The OAuth proxification guide for frontend developers with Microsoft EntraID

# Azure EntraID
export OAUTH2_PROXY_PROVIDER=oidc # Azure is also supported for simpler configuration
export OAUTH2_PROXY_CLIENT_ID=<YOUR_TENANT_CLIENT_ID>
export OAUTH2_PROXY_CLIENT_SECRET=<YOUR_TENANT_SECRET>
export OAUTH2_PROXY_AZURE_TENANT=<YOUR_TENANT_ID>
export OAUTH2_PROXY_REDIRECT_URL=XXXXX
export OAUTH2_PROXY_OIDC_ISSUER_URL=https://sts.windows.net/<YOUR_TENANT_ID>/
export OAUTH2_PROXY_SCOPE=openid email profile # Scopes define the level of access you want to grant to the application it relies on EntraID application configuration
#export OAUTH2_PROXY_INSECURE_OIDC_SKIP_ISSUER_VERIFICATION=true
#export OAUTH2_PROXY_SKIP_CLAIMS_FROM_PROFILE_URL=true
#export OAUTH2_PROXY_USER_ID_CLAIM=name
#export OAUTH2_PROXY_OIDC_GROUPS_CLAIM=groups
#export OAUTH2_PROXY_OIDC_EMAIL_CLAIM=email
#export OAUTH2_PROXY_OIDC_AUDIENCE_CLAIM=name
#export OAUTH2_PROXY_PROFILE_URL=https://graph.microsoft.com/v2.0/me
#export OAUTH2_PROXY_LOGIN_URL=https://login.microsoftonline.com/<YOUR_TENANT_ID>/oauth2/v2.0/authorize
#export OAUTH2_PROXY_REDEEM_URL=https://login.microsoftonline.com/<YOUR_TENANT_ID>/v2.0/token


# HTTP / HTTPS
export OAUTH2_PROXY_HTTP_ADDRESS=http://0.0.0.0:4180

# We don't need HTTPS because we use https is managed upstream of the auth Nginx ( by a load balancer / a reverse proxy )
#export OAUTH2_PROXY_HTTPS_ADDRESS=https://0.0.0.0:443
#export OAUTH2_PROXY_TLS_CERT_FILE=/oauth2/cert.pem 
#export OAUTH2_PROXY_TLS_KEY_FILE=/oauth2/cert.key
#export OAUTH2_PROXY_SSL_INSECURE_SKIP_VERIFY=true
#export OAUTH2_PROXY_FORCE_HTTPS=true


# HEADERS & COOKIES
export OAUTH2_PROXY_COOKIE_EXPIRE=24h
export OAUTH2_PROXY_COOKIE_SECURE=true  
export OAUTH2_PROXY_COOKIE_SECRET=XXXXXXXX
export OAUTH2_PROXY_EMAIL_DOMAINS=*
#export OAUTH2_PROXY_COOKIE_NAME=nexusAuth
#export OAUTH2_PROXY_COOKIE_SAMESITE=lax
#export OAUTH2_PROXY_COOKIE_CSRF_PER_REQUEST=true
#export OAUTH2_PROXY_COOKIE_CSRF_EXPIRE=5m
#export OAUTH2_PROXY_COOKIE_DOMAINS=.localhost
#export OAUTH2_PROXY_COOKIE_HTTPONLY=true

export OAUTH2_PROXY_REVERSE_PROXY=true
# If you have web sockets enabled in your application, you can enable the proxy to handle them as well
export OAUTH2_PROXY_PROXY_WEBSOCKETS=true
# if you want to pass the user's email address to the upstream application, you can enable this option
export OAUTH2_PROXY_SET_XAUTHREQUEST=true
#export OAUTH2_PROXY_PASS_USER_HEADERS=true
#export OAUTH2_PROXY_PREFER_EMAIL_TO_USER=true
#export OAUTH2_PROXY_SKIP_JWT_BEARER_TOKENS=true
#export OAUTH2_PROXY_PASS_ACCESS_TOKEN=true

# PASS AZURE AD BEARER TOKEN ( usefull to debug or to use the graph API on your applications)
# NB : YOU NGINX CONFIGURATION MUST BE SET TO PASS THE AUTHORIZATION HEADER (add_header_proxy and for debug add_header)
export OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER=true
export OAUTH2_PROXY_SET_AUTHORIZATION_HEADER=true

export OAUTH2_PROXY_PASS_BASIC_AUTH=false
#export OAUTH2_PROXY_PASS_HOST_HEADER=true
#export OAUTH2_PROXY_SESSION_STORE_TYPE=cookie
#export OAUTH2_PROXY_WHITELIST_DOMAINS=.localhost

export OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true
export OAUTH2_PROXY_SHOW_DEBUG_ON_ERROR=true
export OAUTH2_PROXY_AUTH_LOGGING=true
export OAUTH2_PROXY_REQUEST_LOGGING=true
export OAUTH2_PROXY_STANDARD_LOGGING=true   
#export OAUTH2_PROXY_APPROVAL_PROMPT=consent
#export OAUTH2_PROXY_UPSTREAMS=http://localhost:8081

<PATH_OF_YOUR_BINARY>/oauth2-proxy

map $http_upgrade $connection_upgrade {
        default upgrade;
        ''	close;
    }

server {
# We don't need HTTPS because we use https is managed upstream of the auth Nginx ( by a load balancer / a reverse proxy )
#    listen 443 default ssl;
#    server_name localhost;
#    ssl_certificate /etc/nginx/cert.pem;
#    ssl_certificate_key /etc/nginx/cert.key;
     listen	  80 default_server;
     server_name localhost
     listen	  [::]:80 default_server;
     server_name  _;

     add_header Strict-Transport-Security max-age=2592000;

     # OAuth proxy cookie can require to increase the buffer size
     proxy_buffering on;
     proxy_buffer_size 8k;

  location /oauth2/ {
    proxy_pass       http://IP_OF_YOUR_OAUTH_PROXY:4180;
    proxy_set_header Host                    $host;
    proxy_set_header X-Real-IP               $remote_addr;
    proxy_set_header X-Auth-Request-Redirect $request_uri;
  }

  location /oauth2/auth {
    proxy_pass       http://IP_OF_YOUR_OAUTH_PROXY:4180;
    proxy_set_header Host             $host;
    proxy_set_header X-Real-IP        $remote_addr;
    proxy_set_header X-Forwarded-Uri  $request_uri;
    proxy_set_header Content-Length   "";
    proxy_pass_request_body           off;
  }

 location /securedapps {
    auth_request /oauth2/auth;
    error_page 401 = /oauth2/sign_in;

    # pass information via X-User and X-Email headers to backend,
    # requires running with --set-xauthrequest flag

    auth_request_set $email	 $upstream_http_x_auth_request_email;
    #add_header X-SSO-MAIL $email;
    proxy_set_header X-SSO-MAIL $email;
    # return 200 $email;

    #auth_request_set $user       $upstream_http_x_auth_request_user;
    #auth_request_set $user       $upstream_http_x_auth_request_preferred_username;
    #proxy_set_header X-User $user;

    auth_request_set $authorization_id  $upstream_http_authorization;
    # Passing the EntraID token clear on the client. FOR DEBUG ONLY
    # add_header X-SSO-AUTHORIZATION-ID $authorization_id;
    # proxy_set_header X-SSO-AUTHORIZATION-ID $authorization_id;

    # if you enabled --pass-access-token, this will pass the token to the backend
    #auth_request_set $token  $upstream_http_x_auth_request_access_token;
    #proxy_set_header X-ACCESS-TOKEN $token;

# This is how to secure your application endpoints, the oauth proxy will call the identity provider to authenticate the user and redirect to the second Nginx server
    proxy_pass http://IP_OF_THE_SECOND_NGINX_SERVER:PORT;

  }
}

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-available/*.conf;

    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }

    server {
        listen       80 default_server;
        listen       [::]:80 default_server;
        server_name  _;
        root         /path/to/your/root/static/public_html;


       # reverse proxy to your secured application
        location /securedapp1 {
            proxy_pass http://IP_OF_YOUR_SECURED_APPLICATION1:8080;
        }

       # static content served
        location /securedapp2 {
            alias /path/to/your/secured/application2/public_html;

        }
    }
}

services:
  ###########################
  #     Front  with Auth    #
  ###########################
  authfront:
    image: nginx
    depends_on:
        - oauth2
        - securedappsfront
    volumes:
      - ./nginx-oauth2.conf:/etc/nginx/conf.d/oauth2.conf
    ports:
      - "80:80"
      - "443:443"
   
  #########################
  #     AzureAD OAuth     #
  #########################
  oauth2:
    build: 
      context: .
      dockerfile: oauth2.Dockerfile
    environment:
      - OAUTH2_PROXY_PROVIDER=oidc
      - OAUTH2_PROXY_CLIENT_ID=<YOUR_CLIENT_ID>
      - OAUTH2_PROXY_CLIENT_SECRET=<YOUR_CLIENT_SECRET>
      - OAUTH2_PROXY_AZURE_TENANT=<YOUR_TENANT_ID>
      - OAUTH2_PROXY_OIDC_ISSUER_URL=https://login.microsoftonline.com/<YOUR_TENANT_ID>/v2.0
      - OAUTH2_PROXY_LOGIN_URL=https://login.microsoftonline.com/<YOUR_TENANT_ID>/oauth2/authorize"
      - OAUTH2_PROXY_REDEEM_URL=https://login.microsoftonline.com/<YOUR_TENANT_ID>/oauth2/token
      - OAUTH2_PROXY_REDIRECT_URL=https://<YOUR_DOMAIN>/oauth2/callback
      - OAUTH2_PROXY_PROFILE_URL=https://graph.microsoft.com/v1.0/me
      - OAUTH2_PROXY_SCOPE=openid email profile
      - OAUTH2_PROXY_HTTP_ADDRESS=http://0.0.0.0:4180
      - OAUTH2_PROXY_COOKIE_SECURE=true  
      - OAUTH2_PROXY_COOKIE_SECRET=<YOUR_COOKIE_SECRET>
      - OAUTH2_PROXY_PROXY_WEBSOCKETS=true
      - OAUTH2_PROXY_EMAIL_DOMAINS=*
      - OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true
      - OAUTH2_PROXY_COOKIE_EXPIRE=24h
      - OAUTH2_PROXY_PASS_USER_HEADERS=true
      - OAUTH2_PROXY_PASS_BASIC_AUTH=true
      - OAUTH2_PROXY_REVERSE_PROXY=true
      - OAUTH2_PROXY_SET_XAUTHREQUEST=true
      - OAUTH2_PROXY_SHOW_DEBUG_ON_ERROR=true
      - OAUTH2_PROXY_AUTH_LOGGING=true
      - OAUTH2_PROXY_REQUEST_LOGGING=true
    #volumes:
    #  - ./oauth2-proxy.cfg:/etc/oauth2-proxy.cfg
    # ⚠️ Be carefull in production by using rootless configuration
    command: /bin/sh -c "/root/go/bin/oauth2-proxy" #--config=/etc/oauth2-proxy.cfg"
    depends_on:
      - securedfront

  ###########################
  #     securedappsfront    #
  ###########################

  securedfront:
      image: nginx 
      volumes:
        - ./nginx.conf:/etc/nginx/nginx.conf

      depends_on:
      - securedapp1
      - api

  ##################
  #      app 1     #
  ##################
  securedapp2:
    build: 
      context: .
      dockerfile: myimage.Dockerfile
    depends_on:
      - api

  ###############
  #     API     #
  ###############
  
  api:
    image: openjdk:11.0.16-jdk
    depends_on:
      - postgres 

  ###############
  #     BDD     #
  ###############

  postgres:
    image: docker.io/postgres:13
    environment:
      POSTGRES_USER: "${POSTGRES_USER}"
      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD}"
      POSTGRES_DB: "${POSTGRES_DB}"
      PGDATA: "${PGDATA}"
    restart: always
    volumes:
      - ./postgres:/data/postgres

FROM redhat/ubi8

RUN dnf module -y install go-toolset && dnf -y clean all  && rm -rf /var/cache
RUN go install github.com/oauth2-proxy/oauth2-proxy/v7@latest