oauth2-proxy/oauth2-proxy
Oauth2 Proxy
This project is a reverse proxy server that secures internal web services by enforcing authentication against external identity providers. It acts as a gatekeeper for incoming HTTP traffic, validating user identity before forwarding requests to protected backend applications. By integrating with OAuth2 and OIDC providers, the proxy ensures that only authorized users can access internal resources.
The proxy distinguishes itself through its flexible session management and granular access control. It maintains authenticated user state across requests using either encrypted client-side cookies or server-side storage backends, and it supports the extraction of identity claims to enable personalized application logic. Administrators can enforce access policies based on specific user attributes, such as email domains or group memberships, and inject verified identity information into request headers for downstream processing.
Beyond core authentication, the software provides comprehensive traffic management, including path-based routing, WebSocket support, and TLS termination. It offers a declarative configuration system that supports syntax validation and environment variable interpolation, allowing for complex security policies and custom authentication provider integrations. The proxy also handles static content serving and provides detailed operational logging for monitoring system and authentication events.
The software is distributed as precompiled binaries for direct execution or as container images for deployment in cloud-native environments.
Features
- OAuth2 Providers - Integrates with OAuth2 and OIDC providers to validate user identity before granting access to internal web services.
- Reverse Proxy Authentication - Acts as a reverse proxy that secures internal web services by enforcing authentication against external identity providers.
- Web Application Security - Secures internal web applications by enforcing mandatory authentication against external identity providers.
- Reverse Proxies - Routes incoming HTTP traffic to upstream applications while enforcing access policies and authentication requirements.
- Attribute-based Access Controls - Restricts access to web services based on verified user attributes like email domains or group memberships.
- Proxy Configurations - Configures HTTP/HTTPS server endpoints with support for custom TLS certificates, cipher suites, and network binding.
- Attribute-Based Access Control - Filters incoming traffic based on verified user attributes such as email address, domain membership, or group affiliation.
- Stateful Session Persistence - Maintains authenticated user state across requests using either encrypted client-side cookies or server-side storage backends.
- Session Persistence Strategies - Maintains authenticated user state across requests by storing encrypted session tokens in client-side cookies.
- Identity Header Injections - Injects user information and authentication headers into requests before passing them to backend applications for downstream processing.
- Session Storage Backends - Maintains authenticated user state using either encrypted client-side cookies or server-side storage backends.
- Personal Dashboards - Reverse proxy providing authentication with various identity providers.
- Request Routing - Maps incoming request paths to specific upstream services, supporting path rewriting, WebSocket proxying, and custom timeout settings.
- Authentication Providers - Integrates with diverse external identity providers through a standardized, provider-agnostic authentication interface.
- Server-Side Session Stores - Offloads session data to external databases or caches to support larger payloads and improved security revocation.
- Proxy Authentication - Forwards requests to upstream services only after verifying user identity and enforcing access policies.
- Request Authentication Middleware - Intercepts network requests to validate user sessions and enforce access control before processing application logic.
- Configuration Validation - Validates configuration files for errors and required fields before startup to prevent runtime failures.
- Containerized Deployments - Supports deployment using prebuilt container images and orchestration manifests for cloud-native environments.
- Declarative Proxy Configurations - Defines routing rules and security policies using structured, declarative configuration files.
- Authentication Claims - Extracts custom attributes from authentication tokens to enable personalized application logic and header injection.
- TLS Management - Handles encrypted traffic by providing certificate and key files, with options to enforce specific TLS versions and cipher suites.
- Proxy Configurations - Manages operational behavior through configuration files, environment variables, and command-line arguments.
- Custom Authentication Providers - Supports integration of custom identity providers through a standard interface and registration logic.
- Session Termination Services - Clears local authentication cookies and redirects users to external providers to finalize the logout process.
- Session Token Refreshers - Manages token expiration and refresh intervals to maintain secure access while reducing re-authentication frequency.
- YAML Configuration Files - Processes YAML-based configuration files with environment variable interpolation for sensitive data.
