OAuth2 Proxy
Identity provideroauth2-proxy
Reverse proxy that authenticates requests against an upstream provider and validates the account.
- Provider
- default
- Category
- Security
- Official docs
- https://oauth2-proxy.github.io/oauth2-proxy/
| property | type | values | required | kind default | this component |
|---|---|---|---|---|---|
| accountRule | enum | email | domain | group | no | — | inherited |
| authorizationModel | enum | none | rbac | abac | rebac | no | rbac | inherited |
| centralised | boolean | — | no | true | ▸ false |
| managed | boolean | — | no | true | ▸ false |
| mfa | boolean | — | no | false | ▸ false |
| mode | enum | reverse-proxy | auth-request | no | reverse-proxy | inherited |
| protocol | enum | oidc | saml | oauth2 | iam | custom | no | oidc | ▸ oauth2 |
| sessionStore | enum | cookie | redis | no | cookie | inherited |
Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.
No rule reads this kind yet. That is a gap, not a guarantee.
nodes:
- { id: "oauth2-proxy", component: "oauth2-proxy" }Resource Access Managementalibaba-ramAmazon Cognitoaws-cognitoAmazon Cognito identity poolaws-cognito-identity-poolAWS Directory Serviceaws-directory-serviceAWS IAMaws-iamAWS IAM Identity Centeraws-iam-identity-centerAWS IAM Roles Anywhereaws-iam-roles-anywhereAWS Directory Service Simple ADaws-simple-adMicrosoft Azure Attestationazure-attestationMicrosoft Entra Domain Servicesazure-entra-domain-servicesMicrosoft Entra External IDazure-entra-external-idMicrosoft Entra IDazure-entra-idMicrosoft Entra Verified IDazure-entra-verified-idAzure IoT Hub Device Provisioning Serviceazure-iot-dpsManaged identities for Azure resourcesazure-managed-identityCloudflare One identity providercloudflare-one-identity-providerActive Directory Domain Servicesactive-directoryAthenzathenzAuth0auth0AutheliaautheliaauthentikauthentikClerkclerkDexdexFreeIPAfreeipaGeneric identity provideridentity-providerKeycloakkeycloakOktaoktaOpenFGAopenfgaOpenLDAPopenldapOryoryPing Identity Platformping-identitySpiceDBspicedbSPIREspireStytchstytchWorkOSworkosZitadelzitadelCloud Identitygoogle-cloud-identityFirebase Authenticationgoogle-firebase-authGoogle Identity Platformgoogle-identity-platformManaged Service for Microsoft Active Directorygoogle-managed-microsoft-ad
and 7 more → Identity provider page# yaml-language-server: $schema=../../schema/component.schema.json # OAuth2 Proxy: "a reverse proxy and static file server that provides authentication using Providers # (Google, GitHub, and others) to validate accounts by email, domain or group". It sits in front of one # upstream and delegates the login to that provider rather than holding a user directory itself; # sessions are carried in a cookie store by default ("Welcome | OAuth2 Proxy"). schemaVersion: "1" type: "component" id: "oauth2-proxy" kind: "identity-provider" provider: "default" docs: "https://oauth2-proxy.github.io/oauth2-proxy/" defaults: managed: false protocol: "oauth2" centralised: false mfa: false properties: mode: type: "enum" values: ["reverse-proxy", "auth-request"] default: "reverse-proxy" sessionStore: type: "enum" values: ["cookie", "redis"] default: "cookie" accountRule: type: "enum" values: ["email", "domain", "group"]