Compare commits
45 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
3c20d31a13
|
|||
|
14a1cb8ea3
|
|||
|
506fdc56ad
|
|||
|
2ddbb8576f
|
|||
|
e41e8e1a17
|
|||
|
86894f72ed
|
|||
|
3f9d70e87b
|
|||
|
fb24320552
|
|||
|
f6120640d2
|
|||
|
ab2d527dbd
|
|||
|
5828a9a5a2
|
|||
| c4317b7503 | |||
| 4ffb6593d5 | |||
| 6c6f75e80d | |||
| 8be8244b13 | |||
| f96a3fb332 | |||
| c19f622fbd | |||
| 04f5499f0b | |||
| 41560feaa7 | |||
| 1743537438 | |||
| 9e5994b959 | |||
| 870724c994 | |||
| be2b4ba9f4 | |||
| 529e28d83b | |||
| 2937b04fdb | |||
| fb8b216481 | |||
| 8b3a950162 | |||
| 655eddeaf9 | |||
| c63fd738d6 | |||
| 00b5d9e031 | |||
| 8902cf8735 | |||
| 3345f8ec69 | |||
| 60604ad3db | |||
| a668454a11 | |||
| eec62eb03a | |||
| 7381450015 | |||
| f7a94e7db9 | |||
| f802a366de | |||
| 07f9587bc1 | |||
| 1ac0ca9732 | |||
| 9abf5645b7 | |||
| 3a66191314 | |||
| c3b4ba8244 | |||
| b413c60d42 | |||
| e678a33016 |
@ -1,2 +1,4 @@
|
||||
example
|
||||
.travis.yml
|
||||
.git
|
||||
.gitlab-ci.yml
|
||||
|
||||
6
.gitlab-ci.yml
Normal file
6
.gitlab-ci.yml
Normal file
@ -0,0 +1,6 @@
|
||||
include:
|
||||
- project: dockerized/commons
|
||||
ref: master
|
||||
file: gitlab-ci-template.yml
|
||||
|
||||
|
||||
@ -1,5 +0,0 @@
|
||||
language: go
|
||||
sudo: false
|
||||
go:
|
||||
- "1.12"
|
||||
script: env GO111MODULE=on go test -v ./...
|
||||
@ -1,18 +0,0 @@
|
||||
FROM golang:1.12-alpine as builder
|
||||
|
||||
# Setup
|
||||
RUN mkdir -p /go/src/github.com/thomseddon/traefik-forward-auth
|
||||
WORKDIR /go/src/github.com/thomseddon/traefik-forward-auth
|
||||
|
||||
# Add libraries
|
||||
RUN apk add --no-cache git
|
||||
|
||||
# Copy & build
|
||||
ADD . /go/src/github.com/thomseddon/traefik-forward-auth/
|
||||
RUN CGO_ENABLED=0 GOOS=linux GOARCH=arm GO111MODULE=on go build -a -installsuffix nocgo -o /traefik-forward-auth github.com/thomseddon/traefik-forward-auth/cmd
|
||||
|
||||
# Copy into scratch container
|
||||
FROM scratch
|
||||
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
|
||||
COPY --from=builder /traefik-forward-auth ./
|
||||
ENTRYPOINT ["./traefik-forward-auth"]
|
||||
@ -1,18 +0,0 @@
|
||||
FROM golang:1.12-alpine as builder
|
||||
|
||||
# Setup
|
||||
RUN mkdir -p /go/src/github.com/thomseddon/traefik-forward-auth
|
||||
WORKDIR /go/src/github.com/thomseddon/traefik-forward-auth
|
||||
|
||||
# Add libraries
|
||||
RUN apk add --no-cache git
|
||||
|
||||
# Copy & build
|
||||
ADD . /go/src/github.com/thomseddon/traefik-forward-auth/
|
||||
RUN CGO_ENABLED=0 GOOS=linux GOARCH=arm64 GO111MODULE=on go build -a -installsuffix nocgo -o /traefik-forward-auth github.com/thomseddon/traefik-forward-auth/cmd
|
||||
|
||||
# Copy into scratch container
|
||||
FROM scratch
|
||||
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
|
||||
COPY --from=builder /traefik-forward-auth ./
|
||||
ENTRYPOINT ["./traefik-forward-auth"]
|
||||
@ -2,6 +2,8 @@ MIT License
|
||||
|
||||
Copyright (c) [2018] [Thom Seddon]
|
||||
|
||||
Copyright (c) [2023] [Wolfgang Hottgenroth]
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
|
||||
5
Makefile
5
Makefile
@ -2,4 +2,7 @@
|
||||
format:
|
||||
gofmt -w -s internal/*.go internal/provider/*.go cmd/*.go
|
||||
|
||||
.PHONY: format
|
||||
test:
|
||||
go test -v ./...
|
||||
|
||||
.PHONY: format test
|
||||
|
||||
365
README.md
365
README.md
@ -1,371 +1,48 @@
|
||||
# Traefik Forward Auth
|
||||
|
||||
# Traefik Forward Auth [](https://travis-ci.org/thomseddon/traefik-forward-auth) [](https://goreportcard.com/report/github.com/thomseddon/traefik-forward-auth)  [](https://GitHub.com/thomseddon/traefik-forward-auth/releases/)
|
||||
|
||||
|
||||
A minimal forward authentication service that provides OAuth/SSO login and authentication for the [traefik](https://github.com/containous/traefik) reverse proxy/load balancer.
|
||||
Yet another minimal modification of a great minimal forward authentication service that provides OAuth/SSO login and authentication for the [traefik](https://github.com/containous/traefik) reverse proxy/load balancer.
|
||||
|
||||
## Why?
|
||||
|
||||
- Seamlessly overlays any http service with a single endpoint (see: `url-path` in [Configuration](#configuration))
|
||||
- Supports multiple providers including Google and OpenID Connect (supported by Azure, Github, Salesforce etc.)
|
||||
- Supports multiple domains/subdomains by dynamically generating redirect_uri's
|
||||
- Allows authentication to be selectively applied/bypassed based on request parameters (see `rules` in [Configuration](#configuration)))
|
||||
- Supports use of centralised authentication host/redirect_uri (see `auth-host` in [Configuration](#configuration)))
|
||||
- Allows authentication to persist across multiple domains (see [Cookie Domains](#cookie-domains))
|
||||
- Supports extended authentication beyond Google token lifetime (see: `lifetime` in [Configuration](#configuration))
|
||||
The original [traefik-forward-auth](https://github.com/thomseddon/traefik-forward-auth) provides the forwarding of authentication between an Identity Provider like [keycloak](https://www.keycloak.org/) and the [ForwardAuth](https://doc.traefik.io/traefik/middlewares/http/forwardauth/) middleware of [traefik](https://doc.traefik.io/traefik/).
|
||||
|
||||
# Contents
|
||||
The modification of this project is to add minimal authorization functionality. The [traefik-forward-auth](https://home.hottis.de/gitlab/dockerized/traefik-forward-auth/) is configured with a `REQUIRED_ROLE` and access to the resource is only granted if the access token issued by the Identity Provider contains a claim with that particular role.
|
||||
|
||||
- [Releases](#releases)
|
||||
- [Usage](#usage)
|
||||
- [Simple](#simple)
|
||||
- [Advanced](#advanced)
|
||||
- [Provider Setup](#provider-setup)
|
||||
- [Configuration](#configuration)
|
||||
- [Overview](#overview)
|
||||
- [Option Details](#option-details)
|
||||
- [Concepts](#concepts)
|
||||
- [Forwarded Headers](#forwarded-headers)
|
||||
- [User Restriction](#user-restriction)
|
||||
- [Operation Modes](#operation-modes)
|
||||
- [Overlay Mode](#overlay-mode)
|
||||
- [Auth Host Mode](#auth-host-mode)
|
||||
- [Copyright](#copyright)
|
||||
- [License](#license)
|
||||
## Docker Image
|
||||
|
||||
## Releases
|
||||
|
||||
We recommend using the `2` tag on docker hub.
|
||||
|
||||
You can also use the latest incremental releases found on [docker hub](https://hub.docker.com/r/thomseddon/traefik-forward-auth/tags) and [github](https://github.com/thomseddon/traefik-forward-auth/releases).
|
||||
|
||||
#### Upgrade Guide
|
||||
|
||||
v2 was released in June 2019, whilst this is fully backwards compatible, a number of configuration options were modified, please see the [upgrade guide](https://github.com/thomseddon/traefik-forward-auth/wiki/v2-Upgrade-Guide) to prevent warnings on startup and ensure you are using the current configuration.
|
||||
|
||||
## Usage
|
||||
|
||||
#### Simple:
|
||||
|
||||
See below for instructions on how to setup your [Provider Setup](#provider-setup).
|
||||
|
||||
docker-compose.yml:
|
||||
|
||||
```yaml
|
||||
version: '3'
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: traefik:1.7
|
||||
ports:
|
||||
- "8085:80"
|
||||
volumes:
|
||||
- ./traefik.toml:/traefik.toml
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
|
||||
traefik-forward-auth:
|
||||
image: thomseddon/traefik-forward-auth:2
|
||||
environment:
|
||||
- PROVIDERS_GOOGLE_CLIENT_ID=your-client-id
|
||||
- PROVIDERS_GOOGLE_CLIENT_SECRET=your-client-secret
|
||||
- SECRET=something-random
|
||||
- INSECURE_COOKIE=true # Example assumes no https, do not use in production
|
||||
|
||||
whoami:
|
||||
image: emilevauge/whoami:latest
|
||||
labels:
|
||||
- "traefik.frontend.rule=Host:whoami.mycompany.com"
|
||||
```
|
||||
|
||||
traefik.toml:
|
||||
|
||||
```toml
|
||||
[entryPoints]
|
||||
[entryPoints.http]
|
||||
address = ":80"
|
||||
|
||||
[entryPoints.http.auth.forward]
|
||||
address = "http://traefik-forward-auth:4181"
|
||||
authResponseHeaders = ["X-Forwarded-User"]
|
||||
|
||||
[docker]
|
||||
endpoint = "unix:///var/run/docker.sock"
|
||||
network = "traefik"
|
||||
```
|
||||
|
||||
#### Advanced:
|
||||
|
||||
Please see the examples directory for a more complete [docker-compose.yml](https://github.com/thomseddon/traefik-forward-auth/blob/master/examples/docker-compose.yml) and full [traefik.toml](https://github.com/thomseddon/traefik-forward-auth/blob/master/examples/traefik.toml).
|
||||
|
||||
Also in the examples directory is [docker-compose-auth-host.yml](https://github.com/thomseddon/traefik-forward-auth/blob/master/examples/docker-compose-auth-host.yml) which shows how to configure a central auth host, along with some other options.
|
||||
|
||||
#### Provider Setup
|
||||
|
||||
##### Google
|
||||
|
||||
Head to https://console.developers.google.com and make sure you've switched to the correct email account.
|
||||
|
||||
Create a new project then search for and select "Credentials" in the search bar. Fill out the "OAuth Consent Screen" tab.
|
||||
|
||||
Click "Create Credentials" > "OAuth client ID". Select "Web Application", fill in the name of your app, skip "Authorized JavaScript origins" and fill "Authorized redirect URIs" with all the domains you will allow authentication from, appended with the `url-path` (e.g. https://app.test.com/_oauth)
|
||||
|
||||
You must set the `providers.google.client-id` and `providers.google.client-secret` config options.
|
||||
|
||||
##### OpenID Connect
|
||||
|
||||
Any provider that supports OpenID Connect 1.0 can be configured via the OIDC config options below.
|
||||
|
||||
You must set the `providers.oidc.issuer-url`, `providers.oidc.client-id` and `providers.oidc.client-secret` config options.
|
||||
The Docker image can be found at [DockerHub wollud1969/traefik-forward-auth](https://hub.docker.com/r/wollud1969/traefik-forward-auth).
|
||||
|
||||
## Configuration
|
||||
|
||||
### Overview
|
||||
### ... of traefik-forward-auth
|
||||
|
||||
The following configuration options are supported:
|
||||
In the `examples` directory the ymls to deploy a whoami service ([at GitHub](https://github.com/traefik/whoami/), [at Docker Hub](https://hub.docker.com/r/containous/whoami)) and the related ymls to deploy and configure the traefik-forward-auth service.
|
||||
The only relevant modification to the original [advanced separate pod example](https://github.com/thomseddon/traefik-forward-auth/tree/master/examples/traefik-v2/kubernetes/advanced-separate-pod) is the configuration parameter `REQUIRED_ROLE`.
|
||||
|
||||
```
|
||||
Usage:
|
||||
traefik-forward-auth [OPTIONS]
|
||||
### ... of the Identity Provider
|
||||
|
||||
Application Options:
|
||||
--log-level=[trace|debug|info|warn|error|fatal|panic] Log level (default: warn) [$LOG_LEVEL]
|
||||
--log-format=[text|json|pretty] Log format (default: text) [$LOG_FORMAT]
|
||||
--auth-host= Single host to use when returning from 3rd party auth [$AUTH_HOST]
|
||||
--config= Path to config file [$CONFIG]
|
||||
--cookie-domain= Domain to set auth cookie on, can be set multiple times [$COOKIE_DOMAIN]
|
||||
--insecure-cookie Use insecure cookies [$INSECURE_COOKIE]
|
||||
--cookie-name= Cookie Name (default: _forward_auth) [$COOKIE_NAME]
|
||||
--csrf-cookie-name= CSRF Cookie Name (default: _forward_auth_csrf) [$CSRF_COOKIE_NAME]
|
||||
--default-action=[auth|allow] Default action (default: auth) [$DEFAULT_ACTION]
|
||||
--default-provider=[google|oidc] Default provider (default: google) [$DEFAULT_PROVIDER]
|
||||
--domain= Only allow given email domains, can be set multiple times [$DOMAIN]
|
||||
--lifetime= Lifetime in seconds (default: 43200) [$LIFETIME]
|
||||
--url-path= Callback URL Path (default: /_oauth) [$URL_PATH]
|
||||
--secret= Secret used for signing (required) [$SECRET]
|
||||
--whitelist= Only allow given email addresses, can be set multiple times [$WHITELIST]
|
||||
--rule.<name>.<param>= Rule definitions, param can be: "action", "rule" or "provider"
|
||||
|
||||
|
||||
Google Provider:
|
||||
--providers.google.client-id= Client ID [$PROVIDERS_GOOGLE_CLIENT_ID]
|
||||
--providers.google.client-secret= Client Secret [$PROVIDERS_GOOGLE_CLIENT_SECRET]
|
||||
--providers.google.prompt= Space separated list of OpenID prompt options [$PROVIDERS_GOOGLE_PROMPT]
|
||||
|
||||
|
||||
OIDC Provider:
|
||||
--providers.oidc.issuer-url= Issuer URL [$PROVIDERS_OIDC_ISSUER_URL]
|
||||
--providers.oidc.client-id= Client ID [$PROVIDERS_OIDC_CLIENT_ID]
|
||||
--providers.oidc.client-secret= Client Secret [$PROVIDERS_OIDC_CLIENT_SECRET]
|
||||
|
||||
|
||||
Help Options:
|
||||
-h, --help Show this help message
|
||||
```
|
||||
|
||||
|
||||
All options can be supplied in any of the following ways, in the following precedence (first is highest precedence):
|
||||
|
||||
|
||||
1. **Command Arguments/Flags** - As shown above
|
||||
2. **Environment Variables** - As shown in square brackets above
|
||||
3. **File**
|
||||
1. Use INI format (e.g. `url-path = _oauthpath`)
|
||||
2. Specify the file location via the `--config` flag or `$CONFIG` environment variable
|
||||
3. Can be specified multiple times, each file will be read in the order they are passed
|
||||
|
||||
### Option Details
|
||||
|
||||
- `auth-host`
|
||||
|
||||
When set, when a user returns from authentication with a 3rd party provider they will always be forwarded to this host. By using one central host, this means you only need to add this `auth-host` as a valid redirect uri to your 3rd party provider.
|
||||
|
||||
The host should be specified without protocol or path, for example:
|
||||
|
||||
```
|
||||
--auth-host="auth.example.com"
|
||||
```
|
||||
|
||||
For more details, please also read the [Auth Host Mode](#auth-host-mode), operation mode in the concepts section.
|
||||
|
||||
Please Note - this should be considered advanced usage, if you are having problems please try disabling this option and then re-read the [Auth Host Mode](#auth-host-mode) section.
|
||||
|
||||
- `config`
|
||||
|
||||
Used to specify the path to a configuration file, can be set multiple times, each file will be read in the order they are passed. Options should be set in an INI format, for example:
|
||||
|
||||
```
|
||||
url-path = _oauthpath
|
||||
```
|
||||
|
||||
- `cookie-domain`
|
||||
|
||||
When set, if a user successfully completes authentication, then if the host of the original request requiring authentication is a subdomain of a given cookie domain, then the authentication cookie will be set for the higher level cookie domain. This means that a cookie can allow access to multiple subdomains without re-authentication. Can be specificed multiple times.
|
||||
|
||||
For example:
|
||||
```
|
||||
--cookie-domain="example.com" --cookie-domain="test.org"
|
||||
```
|
||||
|
||||
For example, if the cookie domain `test.com` has been set, and a request comes in on `app1.test.com`, following authentication the auth cookie will be set for the whole `test.com` domain. As such, if another request is forwarded for authentication from `app2.test.com`, the original cookie will be sent and so the request will be allowed without further authentication.
|
||||
|
||||
Beware however, if using cookie domains whilst running multiple instances of traefik/traefik-forward-auth for the same domain, the cookies will clash. You can fix this by using a different `cookie-name` in each host/cluster or by using the same `cookie-secret` in both instances.
|
||||
|
||||
- `insecure-cookie`
|
||||
|
||||
If you are not using HTTPS between the client and traefik, you will need to pass the `insecure-cookie` option which will mean the `Secure` attribute on the cookie will not be set.
|
||||
|
||||
- `cookie-name`
|
||||
|
||||
Set the name of the cookie set following successful authentication.
|
||||
|
||||
Default: `_forward_auth`
|
||||
|
||||
- `csrf-cookie-name`
|
||||
|
||||
Set the name of the temporary CSRF cookie set during authentication.
|
||||
|
||||
Default: `_forward_auth_csrf`
|
||||
|
||||
- `default-action`
|
||||
|
||||
Specifies the behavior when a request does not match any [rules](#rules). Valid options are `auth` or `allow`.
|
||||
|
||||
Default: `auth` (i.e. all requests require authentication)
|
||||
|
||||
- `default-provider`
|
||||
|
||||
Set the default provider to use for authentication, this can be overridden within [rules](#rules). Valid options are currently `google` or `oidc`.
|
||||
|
||||
Default: `google`
|
||||
|
||||
- `domain`
|
||||
|
||||
When set, only users matching a given domain will be permitted to access.
|
||||
|
||||
For example, setting `--domain=example.com --domain=test.org` would mean that only users from example.com or test.org will be permitted. So thom@example.com would be allowed but thom@another.com would not.
|
||||
|
||||
For more details, please also read [User Restriction](#user-restriction) in the concepts section.
|
||||
|
||||
- `lifetime`
|
||||
|
||||
How long a successful authentication session should last, in seconds.
|
||||
|
||||
Default: `43200` (12 hours)
|
||||
|
||||
- `url-path`
|
||||
|
||||
Customise the path that this service uses to handle the callback following authentication.
|
||||
|
||||
Default: `/_oauth`
|
||||
|
||||
Please note that when using the default [Overlay Mode](#overlay-mode) requests to this exact path will be intercepted by this service and not forwarded to your application. Use this option (or [Auth Host Mode](#auth-host-mode)) if the default `/_oauth` path will collide with an existing route in your application.
|
||||
|
||||
- `secret`
|
||||
|
||||
Used to sign cookies authentication, should be a random (e.g. `openssl rand -hex 16`)
|
||||
|
||||
- `whitelist`
|
||||
|
||||
When set, only specified users will be permitted.
|
||||
|
||||
For example, setting `--whitelist=thom@example.com --whitelist=alice@example.com` would mean that only those two exact users will be permitted. So thom@example.com would be allowed but john@example.com would not.
|
||||
|
||||
For more details, please also read [User Restriction](#user-restriction) in the concepts section.
|
||||
|
||||
- `rule`
|
||||
|
||||
Specify selective authentication rules. Rules are specified in the following format: `rule.<name>.<param>=<value>`
|
||||
|
||||
- `<name>` can be any string and is only used to group rules together
|
||||
- `<param>` can be:
|
||||
- `action` - same usage as [`default-action`](#default-action), supported values:
|
||||
- `auth` (default)
|
||||
- `allow`
|
||||
- `provider` - same usage as [`default-provider`](#default-provider), supported values:
|
||||
- `google`
|
||||
- `oidc`
|
||||
- `rule` - a rule to match a request, this uses traefik's v2 rule parser for which you can find the documentation here: https://docs.traefik.io/v2.0/routing/routers/#rule, supported values are summarised here:
|
||||
- ``Headers(`key`, `value`)``
|
||||
- ``HeadersRegexp(`key`, `regexp`)``
|
||||
- ``Host(`example.com`, ...)``
|
||||
- ``HostRegexp(`example.com`, `{subdomain:[a-z]+}.example.com`, ...)``
|
||||
- ``Method(methods, ...)``
|
||||
- ``Path(`path`, `/articles/{category}/{id:[0-9]+}`, ...)``
|
||||
- ``PathPrefix(`/products/`, `/articles/{category}/{id:[0-9]+}`)``
|
||||
- ``Query(`foo=bar`, `bar=baz`)``
|
||||
|
||||
For example:
|
||||
```
|
||||
# Allow requests that being with `/api/public` and contain the `Content-Type` header with a value of `application/json`
|
||||
rule.1.action = allow
|
||||
rule.1.rule = PathPrefix(`/api/public`) && Headers(`Content-Type`, `application/json`)
|
||||
|
||||
# Allow requests that have the exact path `/public`
|
||||
rule.two.action = allow
|
||||
rule.two.rule = Path(`/public`)
|
||||
|
||||
# Use OpenID Connect provider (must be configured) for requests that begin with `/github`
|
||||
rule.oidc.action = auth
|
||||
rule.oidc.provider = oidc
|
||||
rule.oidc.rule = PathPrefix(`/github`)
|
||||
```
|
||||
|
||||
## Concepts
|
||||
|
||||
### User Restriction
|
||||
|
||||
You can restrict who can login with the following parameters:
|
||||
|
||||
* `domain` - Use this to limit logins to a specific domain, e.g. test.com only
|
||||
* `whitelist` - Use this to only allow specific users to login e.g. thom@test.com only
|
||||
|
||||
Note, if you pass `whitelist` then only this is checked and `domain` is effectively ignored.
|
||||
|
||||
### Forwarded Headers
|
||||
|
||||
The authenticated user is set in the `X-Forwarded-User` header, to pass this on add this to the `authResponseHeaders` config option in traefik, as shown [here](https://github.com/thomseddon/traefik-forward-auth/blob/master/examples/docker-compose-dev.yml).
|
||||
|
||||
### Operation Modes
|
||||
|
||||
#### Overlay Mode
|
||||
|
||||
Overlay is the default operation mode, in this mode the authorisation endpoint is overlaid onto any domain. By default the `/_oauth` path is used, this can be customised using the `url-path` option.
|
||||
|
||||
The user flow will be:
|
||||
|
||||
1. Request to `www.myapp.com/home`
|
||||
2. User redirected to Google login
|
||||
3. After Google login, user is redirected to `www.myapp.com/_oauth`
|
||||
4. Token, user and CSRF cookie is validated (this request in intercepted and is never passed to your application)
|
||||
5. User is redirected to `www.myapp.com/home`
|
||||
6. Request is allowed
|
||||
|
||||
As the hostname in the `redirect_uri` is dynamically generated based on the original request, every hostname must be permitted in the Google OAuth console (e.g. `www.myappp.com` would need to be added in the above example)
|
||||
|
||||
#### Auth Host Mode
|
||||
|
||||
This is an optional mode of operation that is useful when dealing with a large number of subdomains, it is activated by using the `auth-host` config option (see [this example docker-compose.yml](https://github.com/thomseddon/traefik-forward-auth/blob/master/examples/docker-compose-auth-host.yml)).
|
||||
|
||||
For example, if you have a few applications: `app1.test.com`, `app2.test.com`, `appN.test.com`, adding every domain to Google's console can become laborious.
|
||||
To utilise an auth host, permit domain level cookies by setting the cookie domain to `test.com` then set the `auth-host` to: `auth.test.com`.
|
||||
|
||||
The user flow will then be:
|
||||
|
||||
1. Request to `app10.test.com/home/page`
|
||||
2. User redirected to Google login
|
||||
3. After Google login, user is redirected to `auth.test.com/_oauth`
|
||||
4. Token, user and CSRF cookie is validated, auth cookie is set to `test.com`
|
||||
5. User is redirected to `app10.test.com/home/page`
|
||||
6. Request is allowed
|
||||
|
||||
With this setup, only `auth.test.com` must be permitted in the Google console.
|
||||
|
||||
Two criteria must be met for an `auth-host` to be used:
|
||||
|
||||
1. Request matches given `cookie-domain`
|
||||
2. `auth-host` is also subdomain of same `cookie-domain`
|
||||
|
||||
Please note: For Auth Host mode to work, you must ensure that requests to your auth-host are routed to the traefik-forward-auth container, as demonstrated with the service labels in the [docker-compose-auth.yml](https://github.com/thomseddon/traefik-forward-auth/blob/master/examples/docker-compose-auth-host.yml) example.
|
||||
|
||||
## Copyright
|
||||
|
||||
2018 Thom Seddon
|
||||
|
||||
2023 Wolfgang Hottgenroth
|
||||
|
||||
## License
|
||||
|
||||
[MIT](https://github.com/thomseddon/traefik-forward-auth/blob/master/LICENSE.md)
|
||||
|
||||
[MIT](https://home.hottis.de/gitlab/dockerized/traefik-forward-auth/-/blob/master/LICENSE.md)
|
||||
|
||||
|
||||
|
||||
515
README.thomseddon.md
Normal file
515
README.thomseddon.md
Normal file
@ -0,0 +1,515 @@
|
||||
|
||||
# Traefik Forward Auth  [](https://goreportcard.com/report/github.com/thomseddon/traefik-forward-auth)  [](https://GitHub.com/thomseddon/traefik-forward-auth/releases/)
|
||||
|
||||
|
||||
A minimal forward authentication service that provides OAuth/SSO login and authentication for the [traefik](https://github.com/containous/traefik) reverse proxy/load balancer.
|
||||
|
||||
## Why?
|
||||
|
||||
- Seamlessly overlays any http service with a single endpoint (see: `url-path` in [Configuration](#configuration))
|
||||
- Supports multiple providers including Google and OpenID Connect (supported by Azure, Github, Salesforce etc.)
|
||||
- Supports multiple domains/subdomains by dynamically generating redirect_uri's
|
||||
- Allows authentication to be selectively applied/bypassed based on request parameters (see `rules` in [Configuration](#configuration))
|
||||
- Supports use of centralised authentication host/redirect_uri (see `auth-host` in [Configuration](#configuration))
|
||||
- Allows authentication to persist across multiple domains (see [Cookie Domains](#cookie-domains))
|
||||
- Supports extended authentication beyond Google token lifetime (see: `lifetime` in [Configuration](#configuration))
|
||||
|
||||
# Contents
|
||||
|
||||
- [Releases](#releases)
|
||||
- [Usage](#usage)
|
||||
- [Simple](#simple)
|
||||
- [Advanced](#advanced)
|
||||
- [Provider Setup](#provider-setup)
|
||||
- [Configuration](#configuration)
|
||||
- [Overview](#overview)
|
||||
- [Option Details](#option-details)
|
||||
- [Concepts](#concepts)
|
||||
- [Forwarded Headers](#forwarded-headers)
|
||||
- [User Restriction](#user-restriction)
|
||||
- [Applying Authentication](#applying-authentication)
|
||||
- [Global Authentication](#global-authentication)
|
||||
- [Selective Ingress Authentication in Kubernetes](#selective-ingress-authentication-in-kubernetes)
|
||||
- [Selective Container Authentication in Swarm](#selective-container-authentication-in-swarm)
|
||||
- [Rules Based Authentication](#rules-based-authentication)
|
||||
- [Operation Modes](#operation-modes)
|
||||
- [Overlay Mode](#overlay-mode)
|
||||
- [Auth Host Mode](#auth-host-mode)
|
||||
- [Logging Out](#logging-out)
|
||||
- [Copyright](#copyright)
|
||||
- [License](#license)
|
||||
|
||||
## Releases
|
||||
|
||||
We recommend using the `2` tag on docker hub (`thomseddon/traefik-forward-auth:2`).
|
||||
|
||||
You can also use the latest incremental releases found on [docker hub](https://hub.docker.com/r/thomseddon/traefik-forward-auth/tags) and [github](https://github.com/thomseddon/traefik-forward-auth/releases).
|
||||
|
||||
ARM releases are also available on docker hub, just append `-arm` or `-arm64` to your desired released (e.g. `2-arm` or `2.1-arm64`).
|
||||
|
||||
We also build binary files for usage without docker starting with releases after 2.2.0 You can find these as assets of the specific GitHub release.
|
||||
|
||||
#### Upgrade Guide
|
||||
|
||||
v2 was released in June 2019, whilst this is fully backwards compatible, a number of configuration options were modified, please see the [upgrade guide](https://github.com/thomseddon/traefik-forward-auth/wiki/v2-Upgrade-Guide) to prevent warnings on startup and ensure you are using the current configuration.
|
||||
|
||||
## Usage
|
||||
|
||||
#### Simple:
|
||||
|
||||
See below for instructions on how to setup your [Provider Setup](#provider-setup).
|
||||
|
||||
docker-compose.yml:
|
||||
|
||||
```yaml
|
||||
version: '3'
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: traefik:v2.2
|
||||
command: --providers.docker
|
||||
ports:
|
||||
- "8085:80"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
|
||||
traefik-forward-auth:
|
||||
image: thomseddon/traefik-forward-auth:2
|
||||
environment:
|
||||
- PROVIDERS_GOOGLE_CLIENT_ID=your-client-id
|
||||
- PROVIDERS_GOOGLE_CLIENT_SECRET=your-client-secret
|
||||
- SECRET=something-random
|
||||
- INSECURE_COOKIE=true # Example assumes no https, do not use in production
|
||||
labels:
|
||||
- "traefik.http.middlewares.traefik-forward-auth.forwardauth.address=http://traefik-forward-auth:4181"
|
||||
- "traefik.http.middlewares.traefik-forward-auth.forwardauth.authResponseHeaders=X-Forwarded-User"
|
||||
- "traefik.http.services.traefik-forward-auth.loadbalancer.server.port=4181"
|
||||
|
||||
whoami:
|
||||
image: containous/whoami
|
||||
labels:
|
||||
- "traefik.http.routers.whoami.rule=Host(`whoami.mycompany.com`)"
|
||||
- "traefik.http.routers.whoami.middlewares=traefik-forward-auth"
|
||||
```
|
||||
|
||||
#### Advanced:
|
||||
|
||||
Please see the examples directory for a more complete [docker-compose.yml](https://github.com/thomseddon/traefik-forward-auth/blob/master/examples/traefik-v2/swarm/docker-compose.yml) or [kubernetes/simple-separate-pod](https://github.com/thomseddon/traefik-forward-auth/blob/master/examples/traefik-v2/kubernetes/simple-separate-pod/).
|
||||
|
||||
Also in the examples directory is [docker-compose-auth-host.yml](https://github.com/thomseddon/traefik-forward-auth/blob/master/examples/traefik-v2/swarm/docker-compose-auth-host.yml) and [kubernetes/advanced-separate-pod](https://github.com/thomseddon/traefik-forward-auth/blob/master/examples/traefik-v2/kubernetes/advanced-separate-pod/) which shows how to configure a central auth host, along with some other options.
|
||||
|
||||
#### Provider Setup
|
||||
|
||||
Below are some general notes on provider setup, specific instructions and examples for a number of providers can be found on the [Provider Setup](https://github.com/thomseddon/traefik-forward-auth/wiki/Provider-Setup) wiki page.
|
||||
|
||||
##### Google
|
||||
|
||||
Head to https://console.developers.google.com and make sure you've switched to the correct email account.
|
||||
|
||||
Create a new project then search for and select "Credentials" in the search bar. Fill out the "OAuth Consent Screen" tab.
|
||||
|
||||
Click "Create Credentials" > "OAuth client ID". Select "Web Application", fill in the name of your app, skip "Authorized JavaScript origins" and fill "Authorized redirect URIs" with all the domains you will allow authentication from, appended with the `url-path` (e.g. https://app.test.com/_oauth)
|
||||
|
||||
You must set the `providers.google.client-id` and `providers.google.client-secret` config options.
|
||||
|
||||
##### OpenID Connect
|
||||
|
||||
Any provider that supports OpenID Connect 1.0 can be configured via the OIDC config options below.
|
||||
|
||||
You must set the `providers.oidc.issuer-url`, `providers.oidc.client-id` and `providers.oidc.client-secret` config options.
|
||||
|
||||
Please see the [Provider Setup](https://github.com/thomseddon/traefik-forward-auth/wiki/Provider-Setup) wiki page for examples.
|
||||
|
||||
##### Generic OAuth2
|
||||
|
||||
For providers that don't support OpenID Connect, we also have the Generic OAuth2 provider where you can statically configure the OAuth2 and "user" endpoints.
|
||||
|
||||
You must set:
|
||||
- `providers.generic-oauth.auth-url` - URL the client should be sent to authenticate the authenticate
|
||||
- `providers.generic-oauth.token-url` - URL the service should call to exchange an auth code for an access token
|
||||
- `providers.generic-oauth.user-url` - URL used to retrieve user info (service makes a GET request)
|
||||
- `providers.generic-oauth.client-id` - Client ID
|
||||
- `providers.generic-oauth.client-secret` - Client Secret
|
||||
|
||||
You can also set:
|
||||
- `providers.generic-oauth.scope`- Any scopes that should be included in the request (default: profile, email)
|
||||
- `providers.generic-oauth.token-style` - How token is presented when querying the User URL. Can be `header` or `query`, defaults to `header`. With `header` the token is provided in an Authorization header, with query the token is provided in the `access_token` query string value.
|
||||
|
||||
Please see the [Provider Setup](https://github.com/thomseddon/traefik-forward-auth/wiki/Provider-Setup) wiki page for examples.
|
||||
|
||||
## Configuration
|
||||
|
||||
### Overview
|
||||
|
||||
The following configuration options are supported:
|
||||
|
||||
```
|
||||
Usage:
|
||||
traefik-forward-auth [OPTIONS]
|
||||
|
||||
Application Options:
|
||||
--log-level=[trace|debug|info|warn|error|fatal|panic] Log level (default: warn) [$LOG_LEVEL]
|
||||
--log-format=[text|json|pretty] Log format (default: text) [$LOG_FORMAT]
|
||||
--auth-host= Single host to use when returning from 3rd party auth [$AUTH_HOST]
|
||||
--config= Path to config file [$CONFIG]
|
||||
--cookie-domain= Domain to set auth cookie on, can be set multiple times [$COOKIE_DOMAIN]
|
||||
--insecure-cookie Use insecure cookies [$INSECURE_COOKIE]
|
||||
--cookie-name= Cookie Name (default: _forward_auth) [$COOKIE_NAME]
|
||||
--csrf-cookie-name= CSRF Cookie Name (default: _forward_auth_csrf) [$CSRF_COOKIE_NAME]
|
||||
--default-action=[auth|allow] Default action (default: auth) [$DEFAULT_ACTION]
|
||||
--default-provider=[google|oidc|generic-oauth] Default provider (default: google) [$DEFAULT_PROVIDER]
|
||||
--domain= Only allow given email domains, can be set multiple times [$DOMAIN]
|
||||
--lifetime= Lifetime in seconds (default: 43200) [$LIFETIME]
|
||||
--logout-redirect= URL to redirect to following logout [$LOGOUT_REDIRECT]
|
||||
--url-path= Callback URL Path (default: /_oauth) [$URL_PATH]
|
||||
--secret= Secret used for signing (required) [$SECRET]
|
||||
--whitelist= Only allow given email addresses, can be set multiple times [$WHITELIST]
|
||||
--port= Port to listen on (default: 4181) [$PORT]
|
||||
--rule.<name>.<param>= Rule definitions, param can be: "action", "rule" or "provider"
|
||||
|
||||
Google Provider:
|
||||
--providers.google.client-id= Client ID [$PROVIDERS_GOOGLE_CLIENT_ID]
|
||||
--providers.google.client-secret= Client Secret [$PROVIDERS_GOOGLE_CLIENT_SECRET]
|
||||
--providers.google.prompt= Space separated list of OpenID prompt options [$PROVIDERS_GOOGLE_PROMPT]
|
||||
|
||||
OIDC Provider:
|
||||
--providers.oidc.issuer-url= Issuer URL [$PROVIDERS_OIDC_ISSUER_URL]
|
||||
--providers.oidc.client-id= Client ID [$PROVIDERS_OIDC_CLIENT_ID]
|
||||
--providers.oidc.client-secret= Client Secret [$PROVIDERS_OIDC_CLIENT_SECRET]
|
||||
--providers.oidc.resource= Optional resource indicator [$PROVIDERS_OIDC_RESOURCE]
|
||||
|
||||
Generic OAuth2 Provider:
|
||||
--providers.generic-oauth.auth-url= Auth/Login URL [$PROVIDERS_GENERIC_OAUTH_AUTH_URL]
|
||||
--providers.generic-oauth.token-url= Token URL [$PROVIDERS_GENERIC_OAUTH_TOKEN_URL]
|
||||
--providers.generic-oauth.user-url= URL used to retrieve user info [$PROVIDERS_GENERIC_OAUTH_USER_URL]
|
||||
--providers.generic-oauth.client-id= Client ID [$PROVIDERS_GENERIC_OAUTH_CLIENT_ID]
|
||||
--providers.generic-oauth.client-secret= Client Secret [$PROVIDERS_GENERIC_OAUTH_CLIENT_SECRET]
|
||||
--providers.generic-oauth.scope= Scopes (default: profile, email) [$PROVIDERS_GENERIC_OAUTH_SCOPE]
|
||||
--providers.generic-oauth.token-style=[header|query] How token is presented when querying the User URL (default: header)
|
||||
[$PROVIDERS_GENERIC_OAUTH_TOKEN_STYLE]
|
||||
--providers.generic-oauth.resource= Optional resource indicator [$PROVIDERS_GENERIC_OAUTH_RESOURCE]
|
||||
|
||||
Help Options:
|
||||
-h, --help Show this help message
|
||||
```
|
||||
|
||||
All options can be supplied in any of the following ways, in the following precedence (first is highest precedence):
|
||||
|
||||
1. **Command Arguments/Flags** - As shown above
|
||||
2. **Environment Variables** - As shown in square brackets above
|
||||
3. **File**
|
||||
1. Use INI format (e.g. `url-path = _oauthpath`)
|
||||
2. Specify the file location via the `--config` flag or `$CONFIG` environment variable
|
||||
3. Can be specified multiple times, each file will be read in the order they are passed
|
||||
|
||||
### Option Details
|
||||
|
||||
- `auth-host`
|
||||
|
||||
When set, when a user returns from authentication with a 3rd party provider they will always be forwarded to this host. By using one central host, this means you only need to add this `auth-host` as a valid redirect uri to your 3rd party provider.
|
||||
|
||||
The host should be specified without protocol or path, for example:
|
||||
|
||||
```
|
||||
--auth-host="auth.example.com"
|
||||
```
|
||||
|
||||
For more details, please also read the [Auth Host Mode](#auth-host-mode), operation mode in the concepts section.
|
||||
|
||||
Please Note - this should be considered advanced usage, if you are having problems please try disabling this option and then re-read the [Auth Host Mode](#auth-host-mode) section.
|
||||
|
||||
- `config`
|
||||
|
||||
Used to specify the path to a configuration file, can be set multiple times, each file will be read in the order they are passed. Options should be set in an INI format, for example:
|
||||
|
||||
```
|
||||
url-path = _oauthpath
|
||||
```
|
||||
|
||||
- `cookie-domain`
|
||||
|
||||
When set, if a user successfully completes authentication, then if the host of the original request requiring authentication is a subdomain of a given cookie domain, then the authentication cookie will be set for the higher level cookie domain. This means that a cookie can allow access to multiple subdomains without re-authentication. Can be specificed multiple times.
|
||||
|
||||
For example:
|
||||
```
|
||||
--cookie-domain="example.com" --cookie-domain="test.org"
|
||||
```
|
||||
|
||||
For example, if the cookie domain `test.com` has been set, and a request comes in on `app1.test.com`, following authentication the auth cookie will be set for the whole `test.com` domain. As such, if another request is forwarded for authentication from `app2.test.com`, the original cookie will be sent and so the request will be allowed without further authentication.
|
||||
|
||||
Beware however, if using cookie domains whilst running multiple instances of traefik/traefik-forward-auth for the same domain, the cookies will clash. You can fix this by using a different `cookie-name` in each host/cluster or by using the same `cookie-secret` in both instances.
|
||||
|
||||
- `insecure-cookie`
|
||||
|
||||
If you are not using HTTPS between the client and traefik, you will need to pass the `insecure-cookie` option which will mean the `Secure` attribute on the cookie will not be set.
|
||||
|
||||
- `cookie-name`
|
||||
|
||||
Set the name of the cookie set following successful authentication.
|
||||
|
||||
Default: `_forward_auth`
|
||||
|
||||
- `csrf-cookie-name`
|
||||
|
||||
Set the name of the temporary CSRF cookie set during authentication.
|
||||
|
||||
Default: `_forward_auth_csrf`
|
||||
|
||||
- `default-action`
|
||||
|
||||
Specifies the behavior when a request does not match any [rules](#rules). Valid options are `auth` or `allow`.
|
||||
|
||||
Default: `auth` (i.e. all requests require authentication)
|
||||
|
||||
- `default-provider`
|
||||
|
||||
Set the default provider to use for authentication, this can be overridden within [rules](#rules). Valid options are currently `google` or `oidc`.
|
||||
|
||||
Default: `google`
|
||||
|
||||
- `domain`
|
||||
|
||||
When set, only users matching a given domain will be permitted to access.
|
||||
|
||||
For example, setting `--domain=example.com --domain=test.org` would mean that only users from example.com or test.org will be permitted. So thom@example.com would be allowed but thom@another.com would not.
|
||||
|
||||
For more details, please also read [User Restriction](#user-restriction) in the concepts section.
|
||||
|
||||
- `lifetime`
|
||||
|
||||
How long a successful authentication session should last, in seconds.
|
||||
|
||||
Default: `43200` (12 hours)
|
||||
|
||||
- `logout-redirect`
|
||||
|
||||
When set, users will be redirected to this URL following logout.
|
||||
|
||||
- `match-whitelist-or-domain`
|
||||
|
||||
When enabled, users will be permitted if they match *either* the `whitelist` or `domain` parameters.
|
||||
|
||||
This will be enabled by default in v3, but is disabled by default in v2 to maintain backwards compatibility.
|
||||
|
||||
Default: `false`
|
||||
|
||||
For more details, please also read [User Restriction](#user-restriction) in the concepts section.
|
||||
|
||||
- `url-path`
|
||||
|
||||
Customise the path that this service uses to handle the callback following authentication.
|
||||
|
||||
Default: `/_oauth`
|
||||
|
||||
Please note that when using the default [Overlay Mode](#overlay-mode) requests to this exact path will be intercepted by this service and not forwarded to your application. Use this option (or [Auth Host Mode](#auth-host-mode)) if the default `/_oauth` path will collide with an existing route in your application.
|
||||
|
||||
- `secret`
|
||||
|
||||
Used to sign cookies authentication, should be a random (e.g. `openssl rand -hex 16`)
|
||||
|
||||
- `whitelist`
|
||||
|
||||
When set, only specified users will be permitted.
|
||||
|
||||
For example, setting `--whitelist=thom@example.com --whitelist=alice@example.com` would mean that only those two exact users will be permitted. So thom@example.com would be allowed but john@example.com would not.
|
||||
|
||||
For more details, please also read [User Restriction](#user-restriction) in the concepts section.
|
||||
|
||||
- `rule`
|
||||
|
||||
Specify selective authentication rules. Rules are specified in the following format: `rule.<name>.<param>=<value>`
|
||||
|
||||
- `<name>` can be any string and is only used to group rules together
|
||||
- `<param>` can be:
|
||||
- `action` - same usage as [`default-action`](#default-action), supported values:
|
||||
- `auth` (default)
|
||||
- `allow`
|
||||
- `domains` - optional, same usage as [`domain`](#domain)
|
||||
- `provider` - same usage as [`default-provider`](#default-provider), supported values:
|
||||
- `google`
|
||||
- `oidc`
|
||||
- `rule` - a rule to match a request, this uses traefik's v2 rule parser for which you can find the documentation here: https://docs.traefik.io/v2.0/routing/routers/#rule, supported values are summarised here:
|
||||
- ``Headers(`key`, `value`)``
|
||||
- ``HeadersRegexp(`key`, `regexp`)``
|
||||
- ``Host(`example.com`, ...)``
|
||||
- ``HostRegexp(`example.com`, `{subdomain:[a-z]+}.example.com`, ...)``
|
||||
- ``Method(methods, ...)``
|
||||
- ``Path(`path`, `/articles/{category}/{id:[0-9]+}`, ...)``
|
||||
- ``PathPrefix(`/products/`, `/articles/{category}/{id:[0-9]+}`)``
|
||||
- ``Query(`foo=bar`, `bar=baz`)``
|
||||
- `whitelist` - optional, same usage as whitelist`](#whitelist)
|
||||
|
||||
For example:
|
||||
```
|
||||
# Allow requests that being with `/api/public` and contain the `Content-Type` header with a value of `application/json`
|
||||
rule.1.action = allow
|
||||
rule.1.rule = PathPrefix(`/api/public`) && Headers(`Content-Type`, `application/json`)
|
||||
|
||||
# Allow requests that have the exact path `/public`
|
||||
rule.two.action = allow
|
||||
rule.two.rule = Path(`/public`)
|
||||
|
||||
# Use OpenID Connect provider (must be configured) for requests that begin with `/github`
|
||||
rule.oidc.action = auth
|
||||
rule.oidc.provider = oidc
|
||||
rule.oidc.rule = PathPrefix(`/github`)
|
||||
|
||||
# Allow jane@example.com to `/janes-eyes-only`
|
||||
rule.two.action = allow
|
||||
rule.two.rule = Path(`/janes-eyes-only`)
|
||||
rule.two.whitelist = jane@example.com
|
||||
```
|
||||
|
||||
Note: It is possible to break your redirect flow with rules, please be careful not to create an `allow` rule that matches your redirect_uri unless you know what you're doing. This limitation is being tracked in in #101 and the behaviour will change in future releases.
|
||||
|
||||
## Concepts
|
||||
|
||||
### User Restriction
|
||||
|
||||
You can restrict who can login with the following parameters:
|
||||
|
||||
* `domain` - Use this to limit logins to a specific domain, e.g. test.com only
|
||||
* `whitelist` - Use this to only allow specific users to login e.g. thom@test.com only
|
||||
|
||||
Note, if you pass both `whitelist` and `domain`, then the default behaviour is for only `whitelist` to be used and `domain` will be effectively ignored. You can allow users matching *either* `whitelist` or `domain` by passing the `match-whitelist-or-domain` parameter (this will be the default behaviour in v3). If you set `domains` or `whitelist` on a rule, the global configuration is ignored.
|
||||
|
||||
### Forwarded Headers
|
||||
|
||||
The authenticated user is set in the `X-Forwarded-User` header, to pass this on add this to the `authResponseHeaders` config option in traefik, as shown below in the [Applying Authentication](#applying-authentication) section.
|
||||
|
||||
### Applying Authentication
|
||||
|
||||
Authentication can be applied in a variety of ways, either globally across all requests, or selectively to specific containers/ingresses.
|
||||
|
||||
#### Global Authentication
|
||||
|
||||
This can be achieved by enabling forward authentication for an entire entrypoint, for example, with http only:
|
||||
|
||||
```ini
|
||||
--entryPoints.http.address=:80
|
||||
--entrypoints.http.http.middlewares=traefik-forward-auth # "default-traefik-forward-auth" on kubernetes
|
||||
```
|
||||
|
||||
Or https:
|
||||
|
||||
```ini
|
||||
--entryPoints.http.address=:80
|
||||
--entryPoints.http.http.redirections.entryPoint.to=https
|
||||
--entryPoints.http.http.redirections.entryPoint.scheme=https
|
||||
--entryPoints.https.address=:443
|
||||
--entrypoints.https.http.middlewares=traefik-forward-auth # "default-traefik-forward-auth" on kubernetes
|
||||
```
|
||||
|
||||
Note: Traefik prepends the namespace to the name of middleware defined via a kubernetes resource. This is handled automatically when referencing the middleware from another resource in the same namespace (so the namespace does not need to be prepended when referenced). However the full name, including the namespace, must be used when referenced from static configuration (e.g. command arguments or config file), hence you must prepend the namespace to your traefik-forward-auth middleware reference, as shown in the comments above (e.g. `default-traefik-forward-auth` if your middleware is named `traefik-forward-auth` and is defined in the `default` namespace).
|
||||
|
||||
#### Selective Ingress Authentication in Kubernetes
|
||||
|
||||
If you choose not to enable forward authentication for a specific entrypoint, you can apply the middleware to selected ingressroutes:
|
||||
|
||||
```yaml
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
entryPoints:
|
||||
- http
|
||||
routes:
|
||||
- match: Host(`whoami.example.com`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: whoami
|
||||
port: 80
|
||||
middlewares:
|
||||
- name: traefik-forward-auth
|
||||
```
|
||||
|
||||
See the examples directory for more examples.
|
||||
|
||||
#### Selective Container Authentication in Swarm
|
||||
|
||||
You can apply labels to selected containers:
|
||||
|
||||
```yaml
|
||||
whoami:
|
||||
image: containous/whoami
|
||||
labels:
|
||||
- "traefik.http.routers.whoami.rule=Host(`whoami.example.com`)"
|
||||
- "traefik.http.routers.whoami.middlewares=traefik-forward-auth"
|
||||
```
|
||||
|
||||
See the examples directory for more examples.
|
||||
|
||||
#### Rules Based Authentication
|
||||
|
||||
You can also leverage the `rules` config to selectively apply authentication via traefik-forward-auth. For example if you enabled global authentication by enabling forward authentication for an entire entrypoint, you can still exclude some patterns from requiring authentication:
|
||||
|
||||
```ini
|
||||
# Allow requests to 'dash.example.com'
|
||||
rule.1.action = allow
|
||||
rule.1.rule = Host(`dash.example.com`)
|
||||
|
||||
# Allow requests to `app.example.com/public`
|
||||
rule.two.action = allow
|
||||
rule.two.rule = Host(`app.example.com`) && Path(`/public`)
|
||||
```
|
||||
|
||||
### Operation Modes
|
||||
|
||||
#### Overlay Mode
|
||||
|
||||
Overlay is the default operation mode, in this mode the authorisation endpoint is overlaid onto any domain. By default the `/_oauth` path is used, this can be customised using the `url-path` option.
|
||||
|
||||
The user flow will be:
|
||||
|
||||
1. Request to `www.myapp.com/home`
|
||||
2. User redirected to Google login
|
||||
3. After Google login, user is redirected to `www.myapp.com/_oauth`
|
||||
4. Token, user and CSRF cookie is validated (this request in intercepted and is never passed to your application)
|
||||
5. User is redirected to `www.myapp.com/home`
|
||||
6. Request is allowed
|
||||
|
||||
As the hostname in the `redirect_uri` is dynamically generated based on the original request, every hostname must be permitted in the Google OAuth console (e.g. `www.myappp.com` would need to be added in the above example)
|
||||
|
||||
#### Auth Host Mode
|
||||
|
||||
This is an optional mode of operation that is useful when dealing with a large number of subdomains, it is activated by using the `auth-host` config option (see [this example docker-compose.yml](https://github.com/thomseddon/traefik-forward-auth/blob/master/examples/traefik-v2/swarm/docker-compose-auth-host.yml) or [this kubernetes example](https://github.com/thomseddon/traefik-forward-auth/tree/master/examples/traefik-v2/kubernetes/advanced-separate-pod)).
|
||||
|
||||
For example, if you have a few applications: `app1.test.com`, `app2.test.com`, `appN.test.com`, adding every domain to Google's console can become laborious.
|
||||
To utilise an auth host, permit domain level cookies by setting the cookie domain to `test.com` then set the `auth-host` to: `auth.test.com`.
|
||||
|
||||
The user flow will then be:
|
||||
|
||||
1. Request to `app10.test.com/home/page`
|
||||
2. User redirected to Google login
|
||||
3. After Google login, user is redirected to `auth.test.com/_oauth`
|
||||
4. Token, user and CSRF cookie is validated, auth cookie is set to `test.com`
|
||||
5. User is redirected to `app10.test.com/home/page`
|
||||
6. Request is allowed
|
||||
|
||||
With this setup, only `auth.test.com` must be permitted in the Google console.
|
||||
|
||||
Two criteria must be met for an `auth-host` to be used:
|
||||
|
||||
1. Request matches given `cookie-domain`
|
||||
2. `auth-host` is also subdomain of same `cookie-domain`
|
||||
|
||||
Please note: For Auth Host mode to work, you must ensure that requests to your auth-host are routed to the traefik-forward-auth container, as demonstrated with the service labels in the [docker-compose-auth.yml](https://github.com/thomseddon/traefik-forward-auth/blob/master/examples/traefik-v2/swarm/docker-compose-auth-host.yml) example and the [ingressroute resource](https://github.com/thomseddon/traefik-forward-auth/blob/master/examples/traefik-v2/kubernetes/advanced-separate-pod/traefik-forward-auth/ingress.yaml) in a kubernetes example.
|
||||
|
||||
### Logging Out
|
||||
|
||||
The service provides an endpoint to clear a users session and "log them out". The path is created by appending `/logout` to your configured `path` and so with the default settings it will be: `/_oauth/logout`.
|
||||
|
||||
You can use the `logout-redirect` config option to redirect users to another URL following logout (note: the user will not have a valid auth cookie after being logged out).
|
||||
|
||||
Note: This only clears the auth cookie from the users browser and as this service is stateless, it does not invalidate the cookie against future use. So if the cookie was recorded, for example, it could continue to be used for the duration of the cookie lifetime.
|
||||
|
||||
## Copyright
|
||||
|
||||
2018 Thom Seddon
|
||||
|
||||
## License
|
||||
|
||||
[MIT](https://github.com/thomseddon/traefik-forward-auth/blob/master/LICENSE.md)
|
||||
@ -1,6 +1,7 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/http"
|
||||
|
||||
internal "github.com/thomseddon/traefik-forward-auth/internal"
|
||||
@ -24,7 +25,6 @@ func main() {
|
||||
http.HandleFunc("/", server.RootHandler)
|
||||
|
||||
// Start
|
||||
log.Debugf("Starting with options: %s", config)
|
||||
log.Info("Listening on :4181")
|
||||
log.Info(http.ListenAndServe(":4181", nil))
|
||||
log.Infof("Listening on :%d", config.Port)
|
||||
log.Info(http.ListenAndServe(fmt.Sprintf(":%d", config.Port), nil))
|
||||
}
|
||||
|
||||
10
examples-thomseddon/traefik-v1.7/kubernetes/README.md
Normal file
10
examples-thomseddon/traefik-v1.7/kubernetes/README.md
Normal file
@ -0,0 +1,10 @@
|
||||
|
||||
# Kubernetes
|
||||
|
||||
These examples show how to deploy traefik-forward-auth alongside traefik v1.7.
|
||||
|
||||
The "seperate pod" examples show traefik-forward-auth in it's own pod and leave the deployment of traefik as an exercise for the user (e.g. if using helm).
|
||||
|
||||
The "single pod" examples show traefik and traefik-forward-auth in a single pod.
|
||||
|
||||
Please see the README's in each example for more details.
|
||||
@ -0,0 +1,16 @@
|
||||
|
||||
# Kubernetes - Advanced Separate Pod Example
|
||||
|
||||
This is an advanced example of how to deploy traefik-forward-auth in it's own pod. This example is a good starting point for those who already have traefik deployed (e.g. using helm).
|
||||
|
||||
This example uses [Selective Authentication](https://github.com/thomseddon/traefik-forward-auth/blob/master/README.md#selective-ingress-authentication-in-kubernetes) to selectively apply forward authentication to each selective ingress, a simple example "whoami" application (deployment, service and ingress) is included for completeness.
|
||||
|
||||
This example leverages kustomise to define Secrets and ConfigMaps, example deployment:
|
||||
|
||||
```
|
||||
# Deploy traefik-forward-auth
|
||||
kubectl apply -k traefik-forward-auth
|
||||
|
||||
# Deploy example whoami app
|
||||
kubectl apply -k whoami
|
||||
```
|
||||
@ -0,0 +1,3 @@
|
||||
bases:
|
||||
- traefik-forward-auth
|
||||
- whoami
|
||||
@ -0,0 +1,68 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
labels:
|
||||
app: traefik-forward-auth
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: traefik-forward-auth
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: traefik-forward-auth
|
||||
spec:
|
||||
terminationGracePeriodSeconds: 60
|
||||
containers:
|
||||
- image: thomseddon/traefik-forward-auth:2
|
||||
name: traefik-forward-auth
|
||||
ports:
|
||||
- containerPort: 4181
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: CONFIG
|
||||
value: "/config"
|
||||
- name: DOMAIN
|
||||
value: "example.com"
|
||||
# INSECURE_COOKIE is required unless using https entrypoint
|
||||
- name: INSECURE_COOKIE
|
||||
value: "true"
|
||||
# Remove COOKIE_DOMAIN if not using auth host mode
|
||||
- name: COOKIE_DOMAIN
|
||||
value: "example.com"
|
||||
# Remove AUTH_HOST if not using auth host mode
|
||||
- name: AUTH_HOST
|
||||
value: "auth.example.com"
|
||||
- name: LOG_LEVEL
|
||||
value: "info"
|
||||
- name: PROVIDERS_GOOGLE_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: traefik-forward-auth-secrets
|
||||
key: google-client-id
|
||||
- name: PROVIDERS_GOOGLE_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: traefik-forward-auth-secrets
|
||||
key: google-client-secret
|
||||
- name: SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: traefik-forward-auth-secrets
|
||||
key: secret
|
||||
volumeMounts:
|
||||
- name: configs
|
||||
mountPath: /config
|
||||
subPath: traefik-forward-auth.ini
|
||||
|
||||
volumes:
|
||||
- name: configs
|
||||
configMap:
|
||||
name: configs
|
||||
- name: traefik-forward-auth-secrets
|
||||
secret:
|
||||
secretName: secrets
|
||||
@ -0,0 +1,22 @@
|
||||
#
|
||||
# NOTE: This is only needed if you are using auth-host mode
|
||||
#
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
labels:
|
||||
app: traefik-forward-auth
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: traefik
|
||||
ingress.kubernetes.io/auth-type: forward
|
||||
ingress.kubernetes.io/auth-url: http://traefik-forward-auth:4181
|
||||
ingress.kubernetes.io/auth-response-headers: X-Forwarded-User
|
||||
spec:
|
||||
rules:
|
||||
- host: auth.example.com
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
serviceName: traefik-forward-auth
|
||||
servicePort: auth-http
|
||||
@ -0,0 +1,22 @@
|
||||
commonLabels:
|
||||
app: traefik-forward-auth
|
||||
|
||||
resources:
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml # Only needed for auth-host mode
|
||||
|
||||
#
|
||||
# Configs
|
||||
#
|
||||
configMapGenerator:
|
||||
- name: configs
|
||||
files:
|
||||
- traefik-forward-auth.ini
|
||||
|
||||
#
|
||||
# Secrets
|
||||
#
|
||||
secretGenerator:
|
||||
- name: traefik-forward-auth-secrets
|
||||
env: traefik-forward-auth.env
|
||||
@ -0,0 +1,14 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
labels:
|
||||
app: traefik-forward-auth
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: traefik-forward-auth
|
||||
ports:
|
||||
- name: auth-http
|
||||
port: 4181
|
||||
targetPort: 4181
|
||||
@ -0,0 +1,3 @@
|
||||
google-client-id=client-id
|
||||
google-client-secret=client-secret
|
||||
secret=something-random
|
||||
@ -0,0 +1,8 @@
|
||||
rule.example_public.action=allow
|
||||
rule.example_public.rule=Host("stats.example.com") && PathPrefix("/api/public")
|
||||
|
||||
rule.example_api.action=allow
|
||||
rule.example_api.rule=Host("api.example.com") && Headers("X-API-Authorization", "a-long-api-key")
|
||||
|
||||
rule.example_api_query.action=allow
|
||||
rule.example_api_query.rule=Host("api.example.com") && && Query("api_key=a-long-api-key")
|
||||
@ -0,0 +1,19 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: whoami
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
containers:
|
||||
- image: containous/whoami
|
||||
name: whoami
|
||||
@ -0,0 +1,19 @@
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: traefik
|
||||
ingress.kubernetes.io/auth-type: forward
|
||||
ingress.kubernetes.io/auth-url: http://traefik-forward-auth:4181
|
||||
ingress.kubernetes.io/auth-response-headers: X-Forwarded-User
|
||||
spec:
|
||||
rules:
|
||||
- host: whoami.example.com
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
serviceName: whoami
|
||||
servicePort: http
|
||||
@ -0,0 +1,7 @@
|
||||
commonLabels:
|
||||
app: whoami
|
||||
|
||||
resources:
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
@ -0,0 +1,14 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
selector:
|
||||
app: whoami
|
||||
|
||||
@ -0,0 +1,18 @@
|
||||
|
||||
# Kubernetes - Advanced Single Pod Example
|
||||
|
||||
This is an advanced example of how to deploy traefik and traefik-forward-auth in a single pod. This example is a good starting point for those who already have a manually defined traefik config (e.g. not using helm).
|
||||
|
||||
This example uses [Global Authentication](https://github.com/thomseddon/traefik-forward-auth/blob/master/README.md#global-authentication) to apply authentication for the entire `https` entrypoint.
|
||||
|
||||
This example also includes SSL via traefik acme/lesencrypt, auth host mode, exposes the traefik dashboard and leverages kustomise. No special config if required for your applications, but a simple example "whoami" application (deployment, service and ingress) is included for completeness.
|
||||
|
||||
Example deployment:
|
||||
|
||||
```
|
||||
# Deploy traefik+traefik-forward-auth
|
||||
kubectl apply -k traefik
|
||||
|
||||
# Deploy whoami app
|
||||
kubectl apply -k whoami
|
||||
```
|
||||
@ -0,0 +1,3 @@
|
||||
bases:
|
||||
- traefik
|
||||
- whoami
|
||||
@ -0,0 +1,8 @@
|
||||
rule.example_public.action=allow
|
||||
rule.example_public.rule=Host("stats.example.com") && PathPrefix("/api/public")
|
||||
|
||||
rule.example_api.action=allow
|
||||
rule.example_api.rule=Host("api.example.com") && Headers("X-API-Authorization", "a-long-api-key")
|
||||
|
||||
rule.example_api_query.action=allow
|
||||
rule.example_api_query.rule=Host("api.example.com") && && Query("api_key=a-long-api-key")
|
||||
@ -0,0 +1,169 @@
|
||||
################################################################
|
||||
# Global configuration
|
||||
################################################################
|
||||
|
||||
# Enable debug mode
|
||||
#
|
||||
# Optional
|
||||
# Default: false
|
||||
#
|
||||
# debug = true
|
||||
|
||||
# Log level
|
||||
#
|
||||
# Optional
|
||||
# Default: "ERROR"
|
||||
#
|
||||
logLevel = "INFO"
|
||||
|
||||
# Entrypoints to be used by frontends that do not specify any entrypoint.
|
||||
# Each frontend can specify its own entrypoints.
|
||||
#
|
||||
# Optional
|
||||
# Default: ["http"]
|
||||
#
|
||||
defaultEntryPoints = ["http", "https"]
|
||||
|
||||
# If set to true invalid SSL certificates are accepted for backends.
|
||||
# This disables detection of man-in-the-middle attacks so should only be used on secure backend networks.
|
||||
#
|
||||
# Optional
|
||||
# Default: false
|
||||
#
|
||||
insecureSkipVerify = true
|
||||
|
||||
################################################################
|
||||
# Entrypoints configuration
|
||||
################################################################
|
||||
|
||||
# Entrypoints definition
|
||||
#
|
||||
# Optional
|
||||
# Default:
|
||||
[entryPoints]
|
||||
[entryPoints.http]
|
||||
address = ":80"
|
||||
compress = true
|
||||
|
||||
[entryPoints.http.redirect]
|
||||
entryPoint = "https"
|
||||
|
||||
[entryPoints.https]
|
||||
address = ":443"
|
||||
compress = true
|
||||
|
||||
[entryPoints.https.tls]
|
||||
|
||||
[entryPoints.https.auth.forward]
|
||||
address = "http://127.0.0.1:4181"
|
||||
authResponseHeaders = ["X-Forwarded-User"]
|
||||
|
||||
[entryPoints.traefik]
|
||||
address = ":8080"
|
||||
|
||||
################################################################
|
||||
# Traefik logs configuration
|
||||
################################################################
|
||||
|
||||
# Traefik logs
|
||||
# Enabled by default and log to stdout
|
||||
#
|
||||
# Optional
|
||||
#
|
||||
[traefikLog]
|
||||
format = "json"
|
||||
|
||||
# Sets the filepath for the traefik log. If not specified, stdout will be used.
|
||||
# Intermediate directories are created if necessary.
|
||||
#
|
||||
# Optional
|
||||
# Default: os.Stdout
|
||||
#
|
||||
# filePath = "log/traefik.log"
|
||||
|
||||
# Format is either "json" or "common".
|
||||
#
|
||||
# Optional
|
||||
# Default: "common"
|
||||
#
|
||||
# format = "common"
|
||||
|
||||
################################################################
|
||||
# Access logs configuration
|
||||
################################################################
|
||||
|
||||
# Enable access logs
|
||||
# By default it will write to stdout and produce logs in the textual
|
||||
# Common Log Format (CLF), extended with additional fields.
|
||||
#
|
||||
# Optional
|
||||
#
|
||||
# [accessLog]
|
||||
|
||||
# Sets the file path for the access log. If not specified, stdout will be used.
|
||||
# Intermediate directories are created if necessary.
|
||||
#
|
||||
# Optional
|
||||
# Default: os.Stdout
|
||||
#
|
||||
# filePath = "/path/to/log/log.txt"
|
||||
|
||||
# Format is either "json" or "common".
|
||||
#
|
||||
# Optional
|
||||
# Default: "common"
|
||||
#
|
||||
# format = "common"
|
||||
|
||||
################################################################
|
||||
# API and dashboard configuration
|
||||
################################################################
|
||||
|
||||
# Enable API and dashboard
|
||||
[api]
|
||||
|
||||
# Name of the related entry point
|
||||
#
|
||||
# Optional
|
||||
# Default: "traefik"
|
||||
#
|
||||
# entryPoint = "traefik"
|
||||
|
||||
# Enabled Dashboard
|
||||
#
|
||||
# Optional
|
||||
# Default: true
|
||||
#
|
||||
# dashboard = false
|
||||
|
||||
################################################################
|
||||
# Ping configuration
|
||||
################################################################
|
||||
|
||||
# Enable ping
|
||||
[ping]
|
||||
|
||||
# Name of the related entry point
|
||||
#
|
||||
# Optional
|
||||
# Default: "traefik"
|
||||
#
|
||||
# entryPoint = "traefik"
|
||||
|
||||
################################################################
|
||||
# Docker configuration backend
|
||||
################################################################
|
||||
|
||||
# Enable Kubernetes configuration backend
|
||||
[kubernetes]
|
||||
|
||||
[acme]
|
||||
KeyType = "RSA4096"
|
||||
email = "you@example.com"
|
||||
storage = "/acme/acme.json"
|
||||
entryPoint = "https"
|
||||
onHostRule = true
|
||||
acmeLogging = true
|
||||
|
||||
[acme.httpChallenge]
|
||||
entryPoint = "http"
|
||||
@ -0,0 +1,94 @@
|
||||
#
|
||||
# Traefik + Traefik Forward Auth Deployment
|
||||
#
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: traefik
|
||||
labels:
|
||||
app: traefik
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: traefik
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: traefik
|
||||
spec:
|
||||
serviceAccountName: traefik
|
||||
terminationGracePeriodSeconds: 60
|
||||
containers:
|
||||
- image: traefik:1.7.12
|
||||
name: traefik
|
||||
args:
|
||||
- --configfile=/config/traefik.toml
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
protocol: TCP
|
||||
- name: https
|
||||
containerPort: 443
|
||||
protocol: TCP
|
||||
- name: dash
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- mountPath: /config
|
||||
name: configs
|
||||
- mountPath: /acme
|
||||
name: acme
|
||||
|
||||
- image: thomseddon/traefik-forward-auth:2
|
||||
name: traefik-forward-auth
|
||||
ports:
|
||||
- containerPort: 4181
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: CONFIG
|
||||
value: "/config"
|
||||
- name: DOMAIN
|
||||
value: "example.com"
|
||||
# INSECURE_COOKIE is required if not using a https entrypoint
|
||||
# - name: INSECURE_COOKIE
|
||||
# value: "true"
|
||||
# Remove COOKIE_DOMAIN if not using auth host mode
|
||||
- name: COOKIE_DOMAIN
|
||||
value: "example.com"
|
||||
- name: AUTH_HOST
|
||||
value: "auth.example.com"
|
||||
- name: LOG_LEVEL
|
||||
value: "info"
|
||||
- name: PROVIDERS_GOOGLE_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: traefik-forward-auth-secrets
|
||||
key: google-client-id
|
||||
- name: PROVIDERS_GOOGLE_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: traefik-forward-auth-secrets
|
||||
key: google-client-secret
|
||||
- name: SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: traefik-forward-auth-secrets
|
||||
key: secret
|
||||
volumeMounts:
|
||||
- name: configs
|
||||
mountPath: /config
|
||||
subPath: traefik-forward-auth.ini
|
||||
|
||||
volumes:
|
||||
- name: configs
|
||||
configMap:
|
||||
name: configs
|
||||
- name: traefik-forward-auth-secrets
|
||||
secret:
|
||||
secretName: secrets
|
||||
- name: acme
|
||||
persistentVolumeClaim:
|
||||
claimName: traefik-acme
|
||||
@ -0,0 +1,36 @@
|
||||
#
|
||||
# Auth Ingress
|
||||
#
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
labels:
|
||||
app: traefik
|
||||
spec:
|
||||
rules:
|
||||
- host: auth.example.com
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
serviceName: traefik-forward-auth
|
||||
servicePort: auth-http
|
||||
|
||||
---
|
||||
#
|
||||
# Dash Ingress
|
||||
#
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: traefik-dashboard
|
||||
labels:
|
||||
app: traefik
|
||||
spec:
|
||||
rules:
|
||||
- host: traefik.example.com
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
serviceName: traefik-dashboard
|
||||
servicePort: dashboard-http
|
||||
@ -0,0 +1,28 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: default
|
||||
commonLabels:
|
||||
app: traefik
|
||||
|
||||
resources:
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
- pvc.yaml
|
||||
- rbac.yaml
|
||||
|
||||
#
|
||||
# Configs
|
||||
#
|
||||
configMapGenerator:
|
||||
- name: configs
|
||||
files:
|
||||
- configs/traefik.toml
|
||||
- configs/traefik-forward-auth.ini
|
||||
|
||||
#
|
||||
# Secrets
|
||||
#
|
||||
secretGenerator:
|
||||
- name: traefik-forward-auth-secrets
|
||||
env: secrets/traefik-forward-auth.env
|
||||
@ -0,0 +1,17 @@
|
||||
# Source: traefik/templates/acme-pvc.yaml
|
||||
#
|
||||
# PVC
|
||||
#
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: traefik-acme
|
||||
labels:
|
||||
app: traefik
|
||||
spec:
|
||||
accessModes:
|
||||
- "ReadWriteOnce"
|
||||
resources:
|
||||
requests:
|
||||
storage: "1Gi"
|
||||
storageClassName: "local-traefik-acme"
|
||||
@ -0,0 +1,52 @@
|
||||
#
|
||||
# RBAC
|
||||
# Source: traefik/templates/rbac.yaml
|
||||
#
|
||||
kind: ServiceAccount
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: traefik
|
||||
---
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: traefik
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- endpoints
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- extensions
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- extensions
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- update
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: traefik
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: traefik
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: traefik
|
||||
namespace: kube-system
|
||||
@ -0,0 +1,3 @@
|
||||
google-client-id=client-id
|
||||
google-client-secret=client-secret
|
||||
secret=something-random
|
||||
@ -0,0 +1,58 @@
|
||||
#
|
||||
# Traefik Service
|
||||
#
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: traefik
|
||||
labels:
|
||||
app: traefik
|
||||
spec:
|
||||
# Use NodePort if required
|
||||
type: LoadBalancer
|
||||
selector:
|
||||
app: traefik
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 80
|
||||
- name: https
|
||||
port: 443
|
||||
targetPort: 443
|
||||
---
|
||||
#
|
||||
# Auth Service
|
||||
#
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
labels:
|
||||
app: traefik
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: traefik
|
||||
ports:
|
||||
- name: auth-http
|
||||
port: 4181
|
||||
targetPort: 4181
|
||||
|
||||
---
|
||||
#
|
||||
# Dash Service
|
||||
#
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: traefik-dashboard
|
||||
labels:
|
||||
app: traefik
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: traefik
|
||||
ports:
|
||||
- name: dashboard-http
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
@ -0,0 +1,19 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: whoami
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
containers:
|
||||
- image: containous/whoami
|
||||
name: whoami
|
||||
@ -0,0 +1,16 @@
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: traefik
|
||||
spec:
|
||||
rules:
|
||||
- host: whoami.example.com
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
serviceName: whoami
|
||||
servicePort: http
|
||||
@ -0,0 +1,7 @@
|
||||
commonLabels:
|
||||
app: whoami
|
||||
|
||||
resources:
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
@ -0,0 +1,14 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
selector:
|
||||
app: whoami
|
||||
|
||||
@ -0,0 +1,43 @@
|
||||
|
||||
# Kubernetes - Simple Separate Pod Example
|
||||
|
||||
This is a simple example of how to deploy traefik-forward-auth in it's own pod with minimal configuration. This example is a good starting point for those who already have traefik deployed (e.g. using helm).
|
||||
|
||||
This example uses annotations to apply authentication to selected ingresses (see `k8s-app.yml`). This means ingresses will not be protected by default, only those with these annotations will require forward authentication. For example:
|
||||
|
||||
```
|
||||
#
|
||||
# Ingress
|
||||
#
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: traefik
|
||||
ingress.kubernetes.io/auth-type: forward
|
||||
ingress.kubernetes.io/auth-url: http://traefik-forward-auth:4181
|
||||
ingress.kubernetes.io/auth-response-headers: X-Forwarded-User
|
||||
spec:
|
||||
rules:
|
||||
- host: whoami.example.com
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
serviceName: whoami
|
||||
servicePort: http
|
||||
```
|
||||
|
||||
|
||||
Example deployment:
|
||||
```
|
||||
# Deploy traefik-forward-auth
|
||||
kubectl apply -f k8s-traefik-forward-auth.yml
|
||||
|
||||
# Deploy example whoami app
|
||||
kubectl apply -f k8s-app.yml
|
||||
```
|
||||
|
||||
Please see the advanced examples for more details.
|
||||
@ -0,0 +1,62 @@
|
||||
#
|
||||
# Example Application Deployment
|
||||
#
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: whoami
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
containers:
|
||||
- name: whoami
|
||||
image: containous/whoami
|
||||
---
|
||||
#
|
||||
# Service
|
||||
#
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
selector:
|
||||
app: whoami
|
||||
|
||||
---
|
||||
#
|
||||
# Ingress
|
||||
#
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: traefik
|
||||
ingress.kubernetes.io/auth-type: forward
|
||||
ingress.kubernetes.io/auth-url: http://traefik-forward-auth:4181
|
||||
ingress.kubernetes.io/auth-response-headers: X-Forwarded-User
|
||||
spec:
|
||||
rules:
|
||||
- host: whoami.example.com
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
serviceName: whoami
|
||||
servicePort: http
|
||||
@ -0,0 +1,90 @@
|
||||
#
|
||||
# Traefik Forward Auth Deployment
|
||||
#
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
labels:
|
||||
app: traefik-forward-auth
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: traefik-forward-auth
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: traefik-forward-auth
|
||||
spec:
|
||||
terminationGracePeriodSeconds: 60
|
||||
containers:
|
||||
- image: thomseddon/traefik-forward-auth:2
|
||||
name: traefik-forward-auth
|
||||
ports:
|
||||
- containerPort: 4181
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: DOMAIN
|
||||
value: "example.com"
|
||||
# INSECURE_COOKIE is required unless using https entrypoint
|
||||
- name: INSECURE_COOKIE
|
||||
value: "true"
|
||||
- name: PROVIDERS_GOOGLE_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: traefik-forward-auth-secrets
|
||||
key: traefik-forward-auth-google-client-id
|
||||
- name: PROVIDERS_GOOGLE_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: traefik-forward-auth-secrets
|
||||
key: traefik-forward-auth-google-client-secret
|
||||
- name: SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: traefik-forward-auth-secrets
|
||||
key: traefik-forward-auth-secret
|
||||
|
||||
---
|
||||
#
|
||||
# Auth Service
|
||||
#
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
labels:
|
||||
app: traefik-forward-auth
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: traefik-forward-auth
|
||||
ports:
|
||||
- name: auth-http
|
||||
port: 4181
|
||||
targetPort: 4181
|
||||
|
||||
---
|
||||
#
|
||||
# Secrets
|
||||
#
|
||||
# Kubernetes requires secret values to be converted to base64 when defined
|
||||
# explicitly like this. (use `echo -n 'secret-value' | base64`)
|
||||
#
|
||||
# These are here for completeness, in reality you may define these elsewhere,
|
||||
# for example using kustomize (shown in advanced examples)
|
||||
#
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: traefik-forward-auth-secrets
|
||||
labels:
|
||||
app: traefik-forward-auth
|
||||
type: Opaque
|
||||
data:
|
||||
traefik-forward-auth-google-client-id: base64-client-id
|
||||
traefik-forward-auth-google-client-secret: base64-client-secret
|
||||
traefik-forward-auth-secret: base64-something-random
|
||||
@ -14,7 +14,7 @@ services:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
|
||||
whoami1:
|
||||
image: emilevauge/whoami
|
||||
image: containous/whoami
|
||||
networks:
|
||||
- traefik
|
||||
labels:
|
||||
@ -23,7 +23,7 @@ services:
|
||||
- "traefik.frontend.rule=Host:whoami.yourdomain.com"
|
||||
|
||||
traefik-forward-auth:
|
||||
image: thomseddon/traefik-forward-auth
|
||||
image: thomseddon/traefik-forward-auth:2
|
||||
environment:
|
||||
- PROVIDERS_GOOGLE_CLIENT_ID=your-client-id
|
||||
- PROVIDERS_GOOGLE_CLIENT_SECRET=your-client-secret
|
||||
@ -14,7 +14,7 @@ services:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
|
||||
whoami1:
|
||||
image: emilevauge/whoami
|
||||
image: containous/whoami
|
||||
networks:
|
||||
- traefik
|
||||
labels:
|
||||
@ -23,7 +23,7 @@ services:
|
||||
- "traefik.frontend.rule=Host:whoami.localhost.com"
|
||||
|
||||
traefik-forward-auth:
|
||||
build: ../
|
||||
build: thomseddon/traefik-forward-auth:2
|
||||
environment:
|
||||
- DEFAULT_PROVIDER=oidc
|
||||
- PROVIDERS_OIDC_ISSUER_URL=https://login.microsoftonline.com/{tenant}
|
||||
@ -14,7 +14,7 @@ services:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
|
||||
whoami1:
|
||||
image: emilevauge/whoami
|
||||
image: containous/whoami
|
||||
networks:
|
||||
- traefik
|
||||
labels:
|
||||
@ -23,8 +23,8 @@ services:
|
||||
- "traefik.frontend.rule=Host:whoami.localhost.com"
|
||||
|
||||
traefik-forward-auth:
|
||||
build: ../
|
||||
command: ./traefik-forward-auth --rule.1.action=allow --rule.1.rule="Path(`/`)"
|
||||
build: thomseddon/traefik-forward-auth:2
|
||||
command: ./traefik-forward-auth --rule.1.action=allow --rule.1.rule="Path(`/public`)"
|
||||
environment:
|
||||
- PROVIDERS_GOOGLE_CLIENT_ID=your-client-id
|
||||
- PROVIDERS_GOOGLE_CLIENT_SECRET=your-client-secret
|
||||
@ -135,3 +135,4 @@
|
||||
# Enable Docker configuration backend
|
||||
[docker]
|
||||
exposedByDefault = false
|
||||
network = "traefik"
|
||||
@ -0,0 +1,39 @@
|
||||
# Kubernetes - Advanced Separate Pod Example
|
||||
|
||||
This is an advanced example of how to deploy traefik-forward-auth in it's own pod. This example is a good starting point for those who already have traefik deployed (e.g. using helm).
|
||||
|
||||
This example uses [Selective Authentication](https://github.com/thomseddon/traefik-forward-auth/blob/master/README.md#selective-ingress-authentication-in-kubernetes) to selectively apply forward authentication to each selective ingresses, for example:
|
||||
|
||||
```
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
entryPoints:
|
||||
- https
|
||||
routes:
|
||||
- match: Host(`whoami.example.com`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: whoami
|
||||
port: 80
|
||||
middlewares:
|
||||
- name: traefik-forward-auth
|
||||
tls:
|
||||
certresolver: default
|
||||
```
|
||||
|
||||
This example also includes SSL via traefik acme/lesencrypt, auth host mode, and leverages kustomise. A simple example "whoami" application (deployment, service and ingress) is included for completeness.
|
||||
|
||||
Example deployment:
|
||||
|
||||
```
|
||||
# Deploy traefik-forward-auth
|
||||
kubectl apply -k traefik-forward-auth
|
||||
|
||||
# Deploy example whoami app
|
||||
kubectl apply -k whoami
|
||||
```
|
||||
@ -0,0 +1,3 @@
|
||||
bases:
|
||||
- traefik-forward-auth
|
||||
- whoami
|
||||
@ -0,0 +1,8 @@
|
||||
rule.example_public.action=allow
|
||||
rule.example_public.rule=Host("stats.example.com") && PathPrefix("/api/public")
|
||||
|
||||
rule.example_api.action=allow
|
||||
rule.example_api.rule=Host("api.example.com") && Headers("X-API-Authorization", "a-long-api-key")
|
||||
|
||||
rule.example_api_query.action=allow
|
||||
rule.example_api_query.rule=Host("api.example.com") && && Query("api_key=a-long-api-key")
|
||||
@ -0,0 +1,71 @@
|
||||
#
|
||||
# Traefik Forward Auth Deployment
|
||||
#
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
labels:
|
||||
app: traefik-forward-auth
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: traefik-forward-auth
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: traefik-forward-auth
|
||||
spec:
|
||||
serviceAccountName: traefik-ingress-controller
|
||||
terminationGracePeriodSeconds: 60
|
||||
containers:
|
||||
- image: thomseddon/traefik-forward-auth:2
|
||||
name: traefik-forward-auth
|
||||
ports:
|
||||
- containerPort: 4181
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: CONFIG
|
||||
value: "/config"
|
||||
- name: DOMAIN
|
||||
value: "example.com"
|
||||
# INSECURE_COOKIE is required if not using a https entrypoint
|
||||
# - name: INSECURE_COOKIE
|
||||
# value: "true"
|
||||
# Remove COOKIE_DOMAIN if not using auth host mode
|
||||
- name: COOKIE_DOMAIN
|
||||
value: "example.com"
|
||||
- name: AUTH_HOST
|
||||
value: "auth.example.com"
|
||||
- name: LOG_LEVEL
|
||||
value: "info"
|
||||
- name: PROVIDERS_GOOGLE_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: traefik-forward-auth-secrets
|
||||
key: google-client-id
|
||||
- name: PROVIDERS_GOOGLE_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: traefik-forward-auth-secrets
|
||||
key: google-client-secret
|
||||
- name: SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: traefik-forward-auth-secrets
|
||||
key: secret
|
||||
volumeMounts:
|
||||
- name: configs
|
||||
mountPath: /config
|
||||
subPath: traefik-forward-auth.ini
|
||||
|
||||
volumes:
|
||||
- name: configs
|
||||
configMap:
|
||||
name: configs
|
||||
- name: traefik-forward-auth-secrets
|
||||
secret:
|
||||
secretName: traefik-forward-auth-secrets
|
||||
@ -0,0 +1,20 @@
|
||||
#
|
||||
# Auth Ingress
|
||||
#
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
labels:
|
||||
app: traefik
|
||||
spec:
|
||||
entryPoints:
|
||||
- https
|
||||
routes:
|
||||
- match: Host(`auth.example.com`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: traefik-forward-auth
|
||||
port: 4181
|
||||
tls:
|
||||
certresolver: default
|
||||
@ -0,0 +1,26 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: default
|
||||
commonLabels:
|
||||
app: traefik-forward-auth
|
||||
|
||||
resources:
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
- middleware.yaml
|
||||
|
||||
#
|
||||
# Configs
|
||||
#
|
||||
configMapGenerator:
|
||||
- name: configs
|
||||
files:
|
||||
- configs/traefik-forward-auth.ini
|
||||
|
||||
#
|
||||
# Secrets
|
||||
#
|
||||
secretGenerator:
|
||||
- name: traefik-forward-auth-secrets
|
||||
env: secrets/traefik-forward-auth.env
|
||||
@ -0,0 +1,9 @@
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
spec:
|
||||
forwardAuth:
|
||||
address: http://traefik-forward-auth:4181
|
||||
authResponseHeaders:
|
||||
- X-Forwarded-User
|
||||
@ -0,0 +1,3 @@
|
||||
google-client-id=client-id
|
||||
google-client-secret=client-secret
|
||||
secret=something-random
|
||||
@ -0,0 +1,17 @@
|
||||
#
|
||||
# Auth Service
|
||||
#
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
labels:
|
||||
app: traefik
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: traefik
|
||||
ports:
|
||||
- name: auth-http
|
||||
port: 4181
|
||||
targetPort: 4181
|
||||
@ -0,0 +1,19 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: whoami
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
containers:
|
||||
- image: containous/whoami
|
||||
name: whoami
|
||||
@ -0,0 +1,19 @@
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
entryPoints:
|
||||
- https
|
||||
routes:
|
||||
- match: Host(`whoami.example.com`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: whoami
|
||||
port: 80
|
||||
middlewares:
|
||||
- name: traefik-forward-auth
|
||||
tls:
|
||||
certresolver: default
|
||||
@ -0,0 +1,7 @@
|
||||
commonLabels:
|
||||
app: whoami
|
||||
|
||||
resources:
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
@ -0,0 +1,14 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
selector:
|
||||
app: whoami
|
||||
|
||||
@ -0,0 +1,18 @@
|
||||
|
||||
# Kubernetes - Advanced Single Pod Example
|
||||
|
||||
This is an advanced example of how to deploy traefik and traefik-forward-auth in a single pod. This example is a good starting point for those who already have a manually defined traefik config (e.g. not using helm).
|
||||
|
||||
This example uses [Global Authentication](https://github.com/thomseddon/traefik-forward-auth/blob/master/README.md#global-authentication) to apply authentication for the entire `https` entrypoint.
|
||||
|
||||
This example also includes SSL via traefik acme/lesencrypt, auth host mode, exposes the traefik dashboard and leverages kustomise. No special config if required for your applications, but a simple example "whoami" application (deployment, service and ingress) is included for completeness.
|
||||
|
||||
Example deployment:
|
||||
|
||||
```
|
||||
# Deploy traefik+traefik-forward-auth
|
||||
kubectl apply -k traefik
|
||||
|
||||
# Deploy whoami app
|
||||
kubectl apply -k whoami
|
||||
```
|
||||
@ -0,0 +1,3 @@
|
||||
bases:
|
||||
- traefik
|
||||
- whoami
|
||||
@ -0,0 +1,8 @@
|
||||
rule.example_public.action=allow
|
||||
rule.example_public.rule=Host("stats.example.com") && PathPrefix("/api/public")
|
||||
|
||||
rule.example_api.action=allow
|
||||
rule.example_api.rule=Host("api.example.com") && Headers("X-API-Authorization", "a-long-api-key")
|
||||
|
||||
rule.example_api_query.action=allow
|
||||
rule.example_api_query.rule=Host("api.example.com") && && Query("api_key=a-long-api-key")
|
||||
@ -0,0 +1,103 @@
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: ingressroutes.traefik.containo.us
|
||||
|
||||
spec:
|
||||
group: traefik.containo.us
|
||||
version: v1alpha1
|
||||
names:
|
||||
kind: IngressRoute
|
||||
plural: ingressroutes
|
||||
singular: ingressroute
|
||||
scope: Namespaced
|
||||
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: middlewares.traefik.containo.us
|
||||
|
||||
spec:
|
||||
group: traefik.containo.us
|
||||
version: v1alpha1
|
||||
names:
|
||||
kind: Middleware
|
||||
plural: middlewares
|
||||
singular: middleware
|
||||
scope: Namespaced
|
||||
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: ingressroutetcps.traefik.containo.us
|
||||
|
||||
spec:
|
||||
group: traefik.containo.us
|
||||
version: v1alpha1
|
||||
names:
|
||||
kind: IngressRouteTCP
|
||||
plural: ingressroutetcps
|
||||
singular: ingressroutetcp
|
||||
scope: Namespaced
|
||||
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: ingressrouteudps.traefik.containo.us
|
||||
|
||||
spec:
|
||||
group: traefik.containo.us
|
||||
version: v1alpha1
|
||||
names:
|
||||
kind: IngressRouteUDP
|
||||
plural: ingressrouteudps
|
||||
singular: ingressrouteudp
|
||||
scope: Namespaced
|
||||
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: tlsoptions.traefik.containo.us
|
||||
|
||||
spec:
|
||||
group: traefik.containo.us
|
||||
version: v1alpha1
|
||||
names:
|
||||
kind: TLSOption
|
||||
plural: tlsoptions
|
||||
singular: tlsoption
|
||||
scope: Namespaced
|
||||
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: tlsstores.traefik.containo.us
|
||||
|
||||
spec:
|
||||
group: traefik.containo.us
|
||||
version: v1alpha1
|
||||
names:
|
||||
kind: TLSStore
|
||||
plural: tlsstores
|
||||
singular: tlsstore
|
||||
scope: Namespaced
|
||||
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: traefikservices.traefik.containo.us
|
||||
|
||||
spec:
|
||||
group: traefik.containo.us
|
||||
version: v1alpha1
|
||||
names:
|
||||
kind: TraefikService
|
||||
plural: traefikservices
|
||||
singular: traefikservice
|
||||
scope: Namespaced
|
||||
@ -0,0 +1,110 @@
|
||||
#
|
||||
# Traefik + Traefik Forward Auth Deployment
|
||||
#
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: traefik
|
||||
labels:
|
||||
app: traefik
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: traefik
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: traefik
|
||||
spec:
|
||||
serviceAccountName: traefik-ingress-controller
|
||||
terminationGracePeriodSeconds: 60
|
||||
containers:
|
||||
- image: traefik:2.2
|
||||
name: traefik
|
||||
args:
|
||||
- --api.dashboard
|
||||
- --accesslog
|
||||
- --entryPoints.http.address=:80
|
||||
- --entryPoints.http.http.redirections.entryPoint.to=https
|
||||
- --entryPoints.http.http.redirections.entryPoint.scheme=https
|
||||
- --entryPoints.https.address=:443
|
||||
# We're using "global authentication", so the middleware is defined here on the entrypoint
|
||||
# When a kubernetescrd middleware is applied globally it should take the form <kubernetes-namespace>-<middleware>
|
||||
- --entrypoints.https.http.middlewares=default-traefik-forward-auth
|
||||
- --providers.kubernetescrd
|
||||
- --log.level=info
|
||||
- --log.format=json
|
||||
- --certificatesresolvers.default.acme.email=foo@you.com
|
||||
- --certificatesresolvers.default.acme.storage=/acme/acme.json
|
||||
- --certificatesresolvers.default.acme.storage=/acme/acme.json
|
||||
- --certificatesresolvers.default.acme.httpchallenge.entrypoint=http
|
||||
# Please note that this is the staging Let's Encrypt server.
|
||||
# Once you get things working, you should remove that whole line altogether.
|
||||
- --certificatesresolvers.default.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
protocol: TCP
|
||||
- name: https
|
||||
containerPort: 443
|
||||
protocol: TCP
|
||||
- name: dash
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- mountPath: /acme
|
||||
name: acme
|
||||
|
||||
- image: thomseddon/traefik-forward-auth:2
|
||||
name: traefik-forward-auth
|
||||
ports:
|
||||
- containerPort: 4181
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: CONFIG
|
||||
value: "/config"
|
||||
- name: DOMAIN
|
||||
value: "example.com"
|
||||
# INSECURE_COOKIE is required if not using a https entrypoint
|
||||
# - name: INSECURE_COOKIE
|
||||
# value: "true"
|
||||
# Remove COOKIE_DOMAIN if not using auth host mode
|
||||
- name: COOKIE_DOMAIN
|
||||
value: "example.com"
|
||||
- name: AUTH_HOST
|
||||
value: "auth.example.com"
|
||||
- name: LOG_LEVEL
|
||||
value: "info"
|
||||
- name: PROVIDERS_GOOGLE_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: traefik-forward-auth-secrets
|
||||
key: google-client-id
|
||||
- name: PROVIDERS_GOOGLE_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: traefik-forward-auth-secrets
|
||||
key: google-client-secret
|
||||
- name: SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: traefik-forward-auth-secrets
|
||||
key: secret
|
||||
volumeMounts:
|
||||
- name: configs
|
||||
mountPath: /config
|
||||
subPath: traefik-forward-auth.ini
|
||||
|
||||
volumes:
|
||||
- name: configs
|
||||
configMap:
|
||||
name: configs
|
||||
- name: traefik-forward-auth-secrets
|
||||
secret:
|
||||
secretName: traefik-forward-auth-secrets
|
||||
- name: acme
|
||||
persistentVolumeClaim:
|
||||
claimName: traefik-acme
|
||||
@ -0,0 +1,42 @@
|
||||
#
|
||||
# Auth Ingress
|
||||
#
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
labels:
|
||||
app: traefik
|
||||
spec:
|
||||
entryPoints:
|
||||
- https
|
||||
routes:
|
||||
- match: Host(`auth.example.com`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: traefik-forward-auth
|
||||
port: 4181
|
||||
tls:
|
||||
certresolver: default
|
||||
|
||||
---
|
||||
#
|
||||
# Dash Ingress
|
||||
#
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: traefik-dashboard
|
||||
labels:
|
||||
app: traefik
|
||||
spec:
|
||||
entryPoints:
|
||||
- https
|
||||
routes:
|
||||
- match: Host(`traefik.example.com`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: api@internal
|
||||
kind: TraefikService
|
||||
tls:
|
||||
certresolver: default
|
||||
@ -0,0 +1,29 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: default
|
||||
commonLabels:
|
||||
app: traefik
|
||||
|
||||
resources:
|
||||
- crds.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
- middleware.yaml
|
||||
- pvc.yaml
|
||||
- rbac.yaml
|
||||
|
||||
#
|
||||
# Configs
|
||||
#
|
||||
configMapGenerator:
|
||||
- name: configs
|
||||
files:
|
||||
- configs/traefik-forward-auth.ini
|
||||
|
||||
#
|
||||
# Secrets
|
||||
#
|
||||
secretGenerator:
|
||||
- name: traefik-forward-auth-secrets
|
||||
env: secrets/traefik-forward-auth.env
|
||||
@ -0,0 +1,9 @@
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
spec:
|
||||
forwardAuth:
|
||||
address: http://127.0.0.1:4181
|
||||
authResponseHeaders:
|
||||
- X-Forwarded-User
|
||||
@ -0,0 +1,17 @@
|
||||
# Source: traefik/templates/acme-pvc.yaml
|
||||
#
|
||||
# PVC
|
||||
#
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: traefik-acme
|
||||
labels:
|
||||
app: traefik
|
||||
spec:
|
||||
accessModes:
|
||||
- "ReadWriteOnce"
|
||||
resources:
|
||||
requests:
|
||||
storage: "1Gi"
|
||||
storageClassName: "local-traefik-acme"
|
||||
@ -0,0 +1,66 @@
|
||||
#
|
||||
# RBAC
|
||||
#
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
namespace: default
|
||||
name: traefik-ingress-controller
|
||||
---
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
metadata:
|
||||
name: traefik-ingress-controller
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
- endpoints
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- extensions
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- extensions
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- traefik.containo.us
|
||||
resources:
|
||||
- middlewares
|
||||
- ingressroutes
|
||||
- traefikservices
|
||||
- ingressroutetcps
|
||||
- ingressrouteudps
|
||||
- tlsoptions
|
||||
- tlsstores
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
metadata:
|
||||
name: traefik-ingress-controller
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: traefik-ingress-controller
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: traefik-ingress-controller
|
||||
namespace: default
|
||||
@ -0,0 +1,3 @@
|
||||
google-client-id=client-id
|
||||
google-client-secret=client-secret
|
||||
secret=something-random
|
||||
@ -0,0 +1,39 @@
|
||||
#
|
||||
# Traefik Service
|
||||
#
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: traefik
|
||||
labels:
|
||||
app: traefik
|
||||
spec:
|
||||
# Use NodePort if required
|
||||
type: LoadBalancer
|
||||
selector:
|
||||
app: traefik
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 80
|
||||
- name: https
|
||||
port: 443
|
||||
targetPort: 443
|
||||
---
|
||||
#
|
||||
# Auth Service
|
||||
#
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
labels:
|
||||
app: traefik
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: traefik
|
||||
ports:
|
||||
- name: auth-http
|
||||
port: 4181
|
||||
targetPort: 4181
|
||||
@ -0,0 +1,19 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: whoami
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
containers:
|
||||
- image: containous/whoami
|
||||
name: whoami
|
||||
@ -0,0 +1,17 @@
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
entryPoints:
|
||||
- https
|
||||
routes:
|
||||
- match: Host(`whoami.example.com`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: whoami
|
||||
port: 80
|
||||
tls:
|
||||
certresolver: default
|
||||
@ -0,0 +1,7 @@
|
||||
commonLabels:
|
||||
app: whoami
|
||||
|
||||
resources:
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
@ -0,0 +1,14 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
selector:
|
||||
app: whoami
|
||||
|
||||
@ -0,0 +1,39 @@
|
||||
|
||||
# Kubernetes - Simple Separate Pod Example
|
||||
|
||||
This is a simple example of how to deploy traefik-forward-auth in it's own pod with minimal configuration. This example is a good starting point for those who already have traefik deployed (e.g. using helm).
|
||||
|
||||
This example uses [Selective Authentication](https://github.com/thomseddon/traefik-forward-auth/blob/master/README.md#selective-ingress-authentication-in-kubernetes) to apply forward authentication to selected ingresses. This means ingresses will not be protected by default. Authentication can be applied by adding the `traefik-forward-auth` middleware, for example:
|
||||
|
||||
```
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
entryPoints:
|
||||
- http
|
||||
routes:
|
||||
- match: Host(`whoami.example.com`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: whoami
|
||||
port: 80
|
||||
middlewares:
|
||||
- name: traefik-forward-auth
|
||||
```
|
||||
|
||||
A minimal application example is provided in `k8s-app.yml`.
|
||||
|
||||
Example deployment:
|
||||
```
|
||||
# Deploy traefik-forward-auth
|
||||
kubectl apply -f k8s-traefik-forward-auth.yml
|
||||
|
||||
# Deploy example whoami app
|
||||
kubectl apply -f k8s-app.yml
|
||||
```
|
||||
|
||||
Please see the advanced examples for more details.
|
||||
@ -0,0 +1,60 @@
|
||||
#
|
||||
# Example Application Deployment
|
||||
#
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: whoami
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
containers:
|
||||
- name: whoami
|
||||
image: containous/whoami
|
||||
---
|
||||
#
|
||||
# Service
|
||||
#
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
selector:
|
||||
app: whoami
|
||||
|
||||
---
|
||||
#
|
||||
# IngressRoute
|
||||
#
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
entryPoints:
|
||||
- http
|
||||
routes:
|
||||
- match: Host(`whoami.example.com`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: whoami
|
||||
port: 80
|
||||
middlewares:
|
||||
- name: traefik-forward-auth
|
||||
@ -0,0 +1,104 @@
|
||||
#
|
||||
# Traefik Forward Auth Deployment
|
||||
#
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
labels:
|
||||
app: traefik-forward-auth
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: traefik-forward-auth
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: traefik-forward-auth
|
||||
spec:
|
||||
terminationGracePeriodSeconds: 60
|
||||
containers:
|
||||
- image: thomseddon/traefik-forward-auth:2
|
||||
name: traefik-forward-auth
|
||||
ports:
|
||||
- containerPort: 4181
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: DOMAIN
|
||||
value: "example.com"
|
||||
# INSECURE_COOKIE is required unless using https entrypoint
|
||||
- name: INSECURE_COOKIE
|
||||
value: "true"
|
||||
- name: PROVIDERS_GOOGLE_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: traefik-forward-auth-secrets
|
||||
key: traefik-forward-auth-google-client-id
|
||||
- name: PROVIDERS_GOOGLE_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: traefik-forward-auth-secrets
|
||||
key: traefik-forward-auth-google-client-secret
|
||||
- name: SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: traefik-forward-auth-secrets
|
||||
key: traefik-forward-auth-secret
|
||||
|
||||
---
|
||||
#
|
||||
# Auth Service
|
||||
#
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
labels:
|
||||
app: traefik-forward-auth
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: traefik-forward-auth
|
||||
ports:
|
||||
- name: auth-http
|
||||
port: 4181
|
||||
targetPort: 4181
|
||||
|
||||
---
|
||||
#
|
||||
# Auth Middleware
|
||||
#
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
spec:
|
||||
forwardAuth:
|
||||
address: http://traefik-forward-auth:4181
|
||||
authResponseHeaders:
|
||||
- X-Forwarded-User
|
||||
|
||||
---
|
||||
#
|
||||
# Secrets
|
||||
#
|
||||
# Kubernetes requires secret values to be converted to base64 when defined
|
||||
# explicitly like this. (use `echo -n 'secret-value' | base64`)
|
||||
#
|
||||
# These are here for completeness, in reality you may define these elsewhere,
|
||||
# for example using kustomize (shown in advanced examples)
|
||||
#
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: traefik-forward-auth-secrets
|
||||
labels:
|
||||
app: traefik-forward-auth
|
||||
type: Opaque
|
||||
data:
|
||||
traefik-forward-auth-google-client-id: base64-client-id
|
||||
traefik-forward-auth-google-client-secret: base64-client-secret
|
||||
traefik-forward-auth-secret: base64-something-random
|
||||
@ -0,0 +1,37 @@
|
||||
version: '3'
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: traefik:v2.2
|
||||
command:
|
||||
- --providers.docker
|
||||
# This example uses "global authentication"
|
||||
- --entryPoints.http.address=:80
|
||||
- --entrypoints.http.http.middlewares=traefik-forward-auth
|
||||
ports:
|
||||
- "8085:80"
|
||||
- "8086:8080"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
|
||||
whoami:
|
||||
image: containous/whoami
|
||||
labels:
|
||||
- "traefik.http.routers.whoami.rule=Host(`whoami.localhost.com`)"
|
||||
|
||||
traefik-forward-auth:
|
||||
image: thomseddon/traefik-forward-auth:2
|
||||
environment:
|
||||
- PROVIDERS_GOOGLE_CLIENT_ID=your-client-id
|
||||
- PROVIDERS_GOOGLE_CLIENT_SECRET=your-client-secret
|
||||
- SECRET=something-random
|
||||
# INSECURE_COOKIE is required if not using a https entrypoint
|
||||
- INSECURE_COOKIE=true
|
||||
- COOKIE_DOMAIN=localhost.com
|
||||
- AUTH_HOST=auth.localhost.com:8085
|
||||
- LOG_LEVEL=debug
|
||||
labels:
|
||||
- "traefik.http.routers.traefik-forward-auth.rule=Host(`auth.localhost.com`)"
|
||||
- "traefik.http.middlewares.traefik-forward-auth.forwardauth.address=http://traefik-forward-auth:4181"
|
||||
- "traefik.http.middlewares.traefik-forward-auth.forwardauth.authResponseHeaders=X-Forwarded-User"
|
||||
- "traefik.http.services.traefik-forward-auth.loadbalancer.server.port=4181"
|
||||
34
examples-thomseddon/traefik-v2/swarm/docker-compose-oidc.yml
Normal file
34
examples-thomseddon/traefik-v2/swarm/docker-compose-oidc.yml
Normal file
@ -0,0 +1,34 @@
|
||||
version: '3'
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: traefik:v2.2
|
||||
command: --providers.docker
|
||||
ports:
|
||||
- "8085:80"
|
||||
- "8086:8080"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
|
||||
whoami:
|
||||
image: containous/whoami
|
||||
labels:
|
||||
- "traefik.http.routers.whoami.rule=Host(`whoami.localhost.com`)"
|
||||
- "traefik.http.routers.whoami.middlewares=traefik-forward-auth"
|
||||
|
||||
traefik-forward-auth:
|
||||
image: thomseddon/traefik-forward-auth:2
|
||||
environment:
|
||||
- DEFAULT_PROVIDER=oidc
|
||||
- PROVIDERS_OIDC_ISSUER_URL=https://login.microsoftonline.com/{tenant}
|
||||
- PROVIDERS_OIDC_CLIENT_ID=your-client-id
|
||||
- PROVIDERS_OIDC_CLIENT_SECRET=your-client-secret
|
||||
- SECRET=something-random
|
||||
# INSECURE_COOKIE is required if not using a https entrypoint
|
||||
- INSECURE_COOKIE=true
|
||||
- LOG_LEVEL=debug
|
||||
labels:
|
||||
- "traefik.http.middlewares.traefik-forward-auth.forwardauth.address=http://traefik-forward-auth:4181"
|
||||
- "traefik.http.middlewares.traefik-forward-auth.forwardauth.authResponseHeaders=X-Forwarded-User"
|
||||
- "traefik.http.services.traefik-forward-auth.loadbalancer.server.port=4181"
|
||||
|
||||
32
examples-thomseddon/traefik-v2/swarm/docker-compose.yml
Normal file
32
examples-thomseddon/traefik-v2/swarm/docker-compose.yml
Normal file
@ -0,0 +1,32 @@
|
||||
version: '3'
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: traefik:v2.2
|
||||
command: --providers.docker
|
||||
ports:
|
||||
- "8085:80"
|
||||
- "8086:8080"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
|
||||
whoami:
|
||||
image: containous/whoami
|
||||
labels:
|
||||
- "traefik.http.routers.whoami.rule=Host(`whoami.localhost.com`)"
|
||||
# This example uses "Selective Authentication"
|
||||
- "traefik.http.routers.whoami.middlewares=traefik-forward-auth"
|
||||
|
||||
traefik-forward-auth:
|
||||
image: thomseddon/traefik-forward-auth:2
|
||||
environment:
|
||||
- PROVIDERS_GOOGLE_CLIENT_ID=your-client-id
|
||||
- PROVIDERS_GOOGLE_CLIENT_SECRET=your-client-secret
|
||||
- SECRET=something-random
|
||||
# INSECURE_COOKIE is required if not using a https entrypoint
|
||||
- INSECURE_COOKIE=true
|
||||
- LOG_LEVEL=debug
|
||||
labels:
|
||||
- "traefik.http.middlewares.traefik-forward-auth.forwardauth.address=http://traefik-forward-auth:4181"
|
||||
- "traefik.http.middlewares.traefik-forward-auth.forwardauth.authResponseHeaders=X-Forwarded-User"
|
||||
- "traefik.http.services.traefik-forward-auth.loadbalancer.server.port=4181"
|
||||
155
examples/auth.yml
Normal file
155
examples/auth.yml
Normal file
@ -0,0 +1,155 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
data:
|
||||
INSECURE_COOKIE: 'true'
|
||||
COOKIE_DOMAIN: whoami.hottis.de
|
||||
DOMAINS: whoami.hottis.de
|
||||
AUTH_HOST: auth.whoami.hottis.de
|
||||
URL_PATH: /_oauth
|
||||
DEFAULT_PROVIDER: oidc
|
||||
PROVIDERS_OIDC_ISSUER_URL: https://auth2.hottis.de/realms/hottis
|
||||
PROVIDERS_OIDC_CLIENT_ID: whoami
|
||||
REQUIRED_ROLE: whoami_access
|
||||
# ---
|
||||
# apiVersion: v1
|
||||
# kind: Secret
|
||||
# metadata:
|
||||
# name: traefik-forward-auth
|
||||
# type: Opaque
|
||||
# data:
|
||||
# PROVIDERS_OIDC_CLIENT_SECRET: PLACEHOLDER
|
||||
# SECRET: PLACEHOLDER
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
labels:
|
||||
app: traefik-forward-auth
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: traefik-forward-auth
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: traefik-forward-auth
|
||||
annotations:
|
||||
container.apparmor.security.beta.kubernetes.io/traefik-forward-auth: runtime/default
|
||||
spec:
|
||||
containers:
|
||||
- name: traefik-forward-auth
|
||||
#image: thomseddon/traefik-forward-auth
|
||||
image: wollud1969/traefik-forward-auth:3.0.0
|
||||
imagePullPolicy: Always
|
||||
securityContext:
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65534
|
||||
runAsGroup: 65534
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
tcpSocket:
|
||||
port: 4181
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
resources:
|
||||
limits:
|
||||
memory: '10Mi'
|
||||
cpu: '100m'
|
||||
ports:
|
||||
- containerPort: 4181
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: PROVIDERS_OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: traefik-forward-auth
|
||||
key: PROVIDERS_OIDC_CLIENT_SECRET
|
||||
- name: SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: traefik-forward-auth
|
||||
key: SECRET
|
||||
- name: LOG_LEVEL
|
||||
value: trace
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: traefik-forward-auth
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
labels:
|
||||
app: traefik-forward-auth
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: traefik-forward-auth
|
||||
ports:
|
||||
- name: auth-http
|
||||
port: 4181
|
||||
targetPort: 4181
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: auth-whoami-hottis-de
|
||||
spec:
|
||||
secretName: auth-whoami-cert
|
||||
duration: 2160h
|
||||
renewBefore: 360h
|
||||
subject:
|
||||
organizations:
|
||||
- hottis-de
|
||||
isCA: false
|
||||
privateKey:
|
||||
algorithm: RSA
|
||||
encoding: PKCS1
|
||||
size: 2048
|
||||
usages:
|
||||
- server auth
|
||||
dnsNames:
|
||||
- auth.whoami.hottis.de
|
||||
issuerRef:
|
||||
name: letsencrypt-production-http
|
||||
kind: ClusterIssuer
|
||||
group: cert-manager.io
|
||||
---
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
labels:
|
||||
app: traefik-forward-auth
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`auth.whoami.hottis.de`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: traefik-forward-auth
|
||||
port: 4181
|
||||
tls:
|
||||
secretName: auth-whoami-cert
|
||||
---
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
spec:
|
||||
forwardAuth:
|
||||
trustForwardHeader: true
|
||||
address: http://traefik-forward-auth.whoami.svc.cluster.local:4181
|
||||
authResponseHeaders:
|
||||
- X-Forwarded-User
|
||||
|
||||
@ -1,48 +0,0 @@
|
||||
version: '3'
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: traefik
|
||||
command: -c /traefik.toml
|
||||
# command: -c /traefik.toml --logLevel=DEBUG
|
||||
ports:
|
||||
- "8085:80"
|
||||
- "8086:8080"
|
||||
networks:
|
||||
- traefik
|
||||
volumes:
|
||||
- ./traefik.toml:/traefik.toml
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
|
||||
whoami1:
|
||||
image: emilevauge/whoami
|
||||
networks:
|
||||
- traefik
|
||||
labels:
|
||||
- "traefik.backend=whoami1"
|
||||
- "traefik.enable=true"
|
||||
- "traefik.frontend.rule=Host:whoami.localhost.com"
|
||||
|
||||
whoami2:
|
||||
image: emilevauge/whoami
|
||||
networks:
|
||||
- traefik
|
||||
labels:
|
||||
- "traefik.backend=whoami2"
|
||||
- "traefik.enable=true"
|
||||
- "traefik.frontend.rule=Host:whoami.localhost.org"
|
||||
|
||||
traefik-forward-auth:
|
||||
build: ../
|
||||
environment:
|
||||
- PROVIDERS_GOOGLE_CLIENT_ID=your-client-id
|
||||
- PROVIDERS_GOOGLE_CLIENT_SECRET=your-client-secret
|
||||
- SECRET=something-random
|
||||
- INSECURE_COOKIE=true
|
||||
- COOKIE_DOMAIN=localhost.com
|
||||
- AUTH_HOST=auth.localhost.com
|
||||
networks:
|
||||
- traefik
|
||||
|
||||
networks:
|
||||
traefik:
|
||||
24
examples/install.sh
Executable file
24
examples/install.sh
Executable file
@ -0,0 +1,24 @@
|
||||
#!/bin/bash
|
||||
|
||||
SECRET_CONFIG_DIR=~/Workspace/MyKubernetesEnv/secret-configuration
|
||||
|
||||
NAMESPACE=$(cat namespace)
|
||||
SECRET=$(cat $SECRET_CONFIG_DIR/whoami-secret)
|
||||
PROVIDERS_OIDC_CLIENT_SECRET=$(cat $SECRET_CONFIG_DIR/whoami-oidc-secret)
|
||||
|
||||
kubectl create namespace $NAMESPACE \
|
||||
--dry-run=client \
|
||||
-o yaml | \
|
||||
kubectl -f - apply
|
||||
|
||||
kubectl create secret generic traefik-forward-auth \
|
||||
--dry-run=client \
|
||||
-o yaml \
|
||||
--save-config \
|
||||
--from-literal=PROVIDERS_OIDC_CLIENT_SECRET="$PROVIDERS_OIDC_CLIENT_SECRET" \
|
||||
--from-literal=SECRET="$SECRET" | \
|
||||
kubectl apply -f - -n $NAMESPACE
|
||||
|
||||
kubectl -f auth.yml -n $NAMESPACE apply
|
||||
kubectl -f install.yml -n $NAMESPACE apply
|
||||
|
||||
78
examples/install.yml
Normal file
78
examples/install.yml
Normal file
@ -0,0 +1,78 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: whoami
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
containers:
|
||||
- image: containous/whoami
|
||||
name: whoami
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
selector:
|
||||
app: whoami
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: whoami-hottis-de
|
||||
spec:
|
||||
secretName: whoami-cert
|
||||
duration: 2160h
|
||||
renewBefore: 360h
|
||||
subject:
|
||||
organizations:
|
||||
- hottis-de
|
||||
isCA: false
|
||||
privateKey:
|
||||
algorithm: RSA
|
||||
encoding: PKCS1
|
||||
size: 2048
|
||||
usages:
|
||||
- server auth
|
||||
dnsNames:
|
||||
- whoami.hottis.de
|
||||
issuerRef:
|
||||
name: letsencrypt-production-http
|
||||
kind: ClusterIssuer
|
||||
group: cert-manager.io
|
||||
---
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`whoami.hottis.de`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: whoami
|
||||
port: 80
|
||||
middlewares:
|
||||
- name: traefik-forward-auth
|
||||
tls:
|
||||
secretName: whoami-cert
|
||||
2
examples/namespace
Normal file
2
examples/namespace
Normal file
@ -0,0 +1,2 @@
|
||||
whoami
|
||||
|
||||
15
go.sum
15
go.sum
@ -127,7 +127,6 @@ github.com/go-acme/lego/v3 v3.2.0/go.mod h1:074uqt+JS6plx+c9Xaiz6+L+GBb+7itGtzfc
|
||||
github.com/go-cmd/cmd v1.0.5/go.mod h1:y8q8qlK5wQibcw63djSl/ntiHUHXHGdCkPk0j4QeW4s=
|
||||
github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
|
||||
github.com/go-ini/ini v1.44.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
|
||||
github.com/go-kit/kit v0.8.0 h1:Wz+5lgoB0kkuqLEc6NVmwRknTKP6dTGbSqvhZtBI/j0=
|
||||
github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
|
||||
github.com/go-kit/kit v0.9.0 h1:wDJmvq38kDhkVxi50ni9ykkdUr1PKgqKOoi01fa0Mdk=
|
||||
github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
|
||||
@ -145,7 +144,6 @@ github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4er
|
||||
github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
|
||||
github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
|
||||
github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
|
||||
github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
|
||||
github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
|
||||
github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
|
||||
github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs=
|
||||
@ -229,7 +227,6 @@ github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfV
|
||||
github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
|
||||
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
|
||||
github.com/kolo/xmlrpc v0.0.0-20190717152603-07c4ee3fd181/go.mod h1:o03bZfuBwAXHetKXuInt4S7omeXUu62/A845kiycsSQ=
|
||||
github.com/konsorten/go-windows-terminal-sequences v1.0.1 h1:mweAR1A6xJ3oS2pRaGiHgQ4OO8tzTaLawm8vnODuwDk=
|
||||
github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
|
||||
github.com/konsorten/go-windows-terminal-sequences v1.0.2 h1:DB17ag19krx9CFsz4o3enTrPXyIXCl+2iCXH/aMAp9s=
|
||||
github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
|
||||
@ -349,7 +346,6 @@ github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdh
|
||||
github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
|
||||
github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
|
||||
github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
|
||||
github.com/sirupsen/logrus v1.4.1 h1:GL2rEmy6nsikmW0r8opw9JIRScdMF5hA8cOYLH7In1k=
|
||||
github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
|
||||
github.com/sirupsen/logrus v1.4.2 h1:SPIRibHv4MatM3XXNO2BJeFLZwZ2LvZgfQ5+UNI2im4=
|
||||
github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
|
||||
@ -357,13 +353,11 @@ github.com/skratchdot/open-golang v0.0.0-20160302144031-75fb7ed4208c/go.mod h1:s
|
||||
github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
|
||||
github.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
|
||||
github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
|
||||
github.com/spf13/pflag v1.0.1 h1:aCvUg6QPl3ibpQUxyLkrEkCHtPqYJL4x9AuhqVqFis4=
|
||||
github.com/spf13/pflag v1.0.1/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
|
||||
github.com/streadway/amqp v0.0.0-20190404075320-75d898a42a94/go.mod h1:AZpEONHx3DKn8O/DFsRAY58/XVQiIPMTMB1SddzLXVw=
|
||||
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||
github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
|
||||
github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
|
||||
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
|
||||
github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
|
||||
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
|
||||
@ -436,7 +430,6 @@ golang.org/x/net v0.0.0-20190125091013-d26f9f9a57f3/go.mod h1:mL1N/T3taQHkDXs73r
|
||||
golang.org/x/net v0.0.0-20190206173232-65e2d4e15006/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3 h1:0GoQqolDA55aaLxZyTzK/Y2ePZzZTUrRacwib7cNsYQ=
|
||||
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||
golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||
golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
@ -457,7 +450,6 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ
|
||||
golang.org/x/sys v0.0.0-20180622082034-63fc586f45fe/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33 h1:I6FyU15t786LL7oL/hn43zqTuEGr4PN7F4XJ1p4E3Y8=
|
||||
golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
@ -469,7 +461,6 @@ golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5h
|
||||
golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20190422165155-953cdadca894 h1:Cz4ceDQGXuKRnVBDTS23GTn/pU5OE2C0WrNTOYK1Uuc=
|
||||
golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20190801041406-cbf593c0f2f3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
@ -493,10 +484,8 @@ golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3
|
||||
golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
|
||||
golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
|
||||
golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
|
||||
golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135 h1:5Beo0mZN8dRzgrMMkDp0jc8YXQKx9DiJ2k1dkvGsn5A=
|
||||
golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
|
||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
gonum.org/v1/gonum v0.0.0-20190331200053-3d26580ed485 h1:OB/uP/Puiu5vS5QMRPrXCDWUPb+kt8f1KW8oQzFejQw=
|
||||
gonum.org/v1/gonum v0.0.0-20190331200053-3d26580ed485/go.mod h1:2ltnJ7xHfj0zHS40VVPYEAAMTa3ZGguvHGBSJeRWqE0=
|
||||
gonum.org/v1/netlib v0.0.0-20190313105609-8cb42192e0e0/go.mod h1:wa6Ws7BG/ESfp6dHfk7C6KdzKA7wR7u/rKwOGE66zvw=
|
||||
gonum.org/v1/netlib v0.0.0-20190331212654-76723241ea4e/go.mod h1:kS+toOQn6AQKjmKJ7gzohV1XkqsFehRA2FbsbkopSuQ=
|
||||
@ -504,7 +493,6 @@ google.golang.org/api v0.3.1/go.mod h1:6wY9I6uQWHQ8EM57III9mq/AjF+i8G65rmVagqKMt
|
||||
google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
|
||||
google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
|
||||
google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
|
||||
google.golang.org/appengine v1.4.0 h1:/wp5JvzpHIxhs/dumFmF7BXTf3Z+dd4uXta4kVyO508=
|
||||
google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
|
||||
google.golang.org/appengine v1.5.0 h1:KxkO13IPW4Lslp2bz+KHP2E3gtFlrIGNThxkZQ3g+4c=
|
||||
google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
|
||||
@ -553,11 +541,8 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
|
||||
k8s.io/api v0.0.0-20190718183219-b59d8169aab5/go.mod h1:TBhBqb1AWbBQbW3XRusr7n7E4v2+5ZY8r8sAMnyFC5A=
|
||||
k8s.io/apimachinery v0.0.0-20190612205821-1799e75a0719/go.mod h1:I4A+glKBHiTgiEjQiCCQfCAIcIMFGt291SmsvcrFzJA=
|
||||
k8s.io/client-go v0.0.0-20190718183610-8e956561bbf5/go.mod h1:ozblAqkW495yoAX60QZyxQBq5W0YixE9Ffn4F91RO0g=
|
||||
k8s.io/code-generator v0.0.0-20190612205613-18da4a14b22b h1:p+PRuwXWwk5e+UYvicGiavEupapqM5NOxUl3y1GkD6c=
|
||||
k8s.io/code-generator v0.0.0-20190612205613-18da4a14b22b/go.mod h1:G8bQwmHm2eafm5bgtX67XDZQ8CWKSGu9DekI+yN4Y5I=
|
||||
k8s.io/gengo v0.0.0-20190116091435-f8a0810f38af h1:SwjZbO0u5ZuaV6TRMWOGB40iaycX8sbdMQHtjNZ19dk=
|
||||
k8s.io/gengo v0.0.0-20190116091435-f8a0810f38af/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
|
||||
k8s.io/klog v0.3.1 h1:RVgyDHY/kFKtLqh67NvEWIgkMneNoIrdkN0CxDSQc68=
|
||||
k8s.io/klog v0.3.1/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
|
||||
k8s.io/kube-openapi v0.0.0-20190228160746-b3a7cee44a30/go.mod h1:BXM9ceUBTj2QnfH2MK1odQs778ajze1RxcmP6S8RVVc=
|
||||
k8s.io/utils v0.0.0-20190221042446-c2654d5206da/go.mod h1:8k8uAuAQ0rXslZKaEWd0c3oVhZz7sSzSiPnVZayjIX0=
|
||||
|
||||
BIN
images/Keycloak-Access-Settings.png
Normal file
BIN
images/Keycloak-Access-Settings.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 50 KiB |
BIN
images/Keycloak-Capability-Config.png
Normal file
BIN
images/Keycloak-Capability-Config.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 42 KiB |
BIN
images/Keycloak-Client-Mapper.png
Normal file
BIN
images/Keycloak-Client-Mapper.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 72 KiB |
BIN
images/Keycloak-Client-Roles.png
Normal file
BIN
images/Keycloak-Client-Roles.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 37 KiB |
BIN
images/Keycloak-General-Settings.png
Normal file
BIN
images/Keycloak-General-Settings.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 25 KiB |
175
internal/auth.go
175
internal/auth.go
@ -17,6 +17,7 @@ import (
|
||||
|
||||
// Request Validation
|
||||
|
||||
// ValidateCookie verifies that a cookie matches the expected format of:
|
||||
// Cookie = hash(secret, cookie domain, email, expires)|expires|email
|
||||
func ValidateCookie(r *http.Request, c *http.Cookie) (string, error) {
|
||||
parts := strings.Split(c.Value, "|")
|
||||
@ -55,54 +56,88 @@ func ValidateCookie(r *http.Request, c *http.Cookie) (string, error) {
|
||||
return parts[2], nil
|
||||
}
|
||||
|
||||
// Validate email
|
||||
func ValidateEmail(email string) bool {
|
||||
found := false
|
||||
if len(config.Whitelist) > 0 {
|
||||
for _, whitelist := range config.Whitelist {
|
||||
if email == whitelist {
|
||||
found = true
|
||||
}
|
||||
// ValidateEmail checks if the given email address matches either a whitelisted
|
||||
// email address, as defined by the "whitelist" config parameter. Or is part of
|
||||
// a permitted domain, as defined by the "domains" config parameter
|
||||
func ValidateEmail(email, ruleName string) bool {
|
||||
// Use global config by default
|
||||
whitelist := config.Whitelist
|
||||
domains := config.Domains
|
||||
|
||||
if rule, ok := config.Rules[ruleName]; ok {
|
||||
// Override with rule config if found
|
||||
if len(rule.Whitelist) > 0 || len(rule.Domains) > 0 {
|
||||
whitelist = rule.Whitelist
|
||||
domains = rule.Domains
|
||||
}
|
||||
} else if len(config.Domains) > 0 {
|
||||
parts := strings.Split(email, "@")
|
||||
if len(parts) < 2 {
|
||||
return false
|
||||
}
|
||||
for _, domain := range config.Domains {
|
||||
if domain == parts[1] {
|
||||
found = true
|
||||
}
|
||||
}
|
||||
} else {
|
||||
}
|
||||
|
||||
// Do we have any validation to perform?
|
||||
if len(whitelist) == 0 && len(domains) == 0 {
|
||||
return true
|
||||
}
|
||||
|
||||
return found
|
||||
// Email whitelist validation
|
||||
if len(whitelist) > 0 {
|
||||
if ValidateWhitelist(email, whitelist) {
|
||||
return true
|
||||
}
|
||||
|
||||
// If we're not matching *either*, stop here
|
||||
if !config.MatchWhitelistOrDomain {
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
// Domain validation
|
||||
if len(domains) > 0 && ValidateDomains(email, domains) {
|
||||
return true
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
|
||||
// ValidateWhitelist checks if the email is in whitelist
|
||||
func ValidateWhitelist(email string, whitelist CommaSeparatedList) bool {
|
||||
for _, whitelist := range whitelist {
|
||||
if email == whitelist {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// ValidateDomains checks if the email matches a whitelisted domain
|
||||
func ValidateDomains(email string, domains CommaSeparatedList) bool {
|
||||
parts := strings.Split(email, "@")
|
||||
if len(parts) < 2 {
|
||||
return false
|
||||
}
|
||||
for _, domain := range domains {
|
||||
if domain == parts[1] {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// Utility methods
|
||||
|
||||
// Get the redirect base
|
||||
func redirectBase(r *http.Request) string {
|
||||
proto := r.Header.Get("X-Forwarded-Proto")
|
||||
host := r.Header.Get("X-Forwarded-Host")
|
||||
|
||||
return fmt.Sprintf("%s://%s", proto, host)
|
||||
return fmt.Sprintf("%s://%s", r.Header.Get("X-Forwarded-Proto"), r.Host)
|
||||
}
|
||||
|
||||
// Return url
|
||||
func returnUrl(r *http.Request) string {
|
||||
path := r.Header.Get("X-Forwarded-Uri")
|
||||
|
||||
return fmt.Sprintf("%s%s", redirectBase(r), path)
|
||||
return fmt.Sprintf("%s%s", redirectBase(r), r.URL.Path)
|
||||
}
|
||||
|
||||
// Get oauth redirect uri
|
||||
func redirectUri(r *http.Request) string {
|
||||
if use, _ := useAuthDomain(r); use {
|
||||
proto := r.Header.Get("X-Forwarded-Proto")
|
||||
return fmt.Sprintf("%s://%s%s", proto, config.AuthHost, config.Path)
|
||||
p := r.Header.Get("X-Forwarded-Proto")
|
||||
return fmt.Sprintf("%s://%s%s", p, config.AuthHost, config.Path)
|
||||
}
|
||||
|
||||
return fmt.Sprintf("%s%s", redirectBase(r), config.Path)
|
||||
@ -115,7 +150,7 @@ func useAuthDomain(r *http.Request) (bool, string) {
|
||||
}
|
||||
|
||||
// Does the request match a given cookie domain?
|
||||
reqMatch, reqHost := matchCookieDomains(r.Header.Get("X-Forwarded-Host"))
|
||||
reqMatch, reqHost := matchCookieDomains(r.Host)
|
||||
|
||||
// Do any of the auth hosts match a cookie domain?
|
||||
authMatch, authHost := matchCookieDomains(config.AuthHost)
|
||||
@ -126,7 +161,7 @@ func useAuthDomain(r *http.Request) (bool, string) {
|
||||
|
||||
// Cookie methods
|
||||
|
||||
// Create an auth cookie
|
||||
// MakeCookie creates an auth cookie
|
||||
func MakeCookie(r *http.Request, email string) *http.Cookie {
|
||||
expires := cookieExpiry()
|
||||
mac := cookieSignature(r, email, fmt.Sprintf("%d", expires.Unix()))
|
||||
@ -143,23 +178,44 @@ func MakeCookie(r *http.Request, email string) *http.Cookie {
|
||||
}
|
||||
}
|
||||
|
||||
// Make a CSRF cookie (used during login only)
|
||||
// ClearCookie clears the auth cookie
|
||||
func ClearCookie(r *http.Request) *http.Cookie {
|
||||
return &http.Cookie{
|
||||
Name: config.CookieName,
|
||||
Value: "",
|
||||
Path: "/",
|
||||
Domain: cookieDomain(r),
|
||||
HttpOnly: true,
|
||||
Secure: !config.InsecureCookie,
|
||||
Expires: time.Now().Local().Add(time.Hour * -1),
|
||||
}
|
||||
}
|
||||
|
||||
func buildCSRFCookieName(nonce string) string {
|
||||
return config.CSRFCookieName + "_" + nonce[:6]
|
||||
}
|
||||
|
||||
// MakeCSRFCookie makes a csrf cookie (used during login only)
|
||||
//
|
||||
// Note, CSRF cookies live shorter than auth cookies, a fixed 1h.
|
||||
// That's because some CSRF cookies may belong to auth flows that don't complete
|
||||
// and thus may not get cleared by ClearCookie.
|
||||
func MakeCSRFCookie(r *http.Request, nonce string) *http.Cookie {
|
||||
return &http.Cookie{
|
||||
Name: config.CSRFCookieName,
|
||||
Name: buildCSRFCookieName(nonce),
|
||||
Value: nonce,
|
||||
Path: "/",
|
||||
Domain: csrfCookieDomain(r),
|
||||
HttpOnly: true,
|
||||
Secure: !config.InsecureCookie,
|
||||
Expires: cookieExpiry(),
|
||||
Expires: time.Now().Local().Add(time.Hour * 1),
|
||||
}
|
||||
}
|
||||
|
||||
// Create a cookie to clear csrf cookie
|
||||
func ClearCSRFCookie(r *http.Request) *http.Cookie {
|
||||
// ClearCSRFCookie makes an expired csrf cookie to clear csrf cookie
|
||||
func ClearCSRFCookie(r *http.Request, c *http.Cookie) *http.Cookie {
|
||||
return &http.Cookie{
|
||||
Name: config.CSRFCookieName,
|
||||
Name: c.Name,
|
||||
Value: "",
|
||||
Path: "/",
|
||||
Domain: csrfCookieDomain(r),
|
||||
@ -169,18 +225,18 @@ func ClearCSRFCookie(r *http.Request) *http.Cookie {
|
||||
}
|
||||
}
|
||||
|
||||
// Validate the csrf cookie against state
|
||||
func ValidateCSRFCookie(r *http.Request, c *http.Cookie) (valid bool, provider string, redirect string, err error) {
|
||||
state := r.URL.Query().Get("state")
|
||||
// FindCSRFCookie extracts the CSRF cookie from the request based on state.
|
||||
func FindCSRFCookie(r *http.Request, state string) (c *http.Cookie, err error) {
|
||||
// Check for CSRF cookie
|
||||
return r.Cookie(buildCSRFCookieName(state))
|
||||
}
|
||||
|
||||
// ValidateCSRFCookie validates the csrf cookie against state
|
||||
func ValidateCSRFCookie(c *http.Cookie, state string) (valid bool, provider string, redirect string, err error) {
|
||||
if len(c.Value) != 32 {
|
||||
return false, "", "", errors.New("Invalid CSRF cookie value")
|
||||
}
|
||||
|
||||
if len(state) < 34 {
|
||||
return false, "", "", errors.New("Invalid CSRF state value")
|
||||
}
|
||||
|
||||
// Check nonce match
|
||||
if c.Value != state[:32] {
|
||||
return false, "", "", errors.New("CSRF cookie does not match state")
|
||||
@ -197,12 +253,21 @@ func ValidateCSRFCookie(r *http.Request, c *http.Cookie) (valid bool, provider s
|
||||
return true, params[:split], params[split+1:], nil
|
||||
}
|
||||
|
||||
// MakeState generates a state value
|
||||
func MakeState(r *http.Request, p provider.Provider, nonce string) string {
|
||||
return fmt.Sprintf("%s:%s:%s", nonce, p.Name(), returnUrl(r))
|
||||
}
|
||||
|
||||
// ValidateState checks whether the state is of right length.
|
||||
func ValidateState(state string) error {
|
||||
if len(state) < 34 {
|
||||
return errors.New("Invalid CSRF state value")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// Nonce generates a random nonce
|
||||
func Nonce() (error, string) {
|
||||
// Make nonce
|
||||
nonce := make([]byte, 16)
|
||||
_, err := rand.Read(nonce)
|
||||
if err != nil {
|
||||
@ -214,10 +279,8 @@ func Nonce() (error, string) {
|
||||
|
||||
// Cookie domain
|
||||
func cookieDomain(r *http.Request) string {
|
||||
host := r.Header.Get("X-Forwarded-Host")
|
||||
|
||||
// Check if any of the given cookie domains matches
|
||||
_, domain := matchCookieDomains(host)
|
||||
_, domain := matchCookieDomains(r.Host)
|
||||
return domain
|
||||
}
|
||||
|
||||
@ -227,7 +290,7 @@ func csrfCookieDomain(r *http.Request) string {
|
||||
if use, domain := useAuthDomain(r); use {
|
||||
host = domain
|
||||
} else {
|
||||
host = r.Header.Get("X-Forwarded-Host")
|
||||
host = r.Host
|
||||
}
|
||||
|
||||
// Remove port
|
||||
@ -263,9 +326,7 @@ func cookieExpiry() time.Time {
|
||||
return time.Now().Local().Add(config.Lifetime)
|
||||
}
|
||||
|
||||
// Cookie Domain
|
||||
|
||||
// Cookie Domain
|
||||
// CookieDomain holds cookie domain info
|
||||
type CookieDomain struct {
|
||||
Domain string
|
||||
DomainLen int
|
||||
@ -273,6 +334,7 @@ type CookieDomain struct {
|
||||
SubDomainLen int
|
||||
}
|
||||
|
||||
// NewCookieDomain creates a new CookieDomain from the given domain string
|
||||
func NewCookieDomain(domain string) *CookieDomain {
|
||||
return &CookieDomain{
|
||||
Domain: domain,
|
||||
@ -282,6 +344,7 @@ func NewCookieDomain(domain string) *CookieDomain {
|
||||
}
|
||||
}
|
||||
|
||||
// Match checks if the given host matches this CookieDomain
|
||||
func (c *CookieDomain) Match(host string) bool {
|
||||
// Exact domain match?
|
||||
if host == c.Domain {
|
||||
@ -296,19 +359,22 @@ func (c *CookieDomain) Match(host string) bool {
|
||||
return false
|
||||
}
|
||||
|
||||
// UnmarshalFlag converts a string to a CookieDomain
|
||||
func (c *CookieDomain) UnmarshalFlag(value string) error {
|
||||
*c = *NewCookieDomain(value)
|
||||
return nil
|
||||
}
|
||||
|
||||
// MarshalFlag converts a CookieDomain to a string
|
||||
func (c *CookieDomain) MarshalFlag() (string, error) {
|
||||
return c.Domain, nil
|
||||
}
|
||||
|
||||
// Legacy support for comma separated list of cookie domains
|
||||
|
||||
// CookieDomains provides legacy sypport for comma separated list of cookie domains
|
||||
type CookieDomains []CookieDomain
|
||||
|
||||
// UnmarshalFlag converts a comma separated list of cookie domains to an array
|
||||
// of CookieDomains
|
||||
func (c *CookieDomains) UnmarshalFlag(value string) error {
|
||||
if len(value) > 0 {
|
||||
for _, d := range strings.Split(value, ",") {
|
||||
@ -319,6 +385,7 @@ func (c *CookieDomains) UnmarshalFlag(value string) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
// MarshalFlag converts an array of CookieDomain to a comma seperated list
|
||||
func (c *CookieDomains) MarshalFlag() (string, error) {
|
||||
var domains []string
|
||||
for _, d := range *c {
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
package tfa
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"strings"
|
||||
"testing"
|
||||
@ -66,42 +66,139 @@ func TestAuthValidateEmail(t *testing.T) {
|
||||
assert := assert.New(t)
|
||||
config, _ = NewConfig([]string{})
|
||||
|
||||
// Should allow any
|
||||
v := ValidateEmail("test@test.com")
|
||||
// Should allow any with no whitelist/domain is specified
|
||||
v := ValidateEmail("test@test.com", "default")
|
||||
assert.True(v, "should allow any domain if email domain is not defined")
|
||||
v = ValidateEmail("one@two.com")
|
||||
v = ValidateEmail("one@two.com", "default")
|
||||
assert.True(v, "should allow any domain if email domain is not defined")
|
||||
|
||||
// Should block non matching domain
|
||||
config.Domains = []string{"test.com"}
|
||||
v = ValidateEmail("one@two.com")
|
||||
assert.False(v, "should not allow user from another domain")
|
||||
|
||||
// Should allow matching domain
|
||||
config.Domains = []string{"test.com"}
|
||||
v = ValidateEmail("test@test.com")
|
||||
v = ValidateEmail("one@two.com", "default")
|
||||
assert.False(v, "should not allow user from another domain")
|
||||
v = ValidateEmail("test@test.com", "default")
|
||||
assert.True(v, "should allow user from allowed domain")
|
||||
|
||||
// Should block non whitelisted email address
|
||||
config.Domains = []string{}
|
||||
config.Whitelist = []string{"test@test.com"}
|
||||
v = ValidateEmail("one@two.com")
|
||||
assert.False(v, "should not allow user not in whitelist")
|
||||
|
||||
// Should allow matching whitelisted email address
|
||||
config.Domains = []string{}
|
||||
config.Whitelist = []string{"test@test.com"}
|
||||
v = ValidateEmail("test@test.com")
|
||||
v = ValidateEmail("one@two.com", "default")
|
||||
assert.False(v, "should not allow user not in whitelist")
|
||||
v = ValidateEmail("test@test.com", "default")
|
||||
assert.True(v, "should allow user in whitelist")
|
||||
|
||||
// Should allow only matching email address when
|
||||
// MatchWhitelistOrDomain is disabled
|
||||
config.Domains = []string{"example.com"}
|
||||
config.Whitelist = []string{"test@test.com"}
|
||||
config.MatchWhitelistOrDomain = false
|
||||
v = ValidateEmail("one@two.com", "default")
|
||||
assert.False(v, "should not allow user not in either")
|
||||
v = ValidateEmail("test@example.com", "default")
|
||||
assert.False(v, "should not allow user from allowed domain")
|
||||
v = ValidateEmail("test@test.com", "default")
|
||||
assert.True(v, "should allow user in whitelist")
|
||||
|
||||
// Should allow either matching domain or email address when
|
||||
// MatchWhitelistOrDomain is enabled
|
||||
config.Domains = []string{"example.com"}
|
||||
config.Whitelist = []string{"test@test.com"}
|
||||
config.MatchWhitelistOrDomain = true
|
||||
v = ValidateEmail("one@two.com", "default")
|
||||
assert.False(v, "should not allow user not in either")
|
||||
v = ValidateEmail("test@example.com", "default")
|
||||
assert.True(v, "should allow user from allowed domain")
|
||||
v = ValidateEmail("test@test.com", "default")
|
||||
assert.True(v, "should allow user in whitelist")
|
||||
|
||||
// Rule testing
|
||||
|
||||
// Should use global whitelist/domain when not specified on rule
|
||||
config.Domains = []string{"example.com"}
|
||||
config.Whitelist = []string{"test@test.com"}
|
||||
config.Rules = map[string]*Rule{"test": NewRule()}
|
||||
config.MatchWhitelistOrDomain = true
|
||||
v = ValidateEmail("one@two.com", "test")
|
||||
assert.False(v, "should not allow user not in either")
|
||||
v = ValidateEmail("test@example.com", "test")
|
||||
assert.True(v, "should allow user from allowed global domain")
|
||||
v = ValidateEmail("test@test.com", "test")
|
||||
assert.True(v, "should allow user in global whitelist")
|
||||
|
||||
// Should allow matching domain in rule
|
||||
config.Domains = []string{"testglobal.com"}
|
||||
config.Whitelist = []string{}
|
||||
rule := NewRule()
|
||||
config.Rules = map[string]*Rule{"test": rule}
|
||||
rule.Domains = []string{"testrule.com"}
|
||||
config.MatchWhitelistOrDomain = false
|
||||
v = ValidateEmail("one@two.com", "test")
|
||||
assert.False(v, "should not allow user from another domain")
|
||||
v = ValidateEmail("one@testglobal.com", "test")
|
||||
assert.False(v, "should not allow user from global domain")
|
||||
v = ValidateEmail("test@testrule.com", "test")
|
||||
assert.True(v, "should allow user from allowed domain")
|
||||
|
||||
// Should allow matching whitelist in rule
|
||||
config.Domains = []string{}
|
||||
config.Whitelist = []string{"test@testglobal.com"}
|
||||
rule = NewRule()
|
||||
config.Rules = map[string]*Rule{"test": rule}
|
||||
rule.Whitelist = []string{"test@testrule.com"}
|
||||
config.MatchWhitelistOrDomain = false
|
||||
v = ValidateEmail("one@two.com", "test")
|
||||
assert.False(v, "should not allow user from another domain")
|
||||
v = ValidateEmail("test@testglobal.com", "test")
|
||||
assert.False(v, "should not allow user from global domain")
|
||||
v = ValidateEmail("test@testrule.com", "test")
|
||||
assert.True(v, "should allow user from allowed domain")
|
||||
|
||||
// Should allow only matching email address when
|
||||
// MatchWhitelistOrDomain is disabled
|
||||
config.Domains = []string{"exampleglobal.com"}
|
||||
config.Whitelist = []string{"test@testglobal.com"}
|
||||
rule = NewRule()
|
||||
config.Rules = map[string]*Rule{"test": rule}
|
||||
rule.Domains = []string{"examplerule.com"}
|
||||
rule.Whitelist = []string{"test@testrule.com"}
|
||||
config.MatchWhitelistOrDomain = false
|
||||
v = ValidateEmail("one@two.com", "test")
|
||||
assert.False(v, "should not allow user not in either")
|
||||
v = ValidateEmail("test@testglobal.com", "test")
|
||||
assert.False(v, "should not allow user in global whitelist")
|
||||
v = ValidateEmail("test@exampleglobal.com", "test")
|
||||
assert.False(v, "should not allow user from global domain")
|
||||
v = ValidateEmail("test@examplerule.com", "test")
|
||||
assert.False(v, "should not allow user from allowed domain")
|
||||
v = ValidateEmail("test@testrule.com", "test")
|
||||
assert.True(v, "should allow user in whitelist")
|
||||
|
||||
// Should allow either matching domain or email address when
|
||||
// MatchWhitelistOrDomain is enabled
|
||||
config.Domains = []string{"exampleglobal.com"}
|
||||
config.Whitelist = []string{"test@testglobal.com"}
|
||||
rule = NewRule()
|
||||
config.Rules = map[string]*Rule{"test": rule}
|
||||
rule.Domains = []string{"examplerule.com"}
|
||||
rule.Whitelist = []string{"test@testrule.com"}
|
||||
config.MatchWhitelistOrDomain = true
|
||||
v = ValidateEmail("one@two.com", "test")
|
||||
assert.False(v, "should not allow user not in either")
|
||||
v = ValidateEmail("test@testglobal.com", "test")
|
||||
assert.False(v, "should not allow user in global whitelist")
|
||||
v = ValidateEmail("test@exampleglobal.com", "test")
|
||||
assert.False(v, "should not allow user from global domain")
|
||||
v = ValidateEmail("test@examplerule.com", "test")
|
||||
assert.True(v, "should allow user from allowed domain")
|
||||
v = ValidateEmail("test@testrule.com", "test")
|
||||
assert.True(v, "should allow user in whitelist")
|
||||
}
|
||||
|
||||
func TestRedirectUri(t *testing.T) {
|
||||
assert := assert.New(t)
|
||||
|
||||
r, _ := http.NewRequest("GET", "http://example.com", nil)
|
||||
r := httptest.NewRequest("GET", "http://app.example.com/hello", nil)
|
||||
r.Header.Add("X-Forwarded-Proto", "http")
|
||||
r.Header.Add("X-Forwarded-Host", "app.example.com")
|
||||
r.Header.Add("X-Forwarded-Uri", "/hello")
|
||||
|
||||
//
|
||||
// No Auth Host
|
||||
@ -143,10 +240,8 @@ func TestRedirectUri(t *testing.T) {
|
||||
// With Auth URL + cookie domain, but from different domain
|
||||
// - will not use auth host
|
||||
//
|
||||
r, _ = http.NewRequest("GET", "http://another.com", nil)
|
||||
r = httptest.NewRequest("GET", "https://another.com/hello", nil)
|
||||
r.Header.Add("X-Forwarded-Proto", "https")
|
||||
r.Header.Add("X-Forwarded-Host", "another.com")
|
||||
r.Header.Add("X-Forwarded-Uri", "/hello")
|
||||
|
||||
config.AuthHost = "auth.example.com"
|
||||
config.CookieDomains = []CookieDomain{*NewCookieDomain("example.com")}
|
||||
@ -193,29 +288,30 @@ func TestAuthMakeCSRFCookie(t *testing.T) {
|
||||
|
||||
// No cookie domain or auth url
|
||||
c := MakeCSRFCookie(r, "12345678901234567890123456789012")
|
||||
assert.Equal("_forward_auth_csrf_123456", c.Name)
|
||||
assert.Equal("app.example.com", c.Domain)
|
||||
|
||||
// With cookie domain but no auth url
|
||||
config = &Config{
|
||||
CookieDomains: []CookieDomain{*NewCookieDomain("example.com")},
|
||||
}
|
||||
c = MakeCSRFCookie(r, "12345678901234567890123456789012")
|
||||
config.CookieDomains = []CookieDomain{*NewCookieDomain("example.com")}
|
||||
c = MakeCSRFCookie(r, "12222278901234567890123456789012")
|
||||
assert.Equal("_forward_auth_csrf_122222", c.Name)
|
||||
assert.Equal("app.example.com", c.Domain)
|
||||
|
||||
// With cookie domain and auth url
|
||||
config = &Config{
|
||||
AuthHost: "auth.example.com",
|
||||
CookieDomains: []CookieDomain{*NewCookieDomain("example.com")},
|
||||
}
|
||||
c = MakeCSRFCookie(r, "12345678901234567890123456789012")
|
||||
config.AuthHost = "auth.example.com"
|
||||
config.CookieDomains = []CookieDomain{*NewCookieDomain("example.com")}
|
||||
c = MakeCSRFCookie(r, "12333378901234567890123456789012")
|
||||
assert.Equal("_forward_auth_csrf_123333", c.Name)
|
||||
assert.Equal("example.com", c.Domain)
|
||||
}
|
||||
|
||||
func TestAuthClearCSRFCookie(t *testing.T) {
|
||||
assert := assert.New(t)
|
||||
config, _ = NewConfig([]string{})
|
||||
r, _ := http.NewRequest("GET", "http://example.com", nil)
|
||||
|
||||
c := ClearCSRFCookie(r)
|
||||
c := ClearCSRFCookie(r, &http.Cookie{Name: "someCsrfCookie"})
|
||||
assert.Equal("someCsrfCookie", c.Name)
|
||||
if c.Value != "" {
|
||||
t.Error("ClearCSRFCookie should create cookie with empty value")
|
||||
}
|
||||
@ -225,63 +321,62 @@ func TestAuthValidateCSRFCookie(t *testing.T) {
|
||||
assert := assert.New(t)
|
||||
config, _ = NewConfig([]string{})
|
||||
c := &http.Cookie{}
|
||||
|
||||
newCsrfRequest := func(state string) *http.Request {
|
||||
u := fmt.Sprintf("http://example.com?state=%s", state)
|
||||
r, _ := http.NewRequest("GET", u, nil)
|
||||
return r
|
||||
}
|
||||
state := ""
|
||||
|
||||
// Should require 32 char string
|
||||
r := newCsrfRequest("")
|
||||
state = ""
|
||||
c.Value = ""
|
||||
valid, _, _, err := ValidateCSRFCookie(r, c)
|
||||
valid, _, _, err := ValidateCSRFCookie(c, state)
|
||||
assert.False(valid)
|
||||
if assert.Error(err) {
|
||||
assert.Equal("Invalid CSRF cookie value", err.Error())
|
||||
}
|
||||
c.Value = "123456789012345678901234567890123"
|
||||
valid, _, _, err = ValidateCSRFCookie(r, c)
|
||||
valid, _, _, err = ValidateCSRFCookie(c, state)
|
||||
assert.False(valid)
|
||||
if assert.Error(err) {
|
||||
assert.Equal("Invalid CSRF cookie value", err.Error())
|
||||
}
|
||||
|
||||
// Should require valid state
|
||||
r = newCsrfRequest("12345678901234567890123456789012:")
|
||||
c.Value = "12345678901234567890123456789012"
|
||||
valid, _, _, err = ValidateCSRFCookie(r, c)
|
||||
assert.False(valid)
|
||||
if assert.Error(err) {
|
||||
assert.Equal("Invalid CSRF state value", err.Error())
|
||||
}
|
||||
|
||||
// Should require provider
|
||||
r = newCsrfRequest("12345678901234567890123456789012:99")
|
||||
state = "12345678901234567890123456789012:99"
|
||||
c.Value = "12345678901234567890123456789012"
|
||||
valid, _, _, err = ValidateCSRFCookie(r, c)
|
||||
valid, _, _, err = ValidateCSRFCookie(c, state)
|
||||
assert.False(valid)
|
||||
if assert.Error(err) {
|
||||
assert.Equal("Invalid CSRF state format", err.Error())
|
||||
}
|
||||
|
||||
// Should allow valid state
|
||||
r = newCsrfRequest("12345678901234567890123456789012:p99:url123")
|
||||
state = "12345678901234567890123456789012:p99:url123"
|
||||
c.Value = "12345678901234567890123456789012"
|
||||
valid, provider, redirect, err := ValidateCSRFCookie(r, c)
|
||||
valid, provider, redirect, err := ValidateCSRFCookie(c, state)
|
||||
assert.True(valid, "valid request should return valid")
|
||||
assert.Nil(err, "valid request should not return an error")
|
||||
assert.Equal("p99", provider, "valid request should return correct provider")
|
||||
assert.Equal("url123", redirect, "valid request should return correct redirect")
|
||||
}
|
||||
|
||||
func TestValidateState(t *testing.T) {
|
||||
assert := assert.New(t)
|
||||
|
||||
// Should require valid state
|
||||
state := "12345678901234567890123456789012:"
|
||||
err := ValidateState(state)
|
||||
if assert.Error(err) {
|
||||
assert.Equal("Invalid CSRF state value", err.Error())
|
||||
}
|
||||
// Should pass this state
|
||||
state = "12345678901234567890123456789012:p99:url123"
|
||||
err = ValidateState(state)
|
||||
assert.Nil(err, "valid request should not return an error")
|
||||
}
|
||||
|
||||
func TestMakeState(t *testing.T) {
|
||||
assert := assert.New(t)
|
||||
|
||||
r, _ := http.NewRequest("GET", "http://example.com", nil)
|
||||
r := httptest.NewRequest("GET", "http://example.com/hello", nil)
|
||||
r.Header.Add("X-Forwarded-Proto", "http")
|
||||
r.Header.Add("X-Forwarded-Host", "example.com")
|
||||
r.Header.Add("X-Forwarded-Uri", "/hello")
|
||||
|
||||
// Test with google
|
||||
p := provider.Google{}
|
||||
@ -292,6 +387,11 @@ func TestMakeState(t *testing.T) {
|
||||
p2 := provider.OIDC{}
|
||||
state = MakeState(r, &p2, "nonce")
|
||||
assert.Equal("nonce:oidc:http://example.com/hello", state)
|
||||
|
||||
// Test with Generic OAuth
|
||||
p3 := provider.GenericOAuth{}
|
||||
state = MakeState(r, &p3, "nonce")
|
||||
assert.Equal("nonce:generic-oauth:http://example.com/hello", state)
|
||||
}
|
||||
|
||||
func TestAuthNonce(t *testing.T) {
|
||||
|
||||
@ -19,23 +19,27 @@ import (
|
||||
|
||||
var config *Config
|
||||
|
||||
// Config holds the runtime application config
|
||||
type Config struct {
|
||||
LogLevel string `long:"log-level" env:"LOG_LEVEL" default:"warn" choice:"trace" choice:"debug" choice:"info" choice:"warn" choice:"error" choice:"fatal" choice:"panic" description:"Log level"`
|
||||
LogFormat string `long:"log-format" env:"LOG_FORMAT" default:"text" choice:"text" choice:"json" choice:"pretty" description:"Log format"`
|
||||
|
||||
AuthHost string `long:"auth-host" env:"AUTH_HOST" description:"Single host to use when returning from 3rd party auth"`
|
||||
Config func(s string) error `long:"config" env:"CONFIG" description:"Path to config file" json:"-"`
|
||||
CookieDomains []CookieDomain `long:"cookie-domain" env:"COOKIE_DOMAIN" description:"Domain to set auth cookie on, can be set multiple times"`
|
||||
InsecureCookie bool `long:"insecure-cookie" env:"INSECURE_COOKIE" description:"Use insecure cookies"`
|
||||
CookieName string `long:"cookie-name" env:"COOKIE_NAME" default:"_forward_auth" description:"Cookie Name"`
|
||||
CSRFCookieName string `long:"csrf-cookie-name" env:"CSRF_COOKIE_NAME" default:"_forward_auth_csrf" description:"CSRF Cookie Name"`
|
||||
DefaultAction string `long:"default-action" env:"DEFAULT_ACTION" default:"auth" choice:"auth" choice:"allow" description:"Default action"`
|
||||
DefaultProvider string `long:"default-provider" env:"DEFAULT_PROVIDER" default:"google" choice:"google" choice:"oidc" description:"Default provider"`
|
||||
Domains CommaSeparatedList `long:"domain" env:"DOMAIN" description:"Only allow given email domains, can be set multiple times"`
|
||||
LifetimeString int `long:"lifetime" env:"LIFETIME" default:"43200" description:"Lifetime in seconds"`
|
||||
Path string `long:"url-path" env:"URL_PATH" default:"/_oauth" description:"Callback URL Path"`
|
||||
SecretString string `long:"secret" env:"SECRET" description:"Secret used for signing (required)" json:"-"`
|
||||
Whitelist CommaSeparatedList `long:"whitelist" env:"WHITELIST" description:"Only allow given email addresses, can be set multiple times"`
|
||||
AuthHost string `long:"auth-host" env:"AUTH_HOST" description:"Single host to use when returning from 3rd party auth"`
|
||||
Config func(s string) error `long:"config" env:"CONFIG" description:"Path to config file" json:"-"`
|
||||
CookieDomains []CookieDomain `long:"cookie-domain" env:"COOKIE_DOMAIN" env-delim:"," description:"Domain to set auth cookie on, can be set multiple times"`
|
||||
InsecureCookie bool `long:"insecure-cookie" env:"INSECURE_COOKIE" description:"Use insecure cookies"`
|
||||
CookieName string `long:"cookie-name" env:"COOKIE_NAME" default:"_forward_auth" description:"Cookie Name"`
|
||||
CSRFCookieName string `long:"csrf-cookie-name" env:"CSRF_COOKIE_NAME" default:"_forward_auth_csrf" description:"CSRF Cookie Name"`
|
||||
DefaultAction string `long:"default-action" env:"DEFAULT_ACTION" default:"auth" choice:"auth" choice:"allow" description:"Default action"`
|
||||
DefaultProvider string `long:"default-provider" env:"DEFAULT_PROVIDER" default:"google" choice:"google" choice:"oidc" choice:"generic-oauth" description:"Default provider"`
|
||||
Domains CommaSeparatedList `long:"domain" env:"DOMAIN" env-delim:"," description:"Only allow given email domains, can be set multiple times"`
|
||||
LifetimeString int `long:"lifetime" env:"LIFETIME" default:"43200" description:"Lifetime in seconds"`
|
||||
LogoutRedirect string `long:"logout-redirect" env:"LOGOUT_REDIRECT" description:"URL to redirect to following logout"`
|
||||
MatchWhitelistOrDomain bool `long:"match-whitelist-or-domain" env:"MATCH_WHITELIST_OR_DOMAIN" description:"Allow users that match *either* whitelist or domain (enabled by default in v3)"`
|
||||
Path string `long:"url-path" env:"URL_PATH" default:"/_oauth" description:"Callback URL Path"`
|
||||
SecretString string `long:"secret" env:"SECRET" description:"Secret used for signing (required)" json:"-"`
|
||||
Whitelist CommaSeparatedList `long:"whitelist" env:"WHITELIST" env-delim:"," description:"Only allow given email addresses, can be set multiple times"`
|
||||
Port int `long:"port" env:"PORT" default:"4181" description:"Port to listen on"`
|
||||
|
||||
Providers provider.Providers `group:"providers" namespace:"providers" env-namespace:"PROVIDERS"`
|
||||
Rules map[string]*Rule `long:"rule.<name>.<param>" description:"Rule definitions, param can be: \"action\", \"rule\" or \"provider\""`
|
||||
@ -44,6 +48,9 @@ type Config struct {
|
||||
Secret []byte `json:"-"`
|
||||
Lifetime time.Duration
|
||||
|
||||
// Authorization
|
||||
RequiredRole string `long:"required-role" env:"REQUIRED_ROLE" description:"Required role to verify authorization"`
|
||||
|
||||
// Legacy
|
||||
CookieDomainsLegacy CookieDomains `long:"cookie-domains" env:"COOKIE_DOMAINS" description:"DEPRECATED - Use \"cookie-domain\""`
|
||||
CookieSecretLegacy string `long:"cookie-secret" env:"COOKIE_SECRET" description:"DEPRECATED - Use \"secret\"" json:"-"`
|
||||
@ -53,6 +60,7 @@ type Config struct {
|
||||
PromptLegacy string `long:"prompt" env:"PROMPT" description:"DEPRECATED - Use \"providers.google.prompt\""`
|
||||
}
|
||||
|
||||
// NewGlobalConfig creates a new global config, parsed from command arguments
|
||||
func NewGlobalConfig() *Config {
|
||||
var err error
|
||||
config, err = NewConfig(os.Args[1:])
|
||||
@ -66,6 +74,7 @@ func NewGlobalConfig() *Config {
|
||||
|
||||
// TODO: move config parsing into new func "NewParsedConfig"
|
||||
|
||||
// NewConfig parses and validates provided configuration into a config object
|
||||
func NewConfig(args []string) (*Config, error) {
|
||||
c := &Config{
|
||||
Rules: map[string]*Rule{},
|
||||
@ -205,6 +214,14 @@ func (c *Config) parseUnknownFlag(option string, arg flags.SplitArgument, args [
|
||||
rule.Rule = val
|
||||
case "provider":
|
||||
rule.Provider = val
|
||||
case "whitelist":
|
||||
list := CommaSeparatedList{}
|
||||
list.UnmarshalFlag(val)
|
||||
rule.Whitelist = list
|
||||
case "domains":
|
||||
list := CommaSeparatedList{}
|
||||
list.UnmarshalFlag(val)
|
||||
rule.Domains = list
|
||||
default:
|
||||
return args, fmt.Errorf("invalid route param: %v", option)
|
||||
}
|
||||
@ -236,6 +253,7 @@ func convertLegacyToIni(name string) (io.Reader, error) {
|
||||
return bytes.NewReader(legacyFileFormat.ReplaceAll(b, []byte("$1=$2"))), nil
|
||||
}
|
||||
|
||||
// Validate validates a config object
|
||||
func (c *Config) Validate() {
|
||||
// Check for show stopper errors
|
||||
if len(c.Secret) == 0 {
|
||||
@ -269,6 +287,8 @@ func (c *Config) GetProvider(name string) (provider.Provider, error) {
|
||||
return &c.Providers.Google, nil
|
||||
case "oidc":
|
||||
return &c.Providers.OIDC, nil
|
||||
case "generic-oauth":
|
||||
return &c.Providers.GenericOAuth, nil
|
||||
}
|
||||
|
||||
return nil, fmt.Errorf("Unknown provider: %s", name)
|
||||
@ -309,7 +329,7 @@ func (c *Config) setupProvider(name string) error {
|
||||
}
|
||||
|
||||
// Setup
|
||||
err = p.Setup()
|
||||
err = p.Setup(log)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
@ -317,12 +337,16 @@ func (c *Config) setupProvider(name string) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
// Rule holds defined rules
|
||||
type Rule struct {
|
||||
Action string
|
||||
Rule string
|
||||
Provider string
|
||||
Action string
|
||||
Rule string
|
||||
Provider string
|
||||
Whitelist CommaSeparatedList
|
||||
Domains CommaSeparatedList
|
||||
}
|
||||
|
||||
// NewRule creates a new rule object
|
||||
func NewRule() *Rule {
|
||||
return &Rule{
|
||||
Action: "auth",
|
||||
@ -335,6 +359,7 @@ func (r *Rule) formattedRule() string {
|
||||
return strings.ReplaceAll(r.Rule, "Host(", "HostRegexp(")
|
||||
}
|
||||
|
||||
// Validate validates a rule
|
||||
func (r *Rule) Validate(c *Config) error {
|
||||
if r.Action != "auth" && r.Action != "allow" {
|
||||
return errors.New("invalid rule action, must be \"auth\" or \"allow\"")
|
||||
@ -345,13 +370,16 @@ func (r *Rule) Validate(c *Config) error {
|
||||
|
||||
// Legacy support for comma separated lists
|
||||
|
||||
// CommaSeparatedList provides legacy support for config values provided as csv
|
||||
type CommaSeparatedList []string
|
||||
|
||||
// UnmarshalFlag converts a comma separated list to an array
|
||||
func (c *CommaSeparatedList) UnmarshalFlag(value string) error {
|
||||
*c = append(*c, strings.Split(value, ",")...)
|
||||
return nil
|
||||
}
|
||||
|
||||
// MarshalFlag converts an array back to a comma separated list
|
||||
func (c *CommaSeparatedList) MarshalFlag() (string, error) {
|
||||
return strings.Join(*c, ","), nil
|
||||
}
|
||||
|
||||
@ -33,8 +33,13 @@ func TestConfigDefaults(t *testing.T) {
|
||||
assert.Equal("google", c.DefaultProvider)
|
||||
assert.Len(c.Domains, 0)
|
||||
assert.Equal(time.Second*time.Duration(43200), c.Lifetime)
|
||||
assert.Equal("", c.LogoutRedirect)
|
||||
assert.False(c.MatchWhitelistOrDomain)
|
||||
assert.Equal("/_oauth", c.Path)
|
||||
assert.Len(c.Whitelist, 0)
|
||||
assert.Equal(c.Port, 4181)
|
||||
|
||||
assert.Equal("select_account", c.Providers.Google.Prompt)
|
||||
}
|
||||
|
||||
func TestConfigParseArgs(t *testing.T) {
|
||||
@ -47,6 +52,7 @@ func TestConfigParseArgs(t *testing.T) {
|
||||
"--rule.1.rule=PathPrefix(`/one`)",
|
||||
"--rule.two.action=auth",
|
||||
"--rule.two.rule=\"Host(`two.com`) && Path(`/two`)\"",
|
||||
"--port=8000",
|
||||
})
|
||||
require.Nil(t, err)
|
||||
|
||||
@ -54,6 +60,7 @@ func TestConfigParseArgs(t *testing.T) {
|
||||
assert.Equal("cookiename", c.CookieName)
|
||||
assert.Equal("csrfcookiename", c.CSRFCookieName)
|
||||
assert.Equal("oidc", c.DefaultProvider)
|
||||
assert.Equal(8000, c.Port)
|
||||
|
||||
// Check rules
|
||||
assert.Equal(map[string]*Rule{
|
||||
@ -197,14 +204,27 @@ func TestConfigParseEnvironment(t *testing.T) {
|
||||
assert := assert.New(t)
|
||||
os.Setenv("COOKIE_NAME", "env_cookie_name")
|
||||
os.Setenv("PROVIDERS_GOOGLE_CLIENT_ID", "env_client_id")
|
||||
os.Setenv("COOKIE_DOMAIN", "test1.com,example.org")
|
||||
os.Setenv("DOMAIN", "test2.com,example.org")
|
||||
os.Setenv("WHITELIST", "test3.com,example.org")
|
||||
|
||||
c, err := NewConfig([]string{})
|
||||
assert.Nil(err)
|
||||
|
||||
assert.Equal("env_cookie_name", c.CookieName, "variable should be read from environment")
|
||||
assert.Equal("env_client_id", c.Providers.Google.ClientID, "namespace variable should be read from environment")
|
||||
assert.Equal([]CookieDomain{
|
||||
*NewCookieDomain("test1.com"),
|
||||
*NewCookieDomain("example.org"),
|
||||
}, c.CookieDomains, "array variable should be read from environment COOKIE_DOMAIN")
|
||||
assert.Equal(CommaSeparatedList{"test2.com", "example.org"}, c.Domains, "array variable should be read from environment DOMAIN")
|
||||
assert.Equal(CommaSeparatedList{"test3.com", "example.org"}, c.Whitelist, "array variable should be read from environment WHITELIST")
|
||||
|
||||
os.Unsetenv("COOKIE_NAME")
|
||||
os.Unsetenv("PROVIDERS_GOOGLE_CLIENT_ID")
|
||||
os.Unsetenv("COOKIE_DOMAIN")
|
||||
os.Unsetenv("DOMAIN")
|
||||
os.Unsetenv("WHITELIST")
|
||||
}
|
||||
|
||||
func TestConfigParseEnvironmentBackwardsCompatability(t *testing.T) {
|
||||
@ -349,6 +369,11 @@ func TestConfigGetProvider(t *testing.T) {
|
||||
assert.Nil(err)
|
||||
assert.Equal(&c.Providers.OIDC, p)
|
||||
|
||||
// Should be able to get "generic-oauth" provider
|
||||
p, err = c.GetProvider("generic-oauth")
|
||||
assert.Nil(err)
|
||||
assert.Equal(&c.Providers.GenericOAuth, p)
|
||||
|
||||
// Should catch unknown provider
|
||||
p, err = c.GetProvider("bad")
|
||||
if assert.Error(err) {
|
||||
|
||||
@ -8,6 +8,7 @@ import (
|
||||
|
||||
var log *logrus.Logger
|
||||
|
||||
// NewDefaultLogger creates a new logger based on the current configuration
|
||||
func NewDefaultLogger() *logrus.Logger {
|
||||
// Setup logger
|
||||
log = logrus.StandardLogger()
|
||||
|
||||
99
internal/provider/generic_oauth.go
Normal file
99
internal/provider/generic_oauth.go
Normal file
@ -0,0 +1,99 @@
|
||||
package provider
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"net/http"
|
||||
|
||||
"golang.org/x/oauth2"
|
||||
|
||||
"github.com/sirupsen/logrus"
|
||||
)
|
||||
|
||||
// GenericOAuth provider
|
||||
type GenericOAuth struct {
|
||||
AuthURL string `long:"auth-url" env:"AUTH_URL" description:"Auth/Login URL"`
|
||||
TokenURL string `long:"token-url" env:"TOKEN_URL" description:"Token URL"`
|
||||
UserURL string `long:"user-url" env:"USER_URL" description:"URL used to retrieve user info"`
|
||||
ClientID string `long:"client-id" env:"CLIENT_ID" description:"Client ID"`
|
||||
ClientSecret string `long:"client-secret" env:"CLIENT_SECRET" description:"Client Secret" json:"-"`
|
||||
Scopes []string `long:"scope" env:"SCOPE" env-delim:"," default:"profile" default:"email" description:"Scopes"`
|
||||
TokenStyle string `long:"token-style" env:"TOKEN_STYLE" default:"header" choice:"header" choice:"query" description:"How token is presented when querying the User URL"`
|
||||
|
||||
OAuthProvider
|
||||
}
|
||||
|
||||
// Name returns the name of the provider
|
||||
func (o *GenericOAuth) Name() string {
|
||||
return "generic-oauth"
|
||||
}
|
||||
|
||||
// Setup performs validation and setup
|
||||
func (o *GenericOAuth) Setup(log *logrus.Logger) error {
|
||||
// Check parmas
|
||||
if o.AuthURL == "" || o.TokenURL == "" || o.UserURL == "" || o.ClientID == "" || o.ClientSecret == "" {
|
||||
return errors.New("providers.generic-oauth.auth-url, providers.generic-oauth.token-url, providers.generic-oauth.user-url, providers.generic-oauth.client-id, providers.generic-oauth.client-secret must be set")
|
||||
}
|
||||
|
||||
// Create oauth2 config
|
||||
o.Config = &oauth2.Config{
|
||||
ClientID: o.ClientID,
|
||||
ClientSecret: o.ClientSecret,
|
||||
Endpoint: oauth2.Endpoint{
|
||||
AuthURL: o.AuthURL,
|
||||
TokenURL: o.TokenURL,
|
||||
},
|
||||
Scopes: o.Scopes,
|
||||
}
|
||||
|
||||
o.ctx = context.Background()
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// GetLoginURL provides the login url for the given redirect uri and state
|
||||
func (o *GenericOAuth) GetLoginURL(redirectURI, state string) string {
|
||||
return o.OAuthGetLoginURL(redirectURI, state)
|
||||
}
|
||||
|
||||
// ExchangeCode exchanges the given redirect uri and code for a token
|
||||
func (o *GenericOAuth) ExchangeCode(redirectURI, code string) (string, error) {
|
||||
token, err := o.OAuthExchangeCode(redirectURI, code)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
return token.AccessToken, nil
|
||||
}
|
||||
|
||||
// GetUser uses the given token and returns a complete provider.User object
|
||||
func (o *GenericOAuth) GetUser(token string) (User, Roles, error) {
|
||||
var user User
|
||||
var roles Roles
|
||||
|
||||
req, err := http.NewRequest("GET", o.UserURL, nil)
|
||||
if err != nil {
|
||||
return user, roles, err
|
||||
}
|
||||
|
||||
if o.TokenStyle == "header" {
|
||||
req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token))
|
||||
} else if o.TokenStyle == "query" {
|
||||
q := req.URL.Query()
|
||||
q.Add("access_token", token)
|
||||
req.URL.RawQuery = q.Encode()
|
||||
}
|
||||
|
||||
client := &http.Client{}
|
||||
res, err := client.Do(req)
|
||||
if err != nil {
|
||||
return user, roles, err
|
||||
}
|
||||
|
||||
defer res.Body.Close()
|
||||
err = json.NewDecoder(res.Body).Decode(&user)
|
||||
|
||||
return user, roles, err
|
||||
}
|
||||
140
internal/provider/generic_oauth_test.go
Normal file
140
internal/provider/generic_oauth_test.go
Normal file
@ -0,0 +1,140 @@
|
||||
package provider
|
||||
|
||||
import (
|
||||
"net/url"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"golang.org/x/oauth2"
|
||||
)
|
||||
|
||||
// Tests
|
||||
|
||||
func TestGenericOAuthName(t *testing.T) {
|
||||
p := GenericOAuth{}
|
||||
assert.Equal(t, "generic-oauth", p.Name())
|
||||
}
|
||||
|
||||
func TestGenericOAuthSetup(t *testing.T) {
|
||||
assert := assert.New(t)
|
||||
p := GenericOAuth{}
|
||||
|
||||
// Check validation
|
||||
err := p.Setup()
|
||||
if assert.Error(err) {
|
||||
assert.Equal("providers.generic-oauth.auth-url, providers.generic-oauth.token-url, providers.generic-oauth.user-url, providers.generic-oauth.client-id, providers.generic-oauth.client-secret must be set", err.Error())
|
||||
}
|
||||
|
||||
// Check setup
|
||||
p = GenericOAuth{
|
||||
AuthURL: "https://provider.com/oauth2/auth",
|
||||
TokenURL: "https://provider.com/oauth2/token",
|
||||
UserURL: "https://provider.com/oauth2/user",
|
||||
ClientID: "id",
|
||||
ClientSecret: "secret",
|
||||
}
|
||||
err = p.Setup()
|
||||
assert.Nil(err)
|
||||
}
|
||||
|
||||
func TestGenericOAuthGetLoginURL(t *testing.T) {
|
||||
assert := assert.New(t)
|
||||
p := GenericOAuth{
|
||||
AuthURL: "https://provider.com/oauth2/auth",
|
||||
TokenURL: "https://provider.com/oauth2/token",
|
||||
UserURL: "https://provider.com/oauth2/user",
|
||||
ClientID: "idtest",
|
||||
ClientSecret: "secret",
|
||||
Scopes: []string{"scopetest"},
|
||||
}
|
||||
err := p.Setup()
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
// Check url
|
||||
uri, err := url.Parse(p.GetLoginURL("http://example.com/_oauth", "state"))
|
||||
assert.Nil(err)
|
||||
assert.Equal("https", uri.Scheme)
|
||||
assert.Equal("provider.com", uri.Host)
|
||||
assert.Equal("/oauth2/auth", uri.Path)
|
||||
|
||||
// Check query string
|
||||
qs := uri.Query()
|
||||
expectedQs := url.Values{
|
||||
"client_id": []string{"idtest"},
|
||||
"redirect_uri": []string{"http://example.com/_oauth"},
|
||||
"response_type": []string{"code"},
|
||||
"scope": []string{"scopetest"},
|
||||
"state": []string{"state"},
|
||||
}
|
||||
assert.Equal(expectedQs, qs)
|
||||
}
|
||||
|
||||
func TestGenericOAuthExchangeCode(t *testing.T) {
|
||||
assert := assert.New(t)
|
||||
|
||||
// Setup server
|
||||
expected := url.Values{
|
||||
"client_id": []string{"idtest"},
|
||||
"client_secret": []string{"sectest"},
|
||||
"code": []string{"code"},
|
||||
"grant_type": []string{"authorization_code"},
|
||||
"redirect_uri": []string{"http://example.com/_oauth"},
|
||||
}
|
||||
server, serverURL := NewOAuthServer(t, map[string]string{
|
||||
"token": expected.Encode(),
|
||||
})
|
||||
defer server.Close()
|
||||
|
||||
// Setup provider
|
||||
p := GenericOAuth{
|
||||
AuthURL: "https://provider.com/oauth2/auth",
|
||||
TokenURL: serverURL.String() + "/token",
|
||||
UserURL: "https://provider.com/oauth2/user",
|
||||
ClientID: "idtest",
|
||||
ClientSecret: "sectest",
|
||||
}
|
||||
err := p.Setup()
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
// We force AuthStyleInParams to prevent the test failure when the
|
||||
// AuthStyleInHeader is attempted
|
||||
p.Config.Endpoint.AuthStyle = oauth2.AuthStyleInParams
|
||||
|
||||
token, err := p.ExchangeCode("http://example.com/_oauth", "code")
|
||||
assert.Nil(err)
|
||||
assert.Equal("123456789", token)
|
||||
}
|
||||
|
||||
func TestGenericOAuthGetUser(t *testing.T) {
|
||||
assert := assert.New(t)
|
||||
|
||||
// Setup server
|
||||
server, serverURL := NewOAuthServer(t, nil)
|
||||
defer server.Close()
|
||||
|
||||
// Setup provider
|
||||
p := GenericOAuth{
|
||||
AuthURL: "https://provider.com/oauth2/auth",
|
||||
TokenURL: "https://provider.com/oauth2/token",
|
||||
UserURL: serverURL.String() + "/userinfo",
|
||||
ClientID: "idtest",
|
||||
ClientSecret: "sectest",
|
||||
}
|
||||
err := p.Setup()
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
// We force AuthStyleInParams to prevent the test failure when the
|
||||
// AuthStyleInHeader is attempted
|
||||
p.Config.Endpoint.AuthStyle = oauth2.AuthStyleInParams
|
||||
|
||||
user, err := p.GetUser("123456789")
|
||||
assert.Nil(err)
|
||||
|
||||
assert.Equal("example@example.com", user.Email)
|
||||
}
|
||||
@ -6,6 +6,8 @@ import (
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/url"
|
||||
|
||||
"github.com/sirupsen/logrus"
|
||||
)
|
||||
|
||||
// Google provider
|
||||
@ -13,7 +15,7 @@ type Google struct {
|
||||
ClientID string `long:"client-id" env:"CLIENT_ID" description:"Client ID"`
|
||||
ClientSecret string `long:"client-secret" env:"CLIENT_SECRET" description:"Client Secret" json:"-"`
|
||||
Scope string
|
||||
Prompt string `long:"prompt" env:"PROMPT" description:"Space separated list of OpenID prompt options"`
|
||||
Prompt string `long:"prompt" env:"PROMPT" default:"select_account" description:"Space separated list of OpenID prompt options"`
|
||||
|
||||
LoginURL *url.URL
|
||||
TokenURL *url.URL
|
||||
@ -26,7 +28,7 @@ func (g *Google) Name() string {
|
||||
}
|
||||
|
||||
// Setup performs validation and setup
|
||||
func (g *Google) Setup() error {
|
||||
func (g *Google) Setup(log *logrus.Logger) error {
|
||||
if g.ClientID == "" || g.ClientSecret == "" {
|
||||
return errors.New("providers.google.client-id, providers.google.client-secret must be set")
|
||||
}
|
||||
@ -93,23 +95,24 @@ func (g *Google) ExchangeCode(redirectURI, code string) (string, error) {
|
||||
}
|
||||
|
||||
// GetUser uses the given token and returns a complete provider.User object
|
||||
func (g *Google) GetUser(token string) (User, error) {
|
||||
func (g *Google) GetUser(token string) (User, Roles, error) {
|
||||
var user User
|
||||
var roles Roles
|
||||
|
||||
client := &http.Client{}
|
||||
req, err := http.NewRequest("GET", g.UserURL.String(), nil)
|
||||
if err != nil {
|
||||
return user, err
|
||||
return user, roles, err
|
||||
}
|
||||
|
||||
req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token))
|
||||
res, err := client.Do(req)
|
||||
if err != nil {
|
||||
return user, err
|
||||
return user, roles, err
|
||||
}
|
||||
|
||||
defer res.Body.Close()
|
||||
err = json.NewDecoder(res.Body).Decode(&user)
|
||||
|
||||
return user, err
|
||||
return user, roles, err
|
||||
}
|
||||
|
||||
@ -144,8 +144,5 @@ func TestGoogleGetUser(t *testing.T) {
|
||||
user, err := p.GetUser("123456789")
|
||||
assert.Nil(err)
|
||||
|
||||
assert.Equal("1", user.ID)
|
||||
assert.Equal("example@example.com", user.Email)
|
||||
assert.True(user.Verified)
|
||||
assert.Equal("example.com", user.Hd)
|
||||
}
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user