public_git/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2026-09-30 03:31:27 +02:00
Code Issues Projects Releases Wiki Activity

Add EnrichSessionState as main post-Redeem session updater

Browse Source
This commit is contained in:
Nick Meves
2020-10-19 14:09:45 -07:00
parent b6061f0803
commit 2b9e1bbba0
6 changed files with 32 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
providers/provider_default.go
+13 -5
View File
@@ -87,21 +87,29 @@ func (p *ProviderData) GetLoginURL(redirectURI, state string) string {
}
// GetEmailAddress returns the Account email address
func (p *ProviderData) GetEmailAddress(ctx context.Context, s *sessions.SessionState) (string, error) {
// DEPRECATED: Migrate to EnrichSessionState
func (p *ProviderData) GetEmailAddress(_ context.Context, _ *sessions.SessionState) (string, error) {
return "", ErrNotImplemented
}
// GetUserName returns the Account username
func (p *ProviderData) GetUserName(ctx context.Context, s *sessions.SessionState) (string, error) {
// DEPRECATED: Migrate to EnrichSessionState
func (p *ProviderData) GetUserName(_ context.Context, _ *sessions.SessionState) (string, error) {
return "", ErrNotImplemented
}
// ValidateGroup validates that the provided email exists in the configured provider
// email group(s).
func (p *ProviderData) ValidateGroup(email string) bool {
func (p *ProviderData) ValidateGroup(_ string) bool {
return true
}
// EnrichSessionState is called after Redeem to allow providers to enrich session fields
// such as User, Email, Groups with provider specific API calls.
func (p *ProviderData) EnrichSessionState(_ context.Context, _ *sessions.SessionState) error {
return nil
}
// ValidateSessionState validates the AccessToken
func (p *ProviderData) ValidateSessionState(ctx context.Context, s *sessions.SessionState) bool {
return validateToken(ctx, p, s.AccessToken, nil)
@@ -109,12 +117,12 @@ func (p *ProviderData) ValidateSessionState(ctx context.Context, s *sessions.Ses
// RefreshSessionIfNeeded should refresh the user's session if required and
// do nothing if a refresh is not required
func (p *ProviderData) RefreshSessionIfNeeded(ctx context.Context, s *sessions.SessionState) (bool, error) {
func (p *ProviderData) RefreshSessionIfNeeded(_ context.Context, _ *sessions.SessionState) (bool, error) {
return false, nil
}
// CreateSessionStateFromBearerToken should be implemented to allow providers
// to convert ID tokens into sessions
func (p *ProviderData) CreateSessionStateFromBearerToken(ctx context.Context, rawIDToken string, idToken *oidc.IDToken) (*sessions.SessionState, error) {
func (p *ProviderData) CreateSessionStateFromBearerToken(_ context.Context, _ string, _ *oidc.IDToken) (*sessions.SessionState, error) {
return nil, ErrNotImplemented
}
providers/provider_default_test.go
+6
View File
@@ -47,3 +47,9 @@ func TestAcrValuesConfigured(t *testing.T) {
result := p.GetLoginURL("https://my.test.app/oauth", "")
assert.Contains(t, result, "acr_values=testValue")
}
func TestEnrichSessionState(t *testing.T) {
p := &ProviderData{}
s := &sessions.SessionState{}
assert.NoError(t, p.EnrichSessionState(context.Background(), s))
}
providers/providers.go
+3
View File
@@ -10,10 +10,13 @@ import (
// Provider represents an upstream identity provider implementation
type Provider interface {
Data() *ProviderData
// DEPRECATED: Migrate to EnrichSessionState
GetEmailAddress(ctx context.Context, s *sessions.SessionState) (string, error)
// DEPRECATED: Migrate to EnrichSessionState
GetUserName(ctx context.Context, s *sessions.SessionState) (string, error)
Redeem(ctx context.Context, redirectURI, code string) (*sessions.SessionState, error)
ValidateGroup(string) bool
EnrichSessionState(ctx context.Context, s *sessions.SessionState) error
ValidateSessionState(ctx context.Context, s *sessions.SessionState) bool
GetLoginURL(redirectURI, finalRedirect string) string
RefreshSessionIfNeeded(ctx context.Context, s *sessions.SessionState) (bool, error)