Documentation
¶
Overview ¶
Package proxy is the Authenticator for a deployment behind an authenticating reverse proxy (oauth2-proxy, Pomerium, Authelia, an ingress with OIDC): the proxy verifies the person and forwards their identity in a header, and this adapter trusts that header.
Trusting a header is only safe when the proxy is the only way to reach the server, which is a deployment property, not a code one. The deployment guide says so in the same breath as it enables this.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Authenticator ¶
type Authenticator struct {
Header string
NameHeader string
EmailHeader string
GroupsHeader string
}
Authenticator reads the identity from Header and, when the proxy forwards them, the display name, the email address and the groups (comma-separated) from their own headers.
func New ¶
func New(header string) *Authenticator
New returns an Authenticator reading the subject from header, with the conventional companions X-Forwarded-Preferred-Username, X-Forwarded-Email and X-Forwarded-Groups, the headers oauth2-proxy sets, for the display name, the address and the groups.
func (*Authenticator) Authenticate ¶
Authenticate refuses a request with no identity header: behind an authenticating proxy, a request without one did not come through the proxy.
Source Files