oauth2-proxy-patterns

You secure internal services lacking native OIDC support by deploying OAuth2 Proxy as an authentication gateway alongside Keycloak. This pattern uses Nginx's auth_request directive to delegate authentication, ensuring only authorized users access your protected applications.

Configuring OAuth2 Proxy for dual-instance deployment is the best way to handle both internal HTTP and public HTTPS traffic. This setup separates internal network access from public exposure while maintaining consistent Keycloak authentication across both instances.

To block specific user roles at the Nginx layer, you implement visitor access control rules within your Nginx configuration. This intercepts requests authenticated by OAuth2 Proxy and restricts access based on role attributes passed from Keycloak.

Yes, OAuth2 Proxy supports PKCE S256 when integrating with Keycloak as an OIDC provider. This Proof Key for Code Exchange enhancement prevents authorization code interception attacks during the authentication flow.

Yes, you can use Nginx auth_request to delegate authentication to OAuth2 Proxy for self-hosted applications. This subrequest mechanism allows Nginx to verify user identity via OAuth2 Proxy before forwarding traffic to your backend service.

You need separate OAuth2 Proxy instances for internal and external access to isolate network security boundaries. This dual-instance deployment ensures internal HTTP traffic and public HTTPS traffic have distinct cookie management and authentication contexts.