proxyglassGitHub Get started
Authentication

OIDC, behind
your nginx.

Proxyglass serves plain HTTP and relies on your existing reverse proxy for TLS. OIDC uses the authorization-code flow and validates the ID token before creating a session.

Full configuration →

OIDC configuration sample

Replace the issuer, client ID and secret with values from your identity provider. Register the exact callback URI with that client.

oidc:
  enabled: true
  issuer: "https://sso.example.net/realms/operations"
  client_id: "proxyglass"
  client_secret: "REPLACE_WITH_SECRET"
  session_ttl_hours: 8
  # Either set a fixed HTTPS callback or leave empty to derive it from
  # Host + X-Forwarded-Proto on the incoming nginx request.
  redirect_uri: "https://proxyglass.example.net/ui/oidc/callback"
  # Optional; the ID token must contain a string-array "groups" claim.
  allowed_groups:
    - "network-operations"
Keep the secret private. Do not commit it to source control. Render the config from your secret manager or restrict the installed config file to root and the Proxyglass service group.

Forward the public host and scheme

Bind Proxyglass to loopback when nginx is on the same host. Preserve the original host and forward the external scheme so the OIDC callback is built correctly.

location / {
    proxy_pass http://127.0.0.1:8080;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

For another proxy or a non-standard path, set oidc.redirect_uri explicitly to the public absolute URL ending in /ui/oidc/callback.

Register the OIDC client

  • Use the issuer URL for the provider/realm; Proxyglass discovers authorization and token endpoints from its OIDC metadata.
  • Use a confidential client and configure its client secret in the protected Proxyglass config.
  • Allow the callback URI https://proxyglass.example.net/ui/oidc/callback (or the exact URI you configured).
  • Ensure the Proxyglass host can reach the issuer and token endpoints. Standard HTTP proxy environment variables are supported.

OIDC sessions are in memory and expire after session_ttl_hours (8 hours when unset or zero). A service restart clears sessions. Bearer-token sign-in remains available as an alternative.

Optional group allow-list

When allowed_groups is non-empty, a user must have at least one matching value in the ID token’s groups string-array claim. Configure your identity provider to include that claim. An empty list disables group filtering.