Project Bastion: Barbican
A secure proxy to allow authorised access to internal services without exposing them directly.
Routes
DNS Routing
Specifying the scheme and hostname/port, barbican will simply resolve these itself to relay the service. This will include localhost and private network addresses like the AWS metadata endpoint, so it is important to be aware when deciding where to host barbican.
/proxy/<scheme>/<host_and_port>/<path> ==> <scheme>://<host_and_port>/<path>
e.g.
/proxy/https/www.bbc.co.uk/news ==> https://www.bbc.co.uk/news
/proxy/http/some_api.internal:8080/ ==> http://some_api.internal:8080/
Authentication
If not specified, the default auth provider is Basic Authentication
Basic Access Authentication
As the default auth provider, if no configuration is provided Basic Authentication will generate a username and password logging them to stdout.
Authentication:
Provider: Basic
---
Using Basic Auth - Username: "LlSO4iBLPlp0vTZk7yx1QL9830I=" Password: "6gEuyvgzLGum6jVnymPKPY+Y1pY="
or
Authentication:
Provider: Basic
Username: john.smith
Password: Password123
Azure AD
Authentication:
Provider: AzureAd
Instance: https://login.microsoftonline.com/
Domain: contoso.onmicrosoft.com # Enter the domain of your tenant
TenantId: 'da41245a5-11b3-996c-00a8-4d99re19f292' # Enter the Tenant Id (Obtained from the Azure portal. Select 'Endpoints' from the 'App registrations' blade and use the GUID in any of the URLs)
ClientId: ba74781c2-53c2-442a-97c2-3d60re42f403 # Enter the Client Id (Application ID obtained from the Azure portal)
CallbackPath: /signin-oidc
Running in Docker
Build a configuration file:
Authentication:
Provider: Basic
Username: john.smith
Password: Password123
Map the config file in to the container to inject the configuration, and run:
docker run --name barbican -v `pwd`/config.yml:/config.yml uatec/barbican