Skip to content

Commit ed98b35

Browse files
author
Matt Rogers
committed
Update README.md
1 parent 42400a5 commit ed98b35

File tree

2 files changed

+21
-21
lines changed

2 files changed

+21
-21
lines changed

README.md

+21-21
Original file line numberDiff line numberDiff line change
@@ -13,18 +13,18 @@ Features:
1313
* May also be configured to check bearer tokens or Kubernetes client certificates and verify access
1414
* On OpenShift 3.6+ clusters, supports zero-configuration end-to-end TLS via the out of the box router
1515

16-
This is a fork of the https://github.com/openshift/oauth-proxy project with other providers removed (for now). It's
16+
This is a fork of the https://github.com/bitly/oauth2_proxy project with other providers removed (for now). It's
1717
focused on providing the simplest possible secure proxy on OpenShift
1818

19-
![Sign In Page](https://cloud.githubusercontent.com/assets/45028/4970624/7feb7dd8-6886-11e4-93e0-c9904af44ea8.png)
19+
![Sign In Page](https://raw.githubusercontent.com/openshift/oauth-proxy/master/front.png)
2020

2121
## Using this proxy with OpenShift
2222

2323
This proxy is best used as a sidecar container in a Kubernetes pod, protecting another server that listens
2424
only on localhost. On an OpenShift cluster, it can use the service account token as an OAuth client secret
2525
to identify the current user and perform access control checks. For example:
2626

27-
$ ./oauth2_proxy --upstream=http://localhost:8080 --cookie-secret=SECRET \
27+
$ ./oauth-proxy --upstream=http://localhost:8080 --cookie-secret=SECRET \
2828
--openshift-service-account=default --https-address=
2929

3030
will start the proxy against localhost:8080, encrypt the login cookie with SECRET, use the default
@@ -189,7 +189,7 @@ An example [oauth-proxy.cfg](contrib/oauth-proxy.cfg.example) config file is in
189189
### Command Line Options
190190

191191
```
192-
Usage of oauth2_proxy:
192+
Usage of oauth-proxy:
193193
-approval-prompt string: OAuth approval_prompt (default "force")
194194
-authenticated-emails-file string: authenticate against emails via file (one per line)
195195
-basic-auth-password string: the password to set when passing the HTTP Basic Auth header
@@ -240,9 +240,9 @@ See below for provider specific options
240240

241241
### Upstream Configuration
242242

243-
`oauth2_proxy` supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as `http://127.0.0.1:8080/` for the upstream parameter, that will forward all authenticated requests to be forwarded to the upstream server. If you instead provide `http://127.0.0.1:8080/some/path/` then it will only be requests that start with `/some/path/` which are forwarded to the upstream.
243+
`oauth-proxy` supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as `http://127.0.0.1:8080/` for the upstream parameter, that will forward all authenticated requests to be forwarded to the upstream server. If you instead provide `http://127.0.0.1:8080/some/path/` then it will only be requests that start with `/some/path/` which are forwarded to the upstream.
244244

245-
Static file paths are configured as a file:// URL. `file:///var/www/static/` will serve the files from that directory at `http://[oauth2_proxy url]/var/www/static/`, which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at. `file:///var/www/static/#/static/` will ie. make `/var/www/static/` available at `http://[oauth2_proxy url]/static/`.
245+
Static file paths are configured as a file:// URL. `file:///var/www/static/` will serve the files from that directory at `http://[oauth-proxy url]/var/www/static/`, which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at. `file:///var/www/static/#/static/` will ie. make `/var/www/static/` available at `http://[oauth-proxy url]/static/`.
246246

247247
Multiple upstreams can either be configured by supplying a comma separated list to the `-upstream` parameter, supplying the parameter multiple times or provinding a list in the [config file](#config-file). When multiple upstreams are used routing to them will be based on the path they are set up with.
248248

@@ -265,10 +265,10 @@ There are two recommended configurations.
265265

266266
1) Configure SSL Terminiation with OAuth2 Proxy by providing a `--tls-cert=/path/to/cert.pem` and `--tls-key=/path/to/cert.key`.
267267

268-
The command line to run `oauth2_proxy` in this configuration would look like this:
268+
The command line to run `oauth-proxy` in this configuration would look like this:
269269

270270
```bash
271-
./oauth2_proxy \
271+
./oauth-proxy \
272272
--email-domain="yourcompany.com" \
273273
--upstream=http://127.0.0.1:8080/ \
274274
--tls-cert=/path/to/cert.pem \
@@ -283,12 +283,12 @@ The command line to run `oauth2_proxy` in this configuration would look like thi
283283

284284
2) Configure SSL Termination with [Nginx](http://nginx.org/) (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ....
285285

286-
Because `oauth2_proxy` listens on `127.0.0.1:4180` by default, to listen on all interfaces (needed when using an
286+
Because `oauth-proxy` listens on `127.0.0.1:4180` by default, to listen on all interfaces (needed when using an
287287
external load balancer like Amazon ELB or Google Platform Load Balancing) use `--http-address="0.0.0.0:4180"` or
288288
`--http-address="http://:4180"`.
289289

290-
Nginx will listen on port `443` and handle SSL connections while proxying to `oauth2_proxy` on port `4180`.
291-
`oauth2_proxy` will then authenticate requests for an upstream application. The external endpoint for this example
290+
Nginx will listen on port `443` and handle SSL connections while proxying to `oauth-proxy` on port `4180`.
291+
`oauth-proxy` will then authenticate requests for an upstream application. The external endpoint for this example
292292
would be `https://internal.yourcompany.com/`.
293293

294294
An example Nginx config follows. Note the use of `Strict-Transport-Security` header to pin requests to SSL
@@ -314,10 +314,10 @@ server {
314314
}
315315
```
316316

317-
The command line to run `oauth2_proxy` in this configuration would look like this:
317+
The command line to run `oauth-proxy` in this configuration would look like this:
318318

319319
```bash
320-
./oauth2_proxy \
320+
./oauth-proxy \
321321
--email-domain="yourcompany.com" \
322322
--upstream=http://127.0.0.1:8080/ \
323323
--cookie-secret=... \
@@ -329,14 +329,14 @@ The command line to run `oauth2_proxy` in this configuration would look like thi
329329

330330
## Endpoint Documentation
331331

332-
OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The `/oauth2` prefix can be changed with the `--proxy-prefix` config variable.
332+
oauth-proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The `/oauth` prefix can be changed with the `--proxy-prefix` config variable.
333333

334334
* /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see [robotstxt.org](http://www.robotstxt.org/) for more info
335-
* /ping - returns an 200 OK response
336-
* /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
337-
* /oauth2/start - a URL that will redirect to start the OAuth cycle
338-
* /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
339-
* /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the [Nginx `auth_request` directive](#nginx-auth-request)
335+
* /oauth/healthz - returns an 200 OK response
336+
* /oauth/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
337+
* /oauth/start - a URL that will redirect to start the OAuth cycle
338+
* /oauth/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
339+
* /oauth/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the [Nginx `auth_request` directive](#nginx-auth-request)
340340

341341
## Request signatures
342342

@@ -358,15 +358,15 @@ following:
358358

359359
## Logging Format
360360

361-
OAuth2 Proxy logs requests to stdout in a format similar to Apache Combined Log.
361+
oauth-proxy logs requests to stdout in a format similar to Apache Combined Log.
362362

363363
```
364364
<REMOTE_ADDRESS> - <[email protected]> [19/Mar/2015:17:20:19 -0400] <HOST_HEADER> GET <UPSTREAM_HOST> "/path/" HTTP/1.1 "<USER_AGENT>" <RESPONSE_CODE> <RESPONSE_BYTES> <REQUEST_DURATION>
365365
```
366366

367367
## <a name="nginx-auth-request"></a>Configuring for use with the Nginx `auth_request` directive
368368

369-
The [Nginx `auth_request` directive](http://nginx.org/en/docs/http/ngx_http_auth_request_module.html) allows Nginx to authenticate requests via the oauth2_proxy's `/auth` endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:
369+
The [Nginx `auth_request` directive](http://nginx.org/en/docs/http/ngx_http_auth_request_module.html) allows Nginx to authenticate requests via the oauth-proxy's `/auth` endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:
370370

371371
```nginx
372372
server {

front.png

12.6 KB
Loading

0 commit comments

Comments
 (0)