Skip to content

Commit 6ba6c7f

Browse files
hrntknrhrntknr
authored
docs: update configuration documentation with latest options (#74)
* docs: update configuration documentation with latest options Add documentation for new configuration options: - --google-allowed-workspaces: Allow entire Google Workspaces - --github-allowed-orgs: Allow GitHub organizations and teams (Org:Team format) - --trusted-proxies: Configure trusted proxy IP ranges for reverse proxy setups Updated configuration reference, OAuth setup guide, and Docker Compose examples to reflect these new options and their usage patterns. * docs: improve OAuth setup code block formatting
1 parent 47ed79f commit 6ba6c7f

File tree

3 files changed

+36
-10
lines changed

3 files changed

+36
-10
lines changed

‎docs/docs/configuration.md‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -34,19 +34,21 @@ Complete reference for all MCP Auth Proxy configuration options.
3434

3535
#### Google OAuth
3636

37-
| Option | Environment Variable | Default | Description |
38-
| ------------------------ | ---------------------- | ------- | ----------------------------------------------------- |
39-
| `--google-client-id` | `GOOGLE_CLIENT_ID` | - | Google OAuth client ID |
40-
| `--google-client-secret` | `GOOGLE_CLIENT_SECRET` | - | Google OAuth client secret |
41-
| `--google-allowed-users` | `GOOGLE_ALLOWED_USERS` | - | Comma-separated list of allowed Google users (emails) |
37+
| Option | Environment Variable | Default | Description |
38+
| ----------------------------- | --------------------------- | ------- | ----------------------------------------------------- |
39+
| `--google-client-id` | `GOOGLE_CLIENT_ID` | - | Google OAuth client ID |
40+
| `--google-client-secret` | `GOOGLE_CLIENT_SECRET` | - | Google OAuth client secret |
41+
| `--google-allowed-users` | `GOOGLE_ALLOWED_USERS` | - | Comma-separated list of allowed Google users (emails) |
42+
| `--google-allowed-workspaces` | `GOOGLE_ALLOWED_WORKSPACES` | - | Comma-separated list of allowed Google workspaces |
4243

4344
#### GitHub OAuth
4445

45-
| Option | Environment Variable | Default | Description |
46-
| ------------------------ | ---------------------- | ------- | -------------------------------------------------------- |
47-
| `--github-client-id` | `GITHUB_CLIENT_ID` | - | GitHub OAuth client ID |
48-
| `--github-client-secret` | `GITHUB_CLIENT_SECRET` | - | GitHub OAuth client secret |
49-
| `--github-allowed-users` | `GITHUB_ALLOWED_USERS` | - | Comma-separated list of allowed GitHub users (usernames) |
46+
| Option | Environment Variable | Default | Description |
47+
| ------------------------ | ---------------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------- |
48+
| `--github-client-id` | `GITHUB_CLIENT_ID` | - | GitHub OAuth client ID |
49+
| `--github-client-secret` | `GITHUB_CLIENT_SECRET` | - | GitHub OAuth client secret |
50+
| `--github-allowed-users` | `GITHUB_ALLOWED_USERS` | - | Comma-separated list of allowed GitHub users (usernames) |
51+
| `--github-allowed-orgs` | `GITHUB_ALLOWED_ORGS` | - | Comma-separated list of allowed GitHub organizations. You can also restrict access to specific teams using the format `Org:Team` |
5052

5153
#### Generic OIDC
5254

@@ -74,5 +76,6 @@ Complete reference for all MCP Auth Proxy configuration options.
7476
| ---------------------- | -------------------- | ------- | ----------------------------------------------------------------------------------------------------- |
7577
| `--proxy-bearer-token` | `PROXY_BEARER_TOKEN` | - | Bearer token to add to Authorization header when proxying requests |
7678
| `--proxy-headers` | `PROXY_HEADERS` | - | Comma-separated list of headers to add when proxying requests (format: Header1:Value1,Header2:Value2) |
79+
| `--trusted-proxies` | `TRUSTED_PROXIES` | - | Comma-separated list of trusted proxies (IP addresses or CIDR ranges) |
7780

7881
For practical configuration examples including environment variables, Docker Compose, and Kubernetes deployments, see the [Configuration Examples](./examples.md) page.

‎docs/docs/examples.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,12 @@ services:
3737
- GOOGLE_CLIENT_ID=your-google-client-id
3838
- GOOGLE_CLIENT_SECRET=your-google-client-secret
3939
- [email protected],[email protected]
40+
- GOOGLE_ALLOWED_WORKSPACES=workspace1.com,workspace2.com
41+
- GITHUB_CLIENT_ID=your-github-client-id
42+
- GITHUB_CLIENT_SECRET=your-github-client-secret
43+
- GITHUB_ALLOWED_USERS=username1,username2
44+
- GITHUB_ALLOWED_ORGS=org1,org2:team1
45+
- TRUSTED_PROXIES=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
4046
volumes:
4147
- ./data:/data
4248
command: ["npx", "-y", "@modelcontextprotocol/server-filesystem", "./"]

‎docs/docs/oauth-setup.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ Configure OAuth providers to enable secure authentication for your MCP server.
3030

3131
### 3. Configure MCP Auth Proxy
3232

33+
#### Allow specific users:
34+
3335
```bash
3436
./mcp-auth-proxy \
3537
--external-url https://{your-domain} \
@@ -40,6 +42,18 @@ Configure OAuth providers to enable secure authentication for your MCP server.
4042
-- your-mcp-command
4143
```
4244

45+
#### Allow entire Google Workspaces:
46+
47+
```bash
48+
./mcp-auth-proxy \
49+
--external-url https://{your-domain} \
50+
--tls-accept-tos \
51+
--google-client-id "your-google-client-id" \
52+
--google-client-secret "your-google-client-secret" \
53+
--google-allowed-workspaces "workspace1.com,workspace2.com" \
54+
-- your-mcp-command
55+
```
56+
4357
## GitHub OAuth Setup
4458

4559
### 1. Register OAuth App
@@ -60,6 +74,7 @@ Configure OAuth providers to enable secure authentication for your MCP server.
6074
--github-client-id "your-github-client-id" \
6175
--github-client-secret "your-github-client-secret" \
6276
--github-allowed-users "username1,username2" \
77+
--github-allowed-orgs "org1,org2:team1" \
6378
-- your-mcp-command
6479
```
6580

@@ -141,10 +156,12 @@ All OAuth settings can be configured using environment variables:
141156
export GOOGLE_CLIENT_ID="your-google-client-id"
142157
export GOOGLE_CLIENT_SECRET="your-google-client-secret"
143158
export GOOGLE_ALLOWED_USERS="[email protected],[email protected]"
159+
export GOOGLE_ALLOWED_WORKSPACES="workspace1.com,workspace2.com"
144160

145161
export GITHUB_CLIENT_ID="your-github-client-id"
146162
export GITHUB_CLIENT_SECRET="your-github-client-secret"
147163
export GITHUB_ALLOWED_USERS="username1,username2"
164+
export GITHUB_ALLOWED_ORGS="org1,org2:team1"
148165

149166
export OIDC_CONFIGURATION_URL="https://provider.com/.well-known/openid-configuration"
150167
export OIDC_CLIENT_ID="your-oidc-client-id"

0 commit comments

Comments
 (0)