CODEWITHSUNDEEP
oauth-2.0google-oauthoauth2-proxy
jipot
jipot

Reputation: 94

How to authenticate to oauth2-proxy via cURL or POSTMAN

I have my service set behind oauth2-proxy and I am using version 4.0.0.

I am trying to hit an API behind the service, but unfortunately, I always get a 403 forbidden error because of oauth2-proxy being in the way.

I am looking for a way to authenticate via g-suite using oauth2-proxy and generate a token that I can then use for the service.

Does oauth2-proxy support any kind of way to authenticate via cURL or POST call?

Upvotes: 4

Views: 1823

Answers (3)

драган-јованковић
драган-јованковић

Reputation: 628

You need to first :

  • Make a request to be redirected to IDP authentication.
  • Authenticate to your IDP.
  • Request the token from the callback URL
  • Then authenticate using the token. (Probably as a bearer token)

I hope this article helps you understand better how to authenticate with an IDP.

Upvotes: 0

Baibhav Vishal
Baibhav Vishal

Reputation: 89

For Azure Entra IdP, I faced a similar situation. Here I logged in using SSO in web-browser. Noted down the Bearer Token or _oauth2_proxy in cookies. And passed this in cUrl or Postman. For Gsuite, I believe cookies with names similar to this __Secure-3PSID contains the value required for verifying ot OAuth Level, that this request is authenticated.

So note down these cookies values and pass it in cUrl or Postman, along with your normal request to respected service. Hopefully that solves your problem.

Upvotes: 0

Gary Archer
Gary Archer

Reputation: 29283

It feels to me that your deployment separation is not right. OAuth has a strong focus on separation of web and API concerns. The oauth2-proxy utility is a web client and should not be deployed in front of APIs since that can limit your options.

SUBOPTIMAL DEPLOYMENT

  • API is hosted behind oauth2-proxy
  • oauth2-proxy issues redirects to the browser
  • Browser clients can handle redirects and users can login
  • After a browser login oauth2-proxy issues a cookie
  • oauth2-proxy translates cookies to tokens when JavaScript calls APIs
  • Mobile apps or API test clients cannot call the API

OPTIMIZED DEPLOYMENT

  • Web static content is hosted behind oauth2-proxy
  • oauth2-proxy issues redirects to the browser
  • Browser clients can handle redirects and users can login
  • After a browser login oauth2-proxy issues a cookie
  • oauth2-proxy translates cookies to tokens when JavaScript calls APIs
  • APIs have their own internet entry points that require access tokens
  • Mobile apps or API test clients can call APIs with an access token

If I'm misunderstanding anything, maybe clarify your question and post back.

Upvotes: 2

Related Questions