AuthBaton is an authentication service for applications behind a reverse proxy.

• Code of Conduct
• Details
• Usage
• Build
• Deploy
• Contributing

This project and everyone participating in it are governed by the XMiDT Code Of Conduct. By participating, you agree to this Code.

AuthBaton is meant to be used as a helper authentication microservice to reverse proxy tools such as NGINX.

The diagram below shows the path that a request follows before reaching the protected application.

curl https://localhost:6800 -i
HTTP/1.1 403 Forbidden
X-Server-Name: authbaton
X-Server-Version: development
Date: Mon, 05 Apr 2021 21:18:24 GMT
Content-Length: 0
Connection: close

curl https://localhost:6800/original/request/path -H "Authorization: Basic dXNlcjpwYXNz" -i
HTTP/1.1 200 OK
X-Server-Name: authbaton
X-Server-Version: development
Date: Mon, 05 Apr 2021 21:21:46 GMT
Content-Length: 0
Connection: close

Note: AuthBaton accepts any URL path. This allows bascule capability checks to work properly as the reverse proxy can simply reuse the URL path of the original request.

In order to build from source, you need a working 1.x Go environment. Find more information on Go website.

Then, clone the repo and build using make:

git clone [email protected]:xmidt-org/authbaton.git
cd authbaton
make build

The Makefile has the following options you may find helpful:

• make build: builds the authbaton binary
• make test: runs unit tests with coverage for authbaton
• make clean: deletes previously-built binaries and object files

First have a local clone of the source and go into the root directory of the repository. Then use rpkg to build the rpm:

rpkg srpm --spec <repo location>/<spec file location in repo>
rpkg -C <repo location>/.config/rpkg.conf sources --outdir <repo location>'

Once the binary is built, run:

./authbaton

Ensure that the authbaton.yaml config file is in one of the following folders:

• The current working directory
• $HOME/.authbaton
• /etc/authbaton

We currently have an example configuration file only for NGINX. However, any reverse proxy that can authenticate an external request by consulting authbaton is supported.

See example configurations here. We are happy to take contributions for example config files for other reverse proxies.

Refer to CONTRIBUTING.md.