{"id":20238684,"url":"https://github.com/projectcontour/contour-authserver","last_synced_at":"2025-04-10T19:35:34.812Z","repository":{"id":38683090,"uuid":"277450529","full_name":"projectcontour/contour-authserver","owner":"projectcontour","description":"An Envoy-compatible authorization server.","archived":false,"fork":false,"pushed_at":"2025-04-09T17:54:20.000Z","size":359,"stargazers_count":47,"open_issues_count":11,"forks_count":40,"subscribers_count":9,"default_branch":"main","last_synced_at":"2025-04-09T18:52:28.493Z","etag":null,"topics":["authorization-backends","contour","envoy"],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/projectcontour.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-07-06T05:28:37.000Z","updated_at":"2025-04-09T17:54:17.000Z","dependencies_parsed_at":"2022-07-30T06:47:58.358Z","dependency_job_id":"76816192-5203-4889-b542-062eb9521a0f","html_url":"https://github.com/projectcontour/contour-authserver","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/projectcontour%2Fcontour-authserver","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/projectcontour%2Fcontour-authserver/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/projectcontour%2Fcontour-authserver/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/projectcontour%2Fcontour-authserver/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/projectcontour","download_url":"https://codeload.github.com/projectcontour/contour-authserver/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248281423,"owners_count":21077423,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authorization-backends","contour","envoy"],"created_at":"2024-11-14T08:35:21.459Z","updated_at":"2025-04-10T19:35:34.792Z","avatar_url":"https://github.com/projectcontour.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"# contour-authserver\n\n`contour-authserver` implements the Envoy [external authorization][4]\nGRPC protocol (both v2 and v3). It can be used for testing Envoy\nexternal authorization. `contour-authserver` has two authorization\nbackends that are selected by subcommands.\n\n# testserver\n\nUsage:\n\n```\nRun a testing authentication server\n\nUsage:\n  contour-authserver testserver [OPTIONS]\n\nFlags:\n      --address string         The address the authentication endpoint binds to. (default \":9090\")\n  -h, --help                   help for testserver\n      --tls-ca-path string     Path to the TLS CA certificate bundle.\n      --tls-cert-path string   Path to the TLS server certificate.\n      --tls-key-path string    Path to the TLS server key.\n```\n\n`testserver` will authorize any path that contains the string\n`allow`, and will reject other requests with a 401 status code.\n\n# htpasswd\n\nUsage:\n\n```\nRun a htpasswd basic authentication server\n\nUsage:\n  contour-authserver htpasswd [OPTIONS]\n\nFlags:\n      --address string             The address the authentication endpoint binds to. (default \":9090\")\n      --auth-realm string          Basic authentication realm. (default \"default\")\n  -h, --help                       help for htpasswd\n      --metrics-address string     The address the metrics endpoint binds to. (default \":8080\")\n      --selector string            Selector (label-query) to filter Secrets, supports '=', '==', and '!='.\n      --tls-ca-path string         Path to the TLS CA certificate bundle.\n      --tls-cert-path string       Path to the TLS server certificate.\n      --tls-key-path string        Path to the TLS server key.\n      --watch-namespaces strings   The list of namespaces to watch for Secrets.\n```\n\n## htpasswd Secrets\n\nThe `htpasswd` backend implements [HTTP basic authentication][3]\nagainst a set of Secrets that contain [htpasswd][1] formatted data.\nThe htpasswd data must be stored in the `auth` key, which is compatible\nwith ingress-nginx [`auth-file` Secrets][2].\n\nThe `htpasswd` backend only accesses Secrets that are\nannotated with `projectcontour.io/auth-type: basic`.\n\nSecrets that are annotated with the `projectcontour.io/auth-realm`\nwill only be used if the annotation value matches the value of the\n`--auth-realm` flag.\nThe `projectcontour.io/auth-realm: *` annotation explicitly marks\na Secret as being valid for all realms.\nThis is equivalent to omitting the annotation.\n\nWhen it authenticates a request, the `htpasswd` backend injects the\n`Auth-Username` and  `Auth-Realm` headers, which contain the\nauthenticated user name and the basic authentication realm respectively.\n\nThe `--watch-namespaces` flag specifies the namespaces where the\n`htpasswd` backend will discover Secrets.\nIf this flag is empty, Secrets from all namespaces will be used.\n\nThe `--selector` flag accepts a [label selector][5] that can be\nused to further restrict which Secrets the `htpasswd` backend will consume.\n\n# oidc\n\nUsage:\n\n```\nRun a oidc authentication server\n\nUsage:\n  contour-authserver oidc [OPTIONS]\n\nFlags:\n      --config string              Path to config file ( yaml format )\n  -h, --help                       help for htpasswd\n      --tls-ca-path string         Path to the TLS CA certificate bundle.\n      --tls-cert-path string       Path to the TLS server certificate.\n      --tls-key-path string        Path to the TLS server key.\n\n```\nOidc configuration can be specified with configmaps. \nPlease visit [DexIDP](https://github.com/dexidp/dex) for more detail.\n\n```\n## The following entries are the variables  accepted by the Contour OIDC module.\n## server address and port \naddress: \":9443\"\n\n## OIDC issuer URL \nissuerURL: \"http://\u003cpath to your SSO server\u003e\"\n\n## App redirect path ( usually point back to app url)\nredirectURL: \"https://\u003cpath to your applications\u003e\"\nredirectPath: \"/callback\"\nallowEmptyClientSecret: false\nscopes:\n- openid\n- profile\n- email\n- offline_access\nusernameClaim: \"nickname\"\nemailClaim: \"\"\nserveTLS: false\nclientID: \"\u003cyour client id\u003e\"\nclientSecret: \"\u003cyour client secret\u003e\"\n```\n\n\n# Request Headers\n\nBoth authorization backends emit the `Auth-Handler` header, which\npublishes the name of the backend that approved or rejected the\nauthorization.\n\nThe authorization context is also reflected into HTTP headers\nprefixed with `Auth-Context-`. Note that This can generate malformed\nHTTP headers. The `testserver` backend always creates the context\nheaders, but the `htpasswd` backend only does so for authenticated\nrequests (i.e. the origin server gets them bu the client never\ndoes.)\n\n# Deploying `contour-authserver`\n\nThe recommended way to deploy `contour-authserver` is to use the Kustomize\n[deployment YAML](./config/default). This will deploy services for \n`testserver` , `htpasswd` and `oidc` backends. For developer deployments,\n[Skaffold](https://skaffold.dev/) seems to work reasonably well.\n\nThere are no versioned releases or container images yet.\n\n# Releasing `contour-authserver`\n\nMaintainers who need to release a new version of `contour-authserver`\ncan follow the following steps:\n\n```bash\n# Ensure that you have a Github token either in $GITHUB_TOKEN or in ~/.config/goreleaser/github_token.\n# Ensure that goreleaser is installed.\n\n# Tag the release.\n$ ./hack/make-release-tag.sh $OLDVERS $NEWVERS\n\n# Push the release tag to Github.\n$ git push origin $NEWVERS\n\n# Build and release binaries and Docker images.\n$ make release\n\n# Log in with your GitHub account and token to push the images.\n$ docker login -u \u003cGitHub username\u003e\n$ docker push ghcr.io/projectcontour/contour-authserver:$NEWVERS\n$ docker push ghcr.io/projectcontour/contour-authserver:latest\n\n# Log out.\n$ docker logout\n```\n\n[1]: https://httpd.apache.org/docs/current/programs/htpasswd.html\n[2]: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#authentication\n[3]: https://tools.ietf.org/html/rfc7617\n[4]: https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/ext_authz_filter\n[5]: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fprojectcontour%2Fcontour-authserver","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fprojectcontour%2Fcontour-authserver","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fprojectcontour%2Fcontour-authserver/lists"}