oauth2_proxy

Looks like Google's BeyondCorp: https://cloud.google.com/beyondcorp. If you are on GCP, you can already use it https://cloud.google.com/iap to protect your HTTP and TCP backend. This is not something new. The earliest open source project that I can recall is https://github.com/bitly/oauth2_proxy (albeit it might be missing the part where proxy passing identity to the backend). Pomerium is another open source project that's actively maintained. I've been using it as a reverse proxy to all my homelab websites (grafana, miniflux etc). I can now safely access all of these internal resources from outside of my home WiFi with automated SSL certificate configuration and renewal. You can theoretically protect your SSH connection via these IAP proxies, using the Chrome SSH extension and open source SSH relay implementation like https://github.com/

The open source ory ecosystem ( http://github.com/ory/ ) might have what you're looking for, but it's definitely for advanced usecases. I know a lot of people that worked with Auth0/Okta/AWS Cognito but got so frustrated by downtimes, bugs, and complexity that they moved away. But it is an option for rapid prototyping although I'd keep a "replace it" somewhere in my milestone planning. Another possibility is Keycloak which is very enterprise / java fullstack and quite complex to understand. Most advice in the comments is pretty bad though. Stuff like "API Clients need bearer tokens" is completely backwards and pushed by marketing people from companies (Auth0, Okta, ...) that misuse open protocols (OAuth2, OIDC) as a way to legitimize the closed source saas approach they took. Along the lines "if it looks complex it looks secure because mo

Imagine you have an application like GitHub Enterprise or Phabricator, something that has a web interface and SSH for git access. You might trust SSH, but do you trust the web stack to not have vulnerabilities? I don't know about you, but I don't trust running third party apps, I won't publicly expose them. Instead I put them behind authenticating proxies, like Cloudflare Access[1], Google Identity-Aware Proxy[2], Bitly oauth2_proxy[3], and Buzzfeed SSO[4]. With an authenticating proxy an attacker can't even hit the web application until authenticating, so they can't exploit a vulnerability in the web application. They will have to pop the auth proxy first, which have less surface area, and then pop the web application. Applications that combine HTTP and SSH complicate things because the typical HTTP proxy won't proxy your SSH (git) conne

I have used https://github.com/bitly/oauth2_proxy with success, and it supports a variety of providers.

Yes, this could definitely solve that. Another service which might be well suited for this specific task is: https://github.com/bitly/oauth2_proxy

For those interested by the idea but who need open source, we've been using https://github.com/bitly/oauth2_proxy for a while with great results.

Clickable links: [1] http://github.com/coreos/dex [2] https://github.com/bitly/oauth2_proxy

Just want to leave a shoutout for CoreOS's dex[1] identity provider. If you need to hook up kubernetes or (any app that speaks oauth2) with SSO and get pluggable backends, I had it working with $EMPLOYER's LDAP infrastructure in 10 minutes. It also works well with bit.ly's OSS oauth2_proxy[2]. [1] http://github.com/coreos/dex [2] https://github.com/bitly/oauth2_proxy

https://github.com/bitly/oauth2_proxy is a good one as well.

Have you seen https://github.com/bitly/oauth2_proxy?

Can anyone recommend this? https://github.com/bitly/oauth2_proxy

See also oauth2_proxy from bitly: https://github.com/bitly/oauth2_proxy