Github Pangolin OIDC Interceptor

Allows Pangolin to play nicely with GitHub, which doesn't offically support OIDC.

• Working as of Pangolin Enterprise Ver. 1.18.4

Environment Variables

Configure these variables inside your .env file or pass them directly to your container runtime:

Variable	Type	Description	Example
IDP_PRIVATE_KEY	String	A Base64-encoded string of your RSA private key (.pem format) used to sign outbound OIDC tokens.	LS0tLS1CRUdJTiBSU0Eg...
GH_CLIENT_ID	String	The unique Client ID generated by your GitHub OAuth App registration.	Ov23wxt7v...
GH_CLIENT_SECRET	String	The corresponding Client Secret generated by your GitHub OAuth App registration.	40a1b6c8d9...
AUTH_DOMAIN	URL	Public URL for this interceptor, not including path.	https://github-oidc.brys.me
PANGOLIN_CALLBACK_URL	URL	The direct callback routing path inside your Pangolin instance. Pay close attention to the ID number assigned by Pangolin.	https://pangolin.brys.me/auth/idp/**2**/oidc/callback
TOKEN_EXPIRY_TIME	Integer	(Optional) Lifespan of generated tokens in seconds. Defaults to 21600 (6 hours).	3600
LOG_TYPE	String	(Optional) What log format to use Options: TEXT or JSON.	JSON

---

Getting Started

1. Create a GitHub OAuth Application

1. Head to your GitHub profile: Settings -> Developer Settings -> OAuth Apps -> New OAuth App.
2. Set the Homepage URL to your proxy domain (e.g., https://github-oidc.brys.me).
3. Set the Authorization callback URL directly to your proxy endpoint: https://github-oidc.brys.me/callback.
4. Click Register application, then generate and save a new Client Secret.

2. Cryptographic Key Setup

Generate a standard RSA private key and transform it into a single clean Base64 line string for your environment file:

# Generate the raw RSA private key, convert to base64 for environment variable
openssl genrsa 2048 | base64 -w 0 

We will use this later in docker compose to set the RSA key.

3. Deploy via Docker Compose

Create a docker-compose.yml file with the following code:

version: '3.8'

services:
  github-oidc-proxy:
    image: ghcr.io/thecampground/gh-pangolin-oidc:0.0.1
    container_name: github-oidc-proxy
    restart: unless-stopped
    ports:
      - "3410:3410"
    environment:
      - LOG_TYPE=JSON
      - AUTH_DOMAIN= # Your domain for the interceptor
      - PANGOLIN_CALLBACK_URL= # Your callback URL for pangolin (eg. https://example.com/token)
      - GH_CLIENT_ID= # Github OAuth 2 Client ID
      - GH_CLIENT_SECRET=YOUR_GITHUB_CLIENT_SECRET # Github OAuth 2 Client Secret
      - IDP_PRIVATE_KEY=YOUR_BASE64_ENCODED_PEM_STRING # Generated with: openssl genrsa 2048 | base64 -w 0

4. Configuring in Pangolin Admin Dashboard

Log into your Pangolin instance as an administrator, head to the server admin tab on the left, then Identity Providers:

Look for the card titled "OAuth2/OIDC Configuration"

1. Set the client id to the Client ID present in your GitHub OAuth 2 Application.
2. Set the client secret to the Client Secret in your GitHub OAuth2 Application.
3. Set the Authorization URL to your previously configured AUTH_DOMAIN/authorize (add the /authorize part)
4. Set the Token URL to your previously configured AUTH_DOMAIN/token (add the /token part)

Look for the card titled "Token Configuration"

1. Make sure your Identifier Path has sub as the value.

5. Everything should now be set-up. You can start using this interceptor.