OAuth proxy 安装简记

文档 :https://oauth2-proxy.github.io/oauth2-proxy/docs/

下载 :https://github.com/oauth2-proxy/oauth2-proxy/releases

GitHub :https://github.com/oauth2-proxy/oauth2-proxy

安装步骤

  1. 下载 oauth2-proxy
  2. 创建目录,如 /opt/oauth2_proxy ,将下载的 oauth2-proxy 放在此目录中
  3. 创建配置配置文件 oauth2_proxy.cfg
upstreams = ["http://127.0.0.1:8088/" ]

# Email Domains to allow authentication for (this authorizes any email on this domain).
# To authorize any email addresses use "*"

email_domains = ["*"]

# The OAuth Client ID, Secret
client_id = "*******"
client_secret = "*******"

# Cookie Settings
cookie_secret = "aa662707d1d142028e070ea091785136"
# cookie_domain = "route.doopp.com"
# cookie_expire = "168h"
# cookie_refresh = ""
# cookie_secure = true
# cookie_httponly = true

4. 创建启动配置 /etc/systemd/system/oauth_proxy.service

# Systemd service file for oauth2_proxy daemon 

[Unit]
Description=oauth2_proxy daemon service 
After=syslog.target network.target

[Service]
# www-data group and user need to be created before using these lines User=www-data
Group=www-data

ExecStart=/opt/oauth2_proxy/oauth2_proxy -config=/opt/oauth2_proxy/oauth2_proxy.cfg 
ExecReload=/bin/kill -HUP $MAINPID

KillMode=process
Restart=always

[Install]
WantedBy=multi-user.target

5. 加入到启动服务

sudo systemctl daemon-reload
sudo systemctl enable oauth_proxy.service 
sudo systemctl start oauth_proxy.service

6. 替换原来的 http 服务端口 为其他端口,如 127.0.0.1:8088 , 原来的 https 可以不用了

7. 增加 Nginx 配置

server {
  listen 127.0.0.1:8088;
  server_name route.doopp.com;
  ...
}

server {
  listen 443 ssl;
  server_name route.doopp.com;
  ssl_certificate crt/doopp_com.pem;
  ssl_certificate_key crt/doopp_com.key;
  ssl_session_timeout 5m;
  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;

  location /oauth2 {
    proxy_pass       http://127.0.0.1:4180;
    proxy_set_header Host                    $host;
    proxy_set_header X-Real-IP               $remote_addr;
    proxy_set_header X-Scheme                $scheme;
    proxy_set_header X-Auth-Request-Redirect $request_uri;
    # or, if you are handling multiple domains:
    # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
  }

  location = /oauth2/auth {
    proxy_pass       http://127.0.0.1:4180;
    proxy_set_header Host             $host;
    proxy_set_header X-Real-IP        $remote_addr;
    proxy_set_header X-Scheme         $scheme;
    # nginx auth_request includes headers but not body
    proxy_set_header Content-Length   "";
    proxy_pass_request_body           off;
  }

  location / {
    auth_request /oauth2/auth;
    error_page 401 = /oauth2/sign_in;

    # pass information via X-User and X-Email headers to backend,
    # requires running with --set-xauthrequest flag
    auth_request_set $user   $upstream_http_x_auth_request_user;
    auth_request_set $email  $upstream_http_x_auth_request_email;
    proxy_set_header X-User  $user;
    proxy_set_header X-Email $email;

    # if you enabled --pass-access-token, this will pass the token to the backend
    auth_request_set $token  $upstream_http_x_auth_request_access_token;
    proxy_set_header X-Access-Token $token;

    # if you enabled --cookie-refresh, this is needed for it to work with auth_request
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;

    # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
    # limit and so the OAuth2 Proxy splits these into multiple parts.
    # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
    # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
    auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;

    # Extract the Cookie attributes from the first Set-Cookie header and append them
    # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
    if ($auth_cookie ~* "(; .*)") {
        set $auth_cookie_name_0 $auth_cookie;
        set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
    }

    # Send both Set-Cookie headers now if there was a second part
    if ($auth_cookie_name_upstream_1) {
        add_header Set-Cookie $auth_cookie_name_0;
        add_header Set-Cookie $auth_cookie_name_1;
    }

    proxy_pass http://127.0.0.1:8088/;
    # or "root /path/to/site;" or "fastcgi_pass ..." etc
  }
}

7 . 重启 nginx 服务

service nginx stop
service nginx start