Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add OIDC Auth via OAuth2-proxy #14

Merged
merged 9 commits into from
Feb 10, 2025
Merged

Add OIDC Auth via OAuth2-proxy #14

merged 9 commits into from
Feb 10, 2025

Conversation

ivan-c
Copy link
Member

@ivan-c ivan-c commented Nov 20, 2024

  • Remove allowlist restrictions to UW IPs only
  • Reuse Leaf SAML2 configuration for OIDC
  • Use oauth2-proxy (with OIDC) to authenticate users
    • pass email via headers to Leaf API
    • pass roles as via headers as static list (leaf_users;leaf_phi;leaf_admin)

NB: Do not merge until new Leaf Keycloak realm finalized and OIDC client configured

See Projects

@ivan-c ivan-c changed the title Add OIDC Auth Add OIDC Auth via OAuth2-proxy Nov 20, 2024
@ivan-c ivan-c force-pushed the feature/auth-proxy branch from c02e5cc to f8ff8f0 Compare November 25, 2024 21:02
@ivan-c ivan-c marked this pull request as ready for review November 25, 2024 21:06
@ivan-c ivan-c requested review from rpkyle and KitRedgrave November 25, 2024 21:19
Copy link

@KitRedgrave KitRedgrave left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks alright to me :)

Copy link
Contributor

@rpkyle rpkyle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't see anything that looks out of place on my end, but I defer to @KitRedgrave here, they are much more knowledgeable this sort of thing than I am.

dev/default.env Show resolved Hide resolved
@ivan-c ivan-c force-pushed the feature/auth-proxy branch from 5f054fc to 4f1c3ff Compare February 5, 2025 21:41
ivan-c and others added 8 commits February 5, 2025 18:34
* Add oauth2-proxy custom templating dir stub

* update login template html

* fix footer styling

* keep footer at bottom of page

---------

Co-authored-by: Amy Chen <[email protected]>
Co-authored-by: Amy Chen <[email protected]>
* Add logout URL based on LEAF_DOMAIN

* Make every site use env var for logout URL
@ivan-c ivan-c force-pushed the feature/auth-proxy branch from eea07c4 to 32d48a2 Compare February 6, 2025 02:35
@ivan-c ivan-c merged commit 5420b8a into main Feb 10, 2025
@ivan-c ivan-c deleted the feature/auth-proxy branch February 10, 2025 19:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants