oauth2_proxy/README.md

146 lines
6.3 KiB
Markdown
Raw Normal View History

2012-12-11 01:34:58 +00:00
google_auth_proxy
=================
2012-12-17 18:03:34 +00:00
A reverse proxy that provides authentication using Google OAuth2 to validate
2012-12-11 01:34:58 +00:00
individual accounts, or a whole google apps domain.
2012-12-26 18:18:56 +00:00
[![Build Status](https://secure.travis-ci.org/bitly/google_auth_proxy.png?branch=master)](http://travis-ci.org/bitly/google_auth_proxy)
2012-12-11 01:34:58 +00:00
2014-11-10 03:06:40 +00:00
![sign_in_page](https://cloud.githubusercontent.com/assets/45028/4970624/7feb7dd8-6886-11e4-93e0-c9904af44ea8.png)
2012-12-26 18:19:03 +00:00
## Architecture
2012-12-11 01:34:58 +00:00
```
_______ ___________________ __________
|Nginx| ----> |google_auth_proxy| ----> |upstream|
------- ------------------- ----------
||
\/
[google oauth2 api]
```
2012-12-26 18:19:03 +00:00
## Installation
2014-11-10 03:06:40 +00:00
1. Download [Prebuilt Binary](https://github.com/bitly/google_auth_proxy/releases) or build from `master` with `$ go get github.com/bitly/google_auth_proxy` which should put the binary in `$GOROOT/bin`
2. Register an OAuth Application with Google
3. Configure Google Auth Proxy using config file, command line options, or environment variables
4. Deploy behind a SSL endpoint (example provided for Nginx)
2012-12-26 18:19:03 +00:00
## OAuth Configuration
You will need to register an OAuth application with google, and configure it with Redirect URI(s) for the domain you
intend to run `google_auth_proxy` on.
1. Create a new project: https://console.developers.google.com/project
2. Under "APIs & Auth", choose "Credentials"
3. Now, choose "Create new Client ID"
* The Application Type should be **Web application**
* Enter your domain in the Authorized Javascript Origins `https://internal.yourcompany.com`
* Enter the correct Authorized Redirect URL `https://internal.yourcompany.com/oauth2/callback`
* NOTE: `google_auth_proxy` will _only_ callback on the path `/oauth2/callback`
4. Under "APIs & Auth" choose "Consent Screen"
* Fill in the necessary fields and Save (this is _required_)
5. Take note of the **Client ID** and **Client Secret**
2012-12-26 18:19:03 +00:00
2012-12-11 01:34:58 +00:00
2014-11-09 19:51:10 +00:00
## Configuration
`google_auth_proxy` can be configured via [config file](#config-file), [command line options](#command-line-options) or [environment variables](#environment-variables).
### Config File
An example [google_auth_proxy.cfg](contrib/google_auth_proxy.cfg.example) config file is in the contrib directory. It can be used by specifying `-config=/etc/google_auth_proxy.cfg`
### Command Line Options
2012-12-11 01:34:58 +00:00
```
2014-11-09 19:51:10 +00:00
Usage of google_auth_proxy:
2012-12-11 01:59:23 +00:00
-authenticated-emails-file="": authenticate against emails via file (one per line)
2012-12-11 01:34:58 +00:00
-client-id="": the Google OAuth Client ID: ie: "123456.apps.googleusercontent.com"
2012-12-11 01:59:23 +00:00
-client-secret="": the OAuth Client Secret
2014-11-09 19:51:10 +00:00
-config="": path to config file
-cookie-domain="": an optional cookie domain to force cookies to (ie: .yourcompany.com)*
2014-11-09 19:51:10 +00:00
-cookie-expire=168h0m0s: expire timeframe for cookie
2015-03-18 03:13:45 +00:00
-cookie-httponly=true: set HttpOnly cookie flag
-cookie-https-only=true: set secure (HTTPS) cookies (deprecated. use --cookie-secure setting)
2012-12-11 01:59:23 +00:00
-cookie-secret="": the seed string for secure cookies
2015-03-18 03:13:45 +00:00
-cookie-secure=true: set secure (HTTPS) cookie flag
-custom-templates-dir="": path to custom html templates
-display-htpasswd-form=true: display username / password login form if an htpasswd file is provided
2014-11-09 19:51:10 +00:00
-google-apps-domain=: authenticate against the given Google apps domain (may be given multiple times)
2012-12-11 01:59:23 +00:00
-htpasswd-file="": additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption
-http-address="127.0.0.1:4180": [http://]<addr>:<port> or unix://<path> to listen on for HTTP clients
2014-11-09 19:51:10 +00:00
-pass-basic-auth=true: pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream
2015-03-17 19:15:15 +00:00
-pass-host-header=true: pass the request Host Header to upstream
2012-12-11 01:59:23 +00:00
-redirect-url="": the OAuth Redirect URL. ie: "https://internalapp.yourcompany.com/oauth2/callback"
-skip-auth-regex=: bypass authentication for requests path's that match (may be given multiple times)
2014-11-09 19:51:10 +00:00
-upstream=: the http url(s) of the upstream endpoint. If multiple, routing is based on path
2012-12-11 01:59:23 +00:00
-version=false: print version string
```
2014-11-09 19:51:10 +00:00
### Environment variables
2012-12-11 02:11:24 +00:00
2014-11-10 02:07:02 +00:00
The environment variables `GOOGLE_AUTH_PROXY_CLIENT_ID`, `GOOGLE_AUTH_PROXY_CLIENT_SECRET`, `GOOGLE_AUTH_PROXY_COOKIE_SECRET`, `GOOGLE_AUTH_PROXY_COOKIE_DOMAIN` and `GOOGLE_AUTH_PROXY_COOKIE_EXPIRE` can be used in place of the corresponding command-line arguments.
2014-11-09 19:51:10 +00:00
### Example Nginx Configuration
2012-12-11 02:11:24 +00:00
2012-12-26 21:53:02 +00:00
This example has a [Nginx](http://nginx.org/) SSL endpoint proxying to `google_auth_proxy` on port `4180`.
`google_auth_proxy` then authenticates requests for an upstream application running on port `8080`. The external
endpoint for this example would be `https://internal.yourcompany.com/`.
2012-12-11 02:11:24 +00:00
2012-12-26 21:53:02 +00:00
An example Nginx config follows. Note the use of `Strict-Transport-Security` header to pin requests to SSL
via [HSTS](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security):
2012-12-11 02:11:24 +00:00
```
server {
listen 443 default ssl;
server_name internal.yourcompany.com;
ssl_certificate /path/to/cert.pem;
ssl_certificate_key /path/to/cert.key;
add_header Strict-Transport-Security max-age=1209600;
location / {
proxy_pass http://127.0.0.1:4180;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_connect_timeout 1;
proxy_send_timeout 30;
proxy_read_timeout 30;
}
}
```
2012-12-26 15:35:02 +00:00
2012-12-26 21:53:02 +00:00
The command line to run `google_auth_proxy` would look like this:
```bash
./google_auth_proxy \
--google-apps-domain="yourcompany.com" \
--upstream=http://127.0.0.1:8080/ \
--cookie-secret=... \
2015-03-18 03:13:45 +00:00
--cookie-secure=true \
2012-12-26 21:53:02 +00:00
--client-id=... \
--client-secret=...
```
2012-12-26 18:19:03 +00:00
## Endpoint Documentation
2014-11-09 19:51:10 +00:00
Google Auth Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated.
2012-12-26 15:35:02 +00:00
2014-10-14 20:22:38 +00:00
* /ping - returns an 200 OK response
2012-12-26 15:35:02 +00:00
* /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
* /oauth2/start - a URL that will redirect to start the OAuth cycle
2015-03-17 20:25:19 +00:00
* /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this ass the callback url.
## Logging Format
Google Auth Proxy logs requests to stdout in a format similar to Apache Combined Log.
```
<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] <HOST_HEADER> GET <UPSTREAM_HOST> "/path/" HTTP/1.1 "<USER_AGENT>" <RESPONSE_CODE> <RESPONSE_BYTES> <REQUEST_DURATION>
````