# OAuth2 Proxy (/docs/runtime/components/oauth2-proxy)



Component Category [#component-category]

Access and security / authentication proxy

Component Description [#component-description]

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 and OpenID Connect. It sits in front of services that do not have built-in SSO support, handling the login flow through Keycloak and forwarding authenticated requests to the upstream service.

The platform deploys OAuth2 Proxy as separate instances for each protected service, each with its own Keycloak client registration, cookie secret, and redirect URIs.

Why It Is Used [#why-it-is-used]

In BullSequana AI, OAuth2 Proxy extends the platform's single sign-on model to third-party components whose UIs do not natively support OIDC authentication. This ensures that all user-facing services are protected by the same Keycloak identity layer, even when the upstream service has no built-in identity integration.

Learn More [#learn-more]

* [OAuth2 Proxy documentation](https://oauth2-proxy.github.io/oauth2-proxy/)
* [oauth2-proxy/oauth2-proxy on GitHub](https://github.com/oauth2-proxy/oauth2-proxy)

Platform instances [#platform-instances]

| Instance               | Protects       | Keycloak client ID | Tier   |
| ---------------------- | -------------- | ------------------ | ------ |
| `oauth2-proxy-attu`    | Milvus Attu UI | `milvus`           | coreai |
| `oauth2-proxy-airbyte` | Airbyte UI     | `airbyte`          | proai  |

Each instance is deployed as a separate Helm release with its own namespace, SSO configuration, and Keycloak enrollment (setup/cleanup jobs). Both use the same upstream chart (`oauth2-proxy` v7.12.4) but with different client registrations and group-based access controls.

Attu instance [#attu-instance]

Protects the Milvus vector database administration UI. Access is restricted to members of the `COREAI-ATTU-ADMIN-GROUP` Keycloak group.

Airbyte instance [#airbyte-instance]

Protects the Airbyte data ingestion UI. Access is controlled through the `COREAI-AIRBYTE-ADMIN-GROUP` and `COREAI-AIRBYTE-USER-GROUP` Keycloak groups.

Deployment notes [#deployment-notes]

Each OAuth2 Proxy instance deploys as a separate Helm release in its own namespace within the coreai or proai tier. Both instances use the same upstream chart and are enrolled into Keycloak through the standard SSO setup and cleanup jobs. Traffic is routed through Gateway API HTTPRoute resources.

Interacts With [#interacts-with]

* `Keycloak`, which provides the OIDC identity layer that OAuth2 Proxy authenticates against.
* `Milvus`, whose Attu UI is protected by the `oauth2-proxy-attu` instance.
* `Airbyte`, whose web UI is protected by the `oauth2-proxy-airbyte` instance.
* `Gateway API`, which routes traffic to the OAuth2 Proxy endpoints.