Using OAuth Proxy
Last updated
Was this helpful?
Last updated
Was this helpful?
is:
A reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accounts by email, domain or group.
You can deploy OAuth2 Proxy to secure your services in Release. This is handy if a service doesn't have its own authentication mechanism.
We'll use the Release from the awesome-release library to demonstrate.
After import, Release creates an Application Template containing the following:
We can add oauth2-proxy to this as a service alongside our web service.
Replace the current hostname that points directly to the web service, and have it point to oauth2-proxy instead. Find the following:
And change it to the following:
The Application Template should now look like this:
Next, we'll configure OAuth by setting some environment variables.
In this example, we'll use Google as our OAuth2 provider but configuring any other service will be nearly the same.
Generate YOUR_COOKIE_SECRET by running python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(16)).decode())'.
When you set up your Google OAuth2 credentials, you will be asked for the authorized JavaScript origin and redirect URI.
As each Release environment generates its own domain, you can handle this using environment handles or by updating environment variables.
You can predefine a handful of environment names like dev1, dev2, dev3, and so on, or jupiter, mars, venus. Then you can predefine your OAuth2 credentials for each of these predefined environments and your domains will match up correctly.
If you don't want to use environment handles, you can deploy a new environment in Release as normal and once that new environment is created, you can plug the generated domain into your OAuth2 settings, update the environment variables for that specific environment, and redeploy it.
The environment will restart with the correct OAuth2 settings for that temporary domain. The settings will work until that environment disappears.
Once you have configured OAuth2, you can access the generated URL (in our case, https://web-jupiter-mydomain.com/) and you will be automatically redirected to the Google Login screen.
Log in with an email that belongs to one of the domains that you configured your OAuth2 credentials for, and you should be redirected to your service.
Find all the available settings in the .
Follow to get YOUR_CLIENT_ID and YOUR_CLIENT_SECRET.
Release is probably the best bet for truly ephemeral environments with OAuth2 support.
Take a look at all the available for OAuth2.