# Permission to use within your endpoints that need authentication/authorization
# Argument is mandatory and provides a query string to /auth/api/forward
#   "" means just authentication
#   perm=yourservice:login to require specific permission
forward_auth {$AUTH_UPSTREAM:localhost:4401} {
    uri /auth/api/forward?{args[0]}
    header_up Connection keep-alive  # Much higher performance
    header_up -Upgrade  # Disable Upgrade: WebSocket
    copy_headers {
        Remote-User
        Remote-Name
        Remote-Groups
        Remote-Org
        Remote-Org-Name
        Remote-Role
        Remote-Role-Name
        Remote-Session-Expires
        Remote-Credential
    }
}