bitly/oauth2_proxyArchived
Oauth2 Proxy
oauth2_proxy is an OAuth2 reverse proxy and authentication gateway that protects upstream services by requiring users to authenticate through external identity providers. It acts as a secure login layer for backend applications that lack built-in user authentication.
The project provides centralized access control by restricting entry based on email domains, organization membership, or approved user lists. It integrates with identity providers via issuer URLs and client secrets, and supports additional authentication methods such as htpasswd files.
The gateway manages secure identity forwarding by passing authenticated user details and access tokens to backend services through custom HTTP headers or basic auth. It includes capabilities for session cookie management, SSL connection termination, and the ability to exempt specific request paths from authentication using regular expressions. Additional security is provided through HMAC request signing to verify the origin of proxied requests.
Traffic and system observability are supported through incoming request logging and detailed proxy request metadata. The system also allows for custom authentication pages via HTML templates and supports automatic configuration reloading from files.
Features
- Authenticated Web Service Proxies - Acts as an authenticated proxy that validates users before forwarding requests to internal web services.
- HTTP Reverse Proxies - Acts as an HTTP reverse proxy that intercepts incoming requests to validate credentials before forwarding traffic to upstream services.
- Organization-Based Access Management - Blocks authentication for users who are not verified members of a specified organization or team.
- Authenticated Request Proxies - Forwards authenticated requests to backend services while injecting the user's identity and access tokens into HTTP headers.
- Traffic Proxying - Forwards authenticated requests to multiple backend servers or serves local static files.
- Access Control Centralization - Provides a centralized point for managing access to a suite of tools based on email, organization, or user lists.
- Email Domain Restrictions - Restricts access to the protected upstream services based on specific email domains or a predefined list of approved addresses.
- Authentication Gateways - Provides a security layer that enforces access policies and integrates with external identity providers to protect services.
- User Identity Forwardings - Passes authenticated username and group details to backend servers using custom HTTP headers or Basic Auth.
- Identity Provider Integrations - Connects internal applications to external identity services like Google or GitHub to manage user access.
- Identity Providers - Integrates with external identity providers to delegate user authentication and session management via OAuth2 and OIDC.
- OAuth2 Implementations - Implements the standard OAuth2 authorization code grant flow to delegate user authentication to external identity providers.
- Reverse Proxies - Implements a reverse proxy that requires authentication through OAuth2 identity providers before granting access to upstream services.
- Cookie-Based Session Management - Tracks authenticated user states using encrypted session cookies to maintain identity without repeated provider redirects.
- Traffic Protection - Protects private web applications by requiring a valid authenticated session before forwarding traffic to the upstream server.
- Identity Header Injections - Injects authenticated user metadata and access tokens into request headers for consumption by protected backend applications.
- Membership Verifications - Restricts access to services based on a user's membership in specific Google Groups validated via a service account.
- Authentication Bypass Rules - Allows specific endpoints to be exempted from authentication requirements using regular expression path matching.
- SSL Termination Proxies - Handles encrypted traffic termination using certificates and keys to offload SSL/TLS overhead from backend services.
- Authentication Exemptions - Allows specific request paths to be exempted from authentication checks using regular expression matching.
- Htpasswd Authentications - Validates user credentials against hashed passwords stored in htpasswd files for local user authentication.
- Cryptographic Request Signers - Implements cryptographic signing of outgoing HTTP requests to verify the authenticity of the proxied traffic.
- Request Signing - Adds cryptographic HMAC signatures to headers to verify the origin and authenticity of proxied requests.
