public_git
/
oauth2-proxy
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge fb9e2d2700 into 110d51d1d7

This commit is contained in:
Haitao Chen 2025-10-28 19:57:49 +00:00 committed by GitHub
parent 110d51d1d7 fb9e2d2700
commit 51203ea9b4
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 35 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
pkg/validation/providers.go
View File

@ -68,6 +68,11 @@ func providerRequiresClientSecret(provider options.Provider) bool {
return false
}
// PKCE with S256 doesn't require client secret
if provider.Type == "oidc" && provider.CodeChallengeMethod == "S256" {
return false
}
if provider.Type == "login.gov" {
return false
}

30
pkg/validation/providers_test.go
View File

@ -79,5 +79,35 @@ var _ = Describe("Providers", func() {
},
errStrings: []string{skipButtonAndMultipleProvidersMsg},
}),
Entry("with oidc provider using S256 PKCE and no client secret", &validateProvidersTableInput{
options: &options.Options{
Providers: options.Providers{
{
Type: "oidc",
ID: "oidc-s256",
ClientID: "client-id",
ClientSecret: "",
ClientSecretFile: "",
CodeChallengeMethod: "S256",
},
},
},
errStrings: []string{},
}),
Entry("with oidc provider using S256 PKCE and client secret", &validateProvidersTableInput{
options: &options.Options{
Providers: options.Providers{
{
Type: "oidc",
ID: "oidc-s256",
ClientID: "client-id",
ClientSecret: "mysecret",
ClientSecretFile: "",
CodeChallengeMethod: "S256",
},
},
},
errStrings: []string{},
}),
)
})