From f983933d88ee7979bb6176a94365d037272e3360 Mon Sep 17 00:00:00 2001 From: Travis Hunter Date: Sat, 1 Apr 2017 15:10:33 -0400 Subject: [PATCH 01/13] Parse http address without url --- http.go | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/http.go b/http.go index 3b3d1386..aa764c84 100644 --- a/http.go +++ b/http.go @@ -5,7 +5,6 @@ import ( "log" "net" "net/http" - "net/url" "strings" "time" ) @@ -24,19 +23,24 @@ func (s *Server) ListenAndServe() { } func (s *Server) ServeHTTP() { - u, err := url.Parse(s.Opts.HttpAddress) - if err != nil { - log.Fatalf("FATAL: could not parse %#v: %v", s.Opts.HttpAddress, err) + httpAddress := s.Opts.HttpAddress + scheme := "" + + i := strings.Index(httpAddress, "://") + if i > -1 { + scheme = httpAddress[0:i] } var networkType string - switch u.Scheme { + switch scheme { case "", "http": networkType = "tcp" default: - networkType = u.Scheme + networkType = scheme } - listenAddr := strings.TrimPrefix(u.String(), u.Scheme+"://") + + slice := strings.SplitN(httpAddress, "//", 2) + listenAddr := slice[len(slice)-1] listener, err := net.Listen(networkType, listenAddr) if err != nil { From 1e7d2a08a3df581ffbbcf807f3add6a3f129f36e Mon Sep 17 00:00:00 2001 From: idntfy Date: Fri, 7 Apr 2017 14:55:48 +0300 Subject: [PATCH 02/13] #369: Optionally allow skipping authentication for preflight requests --- README.md | 1 + main.go | 1 + oauthproxy.go | 9 ++++++++- oauthproxy_test.go | 27 +++++++++++++++++++++++++++ options.go | 2 ++ 5 files changed, 39 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 9333a664..68a8138a 100644 --- a/README.md +++ b/README.md @@ -199,6 +199,7 @@ Usage of oauth2_proxy: -scope="": Oauth scope specification -signature-key="": GAP-Signature request signature key (algorithm:secretkey) -skip-auth-regex=: bypass authentication for requests path's that match (may be given multiple times) + -skip-auth-preflight=false: bypass authentication for OPTIONAL requests so preflight requests could succeed when using CORS -skip-provider-button=false: will skip sign-in-page to directly reach the next step: oauth/start -ssl-insecure-skip-verify: skip validation of certificates presented when using HTTPS -tls-cert="": path to certificate file diff --git a/main.go b/main.go index b5ed971e..ab0e4d35 100644 --- a/main.go +++ b/main.go @@ -39,6 +39,7 @@ func main() { flagSet.Bool("pass-host-header", true, "pass the request Host Header to upstream") flagSet.Var(&skipAuthRegex, "skip-auth-regex", "bypass authentication for requests path's that match (may be given multiple times)") flagSet.Bool("skip-provider-button", false, "will skip sign-in-page to directly reach the next step: oauth/start") + flagSet.Bool("skip-auth-preflight", false, "will skip authentication for OPTIONS requests") flagSet.Bool("ssl-insecure-skip-verify", false, "skip validation of certificates presented when using HTTPS") flagSet.Var(&emailDomains, "email-domain", "authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email") diff --git a/oauthproxy.go b/oauthproxy.go index f4cd5779..dd2b58e9 100644 --- a/oauthproxy.go +++ b/oauthproxy.go @@ -68,6 +68,7 @@ type OAuthProxy struct { PassAccessToken bool CookieCipher *cookie.Cipher skipAuthRegex []string + skipAuthPreflight bool compiledRegex []*regexp.Regexp templates *template.Template Footer string @@ -198,6 +199,7 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy { serveMux: serveMux, redirectURL: redirectURL, skipAuthRegex: opts.SkipAuthRegex, + skipAuthPreflight: opts.SkipAuthPreflight, compiledRegex: opts.CompiledRegex, SetXAuthRequest: opts.SetXAuthRequest, PassBasicAuth: opts.PassBasicAuth, @@ -421,6 +423,11 @@ func (p *OAuthProxy) GetRedirect(req *http.Request) (redirect string, err error) return } +func (p *OAuthProxy) IsWhitelistedRequest(req *http.Request) (ok bool) { + isPreflightRequestAllowed := p.skipAuthPreflight && req.Method == "OPTIONS" + return isPreflightRequestAllowed || p.IsWhitelistedPath(req.URL.Path) +} + func (p *OAuthProxy) IsWhitelistedPath(path string) (ok bool) { for _, u := range p.compiledRegex { ok = u.MatchString(path) @@ -445,7 +452,7 @@ func (p *OAuthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) { p.RobotsTxt(rw) case path == p.PingPath: p.PingPage(rw) - case p.IsWhitelistedPath(path): + case p.IsWhitelistedRequest(req): p.serveMux.ServeHTTP(rw, req) case path == p.SignInPath: p.SignIn(rw, req) diff --git a/oauthproxy_test.go b/oauthproxy_test.go index 06894244..a0bcc5c1 100644 --- a/oauthproxy_test.go +++ b/oauthproxy_test.go @@ -641,6 +641,33 @@ func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) { assert.Equal(t, "oauth_user@example.com", pc_test.rw.HeaderMap["X-Auth-Request-Email"][0]) } +func TestAuthSkippedForPreflightRequests(t *testing.T) { + upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.WriteHeader(200) + w.Write([]byte("response")) + })) + defer upstream.Close() + + opts := NewOptions() + opts.Upstreams = append(opts.Upstreams, upstream.URL) + opts.ClientID = "bazquux" + opts.ClientSecret = "foobar" + opts.CookieSecret = "xyzzyplugh" + opts.SkipAuthPreflight = true + opts.Validate() + + upstream_url, _ := url.Parse(upstream.URL) + opts.provider = NewTestProvider(upstream_url, "") + + proxy := NewOAuthProxy(opts, func(string) bool { return false }) + rw := httptest.NewRecorder() + req, _ := http.NewRequest("OPTIONS", "/preflight-request", nil) + proxy.ServeHTTP(rw, req) + + assert.Equal(t, 200, rw.Code) + assert.Equal(t, "response", rw.Body.String()) +} + type SignatureAuthenticator struct { auth hmacauth.HmacAuth } diff --git a/options.go b/options.go index 63f23c6c..f1df9169 100644 --- a/options.go +++ b/options.go @@ -58,6 +58,7 @@ type Options struct { PassUserHeaders bool `flag:"pass-user-headers" cfg:"pass_user_headers"` SSLInsecureSkipVerify bool `flag:"ssl-insecure-skip-verify" cfg:"ssl_insecure_skip_verify"` SetXAuthRequest bool `flag:"set-xauthrequest" cfg:"set_xauthrequest"` + SkipAuthPreflight bool `flag:"skip-auth-preflight" cfg:"skip_auth_preflight"` // These options allow for other providers besides Google, with // potential overrides. @@ -99,6 +100,7 @@ func NewOptions() *Options { CookieExpire: time.Duration(168) * time.Hour, CookieRefresh: time.Duration(0), SetXAuthRequest: false, + SkipAuthPreflight: false, PassBasicAuth: true, PassUserHeaders: true, PassAccessToken: false, From 3fa5635d6c5d188a1ff25fe0e21318fdc93c1ec2 Mon Sep 17 00:00:00 2001 From: Jehiah Czebotar Date: Mon, 24 Apr 2017 12:11:23 -0400 Subject: [PATCH 03/13] Release 2.2.0 --- .travis.yml | 2 +- README.md | 4 +--- version.go | 2 +- 3 files changed, 3 insertions(+), 5 deletions(-) diff --git a/.travis.yml b/.travis.yml index c0db4d08..8c830da6 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,7 +1,7 @@ language: go go: - 1.7.5 - - 1.8 + - 1.8.1 script: - curl -s https://raw.githubusercontent.com/pote/gpm/v1.4.0/bin/gpm > gpm - chmod +x gpm diff --git a/README.md b/README.md index 68a8138a..86562c9d 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,6 @@ oauth2_proxy ================= -(This project was renamed from Google Auth Proxy - May 2015) - A reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accounts by email, domain or group. @@ -17,7 +15,7 @@ to validate accounts by email, domain or group. ## Installation -1. Download [Prebuilt Binary](https://github.com/bitly/oauth2_proxy/releases) (current release is `v2.1`) or build with `$ go get github.com/bitly/oauth2_proxy` which will put the binary in `$GOROOT/bin` +1. Download [Prebuilt Binary](https://github.com/bitly/oauth2_proxy/releases) (current release is `v2.2`) or build with `$ go get github.com/bitly/oauth2_proxy` which will put the binary in `$GOROOT/bin` 2. Select a Provider and Register an OAuth Application with a Provider 3. Configure OAuth2 Proxy using config file, command line options, or environment variables 4. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx) diff --git a/version.go b/version.go index 954119fd..b6074ba4 100644 --- a/version.go +++ b/version.go @@ -1,3 +1,3 @@ package main -const VERSION = "2.2.0-alpha" +const VERSION = "2.2.0" From f457a9042a12173896b838abd987d43a60a711f7 Mon Sep 17 00:00:00 2001 From: Jehiah Czebotar Date: Mon, 24 Apr 2017 12:16:16 -0400 Subject: [PATCH 04/13] Readme: update --help usage --- README.md | 96 ++++++++++++++++++++++++++++--------------------------- 1 file changed, 49 insertions(+), 47 deletions(-) diff --git a/README.md b/README.md index 86562c9d..be73f363 100644 --- a/README.md +++ b/README.md @@ -157,54 +157,56 @@ An example [oauth2_proxy.cfg](contrib/oauth2_proxy.cfg.example) config file is i ``` Usage of oauth2_proxy: - -approval-prompt="force": Oauth approval_prompt - -authenticated-emails-file="": authenticate against emails via file (one per line) - -azure-tenant="common": go to a tenant-specific or common (tenant-independent) endpoint. - -basic-auth-password="": the password to set when passing the HTTP Basic Auth header - -client-id="": the OAuth Client ID: ie: "123456.apps.googleusercontent.com" - -client-secret="": the OAuth Client Secret - -config="": path to config file - -cookie-domain="": an optional cookie domain to force cookies to (ie: .yourcompany.com)* - -cookie-expire=168h0m0s: expire timeframe for cookie - -cookie-httponly=true: set HttpOnly cookie flag - -cookie-name="_oauth2_proxy": the name of the cookie that the oauth_proxy creates - -cookie-refresh=0: refresh the cookie after this duration; 0 to disable - -cookie-secret="": the seed string for secure cookies - -cookie-secure=true: set secure (HTTPS) cookie flag - -custom-templates-dir="": path to custom html templates - -display-htpasswd-form=true: display username / password login form if an htpasswd file is provided - -email-domain=: authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email - -github-org="": restrict logins to members of this organisation - -github-team="": restrict logins to members of this team - -google-admin-email="": the google admin to impersonate for api calls - -google-group=: restrict logins to members of this google group (may be given multiple times). - -google-service-account-json="": the path to the service account json credentials - -htpasswd-file="": additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption - -http-address="127.0.0.1:4180": [http://]: or unix:// to listen on for HTTP clients - -https-address=":443": : to listen on for HTTPS clients - -login-url="": Authentication endpoint - -pass-access-token=false: pass OAuth access_token to upstream via X-Forwarded-Access-Token header - -pass-basic-auth=true: pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream - -pass-user-headers=true: pass X-Forwarded-User and X-Forwarded-Email information to upstream - -pass-host-header=true: pass the request Host Header to upstream - -profile-url="": Profile access endpoint - -provider="google": OAuth provider - -proxy-prefix="/oauth2": the url root path that this proxy should be nested under (e.g. //sign_in) - -redeem-url="": Token redemption endpoint - -redirect-url="": the OAuth Redirect URL. ie: "https://internalapp.yourcompany.com/oauth2/callback" - -resource="": the resource that is being protected. ie: "https://graph.windows.net". Currently only used in the Azure provider. - -request-logging=true: Log requests to stdout - -scope="": Oauth scope specification - -signature-key="": GAP-Signature request signature key (algorithm:secretkey) - -skip-auth-regex=: bypass authentication for requests path's that match (may be given multiple times) - -skip-auth-preflight=false: bypass authentication for OPTIONAL requests so preflight requests could succeed when using CORS - -skip-provider-button=false: will skip sign-in-page to directly reach the next step: oauth/start + -approval-prompt string: OAuth approval_prompt (default "force") + -authenticated-emails-file string: authenticate against emails via file (one per line) + -azure-tenant string: go to a tenant-specific or common (tenant-independent) endpoint. (default "common") + -basic-auth-password string: the password to set when passing the HTTP Basic Auth header + -client-id string: the OAuth Client ID: ie: "123456.apps.googleusercontent.com" + -client-secret string: the OAuth Client Secret + -config string: path to config file + -cookie-domain string: an optional cookie domain to force cookies to (ie: .yourcompany.com)* + -cookie-expire duration: expire timeframe for cookie (default 168h0m0s) + -cookie-httponly: set HttpOnly cookie flag (default true) + -cookie-name string: the name of the cookie that the oauth_proxy creates (default "_oauth2_proxy") + -cookie-refresh duration: refresh the cookie after this duration; 0 to disable + -cookie-secret string: the seed string for secure cookies (optionally base64 encoded) + -cookie-secure: set secure (HTTPS) cookie flag (default true) + -custom-templates-dir string: path to custom html templates + -display-htpasswd-form: display username / password login form if an htpasswd file is provided (default true) + -email-domain value: authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email + -footer string: custom footer string. Use "-" to disable default footer. + -github-org string: restrict logins to members of this organisation + -github-team string: restrict logins to members of this team + -google-admin-email string: the google admin to impersonate for api calls + -google-group value: restrict logins to members of this google group (may be given multiple times). + -google-service-account-json string: the path to the service account json credentials + -htpasswd-file string: additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption + -http-address string: [http://]: or unix:// to listen on for HTTP clients (default "127.0.0.1:4180") + -https-address string: : to listen on for HTTPS clients (default ":443") + -login-url string: Authentication endpoint + -pass-access-token: pass OAuth access_token to upstream via X-Forwarded-Access-Token header + -pass-basic-auth: pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream (default true) + -pass-host-header: pass the request Host Header to upstream (default true) + -pass-user-headers: pass X-Forwarded-User and X-Forwarded-Email information to upstream (default true) + -profile-url string: Profile access endpoint + -provider string: OAuth provider (default "google") + -proxy-prefix string: the url root path that this proxy should be nested under (e.g. //sign_in) (default "/oauth2") + -redeem-url string: Token redemption endpoint + -redirect-url string: the OAuth Redirect URL. ie: "https://internalapp.yourcompany.com/oauth2/callback" + -request-logging: Log requests to stdout (default true) + -resource string: The resource that is protected (Azure AD only) + -scope string: OAuth scope specification + -set-xauthrequest: set X-Auth-Request-User and X-Auth-Request-Email response headers (useful in Nginx auth_request mode) + -signature-key string: GAP-Signature request signature key (algorithm:secretkey) + -skip-auth-preflight: will skip authentication for OPTIONS requests + -skip-auth-regex value: bypass authentication for requests path's that match (may be given multiple times) + -skip-provider-button: will skip sign-in-page to directly reach the next step: oauth/start -ssl-insecure-skip-verify: skip validation of certificates presented when using HTTPS - -tls-cert="": path to certificate file - -tls-key="": path to private key file - -upstream=: the http url(s) of the upstream endpoint or file:// paths for static files. Routing is based on the path - -validate-url="": Access token validation endpoint - -version=false: print version string + -tls-cert string: path to certificate file + -tls-key string: path to private key file + -upstream value: the http url(s) of the upstream endpoint or file:// paths for static files. Routing is based on the path + -validate-url string: Access token validation endpoint + -version: print version string ``` See below for provider specific options From d7e327d712101e13d8be50deebec2bbddc90fda4 Mon Sep 17 00:00:00 2001 From: Pierce Lopez Date: Mon, 24 Apr 2017 16:04:06 -0400 Subject: [PATCH 05/13] bump to version 2.2.1-alpha for development --- version.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/version.go b/version.go index b6074ba4..e5b063a1 100644 --- a/version.go +++ b/version.go @@ -1,3 +1,3 @@ package main -const VERSION = "2.2.0" +const VERSION = "2.2.1-alpha" From 68e317881299c5e9c635348366638e97df8f9848 Mon Sep 17 00:00:00 2001 From: Pierce Lopez Date: Mon, 24 Apr 2017 16:04:36 -0400 Subject: [PATCH 06/13] dist.sh: use go build option to strip binaries 30% release binary size reduction --- dist.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dist.sh b/dist.sh index 99b13c63..18c5d02e 100755 --- a/dist.sh +++ b/dist.sh @@ -25,7 +25,8 @@ for os in windows linux darwin; do fi BUILD=$(mktemp -d ${TMPDIR:-/tmp}/oauth2_proxy.XXXXXX) TARGET="oauth2_proxy-$version.$os-$arch.$goversion" - GOOS=$os GOARCH=$arch CGO_ENABLED=0 go build -o $BUILD/$TARGET/oauth2_proxy$EXT || exit 1 + GOOS=$os GOARCH=$arch CGO_ENABLED=0 \ + go build -ldflags="-s -w" -o $BUILD/$TARGET/oauth2_proxy$EXT || exit 1 pushd $BUILD tar czvf $TARGET.tar.gz $TARGET mv $TARGET.tar.gz $DIR/dist From 7f5672b433f70478c79fe4f7294a92cb56a0b64b Mon Sep 17 00:00:00 2001 From: Pierce Lopez Date: Mon, 24 Apr 2017 17:56:15 -0400 Subject: [PATCH 07/13] README: simplify nginx auth_request example /oauth2/auth is not more sensitive than other /oauth2/ paths, does not need "internal" protection "spdy" protocol is obsolete, http2 is the thing to enable now. But it's orthogonal anyway. No need for two separate content/upstream location blocks in this example, reduce to just one, with a comment that it could be serving files instead of proxying. --- README.md | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) diff --git a/README.md b/README.md index be73f363..6ab8de58 100644 --- a/README.md +++ b/README.md @@ -350,15 +350,10 @@ The [Nginx `auth_request` directive](http://nginx.org/en/docs/http/ngx_http_auth ```nginx server { - listen 443 ssl spdy; + listen 443 ssl; server_name ...; include ssl/ssl.conf; - location = /oauth2/auth { - internal; - proxy_pass http://127.0.0.1:4180; - } - location /oauth2/ { proxy_pass http://127.0.0.1:4180; proxy_set_header Host $host; @@ -367,7 +362,7 @@ server { proxy_set_header X-Auth-Request-Redirect $request_uri; } - location /upstream/ { + location / { auth_request /oauth2/auth; error_page 401 = /oauth2/sign_in; @@ -379,13 +374,7 @@ server { proxy_set_header X-Email $email; proxy_pass http://backend/; - } - - location / { - auth_request /oauth2/auth; - error_page 401 = https://example.com/oauth2/sign_in; - - root /path/to/the/site; + # or "root /path/to/site;" or "fastcgi_pass ..." etc } } ``` From 6d295f8446b084bbfb81d94ac4058c466df443e9 Mon Sep 17 00:00:00 2001 From: Pierce Lopez Date: Mon, 24 Apr 2017 17:59:21 -0400 Subject: [PATCH 08/13] README: nginx auth_request example refresh cookie handling how to pass back the refreshed oauth2_proxy cookie from an nginx auth_request --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index 6ab8de58..da0962e4 100644 --- a/README.md +++ b/README.md @@ -373,6 +373,10 @@ server { proxy_set_header X-User $user; proxy_set_header X-Email $email; + # if you enabled --cookie-refresh, this is needed for it to work with auth_request + auth_request_set $auth_cookie $upstream_http_set_cookie; + add_header Set-Cookie $auth_cookie; + proxy_pass http://backend/; # or "root /path/to/site;" or "fastcgi_pass ..." etc } From 17b1fa31dd81fe8b308e996328f38a519844e95d Mon Sep 17 00:00:00 2001 From: Colin Arnott Date: Thu, 18 May 2017 03:45:34 +0000 Subject: [PATCH 09/13] use Authorization header, not access_token query parameter --- providers/github.go | 31 ++++++++++++++----------------- 1 file changed, 14 insertions(+), 17 deletions(-) diff --git a/providers/github.go b/providers/github.go index f6d78b2a..512eed86 100644 --- a/providers/github.go +++ b/providers/github.go @@ -62,8 +62,7 @@ func (p *GitHubProvider) hasOrg(accessToken string) (bool, error) { } params := url.Values{ - "access_token": {accessToken}, - "limit": {"100"}, + "limit": {"100"}, } endpoint := &url.URL{ @@ -74,6 +73,7 @@ func (p *GitHubProvider) hasOrg(accessToken string) (bool, error) { } req, _ := http.NewRequest("GET", endpoint.String(), nil) req.Header.Set("Accept", "application/vnd.github.v3+json") + req.Header.Set("Authorization", fmt.Sprintf("token %s", accessToken)) resp, err := http.DefaultClient.Do(req) if err != nil { return false, err @@ -86,7 +86,7 @@ func (p *GitHubProvider) hasOrg(accessToken string) (bool, error) { } if resp.StatusCode != 200 { return false, fmt.Errorf( - "got %d from %q %s", resp.StatusCode, stripToken(endpoint.String()), body) + "got %d from %q %s", resp.StatusCode, endpoint.String(), body) } if err := json.Unmarshal(body, &orgs); err != nil { @@ -118,8 +118,7 @@ func (p *GitHubProvider) hasOrgAndTeam(accessToken string) (bool, error) { } params := url.Values{ - "access_token": {accessToken}, - "limit": {"100"}, + "limit": {"100"}, } endpoint := &url.URL{ @@ -130,6 +129,7 @@ func (p *GitHubProvider) hasOrgAndTeam(accessToken string) (bool, error) { } req, _ := http.NewRequest("GET", endpoint.String(), nil) req.Header.Set("Accept", "application/vnd.github.v3+json") + req.Header.Set("Authorization", fmt.Sprintf("token %s", accessToken)) resp, err := http.DefaultClient.Do(req) if err != nil { return false, err @@ -142,7 +142,7 @@ func (p *GitHubProvider) hasOrgAndTeam(accessToken string) (bool, error) { } if resp.StatusCode != 200 { return false, fmt.Errorf( - "got %d from %q %s", resp.StatusCode, stripToken(endpoint.String()), body) + "got %d from %q %s", resp.StatusCode, endpoint.String(), body) } if err := json.Unmarshal(body, &teams); err != nil { @@ -198,17 +198,14 @@ func (p *GitHubProvider) GetEmailAddress(s *SessionState) (string, error) { } } - params := url.Values{ - "access_token": {s.AccessToken}, - } - endpoint := &url.URL{ - Scheme: p.ValidateURL.Scheme, - Host: p.ValidateURL.Host, - Path: path.Join(p.ValidateURL.Path, "/user/emails"), - RawQuery: params.Encode(), + Scheme: p.ValidateURL.Scheme, + Host: p.ValidateURL.Host, + Path: path.Join(p.ValidateURL.Path, "/user/emails"), } - resp, err := http.DefaultClient.Get(endpoint.String()) + req, _ := http.NewRequest("GET", endpoint.String(), nil) + req.Header.Set("Authorization", fmt.Sprintf("token %s", s.AccessToken)) + resp, err := http.DefaultClient.Do(req) if err != nil { return "", err } @@ -220,9 +217,9 @@ func (p *GitHubProvider) GetEmailAddress(s *SessionState) (string, error) { if resp.StatusCode != 200 { return "", fmt.Errorf("got %d from %q %s", - resp.StatusCode, stripToken(endpoint.String()), body) + resp.StatusCode, endpoint.String(), body) } else { - log.Printf("got %d from %q %s", resp.StatusCode, stripToken(endpoint.String()), body) + log.Printf("got %d from %q %s", resp.StatusCode, endpoint.String(), body) } if err := json.Unmarshal(body, &emails); err != nil { From c8c6b6646546fb04fa6c366e43d8b91bcfc90d08 Mon Sep 17 00:00:00 2001 From: Shivansh Dhar Date: Fri, 9 Jun 2017 12:17:24 -0400 Subject: [PATCH 10/13] Fix spelling mistake in docs --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index da0962e4..a62151ab 100644 --- a/README.md +++ b/README.md @@ -51,7 +51,7 @@ For Google, the registration steps are: * Choose **"Web application"** * Application name is freeform, choose something appropriate * Authorized JavaScript origins is your domain ex: `https://internal.yourcompany.com` - * Authorized redirect URIs is the location of oath2/callback ex: `https://internal.yourcompany.com/oauth2/callback` + * Authorized redirect URIs is the location of oauth2/callback ex: `https://internal.yourcompany.com/oauth2/callback` * Choose **"Create"** 4. Take note of the **Client ID** and **Client Secret** From 7fea71a4ceaa944439d9a06537b60df4eea3d9b3 Mon Sep 17 00:00:00 2001 From: Bart Spaans Date: Wed, 21 Jun 2017 11:03:24 +0100 Subject: [PATCH 11/13] Update Google Auth Provider instructions --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index a62151ab..85fd9201 100644 --- a/README.md +++ b/README.md @@ -42,7 +42,7 @@ For Google, the registration steps are: 1. Create a new project: https://console.developers.google.com/project 2. Choose the new project from the top right project dropdown (only if another project is selected) -3. In the project Dashboard center pane, choose **"Enable and manage APIs"** +3. In the project Dashboard center pane, choose **"API Manager"** 4. In the left Nav pane, choose **"Credentials"** 5. In the center pane, choose **"OAuth consent screen"** tab. Fill in **"Product name shown to users"** and hit save. 6. In the center pane, choose **"Credentials"** tab. From b80199762457ee30116c38d281b0b9e0f6045443 Mon Sep 17 00:00:00 2001 From: Pavel Sorokin Date: Mon, 26 Jun 2017 06:21:38 +0000 Subject: [PATCH 12/13] Fix incorrect "state" header --- options.go | 2 +- providers/azure.go | 20 +++++++++++++------- 2 files changed, 14 insertions(+), 8 deletions(-) diff --git a/options.go b/options.go index 1951af8b..951fa84f 100644 --- a/options.go +++ b/options.go @@ -109,7 +109,7 @@ func NewOptions() *Options { FilterGroups: "", PassAccessToken: false, PassHostHeader: true, - ApprovalPrompt: "force", + ApprovalPrompt: "", RequestLogging: true, } } diff --git a/providers/azure.go b/providers/azure.go index c131ef3f..5ce210e1 100644 --- a/providers/azure.go +++ b/providers/azure.go @@ -37,10 +37,10 @@ func NewAzureProvider(p *ProviderData) *AzureProvider { p.Scope = "openid" } - if p.ApprovalPrompt == "" || p.ApprovalPrompt == "force" { + if p.ApprovalPrompt == "force" { p.ApprovalPrompt = "consent" } - + log.Printf("Approval prompt: '%s'", p.ApprovalPrompt) return &AzureProvider{ProviderData: p} } @@ -194,7 +194,7 @@ func (p *AzureProvider) GetGroups(s *SessionState, f string) (string, error) { return strings.Join(groups, "|"), nil } -func (p *AzureProvider) GetLoginURL(redirectURI, finalRedirect string) string { +func (p *AzureProvider) GetLoginURL(redirectURI, state string) string { var a url.URL a = *p.LoginURL params, _ := url.ParseQuery(a.RawQuery) @@ -203,17 +203,23 @@ func (p *AzureProvider) GetLoginURL(redirectURI, finalRedirect string) string { params.Set("redirect_uri", redirectURI) params.Set("response_mode", "form_post") params.Add("scope", p.Scope) + params.Add("state", state) params.Set("prompt", p.ApprovalPrompt) params.Set("nonce", "FIXME") - if strings.HasPrefix(finalRedirect, "/") { - params.Add("state", finalRedirect) - } a.RawQuery = params.Encode() return a.String() } func (p *AzureProvider) SetGroupRestriction(groups []string) { - p.PermittedGroups = groups + if len(groups) == 1 && strings.Index(groups[0], "|") >= 0 { + p.PermittedGroups = strings.Split(groups[0], "|") + } else { + p.PermittedGroups = groups + } + log.Printf("Set group restrictions. Allowed groups are:") + for _, pGroup := range p.PermittedGroups { + log.Printf("\t'%s'", pGroup) + } } func (p *AzureProvider) ValidateGroup(s *SessionState) bool { From dba4f436c8b1b2d737bb072c1a1282b8fd3b6c63 Mon Sep 17 00:00:00 2001 From: Pavel Sorokin Date: Tue, 27 Jun 2017 08:33:35 +0800 Subject: [PATCH 13/13] Cleanup --- .gitignore | 1 - Vagrantfile | 29 ----------------------------- 2 files changed, 30 deletions(-) delete mode 100644 Vagrantfile diff --git a/.gitignore b/.gitignore index 7ded8226..c51af8d0 100644 --- a/.gitignore +++ b/.gitignore @@ -9,7 +9,6 @@ oauth2_proxy # Folders _obj _test -.vagrant # Architecture specific extensions/prefixes *.[568vq] diff --git a/Vagrantfile b/Vagrantfile deleted file mode 100644 index 76caec7d..00000000 --- a/Vagrantfile +++ /dev/null @@ -1,29 +0,0 @@ -# -*- mode: ruby -*- -# vi: set ft=ruby : - -Vagrant.configure("2") do |config| - - config.vm.box = "minimal/xenial64" - - config.vm.network "forwarded_port", guest: 8081, host: 8081 - config.vm.network "forwarded_port", guest: 8080, host: 8080 - - config.vm.synced_folder "../../../", "/home/vagrant/go/src/" - - config.vm.provider "virtualbox" do |vb| - vb.memory = "1024" - vb.customize ["modifyvm", :id, "--cableconnected1", "on"] - end - - config.vm.provision "shell", inline: <<-SHELL - apt-get update - apt-get install software-properties-common - add-apt-repository ppa:ubuntu-lxc/lxd-stable - apt-get update - apt-get install -y python golang - SHELL - - config.vm.provision "shell", inline: <<-SHELL - echo 'export GOPATH=$HOME/go' > /etc/profile.d/gopath.sh - SHELL -end