OpenShift Authentication Proxy
A reverse proxy that authenticates the request against OpenShift, retrieving user information & setting the configured header with the appropriate details.
Install
npm install -g openshift-auth-proxy
Usage
Usage: openshift-auth-proxy [options]
Options:
--listen-port Port to listen on [default: 3000]
--server-cert Certificate file to use to listen for TLS [default: "secret/server-cert"]
--server-key Key file to use to listen for TLS [default: "secret/server-key"]
--server-tlsopts-file File containing JSON for proxy TLS options [default: "secret/server-tls.json"]
--backend Backend to proxy requests to once authenticated
--use-backend-host-header Change the host header to the backend URL [boolean] [default: false]
--backend-ca CA certificate file for validating the backend connection TLS (if needed)
[default: "secret/backend-ca"]
--client-cert Client certificate file for mutual TLS to the backend URL (if needed)
[default: "secret/client-cert"]
--client-key Client key file for mutual TLS to the backend URL (if needed)
[default: "secret/client-key"]
--auth-mode Proxy auth mode [choices: "oauth2", "bearer", "mutual_tls", "dummy"] [default: "oauth2"]
--mutual-tls-ca CA cert file to use for validating TLS client certs under "mutual_tls" auth method
[default: "secret/mutual-ca"]
--session-secret File containing secret for encrypted session cookies under "oauth2" method
[default: "secret/session-secret"]
--session-duration Duration for encrypted session cookies [default: 3600000]
--session-active-duration Active duration for encrypted session cookies [default: 300000]
--session-ephemeral Delete cookies on browser close [boolean] [default: true]
--callback-url OAuth callback URL [default: "/auth/openshift/callback"]
--logout-redirect URL to send user to after they log out from OAuth session [default: "/"]
--oauth-id OAuth client ID
--oauth-secret File containing OAuth client secret [default: "secret/oauth-secret"]
--public-master-url Public master address for redirecting clients to
--master-url Internal master address proxy will authenticate against for oauth/bearer
[default: "https://kubernetes.default.svc.cluster.local:8443"]
--master-ca CA certificate(s) file to validate connection to the master [default: "secret/master-ca"]
--transform Transform name(s) to apply to the request/response after authentication [choices: "
user_header", "token_header", "none"] [default: "user_header"]
--user-header Header for sending user name on the proxied request [default: "X-Proxy-Remote-User"]
--trust-remote-user Use the user-header from the proxied request (if set) as the user for the backend request.
[boolean]
--debug Show extra debug information at startup and during operations [boolean]
--help Show help [boolean]
All of these parameters can be set via corresponding environment variables.