search

bitly / oauth2_proxy

A reverse proxy that provides authentication with Google, Github or other provider
MIT License
5.1k stars 1.21k forks source link

Trying to get oauth2_proxy Working on Kubernetes #635

Open mhobotpplnet opened 5 years ago

mhobotpplnet commented 5 years ago

So I am trying to get oath2_proxy to work on Kubernetes , specifically for the dashboard. I followed these instructions https://blog.n1analytics.com/oauth2-lets-encrypt-and-k8s/

I get to the point where it asks me to login and everything, however I get access denied. Org is missing, Org is not missing as it asked me the first time to auth with it. 

61.122.331.121 - - [23/Jul/2018:19:56:35 +0000] myexample.com GET - "/oauth2/sign_in" HTTP/1.1 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36" 200 2478 0.000
172.27.16.76 - - [23/Jul/2018:19:56:35 +0000] 172.27.17.132:4180 GET - "/ping" HTTP/1.1 "kube-probe/1.10" 200 2 0.000
61.122.331.121 - - [23/Jul/2018:19:56:35 +0000] myexample.com GET - "/oauth2/auth" HTTP/1.1 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36" 401 21 0.000
2018/07/23 19:56:35 oauthproxy.go:602: 172.27.30.90:52182 ("61.122.331.121") Cookie "_oauth2_proxy" not present
61.122.331.121 - - [23/Jul/2018:19:56:35 +0000] myexample.com GET - "/oauth2/start?rd=https://myexample.com/favicon.ico" HTTP/1.1 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36" 302 322 0.000
2018/07/23 19:56:35 github.go:105: Missing Organization:"MyOrgName" in []
2018/07/23 19:56:35 oauthproxy.go:566: 172.27.30.90:52490 ("61.122.331.121") Permission Denied: "" is unauthorized
2018/07/23 19:56:35 oauthproxy.go:349: ErrorPage 403 Permission Denied Invalid Account
mhobotpplnet commented 5 years ago

One thing that I did notice is that my org for the app that I authorized through my account was in "request" status .

mhobotpplnet commented 5 years ago

Actually I my comment above was exactly the problem. When I switched to auth with email only, it worked. So once in Dev Settings, your Org Needs to approve your app for it to be used.