Skip to content

Authentication middleware that secures WAI application

License

Notifications You must be signed in to change notification settings

NoRedInk/wai-middleware-auth

 
 

Repository files navigation

wai-middleware-auth

Build Status

Middleware that secures WAI application

Installation

$ stack install wai-middleware-auth

OR

$ cabal install wai-middleware-auth

wai-auth

Along with middleware this package ships with an executable wai-auth, which can function as a protected file server or a reverse proxy. Right from the box it supports OAuth2 authentication as well as it's custom implementations for Google and Github.

Configuration is done using a yaml config file. Here is a sample file that will configure wai-auth to run a file server with Google, GitHub, and GitLab authentication on http://localhost:3000:

app_root: "_env:APPROOT:http://localhost:3000"
app_port: 3000
cookie_age: 3600
secret_key: "...+vwscbKR4DyPT"
file_server:
  root_folder: "/path/to/html/files"
  redirect_to_index: true
  add_trailing_slash: true
providers:
  github:
    client_id: "...94cc"
    client_secret: "...166f"
    app_name: "Dev App for wai-middleware-auth"
    email_white_list:
      - "^[a-zA-Z0-9._%+-][email protected]$"
  google:
    client_id: "...qlj.apps.googleusercontent.com"
    client_secret: "...oxW"
    email_white_list:
      - "^[a-zA-Z0-9._%+-][email protected]$"
  gitlab:
    client_id: "...9cfc"
    client_secret: "...f0d0"
    app_name: "Dev App for wai-middleware-auth"
    email_white_list:
      - "^[a-zA-Z0-9._%+-][email protected]$"

Above configuration will also block access to users that don't have an email with example.com domain. There is also a secret_key field which will be used to encrypt the session cookie. In order to generate a new random key run this command:

$ echo $(wai-auth key --base64)
azuCFq0zEBkLSXhQrhliZzZD8Kblo...

Make sure you have proper callback/redirect urls registered with google/github/gitlab apps, eg: http://localhost:3000/_auth_middleware/google/complete.

After configuration file is ready, running application is very easy:

$ wai-auth --config-file=/path/to/config.yaml
Listening on port 3000

Reverse proxy

To use a reverse proxy instead of a file server, replace file_server with reverse_proxy, eg:

reverse_proxy:
  host: myapp.example.com
  port: 80
  secure: false

Self-hosted GitLab

The GitLab provider also supports using a self-hosted GitLab instance by setting the gitlab_host field. In this case you may also want to override the provider_info to change the title, logo, and description. For example:

providers:
  gitlab:
    gitlab_host: gitlab.mycompany.com
    client_id: "...9cfc"
    client_secret: "...f0d0"
    app_name: "Dev App for wai-middleware-auth"
    email_white_list:
      - "^[a-zA-Z0-9._%+-][email protected]$"
    provider_info:
      title: My Company's GitLab
      logo_url: https://mycompany.com/logo.png
      descr: Use your My Company GitLab account to access this page.

About

Authentication middleware that secures WAI application

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Haskell 97.8%
  • Other 2.2%