public_git
/
oauth2-proxy
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

allow setting arbitrary cookie refresh url

This commit is contained in:
Erikson Bahr 2024-02-02 08:42:37 -03:00
parent 5de6ce45d0
commit 23cf172dd6
No known key found for this signature in database
GPG Key ID: 18A31B1438D87934
4 changed files with 14 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
oauthproxy.go
View File

@ -395,8 +395,11 @@ func buildSessionChain(opts *options.Options, provider providers.Provider, sessi
oidcProviderSettings := opts.Providers[0].OIDCConfig
if oidcProviderSettings.EnableCookieRefresh {
chain = chain.Append(middleware.NewCookieRefresh(&middleware.CookieRefreshOptions{IssuerURL: oidcProviderSettings.IssuerURL, CookieRefreshName: oidcProviderSettings.CookieRefreshName}))
logger.Printf("Enabling OIDC cookie refresh for the cookie '%s' functionality because OIDCEnableCookieRefresh is enabled", oidcProviderSettings.CookieRefreshName)
if oidcProviderSettings.CookieRefreshURL == "" {
oidcProviderSettings.CookieRefreshURL = fmt.Sprintf("%s/session/refresh", oidcProviderSettings.IssuerURL)
}
chain = chain.Append(middleware.NewCookieRefresh(&middleware.CookieRefreshOptions{CookieRefreshURL: oidcProviderSettings.CookieRefreshURL, CookieRefreshName: oidcProviderSettings.CookieRefreshName}))
logger.Printf("Enabling OIDC cookie refresh functionality for the cookie '%s' using the url '%s' because OIDCEnableCookieRefresh is enabled", oidcProviderSettings.CookieRefreshURL, oidcProviderSettings.CookieRefreshName)
}
return chain

2
pkg/apis/options/legacy_options.go
View File

@ -545,6 +545,7 @@ type LegacyProvider struct {
OIDCExtraAudiences []string `flag:"oidc-extra-audience" cfg:"oidc_extra_audiences"`
OIDCEnableCookieRefresh bool `flag:"oidc-enable-cookie-refresh" cfg:"oidc_enable_cookie_refresh"`
OIDCCookieRefreshName string `flag:"oidc-cookie-refresh-name" cfg:"oidc_cookie_refresh_name"`
OIDCCookieRefreshURL string `flag:"oidc-cookie-refresh-url" cfg:"oidc_cookie_refresh_url"`
LoginURL string `flag:"login-url" cfg:"login_url"`
RedeemURL string `flag:"redeem-url" cfg:"redeem_url"`
ProfileURL string `flag:"profile-url" cfg:"profile_url"`
@ -605,6 +606,7 @@ func legacyProviderFlagSet() *pflag.FlagSet {
flagSet.StringSlice("oidc-extra-audience", []string{}, "additional audiences allowed to pass audience verification")
flagSet.Bool("oidc-enable-cookie-refresh", false, "Refresh the OIDC provider cookies to enable SSO in an extended period of time")
flagSet.String("oidc-cookie-refresh-name", "hsdpamcookie", "The name of the cookie that the OIDC provider uses to keep its session fresh")
flagSet.String("oidc-cookie-refresh-url", "", "The URL that is going to be used to refresh the cookie")
flagSet.String("login-url", "", "Authentication endpoint")
flagSet.String("redeem-url", "", "Token redemption endpoint")
flagSet.String("profile-url", "", "Profile access endpoint")

2
pkg/apis/options/providers.go
View File

@ -234,6 +234,8 @@ type OIDCOptions struct {
EnableCookieRefresh bool `json:"enableCookieRefresh,omitempty"`
// Name of the cookie that is going to be extracted from the request and refreshed
CookieRefreshName string `json:"cookieRefreshName,omitempty"`
// Url that is going to be used to refresh the cookie
CookieRefreshURL string `json:"cookieRefreshURL,omitempty"`
}
type LoginGovOptions struct {

10
pkg/middleware/cookie_refresh.go
View File

@ -11,23 +11,23 @@ import (
)
type CookieRefreshOptions struct {
IssuerURL string
CookieRefreshName string
CookieRefreshURL string
}
func NewCookieRefresh(opts *CookieRefreshOptions) alice.Constructor {
cr := &cookieRefresh{
HTTPClient: &http.Client{},
IssuerURL: opts.IssuerURL,
CookieRefreshName: opts.CookieRefreshName,
CookieRefreshURL: opts.CookieRefreshURL,
}
return cr.refreshCookie
}
type cookieRefresh struct {
HTTPClient *http.Client
IssuerURL string
CookieRefreshName string
CookieRefreshURL string
}
func (cr *cookieRefresh) refreshCookie(next http.Handler) http.Handler {
@ -43,7 +43,7 @@ func (cr *cookieRefresh) refreshCookie(next http.Handler) http.Handler {
logger.Errorf("SSO Cookie Refresher - Could find '%s' cookie in the request: %v", cr.CookieRefreshName, err)
return
}
resp := requests.New(fmt.Sprintf("%s/session/refresh", cr.IssuerURL)).
resp := requests.New(cr.CookieRefreshURL).
WithContext(req.Context()).
WithMethod("GET").
SetHeader("api-version", "1").
@ -52,7 +52,7 @@ func (cr *cookieRefresh) refreshCookie(next http.Handler) http.Handler {
if resp.StatusCode() != http.StatusNoContent {
bodyString := string(resp.Body())
logger.Errorf("SSO Cookie Refresher - Could not refresh the '%s' cookie due to status and content: %v - %v", cr.CookieRefreshName, resp.StatusCode(), bodyString)
logger.Errorf("SSO Cookie Refresher - Could not refresh the '%s' cookie in the url '%s' due to status and content: %v - %v", cr.CookieRefreshName, cr.CookieRefreshURL, resp.StatusCode(), bodyString)
return
}