Tools without SSO (oauth2-proxy)

Plenty of useful tools have no sign-in story at all — a Prometheus, an internal dashboard, a static report. Put oauth2-proxy in front of them and they inherit Longbridge sign-in: the proxy authenticates every request against your connected app and forwards the rest to the tool.

1. Register the connected app

The redirect URI is the proxy’s callback:

lbr identity app create internal-tools \
  --redirect-uri https://tools.example.com/oauth2/callback

Copy the client id and secret.

2. Run oauth2-proxy

oauth2-proxy \
  --provider=oidc \
  --oidc-issuer-url=https://console.lngbrdg.com \
  --client-id=<your client id> \
  --client-secret=<your client secret> \
  --redirect-url=https://tools.example.com/oauth2/callback \
  --scope="openid profile email groups" \
  --email-domain="*" \
  --cookie-secret=$(openssl rand -base64 32 | head -c 32) \
  --upstream=http://127.0.0.1:3000

--email-domain="*" is safe behind Longbridge: only your organization’s members can complete the sign-in, whatever their email domain.

3. Gate on roles (optional)

Two places to narrow access, use either or both:

• At the app — refuse the sign-in unless the member holds a role:

  lbr identity app update internal-tools --restrict-to-role platform-oncall

• At the proxy — require a group from the groups claim:

  --allowed-group=platform-oncall

The app-level restriction is the stronger boundary (the token is never issued); the proxy flag is handy when one proxy fronts several paths with different audiences.