public_git
/
oauth2-proxy
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

add azure china support

This commit is contained in:
Leandro Lafin 2024-07-12 11:37:14 -03:00
parent d654f103de
commit 1396a26221
No known key found for this signature in database
GPG Key ID: 60C427B9DF40CB72
2 changed files with 9 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
CHANGELOG.md
View File

@ -10,6 +10,8 @@
# V7.5.1
- [#2128](https://github.com/oauth2-proxy/oauth2-proxy/pull/2128) Update dependencies (@vllvll)
- [#2269](https://github.com/oauth2-proxy/oauth2-proxy/pull/2269) Added Azure China (and other air gaped cloud) support (@mblaschke)
- [#2237](https://github.com/oauth2-proxy/oauth2-proxy/pull/2237) adds an option to append CA certificates (@emsixteeen)
- [#2128](https://github.com/oauth2-proxy/oauth2-proxy/pull/2128) Update dependencies (@vllvll)
- [#2274](https://github.com/oauth2-proxy/oauth2-proxy/pull/2274) Upgrade golang.org/x/net to v0.17.0 (@pierluigilenoci)

14
providers/azure.go
View File

@ -33,7 +33,6 @@ const (
azureProviderName = "Azure"
azureDefaultScope = "openid"
azureDefaultGraphGroupField = "id"
azureV2Scope = "https://graph.microsoft.com/.default"
)
var (
@ -90,15 +89,16 @@ func NewAzureProvider(p *ProviderData, opts options.AzureOptions) *AzureProvider
isV2Endpoint := false
if strings.Contains(p.LoginURL.String(), "v2.0") {
isV2Endpoint = true
azureV2GraphScope := fmt.Sprintf("https://%s/.default", p.ProfileURL.Host)
if strings.Contains(p.Scope, " groups") {
logger.Print("WARNING: `groups` scope is not an accepted scope when using Azure OAuth V2 endpoint. Removing it from the scope list")
p.Scope = strings.ReplaceAll(p.Scope, " groups", "")
}
if !strings.Contains(p.Scope, " "+azureV2Scope) {
if !strings.Contains(p.Scope, " "+azureV2GraphScope) {
// In order to be able to query MS Graph we must pass the ms graph default endpoint
p.Scope += " " + azureV2Scope
p.Scope += " " + azureV2GraphScope
}
if p.ProtectedResource != nil && p.ProtectedResource.String() != "" {
@ -118,12 +118,12 @@ func overrideTenantURL(current, defaultURL *url.URL, tenant, path string) {
if current == nil || current.String() == "" || current.String() == defaultURL.String() {
*current = url.URL{
Scheme: "https",
Host: "login.microsoftonline.com",
Host: current.Host,
Path: "/" + tenant + "/oauth2/" + path}
}
}
func getMicrosoftGraphGroupsURL(graphGroupField string) *url.URL {
func getMicrosoftGraphGroupsURL(profileURL *url.URL, graphGroupField string) *url.URL {
selectStatement := "$select=displayName,id"
if !slices.Contains([]string{"displayName", "id"}, graphGroupField) {
@ -133,7 +133,7 @@ func getMicrosoftGraphGroupsURL(graphGroupField string) *url.URL {
// Select only security groups. Due to the filter option, count param is mandatory even if unused otherwise
return &url.URL{
Scheme: "https",
Host: "graph.microsoft.com",
Host: profileURL.Host,
Path: "/v1.0/me/transitiveMemberOf",
RawQuery: "$count=true&$filter=securityEnabled+eq+true&" + selectStatement,
}
@ -368,7 +368,7 @@ func (p *AzureProvider) getGroupsFromProfileAPI(ctx context.Context, s *sessions
return nil, fmt.Errorf("missing access token")
}
groupsURL := getMicrosoftGraphGroupsURL(p.GraphGroupField).String()
groupsURL := getMicrosoftGraphGroupsURL(p.ProfileURL, p.GraphGroupField).String()
// Need and extra header while talking with MS Graph. For more context see
// https://docs.microsoft.com/en-us/graph/api/group-list-transitivememberof?view=graph-rest-1.0&tabs=http#request-headers