AuthBaton is an authentication service for applications behind a reverse proxy.
This project and everyone participating in it are governed by the XMiDT Code Of Conduct. By participating, you agree to this Code.
AuthBaton is meant to be used as a helper authentication microservice to reverse proxy tools such as NGINX.
The diagram below shows the path that a request follows before reaching the protected application.
curl https://localhost:6800 -i
HTTP/1.1 403 Forbidden
X-Server-Name: authbaton
X-Server-Version: development
Date: Mon, 05 Apr 2021 21:18:24 GMT
Content-Length: 0
Connection: close
curl https://localhost:6800/original/request/path -H "Authorization: Basic dXNlcjpwYXNz" -i
HTTP/1.1 200 OK
X-Server-Name: authbaton
X-Server-Version: development
Date: Mon, 05 Apr 2021 21:21:46 GMT
Content-Length: 0
Connection: close
Note: AuthBaton accepts any URL path. This allows bascule capability checks to work properly as the reverse proxy can simply reuse the URL path of the original request.
In order to build from source, you need a working 1.x Go environment. Find more information on Go website.
Then, clone the repo and build using make:
git clone [email protected]:xmidt-org/authbaton.git
cd authbaton
make build
The Makefile has the following options you may find helpful:
make build
: builds the authbaton binarymake test
: runs unit tests with coverage for authbatonmake clean
: deletes previously-built binaries and object files
First have a local clone of the source and go into the root directory of the repository. Then use rpkg to build the rpm:
rpkg srpm --spec <repo location>/<spec file location in repo>
rpkg -C <repo location>/.config/rpkg.conf sources --outdir <repo location>'
Once the binary is built, run:
./authbaton
Ensure that the authbaton.yaml
config file is in one of the following folders:
- The current working directory
$HOME/.authbaton
/etc/authbaton
We currently have an example configuration file only for NGINX. However, any reverse proxy that can authenticate an external request by consulting authbaton is supported.
See example configurations here. We are happy to take contributions for example config files for other reverse proxies.
Refer to CONTRIBUTING.md.