The highest tagged major version is v2.

proxy

package

v1.1.0 Latest Latest Go to latest Published: Oct 1, 2026 License: Apache-2.0 Imports: 3 Imported by: 0

Documentation ¶

Overview ¶

Package proxy is the Authenticator for a deployment behind an authenticating reverse proxy (oauth2-proxy, Pomerium, Authelia, an ingress with OIDC): the proxy verifies the person and forwards their identity in a header, and this adapter trusts that header.

Trusting a header is only safe when the proxy is the only way to reach the server, which is a deployment property, not a code one. The deployment guide says so in the same breath as it enables this.

Index ¶

type Authenticator
- func New(header string) *Authenticator
- func (a *Authenticator) Authenticate(r *http.Request) (auth.Principal, error)

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Authenticator ¶

type Authenticator struct {
	Header       string
	NameHeader   string
	GroupsHeader string
}

Authenticator reads the identity from Header and the groups, when the proxy forwards them, from GroupsHeader (comma-separated).

func New ¶

func New(header string) *Authenticator

New returns an Authenticator reading the subject from header, with the conventional companions X-Forwarded-Preferred-Username and X-Forwarded-Groups for the display name and the groups.

func (*Authenticator) Authenticate ¶

func (a *Authenticator) Authenticate(r *http.Request) (auth.Principal, error)

Authenticate refuses a request with no identity header: behind an authenticating proxy, a request without one did not come through the proxy.

Source Files ¶

View all Source files

proxy.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL