pixnyb/authentication-proxy repository overview

⁠Dockerised Authentication Proxy

This is a Dockerised authentication for use cases where basic authentication doesn't cut it. It integrates with the traefik reverse proxy as forward authentication middleware.

⁠Usage

⁠Build the Docker image

docker build -t authentication-proxy .

⁠Run the Docker container

docker run -d -p 8080:3000 \
    -e AUTH_HOST=localhost:8080 \
    -e COOKIE_SECURE=false \
    -e COOKIE_HOSTS=localhost:8080 \
    -e COOKIE_HOSTS_USE_ROOT=true \
    -e LOCAL_HTPASSWD_USERS=user:password \
    -e LOCAL_HTPASSWD_USERS_FILE=/etc/nginx/.htpasswd \
    -e LOCAL_HTPASSWD_DISPLAY_NAME=Local \
    -e OAUTH2_GITHUB_AUTH_URL=https://github.com/login/oauth/authorize \
    -e OAUTH2_GITHUB_TOKEN_URL=https://github.com/login/oauth/access_token \
    -e OAUTH2_GITHUB_USER_URL=https://api.github.com/user \
    -e OAUTH2_GITHUB_CLIENT_ID=xxx \
    -e OAUTH2_GITHUB_CLIENT_SECRET=xxx \
    -e OAUTH2_GITHUB_DOMAIN_WHITELIST=xxx \
    -e OAUTH2_GITHUB_ICON=fab fa-github

On first glance, this looks like a mess. Let's break it down:

• -d runs the container in detached mode
• -p 8080:3000 maps port 8080 on the host to port 3000 in the container
• -e AUTH_HOST=localhost:8080 is the host and port of the authentication proxy, this is used to redirect users when authentication is required.
• -e COOKIE_SECURE=false sets the secure flag on the cookie to false, this is useful when running the container locally, will default to true if not set.
• -e COOKIE_HOSTS=localhost:8080 is a list of hosts that the authentication proxy is available on, this is used to be able to set cookies on multiple domains (e.g. domain1.dev,domain2.me)
• -e COOKIE_HOSTS_USE_ROOT=true sets the cookie path on the base domain, useful when all subdomains should be authenticated.

The rest of the environment variables are used to configure the authentication methods.

⁠Environment variables

As mentioned above, there are a few environment variables that can be used to configure the authentication proxy, these are:

The proxy login form will change based on the authentication methods that are configured. The form will show a list of buttons for each configured provider, as well as a username and password field for the local provider.

Both providers configured	Only local provider configured	Only external providers configured

⁠Provider configuration

The authentication proxy supports multiple kinds of providers with support for multiple instances of each one. For all provider configuration variables the following scheme is used: <TYPE>_<IDENTIFIER>_<FIELD> where <TYPE> is the provider type, <IDENTIFIER> is the instance identifier and <FIELD> is the field name.

The following variables are supported for each provider:

⁠LOCAL

The local provider is used to authenticate users using a username and password.

Passwords should be encrypted as md5 hashes, just like in the .htpasswd file.

⁠OAUTH2

The OAuth2 provider is used to authenticate users using an OAuth2 provider.

⁠OIDC

The OIDC provider is used to authenticate users using OpenID Connect.

⁠GOOGLE

The Google provider is used to authenticate users using Google.

⁠APPLE

The Apple provider is used to authenticate users using Apple ID.