A minimal yet very fast and powerful implementation of oauth-proxy in rust+axum, configurable with nginx
Currently only github oauth is supported
git clone https://github.com/CoolElectronics/oauth-proxy-rs-nginx
cd oauth-proxy-rs-nginx
cargo install --path .For use with nginx, you will need to either own the enterprise edition or compile nginx with nginx-jwt-module
Here is how to do that:
git clone https://github.com/max-lt/nginx-jwt-module
git clone https://github.com/nginx/nginx
cd nginx
./auto/configure --add-dynamic-module=../nginx-jwt-module
make
make install
# make sure /usr/local/nginx/ is in your PATH- You will need to generate a secure JWT secret key.
./keygen.shwill do this for you.
To start the auth server, run oauth-proxy-rs-nginx -k /path/to/oauth-proxy-rs-nginx/keys/secret.pem -p 3000 --host 0.0.0.0 --client-id your_github_oauth_client_id --client-secret your_github_oauth_client_secret --authorized-users authorized_user_ids --authorized-orgs authorized_org_ids --authorized-domain yourserver.com
Usage: oauth-proxy-rs-nginx [options]
Options:
--authorized-users
comma separated list of github user IDs (find uid at
https://api.github.com/users/your_username)
--authorized-orgs
comma separated list of github organization IDs (find
uid at https://api.github.com/orgs/your_organization)
--client-secret
oauth client secret
--client-id oauth client ID
-k, --key set path to JWT secret
-p, --port 8080 port to bind to
--host 0.0.0.0 host to bind to
-h, --help print this help menu
To start proxying requests, edit your nginx config to check against the auth-server. Here is an example:
load_module /usr/local/nginx/modules/ngx_http_auth_jwt_module.so;
http {
server {
server_name auth.yourserver.com;
location / {
proxy_pass http://127.0.0.1:3000; # same port as you specified in the CLI
}
listen 80 ssl;
}
server {
server_name restricted_endpoint.yourserver.com;
auth_jwt_key /path/to/oauth-proxy-rs-nginx/keys/secret.pem file;
auth_jwt off;
error_page 401 /oauth-proxy-rs-nginx-auth-failure;
location / {
auth_jwt $cookie_OAuth_Proxy_rs_token;
proxy_pass http://127.0.0.1:7999; # port that you want to proxy
}
location = /oauth-proxy-rs-nginx-auth-failure {
return 302 http://auth.yourserver.com/?callback=http://restricted_endpoint.yourserver.com/oauth-proxy-rs-nginx-set;
}
location = /oauth-proxy-rs-nginx-set {
add_header Set-Cookie "OAuth_Proxy_rs_token=$arg_token;Path=/;Max-Age=86400";
return 302 http://restricted_endpoint.yourserver.com;
}
listen 80 ssl;
}
}