .*)") {\n set $auth_cookie_name_0 $auth_cookie;\n set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";\n }\n\n # Send both Set-Cookie headers now if there was a second part\n if ($auth_cookie_name_upstream_1) {\n add_header Set-Cookie $auth_cookie_name_0;\n add_header Set-Cookie $auth_cookie_name_1;\n }\n\n proxy_pass http://backend/;\n # or "root /path/to/site;" or "fastcgi_pass ..." etc\n }\n}\n')),(0,l.kt)("p",null,"When you use ingress-nginx in Kubernetes, you MUST use ",(0,l.kt)("inlineCode",{parentName:"p"},"kubernetes/ingress-nginx")," (which includes the Lua module) and the following configuration snippet for your ",(0,l.kt)("inlineCode",{parentName:"p"},"Ingress"),".\nVariables set with ",(0,l.kt)("inlineCode",{parentName:"p"},"auth_request_set")," are not ",(0,l.kt)("inlineCode",{parentName:"p"},"set"),"-able in plain nginx config when the location is processed via ",(0,l.kt)("inlineCode",{parentName:"p"},"proxy_pass")," and then may only be processed by Lua.\nNote that ",(0,l.kt)("inlineCode",{parentName:"p"},"nginxinc/kubernetes-ingress")," does not include the Lua module."),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'nginx.ingress.kubernetes.io/auth-response-headers: Authorization\nnginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri\nnginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth\nnginx.ingress.kubernetes.io/configuration-snippet: |\n auth_request_set $name_upstream_1 $upstream_cookie_name_1;\n\n access_by_lua_block {\n if ngx.var.name_upstream_1 ~= "" then\n ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")\n end\n }\n')),(0,l.kt)("p",null,"It is recommended to use ",(0,l.kt)("inlineCode",{parentName:"p"},"--session-store-type=redis")," when expecting large sessions/OIDC tokens (",(0,l.kt)("em",{parentName:"p"},"e.g.")," with MS Azure)."),(0,l.kt)("p",null,"You have to substitute ",(0,l.kt)("em",{parentName:"p"},"name"),' with the actual cookie name you configured via --cookie-name parameter. If you don\'t set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".'),(0,l.kt)("div",{className:"admonition admonition-note alert alert--secondary"},(0,l.kt)("div",{parentName:"div",className:"admonition-heading"},(0,l.kt)("h5",{parentName:"div"},(0,l.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,l.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,l.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"}))),"note")),(0,l.kt)("div",{parentName:"div",className:"admonition-content"},(0,l.kt)("p",{parentName:"div"},"If you set up your OAuth2 provider to rotate your client secret, you can use the ",(0,l.kt)("inlineCode",{parentName:"p"},"client-secret-file")," option to reload the secret when it is updated."))))}g.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/js/b89e1cb0.d176f819.js b/assets/js/b89e1cb0.d176f819.js new file mode 100644 index 00000000..5b2f2048 --- /dev/null +++ b/assets/js/b89e1cb0.d176f819.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[8873],{3905:function(e,t,r){r.d(t,{Zo:function(){return p},kt:function(){return d}});var n=r(7294);function a(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function o(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function i(e){for(var t=1;t=0||(a[r]=e[r]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(a[r]=e[r])}return a}var u=n.createContext({}),c=function(e){var t=n.useContext(u),r=t;return e&&(r="function"==typeof e?e(t):i(i({},t),e)),r},p=function(e){var t=c(e.components);return n.createElement(u.Provider,{value:t},e.children)},l={inlineCode:"code",wrapper:function(e){var t=e.children;return n.createElement(n.Fragment,{},t)}},f=n.forwardRef((function(e,t){var r=e.components,a=e.mdxType,o=e.originalType,u=e.parentName,p=s(e,["components","mdxType","originalType","parentName"]),f=c(r),d=a,m=f["".concat(u,".").concat(d)]||f[d]||l[d]||o;return r?n.createElement(m,i(i({ref:t},p),{},{components:r})):n.createElement(m,i({ref:t},p))}));function d(e,t){var r=arguments,a=t&&t.mdxType;if("string"==typeof e||a){var o=r.length,i=new Array(o);i[0]=f;var s={};for(var u in t)hasOwnProperty.call(t,u)&&(s[u]=t[u]);s.originalType=e,s.mdxType="string"==typeof e?e:a,i[1]=s;for(var c=2;c=0||(n[o]=e[o]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(a=0;a=0||Object.prototype.propertyIsEnumerable.call(e,o)&&(n[o]=e[o])}return n}var p=a.createContext({}),s=function(e){var t=a.useContext(p),o=t;return e&&(o="function"==typeof e?e(t):i(i({},t),e)),o},u=function(e){var t=s(e.components);return a.createElement(p.Provider,{value:t},e.children)},c={inlineCode:"code",wrapper:function(e){var t=e.children;return a.createElement(a.Fragment,{},t)}},d=a.forwardRef((function(e,t){var o=e.components,n=e.mdxType,r=e.originalType,p=e.parentName,u=l(e,["components","mdxType","originalType","parentName"]),d=s(o),h=n,m=d["".concat(p,".").concat(h)]||d[h]||c[h]||r;return o?a.createElement(m,i(i({ref:t},u),{},{components:o})):a.createElement(m,i({ref:t},u))}));function h(e,t){var o=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var r=o.length,i=new Array(r);i[0]=d;var l={};for(var p in t)hasOwnProperty.call(t,p)&&(l[p]=t[p]);l.originalType=e,l.mdxType="string"==typeof e?e:n,i[1]=l;for(var s=2;s\n --client-secret=\n --oidc-issuer-url=https://sts.windows.net/{tenant-id}/\n")),(0,r.kt)("p",null,"Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/7.1.x/configuration/session_storage#redis-storage"},"redis session storage")," should resolve this."),(0,r.kt)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new FB App from ",(0,r.kt)("a",{parentName:"li",href:"https://developers.facebook.com/"},"https://developers.facebook.com/")),(0,r.kt)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),(0,r.kt)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://github.com/settings/developers"},"https://github.com/settings/developers")),(0,r.kt)("li",{parentName:"ol"},"Under ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),(0,r.kt)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=*")),(0,r.kt)("p",null,"NOTE: When ",(0,r.kt)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),(0,r.kt)("p",null,"To restrict by organization only, include the following flag:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-org="": restrict logins to members of this organisation\n')),(0,r.kt)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",(0,r.kt)("inlineCode",{parentName:"p"},"-github-org"),":"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),(0,r.kt)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),(0,r.kt)("p",null,"If you'd like to allow access to users with ",(0,r.kt)("strong",{parentName:"p"},"read only")," access to a ",(0,r.kt)("strong",{parentName:"p"},"public")," repository you will need to provide a ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/settings/tokens"},"token")," for a user that has write access to the repository. The token must be created with at least the ",(0,r.kt)("inlineCode",{parentName:"p"},"public_repo")," scope:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-token="": the token to use when verifying repository collaborators\n')),(0,r.kt)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-github-user="": allow logins by username, separated by a comma\n')),(0,r.kt)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'-login-url="http(s):///login/oauth/authorize"\n-redeem-url="http(s):///login/oauth/access_token"\n-validate-url="http(s):///api/v3"\n')),(0,r.kt)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create new client in your Keycloak with ",(0,r.kt)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",(0,r.kt)("strong",{parentName:"li"},"Valid Redirect URIs")," '",(0,r.kt)("a",{parentName:"li",href:"https://internal.yourcompany.com/oauth2/callback'"},"https://internal.yourcompany.com/oauth2/callback'")),(0,r.kt)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),(0,r.kt)("li",{parentName:"ol"},"Create a mapper with ",(0,r.kt)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",(0,r.kt)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),(0,r.kt)("p",null,"Make sure you set the following to the appropriate url:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--provider=keycloak\n--client-id=\n--client-secret=\n--login-url="http(s):///auth/realms//protocol/openid-connect/auth"\n--redeem-url="http(s):///auth/realms//protocol/openid-connect/token"\n--profile-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n--validate-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n--keycloak-group=\n--keycloak-group=\n')),(0,r.kt)("p",null,"For group based authorization, the optional ",(0,r.kt)("inlineCode",{parentName:"p"},"--keycloak-group")," (legacy) or ",(0,r.kt)("inlineCode",{parentName:"p"},"--allowed-group")," (global standard)\nflags can be used to specify which groups to limit access to."),(0,r.kt)("p",null,"If these are unset but a ",(0,r.kt)("inlineCode",{parentName:"p"},"groups")," mapper is set up above in step (3), the provider will still\npopulate the ",(0,r.kt)("inlineCode",{parentName:"p"},"X-Forwarded-Groups")," header to your upstream server with the ",(0,r.kt)("inlineCode",{parentName:"p"},"groups")," data in the\nKeycloak userinfo endpoint response."),(0,r.kt)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak\nyou should define the 'keycloak-group' value to /admin."),(0,r.kt)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),(0,r.kt)("p",null,"This auth provider has been tested against Gitlab version 12.X. Due to Gitlab API changes, it may not work for version prior to 12.X (see ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/issues/994"},"994"),")."),(0,r.kt)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",(0,r.kt)("a",{parentName:"p",href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"},"these steps to add an application"),". Make sure to enable at least the ",(0,r.kt)("inlineCode",{parentName:"p"},"openid"),", ",(0,r.kt)("inlineCode",{parentName:"p"},"profile")," and ",(0,r.kt)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",(0,r.kt)("a",{parentName:"p",href:"https://myapp.com/oauth2/callback"},"https://myapp.com/oauth2/callback"),"."),(0,r.kt)("p",null,"If you need projects filtering, add the extra ",(0,r.kt)("inlineCode",{parentName:"p"},"read_api")," scope to your application."),(0,r.kt)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",(0,r.kt)("a",{parentName:"p",href:"/oauth2-proxy/docs/7.1.x/configuration/overview#generating-a-cookie-secret"},"these steps")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider="gitlab"\n --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n --client-id=GITLAB_CLIENT_ID\n --client-secret=GITLAB_CLIENT_SECRET\n --cookie-secret=COOKIE_SECRET\n')),(0,r.kt)("p",null,"Restricting by group membership is possible with the following option:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),(0,r.kt)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'--oidc-issuer-url=""\n')),(0,r.kt)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),(0,r.kt)("p",null,"For LinkedIn, the registration steps are:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new project: ",(0,r.kt)("a",{parentName:"li",href:"https://www.linkedin.com/secure/developer"},"https://www.linkedin.com/secure/developer")),(0,r.kt)("li",{parentName:"ol"},"In the OAuth User Agreement section:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),(0,r.kt)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',(0,r.kt)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),(0,r.kt)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),(0,r.kt)("li",{parentName:"ol"},"Take note of the ",(0,r.kt)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",(0,r.kt)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),(0,r.kt)("h3",{id:"microsoft-azure-ad-provider"},"Microsoft Azure AD Provider"),(0,r.kt)("p",null,"For adding an application to the Microsoft Azure AD follow ",(0,r.kt)("a",{parentName:"p",href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"},"these steps to add an application"),"."),(0,r.kt)("p",null,"Take note of your ",(0,r.kt)("inlineCode",{parentName:"p"},"TenantId")," if applicable for your situation. The ",(0,r.kt)("inlineCode",{parentName:"p"},"TenantId")," can be used to override the default ",(0,r.kt)("inlineCode",{parentName:"p"},"common")," authorization server with a tenant specific server."),(0,r.kt)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),(0,r.kt)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."),(0,r.kt)("p",null,"This provider was originally built against CoreOS Dex and we will use it as an example.\nThe OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below."),(0,r.kt)("h4",{id:"dex"},"Dex"),(0,r.kt)("p",null,"To configure the OIDC provider for Dex, perform the following steps:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Download Dex:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"go get github.com/dexidp/dex\n")),(0,r.kt)("p",{parentName:"li"},"See the ",(0,r.kt)("a",{parentName:"p",href:"https://dexidp.io/docs/getting-started/"},"getting started guide")," for more details.")),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to the ",(0,r.kt)("inlineCode",{parentName:"p"},"staticClients")," section of ",(0,r.kt)("inlineCode",{parentName:"p"},"examples/config-dev.yaml"),":"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"- id: oauth2-proxy\nredirectURIs:\n- 'http://127.0.0.1:4180/oauth2/callback'\nname: 'oauth2-proxy'\nsecret: proxy\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Launch Dex: from ",(0,r.kt)("inlineCode",{parentName:"p"},"$GOPATH/github.com/dexidp/dex"),", run:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"bin/dex serve examples/config-dev.yaml\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"In a second terminal, run the oauth2-proxy with the following args:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'-provider oidc\n-provider-display-name "My OIDC Provider"\n-client-id oauth2-proxy\n-client-secret proxy\n-redirect-url http://127.0.0.1:4180/oauth2/callback\n-oidc-issuer-url http://127.0.0.1:5556/dex\n-cookie-secure=false\n-cookie-secret=secret\n-email-domain kilgore.trout\n')),(0,r.kt)("p",{parentName:"li"},"To serve the current working directory as a web site under the ",(0,r.kt)("inlineCode",{parentName:"p"},"/static")," endpoint, add:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},"-upstream file://$PWD/#/static/\n"))),(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Test the setup by visiting ",(0,r.kt)("a",{parentName:"p",href:"http://127.0.0.1:4180"},"http://127.0.0.1:4180")," or ",(0,r.kt)("a",{parentName:"p",href:"http://127.0.0.1:4180/static"},"http://127.0.0.1:4180/static")," ."))),(0,r.kt)("p",null,"See also ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/local-environment"},"our local testing environment")," for a self-contained example using Docker and etcd as storage for Dex."),(0,r.kt)("h4",{id:"okta"},"Okta"),(0,r.kt)("p",null,"To configure the OIDC provider for Okta, perform the following steps:"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",(0,r.kt)("inlineCode",{parentName:"li"},"example.oktapreview.com")),(0,r.kt)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",(0,r.kt)("inlineCode",{parentName:"li"},"default")," will work.")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Security")," then select ",(0,r.kt)("strong",{parentName:"li"},"API")),(0,r.kt)("li",{parentName:"ul"},"Click ",(0,r.kt)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),(0,r.kt)("li",{parentName:"ul"},"Fill out the ",(0,r.kt)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),(0,r.kt)("li",{parentName:"ul"},"For ",(0,r.kt)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",(0,r.kt)("a",{parentName:"li",href:"https://example.corp.com"},"https://example.corp.com")),(0,r.kt)("li",{parentName:"ul"},"Fill out a ",(0,r.kt)("strong",{parentName:"li"},"Description")),(0,r.kt)("li",{parentName:"ul"},"Add any ",(0,r.kt)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),(0,r.kt)("li",{parentName:"ul"},"The default settings will work for other options.\n",(0,r.kt)("a",{parentName:"li",href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"},"See Okta documentation for more information on Authorization Servers"))),(0,r.kt)("ol",{start:3},(0,r.kt)("li",{parentName:"ol"},"Navigate to ",(0,r.kt)("strong",{parentName:"li"},"Applications")," then select ",(0,r.kt)("strong",{parentName:"li"},"Add Application"),".")),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Select ",(0,r.kt)("strong",{parentName:"li"},"Web")," for the ",(0,r.kt)("strong",{parentName:"li"},"Platform")," setting."),(0,r.kt)("li",{parentName:"ul"},"Select ",(0,r.kt)("strong",{parentName:"li"},"OpenID Connect")," and click ",(0,r.kt)("strong",{parentName:"li"},"Create")),(0,r.kt)("li",{parentName:"ul"},"Pick an ",(0,r.kt)("strong",{parentName:"li"},"Application Name")," such as ",(0,r.kt)("inlineCode",{parentName:"li"},"Example App"),"."),(0,r.kt)("li",{parentName:"ul"},"Set the ",(0,r.kt)("strong",{parentName:"li"},"Login redirect URI")," to ",(0,r.kt)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),(0,r.kt)("li",{parentName:"ul"},"Under ",(0,r.kt)("strong",{parentName:"li"},"General")," set the ",(0,r.kt)("strong",{parentName:"li"},"Allowed grant types")," to ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization Code")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Refresh Token"),"."),(0,r.kt)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",(0,r.kt)("inlineCode",{parentName:"li"},"Client ID")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Client Secret"),"."),(0,r.kt)("li",{parentName:"ul"},"Under ",(0,r.kt)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),(0,r.kt)("ol",{start:4},(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("p",{parentName:"li"},"Create a configuration file like the following:"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n "https://example.corp.com"\n]\nemail_domains = [\n "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')))),(0,r.kt)("p",null,"The ",(0,r.kt)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",(0,r.kt)("strong",{parentName:"p"},"Authorization Server"),"'s ",(0,r.kt)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",(0,r.kt)("a",{parentName:"p",href:"https://corp.okta.com"},"https://corp.okta.com")," .\nThe ",(0,r.kt)("inlineCode",{parentName:"p"},"client_id")," and ",(0,r.kt)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",(0,r.kt)("inlineCode",{parentName:"p"},"client_secret")," to encrypt the cookie."),(0,r.kt)("p",null,"Then you can start the oauth2-proxy with ",(0,r.kt)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),(0,r.kt)("h4",{id:"okta---localhost"},"Okta - localhost"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Signup for developer account: ",(0,r.kt)("a",{parentName:"li",href:"https://developer.okta.com/signup/"},"https://developer.okta.com/signup/")),(0,r.kt)("li",{parentName:"ol"},"Create New ",(0,r.kt)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),(0,r.kt)("li",{parentName:"ol"},"Example Application Settings for localhost:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Name:")," My Web App"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Group assignments:")," ",(0,r.kt)("inlineCode",{parentName:"li"},"Everyone")),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("strong",{parentName:"li"},"Grant type allowed:")," ",(0,r.kt)("inlineCode",{parentName:"li"},"Authorization Code")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Refresh Token")))),(0,r.kt)("li",{parentName:"ol"},"Make note of the ",(0,r.kt)("inlineCode",{parentName:"li"},"Client ID")," and ",(0,r.kt)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),(0,r.kt)("li",{parentName:"ol"},"Make note of the ",(0,r.kt)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),(0,r.kt)("li",{parentName:"ol"},"Example config file ",(0,r.kt)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),(0,r.kt)("pre",{parentName:"li"},(0,r.kt)("code",{parentName:"pre"},'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n "http://0.0.0.0:8080"\n]\nemail_domains = [\n "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),(0,r.kt)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",(0,r.kt)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),(0,r.kt)("h3",{id:"logingov-provider"},"login.gov Provider"),(0,r.kt)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",(0,r.kt)("a",{parentName:"p",href:"https://login.gov/developers/"},"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),(0,r.kt)("p",null,"A developer guide is available here: ",(0,r.kt)("a",{parentName:"p",href:"https://developers.login.gov/"},"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),(0,r.kt)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),(0,r.kt)("p",null,"First, register your application in the dashboard. The important bits are:"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},"Identity protocol: make this ",(0,r.kt)("inlineCode",{parentName:"li"},"Openid connect")),(0,r.kt)("li",{parentName:"ul"},"Issuer: do what they say for OpenID Connect. We will refer to this string as ",(0,r.kt)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),(0,r.kt)("li",{parentName:"ul"},"Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",(0,r.kt)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",(0,r.kt)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",(0,r.kt)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),(0,r.kt)("li",{parentName:"ul"},"Return to App URL: Make this be ",(0,r.kt)("inlineCode",{parentName:"li"},"http://localhost:4180/")),(0,r.kt)("li",{parentName:"ul"},"Redirect URIs: Make this be ",(0,r.kt)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),(0,r.kt)("li",{parentName:"ul"},"Attribute Bundle: Make sure that email is selected.")),(0,r.kt)("p",null,"Now start the proxy up with the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},'./oauth2-proxy -provider login.gov \\\n -client-id=${LOGINGOV_ISSUER} \\\n -redirect-url=http://localhost:4180/oauth2/callback \\\n -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n -cookie-secure=false \\\n -email-domain=gsa.gov \\\n -upstream=http://localhost:3000/ \\\n -cookie-secret=somerandomstring12341234567890AB \\\n -cookie-domain=localhost \\\n -skip-provider-button=true \\\n -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),(0,r.kt)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",(0,r.kt)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",(0,r.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",(0,r.kt)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),(0,r.kt)("p",null,"Once it is running, you should be able to go to ",(0,r.kt)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",(0,r.kt)("inlineCode",{parentName:"p"},"http://localhost:3000/"),". In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),(0,r.kt)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),(0,r.kt)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),(0,r.kt)("p",null,"In this case, you can set the ",(0,r.kt)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," -provider oidc\n -client-id oauth2-proxy\n -client-secret proxy\n -redirect-url http://127.0.0.1:4180/oauth2/callback\n -oidc-issuer-url http://127.0.0.1:5556\n -skip-oidc-discovery\n -login-url http://127.0.0.1:5556/authorize\n -redeem-url http://127.0.0.1:5556/token\n -oidc-jwks-url http://127.0.0.1:5556/keys\n -cookie-secure=false\n -email-domain example.com\n")),(0,r.kt)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),(0,r.kt)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),(0,r.kt)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",(0,r.kt)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",(0,r.kt)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),(0,r.kt)("p",null,"Refer to the ",(0,r.kt)("a",{parentName:"p",href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"},"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',(0,r.kt)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' -provider nextcloud\n -client-id \n -client-secret \n -login-url="/index.php/apps/oauth2/authorize"\n -redeem-url="/index.php/apps/oauth2/api/v1/token"\n -validate-url="/ocs/v2.php/cloud/user?format=json"\n')),(0,r.kt)("p",null,"Note: in ",(0,r.kt)("em",{parentName:"p"},"all")," cases the validate-url will ",(0,r.kt)("em",{parentName:"p"},"not")," have the ",(0,r.kt)("inlineCode",{parentName:"p"},"index.php"),"."),(0,r.kt)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("a",{parentName:"li",href:"https://cloud.digitalocean.com/account/api/applications"},"Create a new OAuth application"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),(0,r.kt)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',(0,r.kt)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",(0,r.kt)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),(0,r.kt)("p",null,"To use the provider, pass the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=digitalocean\n --client-id=\n --client-secret=\n")),(0,r.kt)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",(0,r.kt)("inlineCode",{parentName:"p"},"https:///oauth2/callback"),". If you need to change it, you can use the ",(0,r.kt)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),(0,r.kt)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},(0,r.kt)("a",{parentName:"li",href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"},"Add a new OAuth consumer"),(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},'In "Callback URL" use ',(0,r.kt)("inlineCode",{parentName:"li"},"https:///oauth2/callback"),", substituting ",(0,r.kt)("inlineCode",{parentName:"li"},"")," with the actual hostname that oauth2-proxy is running on."),(0,r.kt)("li",{parentName:"ul"},"In Permissions section select:",(0,r.kt)("ul",{parentName:"li"},(0,r.kt)("li",{parentName:"ul"},"Account -> Email"),(0,r.kt)("li",{parentName:"ul"},"Team membership -> Read"),(0,r.kt)("li",{parentName:"ul"},"Repositories -> Read"))))),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),(0,r.kt)("p",null,"To use the provider, pass the following options:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"}," --provider=bitbucket\n --client-id=\n --client-secret=\n")),(0,r.kt)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",(0,r.kt)("inlineCode",{parentName:"p"},"--bitbucket-team="),". To restrict the access to only these users who has access to one selected repository use ",(0,r.kt)("inlineCode",{parentName:"p"},"--bitbucket-repository="),"."),(0,r.kt)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),(0,r.kt)("ol",null,(0,r.kt)("li",{parentName:"ol"},"Create a new application: ",(0,r.kt)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),(0,r.kt)("li",{parentName:"ol"},"Under ",(0,r.kt)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",(0,r.kt)("inlineCode",{parentName:"li"},"https:///oauth2/callback")),(0,r.kt)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),(0,r.kt)("li",{parentName:"ol"},"Pass the following options to the proxy:")),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},' --provider="github"\n --redirect-url="https:///oauth2/callback"\n --provider-display-name="Gitea"\n --client-id="< client_id as generated by Gitea >"\n --client-secret="< client_secret as generated by Gitea >"\n --login-url="https://< your gitea host >/login/oauth/authorize"\n --redeem-url="https://< your gitea host >/login/oauth/access_token"\n --validate-url="https://< your gitea host >/api/v1"\n')),(0,r.kt)("h2",{id:"email-authentication"},"Email Authentication"),(0,r.kt)("p",null,"To authorize by email domain use ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",(0,r.kt)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",(0,r.kt)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),(0,r.kt)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),(0,r.kt)("p",null,"Follow the examples in the ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"},(0,r.kt)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",(0,r.kt)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",(0,r.kt)("inlineCode",{parentName:"p"},"case")," to\n",(0,r.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"},(0,r.kt)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",(0,r.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",(0,r.kt)("inlineCode",{parentName:"p"},"Provider"),"."))}d.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/js/cd4a49c1.9bfe0b83.js b/assets/js/cd4a49c1.9bfe0b83.js new file mode 100644 index 00000000..f5f7d39e --- /dev/null +++ b/assets/js/cd4a49c1.9bfe0b83.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[2439],{3905:function(e,t,a){a.d(t,{Zo:function(){return m},kt:function(){return k}});var n=a(7294);function r(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function l(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function i(e){for(var t=1;t=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var l=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var p=n.createContext({}),d=function(e){var t=n.useContext(p),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},m=function(e){var t=d(e.components);return n.createElement(p.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return n.createElement(n.Fragment,{},t)}},u=n.forwardRef((function(e,t){var a=e.components,r=e.mdxType,l=e.originalType,p=e.parentName,m=o(e,["components","mdxType","originalType","parentName"]),u=d(a),k=r,N=u["".concat(p,".").concat(k)]||u[k]||s[k]||l;return a?n.createElement(N,i(i({ref:t},m),{},{components:a})):n.createElement(N,i({ref:t},m))}));function k(e,t){var a=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var l=a.length,i=new Array(l);i[0]=u;var o={};for(var p in t)hasOwnProperty.call(t,p)&&(o[p]=t[p]);o.originalType=e,o.mdxType="string"==typeof e?e:r,i[1]=o;for(var d=2;dstring alias)",id:"string-alias",children:[],level:4}],level:3},{value:"GitHubOptions",id:"githuboptions",children:[],level:3},{value:"GitLabOptions",id:"gitlaboptions",children:[],level:3},{value:"GoogleOptions",id:"googleoptions",children:[],level:3},{value:"Header",id:"header",children:[],level:3},{value:"HeaderValue",id:"headervalue",children:[],level:3},{value:"KeycloakOptions",id:"keycloakoptions",children:[],level:3},{value:"LoginGovOptions",id:"logingovoptions",children:[],level:3},{value:"LoginURLParameter",id:"loginurlparameter",children:[],level:3},{value:"OIDCOptions",id:"oidcoptions",children:[],level:3},{value:"Provider",id:"provider",children:[],level:3},{value:"ProviderType",id:"providertype",children:[{value:"(string alias)",id:"string-alias-1",children:[],level:4}],level:3},{value:"Providers",id:"providers",children:[{value:"([]Provider alias)",id:"provider-alias",children:[],level:4}],level:3},{value:"SecretSource",id:"secretsource",children:[],level:3},{value:"Server",id:"server",children:[],level:3},{value:"TLS",id:"tls",children:[],level:3},{value:"URLParameterRule",id:"urlparameterrule",children:[],level:3},{value:"Upstream",id:"upstream",children:[],level:3},{value:"UpstreamConfig",id:"upstreamconfig",children:[],level:3}],level:2}],s={toc:m};function u(e){var t=e.components,a=(0,r.Z)(e,i);return(0,l.kt)("wrapper",(0,n.Z)({},s,a,{components:t,mdxType:"MDXLayout"}),(0,l.kt)("div",{className:"admonition admonition-warning alert alert--danger"},(0,l.kt)("div",{parentName:"div",className:"admonition-heading"},(0,l.kt)("h5",{parentName:"div"},(0,l.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,l.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"12",height:"16",viewBox:"0 0 12 16"},(0,l.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M5.05.31c.81 2.17.41 3.38-.52 4.31C3.55 5.67 1.98 6.45.9 7.98c-1.45 2.05-1.7 6.53 3.53 7.7-2.2-1.16-2.67-4.52-.3-6.61-.61 2.03.53 3.33 1.94 2.86 1.39-.47 2.3.53 2.27 1.67-.02.78-.31 1.44-1.13 1.81 3.42-.59 4.78-3.42 4.78-5.56 0-2.84-2.53-3.22-1.25-5.61-1.52.13-2.03 1.13-1.89 2.75.09 1.08-1.02 1.8-1.86 1.33-.67-.41-.66-1.19-.06-1.78C8.18 5.31 8.68 2.45 5.05.32L5.03.3l.02.01z"}))),"warning")),(0,l.kt)("div",{parentName:"div",className:"admonition-content"},(0,l.kt)("p",{parentName:"div"},"This page contains documentation for alpha features.\nWe reserve the right to make breaking changes to the features detailed within this page with no notice."),(0,l.kt)("p",{parentName:"div"},"Options described in this page may be changed, removed, renamed or moved without prior warning.\nPlease beware of this before you use alpha configuration options."))),(0,l.kt)("p",null,"This page details a set of ",(0,l.kt)("strong",{parentName:"p"},"alpha")," configuration options in a new format.\nGoing forward we are intending to add structured configuration in YAML format to\nreplace the existing TOML based configuration file and flags."),(0,l.kt)("p",null,"Below is a reference for the structure of the configuration, with\n",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions")," as the root of the configuration."),(0,l.kt)("p",null,"When using alpha configuration, your config file will look something like below:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},"upstreams:\n - id: ...\n ...\ninjectRequestHeaders:\n - name: ...\n ...\ninjectResponseHeaders:\n - name: ...\n ...\n")),(0,l.kt)("p",null,"Please browse the ",(0,l.kt)("a",{parentName:"p",href:"#configuration-reference"},"reference")," below for the structure\nof the new configuration format."),(0,l.kt)("h2",{id:"using-alpha-configuration"},"Using Alpha Configuration"),(0,l.kt)("p",null,"To use the new ",(0,l.kt)("strong",{parentName:"p"},"alpha")," configuration, generate a YAML file based on the format\ndescribed in the ",(0,l.kt)("a",{parentName:"p",href:"#configuration-reference"},"reference")," below."),(0,l.kt)("p",null,"Provide the path to this file using the ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config")," flag."),(0,l.kt)("div",{className:"admonition admonition-note alert alert--secondary"},(0,l.kt)("div",{parentName:"div",className:"admonition-heading"},(0,l.kt)("h5",{parentName:"div"},(0,l.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,l.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,l.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"}))),"note")),(0,l.kt)("div",{parentName:"div",className:"admonition-content"},(0,l.kt)("p",{parentName:"div"},"When using the ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config")," flag, some options are no longer available.\nSee ",(0,l.kt)("a",{parentName:"p",href:"#removed-options"},"removed options")," below for more information."))),(0,l.kt)("h3",{id:"converting-configuration-to-the-new-structure"},"Converting configuration to the new structure"),(0,l.kt)("p",null,"Before adding the new ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config")," option, start OAuth2 Proxy using the\n",(0,l.kt)("inlineCode",{parentName:"p"},"convert-config-to-alpha")," flag to convert existing configuration to the new format."),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-bash"},"oauth2-proxy --convert-config-to-alpha --config ./path/to/existing/config.cfg\n")),(0,l.kt)("p",null,"This will convert any options supported by the new format to YAML and print the\nnew configuration to ",(0,l.kt)("inlineCode",{parentName:"p"},"STDOUT"),"."),(0,l.kt)("p",null,"Copy this to a new file, remove any options from your existing configuration\nnoted in ",(0,l.kt)("a",{parentName:"p",href:"#removed-options"},"removed options")," and then start OAuth2 Proxy using\nthe new config."),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-bash"},"oauth2-proxy --alpha-config ./path/to/new/config.yaml --config ./path/to/existing/config.cfg\n")),(0,l.kt)("h2",{id:"removed-options"},"Removed options"),(0,l.kt)("p",null,"The following flags/options and their respective environment variables are no\nlonger available when using alpha configuration:"),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"flush-interval"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"flush_interval")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-host-header"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_host_header")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"proxy-websockets"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"proxy_websockets")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"ssl-upstream-insecure-skip-verify"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"ssl_upstream_insecure_skip_verify")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"upstream"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"upstreams"))),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-basic-auth"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_basic_auth")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-access-token"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_access_token")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-user-headers"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_user_headers")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pass-authorization-header"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pass_authorization_header")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"set-basic-auth"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"set_basic_auth")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"set-xauthrequest"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"set_xauthrequest")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"set-authorization-header"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"set_authorization_header")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"prefer-email-to-user"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"prefer_email_to_user")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"basic-auth-password"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"basic_auth_password")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"skip-auth-strip-headers"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"skip_auth_strip_headers"))),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"client-id"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"client_id")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"client-secret"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"client_secret"),", and ",(0,l.kt)("inlineCode",{parentName:"li"},"client-secret-file"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"client_secret_file")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"provider")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"provider-display-name"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"provider_display_name")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"provider-ca-file"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"provider_ca_files")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"login-url"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"login_url")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"redeem-url"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"redeem_url")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"profile-url"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"profile_url")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"resource")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"validate-url"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"validate_url")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"scope")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"prompt")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"approval-prompt"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"approval_prompt")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"acr-values"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"acr_values")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"user-id-claim"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"user_id_claim")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"allowed-group"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"allowed_groups")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"allowed-role"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"allowed_roles")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"jwt-key"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"jwt_key")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"jwt-key-file"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"jwt_key_file")),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"pubjwk-url"),"/",(0,l.kt)("inlineCode",{parentName:"li"},"pubjwk_url"))),(0,l.kt)("p",null,"and all provider-specific options, i.e. any option whose name includes ",(0,l.kt)("inlineCode",{parentName:"p"},"oidc"),",\n",(0,l.kt)("inlineCode",{parentName:"p"},"azure"),", ",(0,l.kt)("inlineCode",{parentName:"p"},"bitbucket"),", ",(0,l.kt)("inlineCode",{parentName:"p"},"github"),", ",(0,l.kt)("inlineCode",{parentName:"p"},"gitlab"),", ",(0,l.kt)("inlineCode",{parentName:"p"},"google")," or ",(0,l.kt)("inlineCode",{parentName:"p"},"keycloak"),". Attempting to\nuse any of these options via flags or via config when ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config")," is\nset will result in an error."),(0,l.kt)("div",{className:"admonition admonition-important alert alert--info"},(0,l.kt)("div",{parentName:"div",className:"admonition-heading"},(0,l.kt)("h5",{parentName:"div"},(0,l.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,l.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"},(0,l.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M7 2.3c3.14 0 5.7 2.56 5.7 5.7s-2.56 5.7-5.7 5.7A5.71 5.71 0 0 1 1.3 8c0-3.14 2.56-5.7 5.7-5.7zM7 1C3.14 1 0 4.14 0 8s3.14 7 7 7 7-3.14 7-7-3.14-7-7-7zm1 3H6v5h2V4zm0 6H6v2h2v-2z"}))),"important")),(0,l.kt)("div",{parentName:"div",className:"admonition-content"},(0,l.kt)("p",{parentName:"div"},"You must remove these options before starting OAuth2 Proxy with ",(0,l.kt)("inlineCode",{parentName:"p"},"--alpha-config")))),(0,l.kt)("h2",{id:"configuration-reference"},"Configuration Reference"),(0,l.kt)("h3",{id:"adfsoptions"},"ADFSOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"skipScope")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"Skip adding the scope parameter in login request",(0,l.kt)("br",null),"Default value is 'false'")))),(0,l.kt)("h3",{id:"alphaoptions"},"AlphaOptions"),(0,l.kt)("p",null,"AlphaOptions contains alpha structured configuration options.\nUsage of these options allows users to access alpha features that are not\navailable as part of the primary configuration structure for OAuth2 Proxy."),(0,l.kt)("div",{className:"admonition admonition-warning alert alert--danger"},(0,l.kt)("div",{parentName:"div",className:"admonition-heading"},(0,l.kt)("h5",{parentName:"div"},(0,l.kt)("span",{parentName:"h5",className:"admonition-icon"},(0,l.kt)("svg",{parentName:"span",xmlns:"http://www.w3.org/2000/svg",width:"12",height:"16",viewBox:"0 0 12 16"},(0,l.kt)("path",{parentName:"svg",fillRule:"evenodd",d:"M5.05.31c.81 2.17.41 3.38-.52 4.31C3.55 5.67 1.98 6.45.9 7.98c-1.45 2.05-1.7 6.53 3.53 7.7-2.2-1.16-2.67-4.52-.3-6.61-.61 2.03.53 3.33 1.94 2.86 1.39-.47 2.3.53 2.27 1.67-.02.78-.31 1.44-1.13 1.81 3.42-.59 4.78-3.42 4.78-5.56 0-2.84-2.53-3.22-1.25-5.61-1.52.13-2.03 1.13-1.89 2.75.09 1.08-1.02 1.8-1.86 1.33-.67-.41-.66-1.19-.06-1.78C8.18 5.31 8.68 2.45 5.05.32L5.03.3l.02.01z"}))),"warning")),(0,l.kt)("div",{parentName:"div",className:"admonition-content"},(0,l.kt)("p",{parentName:"div"},"The options within this structure are considered alpha.\nThey may change between releases without notice."))),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"upstreamConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#upstreamconfig"},"UpstreamConfig"))),(0,l.kt)("td",{parentName:"tr",align:null},"UpstreamConfig is used to configure upstream servers.",(0,l.kt)("br",null),"Once a user is authenticated, requests to the server will be proxied to",(0,l.kt)("br",null),"these upstream servers based on the path mappings defined in this list.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"injectRequestHeaders")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#header"},"[]Header"))),(0,l.kt)("td",{parentName:"tr",align:null},"InjectRequestHeaders is used to configure headers that should be added",(0,l.kt)("br",null),"to requests to upstream servers.",(0,l.kt)("br",null),"Headers may source values from either the authenticated user's session",(0,l.kt)("br",null),"or from a static secret value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"injectResponseHeaders")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#header"},"[]Header"))),(0,l.kt)("td",{parentName:"tr",align:null},"InjectResponseHeaders is used to configure headers that should be added",(0,l.kt)("br",null),"to responses from the proxy.",(0,l.kt)("br",null),"This is typically used when using the proxy as an external authentication",(0,l.kt)("br",null),"provider in conjunction with another proxy such as NGINX and its",(0,l.kt)("br",null),"auth_request module.",(0,l.kt)("br",null),"Headers may source values from either the authenticated user's session",(0,l.kt)("br",null),"or from a static secret value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"server")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#server"},"Server"))),(0,l.kt)("td",{parentName:"tr",align:null},"Server is used to configure the HTTP(S) server for the proxy application.",(0,l.kt)("br",null),"You may choose to run both HTTP and HTTPS servers simultaneously.",(0,l.kt)("br",null),"This can be done by setting the BindAddress and the SecureBindAddress simultaneously.",(0,l.kt)("br",null),"To use the secure server you must configure a TLS certificate and key.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"metricsServer")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#server"},"Server"))),(0,l.kt)("td",{parentName:"tr",align:null},"MetricsServer is used to configure the HTTP(S) server for metrics.",(0,l.kt)("br",null),"You may choose to run both HTTP and HTTPS servers simultaneously.",(0,l.kt)("br",null),"This can be done by setting the BindAddress and the SecureBindAddress simultaneously.",(0,l.kt)("br",null),"To use the secure server you must configure a TLS certificate and key.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"providers")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#providers"},"Providers"))),(0,l.kt)("td",{parentName:"tr",align:null},"Providers is used to configure multiple providers.")))),(0,l.kt)("h3",{id:"azureoptions"},"AzureOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"tenant")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Tenant directs to a tenant-specific or common (tenant-independent) endpoint",(0,l.kt)("br",null),"Default value is 'common'")))),(0,l.kt)("h3",{id:"bitbucketoptions"},"BitbucketOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"team")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Team sets restrict logins to members of this team")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"repository")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Repository sets restrict logins to user with access to this repository")))),(0,l.kt)("h3",{id:"claimsource"},"ClaimSource"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#headervalue"},"HeaderValue"),")"),(0,l.kt)("p",null,"ClaimSource allows loading a header value from a claim within the session"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"claim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Claim is the name of the claim in the session that the value should be",(0,l.kt)("br",null),"loaded from.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"prefix")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Prefix is an optional prefix that will be prepended to the value of the",(0,l.kt)("br",null),"claim if it is non-empty.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"basicAuthPassword")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,l.kt)("td",{parentName:"tr",align:null},"BasicAuthPassword converts this claim into a basic auth header.",(0,l.kt)("br",null),"Note the value of claim will become the basic auth username and the",(0,l.kt)("br",null),"basicAuthPassword will be used as the password value.")))),(0,l.kt)("h3",{id:"duration"},"Duration"),(0,l.kt)("h4",{id:"string-alias"},"(",(0,l.kt)("inlineCode",{parentName:"h4"},"string")," alias)"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#upstream"},"Upstream"),")"),(0,l.kt)("p",null,'Duration is as string representation of a period of time.\nA duration string is a is a possibly signed sequence of decimal numbers,\neach with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".\nValid time units are "ns", "us" (or "\xb5s"), "ms", "s", "m", "h".'),(0,l.kt)("h3",{id:"githuboptions"},"GitHubOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"org")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Org sets restrict logins to members of this organisation")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"team")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Team sets restrict logins to members of this team")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"repo")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Repo sets restrict logins to collaborators of this repository")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"token")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Token is the token to use when verifying repository collaborators",(0,l.kt)("br",null),"it must have push access to the repository")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"users")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Users allows users with these usernames to login",(0,l.kt)("br",null),"even if they do not belong to the specified org and team or collaborators")))),(0,l.kt)("h3",{id:"gitlaboptions"},"GitLabOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"group")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Group sets restrict logins to members of this group")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"projects")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Projects restricts logins to members of any of these projects")))),(0,l.kt)("h3",{id:"googleoptions"},"GoogleOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"group")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Groups sets restrict logins to members of this google group")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"adminEmail")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"AdminEmail is the google admin to impersonate for api calls")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"serviceAccountJson")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ServiceAccountJSON is the path to the service account json credentials")))),(0,l.kt)("h3",{id:"header"},"Header"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions"),")"),(0,l.kt)("p",null,"Header represents an individual header that will be added to a request or\nresponse header."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"name")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Name is the header name to be used for this set of values.",(0,l.kt)("br",null),"Names should be unique within a list of Headers.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"preserveRequestValue")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"PreserveRequestValue determines whether any values for this header",(0,l.kt)("br",null),"should be preserved for the request to the upstream server.",(0,l.kt)("br",null),"This option only applies to injected request headers.",(0,l.kt)("br",null),"Defaults to false (headers that match this header will be stripped).")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"values")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#headervalue"},"[]HeaderValue"))),(0,l.kt)("td",{parentName:"tr",align:null},"Values contains the desired values for this header")))),(0,l.kt)("h3",{id:"headervalue"},"HeaderValue"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#header"},"Header"),")"),(0,l.kt)("p",null,"HeaderValue represents a single header value and the sources that can\nmake up the header value"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"value")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]byte")),(0,l.kt)("td",{parentName:"tr",align:null},"Value expects a base64 encoded string value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"fromEnv")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"FromEnv expects the name of an environment variable.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"fromFile")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"FromFile expects a path to a file containing the secret value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"claim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Claim is the name of the claim in the session that the value should be",(0,l.kt)("br",null),"loaded from.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"prefix")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Prefix is an optional prefix that will be prepended to the value of the",(0,l.kt)("br",null),"claim if it is non-empty.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"basicAuthPassword")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,l.kt)("td",{parentName:"tr",align:null},"BasicAuthPassword converts this claim into a basic auth header.",(0,l.kt)("br",null),"Note the value of claim will become the basic auth username and the",(0,l.kt)("br",null),"basicAuthPassword will be used as the password value.")))),(0,l.kt)("h3",{id:"keycloakoptions"},"KeycloakOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"groups")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Group enables to restrict login to members of indicated group")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"roles")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"Role enables to restrict login to users with role (only available when using the keycloak-oidc provider)")))),(0,l.kt)("h3",{id:"logingovoptions"},"LoginGovOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"jwtKey")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"JWTKey is a private key in PEM format used to sign JWT,")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"jwtKeyFile")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"JWTKeyFile is a path to the private key file in PEM format used to sign the JWT")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"pubjwkURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"PubJWKURL is the JWK pubkey access endpoint")))),(0,l.kt)("h3",{id:"loginurlparameter"},"LoginURLParameter"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("p",null,"LoginURLParameter is the configuration for a single query parameter that\ncan be passed through from the ",(0,l.kt)("inlineCode",{parentName:"p"},"/oauth2/start"),' endpoint to the IdP login\nURL. The "default" option specifies the default value or values (if any)\nthat will be passed to the IdP for this parameter, and "allow" is a list\nof options for ways in which this parameter can be set or overridden via\nthe query string to ',(0,l.kt)("inlineCode",{parentName:"p"},"/oauth2/start"),".\nIf ",(0,l.kt)("em",{parentName:"p"},"only"),' a default is specified and no "allow" then the parameter is\neffectively fixed - the default value will always be used and anything\npassed to the start URL will be ignored. If ',(0,l.kt)("em",{parentName:"p"},"only"),' "allow" is specified\nbut no default then the parameter will only be passed on to the IdP if\nthe caller provides it, and no value will be sent otherwise.'),(0,l.kt)("p",null,"Examples:"),(0,l.kt)("p",null,"A parameter whose value is fixed"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"name: organization\ndefault:\n- myorg\n")),(0,l.kt)("p",null,"A parameter that is not passed by default, but may be set to one of a\nfixed set of values"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"name: prompt\nallow:\n- value: login\n- value: consent\n- value: select_account\n")),(0,l.kt)("p",null,"A parameter that is passed by default but may be overridden by one of\na fixed set of values"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},'name: prompt\ndefault: ["login"]\nallow:\n- value: consent\n- value: select_account\n')),(0,l.kt)("p",null,"A parameter that may be overridden, but only by values that match a\nregular expression. For example to restrict ",(0,l.kt)("inlineCode",{parentName:"p"},"login_hint")," to email\naddresses in your organization's domain:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},'name: login_hint\nallow:\n- pattern: \'^[^@]*@example\\.com$\'\n# this allows at most one "@" sign, and requires "example.com" domain.\n')),(0,l.kt)("p",null,'Note that the YAML rules around exactly which characters are allowed\nand/or require escaping in different types of string literals are\nconvoluted. For regular expressions the single quoted form is simplest\nas backslash is not considered to be an escape character. Alternatively\nuse the "chomped block" format ',(0,l.kt)("inlineCode",{parentName:"p"},"|-"),":"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"- pattern: |-\n ^[^@]*@example\\.com$\n")),(0,l.kt)("p",null,"The hyphen is important, a ",(0,l.kt)("inlineCode",{parentName:"p"},"|")," block would have a trailing newline\ncharacter."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"name")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Name specifies the name of the query parameter.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"default")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"(Optional)")," Default specifies a default value or values that will be",(0,l.kt)("br",null),"passed to the IdP if not overridden.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"allow")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#urlparameterrule"},"[]URLParameterRule"))),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"(Optional)")," Allow specifies rules about how the default (if any) may be",(0,l.kt)("br",null),"overridden via the query string to ",(0,l.kt)("inlineCode",{parentName:"td"},"/oauth2/start"),". Only",(0,l.kt)("br",null),"values that match one or more of the allow rules will be",(0,l.kt)("br",null),"forwarded to the IdP.")))),(0,l.kt)("h3",{id:"oidcoptions"},"OIDCOptions"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"issuerURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"IssuerURL is the OpenID Connect issuer URL",(0,l.kt)("br",null),"eg: ",(0,l.kt)("a",{parentName:"td",href:"https://accounts.google.com"},"https://accounts.google.com"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"insecureAllowUnverifiedEmail")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"InsecureAllowUnverifiedEmail prevents failures if an email address in an id_token is not verified",(0,l.kt)("br",null),"default set to 'false'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"insecureSkipIssuerVerification")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"InsecureSkipIssuerVerification skips verification of ID token issuers. When false, ID Token Issuers must match the OIDC discovery URL",(0,l.kt)("br",null),"default set to 'false'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"insecureSkipNonce")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"InsecureSkipNonce skips verifying the ID Token's nonce claim that must match",(0,l.kt)("br",null),"the random nonce sent in the initial OAuth flow. Otherwise, the nonce is checked",(0,l.kt)("br",null),"after the initial OAuth redeem & subsequent token refreshes.",(0,l.kt)("br",null),"default set to 'true'",(0,l.kt)("br",null),"Warning: In a future release, this will change to 'false' by default for enhanced security.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"skipDiscovery")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"SkipDiscovery allows to skip OIDC discovery and use manually supplied Endpoints",(0,l.kt)("br",null),"default set to 'false'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"jwksURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"JwksURL is the OpenID Connect JWKS URL",(0,l.kt)("br",null),"eg: ",(0,l.kt)("a",{parentName:"td",href:"https://www.googleapis.com/oauth2/v3/certs"},"https://www.googleapis.com/oauth2/v3/certs"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"emailClaim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"EmailClaim indicates which claim contains the user email,",(0,l.kt)("br",null),"default set to 'email'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"groupsClaim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"GroupsClaim indicates which claim contains the user groups",(0,l.kt)("br",null),"default set to 'groups'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"userIDClaim")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"UserIDClaim indicates which claim contains the user ID",(0,l.kt)("br",null),"default set to 'email'")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"audienceClaims")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"AudienceClaim allows to define any claim that is verified against the client id",(0,l.kt)("br",null),"By default ",(0,l.kt)("inlineCode",{parentName:"td"},"aud")," claim is used for verification.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"extraAudiences")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"ExtraAudiences is a list of additional audiences that are allowed",(0,l.kt)("br",null),"to pass verification in addition to the client id.")))),(0,l.kt)("h3",{id:"provider"},"Provider"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#providers"},"Providers"),")"),(0,l.kt)("p",null,"Provider holds all configuration for a single provider"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"clientID")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ClientID is the OAuth Client ID that is defined in the provider",(0,l.kt)("br",null),"This value is required for all providers.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"clientSecret")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ClientSecret is the OAuth Client Secret that is defined in the provider",(0,l.kt)("br",null),"This value is required for all providers.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"clientSecretFile")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ClientSecretFile is the name of the file",(0,l.kt)("br",null),"containing the OAuth Client Secret, it will be used if ClientSecret is not set.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"keycloakConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#keycloakoptions"},"KeycloakOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"KeycloakConfig holds all configurations for Keycloak provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"azureConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#azureoptions"},"AzureOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"AzureConfig holds all configurations for Azure provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"ADFSConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#adfsoptions"},"ADFSOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"ADFSConfig holds all configurations for ADFS provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"bitbucketConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#bitbucketoptions"},"BitbucketOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"BitbucketConfig holds all configurations for Bitbucket provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"githubConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#githuboptions"},"GitHubOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"GitHubConfig holds all configurations for GitHubC provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"gitlabConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#gitlaboptions"},"GitLabOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"GitLabConfig holds all configurations for GitLab provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"googleConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#googleoptions"},"GoogleOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"GoogleConfig holds all configurations for Google provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"oidcConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#oidcoptions"},"OIDCOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"OIDCConfig holds all configurations for OIDC provider",(0,l.kt)("br",null),"or providers utilize OIDC configurations.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"loginGovConfig")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#logingovoptions"},"LoginGovOptions"))),(0,l.kt)("td",{parentName:"tr",align:null},"LoginGovConfig holds all configurations for LoginGov provider.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"id")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ID should be a unique identifier for the provider.",(0,l.kt)("br",null),"This value is required for all providers.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"provider")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#providertype"},"ProviderType"))),(0,l.kt)("td",{parentName:"tr",align:null},"Type is the OAuth provider",(0,l.kt)("br",null),"must be set from the supported providers group,",(0,l.kt)("br",null),"otherwise 'Google' is set as default")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"name")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Name is the providers display name",(0,l.kt)("br",null),"if set, it will be shown to the users in the login page.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"caFiles")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"CAFiles is a list of paths to CA certificates that should be used when connecting to the provider.",(0,l.kt)("br",null),"If not specified, the default Go trust sources are used instead")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"loginURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"LoginURL is the authentication endpoint")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"loginURLParameters")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#loginurlparameter"},"[]LoginURLParameter"))),(0,l.kt)("td",{parentName:"tr",align:null},"LoginURLParameters defines the parameters that can be passed from the start URL to the IdP login URL")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"redeemURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"RedeemURL is the token redemption endpoint")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"profileURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ProfileURL is the profile access endpoint")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"resource")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ProtectedResource is the resource that is protected (Azure AD and ADFS only)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"validateURL")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ValidateURL is the access token validation endpoint")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"scope")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Scope is the OAuth scope specification")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"allowedGroups")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]string")),(0,l.kt)("td",{parentName:"tr",align:null},"AllowedGroups is a list of restrict logins to members of this group")))),(0,l.kt)("h3",{id:"providertype"},"ProviderType"),(0,l.kt)("h4",{id:"string-alias-1"},"(",(0,l.kt)("inlineCode",{parentName:"h4"},"string")," alias)"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#provider"},"Provider"),")"),(0,l.kt)("p",null,"ProviderType is used to enumerate the different provider type options\nValid options are: adfs, azure, bitbucket, digitalocean facebook, github,\ngitlab, google, keycloak, keycloak-oidc, linkedin, login.gov, nextcloud\nand oidc."),(0,l.kt)("h3",{id:"providers"},"Providers"),(0,l.kt)("h4",{id:"provider-alias"},"(",(0,l.kt)("a",{parentName:"h4",href:"#provider"},"[]Provider")," alias)"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions"),")"),(0,l.kt)("p",null,"Providers is a collection of definitions for providers."),(0,l.kt)("h3",{id:"secretsource"},"SecretSource"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#claimsource"},"ClaimSource"),", ",(0,l.kt)("a",{parentName:"p",href:"#headervalue"},"HeaderValue"),", ",(0,l.kt)("a",{parentName:"p",href:"#tls"},"TLS"),")"),(0,l.kt)("p",null,"SecretSource references an individual secret value.\nOnly one source within the struct should be defined at any time."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"value")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"[]byte")),(0,l.kt)("td",{parentName:"tr",align:null},"Value expects a base64 encoded string value.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"fromEnv")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"FromEnv expects the name of an environment variable.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"fromFile")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"FromFile expects a path to a file containing the secret value.")))),(0,l.kt)("h3",{id:"server"},"Server"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions"),")"),(0,l.kt)("p",null,"Server represents the configuration for an HTTP(S) server"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"BindAddress")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"BindAddress is the address on which to serve traffic.",(0,l.kt)("br",null),'Leave blank or set to "-" to disable.')),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"SecureBindAddress")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"SecureBindAddress is the address on which to serve secure traffic.",(0,l.kt)("br",null),'Leave blank or set to "-" to disable.')),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"TLS")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#tls"},"TLS"))),(0,l.kt)("td",{parentName:"tr",align:null},"TLS contains the information for loading the certificate and key for the",(0,l.kt)("br",null),"secure traffic and further configuration for the TLS server.")))),(0,l.kt)("h3",{id:"tls"},"TLS"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#server"},"Server"),")"),(0,l.kt)("p",null,"TLS contains the information for loading a TLS certificate and key\nas well as an optional minimal TLS version that is acceptable."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"Key")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,l.kt)("td",{parentName:"tr",align:null},"Key is the TLS key data to use.",(0,l.kt)("br",null),"Typically this will come from a file.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"Cert")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#secretsource"},"SecretSource"))),(0,l.kt)("td",{parentName:"tr",align:null},"Cert is the TLS certificate data to use.",(0,l.kt)("br",null),"Typically this will come from a file.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"MinVersion")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"MinVersion is the minimal TLS version that is acceptable.",(0,l.kt)("br",null),'E.g. Set to "TLS1.3" to select TLS version 1.3')))),(0,l.kt)("h3",{id:"urlparameterrule"},"URLParameterRule"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#loginurlparameter"},"LoginURLParameter"),")"),(0,l.kt)("p",null,"URLParameterRule represents a rule by which query parameters\npassed to the ",(0,l.kt)("inlineCode",{parentName:"p"},"/oauth2/start")," endpoint are checked to determine whether\nthey are valid overrides for the given parameter passed to the IdP's\nlogin URL. Either Value or Pattern should be supplied, not both."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"value")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"A Value rule matches just this specific value")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"pattern")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"A Pattern rule gives a regular expression that must be matched by",(0,l.kt)("br",null),"some substring of the value. The expression is ",(0,l.kt)("em",{parentName:"td"},"not")," automatically",(0,l.kt)("br",null),"anchored to the start and end of the value, if you ",(0,l.kt)("em",{parentName:"td"},"want")," to restrict",(0,l.kt)("br",null),"the whole parameter value you must anchor it yourself with ",(0,l.kt)("inlineCode",{parentName:"td"},"^")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"$"),".")))),(0,l.kt)("h3",{id:"upstream"},"Upstream"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#upstreamconfig"},"UpstreamConfig"),")"),(0,l.kt)("p",null,"Upstream represents the configuration for an upstream server.\nRequests will be proxied to this upstream if the path matches the request path."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"id")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"ID should be a unique identifier for the upstream.",(0,l.kt)("br",null),"This value is required for all upstreams.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"path")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"Path is used to map requests to the upstream server.",(0,l.kt)("br",null),"The closest match will take precedence and all Paths must be unique.",(0,l.kt)("br",null),"Path can also take a pattern when used with RewriteTarget.",(0,l.kt)("br",null),"Path segments can be captured and matched using regular experessions.",(0,l.kt)("br",null),"Eg:",(0,l.kt)("br",null),"- ",(0,l.kt)("inlineCode",{parentName:"td"},"^/foo$"),": Match only the explicit path ",(0,l.kt)("inlineCode",{parentName:"td"},"/foo"),(0,l.kt)("br",null),"- ",(0,l.kt)("inlineCode",{parentName:"td"},"^/bar/$"),": Match any path prefixed with ",(0,l.kt)("inlineCode",{parentName:"td"},"/bar/"),(0,l.kt)("br",null),"- ",(0,l.kt)("inlineCode",{parentName:"td"},"^/baz/(.*)$"),": Match any path prefixed with ",(0,l.kt)("inlineCode",{parentName:"td"},"/baz")," and capture the remaining path for use with RewriteTarget")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"rewriteTarget")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"RewriteTarget allows users to rewrite the request path before it is sent to",(0,l.kt)("br",null),"the upstream server.",(0,l.kt)("br",null),"Use the Path to capture segments for reuse within the rewrite target.",(0,l.kt)("br",null),"Eg: With a Path of ",(0,l.kt)("inlineCode",{parentName:"td"},"^/baz/(.*)"),", a RewriteTarget of ",(0,l.kt)("inlineCode",{parentName:"td"},"/foo/$1")," would rewrite",(0,l.kt)("br",null),"the request ",(0,l.kt)("inlineCode",{parentName:"td"},"/baz/abc/123")," to ",(0,l.kt)("inlineCode",{parentName:"td"},"/foo/abc/123")," before proxying to the",(0,l.kt)("br",null),"upstream server.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"uri")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"string")),(0,l.kt)("td",{parentName:"tr",align:null},"The URI of the upstream server. This may be an HTTP(S) server of a File",(0,l.kt)("br",null),"based URL. It may include a path, in which case all requests will be served",(0,l.kt)("br",null),"under that path.",(0,l.kt)("br",null),"Eg:",(0,l.kt)("br",null),"- http://localhost:8080",(0,l.kt)("br",null),"- ",(0,l.kt)("a",{parentName:"td",href:"https://service.localhost"},"https://service.localhost"),(0,l.kt)("br",null),"- ",(0,l.kt)("a",{parentName:"td",href:"https://service.localhost/path"},"https://service.localhost/path"),(0,l.kt)("br",null),"- file://host/path",(0,l.kt)("br",null),'If the URI\'s path is "/base" and the incoming request was for "/dir",',(0,l.kt)("br",null),'the upstream request will be for "/base/dir".')),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"insecureSkipTLSVerify")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.",(0,l.kt)("br",null),"This option is insecure and will allow potential Man-In-The-Middle attacks",(0,l.kt)("br",null),"betweem OAuth2 Proxy and the usptream server.",(0,l.kt)("br",null),"Defaults to false.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"static")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"Static will make all requests to this upstream have a static response.",(0,l.kt)("br",null),'The response will have a body of "Authenticated" and a response code',(0,l.kt)("br",null),"matching StaticCode.",(0,l.kt)("br",null),"If StaticCode is not set, the response will return a 200 response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"staticCode")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"int")),(0,l.kt)("td",{parentName:"tr",align:null},"StaticCode determines the response code for the Static response.",(0,l.kt)("br",null),"This option can only be used with Static enabled.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"flushInterval")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#duration"},"Duration"))),(0,l.kt)("td",{parentName:"tr",align:null},"FlushInterval is the period between flushing the response buffer when",(0,l.kt)("br",null),"streaming response from the upstream.",(0,l.kt)("br",null),"Defaults to 1 second.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"passHostHeader")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"PassHostHeader determines whether the request host header should be proxied",(0,l.kt)("br",null),"to the upstream server.",(0,l.kt)("br",null),"Defaults to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"proxyWebSockets")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"ProxyWebSockets enables proxying of websockets to upstream servers",(0,l.kt)("br",null),"Defaults to true.")))),(0,l.kt)("h3",{id:"upstreamconfig"},"UpstreamConfig"),(0,l.kt)("p",null,"(",(0,l.kt)("strong",{parentName:"p"},"Appears on:")," ",(0,l.kt)("a",{parentName:"p",href:"#alphaoptions"},"AlphaOptions"),")"),(0,l.kt)("p",null,"UpstreamConfig is a collection of definitions for upstream servers."),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Field"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"proxyRawPath")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},"bool")),(0,l.kt)("td",{parentName:"tr",align:null},"ProxyRawPath will pass the raw url path to upstream allowing for url's",(0,l.kt)("br",null),'like: "/%2F/" which would otherwise be redirected to "/"')),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"upstreams")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("em",{parentName:"td"},(0,l.kt)("a",{parentName:"em",href:"#upstream"},"[]Upstream"))),(0,l.kt)("td",{parentName:"tr",align:null},"Upstreams represents the configuration for the upstream servers.",(0,l.kt)("br",null),"Requests will be proxied to this upstream if the path matches the request path.")))))}u.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/js/cecf159a.90b73e88.js b/assets/js/cecf159a.90b73e88.js new file mode 100644 index 00000000..95a58cab --- /dev/null +++ b/assets/js/cecf159a.90b73e88.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[5995],{6720:function(o){o.exports=JSON.parse('{"pluginId":"default","version":"7.1.x","label":"7.1.x","banner":"unmaintained","badge":true,"className":"docs-version-7.1.x","isLast":false,"docsSidebars":{"version-7.1.x/docs":[{"type":"link","label":"Installation","href":"/oauth2-proxy/docs/7.1.x/","docId":"installation"},{"type":"link","label":"Behaviour","href":"/oauth2-proxy/docs/7.1.x/behaviour","docId":"behaviour"},{"collapsed":false,"type":"category","label":"Configuration","items":[{"type":"link","label":"Overview","href":"/oauth2-proxy/docs/7.1.x/configuration/overview","docId":"configuration/overview"},{"type":"link","label":"OAuth Provider Configuration","href":"/oauth2-proxy/docs/7.1.x/configuration/oauth_provider","docId":"configuration/oauth_provider"},{"type":"link","label":"Session Storage","href":"/oauth2-proxy/docs/7.1.x/configuration/session_storage","docId":"configuration/session_storage"},{"type":"link","label":"TLS Configuration","href":"/oauth2-proxy/docs/7.1.x/configuration/tls","docId":"configuration/tls"},{"type":"link","label":"Alpha Configuration","href":"/oauth2-proxy/docs/7.1.x/configuration/alpha-config","docId":"configuration/alpha-config"}],"collapsible":true},{"collapsed":false,"type":"category","label":"Features","items":[{"type":"link","label":"Endpoints","href":"/oauth2-proxy/docs/7.1.x/features/endpoints","docId":"features/endpoints"}],"collapsible":true},{"collapsed":false,"type":"category","label":"Community","items":[{"type":"link","label":"Security","href":"/oauth2-proxy/docs/7.1.x/community/security","docId":"community/security"}],"collapsible":true}]},"docs":{"behaviour":{"id":"behaviour","title":"Behaviour","description":"1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy\'s session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).","sidebar":"version-7.1.x/docs"},"community/security":{"id":"community/security","title":"Security","description":"OAuth2 Proxy is a community project.","sidebar":"version-7.1.x/docs"},"configuration/alpha-config":{"id":"configuration/alpha-config","title":"Alpha Configuration","description":"This page contains documentation for alpha features.","sidebar":"version-7.1.x/docs"},"configuration/oauth_provider":{"id":"configuration/oauth_provider","title":"OAuth Provider Configuration","description":"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on.","sidebar":"version-7.1.x/docs"},"configuration/overview":{"id":"configuration/overview","title":"Overview","description":"oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings).","sidebar":"version-7.1.x/docs"},"configuration/session_storage":{"id":"configuration/session_storage","title":"Session Storage","description":"Sessions allow a user\'s authentication to be tracked between multiple HTTP","sidebar":"version-7.1.x/docs"},"configuration/tls":{"id":"configuration/tls","title":"TLS Configuration","description":"There are two recommended configurations.","sidebar":"version-7.1.x/docs"},"features/endpoints":{"id":"features/endpoints","title":"Endpoints","description":"OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.","sidebar":"version-7.1.x/docs"},"installation":{"id":"installation","title":"Installation","description":"1. Choose how to deploy:","sidebar":"version-7.1.x/docs"}}}')}}]); \ No newline at end of file diff --git a/assets/js/d8b74189.4b70dd77.js b/assets/js/d8b74189.4b70dd77.js new file mode 100644 index 00000000..0d459711 --- /dev/null +++ b/assets/js/d8b74189.4b70dd77.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[7559],{9773:function(s){s.exports={blogPosts:[]}}}]); \ No newline at end of file diff --git a/assets/js/de718920.cd0c4637.js b/assets/js/de718920.cd0c4637.js new file mode 100644 index 00000000..d07c3be7 --- /dev/null +++ b/assets/js/de718920.cd0c4637.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[8338],{3905:function(e,t,n){n.d(t,{Zo:function(){return u},kt:function(){return d}});var r=n(7294);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function i(e){for(var t=1;t=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var l=r.createContext({}),c=function(e){var t=r.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):i(i({},t),e)),n},u=function(e){var t=c(e.components);return r.createElement(l.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},m=r.forwardRef((function(e,t){var n=e.components,o=e.mdxType,a=e.originalType,l=e.parentName,u=p(e,["components","mdxType","originalType","parentName"]),m=c(n),d=o,f=m["".concat(l,".").concat(d)]||m[d]||s[d]||a;return n?r.createElement(f,i(i({ref:t},u),{},{components:n})):r.createElement(f,i({ref:t},u))}));function d(e,t){var n=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var a=n.length,i=new Array(a);i[0]=m;var p={};for(var l in t)hasOwnProperty.call(t,l)&&(p[l]=t[l]);p.originalType=e,p.mdxType="string"==typeof e?e:o,i[1]=p;for(var c=2;c=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var u=r.createContext({}),l=function(e){var t=r.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):a(a({},t),e)),n},c=function(e){var t=l(e.components);return r.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},p=r.forwardRef((function(e,t){var n=e.components,i=e.mdxType,o=e.originalType,u=e.parentName,c=s(e,["components","mdxType","originalType","parentName"]),p=l(n),m=i,y=p["".concat(u,".").concat(m)]||p[m]||d[m]||o;return n?r.createElement(y,a(a({ref:t},c),{},{components:n})):r.createElement(y,a({ref:t},c))}));function m(e,t){var n=arguments,i=t&&t.mdxType;if("string"==typeof e||i){var o=n.length,a=new Array(o);a[0]=p;var s={};for(var u in t)hasOwnProperty.call(t,u)&&(s[u]=t[u]);s.originalType=e,s.mdxType="string"==typeof e?e:i,a[1]=s;for(var l=2;l=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var l=r.createContext({}),u=function(e){var t=r.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},c=function(e){var t=u(e.components);return r.createElement(l.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},p=r.forwardRef((function(e,t){var n=e.components,i=e.mdxType,o=e.originalType,l=e.parentName,c=a(e,["components","mdxType","originalType","parentName"]),p=u(n),h=i,k=p["".concat(l,".").concat(h)]||p[h]||d[h]||o;return n?r.createElement(k,s(s({ref:t},c),{},{components:n})):r.createElement(k,s({ref:t},c))}));function h(e,t){var n=arguments,i=t&&t.mdxType;if("string"==typeof e||i){var o=n.length,s=new Array(o);s[0]=p;var a={};for(var l in t)hasOwnProperty.call(t,l)&&(a[l]=t[l]);a.originalType=e,a.mdxType="string"==typeof e?e:i,s[1]=a;for(var u=2;u=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var l=r.createContext({}),u=function(e){var t=r.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},c=function(e){var t=u(e.components);return r.createElement(l.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},p=r.forwardRef((function(e,t){var n=e.components,i=e.mdxType,o=e.originalType,l=e.parentName,c=a(e,["components","mdxType","originalType","parentName"]),p=u(n),h=i,k=p["".concat(l,".").concat(h)]||p[h]||d[h]||o;return n?r.createElement(k,s(s({ref:t},c),{},{components:n})):r.createElement(k,s({ref:t},c))}));function h(e,t){var n=arguments,i=t&&t.mdxType;if("string"==typeof e||i){var o=n.length,s=new Array(o);s[0]=p;var a={};for(var l in t)hasOwnProperty.call(t,l)&&(a[l]=t[l]);a.originalType=e,a.mdxType="string"==typeof e?e:i,s[1]=a;for(var u=2;u=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var u=r.createContext({}),l=function(e){var t=r.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):a(a({},t),e)),n},p=function(e){var t=l(e.components);return r.createElement(u.Provider,{value:t},e.children)},c={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},d=r.forwardRef((function(e,t){var n=e.components,o=e.mdxType,i=e.originalType,u=e.parentName,p=s(e,["components","mdxType","originalType","parentName"]),d=l(n),h=o,m=d["".concat(u,".").concat(h)]||d[h]||c[h]||i;return n?r.createElement(m,a(a({ref:t},p),{},{components:n})):r.createElement(m,a({ref:t},p))}));function h(e,t){var n=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var i=n.length,a=new Array(i);a[0]=d;var s={};for(var u in t)hasOwnProperty.call(t,u)&&(s[u]=t[u]);s.originalType=e,s.mdxType="string"==typeof e?e:o,a[1]=s;for(var l=2;l=0||(w[D]=M[D]);return w}(M,N);if(Object.getOwnPropertySymbols){var j=Object.getOwnPropertySymbols(M);for(L=0;L=0||Object.prototype.propertyIsEnumerable.call(M,D)&&(w[D]=M[D])}return w}var u=L.createContext({}),z=function(M){var N=L.useContext(u),D=N;return M&&(D="function"==typeof M?M(N):T(T({},N),M)),D},e=function(M){var N=z(M.components);return L.createElement(u.Provider,{value:N},M.children)},s={inlineCode:"code",wrapper:function(M){var N=M.children;return L.createElement(L.Fragment,{},N)}},i=L.forwardRef((function(M,N){var D=M.components,w=M.mdxType,j=M.originalType,u=M.parentName,e=t(M,["components","mdxType","originalType","parentName"]),i=z(D),c=w,y=i["".concat(u,".").concat(c)]||i[c]||s[c]||j;return D?L.createElement(y,T(T({ref:N},e),{},{components:D})):L.createElement(y,T({ref:N},e))}));function c(M,N){var D=arguments,w=N&&N.mdxType;if("string"==typeof M||w){var j=D.length,T=new Array(j);T[0]=i;var t={};for(var u in N)hasOwnProperty.call(N,u)&&(t[u]=N[u]);t.originalType=M,t.mdxType="string"==typeof M?M:w,T[1]=t;for(var z=2;z=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var u=r.createContext({}),l=function(e){var t=r.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):a(a({},t),e)),n},c=function(e){var t=l(e.components);return r.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},p=r.forwardRef((function(e,t){var n=e.components,i=e.mdxType,o=e.originalType,u=e.parentName,c=s(e,["components","mdxType","originalType","parentName"]),p=l(n),m=i,y=p["".concat(u,".").concat(m)]||p[m]||d[m]||o;return n?r.createElement(y,a(a({ref:t},c),{},{components:n})):r.createElement(y,a({ref:t},c))}));function m(e,t){var n=arguments,i=t&&t.mdxType;if("string"==typeof e||i){var o=n.length,a=new Array(o);a[0]=p;var s={};for(var u in t)hasOwnProperty.call(t,u)&&(s[u]=t[u]);s.originalType=e,s.mdxType="string"==typeof e?e:i,a[1]=s;for(var l=2;l=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var l=r.createContext({}),u=function(e){var t=r.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},c=function(e){var t=u(e.components);return r.createElement(l.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},p=r.forwardRef((function(e,t){var n=e.components,i=e.mdxType,o=e.originalType,l=e.parentName,c=a(e,["components","mdxType","originalType","parentName"]),p=u(n),h=i,k=p["".concat(l,".").concat(h)]||p[h]||d[h]||o;return n?r.createElement(k,s(s({ref:t},c),{},{components:n})):r.createElement(k,s({ref:t},c))}));function h(e,t){var n=arguments,i=t&&t.mdxType;if("string"==typeof e||i){var o=n.length,s=new Array(o);s[0]=p;var a={};for(var l in t)hasOwnProperty.call(t,l)&&(a[l]=t[l]);a.originalType=e,a.mdxType="string"==typeof e?e:i,s[1]=a;for(var u=2;u=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var u=r.createContext({}),p=function(e){var t=r.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):a(a({},t),e)),n},l=function(e){var t=p(e.components);return r.createElement(u.Provider,{value:t},e.children)},c={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},d=r.forwardRef((function(e,t){var n=e.components,o=e.mdxType,i=e.originalType,u=e.parentName,l=s(e,["components","mdxType","originalType","parentName"]),d=p(n),h=o,f=d["".concat(u,".").concat(h)]||d[h]||c[h]||i;return n?r.createElement(f,a(a({ref:t},l),{},{components:n})):r.createElement(f,a({ref:t},l))}));function h(e,t){var n=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var i=n.length,a=new Array(i);a[0]=d;var s={};for(var u in t)hasOwnProperty.call(t,u)&&(s[u]=t[u]);s.originalType=e,s.mdxType="string"==typeof e?e:o,a[1]=s;for(var p=2;p=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var u=r.createContext({}),p=function(e){var t=r.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):a(a({},t),e)),n},l=function(e){var t=p(e.components);return r.createElement(u.Provider,{value:t},e.children)},c={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},d=r.forwardRef((function(e,t){var n=e.components,o=e.mdxType,i=e.originalType,u=e.parentName,l=s(e,["components","mdxType","originalType","parentName"]),d=p(n),h=o,f=d["".concat(u,".").concat(h)]||d[h]||c[h]||i;return n?r.createElement(f,a(a({ref:t},l),{},{components:n})):r.createElement(f,a({ref:t},l))}));function h(e,t){var n=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var i=n.length,a=new Array(i);a[0]=d;var s={};for(var u in t)hasOwnProperty.call(t,u)&&(s[u]=t[u]);s.originalType=e,s.mdxType="string"==typeof e?e:o,a[1]=s;for(var p=2;p=0;l--)(o=e[l])&&(i=(a<3?o(i):a>3?o(t,n,i):o(t,n))||i);return a>3&&i&&Object.defineProperty(t,n,i),i}function u(e,t){return function(n,r){t(n,r,e)}}function s(e,t){if("object"==typeof Reflect&&"function"==typeof Reflect.metadata)return Reflect.metadata(e,t)}function c(e,t,n,r){return new(n||(n=Promise))((function(o,a){function i(e){try{u(r.next(e))}catch(t){a(t)}}function l(e){try{u(r.throw(e))}catch(t){a(t)}}function u(e){var t;e.done?o(e.value):(t=e.value,t instanceof n?t:new n((function(e){e(t)}))).then(i,l)}u((r=r.apply(e,t||[])).next())}))}function d(e,t){var n,r,o,a,i={label:0,sent:function(){if(1&o[0])throw o[1];return o[1]},trys:[],ops:[]};return a={next:l(0),throw:l(1),return:l(2)},"function"==typeof Symbol&&(a[Symbol.iterator]=function(){return this}),a;function l(a){return function(l){return function(a){if(n)throw new TypeError("Generator is already executing.");for(;i;)try{if(n=1,r&&(o=2&a[0]?r.return:a[0]?r.throw||((o=r.return)&&o.call(r),0):r.next)&&!(o=o.call(r,a[1])).done)return o;switch(r=0,o&&(a=[2&a[0],o.value]),a[0]){case 0:case 1:o=a;break;case 4:return i.label++,{value:a[1],done:!1};case 5:i.label++,r=a[1],a=[0];continue;case 7:a=i.ops.pop(),i.trys.pop();continue;default:if(!(o=i.trys,(o=o.length>0&&o[o.length-1])||6!==a[0]&&2!==a[0])){i=0;continue}if(3===a[0]&&(!o||a[1]>o[0]&&a[1]=e.length&&(e=void 0),{value:e&&e[r++],done:!e}}};throw new TypeError(t?"Object is not iterable.":"Symbol.iterator is not defined.")}function h(e,t){var n="function"==typeof Symbol&&e[Symbol.iterator];if(!n)return e;var r,o,a=n.call(e),i=[];try{for(;(void 0===t||t-- >0)&&!(r=a.next()).done;)i.push(r.value)}catch(l){o={error:l}}finally{try{r&&!r.done&&(n=a.return)&&n.call(a)}finally{if(o)throw o.error}}return i}function g(){for(var e=[],t=0;t1||l(e,t)}))})}function l(e,t){try{(n=o[e](t)).value instanceof y?Promise.resolve(n.value.v).then(u,s):c(a[0][2],n)}catch(r){c(a[0][3],r)}var n}function u(e){l("next",e)}function s(e){l("throw",e)}function c(e,t){e(t),a.shift(),a.length&&l(a[0][0],a[0][1])}}function x(e){var t,n;return t={},r("next"),r("throw",(function(e){throw e})),r("return"),t[Symbol.iterator]=function(){return this},t;function r(r,o){t[r]=e[r]?function(t){return(n=!n)?{value:y(e[r](t)),done:"return"===r}:o?o(t):t}:o}}function k(e){if(!Symbol.asyncIterator)throw new TypeError("Symbol.asyncIterator is not defined.");var t,n=e[Symbol.asyncIterator];return n?n.call(e):(e=m(e),t={},r("next"),r("throw"),r("return"),t[Symbol.asyncIterator]=function(){return this},t);function r(n){t[n]=e[n]&&function(t){return new Promise((function(r,o){(function(e,t,n,r){Promise.resolve(r).then((function(t){e({value:t,done:n})}),t)})(r,o,(t=e[n](t)).done,t.value)}))}}}function E(e,t){return Object.defineProperty?Object.defineProperty(e,"raw",{value:t}):e.raw=t,e}var S=Object.create?function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}:function(e,t){e.default=t};function T(e){if(e&&e.__esModule)return e;var t={};if(null!=e)for(var n in e)"default"!==n&&Object.prototype.hasOwnProperty.call(e,n)&&f(t,e,n);return S(t,e),t}function _(e){return e&&e.__esModule?e:{default:e}}function C(e,t,n,r){if("a"===n&&!r)throw new TypeError("Private accessor was defined without a getter");if("function"==typeof t?e!==t||!r:!t.has(e))throw new TypeError("Cannot read private member from an object whose class did not declare it");return"m"===n?r:"a"===n?r.call(e):r?r.value:t.get(e)}function A(e,t,n,r,o){if("m"===r)throw new TypeError("Private method is not writable");if("a"===r&&!o)throw new TypeError("Private accessor was defined without a setter");if("function"==typeof t?e!==t||!o:!t.has(e))throw new TypeError("Cannot write private member to an object whose class did not declare it");return"a"===r?o.call(e,n):o?o.value=n:t.set(e,n),n}},9782:function(e,t){"use strict";t.Z={title:"OAuth2 Proxy",tagline:"A lightweight authentication proxy written in Go",url:"https://oauth2-proxy.github.io",baseUrl:"/oauth2-proxy/",onBrokenLinks:"throw",favicon:"img/logos/OAuth2_Proxy_icon.svg",organizationName:"oauth2-proxy",projectName:"oauth2-proxy",themeConfig:{navbar:{title:"OAuth2 Proxy",logo:{alt:"OAuth2 Proxy",src:"img/logos/OAuth2_Proxy_icon.svg"},items:[{to:"docs/",activeBasePath:"docs",label:"Docs",position:"left"},{type:"docsVersionDropdown",position:"right",dropdownActiveClassDisabled:!0,dropdownItemsBefore:[],dropdownItemsAfter:[]},{href:"https://github.com/oauth2-proxy/oauth2-proxy",label:"GitHub",position:"right"}],hideOnScroll:!1},footer:{style:"dark",copyright:"Copyright \xa9 2022 OAuth2 Proxy.",links:[]},colorMode:{defaultMode:"light",disableSwitch:!1,respectPrefersColorScheme:!1,switchConfig:{darkIcon:"\ud83c\udf1c",darkIconStyle:{},lightIcon:"\ud83c\udf1e",lightIconStyle:{}}},docs:{versionPersistence:"localStorage"},metadata:[],prism:{additionalLanguages:[]},hideableSidebar:!1,autoCollapseSidebarCategories:!1,tableOfContents:{minHeadingLevel:2,maxHeadingLevel:3}},presets:[["@docusaurus/preset-classic",{docs:{sidebarPath:"/home/runner/work/oauth2-proxy/oauth2-proxy/docs/sidebars.js",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/"},theme:{customCss:"/home/runner/work/oauth2-proxy/oauth2-proxy/docs/src/css/custom.css"}}]],baseUrlIssueBanner:!0,i18n:{defaultLocale:"en",locales:["en"],localeConfigs:{}},onBrokenMarkdownLinks:"warn",onDuplicateRoutes:"warn",staticDirectories:["static"],customFields:{},plugins:[],themes:[],titleDelimiter:"|",noIndex:!1}},2067:function(e,t,n){"use strict";var r=n(7294),o=n(3935),a=n(3727),i=n(8356),l=n.n(i);function u(e){var t=e.error,n=e.retry,o=e.pastDelay;return t?r.createElement("div",{style:{align:"center",color:"#fff",backgroundColor:"#fa383e",borderColor:"#fa383e",borderStyle:"solid",borderRadius:"0.25rem",borderWidth:"1px",boxSizing:"border-box",display:"block",padding:"1rem",flex:"0 0 50%",marginLeft:"25%",marginRight:"25%",marginTop:"5rem",maxWidth:"50%",width:"100%"}},r.createElement("p",null,t.message),r.createElement("div",null,r.createElement("button",{type:"button",onClick:n},"Retry"))):o?r.createElement("div",{style:{display:"flex",justifyContent:"center",alignItems:"center",height:"100vh"}},r.createElement("svg",{id:"loader",style:{width:128,height:110,position:"absolute",top:"calc(100vh - 64%)"},viewBox:"0 0 45 45",xmlns:"http://www.w3.org/2000/svg",stroke:"#61dafb"},r.createElement("g",{fill:"none",fillRule:"evenodd",transform:"translate(1 1)",strokeWidth:"2"},r.createElement("circle",{cx:"22",cy:"22",r:"6",strokeOpacity:"0"},r.createElement("animate",{attributeName:"r",begin:"1.5s",dur:"3s",values:"6;22",calcMode:"linear",repeatCount:"indefinite"}),r.createElement("animate",{attributeName:"stroke-opacity",begin:"1.5s",dur:"3s",values:"1;0",calcMode:"linear",repeatCount:"indefinite"}),r.createElement("animate",{attributeName:"stroke-width",begin:"1.5s",dur:"3s",values:"2;0",calcMode:"linear",repeatCount:"indefinite"})),r.createElement("circle",{cx:"22",cy:"22",r:"6",strokeOpacity:"0"},r.createElement("animate",{attributeName:"r",begin:"3s",dur:"3s",values:"6;22",calcMode:"linear",repeatCount:"indefinite"}),r.createElement("animate",{attributeName:"stroke-opacity",begin:"3s",dur:"3s",values:"1;0",calcMode:"linear",repeatCount:"indefinite"}),r.createElement("animate",{attributeName:"stroke-width",begin:"3s",dur:"3s",values:"2;0",calcMode:"linear",repeatCount:"indefinite"})),r.createElement("circle",{cx:"22",cy:"22",r:"8"},r.createElement("animate",{attributeName:"r",begin:"0s",dur:"1.5s",values:"6;1;2;3;4;5;6",calcMode:"linear",repeatCount:"indefinite"}))))):null}var s=JSON.parse('{"/oauth2-proxy/blog/archive-9ee":{"component":"9e4087bc","archive":"d8b74189"},"/oauth2-proxy/docs/6.1.x-087":{"component":"1be78505","versionMetadata":"be200c4b"},"/oauth2-proxy/docs/6.1.x/-5cb":{"component":"17896441","content":"7b04b1d5"},"/oauth2-proxy/docs/6.1.x/behaviour-f27":{"component":"17896441","content":"42326c77"},"/oauth2-proxy/docs/6.1.x/community/security-fca":{"component":"17896441","content":"ea7cbf6d"},"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider-b14":{"component":"17896441","content":"3def9002"},"/oauth2-proxy/docs/6.1.x/configuration/overview-f3f":{"component":"17896441","content":"ade45c9a"},"/oauth2-proxy/docs/6.1.x/configuration/session_storage-e48":{"component":"17896441","content":"f5839aac"},"/oauth2-proxy/docs/6.1.x/configuration/tls-1ec":{"component":"17896441","content":"a37c03cb"},"/oauth2-proxy/docs/6.1.x/features/endpoints-130":{"component":"17896441","content":"a991188b"},"/oauth2-proxy/docs/6.1.x/features/request_signatures-da5":{"component":"17896441","content":"6f497b56"},"/oauth2-proxy/docs/7.0.x-262":{"component":"1be78505","versionMetadata":"230aeb34"},"/oauth2-proxy/docs/7.0.x/-244":{"component":"17896441","content":"0721a2c0"},"/oauth2-proxy/docs/7.0.x/behaviour-8be":{"component":"17896441","content":"5a047177"},"/oauth2-proxy/docs/7.0.x/community/security-e9b":{"component":"17896441","content":"f4c9d322"},"/oauth2-proxy/docs/7.0.x/configuration/alpha-config-988":{"component":"17896441","content":"3fa022c7"},"/oauth2-proxy/docs/7.0.x/configuration/oauth_provider-43b":{"component":"17896441","content":"7dcecc8d"},"/oauth2-proxy/docs/7.0.x/configuration/overview-1f8":{"component":"17896441","content":"8c826f25"},"/oauth2-proxy/docs/7.0.x/configuration/session_storage-cb8":{"component":"17896441","content":"edfc6e1b"},"/oauth2-proxy/docs/7.0.x/configuration/tls-30b":{"component":"17896441","content":"00691219"},"/oauth2-proxy/docs/7.0.x/features/endpoints-3c2":{"component":"17896441","content":"001ca130"},"/oauth2-proxy/docs/7.0.x/features/request_signatures-494":{"component":"17896441","content":"b89e1cb0"},"/oauth2-proxy/docs/7.1.x-f3e":{"component":"1be78505","versionMetadata":"cecf159a"},"/oauth2-proxy/docs/7.1.x/-735":{"component":"17896441","content":"63d69a63"},"/oauth2-proxy/docs/7.1.x/behaviour-070":{"component":"17896441","content":"41de83de"},"/oauth2-proxy/docs/7.1.x/community/security-702":{"component":"17896441","content":"300a9996"},"/oauth2-proxy/docs/7.1.x/configuration/alpha-config-f0d":{"component":"17896441","content":"243cbd97"},"/oauth2-proxy/docs/7.1.x/configuration/oauth_provider-a58":{"component":"17896441","content":"cbc8963c"},"/oauth2-proxy/docs/7.1.x/configuration/overview-323":{"component":"17896441","content":"92147208"},"/oauth2-proxy/docs/7.1.x/configuration/session_storage-ee0":{"component":"17896441","content":"1999cd7b"},"/oauth2-proxy/docs/7.1.x/configuration/tls-46b":{"component":"17896441","content":"de718920"},"/oauth2-proxy/docs/7.1.x/features/endpoints-3a4":{"component":"17896441","content":"f98fc388"},"/oauth2-proxy/docs/next-932":{"component":"1be78505","versionMetadata":"935f2afb"},"/oauth2-proxy/docs/next/-f81":{"component":"17896441","content":"3b8c55ea"},"/oauth2-proxy/docs/next/behaviour-a17":{"component":"17896441","content":"94285305"},"/oauth2-proxy/docs/next/community/security-54a":{"component":"17896441","content":"35234f08"},"/oauth2-proxy/docs/next/configuration/alpha-config-1f5":{"component":"17896441","content":"cd4a49c1"},"/oauth2-proxy/docs/next/configuration/oauth_provider-dad":{"component":"17896441","content":"357fe94d"},"/oauth2-proxy/docs/next/configuration/overview-252":{"component":"17896441","content":"0f425520"},"/oauth2-proxy/docs/next/configuration/session_storage-08f":{"component":"17896441","content":"9f61b932"},"/oauth2-proxy/docs/next/configuration/tls-411":{"component":"17896441","content":"585bdad0"},"/oauth2-proxy/docs/next/features/endpoints-348":{"component":"17896441","content":"efc9be4b"},"/oauth2-proxy/docs-e47":{"component":"1be78505","versionMetadata":"e8c74efb"},"/oauth2-proxy/docs/-c9e":{"component":"17896441","content":"9ac82b89"},"/oauth2-proxy/docs/behaviour-190":{"component":"17896441","content":"adcdd4d2"},"/oauth2-proxy/docs/community/security-a53":{"component":"17896441","content":"3b8e2d60"},"/oauth2-proxy/docs/configuration/alpha-config-f6e":{"component":"17896441","content":"7874e99f"},"/oauth2-proxy/docs/configuration/oauth_provider-1bb":{"component":"17896441","content":"a1bbfb14"},"/oauth2-proxy/docs/configuration/overview-267":{"component":"17896441","content":"76aee1e9"},"/oauth2-proxy/docs/configuration/session_storage-857":{"component":"17896441","content":"ecc333f0"},"/oauth2-proxy/docs/configuration/tls-a03":{"component":"17896441","content":"9b9cfcc1"},"/oauth2-proxy/docs/features/endpoints-8a9":{"component":"17896441","content":"fb908f49"},"/oauth2-proxy/-4c3":{"component":"1f391b9e","content":"f3976560"}}'),c={"001ca130":[function(){return n.e(4431).then(n.bind(n,1593))},"@site/versioned_docs/version-7.0.x/features/endpoints.md",1593],"00691219":[function(){return n.e(5322).then(n.bind(n,2353))},"@site/versioned_docs/version-7.0.x/configuration/tls.md",2353],"0721a2c0":[function(){return n.e(6760).then(n.bind(n,9603))},"@site/versioned_docs/version-7.0.x/installation.md",9603],"0f425520":[function(){return Promise.all([n.e(532),n.e(7240)]).then(n.bind(n,4826))},"@site/docs/configuration/overview.md",4826],17896441:[function(){return Promise.all([n.e(532),n.e(7918)]).then(n.bind(n,1980))},"@theme/DocItem",1980],"1999cd7b":[function(){return n.e(1898).then(n.bind(n,6485))},"@site/versioned_docs/version-7.1.x/configuration/sessions.md",6485],"1be78505":[function(){return Promise.all([n.e(532),n.e(5897),n.e(9514)]).then(n.bind(n,6756))},"@theme/DocPage",6756],"1f391b9e":[function(){return Promise.all([n.e(532),n.e(5897),n.e(3085)]).then(n.bind(n,6416))},"@theme/MDXPage",6416],"230aeb34":[function(){return n.e(3291).then(n.t.bind(n,7765,19))},"~docs/default/version-7-0-x-metadata-prop-4d1.json",7765],"243cbd97":[function(){return n.e(5845).then(n.bind(n,9780))},"@site/versioned_docs/version-7.1.x/configuration/alpha_config.md",9780],"300a9996":[function(){return n.e(2593).then(n.bind(n,8630))},"@site/versioned_docs/version-7.1.x/community/security.md",8630],"35234f08":[function(){return n.e(2158).then(n.bind(n,7213))},"@site/docs/community/security.md",7213],"357fe94d":[function(){return n.e(9267).then(n.bind(n,3647))},"@site/docs/configuration/auth.md",3647],"3b8c55ea":[function(){return n.e(3217).then(n.bind(n,9803))},"@site/docs/installation.md",9803],"3b8e2d60":[function(){return n.e(7165).then(n.bind(n,2679))},"@site/versioned_docs/version-7.2.x/community/security.md",2679],"3def9002":[function(){return n.e(4189).then(n.bind(n,1693))},"@site/versioned_docs/version-6.1.x/configuration/auth.md",1693],"3fa022c7":[function(){return n.e(8967).then(n.bind(n,2970))},"@site/versioned_docs/version-7.0.x/configuration/alpha_config.md",2970],"41de83de":[function(){return n.e(7250).then(n.bind(n,6239))},"@site/versioned_docs/version-7.1.x/behaviour.md",6239],"42326c77":[function(){return n.e(7595).then(n.bind(n,7327))},"@site/versioned_docs/version-6.1.x/behaviour.md",7327],"585bdad0":[function(){return n.e(8249).then(n.bind(n,6647))},"@site/docs/configuration/tls.md",6647],"5a047177":[function(){return n.e(2598).then(n.bind(n,2846))},"@site/versioned_docs/version-7.0.x/behaviour.md",2846],"63d69a63":[function(){return n.e(7401).then(n.bind(n,6249))},"@site/versioned_docs/version-7.1.x/installation.md",6249],"6f497b56":[function(){return n.e(2114).then(n.bind(n,4925))},"@site/versioned_docs/version-6.1.x/features/request_signatures.md",4925],"76aee1e9":[function(){return Promise.all([n.e(532),n.e(707)]).then(n.bind(n,6104))},"@site/versioned_docs/version-7.2.x/configuration/overview.md",6104],"7874e99f":[function(){return n.e(6482).then(n.bind(n,3615))},"@site/versioned_docs/version-7.2.x/configuration/alpha_config.md",3615],"7b04b1d5":[function(){return n.e(4998).then(n.bind(n,5403))},"@site/versioned_docs/version-6.1.x/installation.md",5403],"7dcecc8d":[function(){return n.e(1351).then(n.bind(n,3310))},"@site/versioned_docs/version-7.0.x/configuration/auth.md",3310],"8c826f25":[function(){return Promise.all([n.e(532),n.e(9890)]).then(n.bind(n,5508))},"@site/versioned_docs/version-7.0.x/configuration/overview.md",5508],92147208:[function(){return n.e(2098).then(n.bind(n,2769))},"@site/versioned_docs/version-7.1.x/configuration/overview.md",2769],"935f2afb":[function(){return n.e(53).then(n.t.bind(n,1109,19))},"~docs/default/version-current-metadata-prop-751.json",1109],94285305:[function(){return n.e(2822).then(n.bind(n,3761))},"@site/docs/behaviour.md",3761],"9ac82b89":[function(){return n.e(2608).then(n.bind(n,8778))},"@site/versioned_docs/version-7.2.x/installation.md",8778],"9b9cfcc1":[function(){return n.e(5410).then(n.bind(n,8954))},"@site/versioned_docs/version-7.2.x/configuration/tls.md",8954],"9e4087bc":[function(){return n.e(3608).then(n.bind(n,3012))},"@theme/BlogArchivePage",3012],"9f61b932":[function(){return n.e(8583).then(n.bind(n,831))},"@site/docs/configuration/sessions.md",831],a1bbfb14:[function(){return n.e(3782).then(n.bind(n,861))},"@site/versioned_docs/version-7.2.x/configuration/auth.md",861],a37c03cb:[function(){return n.e(2871).then(n.bind(n,8291))},"@site/versioned_docs/version-6.1.x/configuration/tls.md",8291],a991188b:[function(){return n.e(9512).then(n.bind(n,7832))},"@site/versioned_docs/version-6.1.x/features/endpoints.md",7832],adcdd4d2:[function(){return n.e(1487).then(n.bind(n,4163))},"@site/versioned_docs/version-7.2.x/behaviour.md",4163],ade45c9a:[function(){return Promise.all([n.e(532),n.e(8447)]).then(n.bind(n,7324))},"@site/versioned_docs/version-6.1.x/configuration/overview.md",7324],b89e1cb0:[function(){return n.e(8873).then(n.bind(n,8706))},"@site/versioned_docs/version-7.0.x/features/request_signatures.md",8706],be200c4b:[function(){return n.e(3358).then(n.t.bind(n,3972,19))},"~docs/default/version-6-1-x-metadata-prop-625.json",3972],cbc8963c:[function(){return n.e(8555).then(n.bind(n,7072))},"@site/versioned_docs/version-7.1.x/configuration/auth.md",7072],cd4a49c1:[function(){return n.e(2439).then(n.bind(n,4044))},"@site/docs/configuration/alpha_config.md",4044],cecf159a:[function(){return n.e(5995).then(n.t.bind(n,6720,19))},"~docs/default/version-7-1-x-metadata-prop-4ab.json",6720],d8b74189:[function(){return n.e(7559).then(n.t.bind(n,9773,19))},"~blog/default/oauth-2-proxy-blog-archive-48b.json",9773],de718920:[function(){return n.e(8338).then(n.bind(n,7772))},"@site/versioned_docs/version-7.1.x/configuration/tls.md",7772],e8c74efb:[function(){return n.e(811).then(n.t.bind(n,275,19))},"~docs/default/version-7-2-x-metadata-prop-080.json",275],ea7cbf6d:[function(){return n.e(5874).then(n.bind(n,754))},"@site/versioned_docs/version-6.1.x/community/security.md",754],ecc333f0:[function(){return n.e(3843).then(n.bind(n,8750))},"@site/versioned_docs/version-7.2.x/configuration/sessions.md",8750],edfc6e1b:[function(){return n.e(8724).then(n.bind(n,5696))},"@site/versioned_docs/version-7.0.x/configuration/sessions.md",5696],efc9be4b:[function(){return n.e(6119).then(n.bind(n,6522))},"@site/docs/features/endpoints.md",6522],f3976560:[function(){return n.e(2844).then(n.bind(n,672))},"@site/src/pages/index.md",672],f4c9d322:[function(){return n.e(4472).then(n.bind(n,6779))},"@site/versioned_docs/version-7.0.x/community/security.md",6779],f5839aac:[function(){return n.e(7826).then(n.bind(n,8782))},"@site/versioned_docs/version-6.1.x/configuration/sessions.md",8782],f98fc388:[function(){return n.e(5437).then(n.bind(n,2018))},"@site/versioned_docs/version-7.1.x/features/endpoints.md",2018],fb908f49:[function(){return n.e(6042).then(n.bind(n,7286))},"@site/versioned_docs/version-7.2.x/features/endpoints.md",7286]};var d=function(e){var t={};return function e(n,r){Object.keys(n).forEach((function(o){var a,i=n[o],l=r?r+"."+o:o;"object"==typeof(a=i)&&a&&Object.keys(a).length>0?e(i,l):t[l]=i}))}(e),t};var f=function(e,t){if("*"===e)return l()({loading:u,loader:function(){return n.e(4608).then(n.bind(n,4608))}});var o=s[e+"-"+t],a=[],i=[],f={},p=d(o);return Object.keys(p).forEach((function(e){var t=c[p[e]];t&&(f[e]=t[0],a.push(t[1]),i.push(t[2]))})),l().Map({loading:u,loader:f,modules:a,webpack:function(){return i},render:function(e,t){var n=JSON.parse(JSON.stringify(o));Object.keys(e).forEach((function(t){for(var r=n,o=t.split("."),a=0;a1?t-1:0),r=1;r\n

Your Docusaurus site did not load properly.

\n

A very common reason is a wrong site baseUrl configuration.

\n

Current configured baseUrl = '+e+" "+("/"===e?" (default value)":"")+'

\n

We suggest trying baseUrl =

\n\n'}(e)).replace(/=0||Object.prototype.hasOwnProperty.call(e,r)&&(n[r]=e[r]);return n},G=function(e,t){if(!e)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return!t||"object"!=typeof t&&"function"!=typeof t?e:t},H=function(e){var t=!(arguments.length>1&&void 0!==arguments[1])||arguments[1];return!1===t?String(e):String(e).replace(/&/g,"&").replace(//g,">").replace(/"/g,""").replace(/'/g,"'")},V=function(e){var t=X(e,y.TITLE),n=X(e,M);if(n&&t)return n.replace(/%s/g,(function(){return Array.isArray(t)?t.join(""):t}));var r=X(e,N);return t||r||void 0},W=function(e){return X(e,I)||function(){}},K=function(e,t){return t.filter((function(t){return void 0!==t[e]})).map((function(t){return t[e]})).reduce((function(e,t){return q({},e,t)}),{})},Y=function(e,t){return t.filter((function(e){return void 0!==e[y.BASE]})).map((function(e){return e[y.BASE]})).reverse().reduce((function(t,n){if(!t.length)for(var r=Object.keys(n),o=0;o=0;n--){var r=e[n];if(r.hasOwnProperty(t))return r[t]}return null},J=(r=Date.now(),function(e){var t=Date.now();t-r>16?(r=t,e(t)):setTimeout((function(){J(e)}),0)}),ee=function(e){return clearTimeout(e)},te="undefined"!=typeof window?window.requestAnimationFrame&&window.requestAnimationFrame.bind(window)||window.webkitRequestAnimationFrame||window.mozRequestAnimationFrame||J:n.g.requestAnimationFrame||J,ne="undefined"!=typeof window?window.cancelAnimationFrame||window.webkitCancelAnimationFrame||window.mozCancelAnimationFrame||ee:n.g.cancelAnimationFrame||ee,re=function(e){return console&&"function"==typeof console.warn&&console.warn(e)},oe=null,ae=function(e,t){var n=e.baseTag,r=e.bodyAttributes,o=e.htmlAttributes,a=e.linkTags,i=e.metaTags,l=e.noscriptTags,u=e.onChangeClientState,s=e.scriptTags,c=e.styleTags,d=e.title,f=e.titleAttributes;ue(y.BODY,r),ue(y.HTML,o),le(d,f);var p={baseTag:se(y.BASE,n),linkTags:se(y.LINK,a),metaTags:se(y.META,i),noscriptTags:se(y.NOSCRIPT,l),scriptTags:se(y.SCRIPT,s),styleTags:se(y.STYLE,c)},m={},h={};Object.keys(p).forEach((function(e){var t=p[e],n=t.newTags,r=t.oldTags;n.length&&(m[e]=n),r.length&&(h[e]=p[e].oldTags)})),t&&t(),u(e,m,h)},ie=function(e){return Array.isArray(e)?e.join(""):e},le=function(e,t){void 0!==e&&document.title!==e&&(document.title=ie(e)),ue(y.TITLE,t)},ue=function(e,t){var n=document.getElementsByTagName(e)[0];if(n){for(var r=n.getAttribute(B),o=r?r.split(","):[],a=[].concat(o),i=Object.keys(t),l=0;l=0;d--)n.removeAttribute(a[d]);o.length===a.length?n.removeAttribute(B):n.getAttribute(B)!==i.join(",")&&n.setAttribute(B,i.join(","))}},se=function(e,t){var n=document.head||document.querySelector(y.HEAD),r=n.querySelectorAll(e+"["+"data-react-helmet]"),o=Array.prototype.slice.call(r),a=[],i=void 0;return t&&t.length&&t.forEach((function(t){var n=document.createElement(e);for(var r in t)if(t.hasOwnProperty(r))if(r===S)n.innerHTML=t.innerHTML;else if(r===x)n.styleSheet?n.styleSheet.cssText=t.cssText:n.appendChild(document.createTextNode(t.cssText));else{var l=void 0===t[r]?"":t[r];n.setAttribute(r,l)}n.setAttribute(B,"true"),o.some((function(e,t){return i=t,n.isEqualNode(e)}))?o.splice(i,1):a.push(n)})),o.forEach((function(e){return e.parentNode.removeChild(e)})),a.forEach((function(e){return n.appendChild(e)})),{oldTags:o,newTags:a}},ce=function(e){return Object.keys(e).reduce((function(t,n){var r=void 0!==e[n]?n+'="'+e[n]+'"':""+n;return t?t+" "+r:r}),"")},de=function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};return Object.keys(e).reduce((function(t,n){return t[R[n]||n]=e[n],t}),t)},fe=function(e,t,n){switch(e){case y.TITLE:return{toComponent:function(){return e=t.title,n=t.titleAttributes,(r={key:e})[B]=!0,o=de(n,r),[l.createElement(y.TITLE,o,e)];var e,n,r,o},toString:function(){return function(e,t,n,r){var o=ce(n),a=ie(t);return o?"<"+e+' data-react-helmet="true" '+o+">"+H(a,r)+"":"<"+e+' data-react-helmet="true">'+H(a,r)+""}(e,t.title,t.titleAttributes,n)}};case g:case v:return{toComponent:function(){return de(t)},toString:function(){return ce(t)}};default:return{toComponent:function(){return function(e,t){return t.map((function(t,n){var r,o=((r={key:n})[B]=!0,r);return Object.keys(t).forEach((function(e){var n=R[e]||e;if(n===S||n===x){var r=t.innerHTML||t.cssText;o.dangerouslySetInnerHTML={__html:r}}else o[n]=t[e]})),l.createElement(e,o)}))}(e,t)},toString:function(){return function(e,t,n){return t.reduce((function(t,r){var o=Object.keys(r).filter((function(e){return!(e===S||e===x)})).reduce((function(e,t){var o=void 0===r[t]?t:t+'="'+H(r[t],n)+'"';return e?e+" "+o:o}),""),a=r.innerHTML||r.cssText||"",i=-1===j.indexOf(e);return t+"<"+e+' data-react-helmet="true" '+o+(i?"/>":">"+a+"")}),"")}(e,t,n)}}}},pe=function(e){var t=e.baseTag,n=e.bodyAttributes,r=e.encode,o=e.htmlAttributes,a=e.linkTags,i=e.metaTags,l=e.noscriptTags,u=e.scriptTags,s=e.styleTags,c=e.title,d=void 0===c?"":c,f=e.titleAttributes;return{base:fe(y.BASE,t,r),bodyAttributes:fe(g,n,r),htmlAttributes:fe(v,o,r),link:fe(y.LINK,a,r),meta:fe(y.META,i,r),noscript:fe(y.NOSCRIPT,l,r),script:fe(y.SCRIPT,u,r),style:fe(y.STYLE,s,r),title:fe(y.TITLE,{title:d,titleAttributes:f},r)}},me=d()((function(e){return{baseTag:Y([k,O],e),bodyAttributes:K(g,e),defer:X(e,L),encode:X(e,D),htmlAttributes:K(v,e),linkTags:Q(y.LINK,[A,k],e),metaTags:Q(y.META,[_,w,E,C,T],e),noscriptTags:Q(y.NOSCRIPT,[S],e),onChangeClientState:W(e),scriptTags:Q(y.SCRIPT,[P,S],e),styleTags:Q(y.STYLE,[x],e),title:V(e),titleAttributes:K(b,e)}}),(function(e){oe&&ne(oe),e.defer?oe=te((function(){ae(e,(function(){oe=null}))})):(ae(e),oe=null)}),pe)((function(){return null})),he=(o=me,i=a=function(e){function t(){return z(this,t),G(this,e.apply(this,arguments))}return function(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Super expression must either be null or a function, not "+typeof t);e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,enumerable:!1,writable:!0,configurable:!0}}),t&&(Object.setPrototypeOf?Object.setPrototypeOf(e,t):e.__proto__=t)}(t,e),t.prototype.shouldComponentUpdate=function(e){return!p()(this.props,e)},t.prototype.mapNestedChildrenToProps=function(e,t){if(!t)return null;switch(e.type){case y.SCRIPT:case y.NOSCRIPT:return{innerHTML:t};case y.STYLE:return{cssText:t}}throw new Error("<"+e.type+" /> elements are self-closing and can not contain children. Refer to our API for more information.")},t.prototype.flattenArrayTypeChildren=function(e){var t,n=e.child,r=e.arrayTypeChildren,o=e.newChildProps,a=e.nestedChildren;return q({},r,((t={})[n.type]=[].concat(r[n.type]||[],[q({},o,this.mapNestedChildrenToProps(n,a))]),t))},t.prototype.mapObjectTypeChildren=function(e){var t,n,r=e.child,o=e.newProps,a=e.newChildProps,i=e.nestedChildren;switch(r.type){case y.TITLE:return q({},o,((t={})[r.type]=i,t.titleAttributes=q({},a),t));case y.BODY:return q({},o,{bodyAttributes:q({},a)});case y.HTML:return q({},o,{htmlAttributes:q({},a)})}return q({},o,((n={})[r.type]=q({},a),n))},t.prototype.mapArrayTypeChildrenToProps=function(e,t){var n=q({},t);return Object.keys(e).forEach((function(t){var r;n=q({},n,((r={})[t]=e[t],r))})),n},t.prototype.warnOnInvalidChildren=function(e,t){return!0},t.prototype.mapChildrenToProps=function(e,t){var n=this,r={};return l.Children.forEach(e,(function(e){if(e&&e.props){var o=e.props,a=o.children,i=function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};return Object.keys(e).reduce((function(t,n){return t[F[n]||n]=e[n],t}),t)}($(o,["children"]));switch(n.warnOnInvalidChildren(e,a),e.type){case y.LINK:case y.META:case y.NOSCRIPT:case y.SCRIPT:case y.STYLE:r=n.flattenArrayTypeChildren({child:e,arrayTypeChildren:r,newChildProps:i,nestedChildren:a});break;default:t=n.mapObjectTypeChildren({child:e,newProps:t,newChildProps:i,nestedChildren:a})}}})),t=this.mapArrayTypeChildrenToProps(r,t)},t.prototype.render=function(){var e=this.props,t=e.children,n=$(e,["children"]),r=q({},n);return t&&(r=this.mapChildrenToProps(t,r)),l.createElement(o,r)},Z(t,null,[{key:"canUseDOM",set:function(e){o.canUseDOM=e}}]),t}(l.Component),a.propTypes={base:s().object,bodyAttributes:s().object,children:s().oneOfType([s().arrayOf(s().node),s().node]),defaultTitle:s().string,defer:s().bool,encodeSpecialCharacters:s().bool,htmlAttributes:s().object,link:s().arrayOf(s().object),meta:s().arrayOf(s().object),noscript:s().arrayOf(s().object),onChangeClientState:s().func,script:s().arrayOf(s().object),style:s().arrayOf(s().object),title:s().string,titleAttributes:s().object,titleTemplate:s().string},a.defaultProps={defer:!0,encodeSpecialCharacters:!0},a.peek=o.peek,a.rewind=function(){var e=o.rewind();return e||(e=pe({baseTag:[],bodyAttributes:{},encodeSpecialCharacters:!0,htmlAttributes:{},linkTags:[],metaTags:[],noscriptTags:[],scriptTags:[],styleTags:[],title:"",titleAttributes:{}})),e},i);he.renderStatic=he.rewind;var ge=function(e){return l.createElement(he,Object.assign({},e))}},9960:function(e,t,n){"use strict";n.d(t,{Z:function(){return p}});var r=n(3366),o=n(7294),a=n(3727),i=n(2263),l=n(3919),u=n(412),s=(0,o.createContext)({collectLink:function(){}});var c=n(4996),d=n(8780),f=["isNavLink","to","href","activeClassName","isActive","data-noBrokenLinkCheck","autoAddBaseUrl"];var p=function(e){var t,n,p=e.isNavLink,m=e.to,h=e.href,g=e.activeClassName,v=e.isActive,b=e["data-noBrokenLinkCheck"],y=e.autoAddBaseUrl,w=void 0===y||y,x=(0,r.Z)(e,f),k=(0,i.Z)().siteConfig,E=k.trailingSlash,S=k.baseUrl,T=(0,c.C)().withBaseUrl,_=(0,o.useContext)(s),C=m||h,A=(0,l.Z)(C),P=null==C?void 0:C.replace("pathname://",""),O=void 0!==P?(n=P,w&&function(e){return e.startsWith("/")}(n)?T(n):n):void 0;O&&A&&(O=(0,d.applyTrailingSlash)(O,{trailingSlash:E,baseUrl:S}));var R=(0,o.useRef)(!1),N=p?a.OL:a.rU,L=u.Z.canUseIntersectionObserver,D=(0,o.useRef)();(0,o.useEffect)((function(){return!L&&A&&null!=O&&window.docusaurus.prefetch(O),function(){L&&D.current&&D.current.disconnect()}}),[D,O,L,A]);var I=null!==(t=null==O?void 0:O.startsWith("#"))&&void 0!==t&&t,M=!O||!A||I;return O&&A&&!I&&!b&&_.collectLink(O),M?o.createElement("a",Object.assign({href:O},C&&!A&&{target:"_blank",rel:"noopener noreferrer"},x)):o.createElement(N,Object.assign({},x,{onMouseEnter:function(){R.current||null==O||(window.docusaurus.preload(O),R.current=!0)},innerRef:function(e){var t,n;L&&e&&A&&(t=e,n=function(){null!=O&&window.docusaurus.prefetch(O)},D.current=new window.IntersectionObserver((function(e){e.forEach((function(e){t===e.target&&(e.isIntersecting||e.intersectionRatio>0)&&(D.current.unobserve(t),D.current.disconnect(),n())}))})),D.current.observe(t))},to:O||""},p&&{isActive:v,activeClassName:g}))}},1875:function(e,t){"use strict";t.Z=function(){return null}},5999:function(e,t,n){"use strict";n.d(t,{Z:function(){return c},I:function(){return s}});var r=n(7294),o=/{\w+}/g,a="{}";function i(e,t){var n=[],i=e.replace(o,(function(e){var o=e.substring(1,e.length-1),i=null==t?void 0:t[o];if(void 0!==i){var l=r.isValidElement(i)?i:String(i);return n.push(l),a}return e}));return 0===n.length?e:n.every((function(e){return"string"==typeof e}))?i.split(a).reduce((function(e,t,r){var o;return e.concat(t).concat(null!==(o=n[r])&&void 0!==o?o:"")}),""):i.split(a).reduce((function(e,t,o){return[].concat(e,[r.createElement(r.Fragment,{key:o},t,n[o])])}),[])}var l=n(7529);function u(e){var t,n,r=e.id,o=e.message;if(void 0===r&&void 0===o)throw new Error("Docusaurus translation declarations must have at least a translation id or a default translation message");return null!==(n=null!==(t=l[null!=r?r:o])&&void 0!==t?t:o)&&void 0!==n?n:r}function s(e,t){return i(u({message:e.message,id:e.id}),t)}function c(e){var t=e.children,n=e.id,r=e.values;if(t&&"string"!=typeof t)throw console.warn("Illegal children",t),new Error("The Docusaurus component only accept simple string values");return i(u({message:t,id:n}),r)}},9913:function(e,t,n){"use strict";n.d(t,{_:function(){return o},t:function(){return a}});var r=n(7294),o=r.createContext(!1);function a(e){var t=e.children,n=(0,r.useState)(!1),a=n[0],i=n[1];return(0,r.useEffect)((function(){i(!0)}),[]),r.createElement(o.Provider,{value:a},t)}},9935:function(e,t,n){"use strict";n.d(t,{m:function(){return r}});var r="default"},7041:function(e,t,n){"use strict";n.d(t,{_:function(){return c},M:function(){return d}});var r=n(7294),o=n(9782),a=JSON.parse('{"docusaurus-plugin-content-docs":{"default":{"path":"/oauth2-proxy/docs","versions":[{"name":"current","label":"Next","isLast":false,"path":"/oauth2-proxy/docs/next","mainDocId":"installation","docs":[{"id":"behaviour","path":"/oauth2-proxy/docs/next/behaviour","sidebar":"docs"},{"id":"community/security","path":"/oauth2-proxy/docs/next/community/security","sidebar":"docs"},{"id":"configuration/alpha-config","path":"/oauth2-proxy/docs/next/configuration/alpha-config","sidebar":"docs"},{"id":"configuration/oauth_provider","path":"/oauth2-proxy/docs/next/configuration/oauth_provider","sidebar":"docs"},{"id":"configuration/overview","path":"/oauth2-proxy/docs/next/configuration/overview","sidebar":"docs"},{"id":"configuration/session_storage","path":"/oauth2-proxy/docs/next/configuration/session_storage","sidebar":"docs"},{"id":"configuration/tls","path":"/oauth2-proxy/docs/next/configuration/tls","sidebar":"docs"},{"id":"features/endpoints","path":"/oauth2-proxy/docs/next/features/endpoints","sidebar":"docs"},{"id":"installation","path":"/oauth2-proxy/docs/next/","sidebar":"docs"}],"sidebars":{"docs":{"link":{"path":"/oauth2-proxy/docs/next/","label":"installation"}}}},{"name":"7.2.x","label":"7.2.x","isLast":true,"path":"/oauth2-proxy/docs","mainDocId":"installation","docs":[{"id":"behaviour","path":"/oauth2-proxy/docs/behaviour","sidebar":"version-7.2.x/docs"},{"id":"community/security","path":"/oauth2-proxy/docs/community/security","sidebar":"version-7.2.x/docs"},{"id":"configuration/alpha-config","path":"/oauth2-proxy/docs/configuration/alpha-config","sidebar":"version-7.2.x/docs"},{"id":"configuration/oauth_provider","path":"/oauth2-proxy/docs/configuration/oauth_provider","sidebar":"version-7.2.x/docs"},{"id":"configuration/overview","path":"/oauth2-proxy/docs/configuration/overview","sidebar":"version-7.2.x/docs"},{"id":"configuration/session_storage","path":"/oauth2-proxy/docs/configuration/session_storage","sidebar":"version-7.2.x/docs"},{"id":"configuration/tls","path":"/oauth2-proxy/docs/configuration/tls","sidebar":"version-7.2.x/docs"},{"id":"features/endpoints","path":"/oauth2-proxy/docs/features/endpoints","sidebar":"version-7.2.x/docs"},{"id":"installation","path":"/oauth2-proxy/docs/","sidebar":"version-7.2.x/docs"}],"sidebars":{"version-7.2.x/docs":{"link":{"path":"/oauth2-proxy/docs/","label":"version-7.2.x/installation"}}}},{"name":"7.1.x","label":"7.1.x","isLast":false,"path":"/oauth2-proxy/docs/7.1.x","mainDocId":"installation","docs":[{"id":"behaviour","path":"/oauth2-proxy/docs/7.1.x/behaviour","sidebar":"version-7.1.x/docs"},{"id":"community/security","path":"/oauth2-proxy/docs/7.1.x/community/security","sidebar":"version-7.1.x/docs"},{"id":"configuration/alpha-config","path":"/oauth2-proxy/docs/7.1.x/configuration/alpha-config","sidebar":"version-7.1.x/docs"},{"id":"configuration/oauth_provider","path":"/oauth2-proxy/docs/7.1.x/configuration/oauth_provider","sidebar":"version-7.1.x/docs"},{"id":"configuration/overview","path":"/oauth2-proxy/docs/7.1.x/configuration/overview","sidebar":"version-7.1.x/docs"},{"id":"configuration/session_storage","path":"/oauth2-proxy/docs/7.1.x/configuration/session_storage","sidebar":"version-7.1.x/docs"},{"id":"configuration/tls","path":"/oauth2-proxy/docs/7.1.x/configuration/tls","sidebar":"version-7.1.x/docs"},{"id":"features/endpoints","path":"/oauth2-proxy/docs/7.1.x/features/endpoints","sidebar":"version-7.1.x/docs"},{"id":"installation","path":"/oauth2-proxy/docs/7.1.x/","sidebar":"version-7.1.x/docs"}],"sidebars":{"version-7.1.x/docs":{"link":{"path":"/oauth2-proxy/docs/7.1.x/","label":"version-7.1.x/installation"}}}},{"name":"7.0.x","label":"7.0.x","isLast":false,"path":"/oauth2-proxy/docs/7.0.x","mainDocId":"installation","docs":[{"id":"behaviour","path":"/oauth2-proxy/docs/7.0.x/behaviour","sidebar":"version-7.0.x/docs"},{"id":"community/security","path":"/oauth2-proxy/docs/7.0.x/community/security","sidebar":"version-7.0.x/docs"},{"id":"configuration/alpha-config","path":"/oauth2-proxy/docs/7.0.x/configuration/alpha-config","sidebar":"version-7.0.x/docs"},{"id":"configuration/oauth_provider","path":"/oauth2-proxy/docs/7.0.x/configuration/oauth_provider","sidebar":"version-7.0.x/docs"},{"id":"configuration/overview","path":"/oauth2-proxy/docs/7.0.x/configuration/overview","sidebar":"version-7.0.x/docs"},{"id":"configuration/session_storage","path":"/oauth2-proxy/docs/7.0.x/configuration/session_storage","sidebar":"version-7.0.x/docs"},{"id":"configuration/tls","path":"/oauth2-proxy/docs/7.0.x/configuration/tls","sidebar":"version-7.0.x/docs"},{"id":"features/endpoints","path":"/oauth2-proxy/docs/7.0.x/features/endpoints","sidebar":"version-7.0.x/docs"},{"id":"features/request_signatures","path":"/oauth2-proxy/docs/7.0.x/features/request_signatures","sidebar":"version-7.0.x/docs"},{"id":"installation","path":"/oauth2-proxy/docs/7.0.x/","sidebar":"version-7.0.x/docs"}],"sidebars":{"version-7.0.x/docs":{"link":{"path":"/oauth2-proxy/docs/7.0.x/","label":"version-7.0.x/installation"}}}},{"name":"6.1.x","label":"6.1.x","isLast":false,"path":"/oauth2-proxy/docs/6.1.x","mainDocId":"installation","docs":[{"id":"behaviour","path":"/oauth2-proxy/docs/6.1.x/behaviour","sidebar":"version-6.1.x/docs"},{"id":"community/security","path":"/oauth2-proxy/docs/6.1.x/community/security","sidebar":"version-6.1.x/docs"},{"id":"configuration/oauth_provider","path":"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider","sidebar":"version-6.1.x/docs"},{"id":"configuration/overview","path":"/oauth2-proxy/docs/6.1.x/configuration/overview","sidebar":"version-6.1.x/docs"},{"id":"configuration/session_storage","path":"/oauth2-proxy/docs/6.1.x/configuration/session_storage","sidebar":"version-6.1.x/docs"},{"id":"configuration/tls","path":"/oauth2-proxy/docs/6.1.x/configuration/tls","sidebar":"version-6.1.x/docs"},{"id":"features/endpoints","path":"/oauth2-proxy/docs/6.1.x/features/endpoints","sidebar":"version-6.1.x/docs"},{"id":"features/request_signatures","path":"/oauth2-proxy/docs/6.1.x/features/request_signatures","sidebar":"version-6.1.x/docs"},{"id":"installation","path":"/oauth2-proxy/docs/6.1.x/","sidebar":"version-6.1.x/docs"}],"sidebars":{"version-6.1.x/docs":{"link":{"path":"/oauth2-proxy/docs/6.1.x/","label":"version-6.1.x/installation"}}}}]}}}'),i=JSON.parse('{"defaultLocale":"en","locales":["en"],"currentLocale":"en","localeConfigs":{"en":{"label":"English","direction":"ltr","htmlLang":"en"}}}'),l=n(7529),u=JSON.parse('{"docusaurusVersion":"2.0.0-beta.15","siteVersion":"0.0.0","pluginVersions":{"docusaurus-plugin-content-docs":{"type":"package","name":"@docusaurus/plugin-content-docs","version":"2.0.0-beta.15"},"docusaurus-plugin-content-blog":{"type":"package","name":"@docusaurus/plugin-content-blog","version":"2.0.0-beta.15"},"docusaurus-plugin-content-pages":{"type":"package","name":"@docusaurus/plugin-content-pages","version":"2.0.0-beta.15"},"docusaurus-plugin-sitemap":{"type":"package","name":"@docusaurus/plugin-sitemap","version":"2.0.0-beta.15"},"docusaurus-theme-classic":{"type":"package","name":"@docusaurus/theme-classic","version":"2.0.0-beta.15"}}}'),s={siteConfig:o.Z,siteMetadata:u,globalData:a,i18n:i,codeTranslations:l},c=r.createContext(s);function d(e){var t=e.children;return r.createElement(c.Provider,{value:s},t)}},3919:function(e,t,n){"use strict";function r(e){return!0===/^(\w*:|\/\/)/.test(e)}function o(e){return void 0!==e&&!r(e)}n.d(t,{b:function(){return r},Z:function(){return o}})},6291:function(e,t,n){"use strict";var r=n(8790);t.Z=r.H},8143:function(e,t,n){"use strict";n.r(t),n.d(t,{BrowserRouter:function(){return r.VK},HashRouter:function(){return r.UT},Link:function(){return r.rU},MemoryRouter:function(){return r.VA},NavLink:function(){return r.OL},Prompt:function(){return r.NL},Redirect:function(){return r.l_},Route:function(){return r.AW},Router:function(){return r.F0},StaticRouter:function(){return r.gx},Switch:function(){return r.rs},generatePath:function(){return r.Gn},matchPath:function(){return r.LX},useHistory:function(){return r.k6},useLocation:function(){return r.TH},useParams:function(){return r.UO},useRouteMatch:function(){return r.$B},withRouter:function(){return r.EN}});var r=n(3727)},4996:function(e,t,n){"use strict";n.d(t,{C:function(){return a},Z:function(){return i}});var r=n(2263),o=n(3919);function a(){var e=(0,r.Z)().siteConfig,t=e.baseUrl,n=e.url;return{withBaseUrl:function(e,r){return function(e,t,n,r){var a=void 0===r?{}:r,i=a.forcePrependBaseUrl,l=void 0!==i&&i,u=a.absolute,s=void 0!==u&&u;if(!n)return n;if(n.startsWith("#"))return n;if((0,o.b)(n))return n;if(l)return t+n.replace(/^\//,"");var c=n.startsWith(t)?n:t+n.replace(/^\//,"");return s?e+c:c}(n,t,e,r)}}}function i(e,t){return void 0===t&&(t={}),(0,a().withBaseUrl)(e,t)}},2263:function(e,t,n){"use strict";var r=n(7294),o=n(7041);t.Z=function(){return(0,r.useContext)(o._)}},8084:function(e,t,n){"use strict";n.r(t),n.d(t,{default:function(){return a},useAllPluginInstancesData:function(){return i},usePluginData:function(){return l}});var r=n(2263),o=n(9935);function a(){var e=(0,r.Z)().globalData;if(!e)throw new Error("Docusaurus global data not found.");return e}function i(e){var t=a()[e];if(!t)throw new Error('Docusaurus plugin global data not found for "'+e+'" plugin.');return t}function l(e,t){void 0===t&&(t=o.m);var n=i(e)[t];if(!n)throw new Error('Docusaurus plugin global data not found for "'+e+'" plugin with id "'+t+'".');return n}},2389:function(e,t,n){"use strict";n.d(t,{Z:function(){return a}});var r=n(7294),o=n(9913);function a(){return(0,r.useContext)(o._)}},4953:function(e,t,n){"use strict";var r=n(7294),o=n(2434),a=n(780);function i(e){var t=e.error,n=e.tryAgain;return r.createElement("div",{style:{display:"flex",flexDirection:"column",justifyContent:"center",alignItems:"center",height:"50vh",width:"100%",fontSize:"20px"}},r.createElement("h1",null,"This page crashed."),r.createElement("p",null,t.message),r.createElement("button",{type:"button",onClick:n},"Try again"))}t.Z=function(e){var t=e.error,n=e.tryAgain;return r.createElement(a.Z,{fallback:function(){return r.createElement(i,{error:t,tryAgain:n})}},r.createElement(o.Z,{title:"Page Error"},r.createElement(i,{error:t,tryAgain:n})))}},8408:function(e,t,n){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.getDocVersionSuggestions=t.getActiveDocContext=t.getActiveVersion=t.getLatestVersion=t.getActivePlugin=void 0;var r=n(8143);t.getActivePlugin=function(e,t,n){void 0===n&&(n={});var o=Object.entries(e).sort((function(e,t){return t[1].path.localeCompare(e[1].path)})).find((function(e){var n=e[1];return!!(0,r.matchPath)(t,{path:n.path,exact:!1,strict:!1})})),a=o?{pluginId:o[0],pluginData:o[1]}:void 0;if(!a&&n.failfast)throw new Error("Can't find active docs plugin for \""+t+'" pathname, while it was expected to be found. Maybe you tried to use a docs feature that can only be used on a docs-related page? Existing docs plugin paths are: '+Object.values(e).map((function(e){return e.path})).join(", "));return a};t.getLatestVersion=function(e){return e.versions.find((function(e){return e.isLast}))};t.getActiveVersion=function(e,n){var o=(0,t.getLatestVersion)(e);return[].concat(e.versions.filter((function(e){return e!==o})),[o]).find((function(e){return!!(0,r.matchPath)(n,{path:e.path,exact:!1,strict:!1})}))};t.getActiveDocContext=function(e,n){var o,a,i=(0,t.getActiveVersion)(e,n),l=null==i?void 0:i.docs.find((function(e){return!!(0,r.matchPath)(n,{path:e.path,exact:!0,strict:!1})}));return{activeVersion:i,activeDoc:l,alternateDocVersions:l?(o=l.id,a={},e.versions.forEach((function(e){e.docs.forEach((function(t){t.id===o&&(a[e.name]=t)}))})),a):{}}};t.getDocVersionSuggestions=function(e,n){var r=(0,t.getLatestVersion)(e),o=(0,t.getActiveDocContext)(e,n);return{latestDocSuggestion:null==o?void 0:o.alternateDocVersions[r.name],latestVersionSuggestion:r}}},7608:function(e,t,n){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.useDocVersionSuggestions=t.useActiveDocContext=t.useActiveVersion=t.useLatestVersion=t.useVersions=t.useActivePluginAndVersion=t.useActivePlugin=t.useDocsData=t.useAllDocsData=void 0;var r=n(9767),o=n(8143),a=(0,r.__importStar)(n(8084)),i=n(8408),l={};t.useAllDocsData=function(){var e;return null!==(e=(0,a.default)()["docusaurus-plugin-content-docs"])&&void 0!==e?e:l};t.useDocsData=function(e){return(0,a.usePluginData)("docusaurus-plugin-content-docs",e)};t.useActivePlugin=function(e){void 0===e&&(e={});var n=(0,t.useAllDocsData)(),r=(0,o.useLocation)().pathname;return(0,i.getActivePlugin)(n,r,e)};t.useActivePluginAndVersion=function(e){void 0===e&&(e={});var n=(0,t.useActivePlugin)(e),r=(0,o.useLocation)().pathname;if(n)return{activePlugin:n,activeVersion:(0,i.getActiveVersion)(n.pluginData,r)}};t.useVersions=function(e){return(0,t.useDocsData)(e).versions};t.useLatestVersion=function(e){var n=(0,t.useDocsData)(e);return(0,i.getLatestVersion)(n)};t.useActiveVersion=function(e){var n=(0,t.useDocsData)(e),r=(0,o.useLocation)().pathname;return(0,i.getActiveVersion)(n,r)};t.useActiveDocContext=function(e){var n=(0,t.useDocsData)(e),r=(0,o.useLocation)().pathname;return(0,i.getActiveDocContext)(n,r)};t.useDocVersionSuggestions=function(e){var n=(0,t.useDocsData)(e),r=(0,o.useLocation)().pathname;return(0,i.getDocVersionSuggestions)(n,r)}},5551:function(e,t,n){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),(0,n(9767).__exportStar)(n(7608),t)},541:function(e,t,n){"use strict";n.d(t,{Z:function(){return a}});var r=n(7294),o="iconExternalLink_I5OW";var a=function(e){var t=e.width,n=void 0===t?13.5:t,a=e.height,i=void 0===a?13.5:a;return r.createElement("svg",{width:n,height:i,"aria-hidden":"true",viewBox:"0 0 24 24",className:o},r.createElement("path",{fill:"currentColor",d:"M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"}))}},2434:function(e,t,n){"use strict";n.d(t,{Z:function(){return me}});var r=n(7294),o=n(6010),a=n(780),i=n(6775),l=n(5999),u=n(9548),s="skipToContent_ZgBM";function c(e){e.setAttribute("tabindex","-1"),e.focus(),e.removeAttribute("tabindex")}var d=function(){var e=(0,r.useRef)(null),t=(0,i.k6)().action;return(0,u.SL)((function(n){var r=n.location;e.current&&!r.hash&&"PUSH"===t&&c(e.current)})),r.createElement("div",{ref:e,role:"region"},r.createElement("a",{href:"#",className:s,onClick:function(e){e.preventDefault();var t=document.querySelector("main:first-of-type")||document.querySelector(".main-wrapper");t&&c(t)}},r.createElement(l.Z,{id:"theme.common.skipToMainContent",description:"The skip to content label used for accessibility, allowing to rapidly navigate to main content with keyboard tab/enter navigation"},"Skip to main content")))},f=n(7462),p=n(3366),m=["width","height","color","strokeWidth","className"];function h(e){var t=e.width,n=void 0===t?21:t,o=e.height,a=void 0===o?21:o,i=e.color,l=void 0===i?"currentColor":i,u=e.strokeWidth,s=void 0===u?1.2:u,c=(e.className,(0,p.Z)(e,m));return r.createElement("svg",(0,f.Z)({viewBox:"0 0 15 15",width:n,height:a},c),r.createElement("g",{stroke:l,strokeWidth:s},r.createElement("path",{d:"M.75.75l13.5 13.5M14.25.75L.75 14.25"})))}var g="announcementBar_IbjG",v="announcementBarPlaceholder_NC_W",b="announcementBarClose_FG1z",y="announcementBarContent_KsVm";var w=function(){var e=(0,u.nT)(),t=e.isActive,n=e.close,a=(0,u.LU)().announcementBar;if(!t)return null;var i=a.content,s=a.backgroundColor,c=a.textColor,d=a.isCloseable;return r.createElement("div",{className:g,style:{backgroundColor:s,color:c},role:"banner"},d&&r.createElement("div",{className:v}),r.createElement("div",{className:y,dangerouslySetInnerHTML:{__html:i}}),d?r.createElement("button",{type:"button",className:(0,o.Z)("clean-btn close",b),onClick:n,"aria-label":(0,l.I)({id:"theme.AnnouncementBar.closeButtonAriaLabel",message:"Close",description:"The ARIA label for close button of announcement bar"})},r.createElement(h,{width:14,height:14,strokeWidth:3.1})):null)},x=n(1875),k=n(2389),E="toggle_Pssr",S="toggleScreenReader_JnkT",T="toggleDisabled_jDku",_="toggleTrack_SSoT",C="toggleTrackCheck_XobZ",A="toggleChecked_cnQY",P="toggleTrackX_YkSC",O="toggleTrackThumb_uRm4",R="toggleFocused_A7DC",N="toggleIcon_eZtF",L=(0,r.memo)((function(e){var t,n=e.className,a=e.switchConfig,i=e.checked,l=e.disabled,u=e.onChange,s=a.darkIcon,c=a.darkIconStyle,d=a.lightIcon,f=a.lightIconStyle,p=(0,r.useState)(i),m=p[0],h=p[1],g=(0,r.useState)(!1),v=g[0],b=g[1],y=(0,r.useRef)(null);return r.createElement("div",{className:(0,o.Z)(E,n,(t={},t[A]=m,t[R]=v,t[T]=l,t))},r.createElement("div",{className:_,role:"button",tabIndex:-1,onClick:function(){var e;return null==(e=y.current)?void 0:e.click()}},r.createElement("div",{className:C},r.createElement("span",{className:N,style:c},s)),r.createElement("div",{className:P},r.createElement("span",{className:N,style:f},d)),r.createElement("div",{className:O})),r.createElement("input",{ref:y,checked:m,type:"checkbox",className:S,"aria-label":"Switch between dark and light mode",onChange:u,onClick:function(){return h(!m)},onFocus:function(){return b(!0)},onBlur:function(){return b(!1)},onKeyDown:function(e){var t;"Enter"===e.key&&(null==(t=y.current)||t.click())}}))}));function D(e){var t=(0,u.LU)().colorMode.switchConfig,n=(0,k.Z)();return r.createElement(L,(0,f.Z)({switchConfig:t,disabled:!n},e))}var I=n(5551),M=n(2207),F=n(5537),j=["width","height","className"];var B=function(e){var t=e.width,n=void 0===t?30:t,o=e.height,a=void 0===o?30:o,i=e.className,l=(0,p.Z)(e,j);return r.createElement("svg",(0,f.Z)({className:i,width:n,height:a,viewBox:"0 0 30 30","aria-hidden":"true"},l),r.createElement("path",{stroke:"currentColor",strokeLinecap:"round",strokeMiterlimit:"10",strokeWidth:"2",d:"M4 7h22M4 15h22M4 23h22"}))},U={toggle:"toggle_TdHA",navbarHideable:"navbarHideable_aKYr",navbarHidden:"navbarHidden_KUhG",navbarSidebarToggle:"navbarSidebarToggle_nL8I"},z="right";function Z(){return(0,u.LU)().navbar.items}function q(){var e=(0,u.LU)().colorMode.disableSwitch,t=(0,u.If)(),n=t.isDarkTheme,o=t.setLightTheme,a=t.setDarkTheme;return{isDarkTheme:n,toggle:(0,r.useCallback)((function(e){return e.target.checked?a():o()}),[o,a]),disabled:e}}function $(e){var t=e.sidebarShown,n=e.toggleSidebar;(0,u.Ni)(t);var a=Z(),i=q(),s=function(e){var t,n=e.sidebarShown,o=e.toggleSidebar,a=null==(t=(0,u.g8)())?void 0:t({toggleSidebar:o}),i=(0,u.D9)(a),l=(0,r.useState)((function(){return!1})),s=l[0],c=l[1];(0,r.useEffect)((function(){a&&!i&&c(!0)}),[a,i]);var d=!!a;return(0,r.useEffect)((function(){d?n||c(!0):c(!1)}),[n,d]),{shown:s,hide:(0,r.useCallback)((function(){c(!1)}),[]),content:a}}({sidebarShown:t,toggleSidebar:n});return r.createElement("div",{className:"navbar-sidebar"},r.createElement("div",{className:"navbar-sidebar__brand"},r.createElement(F.Z,{className:"navbar__brand",imageClassName:"navbar__logo",titleClassName:"navbar__title"}),!i.disabled&&r.createElement(D,{className:U.navbarSidebarToggle,checked:i.isDarkTheme,onChange:i.toggle}),r.createElement("button",{type:"button",className:"clean-btn navbar-sidebar__close",onClick:n},r.createElement(h,{color:"var(--ifm-color-emphasis-600)",className:U.navbarSidebarCloseSvg}))),r.createElement("div",{className:(0,o.Z)("navbar-sidebar__items",{"navbar-sidebar__items--show-secondary":s.shown})},r.createElement("div",{className:"navbar-sidebar__item menu"},r.createElement("ul",{className:"menu__list"},a.map((function(e,t){return r.createElement(M.Z,(0,f.Z)({mobile:!0},e,{onClick:n,key:t}))})))),r.createElement("div",{className:"navbar-sidebar__item menu"},a.length>0&&r.createElement("button",{type:"button",className:"clean-btn navbar-sidebar__back",onClick:s.hide},r.createElement(l.Z,{id:"theme.navbar.mobileSidebarSecondaryMenu.backButtonLabel",description:"The label of the back button to return to main menu, inside the mobile navbar sidebar secondary menu (notably used to display the docs sidebar)"},"\u2190 Back to main menu")),s.content)))}var G=function(){var e,t=(0,u.LU)().navbar,n=t.hideOnScroll,a=t.style,i=function(){var e=(0,u.iP)(),t="mobile"===e,n=(0,r.useState)(!1),o=n[0],a=n[1];(0,u.Rb)((function(){if(o)return a(!1),!1}));var i=(0,r.useCallback)((function(){a((function(e){return!e}))}),[]);return(0,r.useEffect)((function(){"desktop"===e&&a(!1)}),[e]),{shouldRender:t,toggle:i,shown:o}}(),l=q(),s=(0,I.useActivePlugin)(),c=(0,u.cK)(n),d=c.navbarRef,p=c.isNavbarVisible,m=Z(),h=m.some((function(e){return"search"===e.type})),g=function(e){return{leftItems:e.filter((function(e){var t;return"left"===(null!=(t=e.position)?t:z)})),rightItems:e.filter((function(e){var t;return"right"===(null!=(t=e.position)?t:z)}))}}(m),v=g.leftItems,b=g.rightItems;return r.createElement("nav",{ref:d,className:(0,o.Z)("navbar","navbar--fixed-top",(e={"navbar--dark":"dark"===a,"navbar--primary":"primary"===a,"navbar-sidebar--show":i.shown},e[U.navbarHideable]=n,e[U.navbarHidden]=n&&!p,e))},r.createElement("div",{className:"navbar__inner"},r.createElement("div",{className:"navbar__items"},((null==m?void 0:m.length)>0||s)&&r.createElement("button",{"aria-label":"Navigation bar toggle",className:"navbar__toggle clean-btn",type:"button",tabIndex:0,onClick:i.toggle,onKeyDown:i.toggle},r.createElement(B,null)),r.createElement(F.Z,{className:"navbar__brand",imageClassName:"navbar__logo",titleClassName:"navbar__title"}),v.map((function(e,t){return r.createElement(M.Z,(0,f.Z)({},e,{key:t}))}))),r.createElement("div",{className:"navbar__items navbar__items--right"},b.map((function(e,t){return r.createElement(M.Z,(0,f.Z)({},e,{key:t}))})),!l.disabled&&r.createElement(D,{className:U.toggle,checked:l.isDarkTheme,onChange:l.toggle}),!h&&r.createElement(x.Z,null))),r.createElement("div",{role:"presentation",className:"navbar-sidebar__backdrop",onClick:i.toggle}),i.shouldRender&&r.createElement($,{sidebarShown:i.shown,toggleSidebar:i.toggle}))},H=n(9960),V=n(4996),W=n(3919),K="footerLogoLink_RC3H",Y=n(9750),Q=n(541),X=["to","href","label","prependBaseUrlToHref"];function J(e){var t=e.to,n=e.href,o=e.label,a=e.prependBaseUrlToHref,i=(0,p.Z)(e,X),l=(0,V.Z)(t),u=(0,V.Z)(n,{forcePrependBaseUrl:!0});return r.createElement(H.Z,(0,f.Z)({className:"footer__link-item"},n?{href:a?u:n}:{to:l},i),n&&!(0,W.Z)(n)?r.createElement("span",null,o,r.createElement(Q.Z,null)):o)}function ee(e){var t=e.sources,n=e.alt,o=e.width,a=e.height;return r.createElement(Y.Z,{className:"footer__logo",alt:n,sources:t,width:o,height:a})}function te(e){var t=e.links;return r.createElement(r.Fragment,null,t.map((function(e,t){return r.createElement("div",{key:t,className:"col footer__col"},r.createElement("div",{className:"footer__title"},e.title),r.createElement("ul",{className:"footer__items"},e.items.map((function(e,t){return e.html?r.createElement("li",{key:t,className:"footer__item",dangerouslySetInnerHTML:{__html:e.html}}):r.createElement("li",{key:e.href||e.to,className:"footer__item"},r.createElement(J,e))}))))})))}function ne(e){var t=e.links;return r.createElement("div",{className:"footer__links"},t.map((function(e,n){return r.createElement(r.Fragment,null,e.html?r.createElement("span",{key:n,className:"footer__link-item",dangerouslySetInnerHTML:{__html:e.html}}):r.createElement(J,e),t.length!==n+1&&r.createElement("span",{className:"footer__link-separator"},"\xb7"))})))}function re(){var e=(0,u.LU)().footer,t=e||{},n=t.copyright,a=t.links,i=void 0===a?[]:a,l=t.logo,s=void 0===l?{}:l,c={light:(0,V.Z)(s.src),dark:(0,V.Z)(s.srcDark||s.src)};return e?r.createElement("footer",{className:(0,o.Z)("footer",{"footer--dark":"dark"===e.style})},r.createElement("div",{className:"container container-fluid"},i&&i.length>0&&(function(e){return"title"in e[0]}(i)?r.createElement("div",{className:"row footer__links"},r.createElement(te,{links:i})):r.createElement("div",{className:"footer__links text--center"},r.createElement(ne,{links:i}))),(s||n)&&r.createElement("div",{className:"footer__bottom text--center"},s&&(s.src||s.srcDark)&&r.createElement("div",{className:"margin-bottom--sm"},s.href?r.createElement(H.Z,{href:s.href,className:K},r.createElement(ee,{alt:s.alt,sources:c,width:s.width,height:s.height})):r.createElement(ee,{alt:s.alt,sources:c})),n?r.createElement("div",{className:"footer__copyright",dangerouslySetInnerHTML:{__html:n}}):null))):null}var oe=r.memo(re);function ae(e){var t=e.children;return r.createElement(u.SG,null,r.createElement(u.pl,null,r.createElement(u.z5,null,r.createElement(u.OC,null,r.createElement(u.L5,null,r.createElement(u.Cn,null,t))))))}var ie=n(2859),le=n(2263);function ue(e){var t=e.locale,n=e.version,o=e.tag;return r.createElement(ie.Z,null,t&&r.createElement("meta",{name:"docusaurus_locale",content:t}),n&&r.createElement("meta",{name:"docusaurus_version",content:n}),o&&r.createElement("meta",{name:"docusaurus_tag",content:o}))}var se=n(1217);function ce(){var e=(0,le.Z)().i18n,t=e.defaultLocale,n=e.localeConfigs,o=(0,u.l5)();return r.createElement(ie.Z,null,Object.entries(n).map((function(e){var t=e[0],n=e[1].htmlLang;return r.createElement("link",{key:t,rel:"alternate",href:o.createUrl({locale:t,fullyQualified:!0}),hrefLang:n})})),r.createElement("link",{rel:"alternate",href:o.createUrl({locale:t,fullyQualified:!0}),hrefLang:"x-default"}))}function de(e){var t=e.permalink,n=(0,le.Z)().siteConfig.url,o=function(){var e=(0,le.Z)().siteConfig.url,t=(0,i.TH)().pathname;return e+(0,V.Z)(t)}(),a=t?""+n+t:o;return r.createElement(ie.Z,null,r.createElement("meta",{property:"og:url",content:a}),r.createElement("link",{rel:"canonical",href:a}))}function fe(e){var t=(0,le.Z)(),n=t.siteConfig.favicon,o=t.i18n,a=o.currentLocale,i=o.localeConfigs,l=(0,u.LU)(),s=l.metadata,c=l.image,d=e.title,p=e.description,m=e.image,h=e.keywords,g=e.searchMetadata,v=(0,V.Z)(n),b=(0,u.pe)(d),y=i[a],w=y.htmlLang,x=y.direction;return r.createElement(r.Fragment,null,r.createElement(ie.Z,null,r.createElement("html",{lang:w,dir:x}),n&&r.createElement("link",{rel:"icon",href:v}),r.createElement("title",null,b),r.createElement("meta",{property:"og:title",content:b}),r.createElement("meta",{name:"twitter:card",content:"summary_large_image"})),c&&r.createElement(se.Z,{image:c}),m&&r.createElement(se.Z,{image:m}),r.createElement(se.Z,{description:p,keywords:h}),r.createElement(de,null),r.createElement(ce,null),r.createElement(ue,(0,f.Z)({tag:u.HX,locale:a},g)),r.createElement(ie.Z,null,s.map((function(e,t){return r.createElement("meta",(0,f.Z)({key:"metadata_"+t},e))}))))}function pe(e){var t=e.error,n=e.tryAgain;return r.createElement("main",{className:"container margin-vert--xl"},r.createElement("div",{className:"row"},r.createElement("div",{className:"col col--6 col--offset-3"},r.createElement("h1",{className:"hero__title"},r.createElement(l.Z,{id:"theme.ErrorPageContent.title",description:"The title of the fallback page when the page crashed"},"This page crashed.")),r.createElement("p",null,t.message),r.createElement("div",null,r.createElement("button",{type:"button",onClick:n},r.createElement(l.Z,{id:"theme.ErrorPageContent.tryAgain",description:"The label of the button to try again when the page crashed"},"Try again"))))))}var me=function(e){var t=e.children,n=e.noFooter,i=e.wrapperClassName,l=e.pageClassName;return(0,u.t$)(),r.createElement(ae,null,r.createElement(fe,e),r.createElement(d,null),r.createElement(w,null),r.createElement(G,null),r.createElement("div",{className:(0,o.Z)(u.kM.wrapper.main,i,l)},r.createElement(a.Z,{fallback:pe},t)),!n&&r.createElement(oe,null))}},5537:function(e,t,n){"use strict";var r=n(7462),o=n(3366),a=n(7294),i=n(9960),l=n(9750),u=n(4996),s=n(2263),c=n(9548),d=["imageClassName","titleClassName"];t.Z=function(e){var t=(0,s.Z)().siteConfig.title,n=(0,c.LU)().navbar,f=n.title,p=n.logo,m=void 0===p?{src:""}:p,h=e.imageClassName,g=e.titleClassName,v=(0,o.Z)(e,d),b=(0,u.Z)(m.href||"/"),y={light:(0,u.Z)(m.src),dark:(0,u.Z)(m.srcDark||m.src)},w=a.createElement(l.Z,{sources:y,height:m.height,width:m.width,alt:m.alt||f||t});return a.createElement(i.Z,(0,r.Z)({to:b},v,m.target&&{target:m.target}),m.src&&(h?a.createElement("div",{className:h},w):w),null!=f&&a.createElement("b",{className:g},f))}},5525:function(e,t,n){"use strict";var r=n(7462),o=n(3366),a=n(7294),i=n(6010),l=n(3072),u=n(1068),s=["className","isDropdownItem"],c=["className","isDropdownItem"],d=["mobile","position"];function f(e){var t=e.className,n=e.isDropdownItem,u=void 0!==n&&n,c=(0,o.Z)(e,s),d=a.createElement(l.Z,(0,r.Z)({className:(0,i.Z)(u?"dropdown__link":"navbar__item navbar__link",t)},c));return u?a.createElement("li",null,d):d}function p(e){var t=e.className,n=(e.isDropdownItem,(0,o.Z)(e,c));return a.createElement("li",{className:"menu__list-item"},a.createElement(l.Z,(0,r.Z)({className:(0,i.Z)("menu__link",t)},n)))}t.Z=function(e){var t,n=e.mobile,i=void 0!==n&&n,l=(e.position,(0,o.Z)(e,d)),s=i?p:f;return a.createElement(s,(0,r.Z)({},l,{activeClassName:null!=(t=l.activeClassName)?t:(0,u.E)(i)}))}},6400:function(e,t,n){"use strict";n.d(t,{Z:function(){return f}});var r=n(7462),o=n(3366),a=n(7294),i=n(5525),l=n(5551),u=n(6010),s=n(1068),c=n(9548),d=["docId","label","docsPluginId"];function f(e){var t,n=e.docId,f=e.label,p=e.docsPluginId,m=(0,o.Z)(e,d),h=(0,l.useActiveDocContext)(p),g=h.activeVersion,v=h.activeDoc,b=(0,c.J)(p).preferredVersion,y=(0,l.useLatestVersion)(p),w=function(e,t){var n=e.flatMap((function(e){return e.docs})),r=n.find((function(e){return e.id===t}));if(!r){var o=n.map((function(e){return e.id})).join("\n- ");throw new Error("DocNavbarItem: couldn't find any doc with id \""+t+'" in version'+(e.length?"s":"")+" "+e.map((function(e){return e.name})).join(", ")+'".\nAvailable doc ids are:\n- '+o)}return r}((0,c.jj)([g,b,y].filter(Boolean)),n),x=(0,s.E)(m.mobile);return a.createElement(i.Z,(0,r.Z)({exact:!0},m,{className:(0,u.Z)(m.className,(t={},t[x]=(null==v?void 0:v.sidebar)&&v.sidebar===w.sidebar,t)),activeClassName:x,label:null!=f?f:w.id,to:w.path}))}},4792:function(e,t,n){"use strict";n.d(t,{Z:function(){return f}});var r=n(7462),o=n(3366),a=n(7294),i=n(5525),l=n(5551),u=n(6010),s=n(1068),c=n(9548),d=["sidebarId","label","docsPluginId"];function f(e){var t,n=e.sidebarId,f=e.label,p=e.docsPluginId,m=(0,o.Z)(e,d),h=(0,l.useActiveDocContext)(p),g=h.activeVersion,v=h.activeDoc,b=(0,c.J)(p).preferredVersion,y=(0,l.useLatestVersion)(p),w=function(e,t){var n=e.flatMap((function(e){if(e.sidebars)return Object.entries(e.sidebars)})).filter((function(e){return!!e})),r=n.find((function(e){return e[0]===t}));if(!r)throw new Error("DocSidebarNavbarItem: couldn't find any sidebar with id \""+t+'" in version'+(e.length?"s":"")+" "+e.map((function(e){return e.name})).join(", ")+'".\nAvailable sidebar ids are:\n- '+Object.keys(n).join("\n- "));if(!r[1].link)throw new Error("DocSidebarNavbarItem: couldn't find any document for sidebar with id \""+t+'"');return r[1].link}((0,c.jj)([g,b,y].filter(Boolean)),n),x=(0,s.E)(m.mobile);return a.createElement(i.Z,(0,r.Z)({exact:!0},m,{className:(0,u.Z)(m.className,(t={},t[x]=(null==v?void 0:v.sidebar)===n,t)),activeClassName:x,label:null!=f?f:w.label,to:w.path}))}},9308:function(e,t,n){"use strict";n.d(t,{Z:function(){return p}});var r=n(7462),o=n(3366),a=n(7294),i=n(5525),l=n(3154),u=n(5551),s=n(9548),c=n(5999),d=["mobile","docsPluginId","dropdownActiveClassDisabled","dropdownItemsBefore","dropdownItemsAfter"],f=function(e){return e.docs.find((function(t){return t.id===e.mainDocId}))};function p(e){var t,n,p=e.mobile,m=e.docsPluginId,h=e.dropdownActiveClassDisabled,g=e.dropdownItemsBefore,v=e.dropdownItemsAfter,b=(0,o.Z)(e,d),y=(0,u.useActiveDocContext)(m),w=(0,u.useVersions)(m),x=(0,u.useLatestVersion)(m),k=(0,s.J)(m),E=k.preferredVersion,S=k.savePreferredVersionName;var T,_=(T=w.map((function(e){var t=(null==y?void 0:y.alternateDocVersions[e.name])||f(e);return{isNavLink:!0,label:e.label,to:t.path,isActive:function(){return e===(null==y?void 0:y.activeVersion)},onClick:function(){S(e.name)}}})),[].concat(g,T,v)),C=null!=(t=null!=(n=y.activeVersion)?n:E)?t:x,A=p&&_.length>1?(0,c.I)({id:"theme.navbar.mobileVersionsDropdown.label",message:"Versions",description:"The label for the navbar versions dropdown on mobile view"}):C.label,P=p&&_.length>1?void 0:f(C).path;return _.length<=1?a.createElement(i.Z,(0,r.Z)({},b,{mobile:p,label:A,to:P,isActive:h?function(){return!1}:void 0})):a.createElement(l.Z,(0,r.Z)({},b,{mobile:p,label:A,to:P,items:_,isActive:h?function(){return!1}:void 0}))}},7250:function(e,t,n){"use strict";n.d(t,{Z:function(){return c}});var r=n(7462),o=n(3366),a=n(7294),i=n(5525),l=n(5551),u=n(9548),s=["label","to","docsPluginId"];function c(e){var t,n=e.label,c=e.to,d=e.docsPluginId,f=(0,o.Z)(e,s),p=(0,l.useActiveVersion)(d),m=(0,u.J)(d).preferredVersion,h=(0,l.useLatestVersion)(d),g=null!=(t=null!=p?p:m)?t:h,v=null!=n?n:g.label,b=null!=c?c:function(e){return e.docs.find((function(t){return t.id===e.mainDocId}))}(g).path;return a.createElement(i.Z,(0,r.Z)({},f,{label:v,to:b}))}},3154:function(e,t,n){"use strict";var r=n(7462),o=n(3366),a=n(7294),i=n(6010),l=n(9548),u=n(3072),s=n(2207),c=["items","position","className"],d=["items","className","position"],f=["mobile"];function p(e,t){return e.some((function(e){return function(e,t){return!!(0,l.Mg)(e.to,t)||!!(0,l.Fx)(e.activeBaseRegex,t)||!(!e.activeBasePath||!t.startsWith(e.activeBasePath))}(e,t)}))}function m(e){var t,n=e.items,l=e.position,d=e.className,f=(0,o.Z)(e,c),p=(0,a.useRef)(null),m=(0,a.useState)(!1),h=m[0],g=m[1];return(0,a.useEffect)((function(){var e=function(e){p.current&&!p.current.contains(e.target)&&g(!1)};return document.addEventListener("mousedown",e),document.addEventListener("touchstart",e),function(){document.removeEventListener("mousedown",e),document.removeEventListener("touchstart",e)}}),[p]),a.createElement("div",{ref:p,className:(0,i.Z)("navbar__item","dropdown","dropdown--hoverable",{"dropdown--right":"right"===l,"dropdown--show":h})},a.createElement(u.Z,(0,r.Z)({href:f.to?void 0:"#",className:(0,i.Z)("navbar__link",d)},f,{onClick:f.to?void 0:function(e){return e.preventDefault()},onKeyDown:function(e){"Enter"===e.key&&(e.preventDefault(),g(!h))}}),null!=(t=f.children)?t:f.label),a.createElement("ul",{className:"dropdown__menu"},n.map((function(e,t){return a.createElement(s.Z,(0,r.Z)({isDropdownItem:!0,onKeyDown:function(e){if(t===n.length-1&&"Tab"===e.key){e.preventDefault(),g(!1);var r=p.current.nextElementSibling;r&&r.focus()}},activeClassName:"dropdown__link--active"},e,{key:t}))}))))}function h(e){var t,n=e.items,c=e.className,f=(e.position,(0,o.Z)(e,d)),m=(0,l.be)(),h=p(n,m),g=(0,l.uR)({initialState:function(){return!h}}),v=g.collapsed,b=g.toggleCollapsed,y=g.setCollapsed;return(0,a.useEffect)((function(){h&&y(!h)}),[m,h,y]),a.createElement("li",{className:(0,i.Z)("menu__list-item",{"menu__list-item--collapsed":v})},a.createElement(u.Z,(0,r.Z)({role:"button",className:(0,i.Z)("menu__link menu__link--sublist",c)},f,{onClick:function(e){e.preventDefault(),b()}}),null!=(t=f.children)?t:f.label),a.createElement(l.zF,{lazy:!0,as:"ul",className:"menu__list",collapsed:v},n.map((function(e,t){return a.createElement(s.Z,(0,r.Z)({mobile:!0,isDropdownItem:!0,onClick:f.onClick,activeClassName:"menu__link--active"},e,{key:t}))}))))}t.Z=function(e){var t=e.mobile,n=void 0!==t&&t,r=(0,o.Z)(e,f),i=n?h:m;return a.createElement(i,r)}},3072:function(e,t,n){"use strict";n.d(t,{Z:function(){return f}});var r=n(7462),o=n(3366),a=n(7294),i=n(9960),l=n(4996),u=n(541),s=n(3919),c=n(9548),d=["activeBasePath","activeBaseRegex","to","href","label","activeClassName","prependBaseUrlToHref"];function f(e){var t,n=e.activeBasePath,f=e.activeBaseRegex,p=e.to,m=e.href,h=e.label,g=e.activeClassName,v=void 0===g?"":g,b=e.prependBaseUrlToHref,y=(0,o.Z)(e,d),w=(0,l.Z)(p),x=(0,l.Z)(n),k=(0,l.Z)(m,{forcePrependBaseUrl:!0}),E=h&&m&&!(0,s.Z)(m),S="dropdown__link--active"===v;return a.createElement(i.Z,(0,r.Z)({},m?{href:b?k:m}:Object.assign({isNavLink:!0,activeClassName:null!=(t=y.className)&&t.includes(v)?"":v,to:w},n||f?{isActive:function(e,t){return f?(0,c.Fx)(f,t.pathname):t.pathname.startsWith(x)}}:null),y),E?a.createElement("span",null,h,a.createElement(u.Z,S&&{width:12,height:12})):h)}},2207:function(e,t,n){"use strict";n.d(t,{Z:function(){return y}});var r=n(3366),o=n(7294),a=n(5525),i=n(3154),l=n(7462),u=["width","height"];var s=function(e){var t=e.width,n=void 0===t?20:t,a=e.height,i=void 0===a?20:a,s=(0,r.Z)(e,u);return o.createElement("svg",(0,l.Z)({viewBox:"0 0 20 20",width:n,height:i,"aria-hidden":"true"},s),o.createElement("path",{fill:"currentColor",d:"M19.753 10.909c-.624-1.707-2.366-2.726-4.661-2.726-.09 0-.176.002-.262.006l-.016-2.063 3.525-.607c.115-.019.133-.119.109-.231-.023-.111-.167-.883-.188-.976-.027-.131-.102-.127-.207-.109-.104.018-3.25.461-3.25.461l-.013-2.078c-.001-.125-.069-.158-.194-.156l-1.025.016c-.105.002-.164.049-.162.148l.033 2.307s-3.061.527-3.144.543c-.084.014-.17.053-.151.143.019.09.19 1.094.208 1.172.018.08.072.129.188.107l2.924-.504.035 2.018c-1.077.281-1.801.824-2.256 1.303-.768.807-1.207 1.887-1.207 2.963 0 1.586.971 2.529 2.328 2.695 3.162.387 5.119-3.06 5.769-4.715 1.097 1.506.256 4.354-2.094 5.98-.043.029-.098.129-.033.207l.619.756c.08.096.206.059.256.023 2.51-1.73 3.661-4.515 2.869-6.683zm-7.386 3.188c-.966-.121-.944-.914-.944-1.453 0-.773.327-1.58.876-2.156a3.21 3.21 0 011.229-.799l.082 4.277a2.773 2.773 0 01-1.243.131zm2.427-.553l.046-4.109c.084-.004.166-.01.252-.01.773 0 1.494.145 1.885.361.391.217-1.023 2.713-2.183 3.758zm-8.95-7.668a.196.196 0 00-.196-.145h-1.95a.194.194 0 00-.194.144L.008 16.916c-.017.051-.011.076.062.076h1.733c.075 0 .099-.023.114-.072l1.008-3.318h3.496l1.008 3.318c.016.049.039.072.113.072h1.734c.072 0 .078-.025.062-.076-.014-.05-3.083-9.741-3.494-11.04zm-2.618 6.318l1.447-5.25 1.447 5.25H3.226z"}))},c=n(2263),d=n(9548),f="iconLanguage_dNtB",p=["mobile","dropdownItemsBefore","dropdownItemsAfter"];function m(e){var t=e.mobile,n=e.dropdownItemsBefore,a=e.dropdownItemsAfter,u=(0,r.Z)(e,p),m=(0,c.Z)().i18n,h=m.currentLocale,g=m.locales,v=m.localeConfigs,b=(0,d.l5)();function y(e){return v[e].label}var w=g.map((function(e){var t="pathname://"+b.createUrl({locale:e,fullyQualified:!1});return{isNavLink:!0,label:y(e),to:t,target:"_self",autoAddBaseUrl:!1,className:e===h?"dropdown__link--active":""}})),x=[].concat(n,w,a),k=t?"Languages":y(h);return o.createElement(i.Z,(0,l.Z)({},u,{mobile:t,label:o.createElement("span",null,o.createElement(s,{className:f}),o.createElement("span",null,k)),items:x}))}var h=n(1875);function g(e){return e.mobile?null:o.createElement(h.Z,null)}var v=["type"],b={default:function(){return a.Z},localeDropdown:function(){return m},search:function(){return g},dropdown:function(){return i.Z},docsVersion:function(){return n(7250).Z},docsVersionDropdown:function(){return n(9308).Z},doc:function(){return n(6400).Z},docSidebar:function(){return n(4792).Z}};function y(e){var t=e.type,n=(0,r.Z)(e,v),a=function(e,t){return e&&"default"!==e?e:t?"dropdown":"default"}(t,void 0!==n.items),i=function(e){var t=b[e];if(!t)throw new Error('No NavbarItem component found for type "'+e+'".');return t()}(a);return o.createElement(i,n)}},1068:function(e,t,n){"use strict";n.d(t,{E:function(){return r}});var r=function(e){return e?"menu__link--active":"navbar__link--active"}},1217:function(e,t,n){"use strict";n.d(t,{Z:function(){return l}});var r=n(7294),o=n(2859),a=n(9548),i=n(4996);function l(e){var t=e.title,n=e.description,l=e.keywords,u=e.image,s=e.children,c=(0,a.pe)(t),d=(0,i.C)().withBaseUrl,f=u?d(u,{absolute:!0}):void 0;return r.createElement(o.Z,null,t&&r.createElement("title",null,c),t&&r.createElement("meta",{property:"og:title",content:c}),n&&r.createElement("meta",{name:"description",content:n}),n&&r.createElement("meta",{property:"og:description",content:n}),l&&r.createElement("meta",{name:"keywords",content:Array.isArray(l)?l.join(","):l}),f&&r.createElement("meta",{property:"og:image",content:f}),f&&r.createElement("meta",{name:"twitter:image",content:f}),s)}},9750:function(e,t,n){"use strict";n.d(t,{Z:function(){return d}});var r=n(7462),o=n(3366),a=n(7294),i=n(6010),l=n(2389),u=n(9548),s={themedImage:"themedImage_W2Cr","themedImage--light":"themedImage--light_TfLj","themedImage--dark":"themedImage--dark_oUvU"},c=["sources","className","alt"];var d=function(e){var t=(0,l.Z)(),n=(0,u.If)().isDarkTheme,d=e.sources,f=e.className,p=e.alt,m=void 0===p?"":p,h=(0,o.Z)(e,c),g=t?n?["dark"]:["light"]:["light","dark"];return a.createElement(a.Fragment,null,g.map((function(e){return a.createElement("img",(0,r.Z)({key:e,src:d[e],alt:m,className:(0,i.Z)(s.themedImage,s["themedImage--"+e],f)},h))})))}},467:function(e,t,n){"use strict";n.r(t);var r=n(412),o=n(9782);t.default=function(e){if(r.Z.canUseDOM){var t=o.Z.themeConfig.prism.additionalLanguages;window.Prism=e,t.forEach((function(e){n(6500)("./prism-"+e)})),delete window.Prism}}},2448:function(e,t,n){"use strict";var r=o(n(7410));function o(e){return e&&e.__esModule?e:{default:e}}(0,o(n(467)).default)(r.default)},9548:function(e,t,n){"use strict";n.d(t,{pl:function(){return ze},zF:function(){return be},SG:function(){return dt},HX:function(){return Q},PO:function(){return Ce},D_:function(){return u},L5:function(){return M},bT:function(){return C},qu:function(){return S},Cv:function(){return Ne},Cn:function(){return Pe},OC:function(){return Xe},z5:function(){return gt},kM:function(){return Ie},os:function(){return X},lx:function(){return Le},Wl:function(){return P},_F:function(){return O},Fx:function(){return rt},Mg:function(){return w},bc:function(){return W},Vo:function(){return K},nZ:function(){return Y},jj:function(){return De},l5:function(){return g},nT:function(){return Ze},uR:function(){return ce},If:function(){return ft},fP:function(){return s},J:function(){return B},Vq:function(){return A},E6:function(){return T},cK:function(){return bt},Rb:function(){return $e},t$:function(){return yt},be:function(){return qe},SL:function(){return ae},Ni:function(){return kt},g8:function(){return Re},D9:function(){return oe},pJ:function(){return xt},RF:function(){return tt},o5:function(){return nt},DA:function(){return Ye},Si:function(){return We},UB:function(){return vt},LU:function(){return o},pe:function(){return J},iP:function(){return Ct}});var r=n(2263);function o(){return(0,r.Z)().siteConfig.themeConfig}var a=n(7294),i=Symbol("EmptyContext"),l=a.createContext(i);function u(e){var t=e.children,n=(0,a.useState)(null),r=n[0],o=n[1],i=(0,a.useMemo)((function(){return{expandedItem:r,setExpandedItem:o}}),[r]);return a.createElement(l.Provider,{value:i},t)}function s(){var e=(0,a.useContext)(l);if(e===i)throw new Error("This hook requires usage of ");return e}var c="localStorage";function d(e){if(void 0===e&&(e=c),"undefined"==typeof window)throw new Error("Browser storage is not available on Node.js/Docusaurus SSR process.");if("none"===e)return null;try{return window[e]}catch(n){return t=n,f||(console.warn("Docusaurus browser storage is not available.\nPossible reasons: running Docusaurus in an iframe, in an incognito browser session, or using too strict browser privacy settings.",t),f=!0),null}var t}var f=!1;var p={get:function(){return null},set:function(){},del:function(){}};var m=function(e,t){if("undefined"==typeof window)return function(e){function t(){throw new Error('Illegal storage API usage for storage key "'+e+'".\nDocusaurus storage APIs are not supposed to be called on the server-rendering process.\nPlease only call storage APIs in effects and event handlers.')}return{get:t,set:t,del:t}}(e);var n=d(null==t?void 0:t.persistence);return null===n?p:{get:function(){try{return n.getItem(e)}catch(t){return console.error("Docusaurus storage error, can't get key="+e,t),null}},set:function(t){try{n.setItem(e,t)}catch(r){console.error("Docusaurus storage error, can't set "+e+"="+t,r)}},del:function(){try{n.removeItem(e)}catch(t){console.error("Docusaurus storage error, can't delete key="+e,t)}}}};var h=n(6775);function g(){var e=(0,r.Z)(),t=e.siteConfig,n=t.baseUrl,o=t.url,a=e.i18n,i=a.defaultLocale,l=a.currentLocale,u=(0,h.TH)().pathname,s=l===i?n:n.replace("/"+l+"/","/"),c=u.replace(n,"");return{createUrl:function(e){var t=e.locale;return""+(e.fullyQualified?o:"")+function(e){return e===i?""+s:""+s+e+"/"}(t)+c}}}var v=n(5551);function b(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n=e.length?{done:!0}:{done:!1,value:e[r++]}}}throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}var w=function(e,t){var n=function(e){return!e||(null==e?void 0:e.endsWith("/"))?e:e+"/"};return n(e)===n(t)},x=!!v.useAllDocsData,k=Symbol("EmptyContext"),E=(0,a.createContext)(k);function S(e){var t=e.children,n=e.version;return a.createElement(E.Provider,{value:n},t)}function T(){var e=(0,a.useContext)(E);if(e===k)throw new Error("This hook requires usage of ");return e}var _=(0,a.createContext)(k);function C(e){var t=e.children,n=e.sidebar;return a.createElement(_.Provider,{value:n},t)}function A(){var e=(0,a.useContext)(_);if(e===k)throw new Error("This hook requires usage of ");return e}function P(e){if(e.href)return e.href;for(var t,n=y(e.items);!(t=n()).done;){var r=t.value;if("link"===r.type)return r.href;if("category"!==r.type)throw new Error("Unexpected category item type for "+JSON.stringify(r));var o=P(r);if(o)return o}}function O(e,t){var n=function(e){return void 0!==e&&w(e,t)};return"link"===e.type?n(e.href):"category"===e.type&&(n(e.href)||function(e,t){return e.some((function(e){return O(e,t)}))}(e.items,t))}var R=function(e){return"docs-preferred-version-"+e},N={save:function(e,t,n){m(R(e),{persistence:t}).set(n)},read:function(e,t){return m(R(e),{persistence:t}).get()},clear:function(e,t){m(R(e),{persistence:t}).del()}};function L(e){var t=e.pluginIds,n=e.versionPersistence,r=e.allDocsData;var o={};return t.forEach((function(e){o[e]=function(e){var t=N.read(e,n);return r[e].versions.some((function(e){return e.name===t}))?{preferredVersionName:t}:(N.clear(e,n),{preferredVersionName:null})}(e)})),o}function D(){var e=(0,v.useAllDocsData)(),t=o().docs.versionPersistence,n=(0,a.useMemo)((function(){return Object.keys(e)}),[e]),r=(0,a.useState)((function(){return function(e){var t={};return e.forEach((function(e){t[e]={preferredVersionName:null}})),t}(n)})),i=r[0],l=r[1];return(0,a.useEffect)((function(){l(L({allDocsData:e,versionPersistence:t,pluginIds:n}))}),[e,t,n]),[i,(0,a.useMemo)((function(){return{savePreferredVersion:function(e,n){N.save(e,t,n),l((function(t){var r;return Object.assign({},t,((r={})[e]={preferredVersionName:n},r))}))}}}),[t])]}var I=(0,a.createContext)(null);function M(e){var t=e.children;return x?a.createElement(F,null,t):t}function F(e){var t=e.children,n=D();return a.createElement(I.Provider,{value:n},t)}var j=n(9935);function B(e){void 0===e&&(e=j.m);var t=(0,v.useDocsData)(e),n=function(){var e=(0,a.useContext)(I);if(!e)throw new Error('Can\'t find docs preferred context, maybe you forgot to use the "DocsPreferredVersionContextProvider"?');return e}(),r=n[0],o=n[1],i=r[e].preferredVersionName;return{preferredVersion:i?t.versions.find((function(e){return e.name===i})):null,savePreferredVersionName:(0,a.useCallback)((function(t){o.savePreferredVersion(e,t)}),[o,e])}}var U=n(7594),z=n.n(U),Z=/title=(["'])(.*?)\1/,q=/{([\d,-]+)}/,$=["js","jsBlock","jsx","python","html"],G={js:{start:"\\/\\/",end:""},jsBlock:{start:"\\/\\*",end:"\\*\\/"},jsx:{start:"\\{\\s*\\/\\*",end:"\\*\\/\\s*\\}"},python:{start:"#",end:""},html:{start:"\x3c!--",end:"--\x3e"}},H=["highlight-next-line","highlight-start","highlight-end"],V=function(e){void 0===e&&(e=$);var t=e.map((function(e){var t=G[e],n=t.start,r=t.end;return"(?:"+n+"\\s*("+H.join("|")+")\\s*"+r+")"})).join("|");return new RegExp("^\\s*(?:"+t+")\\s*$")};function W(e){var t,n;return null!==(n=null===(t=null==e?void 0:e.match(Z))||void 0===t?void 0:t[2])&&void 0!==n?n:""}function K(e){var t=e.split(" ").find((function(e){return e.startsWith("language-")}));return null==t?void 0:t.replace(/language-/,"")}function Y(e,t,n){var r=e.replace(/\n$/,"");if(t&&q.test(t)){var o=t.match(q)[1];return{highlightLines:z()(o).filter((function(e){return e>0})).map((function(e){return e-1})),code:r}}if(void 0===n)return{highlightLines:[],code:r};for(var a,i=function(e){switch(e){case"js":case"javascript":case"ts":case"typescript":return V(["js","jsBlock"]);case"jsx":case"tsx":return V(["js","jsBlock","jsx"]);case"html":return V(["js","jsBlock","html"]);case"python":case"py":return V(["python"]);default:return V()}}(n),l=r.split("\n"),u="",s=0;s1&&e.preventDefault()},onClick:function(e){e.stopPropagation();var t=e.target;Te(t)&&_e(t,l.current)&&(e.preventDefault(),s?(c(!1),p(!0)):c(!0))}}),n,a.createElement(be,{lazy:!1,collapsed:s,disableSSRStyle:!0,onCollapseTransitionEnd:function(e){c(e),p(!e)}},a.createElement("div",{className:Ee},r)))};var Ae=(0,a.createContext)(null);function Pe(e){var t=e.children;return a.createElement(Ae.Provider,{value:(0,a.useState)(null)},t)}function Oe(){var e=(0,a.useContext)(Ae);if(null===e)throw new Error("MobileSecondaryMenuProvider was not used correctly, context value is null");return e}function Re(){var e=Oe()[0];if(e){var t=e.component;return function(n){return a.createElement(t,Object.assign({},e.props,n))}}return function(){}}function Ne(e){var t,n=e.component,r=e.props,o=Oe()[1],i=(t=r,(0,a.useMemo)((function(){return t}),[].concat(Object.keys(t),Object.values(t))));return(0,a.useEffect)((function(){o({component:n,props:i})}),[o,n,i]),(0,a.useEffect)((function(){return function(){return o(null)}}),[o]),null}function Le(e,t){return void 0===t&&(t=function(e,t){return e===t}),e.filter((function(n,r){return e.findIndex((function(e){return t(e,n)}))!==r}))}function De(e){return Array.from(new Set(e))}var Ie={page:{blogListPage:"blog-list-page",blogPostPage:"blog-post-page",blogTagsListPage:"blog-tags-list-page",blogTagPostListPage:"blog-tags-post-list-page",docsDocPage:"docs-doc-page",docsTagsListPage:"docs-tags-list-page",docsTagDocListPage:"docs-tags-doc-list-page",mdxPage:"mdx-page"},wrapper:{main:"main-wrapper",blogPages:"blog-wrapper",docsPages:"docs-wrapper",mdxPages:"mdx-wrapper"},common:{editThisPage:"theme-edit-this-page",lastUpdated:"theme-last-updated",backToTopButton:"theme-back-to-top-button",codeBlock:"theme-code-block"},layout:{},docs:{docVersionBanner:"theme-doc-version-banner",docVersionBadge:"theme-doc-version-badge",docMarkdown:"theme-doc-markdown",docTocMobile:"theme-doc-toc-mobile",docTocDesktop:"theme-doc-toc-desktop",docFooter:"theme-doc-footer",docFooterTagsRow:"theme-doc-footer-tags-row",docFooterEditMetaRow:"theme-doc-footer-edit-meta-row",docSidebarContainer:"theme-doc-sidebar-container",docSidebarMenu:"theme-doc-sidebar-menu",docSidebarItemCategory:"theme-doc-sidebar-item-category",docSidebarItemLink:"theme-doc-sidebar-item-link",docSidebarItemCategoryLevel:function(e){return"theme-doc-sidebar-item-category-level-"+e},docSidebarItemLinkLevel:function(e){return"theme-doc-sidebar-item-link-level-"+e}},blog:{}},Me=m("docusaurus.announcement.dismiss"),Fe=m("docusaurus.announcement.id"),je=function(){return"true"===Me.get()},Be=function(e){return Me.set(String(e))},Ue=(0,a.createContext)(null);function ze(e){var t=e.children,n=function(){var e=o().announcementBar,t=(0,ye.Z)(),n=(0,a.useState)((function(){return!!t&&je()})),r=n[0],i=n[1];(0,a.useEffect)((function(){i(je())}),[]);var l=(0,a.useCallback)((function(){Be(!0),i(!0)}),[]);return(0,a.useEffect)((function(){if(e){var t=e.id,n=Fe.get();"annoucement-bar"===n&&(n="announcement-bar");var r=t!==n;Fe.set(t),r&&Be(!1),!r&&je()||i(!1)}}),[e]),(0,a.useMemo)((function(){return{isActive:!!e&&!r,close:l}}),[e,r,l])}();return a.createElement(Ue.Provider,{value:n},t)}var Ze=function(){var e=(0,a.useContext)(Ue);if(!e)throw new Error("useAnnouncementBar(): AnnouncementBar not found in React context: make sure to use the AnnouncementBarProvider on top of the tree");return e};function qe(){var e=(0,r.Z)().siteConfig.baseUrl;return(0,h.TH)().pathname.replace(e,"/")}n(5999);function $e(e){!function(e){var t=(0,h.k6)().block,n=(0,a.useRef)(e);(0,a.useEffect)((function(){n.current=e}),[e]),(0,a.useEffect)((function(){return t((function(e,t){return n.current(e,t)}))}),[t,n])}((function(t,n){if("POP"===n)return e(t,n)}))}function Ge(e){var t=e.getBoundingClientRect();return t.top===t.bottom?Ge(e.parentNode):t}function He(e,t){var n,r=t.anchorTopOffset,o=e.find((function(e){return Ge(e).top>=r}));return o?function(e){return e.top>0&&e.bottom=n&&e.level<=r}(e)?[Object.assign({},e,{children:t})]:t}))}function Ye(e){var t=e.toc,n=e.minHeadingLevel,r=e.maxHeadingLevel;return(0,a.useMemo)((function(){return Ke({toc:t,minHeadingLevel:n,maxHeadingLevel:r})}),[t,n,r])}var Qe=(0,a.createContext)(void 0);function Xe(e){var t,n=e.children;return a.createElement(Qe.Provider,{value:(t=(0,a.useRef)(!0),(0,a.useMemo)((function(){return{scrollEventsEnabledRef:t,enableScrollEvents:function(){t.current=!0},disableScrollEvents:function(){t.current=!1}}}),[]))},n)}function Je(){var e=(0,a.useContext)(Qe);if(null==e)throw new Error('"useScrollController" is used but no context provider was found in the React tree.');return e}var et=function(){return le.Z.canUseDOM?{scrollX:window.pageXOffset,scrollY:window.pageYOffset}:null};function tt(e,t){void 0===t&&(t=[]);var n=Je().scrollEventsEnabledRef,r=(0,a.useRef)(et()),o=re(e);(0,a.useEffect)((function(){var e=function(){if(n.current){var e=et();o&&o(e,r.current),r.current=e}},t={passive:!0};return e(),window.addEventListener("scroll",e,t),function(){return window.removeEventListener("scroll",e,t)}}),[o,n].concat(t))}function nt(){var e,t,n,r=Je(),o=(e=(0,a.useRef)({elem:null,top:0}),t=(0,a.useCallback)((function(t){e.current={elem:t,top:t.getBoundingClientRect().top}}),[]),n=(0,a.useCallback)((function(){var t=e.current,n=t.elem,r=t.top;if(!n)return{restored:!1};var o=n.getBoundingClientRect().top-r;return o&&window.scrollBy({left:0,top:o}),e.current={elem:null,top:0},{restored:0!==o}}),[]),(0,a.useMemo)((function(){return{save:t,restore:n}}),[n,t])),i=(0,a.useRef)(void 0),l=(0,a.useCallback)((function(e){o.save(e),r.disableScrollEvents(),i.current=function(){var e=o.restore().restored;if(i.current=void 0,e){window.addEventListener("scroll",(function e(){r.enableScrollEvents(),window.removeEventListener("scroll",e)}))}else r.enableScrollEvents()}}),[r,o]);return(0,a.useLayoutEffect)((function(){var e;null===(e=i.current)||void 0===e||e.call(i)})),{blockElementScrollPositionUntilNextRender:l}}function rt(e,t){return void 0!==e&&void 0!==t&&new RegExp(e,"gi").test(t)}var ot=m("theme"),at="light",it="dark",lt=function(e){return e===it?it:at},ut=function(e){m("theme").set(lt(e))};function st(){var e=o().colorMode,t=e.defaultMode,n=e.disableSwitch,r=e.respectPrefersColorScheme,i=(0,a.useState)(function(e){return le.Z.canUseDOM?lt(document.documentElement.getAttribute("data-theme")):lt(e)}(t)),l=i[0],u=i[1],s=(0,a.useCallback)((function(){u(at),ut(at)}),[]),c=(0,a.useCallback)((function(){u(it),ut(it)}),[]);return(0,a.useEffect)((function(){document.documentElement.setAttribute("data-theme",lt(l))}),[l]),(0,a.useEffect)((function(){if(!n)try{var e=ot.get();null!==e&&u(lt(e))}catch(t){console.error(t)}}),[n,u]),(0,a.useEffect)((function(){n&&!r||window.matchMedia("(prefers-color-scheme: dark)").addListener((function(e){var t=e.matches;u(t?it:at)}))}),[n,r]),{isDarkTheme:l===it,setLightTheme:s,setDarkTheme:c}}var ct=a.createContext(void 0);function dt(e){var t=e.children,n=st(),r=n.isDarkTheme,o=n.setLightTheme,i=n.setDarkTheme,l=(0,a.useMemo)((function(){return{isDarkTheme:r,setLightTheme:o,setDarkTheme:i}}),[r,o,i]);return a.createElement(ct.Provider,{value:l},t)}function ft(){var e=(0,a.useContext)(ct);if(null==e)throw new Error('"useColorMode()" is used outside of "Layout" component. Please see https://docusaurus.io/docs/api/themes/configuration#use-color-mode.');return e}var pt="docusaurus.tab.",mt=(0,a.createContext)(void 0);function ht(){var e=(0,a.useState)({}),t=e[0],n=e[1],r=(0,a.useCallback)((function(e,t){m("docusaurus.tab."+e).set(t)}),[]);return(0,a.useEffect)((function(){try{var e={};(function(e){void 0===e&&(e=c);var t=d(e);if(!t)return[];for(var n=[],r=0;r=l?r(!1):a+s996?Et:St:Tt}function Ct(){var e=(0,a.useState)((function(){return _t()})),t=e[0],n=e[1];return(0,a.useEffect)((function(){function e(){n(_t())}return window.addEventListener("resize",e),function(){window.removeEventListener("resize",e),clearTimeout(undefined)}}),[]),t}},8802:function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default=function(e,t){var n=t.trailingSlash,r=t.baseUrl;if(e.startsWith("#"))return e;if(void 0===n)return e;var o,a=e.split(/[#?]/)[0],i="/"===a||a===r?a:(o=a,n?function(e){return e.endsWith("/")?e:e+"/"}(o):function(e){return e.endsWith("/")?e.slice(0,-1):e}(o));return e.replace(a,i)}},8780:function(e,t,n){"use strict";var r=this&&this.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.applyTrailingSlash=t.blogPostContainerID=void 0,t.blogPostContainerID="post-content";var o=n(8802);Object.defineProperty(t,"applyTrailingSlash",{enumerable:!0,get:function(){return r(o).default}})},6010:function(e,t,n){"use strict";function r(e){var t,n,o="";if("string"==typeof e||"number"==typeof e)o+=e;else if("object"==typeof e)if(Array.isArray(e))for(t=0;t=0;f--){var p=i[f];"."===p?a(i,f):".."===p?(a(i,f),d++):d&&(a(i,f),d--)}if(!s)for(;d--;d)i.unshift("..");!s||""===i[0]||i[0]&&o(i[0])||i.unshift("");var m=i.join("/");return n&&"/"!==m.substr(-1)&&(m+="/"),m};function l(e){return e.valueOf?e.valueOf():Object.prototype.valueOf.call(e)}var u=function e(t,n){if(t===n)return!0;if(null==t||null==n)return!1;if(Array.isArray(t))return Array.isArray(n)&&t.length===n.length&&t.every((function(t,r){return e(t,n[r])}));if("object"==typeof t||"object"==typeof n){var r=l(t),o=l(n);return r!==t||o!==n?e(r,o):Object.keys(Object.assign({},t,n)).every((function(r){return e(t[r],n[r])}))}return!1},s=n(2177);function c(e){return"/"===e.charAt(0)?e:"/"+e}function d(e){return"/"===e.charAt(0)?e.substr(1):e}function f(e,t){return function(e,t){return 0===e.toLowerCase().indexOf(t.toLowerCase())&&-1!=="/?#".indexOf(e.charAt(t.length))}(e,t)?e.substr(t.length):e}function p(e){return"/"===e.charAt(e.length-1)?e.slice(0,-1):e}function m(e){var t=e.pathname,n=e.search,r=e.hash,o=t||"/";return n&&"?"!==n&&(o+="?"===n.charAt(0)?n:"?"+n),r&&"#"!==r&&(o+="#"===r.charAt(0)?r:"#"+r),o}function h(e,t,n,o){var a;"string"==typeof e?(a=function(e){var t=e||"/",n="",r="",o=t.indexOf("#");-1!==o&&(r=t.substr(o),t=t.substr(0,o));var a=t.indexOf("?");return-1!==a&&(n=t.substr(a),t=t.substr(0,a)),{pathname:t,search:"?"===n?"":n,hash:"#"===r?"":r}}(e),a.state=t):(void 0===(a=(0,r.Z)({},e)).pathname&&(a.pathname=""),a.search?"?"!==a.search.charAt(0)&&(a.search="?"+a.search):a.search="",a.hash?"#"!==a.hash.charAt(0)&&(a.hash="#"+a.hash):a.hash="",void 0!==t&&void 0===a.state&&(a.state=t));try{a.pathname=decodeURI(a.pathname)}catch(l){throw l instanceof URIError?new URIError('Pathname "'+a.pathname+'" could not be decoded. This is likely caused by an invalid percent-encoding.'):l}return n&&(a.key=n),o?a.pathname?"/"!==a.pathname.charAt(0)&&(a.pathname=i(a.pathname,o.pathname)):a.pathname=o.pathname:a.pathname||(a.pathname="/"),a}function g(e,t){return e.pathname===t.pathname&&e.search===t.search&&e.hash===t.hash&&e.key===t.key&&u(e.state,t.state)}function v(){var e=null;var t=[];return{setPrompt:function(t){return e=t,function(){e===t&&(e=null)}},confirmTransitionTo:function(t,n,r,o){if(null!=e){var a="function"==typeof e?e(t,n):e;"string"==typeof a?"function"==typeof r?r(a,o):o(!0):o(!1!==a)}else o(!0)},appendListener:function(e){var n=!0;function r(){n&&e.apply(void 0,arguments)}return t.push(r),function(){n=!1,t=t.filter((function(e){return e!==r}))}},notifyListeners:function(){for(var e=arguments.length,n=new Array(e),r=0;rt?n.splice(t,n.length-t,o):n.push(o),d({action:r,location:o,index:t,entries:n})}}))},replace:function(e,t){var r="REPLACE",o=h(e,t,f(),w.location);c.confirmTransitionTo(o,r,n,(function(e){e&&(w.entries[w.index]=o,d({action:r,location:o}))}))},go:y,goBack:function(){y(-1)},goForward:function(){y(1)},canGo:function(e){var t=w.index+e;return t>=0&&t
'};function o(e,t,n){return en?n:e}function a(e){return 100*(-1+e)}function i(e,t,n){var o;return(o="translate3d"===r.positionUsing?{transform:"translate3d("+a(e)+"%,0,0)"}:"translate"===r.positionUsing?{transform:"translate("+a(e)+"%,0)"}:{"margin-left":a(e)+"%"}).transition="all "+t+"ms "+n,o}n.configure=function(e){var t,n;for(t in e)void 0!==(n=e[t])&&e.hasOwnProperty(t)&&(r[t]=n);return this},n.status=null,n.set=function(e){var t=n.isStarted();e=o(e,r.minimum,1),n.status=1===e?null:e;var a=n.render(!t),s=a.querySelector(r.barSelector),c=r.speed,d=r.easing;return a.offsetWidth,l((function(t){""===r.positionUsing&&(r.positionUsing=n.getPositioningCSS()),u(s,i(e,c,d)),1===e?(u(a,{transition:"none",opacity:1}),a.offsetWidth,setTimeout((function(){u(a,{transition:"all "+c+"ms linear",opacity:0}),setTimeout((function(){n.remove(),t()}),c)}),c)):setTimeout(t,c)})),this},n.isStarted=function(){return"number"==typeof n.status},n.start=function(){n.status||n.set(0);var e=function(){setTimeout((function(){n.status&&(n.trickle(),e())}),r.trickleSpeed)};return r.trickle&&e(),this},n.done=function(e){return e||n.status?n.inc(.3+.5*Math.random()).set(1):this},n.inc=function(e){var t=n.status;return t?("number"!=typeof e&&(e=(1-t)*o(Math.random()*t,.1,.95)),t=o(t+e,0,.994),n.set(t)):n.start()},n.trickle=function(){return n.inc(Math.random()*r.trickleRate)},e=0,t=0,n.promise=function(r){return r&&"resolved"!==r.state()?(0===t&&n.start(),e++,t++,r.always((function(){0==--t?(e=0,n.done()):n.set((e-t)/e)})),this):this},n.render=function(e){if(n.isRendered())return document.getElementById("nprogress");c(document.documentElement,"nprogress-busy");var t=document.createElement("div");t.id="nprogress",t.innerHTML=r.template;var o,i=t.querySelector(r.barSelector),l=e?"-100":a(n.status||0),s=document.querySelector(r.parent);return u(i,{transition:"all 0 linear",transform:"translate3d("+l+"%,0,0)"}),r.showSpinner||(o=t.querySelector(r.spinnerSelector))&&p(o),s!=document.body&&c(s,"nprogress-custom-parent"),s.appendChild(t),t},n.remove=function(){d(document.documentElement,"nprogress-busy"),d(document.querySelector(r.parent),"nprogress-custom-parent");var e=document.getElementById("nprogress");e&&p(e)},n.isRendered=function(){return!!document.getElementById("nprogress")},n.getPositioningCSS=function(){var e=document.body.style,t="WebkitTransform"in e?"Webkit":"MozTransform"in e?"Moz":"msTransform"in e?"ms":"OTransform"in e?"O":"";return t+"Perspective"in e?"translate3d":t+"Transform"in e?"translate":"margin"};var l=function(){var e=[];function t(){var n=e.shift();n&&n(t)}return function(n){e.push(n),1==e.length&&t()}}(),u=function(){var e=["Webkit","O","Moz","ms"],t={};function n(e){return e.replace(/^-ms-/,"ms-").replace(/-([\da-z])/gi,(function(e,t){return t.toUpperCase()}))}function r(t){var n=document.body.style;if(t in n)return t;for(var r,o=e.length,a=t.charAt(0).toUpperCase()+t.slice(1);o--;)if((r=e[o]+a)in n)return r;return t}function o(e){return e=n(e),t[e]||(t[e]=r(e))}function a(e,t,n){t=o(t),e.style[t]=n}return function(e,t){var n,r,o=arguments;if(2==o.length)for(n in t)void 0!==(r=t[n])&&t.hasOwnProperty(n)&&a(e,n,r);else a(e,o[1],o[2])}}();function s(e,t){return("string"==typeof e?e:f(e)).indexOf(" "+t+" ")>=0}function c(e,t){var n=f(e),r=n+t;s(n,t)||(e.className=r.substring(1))}function d(e,t){var n,r=f(e);s(e,t)&&(n=r.replace(" "+t+" "," "),e.className=n.substring(1,n.length-1))}function f(e){return(" "+(e.className||"")+" ").replace(/\s+/gi," ")}function p(e){e&&e.parentNode&&e.parentNode.removeChild(e)}return n},void 0===(o="function"==typeof r?r.call(t,n,t,e):r)||(e.exports=o)},7418:function(e){"use strict";var t=Object.getOwnPropertySymbols,n=Object.prototype.hasOwnProperty,r=Object.prototype.propertyIsEnumerable;function o(e){if(null==e)throw new TypeError("Object.assign cannot be called with null or undefined");return Object(e)}e.exports=function(){try{if(!Object.assign)return!1;var e=new String("abc");if(e[5]="de","5"===Object.getOwnPropertyNames(e)[0])return!1;for(var t={},n=0;n<10;n++)t["_"+String.fromCharCode(n)]=n;if("0123456789"!==Object.getOwnPropertyNames(t).map((function(e){return t[e]})).join(""))return!1;var r={};return"abcdefghijklmnopqrst".split("").forEach((function(e){r[e]=e})),"abcdefghijklmnopqrst"===Object.keys(Object.assign({},r)).join("")}catch(o){return!1}}()?Object.assign:function(e,a){for(var i,l,u=o(e),s=1;se.trim())))if(/^-?\d+$/.test(r))n.push(parseInt(r,10));else if(t=r.match(/^(-?\d+)(-|\.\.\.?|\u2025|\u2026|\u22EF)(-?\d+)$/)){let[e,r,o,a]=t;if(r&&a){r=parseInt(r),a=parseInt(a);const e=r=d.reach);E+=k.value.length,k=k.next){var S=k.value;if(t.length>e.length)return;if(!(S instanceof o)){var T,_=1;if(b){if(!(T=a(x,E,e,v))||T.index>=e.length)break;var C=T.index,A=T.index+T[0].length,P=E;for(P+=k.value.length;C>=P;)P+=(k=k.next).value.length;if(E=P-=k.value.length,k.value instanceof o)continue;for(var O=k;O!==t.tail&&(Pd.reach&&(d.reach=D);var I=k.prev;if(N&&(I=u(t,I,N),E+=N.length),s(t,I,_),k=u(t,I,new o(f,g?r.tokenize(R,g):R,y,R)),L&&u(t,k,L),_>1){var M={cause:f+","+m,reach:D};i(e,t,n,k.prev,E,M),d&&M.reach>d.reach&&(d.reach=M.reach)}}}}}}function l(){var e={value:null,prev:null,next:null},t={value:null,prev:e,next:null};e.next=t,this.head=e,this.tail=t,this.length=0}function u(e,t,n){var r=t.next,o={value:n,prev:t,next:r};return t.next=o,r.prev=o,e.length++,o}function s(e,t,n){for(var r=t.next,o=0;o"+a.content+""},r}(),o=r;r.default=r,o.languages.markup={comment:{pattern://,greedy:!0},prolog:{pattern:/<\?[\s\S]+?\?>/,greedy:!0},doctype:{pattern:/"'[\]]|"[^"]*"|'[^']*')+(?:\[(?:[^<"'\]]|"[^"]*"|'[^']*'|<(?!!--)|)*\]\s*)?>/i,greedy:!0,inside:{"internal-subset":{pattern:/(^[^\[]*\[)[\s\S]+(?=\]>$)/,lookbehind:!0,greedy:!0,inside:null},string:{pattern:/"[^"]*"|'[^']*'/,greedy:!0},punctuation:/^$|[[\]]/,"doctype-tag":/^DOCTYPE/i,name:/[^\s<>'"]+/}},cdata:{pattern://i,greedy:!0},tag:{pattern:/<\/?(?!\d)[^\s>\/=$<%]+(?:\s(?:\s*[^\s>\/=]+(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s'">=]+(?=[\s>]))|(?=[\s/>])))+)?\s*\/?>/,greedy:!0,inside:{tag:{pattern:/^<\/?[^\s>\/]+/,inside:{punctuation:/^<\/?/,namespace:/^[^\s>\/:]+:/}},"special-attr":[],"attr-value":{pattern:/=\s*(?:"[^"]*"|'[^']*'|[^\s'">=]+)/,inside:{punctuation:[{pattern:/^=/,alias:"attr-equals"},/"|'/]}},punctuation:/\/?>/,"attr-name":{pattern:/[^\s>\/]+/,inside:{namespace:/^[^\s>\/:]+:/}}}},entity:[{pattern:/&[\da-z]{1,8};/i,alias:"named-entity"},/&#x?[\da-f]{1,8};/i]},o.languages.markup.tag.inside["attr-value"].inside.entity=o.languages.markup.entity,o.languages.markup.doctype.inside["internal-subset"].inside=o.languages.markup,o.hooks.add("wrap",(function(e){"entity"===e.type&&(e.attributes.title=e.content.replace(/&/,"&"))})),Object.defineProperty(o.languages.markup.tag,"addInlined",{value:function(e,t){var n={};n["language-"+t]={pattern:/(^$)/i,lookbehind:!0,inside:o.languages[t]},n.cdata=/^$/i;var r={"included-cdata":{pattern://i,inside:n}};r["language-"+t]={pattern:/[\s\S]+/,inside:o.languages[t]};var a={};a[e]={pattern:RegExp(/(<__[^>]*>)(?:))*\]\]>|(?!)/.source.replace(/__/g,(function(){return e})),"i"),lookbehind:!0,greedy:!0,inside:r},o.languages.insertBefore("markup","cdata",a)}}),Object.defineProperty(o.languages.markup.tag,"addAttribute",{value:function(e,t){o.languages.markup.tag.inside["special-attr"].push({pattern:RegExp(/(^|["'\s])/.source+"(?:"+e+")"+/\s*=\s*(?:"[^"]*"|'[^']*'|[^\s'">=]+(?=[\s>]))/.source,"i"),lookbehind:!0,inside:{"attr-name":/^[^\s=]+/,"attr-value":{pattern:/=[\s\S]+/,inside:{value:{pattern:/(^=\s*(["']|(?!["'])))\S[\s\S]*(?=\2$)/,lookbehind:!0,alias:[t,"language-"+t],inside:o.languages[t]},punctuation:[{pattern:/^=/,alias:"attr-equals"},/"|'/]}}}})}}),o.languages.html=o.languages.markup,o.languages.mathml=o.languages.markup,o.languages.svg=o.languages.markup,o.languages.xml=o.languages.extend("markup",{}),o.languages.ssml=o.languages.xml,o.languages.atom=o.languages.xml,o.languages.rss=o.languages.xml,function(e){var t="\\b(?:BASH|BASHOPTS|BASH_ALIASES|BASH_ARGC|BASH_ARGV|BASH_CMDS|BASH_COMPLETION_COMPAT_DIR|BASH_LINENO|BASH_REMATCH|BASH_SOURCE|BASH_VERSINFO|BASH_VERSION|COLORTERM|COLUMNS|COMP_WORDBREAKS|DBUS_SESSION_BUS_ADDRESS|DEFAULTS_PATH|DESKTOP_SESSION|DIRSTACK|DISPLAY|EUID|GDMSESSION|GDM_LANG|GNOME_KEYRING_CONTROL|GNOME_KEYRING_PID|GPG_AGENT_INFO|GROUPS|HISTCONTROL|HISTFILE|HISTFILESIZE|HISTSIZE|HOME|HOSTNAME|HOSTTYPE|IFS|INSTANCE|JOB|LANG|LANGUAGE|LC_ADDRESS|LC_ALL|LC_IDENTIFICATION|LC_MEASUREMENT|LC_MONETARY|LC_NAME|LC_NUMERIC|LC_PAPER|LC_TELEPHONE|LC_TIME|LESSCLOSE|LESSOPEN|LINES|LOGNAME|LS_COLORS|MACHTYPE|MAILCHECK|MANDATORY_PATH|NO_AT_BRIDGE|OLDPWD|OPTERR|OPTIND|ORBIT_SOCKETDIR|OSTYPE|PAPERSIZE|PATH|PIPESTATUS|PPID|PS1|PS2|PS3|PS4|PWD|RANDOM|REPLY|SECONDS|SELINUX_INIT|SESSION|SESSIONTYPE|SESSION_MANAGER|SHELL|SHELLOPTS|SHLVL|SSH_AUTH_SOCK|TERM|UID|UPSTART_EVENTS|UPSTART_INSTANCE|UPSTART_JOB|UPSTART_SESSION|USER|WINDOWID|XAUTHORITY|XDG_CONFIG_DIRS|XDG_CURRENT_DESKTOP|XDG_DATA_DIRS|XDG_GREETER_DATA_DIR|XDG_MENU_PREFIX|XDG_RUNTIME_DIR|XDG_SEAT|XDG_SEAT_PATH|XDG_SESSION_DESKTOP|XDG_SESSION_ID|XDG_SESSION_PATH|XDG_SESSION_TYPE|XDG_VTNR|XMODIFIERS)\\b",n={pattern:/(^(["']?)\w+\2)[ \t]+\S.*/,lookbehind:!0,alias:"punctuation",inside:null},r={bash:n,environment:{pattern:RegExp("\\$"+t),alias:"constant"},variable:[{pattern:/\$?\(\([\s\S]+?\)\)/,greedy:!0,inside:{variable:[{pattern:/(^\$\(\([\s\S]+)\)\)/,lookbehind:!0},/^\$\(\(/],number:/\b0x[\dA-Fa-f]+\b|(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:[Ee]-?\d+)?/,operator:/--|\+\+|\*\*=?|<<=?|>>=?|&&|\|\||[=!+\-*/%<>^&|]=?|[?~:]/,punctuation:/\(\(?|\)\)?|,|;/}},{pattern:/\$\((?:\([^)]+\)|[^()])+\)|`[^`]+`/,greedy:!0,inside:{variable:/^\$\(|^`|\)$|`$/}},{pattern:/\$\{[^}]+\}/,greedy:!0,inside:{operator:/:[-=?+]?|[!\/]|##?|%%?|\^\^?|,,?/,punctuation:/[\[\]]/,environment:{pattern:RegExp("(\\{)"+t),lookbehind:!0,alias:"constant"}}},/\$(?:\w+|[#?*!@$])/],entity:/\\(?:[abceEfnrtv\\"]|O?[0-7]{1,3}|U[0-9a-fA-F]{8}|u[0-9a-fA-F]{4}|x[0-9a-fA-F]{1,2})/};e.languages.bash={shebang:{pattern:/^#!\s*\/.*/,alias:"important"},comment:{pattern:/(^|[^"{\\$])#.*/,lookbehind:!0},"function-name":[{pattern:/(\bfunction\s+)[\w-]+(?=(?:\s*\(?:\s*\))?\s*\{)/,lookbehind:!0,alias:"function"},{pattern:/\b[\w-]+(?=\s*\(\s*\)\s*\{)/,alias:"function"}],"for-or-select":{pattern:/(\b(?:for|select)\s+)\w+(?=\s+in\s)/,alias:"variable",lookbehind:!0},"assign-left":{pattern:/(^|[\s;|&]|[<>]\()\w+(?=\+?=)/,inside:{environment:{pattern:RegExp("(^|[\\s;|&]|[<>]\\()"+t),lookbehind:!0,alias:"constant"}},alias:"variable",lookbehind:!0},string:[{pattern:/((?:^|[^<])<<-?\s*)(\w+)\s[\s\S]*?(?:\r?\n|\r)\2/,lookbehind:!0,greedy:!0,inside:r},{pattern:/((?:^|[^<])<<-?\s*)(["'])(\w+)\2\s[\s\S]*?(?:\r?\n|\r)\3/,lookbehind:!0,greedy:!0,inside:{bash:n}},{pattern:/(^|[^\\](?:\\\\)*)"(?:\\[\s\S]|\$\([^)]+\)|\$(?!\()|`[^`]+`|[^"\\`$])*"/,lookbehind:!0,greedy:!0,inside:r},{pattern:/(^|[^$\\])'[^']*'/,lookbehind:!0,greedy:!0},{pattern:/\$'(?:[^'\\]|\\[\s\S])*'/,greedy:!0,inside:{entity:r.entity}}],environment:{pattern:RegExp("\\$?"+t),alias:"constant"},variable:r.variable,function:{pattern:/(^|[\s;|&]|[<>]\()(?:add|apropos|apt|apt-cache|apt-get|aptitude|aspell|automysqlbackup|awk|basename|bash|bc|bconsole|bg|bzip2|cal|cat|cfdisk|chgrp|chkconfig|chmod|chown|chroot|cksum|clear|cmp|column|comm|composer|cp|cron|crontab|csplit|curl|cut|date|dc|dd|ddrescue|debootstrap|df|diff|diff3|dig|dir|dircolors|dirname|dirs|dmesg|docker|docker-compose|du|egrep|eject|env|ethtool|expand|expect|expr|fdformat|fdisk|fg|fgrep|file|find|fmt|fold|format|free|fsck|ftp|fuser|gawk|git|gparted|grep|groupadd|groupdel|groupmod|groups|grub-mkconfig|gzip|halt|head|hg|history|host|hostname|htop|iconv|id|ifconfig|ifdown|ifup|import|install|ip|jobs|join|kill|killall|less|link|ln|locate|logname|logrotate|look|lpc|lpr|lprint|lprintd|lprintq|lprm|ls|lsof|lynx|make|man|mc|mdadm|mkconfig|mkdir|mke2fs|mkfifo|mkfs|mkisofs|mknod|mkswap|mmv|more|most|mount|mtools|mtr|mutt|mv|nano|nc|netstat|nice|nl|node|nohup|notify-send|npm|nslookup|op|open|parted|passwd|paste|pathchk|ping|pkill|pnpm|podman|podman-compose|popd|pr|printcap|printenv|ps|pushd|pv|quota|quotacheck|quotactl|ram|rar|rcp|reboot|remsync|rename|renice|rev|rm|rmdir|rpm|rsync|scp|screen|sdiff|sed|sendmail|seq|service|sftp|sh|shellcheck|shuf|shutdown|sleep|slocate|sort|split|ssh|stat|strace|su|sudo|sum|suspend|swapon|sync|tac|tail|tar|tee|time|timeout|top|touch|tr|traceroute|tsort|tty|umount|uname|unexpand|uniq|units|unrar|unshar|unzip|update-grub|uptime|useradd|userdel|usermod|users|uudecode|uuencode|v|vcpkg|vdir|vi|vim|virsh|vmstat|wait|watch|wc|wget|whereis|which|who|whoami|write|xargs|xdg-open|yarn|yes|zenity|zip|zsh|zypper)(?=$|[)\s;|&])/,lookbehind:!0},keyword:{pattern:/(^|[\s;|&]|[<>]\()(?:case|do|done|elif|else|esac|fi|for|function|if|in|select|then|until|while)(?=$|[)\s;|&])/,lookbehind:!0},builtin:{pattern:/(^|[\s;|&]|[<>]\()(?:\.|:|alias|bind|break|builtin|caller|cd|command|continue|declare|echo|enable|eval|exec|exit|export|getopts|hash|help|let|local|logout|mapfile|printf|pwd|read|readarray|readonly|return|set|shift|shopt|source|test|times|trap|type|typeset|ulimit|umask|unalias|unset)(?=$|[)\s;|&])/,lookbehind:!0,alias:"class-name"},boolean:{pattern:/(^|[\s;|&]|[<>]\()(?:false|true)(?=$|[)\s;|&])/,lookbehind:!0},"file-descriptor":{pattern:/\B&\d\b/,alias:"important"},operator:{pattern:/\d?<>|>\||\+=|=[=~]?|!=?|<<[<-]?|[&\d]?>>|\d[<>]&?|[<>][&=]?|&[>&]?|\|[&|]?/,inside:{"file-descriptor":{pattern:/^\d/,alias:"important"}}},punctuation:/\$?\(\(?|\)\)?|\.\.|[{}[\];\\]/,number:{pattern:/(^|\s)(?:[1-9]\d*|0)(?:[.,]\d+)?\b/,lookbehind:!0}},n.inside=e.languages.bash;for(var o=["comment","function-name","for-or-select","assign-left","string","environment","function","keyword","builtin","boolean","file-descriptor","operator","punctuation","number"],a=r.variable[1].inside,i=0;i]=?|[!=]=?=?|--?|\+\+?|&&?|\|\|?|[?*/~^%]/,punctuation:/[{}[\];(),.:]/},o.languages.c=o.languages.extend("clike",{comment:{pattern:/\/\/(?:[^\r\n\\]|\\(?:\r\n?|\n|(?![\r\n])))*|\/\*[\s\S]*?(?:\*\/|$)/,greedy:!0},string:{pattern:/"(?:\\(?:\r\n|[\s\S])|[^"\\\r\n])*"/,greedy:!0},"class-name":{pattern:/(\b(?:enum|struct)\s+(?:__attribute__\s*\(\([\s\S]*?\)\)\s*)?)\w+|\b[a-z]\w*_t\b/,lookbehind:!0},keyword:/\b(?:_Alignas|_Alignof|_Atomic|_Bool|_Complex|_Generic|_Imaginary|_Noreturn|_Static_assert|_Thread_local|__attribute__|asm|auto|break|case|char|const|continue|default|do|double|else|enum|extern|float|for|goto|if|inline|int|long|register|return|short|signed|sizeof|static|struct|switch|typedef|typeof|union|unsigned|void|volatile|while)\b/,function:/\b[a-z_]\w*(?=\s*\()/i,number:/(?:\b0x(?:[\da-f]+(?:\.[\da-f]*)?|\.[\da-f]+)(?:p[+-]?\d+)?|(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:e[+-]?\d+)?)[ful]{0,4}/i,operator:/>>=?|<<=?|->|([-+&|:])\1|[?:~]|[-+*/%&|^!=<>]=?/}),o.languages.insertBefore("c","string",{char:{pattern:/'(?:\\(?:\r\n|[\s\S])|[^'\\\r\n]){0,32}'/,greedy:!0}}),o.languages.insertBefore("c","string",{macro:{pattern:/(^[\t ]*)#\s*[a-z](?:[^\r\n\\/]|\/(?!\*)|\/\*(?:[^*]|\*(?!\/))*\*\/|\\(?:\r\n|[\s\S]))*/im,lookbehind:!0,greedy:!0,alias:"property",inside:{string:[{pattern:/^(#\s*include\s*)<[^>]+>/,lookbehind:!0},o.languages.c.string],char:o.languages.c.char,comment:o.languages.c.comment,"macro-name":[{pattern:/(^#\s*define\s+)\w+\b(?!\()/i,lookbehind:!0},{pattern:/(^#\s*define\s+)\w+\b(?=\()/i,lookbehind:!0,alias:"function"}],directive:{pattern:/^(#\s*)[a-z]+/,lookbehind:!0,alias:"keyword"},"directive-hash":/^#/,punctuation:/##|\\(?=[\r\n])/,expression:{pattern:/\S[\s\S]*/,inside:o.languages.c}}}}),o.languages.insertBefore("c","function",{constant:/\b(?:EOF|NULL|SEEK_CUR|SEEK_END|SEEK_SET|__DATE__|__FILE__|__LINE__|__TIMESTAMP__|__TIME__|__func__|stderr|stdin|stdout)\b/}),delete o.languages.c.boolean,function(e){var t=/\b(?:alignas|alignof|asm|auto|bool|break|case|catch|char|char16_t|char32_t|char8_t|class|co_await|co_return|co_yield|compl|concept|const|const_cast|consteval|constexpr|constinit|continue|decltype|default|delete|do|double|dynamic_cast|else|enum|explicit|export|extern|final|float|for|friend|goto|if|import|inline|int|int16_t|int32_t|int64_t|int8_t|long|module|mutable|namespace|new|noexcept|nullptr|operator|override|private|protected|public|register|reinterpret_cast|requires|return|short|signed|sizeof|static|static_assert|static_cast|struct|switch|template|this|thread_local|throw|try|typedef|typeid|typename|uint16_t|uint32_t|uint64_t|uint8_t|union|unsigned|using|virtual|void|volatile|wchar_t|while)\b/,n=/\b(?!)\w+(?:\s*\.\s*\w+)*\b/.source.replace(//g,(function(){return t.source}));e.languages.cpp=e.languages.extend("c",{"class-name":[{pattern:RegExp(/(\b(?:class|concept|enum|struct|typename)\s+)(?!)\w+/.source.replace(//g,(function(){return t.source}))),lookbehind:!0},/\b[A-Z]\w*(?=\s*::\s*\w+\s*\()/,/\b[A-Z_]\w*(?=\s*::\s*~\w+\s*\()/i,/\b\w+(?=\s*<(?:[^<>]|<(?:[^<>]|<[^<>]*>)*>)*>\s*::\s*\w+\s*\()/],keyword:t,number:{pattern:/(?:\b0b[01']+|\b0x(?:[\da-f']+(?:\.[\da-f']*)?|\.[\da-f']+)(?:p[+-]?[\d']+)?|(?:\b[\d']+(?:\.[\d']*)?|\B\.[\d']+)(?:e[+-]?[\d']+)?)[ful]{0,4}/i,greedy:!0},operator:/>>=?|<<=?|->|--|\+\+|&&|\|\||[?:~]|<=>|[-+*/%&|^!=<>]=?|\b(?:and|and_eq|bitand|bitor|not|not_eq|or|or_eq|xor|xor_eq)\b/,boolean:/\b(?:false|true)\b/}),e.languages.insertBefore("cpp","string",{module:{pattern:RegExp(/(\b(?:import|module)\s+)/.source+"(?:"+/"(?:\\(?:\r\n|[\s\S])|[^"\\\r\n])*"|<[^<>\r\n]*>/.source+"|"+/(?:\s*:\s*)?|:\s*/.source.replace(//g,(function(){return n}))+")"),lookbehind:!0,greedy:!0,inside:{string:/^[<"][\s\S]+/,operator:/:/,punctuation:/\./}},"raw-string":{pattern:/R"([^()\\ ]{0,16})\([\s\S]*?\)\1"/,alias:"string",greedy:!0}}),e.languages.insertBefore("cpp","keyword",{"generic-function":{pattern:/\b(?!operator\b)[a-z_]\w*\s*<(?:[^<>]|<[^<>]*>)*>(?=\s*\()/i,inside:{function:/^\w+/,generic:{pattern:/<[\s\S]+/,alias:"class-name",inside:e.languages.cpp}}}}),e.languages.insertBefore("cpp","operator",{"double-colon":{pattern:/::/,alias:"punctuation"}}),e.languages.insertBefore("cpp","class-name",{"base-clause":{pattern:/(\b(?:class|struct)\s+\w+\s*:\s*)[^;{}"'\s]+(?:\s+[^;{}"'\s]+)*(?=\s*[;{])/,lookbehind:!0,greedy:!0,inside:e.languages.extend("cpp",{})}}),e.languages.insertBefore("inside","double-colon",{"class-name":/\b[a-z_]\w*\b(?!\s*::)/i},e.languages.cpp["base-clause"])}(o),function(e){var t=/(?:"(?:\\(?:\r\n|[\s\S])|[^"\\\r\n])*"|'(?:\\(?:\r\n|[\s\S])|[^'\\\r\n])*')/;e.languages.css={comment:/\/\*[\s\S]*?\*\//,atrule:{pattern:/@[\w-](?:[^;{\s]|\s+(?![\s{]))*(?:;|(?=\s*\{))/,inside:{rule:/^@[\w-]+/,"selector-function-argument":{pattern:/(\bselector\s*\(\s*(?![\s)]))(?:[^()\s]|\s+(?![\s)])|\((?:[^()]|\([^()]*\))*\))+(?=\s*\))/,lookbehind:!0,alias:"selector"},keyword:{pattern:/(^|[^\w-])(?:and|not|only|or)(?![\w-])/,lookbehind:!0}}},url:{pattern:RegExp("\\burl\\((?:"+t.source+"|"+/(?:[^\\\r\n()"']|\\[\s\S])*/.source+")\\)","i"),greedy:!0,inside:{function:/^url/i,punctuation:/^\(|\)$/,string:{pattern:RegExp("^"+t.source+"$"),alias:"url"}}},selector:{pattern:RegExp("(^|[{}\\s])[^{}\\s](?:[^{};\"'\\s]|\\s+(?![\\s{])|"+t.source+")*(?=\\s*\\{)"),lookbehind:!0},string:{pattern:t,greedy:!0},property:{pattern:/(^|[^-\w\xA0-\uFFFF])(?!\s)[-_a-z\xA0-\uFFFF](?:(?!\s)[-\w\xA0-\uFFFF])*(?=\s*:)/i,lookbehind:!0},important:/!important\b/i,function:{pattern:/(^|[^-a-z0-9])[-a-z0-9]+(?=\()/i,lookbehind:!0},punctuation:/[(){};:,]/},e.languages.css.atrule.inside.rest=e.languages.css;var n=e.languages.markup;n&&(n.tag.addInlined("style","css"),n.tag.addAttribute("style","css"))}(o),function(e){var t,n=/("|')(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/;e.languages.css.selector={pattern:e.languages.css.selector.pattern,lookbehind:!0,inside:t={"pseudo-element":/:(?:after|before|first-letter|first-line|selection)|::[-\w]+/,"pseudo-class":/:[-\w]+/,class:/\.[-\w]+/,id:/#[-\w]+/,attribute:{pattern:RegExp("\\[(?:[^[\\]\"']|"+n.source+")*\\]"),greedy:!0,inside:{punctuation:/^\[|\]$/,"case-sensitivity":{pattern:/(\s)[si]$/i,lookbehind:!0,alias:"keyword"},namespace:{pattern:/^(\s*)(?:(?!\s)[-*\w\xA0-\uFFFF])*\|(?!=)/,lookbehind:!0,inside:{punctuation:/\|$/}},"attr-name":{pattern:/^(\s*)(?:(?!\s)[-\w\xA0-\uFFFF])+/,lookbehind:!0},"attr-value":[n,{pattern:/(=\s*)(?:(?!\s)[-\w\xA0-\uFFFF])+(?=\s*$)/,lookbehind:!0}],operator:/[|~*^$]?=/}},"n-th":[{pattern:/(\(\s*)[+-]?\d*[\dn](?:\s*[+-]\s*\d+)?(?=\s*\))/,lookbehind:!0,inside:{number:/[\dn]+/,operator:/[+-]/}},{pattern:/(\(\s*)(?:even|odd)(?=\s*\))/i,lookbehind:!0}],combinator:/>|\+|~|\|\|/,punctuation:/[(),]/}},e.languages.css.atrule.inside["selector-function-argument"].inside=t,e.languages.insertBefore("css","property",{variable:{pattern:/(^|[^-\w\xA0-\uFFFF])--(?!\s)[-_a-z\xA0-\uFFFF](?:(?!\s)[-\w\xA0-\uFFFF])*/i,lookbehind:!0}});var r={pattern:/(\b\d+)(?:%|[a-z]+(?![\w-]))/,lookbehind:!0},o={pattern:/(^|[^\w.-])-?(?:\d+(?:\.\d+)?|\.\d+)/,lookbehind:!0};e.languages.insertBefore("css","function",{operator:{pattern:/(\s)[+\-*\/](?=\s)/,lookbehind:!0},hexcode:{pattern:/\B#[\da-f]{3,8}\b/i,alias:"color"},color:[{pattern:/(^|[^\w-])(?:AliceBlue|AntiqueWhite|Aqua|Aquamarine|Azure|Beige|Bisque|Black|BlanchedAlmond|Blue|BlueViolet|Brown|BurlyWood|CadetBlue|Chartreuse|Chocolate|Coral|CornflowerBlue|Cornsilk|Crimson|Cyan|DarkBlue|DarkCyan|DarkGoldenRod|DarkGr[ae]y|DarkGreen|DarkKhaki|DarkMagenta|DarkOliveGreen|DarkOrange|DarkOrchid|DarkRed|DarkSalmon|DarkSeaGreen|DarkSlateBlue|DarkSlateGr[ae]y|DarkTurquoise|DarkViolet|DeepPink|DeepSkyBlue|DimGr[ae]y|DodgerBlue|FireBrick|FloralWhite|ForestGreen|Fuchsia|Gainsboro|GhostWhite|Gold|GoldenRod|Gr[ae]y|Green|GreenYellow|HoneyDew|HotPink|IndianRed|Indigo|Ivory|Khaki|Lavender|LavenderBlush|LawnGreen|LemonChiffon|LightBlue|LightCoral|LightCyan|LightGoldenRodYellow|LightGr[ae]y|LightGreen|LightPink|LightSalmon|LightSeaGreen|LightSkyBlue|LightSlateGr[ae]y|LightSteelBlue|LightYellow|Lime|LimeGreen|Linen|Magenta|Maroon|MediumAquaMarine|MediumBlue|MediumOrchid|MediumPurple|MediumSeaGreen|MediumSlateBlue|MediumSpringGreen|MediumTurquoise|MediumVioletRed|MidnightBlue|MintCream|MistyRose|Moccasin|NavajoWhite|Navy|OldLace|Olive|OliveDrab|Orange|OrangeRed|Orchid|PaleGoldenRod|PaleGreen|PaleTurquoise|PaleVioletRed|PapayaWhip|PeachPuff|Peru|Pink|Plum|PowderBlue|Purple|Red|RosyBrown|RoyalBlue|SaddleBrown|Salmon|SandyBrown|SeaGreen|SeaShell|Sienna|Silver|SkyBlue|SlateBlue|SlateGr[ae]y|Snow|SpringGreen|SteelBlue|Tan|Teal|Thistle|Tomato|Transparent|Turquoise|Violet|Wheat|White|WhiteSmoke|Yellow|YellowGreen)(?![\w-])/i,lookbehind:!0},{pattern:/\b(?:hsl|rgb)\(\s*\d{1,3}\s*,\s*\d{1,3}%?\s*,\s*\d{1,3}%?\s*\)\B|\b(?:hsl|rgb)a\(\s*\d{1,3}\s*,\s*\d{1,3}%?\s*,\s*\d{1,3}%?\s*,\s*(?:0|0?\.\d+|1)\s*\)\B/i,inside:{unit:r,number:o,function:/[\w-]+(?=\()/,punctuation:/[(),]/}}],entity:/\\[\da-f]{1,8}/i,unit:r,number:o})}(o),o.languages.javascript=o.languages.extend("clike",{"class-name":[o.languages.clike["class-name"],{pattern:/(^|[^$\w\xA0-\uFFFF])(?!\s)[_$A-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\.(?:constructor|prototype))/,lookbehind:!0}],keyword:[{pattern:/((?:^|\})\s*)catch\b/,lookbehind:!0},{pattern:/(^|[^.]|\.\.\.\s*)\b(?:as|assert(?=\s*\{)|async(?=\s*(?:function\b|\(|[$\w\xA0-\uFFFF]|$))|await|break|case|class|const|continue|debugger|default|delete|do|else|enum|export|extends|finally(?=\s*(?:\{|$))|for|from(?=\s*(?:['"]|$))|function|(?:get|set)(?=\s*(?:[#\[$\w\xA0-\uFFFF]|$))|if|implements|import|in|instanceof|interface|let|new|null|of|package|private|protected|public|return|static|super|switch|this|throw|try|typeof|undefined|var|void|while|with|yield)\b/,lookbehind:!0}],function:/#?(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\s*(?:\.\s*(?:apply|bind|call)\s*)?\()/,number:{pattern:RegExp(/(^|[^\w$])/.source+"(?:"+/NaN|Infinity/.source+"|"+/0[bB][01]+(?:_[01]+)*n?/.source+"|"+/0[oO][0-7]+(?:_[0-7]+)*n?/.source+"|"+/0[xX][\dA-Fa-f]+(?:_[\dA-Fa-f]+)*n?/.source+"|"+/\d+(?:_\d+)*n/.source+"|"+/(?:\d+(?:_\d+)*(?:\.(?:\d+(?:_\d+)*)?)?|\.\d+(?:_\d+)*)(?:[Ee][+-]?\d+(?:_\d+)*)?/.source+")"+/(?![\w$])/.source),lookbehind:!0},operator:/--|\+\+|\*\*=?|=>|&&=?|\|\|=?|[!=]==|<<=?|>>>?=?|[-+*/%&|^!=<>]=?|\.{3}|\?\?=?|\?\.?|[~:]/}),o.languages.javascript["class-name"][0].pattern=/(\b(?:class|extends|implements|instanceof|interface|new)\s+)[\w.\\]+/,o.languages.insertBefore("javascript","keyword",{regex:{pattern:/((?:^|[^$\w\xA0-\uFFFF."'\])\s]|\b(?:return|yield))\s*)\/(?:\[(?:[^\]\\\r\n]|\\.)*\]|\\.|[^/\\\[\r\n])+\/[dgimyus]{0,7}(?=(?:\s|\/\*(?:[^*]|\*(?!\/))*\*\/)*(?:$|[\r\n,.;:})\]]|\/\/))/,lookbehind:!0,greedy:!0,inside:{"regex-source":{pattern:/^(\/)[\s\S]+(?=\/[a-z]*$)/,lookbehind:!0,alias:"language-regex",inside:o.languages.regex},"regex-delimiter":/^\/|\/$/,"regex-flags":/^[a-z]+$/}},"function-variable":{pattern:/#?(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\s*[=:]\s*(?:async\s*)?(?:\bfunction\b|(?:\((?:[^()]|\([^()]*\))*\)|(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*)\s*=>))/,alias:"function"},parameter:[{pattern:/(function(?:\s+(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*)?\s*\(\s*)(?!\s)(?:[^()\s]|\s+(?![\s)])|\([^()]*\))+(?=\s*\))/,lookbehind:!0,inside:o.languages.javascript},{pattern:/(^|[^$\w\xA0-\uFFFF])(?!\s)[_$a-z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\s*=>)/i,lookbehind:!0,inside:o.languages.javascript},{pattern:/(\(\s*)(?!\s)(?:[^()\s]|\s+(?![\s)])|\([^()]*\))+(?=\s*\)\s*=>)/,lookbehind:!0,inside:o.languages.javascript},{pattern:/((?:\b|\s|^)(?!(?:as|async|await|break|case|catch|class|const|continue|debugger|default|delete|do|else|enum|export|extends|finally|for|from|function|get|if|implements|import|in|instanceof|interface|let|new|null|of|package|private|protected|public|return|set|static|super|switch|this|throw|try|typeof|undefined|var|void|while|with|yield)(?![$\w\xA0-\uFFFF]))(?:(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*\s*)\(\s*|\]\s*\(\s*)(?!\s)(?:[^()\s]|\s+(?![\s)])|\([^()]*\))+(?=\s*\)\s*\{)/,lookbehind:!0,inside:o.languages.javascript}],constant:/\b[A-Z](?:[A-Z_]|\dx?)*\b/}),o.languages.insertBefore("javascript","string",{hashbang:{pattern:/^#!.*/,greedy:!0,alias:"comment"},"template-string":{pattern:/`(?:\\[\s\S]|\$\{(?:[^{}]|\{(?:[^{}]|\{[^}]*\})*\})+\}|(?!\$\{)[^\\`])*`/,greedy:!0,inside:{"template-punctuation":{pattern:/^`|`$/,alias:"string"},interpolation:{pattern:/((?:^|[^\\])(?:\\{2})*)\$\{(?:[^{}]|\{(?:[^{}]|\{[^}]*\})*\})+\}/,lookbehind:!0,inside:{"interpolation-punctuation":{pattern:/^\$\{|\}$/,alias:"punctuation"},rest:o.languages.javascript}},string:/[\s\S]+/}},"string-property":{pattern:/((?:^|[,{])[ \t]*)(["'])(?:\\(?:\r\n|[\s\S])|(?!\2)[^\\\r\n])*\2(?=\s*:)/m,lookbehind:!0,greedy:!0,alias:"property"}}),o.languages.insertBefore("javascript","operator",{"literal-property":{pattern:/((?:^|[,{])[ \t]*)(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\s*:)/m,lookbehind:!0,alias:"property"}}),o.languages.markup&&(o.languages.markup.tag.addInlined("script","javascript"),o.languages.markup.tag.addAttribute(/on(?:abort|blur|change|click|composition(?:end|start|update)|dblclick|error|focus(?:in|out)?|key(?:down|up)|load|mouse(?:down|enter|leave|move|out|over|up)|reset|resize|scroll|select|slotchange|submit|unload|wheel)/.source,"javascript")),o.languages.js=o.languages.javascript,function(e){var t=e.util.clone(e.languages.javascript),n=/(?:\s|\/\/.*(?!.)|\/\*(?:[^*]|\*(?!\/))\*\/)/.source,r=/(?:\{(?:\{(?:\{[^{}]*\}|[^{}])*\}|[^{}])*\})/.source,o=/(?:\{*\.{3}(?:[^{}]|)*\})/.source;function a(e,t){return e=e.replace(//g,(function(){return n})).replace(//g,(function(){return r})).replace(//g,(function(){return o})),RegExp(e,t)}o=a(o).source,e.languages.jsx=e.languages.extend("markup",t),e.languages.jsx.tag.pattern=a(/<\/?(?:[\w.:-]+(?:+(?:[\w.:$-]+(?:=(?:"(?:\\[\s\S]|[^\\"])*"|'(?:\\[\s\S]|[^\\'])*'|[^\s{'"/>=]+|))?|))**\/?)?>/.source),e.languages.jsx.tag.inside.tag.pattern=/^<\/?[^\s>\/]*/,e.languages.jsx.tag.inside["attr-value"].pattern=/=(?!\{)(?:"(?:\\[\s\S]|[^\\"])*"|'(?:\\[\s\S]|[^\\'])*'|[^\s'">]+)/,e.languages.jsx.tag.inside.tag.inside["class-name"]=/^[A-Z]\w*(?:\.[A-Z]\w*)*$/,e.languages.jsx.tag.inside.comment=t.comment,e.languages.insertBefore("inside","attr-name",{spread:{pattern:a(//.source),inside:e.languages.jsx}},e.languages.jsx.tag),e.languages.insertBefore("inside","special-attr",{script:{pattern:a(/=/.source),alias:"language-javascript",inside:{"script-punctuation":{pattern:/^=(?=\{)/,alias:"punctuation"},rest:e.languages.jsx}}},e.languages.jsx.tag);var i=function(e){return e?"string"==typeof e?e:"string"==typeof e.content?e.content:e.content.map(i).join(""):""},l=function(t){for(var n=[],r=0;r0&&n[n.length-1].tagName===i(o.content[0].content[1])&&n.pop():"/>"===o.content[o.content.length-1].content||n.push({tagName:i(o.content[0].content[1]),openedBraces:0}):n.length>0&&"punctuation"===o.type&&"{"===o.content?n[n.length-1].openedBraces++:n.length>0&&n[n.length-1].openedBraces>0&&"punctuation"===o.type&&"}"===o.content?n[n.length-1].openedBraces--:a=!0),(a||"string"==typeof o)&&n.length>0&&0===n[n.length-1].openedBraces){var u=i(o);r0&&("string"==typeof t[r-1]||"plain-text"===t[r-1].type)&&(u=i(t[r-1])+u,t.splice(r-1,1),r--),t[r]=new e.Token("plain-text",u,null,u)}o.content&&"string"!=typeof o.content&&l(o.content)}};e.hooks.add("after-tokenize",(function(e){"jsx"!==e.language&&"tsx"!==e.language||l(e.tokens)}))}(o),function(e){function t(e,t){return RegExp(e.replace(//g,(function(){return/(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*/.source})),t)}e.languages.insertBefore("javascript","function-variable",{"method-variable":{pattern:RegExp("(\\.\\s*)"+e.languages.javascript["function-variable"].pattern.source),lookbehind:!0,alias:["function-variable","method","function","property-access"]}}),e.languages.insertBefore("javascript","function",{method:{pattern:RegExp("(\\.\\s*)"+e.languages.javascript.function.source),lookbehind:!0,alias:["function","property-access"]}}),e.languages.insertBefore("javascript","constant",{"known-class-name":[{pattern:/\b(?:(?:Float(?:32|64)|(?:Int|Uint)(?:8|16|32)|Uint8Clamped)?Array|ArrayBuffer|BigInt|Boolean|DataView|Date|Error|Function|Intl|JSON|(?:Weak)?(?:Map|Set)|Math|Number|Object|Promise|Proxy|Reflect|RegExp|String|Symbol|WebAssembly)\b/,alias:"class-name"},{pattern:/\b(?:[A-Z]\w*)Error\b/,alias:"class-name"}]}),e.languages.insertBefore("javascript","keyword",{imports:{pattern:t(/(\bimport\b\s*)(?:(?:\s*,\s*(?:\*\s*as\s+|\{[^{}]*\}))?|\*\s*as\s+|\{[^{}]*\})(?=\s*\bfrom\b)/.source),lookbehind:!0,inside:e.languages.javascript},exports:{pattern:t(/(\bexport\b\s*)(?:\*(?:\s*as\s+)?(?=\s*\bfrom\b)|\{[^{}]*\})/.source),lookbehind:!0,inside:e.languages.javascript}}),e.languages.javascript.keyword.unshift({pattern:/\b(?:as|default|export|from|import)\b/,alias:"module"},{pattern:/\b(?:await|break|catch|continue|do|else|finally|for|if|return|switch|throw|try|while|yield)\b/,alias:"control-flow"},{pattern:/\bnull\b/,alias:["null","nil"]},{pattern:/\bundefined\b/,alias:"nil"}),e.languages.insertBefore("javascript","operator",{spread:{pattern:/\.{3}/,alias:"operator"},arrow:{pattern:/=>/,alias:"operator"}}),e.languages.insertBefore("javascript","punctuation",{"property-access":{pattern:t(/(\.\s*)#?/.source),lookbehind:!0},"maybe-class-name":{pattern:/(^|[^$\w\xA0-\uFFFF])[A-Z][$\w\xA0-\uFFFF]+/,lookbehind:!0},dom:{pattern:/\b(?:document|(?:local|session)Storage|location|navigator|performance|window)\b/,alias:"variable"},console:{pattern:/\bconsole(?=\s*\.)/,alias:"class-name"}});for(var n=["function","function-variable","method","method-variable","property-access"],r=0;r=f.length)return;var r=t[n];if("string"==typeof r||"string"==typeof r.content){var o=f[i],a="string"==typeof r?r:r.content,l=a.indexOf(o);if(-1!==l){++i;var u=a.substring(0,l),d=s(c[o]),p=a.substring(l+o.length),m=[];if(u&&m.push(u),m.push(d),p){var h=[p];e(h),m.push.apply(m,h)}"string"==typeof r?(t.splice.apply(t,[n,1].concat(m)),n+=m.length-1):r.content=m}}else{var g=r.content;Array.isArray(g)?e(g):e([g])}}}(d),new e.Token(r,d,"language-"+r,t)}e.languages.javascript["template-string"]=[i("css",/\b(?:styled(?:\([^)]*\))?(?:\s*\.\s*\w+(?:\([^)]*\))*)*|css(?:\s*\.\s*(?:global|resolve))?|createGlobalStyle|keyframes)/.source),i("html",/\bhtml|\.\s*(?:inner|outer)HTML\s*\+?=/.source),i("svg",/\bsvg/.source),i("markdown",/\b(?:markdown|md)/.source),i("graphql",/\b(?:gql|graphql(?:\s*\.\s*experimental)?)/.source),i("sql",/\bsql/.source),t].filter(Boolean);var d={javascript:!0,js:!0,typescript:!0,ts:!0,jsx:!0,tsx:!0};function f(e){return"string"==typeof e?e:Array.isArray(e)?e.map(f).join(""):f(e.content)}e.hooks.add("after-tokenize",(function(t){t.language in d&&function t(n){for(var r=0,o=n.length;r",unchanged:" ",diff:"!"};Object.keys(t).forEach((function(n){var r=t[n],o=[];/^\w+$/.test(n)||o.push(/\w+/.exec(n)[0]),"diff"===n&&o.push("bold"),e.languages.diff[n]={pattern:RegExp("^(?:["+r+"].*(?:\r\n?|\n|(?![\\s\\S])))+","m"),alias:o,inside:{line:{pattern:/(.)(?=[\s\S]).*(?:\r\n?|\n)?/,lookbehind:!0},prefix:{pattern:/[\s\S]/,alias:/\w+/.exec(n)[0]}}}})),Object.defineProperty(e.languages.diff,"PREFIXES",{value:t})}(o),o.languages.git={comment:/^#.*/m,deleted:/^[-\u2013].*/m,inserted:/^\+.*/m,string:/("|')(?:\\.|(?!\1)[^\\\r\n])*\1/,command:{pattern:/^.*\$ git .*$/m,inside:{parameter:/\s--?\w+/}},coord:/^@@.*@@$/m,"commit-sha1":/^commit \w{40}$/m},o.languages.go=o.languages.extend("clike",{string:{pattern:/(^|[^\\])"(?:\\.|[^"\\\r\n])*"|`[^`]*`/,lookbehind:!0,greedy:!0},keyword:/\b(?:break|case|chan|const|continue|default|defer|else|fallthrough|for|func|go(?:to)?|if|import|interface|map|package|range|return|select|struct|switch|type|var)\b/,boolean:/\b(?:_|false|iota|nil|true)\b/,number:[/\b0(?:b[01_]+|o[0-7_]+)i?\b/i,/\b0x(?:[a-f\d_]+(?:\.[a-f\d_]*)?|\.[a-f\d_]+)(?:p[+-]?\d+(?:_\d+)*)?i?(?!\w)/i,/(?:\b\d[\d_]*(?:\.[\d_]*)?|\B\.\d[\d_]*)(?:e[+-]?[\d_]+)?i?(?!\w)/i],operator:/[*\/%^!=]=?|\+[=+]?|-[=-]?|\|[=|]?|&(?:=|&|\^=?)?|>(?:>=?|=)?|<(?:<=?|=|-)?|:=|\.\.\./,builtin:/\b(?:append|bool|byte|cap|close|complex|complex(?:64|128)|copy|delete|error|float(?:32|64)|u?int(?:8|16|32|64)?|imag|len|make|new|panic|print(?:ln)?|real|recover|rune|string|uintptr)\b/}),o.languages.insertBefore("go","string",{char:{pattern:/'(?:\\.|[^'\\\r\n]){0,10}'/,greedy:!0}}),delete o.languages.go["class-name"],o.languages.graphql={comment:/#.*/,description:{pattern:/(?:"""(?:[^"]|(?!""")")*"""|"(?:\\.|[^\\"\r\n])*")(?=\s*[a-z_])/i,greedy:!0,alias:"string",inside:{"language-markdown":{pattern:/(^"(?:"")?)(?!\1)[\s\S]+(?=\1$)/,lookbehind:!0,inside:o.languages.markdown}}},string:{pattern:/"""(?:[^"]|(?!""")")*"""|"(?:\\.|[^\\"\r\n])*"/,greedy:!0},number:/(?:\B-|\b)\d+(?:\.\d+)?(?:e[+-]?\d+)?\b/i,boolean:/\b(?:false|true)\b/,variable:/\$[a-z_]\w*/i,directive:{pattern:/@[a-z_]\w*/i,alias:"function"},"attr-name":{pattern:/\b[a-z_]\w*(?=\s*(?:\((?:[^()"]|"(?:\\.|[^\\"\r\n])*")*\))?:)/i,greedy:!0},"atom-input":{pattern:/\b[A-Z]\w*Input\b/,alias:"class-name"},scalar:/\b(?:Boolean|Float|ID|Int|String)\b/,constant:/\b[A-Z][A-Z_\d]*\b/,"class-name":{pattern:/(\b(?:enum|implements|interface|on|scalar|type|union)\s+|&\s*|:\s*|\[)[A-Z_]\w*/,lookbehind:!0},fragment:{pattern:/(\bfragment\s+|\.{3}\s*(?!on\b))[a-zA-Z_]\w*/,lookbehind:!0,alias:"function"},"definition-mutation":{pattern:/(\bmutation\s+)[a-zA-Z_]\w*/,lookbehind:!0,alias:"function"},"definition-query":{pattern:/(\bquery\s+)[a-zA-Z_]\w*/,lookbehind:!0,alias:"function"},keyword:/\b(?:directive|enum|extend|fragment|implements|input|interface|mutation|on|query|repeatable|scalar|schema|subscription|type|union)\b/,operator:/[!=|&]|\.{3}/,"property-query":/\w+(?=\s*\()/,object:/\w+(?=\s*\{)/,punctuation:/[!(){}\[\]:=,]/,property:/\w+/},o.hooks.add("after-tokenize",(function(e){if("graphql"===e.language)for(var t=e.tokens.filter((function(e){return"string"!=typeof e&&"comment"!==e.type&&"scalar"!==e.type})),n=0;n0)){var l=f(/^\{$/,/^\}$/);if(-1===l)continue;for(var u=n;u=0&&p(s,"variable-input")}}}}function c(e){return t[n+e]}function d(e,t){t=t||0;for(var n=0;n=a.length);u++){var s=l[u];if("string"==typeof s||s.content&&"string"==typeof s.content){var c=a[o],d=n.tokenStack[c],f="string"==typeof s?s:s.content,p=t(r,c),m=f.indexOf(p);if(m>-1){++o;var h=f.substring(0,m),g=new e.Token(r,e.tokenize(d,n.grammar),"language-"+r,d),v=f.substring(m+p.length),b=[];h&&b.push.apply(b,i([h])),b.push(g),v&&b.push.apply(b,i([v])),"string"==typeof s?l.splice.apply(l,[u,1].concat(b)):s.content=b}}else s.content&&i(s.content)}return l}(n.tokens)}}}})}(o),function(e){e.languages.handlebars={comment:/\{\{![\s\S]*?\}\}/,delimiter:{pattern:/^\{\{\{?|\}\}\}?$/,alias:"punctuation"},string:/(["'])(?:\\.|(?!\1)[^\\\r\n])*\1/,number:/\b0x[\dA-Fa-f]+\b|(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:[Ee][+-]?\d+)?/,boolean:/\b(?:false|true)\b/,block:{pattern:/^(\s*(?:~\s*)?)[#\/]\S+?(?=\s*(?:~\s*)?$|\s)/,lookbehind:!0,alias:"keyword"},brackets:{pattern:/\[[^\]]+\]/,inside:{punctuation:/\[|\]/,variable:/[\s\S]+/}},punctuation:/[!"#%&':()*+,.\/;<=>@\[\\\]^`{|}~]/,variable:/[^!"#%&'()*+,\/;<=>@\[\\\]^`{|}~\s]+/},e.hooks.add("before-tokenize",(function(t){e.languages["markup-templating"].buildPlaceholders(t,"handlebars",/\{\{\{[\s\S]+?\}\}\}|\{\{[\s\S]+?\}\}/g)})),e.hooks.add("after-tokenize",(function(t){e.languages["markup-templating"].tokenizePlaceholders(t,"handlebars")})),e.languages.hbs=e.languages.handlebars}(o),o.languages.json={property:{pattern:/(^|[^\\])"(?:\\.|[^\\"\r\n])*"(?=\s*:)/,lookbehind:!0,greedy:!0},string:{pattern:/(^|[^\\])"(?:\\.|[^\\"\r\n])*"(?!\s*:)/,lookbehind:!0,greedy:!0},comment:{pattern:/\/\/.*|\/\*[\s\S]*?(?:\*\/|$)/,greedy:!0},number:/-?\b\d+(?:\.\d+)?(?:e[+-]?\d+)?\b/i,punctuation:/[{}[\],]/,operator:/:/,boolean:/\b(?:false|true)\b/,null:{pattern:/\bnull\b/,alias:"keyword"}},o.languages.webmanifest=o.languages.json,o.languages.less=o.languages.extend("css",{comment:[/\/\*[\s\S]*?\*\//,{pattern:/(^|[^\\])\/\/.*/,lookbehind:!0}],atrule:{pattern:/@[\w-](?:\((?:[^(){}]|\([^(){}]*\))*\)|[^(){};\s]|\s+(?!\s))*?(?=\s*\{)/,inside:{punctuation:/[:()]/}},selector:{pattern:/(?:@\{[\w-]+\}|[^{};\s@])(?:@\{[\w-]+\}|\((?:[^(){}]|\([^(){}]*\))*\)|[^(){};@\s]|\s+(?!\s))*?(?=\s*\{)/,inside:{variable:/@+[\w-]+/}},property:/(?:@\{[\w-]+\}|[\w-])+(?:\+_?)?(?=\s*:)/,operator:/[+\-*\/]/}),o.languages.insertBefore("less","property",{variable:[{pattern:/@[\w-]+\s*:/,inside:{punctuation:/:/}},/@@?[\w-]+/],"mixin-usage":{pattern:/([{;]\s*)[.#](?!\d)[\w-].*?(?=[(;])/,lookbehind:!0,alias:"function"}}),o.languages.makefile={comment:{pattern:/(^|[^\\])#(?:\\(?:\r\n|[\s\S])|[^\\\r\n])*/,lookbehind:!0},string:{pattern:/(["'])(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/,greedy:!0},"builtin-target":{pattern:/\.[A-Z][^:#=\s]+(?=\s*:(?!=))/,alias:"builtin"},target:{pattern:/^(?:[^:=\s]|[ \t]+(?![\s:]))+(?=\s*:(?!=))/m,alias:"symbol",inside:{variable:/\$+(?:(?!\$)[^(){}:#=\s]+|(?=[({]))/}},variable:/\$+(?:(?!\$)[^(){}:#=\s]+|\([@*%<^+?][DF]\)|(?=[({]))/,keyword:/-include\b|\b(?:define|else|endef|endif|export|ifn?def|ifn?eq|include|override|private|sinclude|undefine|unexport|vpath)\b/,function:{pattern:/(\()(?:abspath|addsuffix|and|basename|call|dir|error|eval|file|filter(?:-out)?|findstring|firstword|flavor|foreach|guile|if|info|join|lastword|load|notdir|or|origin|patsubst|realpath|shell|sort|strip|subst|suffix|value|warning|wildcard|word(?:list|s)?)(?=[ \t])/,lookbehind:!0},operator:/(?:::|[?:+!])?=|[|@]/,punctuation:/[:;(){}]/},function(e){var t=/(?:\\.|[^\\\n\r]|(?:\n|\r\n?)(?![\r\n]))/.source;function n(e){return e=e.replace(//g,(function(){return t})),RegExp(/((?:^|[^\\])(?:\\{2})*)/.source+"(?:"+e+")")}var r=/(?:\\.|``(?:[^`\r\n]|`(?!`))+``|`[^`\r\n]+`|[^\\|\r\n`])+/.source,o=/\|?__(?:\|__)+\|?(?:(?:\n|\r\n?)|(?![\s\S]))/.source.replace(/__/g,(function(){return r})),a=/\|?[ \t]*:?-{3,}:?[ \t]*(?:\|[ \t]*:?-{3,}:?[ \t]*)+\|?(?:\n|\r\n?)/.source;e.languages.markdown=e.languages.extend("markup",{}),e.languages.insertBefore("markdown","prolog",{"front-matter-block":{pattern:/(^(?:\s*[\r\n])?)---(?!.)[\s\S]*?[\r\n]---(?!.)/,lookbehind:!0,greedy:!0,inside:{punctuation:/^---|---$/,"front-matter":{pattern:/\S+(?:\s+\S+)*/,alias:["yaml","language-yaml"],inside:e.languages.yaml}}},blockquote:{pattern:/^>(?:[\t ]*>)*/m,alias:"punctuation"},table:{pattern:RegExp("^"+o+a+"(?:"+o+")*","m"),inside:{"table-data-rows":{pattern:RegExp("^("+o+a+")(?:"+o+")*$"),lookbehind:!0,inside:{"table-data":{pattern:RegExp(r),inside:e.languages.markdown},punctuation:/\|/}},"table-line":{pattern:RegExp("^("+o+")"+a+"$"),lookbehind:!0,inside:{punctuation:/\||:?-{3,}:?/}},"table-header-row":{pattern:RegExp("^"+o+"$"),inside:{"table-header":{pattern:RegExp(r),alias:"important",inside:e.languages.markdown},punctuation:/\|/}}}},code:[{pattern:/((?:^|\n)[ \t]*\n|(?:^|\r\n?)[ \t]*\r\n?)(?: {4}|\t).+(?:(?:\n|\r\n?)(?: {4}|\t).+)*/,lookbehind:!0,alias:"keyword"},{pattern:/^```[\s\S]*?^```$/m,greedy:!0,inside:{"code-block":{pattern:/^(```.*(?:\n|\r\n?))[\s\S]+?(?=(?:\n|\r\n?)^```$)/m,lookbehind:!0},"code-language":{pattern:/^(```).+/,lookbehind:!0},punctuation:/```/}}],title:[{pattern:/\S.*(?:\n|\r\n?)(?:==+|--+)(?=[ \t]*$)/m,alias:"important",inside:{punctuation:/==+$|--+$/}},{pattern:/(^\s*)#.+/m,lookbehind:!0,alias:"important",inside:{punctuation:/^#+|#+$/}}],hr:{pattern:/(^\s*)([*-])(?:[\t ]*\2){2,}(?=\s*$)/m,lookbehind:!0,alias:"punctuation"},list:{pattern:/(^\s*)(?:[*+-]|\d+\.)(?=[\t ].)/m,lookbehind:!0,alias:"punctuation"},"url-reference":{pattern:/!?\[[^\]]+\]:[\t ]+(?:\S+|<(?:\\.|[^>\\])+>)(?:[\t ]+(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\((?:\\.|[^)\\])*\)))?/,inside:{variable:{pattern:/^(!?\[)[^\]]+/,lookbehind:!0},string:/(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\((?:\\.|[^)\\])*\))$/,punctuation:/^[\[\]!:]|[<>]/},alias:"url"},bold:{pattern:n(/\b__(?:(?!_)|_(?:(?!_))+_)+__\b|\*\*(?:(?!\*)|\*(?:(?!\*))+\*)+\*\*/.source),lookbehind:!0,greedy:!0,inside:{content:{pattern:/(^..)[\s\S]+(?=..$)/,lookbehind:!0,inside:{}},punctuation:/\*\*|__/}},italic:{pattern:n(/\b_(?:(?!_)|__(?:(?!_))+__)+_\b|\*(?:(?!\*)|\*\*(?:(?!\*))+\*\*)+\*/.source),lookbehind:!0,greedy:!0,inside:{content:{pattern:/(^.)[\s\S]+(?=.$)/,lookbehind:!0,inside:{}},punctuation:/[*_]/}},strike:{pattern:n(/(~~?)(?:(?!~))+\2/.source),lookbehind:!0,greedy:!0,inside:{content:{pattern:/(^~~?)[\s\S]+(?=\1$)/,lookbehind:!0,inside:{}},punctuation:/~~?/}},"code-snippet":{pattern:/(^|[^\\`])(?:``[^`\r\n]+(?:`[^`\r\n]+)*``(?!`)|`[^`\r\n]+`(?!`))/,lookbehind:!0,greedy:!0,alias:["code","keyword"]},url:{pattern:n(/!?\[(?:(?!\]))+\](?:\([^\s)]+(?:[\t ]+"(?:\\.|[^"\\])*")?\)|[ \t]?\[(?:(?!\]))+\])/.source),lookbehind:!0,greedy:!0,inside:{operator:/^!/,content:{pattern:/(^\[)[^\]]+(?=\])/,lookbehind:!0,inside:{}},variable:{pattern:/(^\][ \t]?\[)[^\]]+(?=\]$)/,lookbehind:!0},url:{pattern:/(^\]\()[^\s)]+/,lookbehind:!0},string:{pattern:/(^[ \t]+)"(?:\\.|[^"\\])*"(?=\)$)/,lookbehind:!0}}}}),["url","bold","italic","strike"].forEach((function(t){["url","bold","italic","strike","code-snippet"].forEach((function(n){t!==n&&(e.languages.markdown[t].inside.content.inside[n]=e.languages.markdown[n])}))})),e.hooks.add("after-tokenize",(function(e){"markdown"!==e.language&&"md"!==e.language||function e(t){if(t&&"string"!=typeof t)for(var n=0,r=t.length;n",quot:'"'},u=String.fromCodePoint||String.fromCharCode;e.languages.md=e.languages.markdown}(o),o.languages.objectivec=o.languages.extend("c",{string:{pattern:/@?"(?:\\(?:\r\n|[\s\S])|[^"\\\r\n])*"/,greedy:!0},keyword:/\b(?:asm|auto|break|case|char|const|continue|default|do|double|else|enum|extern|float|for|goto|if|in|inline|int|long|register|return|self|short|signed|sizeof|static|struct|super|switch|typedef|typeof|union|unsigned|void|volatile|while)\b|(?:@interface|@end|@implementation|@protocol|@class|@public|@protected|@private|@property|@try|@catch|@finally|@throw|@synthesize|@dynamic|@selector)\b/,operator:/-[->]?|\+\+?|!=?|<>?=?|==?|&&?|\|\|?|[~^%?*\/@]/}),delete o.languages.objectivec["class-name"],o.languages.objc=o.languages.objectivec,o.languages.ocaml={comment:{pattern:/\(\*[\s\S]*?\*\)/,greedy:!0},char:{pattern:/'(?:[^\\\r\n']|\\(?:.|[ox]?[0-9a-f]{1,3}))'/i,greedy:!0},string:[{pattern:/"(?:\\(?:[\s\S]|\r\n)|[^\\\r\n"])*"/,greedy:!0},{pattern:/\{([a-z_]*)\|[\s\S]*?\|\1\}/,greedy:!0}],number:[/\b(?:0b[01][01_]*|0o[0-7][0-7_]*)\b/i,/\b0x[a-f0-9][a-f0-9_]*(?:\.[a-f0-9_]*)?(?:p[+-]?\d[\d_]*)?(?!\w)/i,/\b\d[\d_]*(?:\.[\d_]*)?(?:e[+-]?\d[\d_]*)?(?!\w)/i],directive:{pattern:/\B#\w+/,alias:"property"},label:{pattern:/\B~\w+/,alias:"property"},"type-variable":{pattern:/\B'\w+/,alias:"function"},variant:{pattern:/`\w+/,alias:"symbol"},keyword:/\b(?:as|assert|begin|class|constraint|do|done|downto|else|end|exception|external|for|fun|function|functor|if|in|include|inherit|initializer|lazy|let|match|method|module|mutable|new|nonrec|object|of|open|private|rec|sig|struct|then|to|try|type|val|value|virtual|when|where|while|with)\b/,boolean:/\b(?:false|true)\b/,"operator-like-punctuation":{pattern:/\[[<>|]|[>|]\]|\{<|>\}/,alias:"punctuation"},operator:/\.[.~]|:[=>]|[=<>@^|&+\-*\/$%!?~][!$%&*+\-.\/:<=>?@^|~]*|\b(?:and|asr|land|lor|lsl|lsr|lxor|mod|or)\b/,punctuation:/;;|::|[(){}\[\].,:;#]|\b_\b/},o.languages.python={comment:{pattern:/(^|[^\\])#.*/,lookbehind:!0,greedy:!0},"string-interpolation":{pattern:/(?:f|fr|rf)(?:("""|''')[\s\S]*?\1|("|')(?:\\.|(?!\2)[^\\\r\n])*\2)/i,greedy:!0,inside:{interpolation:{pattern:/((?:^|[^{])(?:\{\{)*)\{(?!\{)(?:[^{}]|\{(?!\{)(?:[^{}]|\{(?!\{)(?:[^{}])+\})+\})+\}/,lookbehind:!0,inside:{"format-spec":{pattern:/(:)[^:(){}]+(?=\}$)/,lookbehind:!0},"conversion-option":{pattern:/![sra](?=[:}]$)/,alias:"punctuation"},rest:null}},string:/[\s\S]+/}},"triple-quoted-string":{pattern:/(?:[rub]|br|rb)?("""|''')[\s\S]*?\1/i,greedy:!0,alias:"string"},string:{pattern:/(?:[rub]|br|rb)?("|')(?:\\.|(?!\1)[^\\\r\n])*\1/i,greedy:!0},function:{pattern:/((?:^|\s)def[ \t]+)[a-zA-Z_]\w*(?=\s*\()/g,lookbehind:!0},"class-name":{pattern:/(\bclass\s+)\w+/i,lookbehind:!0},decorator:{pattern:/(^[\t ]*)@\w+(?:\.\w+)*/m,lookbehind:!0,alias:["annotation","punctuation"],inside:{punctuation:/\./}},keyword:/\b(?:_(?=\s*:)|and|as|assert|async|await|break|case|class|continue|def|del|elif|else|except|exec|finally|for|from|global|if|import|in|is|lambda|match|nonlocal|not|or|pass|print|raise|return|try|while|with|yield)\b/,builtin:/\b(?:__import__|abs|all|any|apply|ascii|basestring|bin|bool|buffer|bytearray|bytes|callable|chr|classmethod|cmp|coerce|compile|complex|delattr|dict|dir|divmod|enumerate|eval|execfile|file|filter|float|format|frozenset|getattr|globals|hasattr|hash|help|hex|id|input|int|intern|isinstance|issubclass|iter|len|list|locals|long|map|max|memoryview|min|next|object|oct|open|ord|pow|property|range|raw_input|reduce|reload|repr|reversed|round|set|setattr|slice|sorted|staticmethod|str|sum|super|tuple|type|unichr|unicode|vars|xrange|zip)\b/,boolean:/\b(?:False|None|True)\b/,number:/\b0(?:b(?:_?[01])+|o(?:_?[0-7])+|x(?:_?[a-f0-9])+)\b|(?:\b\d+(?:_\d+)*(?:\.(?:\d+(?:_\d+)*)?)?|\B\.\d+(?:_\d+)*)(?:e[+-]?\d+(?:_\d+)*)?j?(?!\w)/i,operator:/[-+%=]=?|!=|:=|\*\*?=?|\/\/?=?|<[<=>]?|>[=>]?|[&|^~]/,punctuation:/[{}[\];(),.:]/},o.languages.python["string-interpolation"].inside.interpolation.inside.rest=o.languages.python,o.languages.py=o.languages.python,o.languages.reason=o.languages.extend("clike",{string:{pattern:/"(?:\\(?:\r\n|[\s\S])|[^\\\r\n"])*"/,greedy:!0},"class-name":/\b[A-Z]\w*/,keyword:/\b(?:and|as|assert|begin|class|constraint|do|done|downto|else|end|exception|external|for|fun|function|functor|if|in|include|inherit|initializer|lazy|let|method|module|mutable|new|nonrec|object|of|open|or|private|rec|sig|struct|switch|then|to|try|type|val|virtual|when|while|with)\b/,operator:/\.{3}|:[:=]|\|>|->|=(?:==?|>)?|<=?|>=?|[|^?'#!~`]|[+\-*\/]\.?|\b(?:asr|land|lor|lsl|lsr|lxor|mod)\b/}),o.languages.insertBefore("reason","class-name",{char:{pattern:/'(?:\\x[\da-f]{2}|\\o[0-3][0-7][0-7]|\\\d{3}|\\.|[^'\\\r\n])'/,greedy:!0},constructor:/\b[A-Z]\w*\b(?!\s*\.)/,label:{pattern:/\b[a-z]\w*(?=::)/,alias:"symbol"}}),delete o.languages.reason.function,function(e){e.languages.sass=e.languages.extend("css",{comment:{pattern:/^([ \t]*)\/[\/*].*(?:(?:\r?\n|\r)\1[ \t].+)*/m,lookbehind:!0,greedy:!0}}),e.languages.insertBefore("sass","atrule",{"atrule-line":{pattern:/^(?:[ \t]*)[@+=].+/m,greedy:!0,inside:{atrule:/(?:@[\w-]+|[+=])/}}}),delete e.languages.sass.atrule;var t=/\$[-\w]+|#\{\$[-\w]+\}/,n=[/[+*\/%]|[=!]=|<=?|>=?|\b(?:and|not|or)\b/,{pattern:/(\s)-(?=\s)/,lookbehind:!0}];e.languages.insertBefore("sass","property",{"variable-line":{pattern:/^[ \t]*\$.+/m,greedy:!0,inside:{punctuation:/:/,variable:t,operator:n}},"property-line":{pattern:/^[ \t]*(?:[^:\s]+ *:.*|:[^:\s].*)/m,greedy:!0,inside:{property:[/[^:\s]+(?=\s*:)/,{pattern:/(:)[^:\s]+/,lookbehind:!0}],punctuation:/:/,variable:t,operator:n,important:e.languages.sass.important}}}),delete e.languages.sass.property,delete e.languages.sass.important,e.languages.insertBefore("sass","punctuation",{selector:{pattern:/^([ \t]*)\S(?:,[^,\r\n]+|[^,\r\n]*)(?:,[^,\r\n]+)*(?:,(?:\r?\n|\r)\1[ \t]+\S(?:,[^,\r\n]+|[^,\r\n]*)(?:,[^,\r\n]+)*)*/m,lookbehind:!0,greedy:!0}})}(o),o.languages.scss=o.languages.extend("css",{comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|\/\/.*)/,lookbehind:!0},atrule:{pattern:/@[\w-](?:\([^()]+\)|[^()\s]|\s+(?!\s))*?(?=\s+[{;])/,inside:{rule:/@[\w-]+/}},url:/(?:[-a-z]+-)?url(?=\()/i,selector:{pattern:/(?=\S)[^@;{}()]?(?:[^@;{}()\s]|\s+(?!\s)|#\{\$[-\w]+\})+(?=\s*\{(?:\}|\s|[^}][^:{}]*[:{][^}]))/,inside:{parent:{pattern:/&/,alias:"important"},placeholder:/%[-\w]+/,variable:/\$[-\w]+|#\{\$[-\w]+\}/}},property:{pattern:/(?:[-\w]|\$[-\w]|#\{\$[-\w]+\})+(?=\s*:)/,inside:{variable:/\$[-\w]+|#\{\$[-\w]+\}/}}}),o.languages.insertBefore("scss","atrule",{keyword:[/@(?:content|debug|each|else(?: if)?|extend|for|forward|function|if|import|include|mixin|return|use|warn|while)\b/i,{pattern:/( )(?:from|through)(?= )/,lookbehind:!0}]}),o.languages.insertBefore("scss","important",{variable:/\$[-\w]+|#\{\$[-\w]+\}/}),o.languages.insertBefore("scss","function",{"module-modifier":{pattern:/\b(?:as|hide|show|with)\b/i,alias:"keyword"},placeholder:{pattern:/%[-\w]+/,alias:"selector"},statement:{pattern:/\B!(?:default|optional)\b/i,alias:"keyword"},boolean:/\b(?:false|true)\b/,null:{pattern:/\bnull\b/,alias:"keyword"},operator:{pattern:/(\s)(?:[-+*\/%]|[=!]=|<=?|>=?|and|not|or)(?=\s)/,lookbehind:!0}}),o.languages.scss.atrule.inside.rest=o.languages.scss,o.languages.sql={comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|(?:--|\/\/|#).*)/,lookbehind:!0},variable:[{pattern:/@(["'`])(?:\\[\s\S]|(?!\1)[^\\])+\1/,greedy:!0},/@[\w.$]+/],string:{pattern:/(^|[^@\\])("|')(?:\\[\s\S]|(?!\2)[^\\]|\2\2)*\2/,greedy:!0,lookbehind:!0},identifier:{pattern:/(^|[^@\\])`(?:\\[\s\S]|[^`\\]|``)*`/,greedy:!0,lookbehind:!0,inside:{punctuation:/^`|`$/}},function:/\b(?:AVG|COUNT|FIRST|FORMAT|LAST|LCASE|LEN|MAX|MID|MIN|MOD|NOW|ROUND|SUM|UCASE)(?=\s*\()/i,keyword:/\b(?:ACTION|ADD|AFTER|ALGORITHM|ALL|ALTER|ANALYZE|ANY|APPLY|AS|ASC|AUTHORIZATION|AUTO_INCREMENT|BACKUP|BDB|BEGIN|BERKELEYDB|BIGINT|BINARY|BIT|BLOB|BOOL|BOOLEAN|BREAK|BROWSE|BTREE|BULK|BY|CALL|CASCADED?|CASE|CHAIN|CHAR(?:ACTER|SET)?|CHECK(?:POINT)?|CLOSE|CLUSTERED|COALESCE|COLLATE|COLUMNS?|COMMENT|COMMIT(?:TED)?|COMPUTE|CONNECT|CONSISTENT|CONSTRAINT|CONTAINS(?:TABLE)?|CONTINUE|CONVERT|CREATE|CROSS|CURRENT(?:_DATE|_TIME|_TIMESTAMP|_USER)?|CURSOR|CYCLE|DATA(?:BASES?)?|DATE(?:TIME)?|DAY|DBCC|DEALLOCATE|DEC|DECIMAL|DECLARE|DEFAULT|DEFINER|DELAYED|DELETE|DELIMITERS?|DENY|DESC|DESCRIBE|DETERMINISTIC|DISABLE|DISCARD|DISK|DISTINCT|DISTINCTROW|DISTRIBUTED|DO|DOUBLE|DROP|DUMMY|DUMP(?:FILE)?|DUPLICATE|ELSE(?:IF)?|ENABLE|ENCLOSED|END|ENGINE|ENUM|ERRLVL|ERRORS|ESCAPED?|EXCEPT|EXEC(?:UTE)?|EXISTS|EXIT|EXPLAIN|EXTENDED|FETCH|FIELDS|FILE|FILLFACTOR|FIRST|FIXED|FLOAT|FOLLOWING|FOR(?: EACH ROW)?|FORCE|FOREIGN|FREETEXT(?:TABLE)?|FROM|FULL|FUNCTION|GEOMETRY(?:COLLECTION)?|GLOBAL|GOTO|GRANT|GROUP|HANDLER|HASH|HAVING|HOLDLOCK|HOUR|IDENTITY(?:COL|_INSERT)?|IF|IGNORE|IMPORT|INDEX|INFILE|INNER|INNODB|INOUT|INSERT|INT|INTEGER|INTERSECT|INTERVAL|INTO|INVOKER|ISOLATION|ITERATE|JOIN|KEYS?|KILL|LANGUAGE|LAST|LEAVE|LEFT|LEVEL|LIMIT|LINENO|LINES|LINESTRING|LOAD|LOCAL|LOCK|LONG(?:BLOB|TEXT)|LOOP|MATCH(?:ED)?|MEDIUM(?:BLOB|INT|TEXT)|MERGE|MIDDLEINT|MINUTE|MODE|MODIFIES|MODIFY|MONTH|MULTI(?:LINESTRING|POINT|POLYGON)|NATIONAL|NATURAL|NCHAR|NEXT|NO|NONCLUSTERED|NULLIF|NUMERIC|OFF?|OFFSETS?|ON|OPEN(?:DATASOURCE|QUERY|ROWSET)?|OPTIMIZE|OPTION(?:ALLY)?|ORDER|OUT(?:ER|FILE)?|OVER|PARTIAL|PARTITION|PERCENT|PIVOT|PLAN|POINT|POLYGON|PRECEDING|PRECISION|PREPARE|PREV|PRIMARY|PRINT|PRIVILEGES|PROC(?:EDURE)?|PUBLIC|PURGE|QUICK|RAISERROR|READS?|REAL|RECONFIGURE|REFERENCES|RELEASE|RENAME|REPEAT(?:ABLE)?|REPLACE|REPLICATION|REQUIRE|RESIGNAL|RESTORE|RESTRICT|RETURN(?:ING|S)?|REVOKE|RIGHT|ROLLBACK|ROUTINE|ROW(?:COUNT|GUIDCOL|S)?|RTREE|RULE|SAVE(?:POINT)?|SCHEMA|SECOND|SELECT|SERIAL(?:IZABLE)?|SESSION(?:_USER)?|SET(?:USER)?|SHARE|SHOW|SHUTDOWN|SIMPLE|SMALLINT|SNAPSHOT|SOME|SONAME|SQL|START(?:ING)?|STATISTICS|STATUS|STRIPED|SYSTEM_USER|TABLES?|TABLESPACE|TEMP(?:ORARY|TABLE)?|TERMINATED|TEXT(?:SIZE)?|THEN|TIME(?:STAMP)?|TINY(?:BLOB|INT|TEXT)|TOP?|TRAN(?:SACTIONS?)?|TRIGGER|TRUNCATE|TSEQUAL|TYPES?|UNBOUNDED|UNCOMMITTED|UNDEFINED|UNION|UNIQUE|UNLOCK|UNPIVOT|UNSIGNED|UPDATE(?:TEXT)?|USAGE|USE|USER|USING|VALUES?|VAR(?:BINARY|CHAR|CHARACTER|YING)|VIEW|WAITFOR|WARNINGS|WHEN|WHERE|WHILE|WITH(?: ROLLUP|IN)?|WORK|WRITE(?:TEXT)?|YEAR)\b/i,boolean:/\b(?:FALSE|NULL|TRUE)\b/i,number:/\b0x[\da-f]+\b|\b\d+(?:\.\d*)?|\B\.\d+\b/i,operator:/[-+*\/=%^~]|&&?|\|\|?|!=?|<(?:=>?|<|>)?|>[>=]?|\b(?:AND|BETWEEN|DIV|ILIKE|IN|IS|LIKE|NOT|OR|REGEXP|RLIKE|SOUNDS LIKE|XOR)\b/i,punctuation:/[;[\]()`,.]/},function(e){var t={pattern:/(\b\d+)(?:%|[a-z]+)/,lookbehind:!0},n={pattern:/(^|[^\w.-])-?(?:\d+(?:\.\d+)?|\.\d+)/,lookbehind:!0},r={comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|\/\/.*)/,lookbehind:!0},url:{pattern:/\burl\((["']?).*?\1\)/i,greedy:!0},string:{pattern:/("|')(?:(?!\1)[^\\\r\n]|\\(?:\r\n|[\s\S]))*\1/,greedy:!0},interpolation:null,func:null,important:/\B!(?:important|optional)\b/i,keyword:{pattern:/(^|\s+)(?:(?:else|for|if|return|unless)(?=\s|$)|@[\w-]+)/,lookbehind:!0},hexcode:/#[\da-f]{3,6}/i,color:[/\b(?:AliceBlue|AntiqueWhite|Aqua|Aquamarine|Azure|Beige|Bisque|Black|BlanchedAlmond|Blue|BlueViolet|Brown|BurlyWood|CadetBlue|Chartreuse|Chocolate|Coral|CornflowerBlue|Cornsilk|Crimson|Cyan|DarkBlue|DarkCyan|DarkGoldenRod|DarkGr[ae]y|DarkGreen|DarkKhaki|DarkMagenta|DarkOliveGreen|DarkOrange|DarkOrchid|DarkRed|DarkSalmon|DarkSeaGreen|DarkSlateBlue|DarkSlateGr[ae]y|DarkTurquoise|DarkViolet|DeepPink|DeepSkyBlue|DimGr[ae]y|DodgerBlue|FireBrick|FloralWhite|ForestGreen|Fuchsia|Gainsboro|GhostWhite|Gold|GoldenRod|Gr[ae]y|Green|GreenYellow|HoneyDew|HotPink|IndianRed|Indigo|Ivory|Khaki|Lavender|LavenderBlush|LawnGreen|LemonChiffon|LightBlue|LightCoral|LightCyan|LightGoldenRodYellow|LightGr[ae]y|LightGreen|LightPink|LightSalmon|LightSeaGreen|LightSkyBlue|LightSlateGr[ae]y|LightSteelBlue|LightYellow|Lime|LimeGreen|Linen|Magenta|Maroon|MediumAquaMarine|MediumBlue|MediumOrchid|MediumPurple|MediumSeaGreen|MediumSlateBlue|MediumSpringGreen|MediumTurquoise|MediumVioletRed|MidnightBlue|MintCream|MistyRose|Moccasin|NavajoWhite|Navy|OldLace|Olive|OliveDrab|Orange|OrangeRed|Orchid|PaleGoldenRod|PaleGreen|PaleTurquoise|PaleVioletRed|PapayaWhip|PeachPuff|Peru|Pink|Plum|PowderBlue|Purple|Red|RosyBrown|RoyalBlue|SaddleBrown|Salmon|SandyBrown|SeaGreen|SeaShell|Sienna|Silver|SkyBlue|SlateBlue|SlateGr[ae]y|Snow|SpringGreen|SteelBlue|Tan|Teal|Thistle|Tomato|Transparent|Turquoise|Violet|Wheat|White|WhiteSmoke|Yellow|YellowGreen)\b/i,{pattern:/\b(?:hsl|rgb)\(\s*\d{1,3}\s*,\s*\d{1,3}%?\s*,\s*\d{1,3}%?\s*\)\B|\b(?:hsl|rgb)a\(\s*\d{1,3}\s*,\s*\d{1,3}%?\s*,\s*\d{1,3}%?\s*,\s*(?:0|0?\.\d+|1)\s*\)\B/i,inside:{unit:t,number:n,function:/[\w-]+(?=\()/,punctuation:/[(),]/}}],entity:/\\[\da-f]{1,8}/i,unit:t,boolean:/\b(?:false|true)\b/,operator:[/~|[+!\/%<>?=]=?|[-:]=|\*[*=]?|\.{2,3}|&&|\|\||\B-\B|\b(?:and|in|is(?: a| defined| not|nt)?|not|or)\b/],number:n,punctuation:/[{}()\[\];:,]/};r.interpolation={pattern:/\{[^\r\n}:]+\}/,alias:"variable",inside:{delimiter:{pattern:/^\{|\}$/,alias:"punctuation"},rest:r}},r.func={pattern:/[\w-]+\([^)]*\).*/,inside:{function:/^[^(]+/,rest:r}},e.languages.stylus={"atrule-declaration":{pattern:/(^[ \t]*)@.+/m,lookbehind:!0,inside:{atrule:/^@[\w-]+/,rest:r}},"variable-declaration":{pattern:/(^[ \t]*)[\w$-]+\s*.?=[ \t]*(?:\{[^{}]*\}|\S.*|$)/m,lookbehind:!0,inside:{variable:/^\S+/,rest:r}},statement:{pattern:/(^[ \t]*)(?:else|for|if|return|unless)[ \t].+/m,lookbehind:!0,inside:{keyword:/^\S+/,rest:r}},"property-declaration":{pattern:/((?:^|\{)([ \t]*))(?:[\w-]|\{[^}\r\n]+\})+(?:\s*:\s*|[ \t]+)(?!\s)[^{\r\n]*(?:;|[^{\r\n,]$(?!(?:\r?\n|\r)(?:\{|\2[ \t])))/m,lookbehind:!0,inside:{property:{pattern:/^[^\s:]+/,inside:{interpolation:r.interpolation}},rest:r}},selector:{pattern:/(^[ \t]*)(?:(?=\S)(?:[^{}\r\n:()]|::?[\w-]+(?:\([^)\r\n]*\)|(?![\w-]))|\{[^}\r\n]+\})+)(?:(?:\r?\n|\r)(?:\1(?:(?=\S)(?:[^{}\r\n:()]|::?[\w-]+(?:\([^)\r\n]*\)|(?![\w-]))|\{[^}\r\n]+\})+)))*(?:,$|\{|(?=(?:\r?\n|\r)(?:\{|\1[ \t])))/m,lookbehind:!0,inside:{interpolation:r.interpolation,comment:r.comment,punctuation:/[{},]/}},func:r.func,string:r.string,comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|\/\/.*)/,lookbehind:!0,greedy:!0},interpolation:r.interpolation,punctuation:/[{}()\[\];:.]/}}(o),function(e){e.languages.typescript=e.languages.extend("javascript",{"class-name":{pattern:/(\b(?:class|extends|implements|instanceof|interface|new|type)\s+)(?!keyof\b)(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?:\s*<(?:[^<>]|<(?:[^<>]|<[^<>]*>)*>)*>)?/,lookbehind:!0,greedy:!0,inside:null},builtin:/\b(?:Array|Function|Promise|any|boolean|console|never|number|string|symbol|unknown)\b/}),e.languages.typescript.keyword.push(/\b(?:abstract|declare|is|keyof|readonly|require)\b/,/\b(?:asserts|infer|interface|module|namespace|type)\b(?=\s*(?:[{_$a-zA-Z\xA0-\uFFFF]|$))/,/\btype\b(?=\s*(?:[\{*]|$))/),delete e.languages.typescript.parameter,delete e.languages.typescript["literal-property"];var t=e.languages.extend("typescript",{});delete t["class-name"],e.languages.typescript["class-name"].inside=t,e.languages.insertBefore("typescript","function",{decorator:{pattern:/@[$\w\xA0-\uFFFF]+/,inside:{at:{pattern:/^@/,alias:"operator"},function:/^[\s\S]+/}},"generic-function":{pattern:/#?(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*\s*<(?:[^<>]|<(?:[^<>]|<[^<>]*>)*>)*>(?=\s*\()/,greedy:!0,inside:{function:/^#?(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*/,generic:{pattern:/<[\s\S]+/,alias:"class-name",inside:t}}}}),e.languages.ts=e.languages.typescript}(o),function(e){var t=e.util.clone(e.languages.typescript);e.languages.tsx=e.languages.extend("jsx",t),delete e.languages.tsx.parameter,delete e.languages.tsx["literal-property"];var n=e.languages.tsx.tag;n.pattern=RegExp(/(^|[^\w$]|(?=<\/))/.source+"(?:"+n.pattern.source+")",n.pattern.flags),n.lookbehind=!0}(o),o.languages.wasm={comment:[/\(;[\s\S]*?;\)/,{pattern:/;;.*/,greedy:!0}],string:{pattern:/"(?:\\[\s\S]|[^"\\])*"/,greedy:!0},keyword:[{pattern:/\b(?:align|offset)=/,inside:{operator:/=/}},{pattern:/\b(?:(?:f32|f64|i32|i64)(?:\.(?:abs|add|and|ceil|clz|const|convert_[su]\/i(?:32|64)|copysign|ctz|demote\/f64|div(?:_[su])?|eqz?|extend_[su]\/i32|floor|ge(?:_[su])?|gt(?:_[su])?|le(?:_[su])?|load(?:(?:8|16|32)_[su])?|lt(?:_[su])?|max|min|mul|neg?|nearest|or|popcnt|promote\/f32|reinterpret\/[fi](?:32|64)|rem_[su]|rot[lr]|shl|shr_[su]|sqrt|store(?:8|16|32)?|sub|trunc(?:_[su]\/f(?:32|64))?|wrap\/i64|xor))?|memory\.(?:grow|size))\b/,inside:{punctuation:/\./}},/\b(?:anyfunc|block|br(?:_if|_table)?|call(?:_indirect)?|data|drop|elem|else|end|export|func|get_(?:global|local)|global|if|import|local|loop|memory|module|mut|nop|offset|param|result|return|select|set_(?:global|local)|start|table|tee_local|then|type|unreachable)\b/],variable:/\$[\w!#$%&'*+\-./:<=>?@\\^`|~]+/,number:/[+-]?\b(?:\d(?:_?\d)*(?:\.\d(?:_?\d)*)?(?:[eE][+-]?\d(?:_?\d)*)?|0x[\da-fA-F](?:_?[\da-fA-F])*(?:\.[\da-fA-F](?:_?[\da-fA-D])*)?(?:[pP][+-]?\d(?:_?\d)*)?)\b|\binf\b|\bnan(?::0x[\da-fA-F](?:_?[\da-fA-D])*)?\b/,punctuation:/[()]/},function(e){var t=/[*&][^\s[\]{},]+/,n=/!(?:<[\w\-%#;/?:@&=+$,.!~*'()[\]]+>|(?:[a-zA-Z\d-]*!)?[\w\-%#;/?:@&=+$.~*'()]+)?/,r="(?:"+n.source+"(?:[ \t]+"+t.source+")?|"+t.source+"(?:[ \t]+"+n.source+")?)",o=/(?:[^\s\x00-\x08\x0e-\x1f!"#%&'*,\-:>?@[\]`{|}\x7f-\x84\x86-\x9f\ud800-\udfff\ufffe\uffff]|[?:-])(?:[ \t]*(?:(?![#:])|:))*/.source.replace(//g,(function(){return/[^\s\x00-\x08\x0e-\x1f,[\]{}\x7f-\x84\x86-\x9f\ud800-\udfff\ufffe\uffff]/.source})),a=/"(?:[^"\\\r\n]|\\.)*"|'(?:[^'\\\r\n]|\\.)*'/.source;function i(e,t){t=(t||"").replace(/m/g,"")+"m";var n=/([:\-,[{]\s*(?:\s<>[ \t]+)?)(?:<>)(?=[ \t]*(?:$|,|\]|\}|(?:[\r\n]\s*)?#))/.source.replace(/<>/g,(function(){return r})).replace(/<>/g,(function(){return e}));return RegExp(n,t)}e.languages.yaml={scalar:{pattern:RegExp(/([\-:]\s*(?:\s<>[ \t]+)?[|>])[ \t]*(?:((?:\r?\n|\r)[ \t]+)\S[^\r\n]*(?:\2[^\r\n]+)*)/.source.replace(/<>/g,(function(){return r}))),lookbehind:!0,alias:"string"},comment:/#.*/,key:{pattern:RegExp(/((?:^|[:\-,[{\r\n?])[ \t]*(?:<>[ \t]+)?)<>(?=\s*:\s)/.source.replace(/<>/g,(function(){return r})).replace(/<>/g,(function(){return"(?:"+o+"|"+a+")"}))),lookbehind:!0,greedy:!0,alias:"atrule"},directive:{pattern:/(^[ \t]*)%.+/m,lookbehind:!0,alias:"important"},datetime:{pattern:i(/\d{4}-\d\d?-\d\d?(?:[tT]|[ \t]+)\d\d?:\d{2}:\d{2}(?:\.\d*)?(?:[ \t]*(?:Z|[-+]\d\d?(?::\d{2})?))?|\d{4}-\d{2}-\d{2}|\d\d?:\d{2}(?::\d{2}(?:\.\d*)?)?/.source),lookbehind:!0,alias:"number"},boolean:{pattern:i(/false|true/.source,"i"),lookbehind:!0,alias:"important"},null:{pattern:i(/null|~/.source,"i"),lookbehind:!0,alias:"important"},string:{pattern:i(a),lookbehind:!0,greedy:!0},number:{pattern:i(/[+-]?(?:0x[\da-f]+|0o[0-7]+|(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?|\.inf|\.nan)/.source,"i"),lookbehind:!0},tag:n,important:t,punctuation:/---|[:[\]{}\-,|>?]|\.\.\./},e.languages.yml=e.languages.yaml}(o),t.default=o},9901:function(e){e.exports&&(e.exports={core:{meta:{path:"components/prism-core.js",option:"mandatory"},core:"Core"},themes:{meta:{path:"themes/{id}.css",link:"index.html?theme={id}",exclusive:!0},prism:{title:"Default",option:"default"},"prism-dark":"Dark","prism-funky":"Funky","prism-okaidia":{title:"Okaidia",owner:"ocodia"},"prism-twilight":{title:"Twilight",owner:"remybach"},"prism-coy":{title:"Coy",owner:"tshedor"},"prism-solarizedlight":{title:"Solarized Light",owner:"hectormatos2011 "},"prism-tomorrow":{title:"Tomorrow Night",owner:"Rosey"}},languages:{meta:{path:"components/prism-{id}",noCSS:!0,examplesPath:"examples/prism-{id}",addCheckAll:!0},markup:{title:"Markup",alias:["html","xml","svg","mathml","ssml","atom","rss"],aliasTitles:{html:"HTML",xml:"XML",svg:"SVG",mathml:"MathML",ssml:"SSML",atom:"Atom",rss:"RSS"},option:"default"},css:{title:"CSS",option:"default",modify:"markup"},clike:{title:"C-like",option:"default"},javascript:{title:"JavaScript",require:"clike",modify:"markup",optional:"regex",alias:"js",option:"default"},abap:{title:"ABAP",owner:"dellagustin"},abnf:{title:"ABNF",owner:"RunDevelopment"},actionscript:{title:"ActionScript",require:"javascript",modify:"markup",owner:"Golmote"},ada:{title:"Ada",owner:"Lucretia"},agda:{title:"Agda",owner:"xy-ren"},al:{title:"AL",owner:"RunDevelopment"},antlr4:{title:"ANTLR4",alias:"g4",owner:"RunDevelopment"},apacheconf:{title:"Apache Configuration",owner:"GuiTeK"},apex:{title:"Apex",require:["clike","sql"],owner:"RunDevelopment"},apl:{title:"APL",owner:"ngn"},applescript:{title:"AppleScript",owner:"Golmote"},aql:{title:"AQL",owner:"RunDevelopment"},arduino:{title:"Arduino",require:"cpp",alias:"ino",owner:"dkern"},arff:{title:"ARFF",owner:"Golmote"},asciidoc:{alias:"adoc",title:"AsciiDoc",owner:"Golmote"},aspnet:{title:"ASP.NET (C#)",require:["markup","csharp"],owner:"nauzilus"},asm6502:{title:"6502 Assembly",owner:"kzurawel"},asmatmel:{title:"Atmel AVR Assembly",owner:"cerkit"},autohotkey:{title:"AutoHotkey",owner:"aviaryan"},autoit:{title:"AutoIt",owner:"Golmote"},avisynth:{title:"AviSynth",alias:"avs",owner:"Zinfidel"},"avro-idl":{title:"Avro IDL",alias:"avdl",owner:"RunDevelopment"},bash:{title:"Bash",alias:"shell",aliasTitles:{shell:"Shell"},owner:"zeitgeist87"},basic:{title:"BASIC",owner:"Golmote"},batch:{title:"Batch",owner:"Golmote"},bbcode:{title:"BBcode",alias:"shortcode",aliasTitles:{shortcode:"Shortcode"},owner:"RunDevelopment"},bicep:{title:"Bicep",owner:"johnnyreilly"},birb:{title:"Birb",require:"clike",owner:"Calamity210"},bison:{title:"Bison",require:"c",owner:"Golmote"},bnf:{title:"BNF",alias:"rbnf",aliasTitles:{rbnf:"RBNF"},owner:"RunDevelopment"},brainfuck:{title:"Brainfuck",owner:"Golmote"},brightscript:{title:"BrightScript",owner:"RunDevelopment"},bro:{title:"Bro",owner:"wayward710"},bsl:{title:"BSL (1C:Enterprise)",alias:"oscript",aliasTitles:{oscript:"OneScript"},owner:"Diversus23"},c:{title:"C",require:"clike",owner:"zeitgeist87"},csharp:{title:"C#",require:"clike",alias:["cs","dotnet"],owner:"mvalipour"},cpp:{title:"C++",require:"c",owner:"zeitgeist87"},cfscript:{title:"CFScript",require:"clike",alias:"cfc",owner:"mjclemente"},chaiscript:{title:"ChaiScript",require:["clike","cpp"],owner:"RunDevelopment"},cil:{title:"CIL",owner:"sbrl"},clojure:{title:"Clojure",owner:"troglotit"},cmake:{title:"CMake",owner:"mjrogozinski"},cobol:{title:"COBOL",owner:"RunDevelopment"},coffeescript:{title:"CoffeeScript",require:"javascript",alias:"coffee",owner:"R-osey"},concurnas:{title:"Concurnas",alias:"conc",owner:"jasontatton"},csp:{title:"Content-Security-Policy",owner:"ScottHelme"},coq:{title:"Coq",owner:"RunDevelopment"},crystal:{title:"Crystal",require:"ruby",owner:"MakeNowJust"},"css-extras":{title:"CSS Extras",require:"css",modify:"css",owner:"milesj"},csv:{title:"CSV",owner:"RunDevelopment"},cypher:{title:"Cypher",owner:"RunDevelopment"},d:{title:"D",require:"clike",owner:"Golmote"},dart:{title:"Dart",require:"clike",owner:"Golmote"},dataweave:{title:"DataWeave",owner:"machaval"},dax:{title:"DAX",owner:"peterbud"},dhall:{title:"Dhall",owner:"RunDevelopment"},diff:{title:"Diff",owner:"uranusjr"},django:{title:"Django/Jinja2",require:"markup-templating",alias:"jinja2",owner:"romanvm"},"dns-zone-file":{title:"DNS zone file",owner:"RunDevelopment",alias:"dns-zone"},docker:{title:"Docker",alias:"dockerfile",owner:"JustinBeckwith"},dot:{title:"DOT (Graphviz)",alias:"gv",optional:"markup",owner:"RunDevelopment"},ebnf:{title:"EBNF",owner:"RunDevelopment"},editorconfig:{title:"EditorConfig",owner:"osipxd"},eiffel:{title:"Eiffel",owner:"Conaclos"},ejs:{title:"EJS",require:["javascript","markup-templating"],owner:"RunDevelopment",alias:"eta",aliasTitles:{eta:"Eta"}},elixir:{title:"Elixir",owner:"Golmote"},elm:{title:"Elm",owner:"zwilias"},etlua:{title:"Embedded Lua templating",require:["lua","markup-templating"],owner:"RunDevelopment"},erb:{title:"ERB",require:["ruby","markup-templating"],owner:"Golmote"},erlang:{title:"Erlang",owner:"Golmote"},"excel-formula":{title:"Excel Formula",alias:["xlsx","xls"],owner:"RunDevelopment"},fsharp:{title:"F#",require:"clike",owner:"simonreynolds7"},factor:{title:"Factor",owner:"catb0t"},false:{title:"False",owner:"edukisto"},"firestore-security-rules":{title:"Firestore security rules",require:"clike",owner:"RunDevelopment"},flow:{title:"Flow",require:"javascript",owner:"Golmote"},fortran:{title:"Fortran",owner:"Golmote"},ftl:{title:"FreeMarker Template Language",require:"markup-templating",owner:"RunDevelopment"},gml:{title:"GameMaker Language",alias:"gamemakerlanguage",require:"clike",owner:"LiarOnce"},gap:{title:"GAP (CAS)",owner:"RunDevelopment"},gcode:{title:"G-code",owner:"RunDevelopment"},gdscript:{title:"GDScript",owner:"RunDevelopment"},gedcom:{title:"GEDCOM",owner:"Golmote"},gherkin:{title:"Gherkin",owner:"hason"},git:{title:"Git",owner:"lgiraudel"},glsl:{title:"GLSL",require:"c",owner:"Golmote"},gn:{title:"GN",alias:"gni",owner:"RunDevelopment"},go:{title:"Go",require:"clike",owner:"arnehormann"},"go-module":{title:"Go module",alias:"go-mod",owner:"RunDevelopment"},graphql:{title:"GraphQL",optional:"markdown",owner:"Golmote"},groovy:{title:"Groovy",require:"clike",owner:"robfletcher"},haml:{title:"Haml",require:"ruby",optional:["css","css-extras","coffeescript","erb","javascript","less","markdown","scss","textile"],owner:"Golmote"},handlebars:{title:"Handlebars",require:"markup-templating",alias:"hbs",owner:"Golmote"},haskell:{title:"Haskell",alias:"hs",owner:"bholst"},haxe:{title:"Haxe",require:"clike",optional:"regex",owner:"Golmote"},hcl:{title:"HCL",owner:"outsideris"},hlsl:{title:"HLSL",require:"c",owner:"RunDevelopment"},hoon:{title:"Hoon",owner:"matildepark"},http:{title:"HTTP",optional:["csp","css","hpkp","hsts","javascript","json","markup","uri"],owner:"danielgtaylor"},hpkp:{title:"HTTP Public-Key-Pins",owner:"ScottHelme"},hsts:{title:"HTTP Strict-Transport-Security",owner:"ScottHelme"},ichigojam:{title:"IchigoJam",owner:"BlueCocoa"},icon:{title:"Icon",owner:"Golmote"},"icu-message-format":{title:"ICU Message Format",owner:"RunDevelopment"},idris:{title:"Idris",alias:"idr",owner:"KeenS",require:"haskell"},ignore:{title:".ignore",owner:"osipxd",alias:["gitignore","hgignore","npmignore"],aliasTitles:{gitignore:".gitignore",hgignore:".hgignore",npmignore:".npmignore"}},inform7:{title:"Inform 7",owner:"Golmote"},ini:{title:"Ini",owner:"aviaryan"},io:{title:"Io",owner:"AlesTsurko"},j:{title:"J",owner:"Golmote"},java:{title:"Java",require:"clike",owner:"sherblot"},javadoc:{title:"JavaDoc",require:["markup","java","javadoclike"],modify:"java",optional:"scala",owner:"RunDevelopment"},javadoclike:{title:"JavaDoc-like",modify:["java","javascript","php"],owner:"RunDevelopment"},javastacktrace:{title:"Java stack trace",owner:"RunDevelopment"},jexl:{title:"Jexl",owner:"czosel"},jolie:{title:"Jolie",require:"clike",owner:"thesave"},jq:{title:"JQ",owner:"RunDevelopment"},jsdoc:{title:"JSDoc",require:["javascript","javadoclike","typescript"],modify:"javascript",optional:["actionscript","coffeescript"],owner:"RunDevelopment"},"js-extras":{title:"JS Extras",require:"javascript",modify:"javascript",optional:["actionscript","coffeescript","flow","n4js","typescript"],owner:"RunDevelopment"},json:{title:"JSON",alias:"webmanifest",aliasTitles:{webmanifest:"Web App Manifest"},owner:"CupOfTea696"},json5:{title:"JSON5",require:"json",owner:"RunDevelopment"},jsonp:{title:"JSONP",require:"json",owner:"RunDevelopment"},jsstacktrace:{title:"JS stack trace",owner:"sbrl"},"js-templates":{title:"JS Templates",require:"javascript",modify:"javascript",optional:["css","css-extras","graphql","markdown","markup","sql"],owner:"RunDevelopment"},julia:{title:"Julia",owner:"cdagnino"},keepalived:{title:"Keepalived Configure",owner:"dev-itsheng"},keyman:{title:"Keyman",owner:"mcdurdin"},kotlin:{title:"Kotlin",alias:["kt","kts"],aliasTitles:{kts:"Kotlin Script"},require:"clike",owner:"Golmote"},kumir:{title:"KuMir (\u041a\u0443\u041c\u0438\u0440)",alias:"kum",owner:"edukisto"},kusto:{title:"Kusto",owner:"RunDevelopment"},latex:{title:"LaTeX",alias:["tex","context"],aliasTitles:{tex:"TeX",context:"ConTeXt"},owner:"japborst"},latte:{title:"Latte",require:["clike","markup-templating","php"],owner:"nette"},less:{title:"Less",require:"css",optional:"css-extras",owner:"Golmote"},lilypond:{title:"LilyPond",require:"scheme",alias:"ly",owner:"RunDevelopment"},liquid:{title:"Liquid",require:"markup-templating",owner:"cinhtau"},lisp:{title:"Lisp",alias:["emacs","elisp","emacs-lisp"],owner:"JuanCaicedo"},livescript:{title:"LiveScript",owner:"Golmote"},llvm:{title:"LLVM IR",owner:"porglezomp"},log:{title:"Log file",optional:"javastacktrace",owner:"RunDevelopment"},lolcode:{title:"LOLCODE",owner:"Golmote"},lua:{title:"Lua",owner:"Golmote"},magma:{title:"Magma (CAS)",owner:"RunDevelopment"},makefile:{title:"Makefile",owner:"Golmote"},markdown:{title:"Markdown",require:"markup",optional:"yaml",alias:"md",owner:"Golmote"},"markup-templating":{title:"Markup templating",require:"markup",owner:"Golmote"},matlab:{title:"MATLAB",owner:"Golmote"},maxscript:{title:"MAXScript",owner:"RunDevelopment"},mel:{title:"MEL",owner:"Golmote"},mermaid:{title:"Mermaid",owner:"RunDevelopment"},mizar:{title:"Mizar",owner:"Golmote"},mongodb:{title:"MongoDB",owner:"airs0urce",require:"javascript"},monkey:{title:"Monkey",owner:"Golmote"},moonscript:{title:"MoonScript",alias:"moon",owner:"RunDevelopment"},n1ql:{title:"N1QL",owner:"TMWilds"},n4js:{title:"N4JS",require:"javascript",optional:"jsdoc",alias:"n4jsd",owner:"bsmith-n4"},"nand2tetris-hdl":{title:"Nand To Tetris HDL",owner:"stephanmax"},naniscript:{title:"Naninovel Script",owner:"Elringus",alias:"nani"},nasm:{title:"NASM",owner:"rbmj"},neon:{title:"NEON",owner:"nette"},nevod:{title:"Nevod",owner:"nezaboodka"},nginx:{title:"nginx",owner:"volado"},nim:{title:"Nim",owner:"Golmote"},nix:{title:"Nix",owner:"Golmote"},nsis:{title:"NSIS",owner:"idleberg"},objectivec:{title:"Objective-C",require:"c",alias:"objc",owner:"uranusjr"},ocaml:{title:"OCaml",owner:"Golmote"},opencl:{title:"OpenCL",require:"c",modify:["c","cpp"],owner:"Milania1"},openqasm:{title:"OpenQasm",alias:"qasm",owner:"RunDevelopment"},oz:{title:"Oz",owner:"Golmote"},parigp:{title:"PARI/GP",owner:"Golmote"},parser:{title:"Parser",require:"markup",owner:"Golmote"},pascal:{title:"Pascal",alias:"objectpascal",aliasTitles:{objectpascal:"Object Pascal"},owner:"Golmote"},pascaligo:{title:"Pascaligo",owner:"DefinitelyNotAGoat"},psl:{title:"PATROL Scripting Language",owner:"bertysentry"},pcaxis:{title:"PC-Axis",alias:"px",owner:"RunDevelopment"},peoplecode:{title:"PeopleCode",alias:"pcode",owner:"RunDevelopment"},perl:{title:"Perl",owner:"Golmote"},php:{title:"PHP",require:"markup-templating",owner:"milesj"},phpdoc:{title:"PHPDoc",require:["php","javadoclike"],modify:"php",owner:"RunDevelopment"},"php-extras":{title:"PHP Extras",require:"php",modify:"php",owner:"milesj"},plsql:{title:"PL/SQL",require:"sql",owner:"Golmote"},powerquery:{title:"PowerQuery",alias:["pq","mscript"],owner:"peterbud"},powershell:{title:"PowerShell",owner:"nauzilus"},processing:{title:"Processing",require:"clike",owner:"Golmote"},prolog:{title:"Prolog",owner:"Golmote"},promql:{title:"PromQL",owner:"arendjr"},properties:{title:".properties",owner:"Golmote"},protobuf:{title:"Protocol Buffers",require:"clike",owner:"just-boris"},pug:{title:"Pug",require:["markup","javascript"],optional:["coffeescript","ejs","handlebars","less","livescript","markdown","scss","stylus","twig"],owner:"Golmote"},puppet:{title:"Puppet",owner:"Golmote"},pure:{title:"Pure",optional:["c","cpp","fortran"],owner:"Golmote"},purebasic:{title:"PureBasic",require:"clike",alias:"pbfasm",owner:"HeX0R101"},purescript:{title:"PureScript",require:"haskell",alias:"purs",owner:"sriharshachilakapati"},python:{title:"Python",alias:"py",owner:"multipetros"},qsharp:{title:"Q#",require:"clike",alias:"qs",owner:"fedonman"},q:{title:"Q (kdb+ database)",owner:"Golmote"},qml:{title:"QML",require:"javascript",owner:"RunDevelopment"},qore:{title:"Qore",require:"clike",owner:"temnroegg"},r:{title:"R",owner:"Golmote"},racket:{title:"Racket",require:"scheme",alias:"rkt",owner:"RunDevelopment"},cshtml:{title:"Razor C#",alias:"razor",require:["markup","csharp"],optional:["css","css-extras","javascript","js-extras"],owner:"RunDevelopment"},jsx:{title:"React JSX",require:["markup","javascript"],optional:["jsdoc","js-extras","js-templates"],owner:"vkbansal"},tsx:{title:"React TSX",require:["jsx","typescript"]},reason:{title:"Reason",require:"clike",owner:"Golmote"},regex:{title:"Regex",owner:"RunDevelopment"},rego:{title:"Rego",owner:"JordanSh"},renpy:{title:"Ren'py",alias:"rpy",owner:"HyuchiaDiego"},rest:{title:"reST (reStructuredText)",owner:"Golmote"},rip:{title:"Rip",owner:"ravinggenius"},roboconf:{title:"Roboconf",owner:"Golmote"},robotframework:{title:"Robot Framework",alias:"robot",owner:"RunDevelopment"},ruby:{title:"Ruby",require:"clike",alias:"rb",owner:"samflores"},rust:{title:"Rust",owner:"Golmote"},sas:{title:"SAS",optional:["groovy","lua","sql"],owner:"Golmote"},sass:{title:"Sass (Sass)",require:"css",optional:"css-extras",owner:"Golmote"},scss:{title:"Sass (Scss)",require:"css",optional:"css-extras",owner:"MoOx"},scala:{title:"Scala",require:"java",owner:"jozic"},scheme:{title:"Scheme",owner:"bacchus123"},"shell-session":{title:"Shell session",require:"bash",alias:["sh-session","shellsession"],owner:"RunDevelopment"},smali:{title:"Smali",owner:"RunDevelopment"},smalltalk:{title:"Smalltalk",owner:"Golmote"},smarty:{title:"Smarty",require:"markup-templating",optional:"php",owner:"Golmote"},sml:{title:"SML",alias:"smlnj",aliasTitles:{smlnj:"SML/NJ"},owner:"RunDevelopment"},solidity:{title:"Solidity (Ethereum)",alias:"sol",require:"clike",owner:"glachaud"},"solution-file":{title:"Solution file",alias:"sln",owner:"RunDevelopment"},soy:{title:"Soy (Closure Template)",require:"markup-templating",owner:"Golmote"},sparql:{title:"SPARQL",require:"turtle",owner:"Triply-Dev",alias:"rq"},"splunk-spl":{title:"Splunk SPL",owner:"RunDevelopment"},sqf:{title:"SQF: Status Quo Function (Arma 3)",require:"clike",owner:"RunDevelopment"},sql:{title:"SQL",owner:"multipetros"},squirrel:{title:"Squirrel",require:"clike",owner:"RunDevelopment"},stan:{title:"Stan",owner:"RunDevelopment"},iecst:{title:"Structured Text (IEC 61131-3)",owner:"serhioromano"},stylus:{title:"Stylus",owner:"vkbansal"},swift:{title:"Swift",owner:"chrischares"},systemd:{title:"Systemd configuration file",owner:"RunDevelopment"},"t4-templating":{title:"T4 templating",owner:"RunDevelopment"},"t4-cs":{title:"T4 Text Templates (C#)",require:["t4-templating","csharp"],alias:"t4",owner:"RunDevelopment"},"t4-vb":{title:"T4 Text Templates (VB)",require:["t4-templating","vbnet"],owner:"RunDevelopment"},tap:{title:"TAP",owner:"isaacs",require:"yaml"},tcl:{title:"Tcl",owner:"PeterChaplin"},tt2:{title:"Template Toolkit 2",require:["clike","markup-templating"],owner:"gflohr"},textile:{title:"Textile",require:"markup",optional:"css",owner:"Golmote"},toml:{title:"TOML",owner:"RunDevelopment"},tremor:{title:"Tremor",alias:["trickle","troy"],owner:"darach",aliasTitles:{trickle:"trickle",troy:"troy"}},turtle:{title:"Turtle",alias:"trig",aliasTitles:{trig:"TriG"},owner:"jakubklimek"},twig:{title:"Twig",require:"markup-templating",owner:"brandonkelly"},typescript:{title:"TypeScript",require:"javascript",optional:"js-templates",alias:"ts",owner:"vkbansal"},typoscript:{title:"TypoScript",alias:"tsconfig",aliasTitles:{tsconfig:"TSConfig"},owner:"dkern"},unrealscript:{title:"UnrealScript",alias:["uscript","uc"],owner:"RunDevelopment"},uorazor:{title:"UO Razor Script",owner:"jaseowns"},uri:{title:"URI",alias:"url",aliasTitles:{url:"URL"},owner:"RunDevelopment"},v:{title:"V",require:"clike",owner:"taggon"},vala:{title:"Vala",require:"clike",optional:"regex",owner:"TemplarVolk"},vbnet:{title:"VB.Net",require:"basic",owner:"Bigsby"},velocity:{title:"Velocity",require:"markup",owner:"Golmote"},verilog:{title:"Verilog",owner:"a-rey"},vhdl:{title:"VHDL",owner:"a-rey"},vim:{title:"vim",owner:"westonganger"},"visual-basic":{title:"Visual Basic",alias:["vb","vba"],aliasTitles:{vba:"VBA"},owner:"Golmote"},warpscript:{title:"WarpScript",owner:"RunDevelopment"},wasm:{title:"WebAssembly",owner:"Golmote"},"web-idl":{title:"Web IDL",alias:"webidl",owner:"RunDevelopment"},wiki:{title:"Wiki markup",require:"markup",owner:"Golmote"},wolfram:{title:"Wolfram language",alias:["mathematica","nb","wl"],aliasTitles:{mathematica:"Mathematica",nb:"Mathematica Notebook"},owner:"msollami"},wren:{title:"Wren",owner:"clsource"},xeora:{title:"Xeora",require:"markup",alias:"xeoracube",aliasTitles:{xeoracube:"XeoraCube"},owner:"freakmaxi"},"xml-doc":{title:"XML doc (.net)",require:"markup",modify:["csharp","fsharp","vbnet"],owner:"RunDevelopment"},xojo:{title:"Xojo (REALbasic)",owner:"Golmote"},xquery:{title:"XQuery",require:"markup",owner:"Golmote"},yaml:{title:"YAML",alias:"yml",owner:"hason"},yang:{title:"YANG",owner:"RunDevelopment"},zig:{title:"Zig",owner:"RunDevelopment"}},plugins:{meta:{path:"plugins/{id}/prism-{id}",link:"plugins/{id}/"},"line-highlight":{title:"Line Highlight",description:"Highlights specific lines and/or line ranges."},"line-numbers":{title:"Line Numbers",description:"Line number at the beginning of code lines.",owner:"kuba-kubula"},"show-invisibles":{title:"Show Invisibles",description:"Show hidden characters such as tabs and line breaks.",optional:["autolinker","data-uri-highlight"]},autolinker:{title:"Autolinker",description:"Converts URLs and emails in code to clickable links. Parses Markdown links in comments."},wpd:{title:"WebPlatform Docs",description:'Makes tokens link to WebPlatform.org documentation. The links open in a new tab.'},"custom-class":{title:"Custom Class",description:"This plugin allows you to prefix Prism's default classes (.comment can become .namespace--comment) or replace them with your defined ones (like .editor__comment). You can even add new classes.",owner:"dvkndn",noCSS:!0},"file-highlight":{title:"File Highlight",description:"Fetch external files and highlight them with Prism. Used on the Prism website itself.",noCSS:!0},"show-language":{title:"Show Language",description:"Display the highlighted language in code blocks (inline code does not show the label).",owner:"nauzilus",noCSS:!0,require:"toolbar"},"jsonp-highlight":{title:"JSONP Highlight",description:"Fetch content with JSONP and highlight some interesting content (e.g. GitHub/Gists or Bitbucket API).",noCSS:!0,owner:"nauzilus"},"highlight-keywords":{title:"Highlight Keywords",description:"Adds special CSS classes for each keyword for fine-grained highlighting.",owner:"vkbansal",noCSS:!0},"remove-initial-line-feed":{title:"Remove initial line feed",description:"Removes the initial line feed in code blocks.",owner:"Golmote",noCSS:!0},"inline-color":{title:"Inline color",description:"Adds a small inline preview for colors in style sheets.",require:"css-extras",owner:"RunDevelopment"},previewers:{title:"Previewers",description:"Previewers for angles, colors, gradients, easing and time.",require:"css-extras",owner:"Golmote"},autoloader:{title:"Autoloader",description:"Automatically loads the needed languages to highlight the code blocks.",owner:"Golmote",noCSS:!0},"keep-markup":{title:"Keep Markup",description:"Prevents custom markup from being dropped out during highlighting.",owner:"Golmote",optional:"normalize-whitespace",noCSS:!0},"command-line":{title:"Command Line",description:"Display a command line with a prompt and, optionally, the output/response from the commands.",owner:"chriswells0"},"unescaped-markup":{title:"Unescaped Markup",description:"Write markup without having to escape anything."},"normalize-whitespace":{title:"Normalize Whitespace",description:"Supports multiple operations to normalize whitespace in code blocks.",owner:"zeitgeist87",optional:"unescaped-markup",noCSS:!0},"data-uri-highlight":{title:"Data-URI Highlight",description:"Highlights data-URI contents.",owner:"Golmote",noCSS:!0},toolbar:{title:"Toolbar",description:"Attach a toolbar for plugins to easily register buttons on the top of a code block.",owner:"mAAdhaTTah"},"copy-to-clipboard":{title:"Copy to Clipboard Button",description:"Add a button that copies the code block to the clipboard when clicked.",owner:"mAAdhaTTah",require:"toolbar",noCSS:!0},"download-button":{title:"Download Button",description:"A button in the toolbar of a code block adding a convenient way to download a code file.",owner:"Golmote",require:"toolbar",noCSS:!0},"match-braces":{title:"Match braces",description:"Highlights matching braces.",owner:"RunDevelopment"},"diff-highlight":{title:"Diff Highlight",description:"Highlights the code inside diff blocks.",owner:"RunDevelopment",require:"diff"},"filter-highlight-all":{title:"Filter highlightAll",description:"Filters the elements the highlightAll and highlightAllUnder methods actually highlight.",owner:"RunDevelopment",noCSS:!0},treeview:{title:"Treeview",description:"A language with special styles to highlight file system tree structures.",owner:"Golmote"}}})},2885:function(e,t,n){const r=n(9901),o=n(9642),a=new Set;function i(e){void 0===e?e=Object.keys(r.languages).filter((e=>"meta"!=e)):Array.isArray(e)||(e=[e]);const t=[...a,...Object.keys(Prism.languages)];o(r,e,t).load((e=>{if(!(e in r.languages))return void(i.silent||console.warn("Language does not exist: "+e));const t="./prism-"+e;delete n.c[n(6500).resolve(t)],delete Prism.languages[e],n(6500)(t),a.add(e)}))}i.silent=!1,e.exports=i},6500:function(e,t,n){var r={"./":2885};function o(e){var t=a(e);return n(t)}function a(e){if(!n.o(r,e)){var t=new Error("Cannot find module '"+e+"'");throw t.code="MODULE_NOT_FOUND",t}return r[e]}o.keys=function(){return Object.keys(r)},o.resolve=a,e.exports=o,o.id=6500},9642:function(e){"use strict";var t=function(){var e=function(){};function t(e,t){Array.isArray(e)?e.forEach(t):null!=e&&t(e,0)}function n(e){for(var t={},n=0,r=e.length;n "));var l={},u=e[r];if(u){function i(t){if(!(t in e))throw new Error(r+" depends on an unknown component "+t);if(!(t in l))for(var i in o(t,a),l[t]=!0,n[t])l[i]=!0}t(u.require,i),t(u.optional,i),t(u.modify,i)}n[r]=l,a.pop()}}return function(e){var t=n[e];return t||(o(e,r),t=n[e]),t}}function o(e){for(var t in e)return!0;return!1}return function(a,i,l){var u=function(e){var t={};for(var n in e){var r=e[n];for(var o in r)if("meta"!=o){var a=r[o];t[o]="string"==typeof a?{title:a}:a}}return t}(a),s=function(e){var n;return function(r){if(r in e)return r;if(!n)for(var o in n={},e){var a=e[o];t(a&&a.alias,(function(t){if(t in n)throw new Error(t+" cannot be alias for both "+o+" and "+n[t]);if(t in e)throw new Error(t+" cannot be alias of "+o+" because it is a component.");n[t]=o}))}return n[r]||r}}(u);i=i.map(s),l=(l||[]).map(s);var c=n(i),d=n(l);i.forEach((function e(n){var r=u[n];t(r&&r.require,(function(t){t in d||(c[t]=!0,e(t))}))}));for(var f,p=r(u),m=c;o(m);){for(var h in f={},m){var g=u[h];t(g&&g.modify,(function(e){e in d&&(f[e]=!0)}))}for(var v in d)if(!(v in c))for(var b in p(v))if(b in c){f[v]=!0;break}for(var y in m=f)c[y]=!0}var w={getIds:function(){var e=[];return w.load((function(t){e.push(t)})),e},load:function(t,n){return function(t,n,r,o){var a=o?o.series:void 0,i=o?o.parallel:e,l={},u={};function s(e){if(e in l)return l[e];u[e]=!0;var o,c=[];for(var d in t(e))d in n&&c.push(d);if(0===c.length)o=r(e);else{var f=i(c.map((function(e){var t=s(e);return delete u[e],t})));a?o=a(f,(function(){return r(e)})):r(e)}return l[e]=o}for(var c in n)s(c);var d=[];for(var f in u)d.push(l[f]);return i(d)}(p,c,t,n)}};return w}}();e.exports=t},2703:function(e,t,n){"use strict";var r=n(414);function o(){}function a(){}a.resetWarningCache=o,e.exports=function(){function e(e,t,n,o,a,i){if(i!==r){var l=new Error("Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types");throw l.name="Invariant Violation",l}}function t(){return e}e.isRequired=e;var n={array:e,bool:e,func:e,number:e,object:e,string:e,symbol:e,any:e,arrayOf:t,element:e,elementType:e,instanceOf:t,node:e,objectOf:t,oneOf:t,oneOfType:t,shape:t,exact:t,checkPropTypes:a,resetWarningCache:o};return n.PropTypes=n,n}},5697:function(e,t,n){e.exports=n(2703)()},414:function(e){"use strict";e.exports="SECRET_DO_NOT_PASS_THIS_OR_YOU_WILL_BE_FIRED"},4448:function(e,t,n){"use strict";var r=n(7294),o=n(7418),a=n(3840);function i(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n