63 lines
3.2 KiB
Bash
Executable File
63 lines
3.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -eo pipefail
|
|
[[ $DOKKU_TRACE ]] && set -x
|
|
|
|
case "$1" in
|
|
help | google-auth:help)
|
|
help_content() {
|
|
cat <<help_content
|
|
google-auth:configure [options], Set Google credentials and who may sign in (re-run any time to change)
|
|
google-auth:allow [<domain|address>...], Let a domain or address sign in (no arguments lists the allow list)
|
|
google-auth:unallow <domain|address...>, Remove a domain or address from the allow list
|
|
google-auth:deny [<address>...], Block an address even if the allow list covers it (no arguments lists the deny list)
|
|
google-auth:undeny <address...>, Remove an address from the deny list
|
|
google-auth:enable <app>, Require Google sign-in for all requests to <app>
|
|
google-auth:disable <app>, Remove Google sign-in from <app>
|
|
google-auth:exclude <app> <pattern...>, Exempt path prefixes (/path) or regexes (re:^/x) from sign-in
|
|
google-auth:unexclude <app> <pattern...>, Remove previously excluded patterns
|
|
google-auth:report [app], Show global and per-app google-auth status
|
|
google-auth:start, Start the shared auth service container
|
|
google-auth:stop, Stop the shared auth service container
|
|
google-auth:restart, Restart the shared auth service container (picks up config changes)
|
|
google-auth:logs [--tail|-t], Show logs from the shared auth service container
|
|
help_content
|
|
}
|
|
|
|
if [[ "$1" == "google-auth:help" ]]; then
|
|
echo -e 'Usage: dokku google-auth[:COMMAND]'
|
|
echo ''
|
|
echo 'Put Google OAuth SSO in front of dokku apps.'
|
|
echo ''
|
|
echo 'Commands:'
|
|
help_content | sort | column -c2 -t -s,
|
|
echo ''
|
|
echo 'google-auth:configure options (all persisted; re-run to change any of them):'
|
|
echo ''
|
|
echo ' --client-id <id> Google OAuth client id'
|
|
echo ' --client-secret <secret> Google OAuth client secret'
|
|
echo ' --auth-host <host> the one host registered as a redirect URI with Google'
|
|
echo ' --allow-domain <domain> allow any verified account at <domain> (repeatable)'
|
|
echo ' --allow-email <address> allow one specific address (repeatable)'
|
|
echo ' --deny-email <address> block one address, even if a rule above allows it (repeatable)'
|
|
echo ' --clear-deny-emails empty the deny list'
|
|
echo ' --session-ttl <duration> how long a sign-in lasts (default 24h)'
|
|
echo ' --cookie-name <name> session cookie name (default _google_auth)'
|
|
echo ' --port <port> 127.0.0.1 port for the auth service (default 2999)'
|
|
echo ' --regenerate-cookie-secret rotate the session key (signs everyone out)'
|
|
echo ''
|
|
echo 'The allow rules are a strict allowlist: an account that matches none of them'
|
|
echo 'is rejected, and at least one rule is required. The deny list wins over both.'
|
|
echo ''
|
|
echo 'These flags REPLACE the list they name, so they suit initial setup. To add or'
|
|
echo 'remove one person afterwards, use google-auth:allow / :unallow / :deny /'
|
|
echo ':undeny, which change one entry at a time and restart the service for you.'
|
|
else
|
|
help_content
|
|
fi
|
|
;;
|
|
|
|
*)
|
|
exit "${DOKKU_NOT_IMPLEMENTED_EXIT:-10}"
|
|
;;
|
|
esac
|