OAuth2 Proxy
Authentication proxy for platform services that lack native SSO support.
Component Category
Access and security / authentication proxy
Component Description
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 and OpenID Connect. It sits in front of services that do not have built-in SSO support, handling the login flow through Keycloak and forwarding authenticated requests to the upstream service.
The platform deploys OAuth2 Proxy as separate instances for each protected service, each with its own Keycloak client registration, cookie secret, and redirect URIs.
Why It Is Used
In BullSequana AI, OAuth2 Proxy extends the platform's single sign-on model to third-party components whose UIs do not natively support OIDC authentication. This ensures that all user-facing services are protected by the same Keycloak identity layer, even when the upstream service has no built-in identity integration.
Learn More
Platform instances
| Instance | Protects | Keycloak client ID | Tier |
|---|---|---|---|
oauth2-proxy-attu | Milvus Attu UI | milvus | coreai |
oauth2-proxy-airbyte | Airbyte UI | airbyte | proai |
Each instance is deployed as a separate Helm release with its own namespace, SSO configuration, and Keycloak enrollment (setup/cleanup jobs). Both use the same upstream chart (oauth2-proxy v7.12.4) but with different client registrations and group-based access controls.
Attu instance
Protects the Milvus vector database administration UI. Access is restricted to members of the COREAI-ATTU-ADMIN-GROUP Keycloak group.
Airbyte instance
Protects the Airbyte data ingestion UI. Access is controlled through the COREAI-AIRBYTE-ADMIN-GROUP and COREAI-AIRBYTE-USER-GROUP Keycloak groups.
Deployment notes
Each OAuth2 Proxy instance deploys as a separate Helm release in its own namespace within the coreai or proai tier. Both instances use the same upstream chart and are enrolled into Keycloak through the standard SSO setup and cleanup jobs. Traffic is routed through Gateway API HTTPRoute resources.
Interacts With
Keycloak, which provides the OIDC identity layer that OAuth2 Proxy authenticates against.Milvus, whose Attu UI is protected by theoauth2-proxy-attuinstance.Airbyte, whose web UI is protected by theoauth2-proxy-airbyteinstance.Gateway API, which routes traffic to the OAuth2 Proxy endpoints.