authproxy

Documentation

Overview

Package authproxy is a reverse proxy that runs in front of applications and takes care of authentication.

This is useful for applications like Promentheus that doesn't handle authentication itself, so we can run it behind auth-proxy to restrict access.

The auth-proxy application also adds the X-WEBAUTH-USER header to each authenticated request and gives it the value of the logged in users email address, which can be used for audit logging. The application running behind auth-proxy should then use:

https://pkg.go.dev/go.skia.org/infra/go/alogin/proxylogin

When using --cria_group this application should be run using work-load identity with a service account that as read access to CRIA, such as:

skia-auth-proxy-cria-reader@skia-public.iam.gserviceaccount.com

See also:

https://chrome-infra-auth.appspot.com/auth/groups/project-skia-auth-service-access

https://grafana.com/blog/2015/12/07/grafana-authproxy-have-it-your-way/

Index

• Constants
• Variables
• func Main() error
• type App
  • func New(ctx context.Context) (*App, error)
  • func (a *App) Flagset() *flag.FlagSet
  • func (a *App) Run(ctx context.Context) error
• type AuthType
  • func ToAuthType(s string) AuthType

Constants

const (

	// WebAuthHeaderName is the name of the header sent to the application that
	// contains the users email address.
	WebAuthHeaderName = "X-WEBAUTH-USER"

	// WebAuthRoleHeaderName is the name of the header sent to the application
	// that contains the users Roles.
	WebAuthRoleHeaderName = "X-WEBAUTH-ROLES"
)

Variables

var AllValidAuthTypes = []AuthType{OAuth2, ProtoHeader, Mocked}

AllValidAuthTypes is a list of all valid AuthTypes.

Functions

func Main

func Main() error

Main constructs and runs the application. This function will only return on failure.

Types

type App

type App struct {
	// contains filtered or unexported fields
}

App is the auth-proxy application.

func New

func New(ctx context.Context) (*App, error)

New returns a new *App.

func (*App) Flagset

func (a *App) Flagset() *flag.FlagSet

Flagset constructs a flag.FlagSet for the App.

func (*App) Run

func (a *App) Run(ctx context.Context) error

Run starts the application serving, it does not return unless there is an error or the passed in context is cancelled.

type AuthType

type AuthType string

AuthType represents the types of authentication auth-proxy can handle.

const (
	// OAuth2 uses the legacy OAuth 2.0 flow.
	OAuth2 AuthType = "oauth2"

	// ProtoHeader uses an incoming HTTP header with a serialized proto.
	ProtoHeader AuthType = "protoheader"

	// Mocked uses a string provided on the command line for the user identity
	Mocked AuthType = "mocked"

	// Invalid represents an invalid authentication scheme.
	Invalid AuthType = ""
)

func ToAuthType

func ToAuthType(s string) AuthType

ToAuthType converts a string to AuthType, returning Invalid if it is not a valid type.